From b96dba1babba971cda538751164990a2d8efa623 Mon Sep 17 00:00:00 2001
From: Kun Chen <3233006+kunchenguid@users.noreply.github.com>
Date: Thu, 20 Aug 2026 23:28:39 -0700
Subject: [PATCH 01/11] fix(bearings): restore decision options and add close
 controls (#2707)

* fix(bearings): always show decision options and a close/drop control

Freeform-only Captain's Call cards hid the option buttons the board was designed around, and there was no way to drop a stale hold without inventing an answer. Require selectable options, keep freeform as a supplement, and route the reserved __drop__ answer through decline so the hold leaves Captain's Call.

* no-mistakes(review): Fix drop closure and decision-only option validation

* no-mistakes(review): Preserve answerability for non-decision cards

* no-mistakes(document): Clarify decision drop documentation
---
 .agents/skills/bearings/SKILL.md              |   8 +-
 .../bearings/assets/board-template.html       |  46 +++--
 .../skills/decision-hold-lifecycle/SKILL.md   |   1 +
 bin/fm-bearings-board.sh                      |  15 +-
 bin/fm-decision-hold.sh                       |  98 +++++++----
 docs/decision-hold-lifecycle.md               |  26 ++-
 tests/fm-bearings-board.test.sh               | 158 ++++++++++++++++++
 7 files changed, 303 insertions(+), 49 deletions(-)

diff --git a/.agents/skills/bearings/SKILL.md b/.agents/skills/bearings/SKILL.md
index 5f375dab2e..44199d0b55 100644
--- a/.agents/skills/bearings/SKILL.md
+++ b/.agents/skills/bearings/SKILL.md
@@ -77,6 +77,8 @@ Compose the payload from the same snapshot with the same ranking judgment as the
 
 - A Captain's Call decision key is the FULL hold identity from `decisions_open`; a merge card's key is `merge.<task-id>`; the Charted Next dispatch picker's key is `dispatch.charted`.
 - Decision cards carry agent-authored copy: a short noun-phrase title, one-line `about` and `decide` context rows, and option labels with hints, with the recommended option marked.
+- Every decision card must include at least one selectable option, and the board always renders freeform as a supplementary "something else" input, never the only control.
+- Do not use `__drop__` as an option value: that reserved answer is the card's Close / drop control, recognized by the keyed-answer intake as a decline.
 - Every Captain's Call item and every Underway, Recently Landed, and Charted Next row carries an explicit `repo` field. Fill it from the snapshot and task records wherever known; use null or an empty string only as the deliberate genuinely-no-repo marker, in which case the template may show the internal id. Ids otherwise stay in the payload only as the routing channel, and composed reasons name blockers in plain words.
 
 Run `build` once after composing the payload.
@@ -87,7 +89,11 @@ Never run `lavish-axi poll` for the board yourself: the armed source's supervise
 ### Handling a board wake
 
 A board answer arrives as an ordinary `procevent lavish <source-id> <sequence>` check wake. Identify it by comparing the wake source id with `bin/fm-procevent-lavish.sh source-id "$(bin/fm-bearings-board.sh path)"`, regardless of which answer kinds the result contains; then load `process-event-sources` and follow its contract for the result read, adapter classification, and the handled acknowledgement.
-Decision answers need no routing from you: the runner feeds the board's any-origin binding into `bin/fm-decision-hold.sh`'s one keyed-answer intake, which closes each full-identity hold at answer time; reconcile any `skipped:` key yourself, using `resolve` when routed work exists.
+Decision answers need no routing from you: the runner feeds the board's any-origin binding into `bin/fm-decision-hold.sh`'s one keyed-answer intake, which closes each full-identity hold at answer time.
+A reserved `__drop__` answer is the captain closing or dropping that hold, not a substantive choice and not a merge.
+The intake declines it through `bin/fm-decision-hold.sh` with a "dropped by captain" decision record, so the hold leaves Captain's Call on the next rebuild.
+Existing work routed behind that hold remains independent queued work; dropping does not close those dependents.
+Reconcile any other `skipped:` key yourself, using `resolve` when routed work exists.
 Route the non-decision keys yourself:
 
 - `merge.<task-id>` is the captain's explicit merge order; follow the merge ruling below.
diff --git a/.agents/skills/bearings/assets/board-template.html b/.agents/skills/bearings/assets/board-template.html
index c768f4d346..f31463f074 100644
--- a/.agents/skills/bearings/assets/board-template.html
+++ b/.agents/skills/bearings/assets/board-template.html
@@ -91,6 +91,8 @@
 .fm-btn--primary:hover { background: var(--rust-600); }
 .fm-btn--gold { background: var(--gold-500); color: var(--navy-700); border-color: var(--ink-900); box-shadow: var(--shadow-hard-sm); }
 .fm-btn--gold:hover { background: var(--gold-600); color: var(--white); }
+.fm-btn--ghost { background: transparent; color: var(--text-muted); border-color: var(--border-default); box-shadow: none; }
+.fm-btn--ghost:hover { background: var(--paper-100); color: var(--text-strong); border-color: var(--ink-300); }
 .fm-btn[disabled] { opacity: 0.5; cursor: not-allowed; }
 
 /* ---- fm-card ---- */
@@ -219,7 +221,9 @@
   letter-spacing: 0.07em; color: var(--navy-700); background: var(--gold-300);
   border: 1px solid var(--gold-600); border-radius: var(--radius-xs); padding: 3px 7px 2px; }
 .bb-opt:has(input:checked) { border-color: var(--rust-500); background: var(--rust-050); box-shadow: inset 0 0 0 1px var(--rust-500); }
-.bb-decision__foot { display: flex; align-items: center; gap: 10px; margin-top: auto; }
+.bb-decision__foot { display: flex; align-items: center; gap: 10px; margin-top: auto; flex-wrap: wrap; }
+.bb-drop { margin-left: auto; }
+.is-queued .bb-drop { display: none; }
 .bb-queued {
   display: none; align-items: center; gap: 6px;
   font-size: var(--fs-2xs); font-weight: 800; text-transform: uppercase; letter-spacing: 0.07em;
@@ -517,10 +521,14 @@
     });
     form.appendChild(opts);
 
-    if (item.allow_freeform) {
+    /* Decision cards always keep a supplementary "something else" box; merge
+       and credential cards keep the payload's allow_freeform flag. */
+    if (item.type === "decision" || item.allow_freeform) {
       var ff = document.createElement("input");
       ff.type = "text"; ff.name = "note"; ff.className = "bb-freeform";
-      ff.placeholder = item.freeform_hint || "or answer in your own words…";
+      ff.placeholder = item.freeform_hint || (item.type === "decision"
+        ? "or something else…"
+        : "or answer in your own words…");
       form.appendChild(ff);
     }
 
@@ -534,16 +542,18 @@
     var answerLimit = el("span", "bb-limit");
     answerLimit.setAttribute("role", "alert");
     foot.appendChild(answerLimit);
+    var dropBtn = null;
+    if (item.type === "decision") {
+      dropBtn = el("button", "fm-btn fm-btn--sm fm-btn--ghost bb-drop", "Close / drop");
+      dropBtn.type = "button";
+      dropBtn.setAttribute("aria-label", "Close or drop this decision");
+      foot.appendChild(dropBtn);
+    }
     form.appendChild(foot);
 
-    form.addEventListener("submit", function (ev) {
-      ev.preventDefault();
+    function queueAnswer(answer) {
+      if (card.classList.contains("is-queued")) return;
       answerLimit.classList.remove("is-visible");
-      var fd = new FormData(form);
-      var value = fd.get("answer");
-      var note = (fd.get("note") || "").trim();
-      /* picked option, optionally annotated; a bare note is itself the answer */
-      var answer = value ? (note ? value + " - " + note : value) : note;
       if (!answer) return;
       if (utf8ByteLength(answer) > 512) {
         answerLimit.textContent = "Answer is too long to queue (512 bytes maximum).";
@@ -560,7 +570,23 @@
       card.classList.add("is-queued");
       /* deal the next card once this one is answered */
       setTimeout(function () { showCard(active < cards.length - 1 ? active + 1 : active); }, 450);
+    }
+
+    form.addEventListener("submit", function (ev) {
+      ev.preventDefault();
+      var fd = new FormData(form);
+      var value = fd.get("answer");
+      var note = (fd.get("note") || "").trim();
+      /* picked option, optionally annotated; a bare note is itself the answer */
+      var answer = value ? (note ? value + " - " + note : value) : note;
+      queueAnswer(answer);
     });
+    if (dropBtn) {
+      dropBtn.addEventListener("click", function () {
+        /* reserved close/drop encoding; the keyed-answer intake declines it */
+        queueAnswer("__drop__");
+      });
+    }
 
     pad.appendChild(form);
     card.appendChild(pad);
diff --git a/.agents/skills/decision-hold-lifecycle/SKILL.md b/.agents/skills/decision-hold-lifecycle/SKILL.md
index dcb1eeb8a8..04a78f6b2a 100644
--- a/.agents/skills/decision-hold-lifecycle/SKILL.md
+++ b/.agents/skills/decision-hold-lifecycle/SKILL.md
@@ -25,6 +25,7 @@ When the captain's answer authorizes follow-up work, the hold remains the author
 When the captain's answer routes no follow-up work at all, such as a declined proposal, `bin/fm-decision-hold.sh decline` records that answer and closes the hold; it never substitutes for routing work the captain did authorize.
 When the captain simply answers a hold that has no follow-up work routed behind it yet, `bin/fm-decision-hold.sh answer` records that answer and closes the hold, so answering is closing rather than a separate later act that can be forgotten.
 "A keyed answer closes its matching hold" is one capability with one owner, `bin/fm-decision-hold.sh answers`, and every channel that carries a captain answer feeds it the same `<decision-key>` and answer.
+The exact answer `__drop__` is the reserved close/drop encoding owned by that script's header: the intake declines the hold with a dropped-by-captain record rather than recording a substantive answer, and closes only that hold while existing dependents remain independent queued work.
 A channel never maps a key to a hold, records a decision, or closes anything itself, so no channel is special and a new one needs no new closing logic.
 Chat already feeds it: `bin/fm-send.sh --resolve-key` answers a decision in whichever ledger still holds it open, including a decision already transferred to its durable hold.
 A captured-answer source feeds it too once bound with `bin/fm-decision-hold.sh bind <source-id> <origin-id>`, or with `--any-origin` for a source that carries answers across origins, such as the bearings board; bind before arming the source, and key each structured question by the hold's own decision key, or by its full hold identity under an any-origin binding.
diff --git a/bin/fm-bearings-board.sh b/bin/fm-bearings-board.sh
index 008b714b80..fd336763ae 100755
--- a/bin/fm-bearings-board.sh
+++ b/bin/fm-bearings-board.sh
@@ -32,8 +32,13 @@
 # Captain's Call item explicitly carries `repo`; the composer fills it from the
 # snapshot and task records wherever known, and uses null or an empty string
 # only as the deliberate genuinely-no-repo marker. In that exceptional case
-# the template may display the routing id. Anything else refuses before the
-# existing board is touched.
+# the template may display the routing id. Decision cards must include at least
+# one selectable option; every other Captain's Call item must either include an
+# option or explicitly allow freeform input. Option values cannot
+# be `__drop__`: that reserved answer is the board Close / drop encoding,
+# recognized by fm-decision-hold.sh's keyed-answer intake as a decline rather
+# than a substantive choice. Anything else refuses before the existing board
+# is touched.
 #
 # The board path is stable - $FM_HOME/.lavish/bearings-board.html - so a
 # re-invocation rebuilds the same file in place, which keeps the same Lavish
@@ -85,10 +90,14 @@ validate_payload() {  # <data.json>
       and repo_marker
       and (.title | nonempty_string)
       and (.options | type == "array")
-      and ((.options | length) > 0 or .allow_freeform == true)
+      and (if .type == "decision"
+        then (.options | length) > 0
+        else ((.options | length) > 0 or .allow_freeform == true)
+        end)
       and ([.options[]
         | type == "object"
           and (.value | slug(128))
+          and .value != "__drop__"
           and (.label | nonempty_string)
           and optional_string("hint")] | all)
       and (optional_string("about"))
diff --git a/bin/fm-decision-hold.sh b/bin/fm-decision-hold.sh
index 1e637de015..794336b232 100755
--- a/bin/fm-decision-hold.sh
+++ b/bin/fm-decision-hold.sh
@@ -59,20 +59,24 @@
 # separate later call nobody is forced to make. It records the captain's answer
 # on an actively held hold, records `(none)` as the routed identities because no
 # follow-up work has been routed behind the hold yet, and closes it. It shares
-# every guard `decline` has, including the refusal while any task is still
-# blocked by the hold, so a decision whose follow-up work is already routed still
-# goes through `resolve` and the routed-vs-unrouted distinction survives. It says
-# only that the captain answered; `decline` still says the captain answered with
-# no follow-up work at all.
+# every guard the public `decline` path has, including the refusal while any task
+# is still blocked by the hold, so a substantive decision whose follow-up work is
+# already routed still goes through `resolve` and the routed-vs-unrouted
+# distinction survives. It says only that the captain answered; an ordinary
+# `decline` still says the captain answered with no follow-up work at all. The
+# reserved keyed-answer drop described below is the sole internal exception.
 #
 # ONE KEYED-ANSWER INTAKE, FED BY EVERY CHANNEL.
 # "A keyed answer closes its matching hold" is a single capability, owned here
 # and nowhere else. `answers` is its channel-agnostic entry point: it reads
 # `<decision-key>\t<answer>\t<label>` lines on stdin, maps each key to this
 # origin's `<origin-id>-decision-<key>` hold, and closes it through the very same
-# `answer` path above, so every guard applies identically no matter which channel
-# the answer arrived on. With `--any-origin` in place of an origin id, each key
-# is instead a FULL hold identity `<origin>-decision-<key>`, split at its first
+# `answer` path above, except that the exact reserved answer `__drop__` closes
+# with a declined "dropped by captain" decision record rather than as a
+# substantive choice. Drop closes only the hold; existing dependent tasks remain
+# queued as independent work. Every other guard applies identically no matter
+# which channel the answer arrived on. With `--any-origin` in place of an origin
+# id, each key is instead a FULL hold identity `<origin>-decision-<key>`, split at its first
 # `-decision-`, so one source can carry answers for holds across origins - the
 # aggregation a bearings board needs. An origin id that itself contains
 # `-decision-` is outside any-origin resolution; bind such a source to its one
@@ -85,15 +89,16 @@
 #
 # A channel's ONLY job is to turn whatever it received into those keyed lines and
 # pipe them here. It must never map keys to holds, build decision records, decide
-# resolve-versus-decline, or close a hold itself. A future channel needs no change
-# here at all.
+# resolve-versus-decline, or close a hold itself. Emitting `__drop__` is how a
+# channel reports that the captain dropped the decision; this intake, not the
+# channel, chooses `decline`. A future channel needs no change here at all.
 #
 # The decision text is a pure function of (source, key, answer, label), which is
 # what makes a replayed delivery an idempotent no-op rather than a rejected
-# "different captain decision". A key whose hold is absent, already closed, or
-# still blocking routed work is reported as `skipped:` and left for `resolve`;
-# skipping is never forced closure, and the command exits nonzero when any key
-# was skipped.
+# "different captain decision". A key whose hold is absent or already closed is
+# reported as `skipped:`; a substantive answer whose hold still blocks routed
+# work is also skipped and left for `resolve`. A reserved drop still closes only
+# that hold, and the command exits nonzero when any key was skipped.
 #
 # `bind`, `unbind`, and `binding` record whether a captured-answer SOURCE belongs
 # to one origin or uses the any-origin intake, for any channel whose answers arrive detached from the origin (a
@@ -107,11 +112,12 @@
 # accepts it, so the process-event runner feeds an any-origin source through the
 # same seam with no runner change.
 #
-# `decline` is the unrouted path for a decision the captain answered with no
-# follow-up work. It takes no --routed-to task, records `(none)` as the routed
-# identities, and closes an actively held hold. It refuses while any task is still
-# blocked by the hold, because releasing routed work without recording it is
-# `resolve`'s job.
+# Public `decline` is the unrouted path for a decision the captain answered with
+# no follow-up work. It takes no --routed-to task, records `(none)` as the routed
+# identities, and closes an actively held hold. It refuses while any task is
+# still blocked by the hold, because releasing routed work without recording it
+# is `resolve`'s job. Only `answers` may invoke its private drop mode, which
+# closes the stale hold without closing or recording existing dependents.
 #
 # `repair` records the missing resolution block on a hold that was already closed
 # outside this script, so `verify` stops failing on an origin whose decision was
@@ -633,14 +639,12 @@ parse_decision_only_flags() {  # <args...>; prints the --decision-file value
   printf '%s' "$decision_file"
 }
 
-# The one unrouted close path, shared by `answer` and `decline`. They differ only
-# in the resolution mode they record and the outcome word they print; every
-# guard - the captain decision file, the active-hold requirement, the retry
-# identity, and the refusal to release still-routed work - is identical, so
-# neither can drift into a weaker close than the other.
-close_unrouted_hold() {  # <mode> <outcome-word> <origin-id> <decision-key> <flag-args...>
-  local mode=$1 outcome=$2 origin=$3 key=$4 decision_file id body hold_show hold_body state dependents
-  shift 4
+# The one non-routing close path, shared by `answer`, `decline`, and the reserved
+# drop intake. Answer and decline refuse still-routed work. Drop closes only the
+# stale hold, leaving existing dependent tasks as independent work.
+close_unrouted_hold() {  # <mode> <outcome-word> <preserve-routed> <origin-id> <decision-key> <flag-args...>
+  local mode=$1 outcome=$2 preserve_routed=$3 origin=$4 key=$5 decision_file id body hold_show hold_body state dependents
+  shift 5
   decision_file=$(parse_decision_only_flags "$@") || exit 2
   validate_slug origin-id "$origin"
   validate_slug decision-key "$key"
@@ -666,7 +670,7 @@ close_unrouted_hold() {  # <mode> <outcome-word> <origin-id> <decision-key> <fla
       ;;
   esac
   dependents=$(tasks_blocked_by "$id") || exit 1
-  [ -z "$dependents" ] \
+  [ -z "$dependents" ] || [ "$preserve_routed" = yes ] \
     || fail "captain hold $id still blocks routed work ($dependents); use resolve to record that work"
   body=$(resolution_body "$mode" "$ROUTED_NONE")
   tasks_axi update "$id" --body "$body" >/dev/null \
@@ -678,7 +682,7 @@ close_unrouted_hold() {  # <mode> <outcome-word> <origin-id> <decision-key> <fla
 
 command_answer() {
   [ "$#" -ge 2 ] || { usage >&2; exit 2; }
-  close_unrouted_hold answered answered "$@"
+  close_unrouted_hold answered answered no "$@"
 }
 
 # --- the one keyed-answer intake, and the source bindings that feed it --------
@@ -691,6 +695,11 @@ BINDING_SCHEMA=fm-decision-binding.v1
 # which is what lets the runner's feed seam carry an any-origin source unchanged.
 BINDING_ANY='(any)'
 
+# Reserved close/drop answer. Exact match after sanitize. The bearings board's
+# Close / drop control emits this value; this intake declines the matching hold
+# with a "dropped by captain" record rather than recording a substantive answer.
+DROP_ANSWER='__drop__'
+
 validate_source_id() {  # <source-id>
   validate_slug source-id "$1"
   [ "${#1}" -le 64 ] || fail "source-id must be at most 64 characters: $1"
@@ -766,6 +775,16 @@ keyed_decision_text() {  # <source> <key> <answer> <label>
   [ -z "$4" ] || printf 'Answer as shown to the captain: %s\n' "$4"
 }
 
+# The durable record for a reserved close/drop answer. Pure function of source,
+# key, and label so a replayed drop is idempotent; it never records `__drop__`
+# as if it were a substantive choice.
+keyed_drop_decision_text() {  # <source> <key> <label>
+  printf 'Captain dropped this decision through %s.\n' "$1"
+  printf 'Decision key: %s\n' "$2"
+  printf 'dropped by captain\n'
+  [ -z "$3" ] || printf 'Answer as shown to the captain: %s\n' "$3"
+}
+
 sanitize_field() {  # <text>
   printf '%s' "$1" | tr '\n\r\t' '   ' | LC_ALL=C tr -d '\000-\037\177' | cut -c1-512
 }
@@ -825,6 +844,19 @@ command_answers() {
       k_key=$key
       hold="$origin-decision-$key"
     fi
+    if [ "$answer" = "$DROP_ANSWER" ]; then
+      keyed_drop_decision_text "$source" "$k_key" "$label" > "$tmp" \
+        || fail "cannot stage the captain decision for $hold"
+      if "$0" decline "$k_origin" "$k_key" --decision-file "$tmp" --drop >/dev/null 2>"$err"; then
+        printf 'closed: %s\n' "$hold"
+        closed=$((closed + 1))
+      else
+        reason=$(tr -d '\n' < "$err" | sed 's/^fm-decision-hold: //')
+        printf 'skipped: %s (%s)\n' "$hold" "$reason"
+        skipped=$((skipped + 1))
+      fi
+      continue
+    fi
     keyed_decision_text "$source" "$k_key" "$answer" "$label" > "$tmp" \
       || fail "cannot stage the captain decision for $hold"
     if "$0" answer "$k_origin" "$k_key" --decision-file "$tmp" >/dev/null 2>"$err"; then
@@ -842,8 +874,14 @@ command_answers() {
 }
 
 command_decline() {
+  local preserve_routed=no last
   [ "$#" -ge 2 ] || { usage >&2; exit 2; }
-  close_unrouted_hold declined declined "$@"
+  if [ "${!#}" = --drop ]; then
+    preserve_routed=yes
+    last=$(($# - 1))
+    set -- "${@:1:last}"
+  fi
+  close_unrouted_hold declined declined "$preserve_routed" "$@"
 }
 
 command_repair() {
diff --git a/docs/decision-hold-lifecycle.md b/docs/decision-hold-lifecycle.md
index 1bcb63dcee..eb5e15972c 100644
--- a/docs/decision-hold-lifecycle.md
+++ b/docs/decision-hold-lifecycle.md
@@ -31,10 +31,11 @@ The `resolve` subcommand is the routed path and additionally requires at least o
 It clears each dependency edge through tasks-axi and marks the hold Done only after those writes succeed.
 An exact retry can finish a partial routing operation, and a failed intermediate step leaves the hold open.
 
-The `answer` and `decline` subcommands share one unrouted close implementation and differ only in the `Resolution mode:` they record and the outcome word they print, so neither can drift into a weaker close than the other.
-Both record `(none)` as the routed identities and refuse while any task in the same backlog is still blocked by the hold, because releasing routed work without recording it is `resolve`'s job.
+The public `answer` and `decline` subcommands share one unrouted close implementation and differ only in the `Resolution mode:` they record and the outcome word they print, so neither can drift into a weaker ordinary close than the other.
+Both ordinarily record `(none)` as the routed identities and refuse while any task in the same backlog is still blocked by the hold, because releasing routed work without recording it is `resolve`'s job.
+The keyed-answer intake's reserved drop is the sole exception: its internal decline invocation closes only the stale hold and deliberately leaves existing dependents as independent queued work.
 Every candidate found in the listing prefilter is confirmed against its own structured record before the refusal is reported.
-`answer` exists so the act carrying a captain answer can also be the act that closes its hold; `decline` continues to mean the stronger claim that the answer routes no follow-up work at all.
+`answer` exists so the act carrying a captain answer can also be the act that closes its hold; an ordinary `decline` continues to mean the stronger claim that the answer routes no follow-up work at all.
 
 The `repair` subcommand records the resolution block on a hold that was already closed outside the script, such as by a direct `tasks-axi done`, so an origin whose decision was genuinely answered stops failing `verify`.
 It refuses a hold that is still actively held, never reopens a closed hold, and never clears a dependency edge, so an unanswered decision keeps blocking teardown until the captain's word closes it.
@@ -46,12 +47,14 @@ The live status-log decision ledger has always had answer-time closure through `
 The durable hold ledger did not, so an answer could be captured, believed, and even implemented while its hold stayed open, and the captain could then be asked to re-answer a decision already on disk.
 
 "A keyed answer closes its matching hold" is now one capability with one owner.
-`answers` is its channel-agnostic entry point: it reads a key, answer, and label on each input line and closes the matching hold through the same `answer` path, so every guard applies identically no matter which channel the answer arrived on.
+`answers` is its channel-agnostic entry point: it reads a key, answer, and label on each input line and closes the matching hold through the same `answer` path, except that the exact reserved answer `__drop__` closes with a declined, "dropped by captain" decision record rather than as a substantive choice.
 For a single-origin intake the key is the decision key mapped under that bound origin; for the cross-origin intake it is the full hold identity, while keys that do not name a full decision hold feed nothing.
 `--source` is provenance text recorded in the durable decision, never a behavior switch, and the command carries no per-channel branch and no knowledge of chat, review decks, or any transport.
 A channel's only job is to turn whatever it received into those keyed lines and pipe them in; it never maps keys to holds, builds decision records, chooses between the close paths, or closes a hold itself.
+Emitting `__drop__` is how a channel reports that the captain dropped the decision; the intake, not the channel, chooses `decline`.
 The decision text is a pure function of source, key, answer, and label, which is what makes a replayed delivery an idempotent no-op rather than a rejected different decision.
-A key whose hold is absent, already closed, or still blocking routed work is reported as skipped and left for `resolve`, and the command exits nonzero when any key was skipped.
+A key whose hold is absent or already closed is reported as skipped, as is a substantive answer whose hold still blocks routed work; a reserved drop instead closes only that hold while existing dependents remain independent queued work.
+The command exits nonzero when any key was skipped.
 
 `bind`, `unbind`, and `binding` record whether a captured-answer source belongs to one origin or uses the cross-origin intake, for a channel whose answers arrive detached from the origin.
 The binding is a private record under `state/decision-bindings/`, and a source with no binding feeds nothing, so the path is opt-in per source.
@@ -89,6 +92,7 @@ Plural blocker-readiness and mixed-home projection verification date: 2026-07-22
 Unrouted close-path verification date: 2026-08-13.
 Answer-time closure verification date: 2026-08-16.
 Cross-origin answer-time closure verification date: 2026-08-19.
+Reserved close/drop answer verification date: 2026-08-20.
 
 The focused end-to-end regression uses only synthetic `sample` identities and decision text.
 It begins with a completed investigation and visual review whose genuine unresolved choice exists only in the report.
@@ -108,6 +112,7 @@ The capture is left unacknowledged throughout, so the wake firstmate needs in or
 A replayed delivery closes nothing new and is not rejected as a different decision, a source with no binding closes nothing at all, and the `answer` subcommand itself refuses an empty or missing decision file, an absent hold, and a drifted retry.
 A separate regression drives the real `fm-send` over a stubbed transport to prove the chat channel reaches the same intake for a decision already transferred to its hold, which the status ledger alone can no longer close.
 The cross-origin regression drives a bound source through the real runner and adapter interface, closes full-identity holds from different origins, and proves that over-limit, malformed, non-decision, routed-work, absent-hold, and replayed answers all fail or skip without weakening the existing guards.
+A reserved `__drop__` answer through that same published poll shape declines the matching hold with a dropped-by-captain record and leaves Bearings' Captain's Call even when existing independent work is routed behind it; that dependent work remains queued and is not closed.
 
 The final verification commands and their exact summarized outputs follow.
 
@@ -131,6 +136,17 @@ ok - an any-origin bound source closes full-identity holds across origins
 ok - the answer path keeps every guard the unrouted close path already had
 ok - the chat channel feeds the same keyed-answer intake a captured review does
 
+$ bash tests/fm-bearings-board.test.sh
+ok - path prints the stable home-scoped board location
+ok - build refuses malformed payloads before touching the board
+ok - build keeps freeform-only credential cards valid
+ok - build injects the payload, binds any-origin, then arms the source
+ok - registration can consume answers only after any-origin binding exists
+ok - build establishes the Lavish session before binding and arming
+ok - rebuild refreshes the board in place without double-arming
+ok - build refuses a template without exactly one data slot
+ok - a reserved close/drop answer declines the hold and leaves Captain's Call
+
 $ bash tests/fm-fleet-snapshot-view.test.sh
 ok - backlog normalization preserves strict roles and resolves every blocker compatibly
 ok - durable captain-held transfer closes the duplicate live status decision
diff --git a/tests/fm-bearings-board.test.sh b/tests/fm-bearings-board.test.sh
index 1bf22ae88b..5025dacca5 100644
--- a/tests/fm-bearings-board.test.sh
+++ b/tests/fm-bearings-board.test.sh
@@ -170,6 +170,30 @@ test_build_refuses_malformed_payloads_before_touching_the_board() {
   set +e; out=$(run_board "$home" build "$data" 2>&1); rc=$?; set -e
   [ "$rc" -ne 0 ] || fail "an unanswerable captains_call item was accepted"
 
+  write_valid_payload "$data"
+  jq '.captains_call[0].options = [] | .captains_call[0].allow_freeform = true' "$data" > "$data.tmp" \
+    && mv "$data.tmp" "$data"
+  set +e; out=$(run_board "$home" build "$data" 2>&1); rc=$?; set -e
+  [ "$rc" -ne 0 ] || fail "a freeform-only captains_call item without options was accepted"
+
+  write_valid_payload "$data"
+  jq '.captains_call[1].options = [] | .captains_call[1].allow_freeform = false' "$data" > "$data.tmp" \
+    && mv "$data.tmp" "$data"
+  set +e; out=$(run_board "$home" build "$data" 2>&1); rc=$?; set -e
+  [ "$rc" -ne 0 ] || fail "an optionless merge card with freeform disabled was accepted"
+
+  write_valid_payload "$data"
+  jq '.captains_call[0].type = "credential"
+    | .captains_call[0].options = []
+    | del(.captains_call[0].allow_freeform)' "$data" > "$data.tmp" && mv "$data.tmp" "$data"
+  set +e; out=$(run_board "$home" build "$data" 2>&1); rc=$?; set -e
+  [ "$rc" -ne 0 ] || fail "an optionless credential card without freeform permission was accepted"
+
+  write_valid_payload "$data"
+  jq '.captains_call[0].options[0].value = "__drop__"' "$data" > "$data.tmp" && mv "$data.tmp" "$data"
+  set +e; out=$(run_board "$home" build "$data" 2>&1); rc=$?; set -e
+  [ "$rc" -ne 0 ] || fail "a captains_call option reserved for close/drop was accepted"
+
   write_valid_payload "$data"
   jq '.captains_call[1].pr_url = "javascript:alert(1)"' "$data" > "$data.tmp" && mv "$data.tmp" "$data"
   set +e; out=$(run_board "$home" build "$data" 2>&1); rc=$?; set -e
@@ -190,6 +214,22 @@ test_build_refuses_malformed_payloads_before_touching_the_board() {
   pass "build refuses malformed payloads before touching the board"
 }
 
+test_build_accepts_a_freeform_only_credential_card() {
+  local home data board
+  home=$(make_home credential)
+  data="$home/payload.json"
+  board="$home/.lavish/bearings-board.html"
+  write_valid_payload "$data"
+  jq '.captains_call[0].type = "credential"
+    | .captains_call[0].options = []
+    | .captains_call[0].allow_freeform = true' "$data" > "$data.tmp" && mv "$data.tmp" "$data"
+
+  run_board "$home" build "$data" >/dev/null \
+    || fail "a freeform-only credential card was refused"
+  [ -f "$board" ] || fail "a valid freeform-only credential card did not build a board"
+  pass "build keeps freeform-only credential cards valid"
+}
+
 test_build_injects_binds_then_arms() {
   local home data board out sid
   home=$(make_home build)
@@ -370,10 +410,128 @@ test_build_refuses_a_template_without_exactly_one_slot() {
   pass "build refuses a template without exactly one data slot"
 }
 
+# The board Close / drop control emits the reserved answer `__drop__`. The
+# keyed-answer intake must decline that hold with a dropped-by-captain record
+# so it leaves Captain's Call, without treating the encoding as a choice.
+test_drop_answer_declines_the_hold_without_a_substantive_choice() {
+  local home origin key hold routed_hold result out show json rc
+  home=$(make_home drop-close)
+  origin=sample-board-drop
+  key=stale-choice
+  hold="$origin-decision-$key"
+  result="$home/drop.result"
+
+  command -v tasks-axi >/dev/null 2>&1 || { echo "skip: tasks-axi not found"; return 0; }
+  cp "$ROOT/.tasks.toml" "$home/.tasks.toml"
+  cat > "$home/data/backlog.md" <<'EOF'
+## In flight
+
+## Queued
+
+## Done
+EOF
+  fm_write_meta "$home/state/$origin.meta" "project=$home/projects/sample" "kind=scout"
+  (cd "$home" && tasks-axi add "$origin" "Review sample board drop" --kind scout --repo sample --start) >/dev/null \
+    || fail "could not create the drop-close origin"
+  run_decisions "$home" hold "$origin" "$key" \
+    --title "Drop this stale choice" --reason "captain stale choice pending" --repo sample >/dev/null \
+    || fail "could not create the drop-close captain hold"
+  run_decisions "$home" complete "$origin" "$key" >/dev/null \
+    || fail "completion failed for the drop-close hold"
+
+  json=$(PATH="$home/fakebin:$PATH" FM_HOME="$home" FM_BEARINGS_NOW=2026-08-20T12:00:00Z \
+    "$ROOT/bin/fm-bearings-snapshot.sh" --json) \
+    || fail "Bearings failed before a reserved close/drop"
+  printf '%s' "$json" | jq -e --arg hold "$hold" '
+    .decisions_open | any(.id == $hold)
+  ' >/dev/null || fail "the drop-close hold was not an open Captain's Call before drop: $json"
+
+  cat > "$result" <<EOF
+session:
+  file: /bearings-board.html
+  status: feedback
+prompts[1]{uid,prompt,selector,tag,text}:
+  "2","Stale choice: __drop__\\n\\nContext data:\\n{\\n  \\"question\\": \\"$hold\\",\\n  \\"answer\\": \\"__drop__\\"\\n}","form",choice,"Stale choice -> __drop__"
+EOF
+
+  out=$(PATH="$home/fakebin:$PATH" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
+    "$ROOT/bin/fm-procevent-lavish.sh" answers "$result") \
+    || fail "the adapter did not report the reserved close/drop answer"
+  assert_contains "$out" "$hold	__drop__" \
+    "the adapter dropped the reserved close/drop encoding: $out"
+
+  set +e
+  out=$(printf '%s\n' "$out" | run_decisions "$home" answers --any-origin \
+    --source "the captured result board-drop sequence 1" 2>&1)
+  rc=$?
+  set -e
+  [ "$rc" -eq 0 ] || fail "a reserved close/drop answer did not close its hold: $out"
+  assert_contains "$out" "closed: $hold" "the intake did not close the dropped hold: $out"
+
+  show=$(cd "$home" && tasks-axi show "$hold" --full) \
+    || fail "the dropped captain hold disappeared"
+  assert_contains "$show" "state: done" "a reserved close/drop answer left the hold open"
+  assert_contains "$show" "Resolution mode: declined" \
+    "a reserved close/drop answer was recorded as a substantive answer"
+  assert_contains "$show" "dropped by captain" \
+    "a reserved close/drop answer lost the dropped-by-captain decision record"
+  assert_not_contains "$show" "Answer: __drop__" \
+    "a reserved close/drop answer was recorded as if __drop__ were a choice"
+
+  json=$(PATH="$home/fakebin:$PATH" FM_HOME="$home" FM_BEARINGS_NOW=2026-08-20T12:00:00Z \
+    "$ROOT/bin/fm-bearings-snapshot.sh" --json) \
+    || fail "Bearings failed after a reserved close/drop"
+  printf '%s' "$json" | jq -e --arg hold "$hold" '
+    (.decisions_open | any(.id == $hold) | not)
+  ' >/dev/null || fail "a dropped decision remained an open Captain's Call: $json"
+
+  set +e
+  out=$(printf '%s\t%s\t%s\n' "$hold" "__drop__" "Stale choice -> __drop__" \
+    | run_decisions "$home" answers --any-origin \
+      --source "the captured result board-drop sequence 1" 2>&1)
+  rc=$?
+  set -e
+  [ "$rc" -eq 0 ] || fail "replaying an identical close/drop was not idempotent: $out"
+
+  routed_hold=$(run_decisions "$home" hold "$origin" still-routed \
+    --title "Still routed" --reason "captain routed choice pending" --repo sample) \
+    || fail "could not create the routed drop-close hold"
+  (cd "$home" && tasks-axi add sample-routed-drop "Apply the routed drop" \
+    --kind ship --repo sample --blocked-by "$routed_hold") >/dev/null \
+    || fail "could not route work behind the drop-close hold"
+  set +e
+  out=$(printf '%s\t%s\t%s\n' "$routed_hold" "__drop__" "Close / drop" \
+    | run_decisions "$home" answers --any-origin \
+      --source "the captured result board-drop sequence 2" 2>&1)
+  rc=$?
+  set -e
+  [ "$rc" -eq 0 ] || fail "a close/drop did not close a hold with existing routed work: $out"
+  assert_contains "$out" "closed: $routed_hold" \
+    "a close/drop on routed work was not reported as closed: $out"
+  show=$(cd "$home" && tasks-axi show "$routed_hold" --full)
+  assert_contains "$show" "state: done" \
+    "a close/drop left the routed hold open"
+  show=$(cd "$home" && tasks-axi show sample-routed-drop --full)
+  assert_contains "$show" "state: queued" \
+    "a close/drop cascaded into the existing dependent work"
+  assert_contains "$show" "blocked: no" \
+    "existing dependent work did not become independent after the hold closed"
+  json=$(PATH="$home/fakebin:$PATH" FM_HOME="$home" FM_BEARINGS_NOW=2026-08-20T12:00:00Z \
+    "$ROOT/bin/fm-bearings-snapshot.sh" --json) \
+    || fail "Bearings failed after dropping a hold with routed work"
+  printf '%s' "$json" | jq -e --arg hold "$routed_hold" '
+    (.decisions_open | any(.id == $hold) | not)
+  ' >/dev/null || fail "a dropped routed decision remained in Captain's Call: $json"
+  pass "a reserved close/drop answer declines the hold and leaves Captain's Call"
+}
+
 test_path_is_stable_and_home_scoped
 test_build_refuses_malformed_payloads_before_touching_the_board
+test_build_accepts_a_freeform_only_credential_card
 test_build_injects_binds_then_arms
 test_registration_cannot_consume_before_any_origin_binding
 test_build_does_not_bind_or_arm_when_session_start_fails
 test_rebuild_is_idempotent_and_does_not_double_arm
 test_build_refuses_a_template_without_exactly_one_slot
+test_drop_answer_declines_the_hold_without_a_substantive_choice

From a0cec26321d01a061daee40fdcca71bdd80ebf47 Mon Sep 17 00:00:00 2001
From: Kun Chen <3233006+kunchenguid@users.noreply.github.com>
Date: Thu, 20 Aug 2026 23:30:38 -0700
Subject: [PATCH 02/11] ci: require no-mistakes pipeline step attestation
 (#2710)

Signature-only PRs can hide skipped review, test, or document steps. Fail unless no-mistakes >= 1.46.0 attests those three steps completed.
---
 .github/workflows/no-mistakes-required.yml | 69 ++++++++++++++++++++++
 1 file changed, 69 insertions(+)

diff --git a/.github/workflows/no-mistakes-required.yml b/.github/workflows/no-mistakes-required.yml
index f56afee418..af5564e865 100644
--- a/.github/workflows/no-mistakes-required.yml
+++ b/.github/workflows/no-mistakes-required.yml
@@ -36,6 +36,75 @@ jobs:
           marker='Updates from [git push no-mistakes](https://github.com/kunchenguid/no-mistakes)'
           if printf '%s' "${PR_BODY:-}" | grep -qF -- "$marker"; then
             echo "Found no-mistakes signature in PR #${PR_NUMBER} body."
+            if ! command -v jq >/dev/null 2>&1; then
+              echo "::error::This check requires jq to parse no-mistakes pipeline step attestation, but jq was not found on the runner." >&2
+              exit 1
+            fi
+            prefix='<!-- no-mistakes-pipeline-attestation:v1 '
+            suffix=' -->'
+            body="${PR_BODY:-}"
+            json=''
+            parse_ok=0
+            case "$body" in
+              *"$prefix"*)
+                rest="${body#*"$prefix"}"
+                case "$rest" in
+                  *"$suffix"*)
+                    json="${rest%%"$suffix"*}"
+                    if printf '%s' "$json" | jq -e . >/dev/null 2>&1; then
+                      parse_ok=1
+                    fi
+                    ;;
+                esac
+                ;;
+            esac
+            if [ "$parse_ok" -ne 1 ]; then
+              {
+                echo "::error::This repository requires no-mistakes >= 1.46.0; structured pipeline step attestation is missing or unparseable."
+                echo
+                echo "The no-mistakes signature was found, but this check also requires one"
+                echo "HTML comment in the PR body:"
+                echo
+                echo '    <!-- no-mistakes-pipeline-attestation:v1 {"head_sha":"...","steps":[...]} -->'
+                echo
+                echo "That comment is emitted by no-mistakes >= 1.46.0 (the release that started"
+                echo "emitting structured step attestation; see https://github.com/kunchenguid/no-mistakes/pull/670)."
+                echo "An older no-mistakes that writes only the signature line is not enough."
+                echo
+                echo "Re-run the pipeline with 'git push no-mistakes' using no-mistakes >= 1.46.0."
+                echo "See CONTRIBUTING.md for setup and the full workflow."
+                echo
+                echo "PR author: ${PR_AUTHOR}"
+              } >&2
+              exit 1
+            fi
+            incomplete=''
+            for required in review test document; do
+              status=$(printf '%s' "$json" | jq -r --arg step "$required" \
+                '([(.steps | arrays | .[]) | select(.step == $step) | .status] | first // empty | select(. != "")) // "missing"')
+              if [ "$status" != "completed" ]; then
+                if [ -n "$incomplete" ]; then
+                  incomplete="${incomplete}, "
+                fi
+                incomplete="${incomplete}${required}=${status}"
+              fi
+            done
+            if [ -n "$incomplete" ]; then
+              {
+                echo "::error::Required no-mistakes pipeline steps are not completed: ${incomplete}."
+                echo
+                echo "This repository requires review, test, and document to each have status"
+                echo "exactly 'completed'. Quota skips and agent skips are not compliant."
+                echo
+                echo "Re-run the pipeline with 'git push no-mistakes' using no-mistakes >= 1.46.0"
+                echo "so those required steps complete rather than skip."
+                echo "See CONTRIBUTING.md for setup and the full workflow."
+                echo
+                echo "PR author: ${PR_AUTHOR}"
+              } >&2
+              exit 1
+            fi
+            echo "Pipeline step attestation is valid: review, test, and document are completed."
             exit 0
           fi
           {

From 99b21d82db4ecd02f3dbbe0a1d49e2d8c5630351 Mon Sep 17 00:00:00 2001
From: Kun Chen <3233006+kunchenguid@users.noreply.github.com>
Date: Fri, 21 Aug 2026 00:58:00 -0700
Subject: [PATCH 03/11] feat: collapse decisions into tasks held for the
 captain (#2728)

* feat(captain-hold): collapse the decisions concept into tasks held for the captain

A decision is no longer a separate type: it is an ordinary backlog task held
for the captain, identified by its task id. bin/fm-captain-hold.sh owns the
surviving behaviors - guarded hold creation, the recorded-answer close
(answer/answers with a release mode for captain-gated work), the source
bindings, and the investigation completion gate - and bin/fm-decision-hold.sh
becomes a one-release compatibility shim over it.

The fleet snapshot now parses hold-until and computes captain_actionable as
queued + captain-held + unblocked + due, independent of row kind, plus a
presentation-only deferred_marker for prose-deferred rows. Bearings renders
every due captain-held task in Captain's Call, date-deferred holds as dated
Charted Next gates, suppresses prose-deferred rows from default views with an
omitted disclosure, and excludes from Recently Landed anything that closed
while still held for the captain.

Legacy compatibility: pre-collapse <origin>-decision-<key> rows are already
plain task ids and keep working; short keys in recorded metadata, concrete
origin bindings, chat --resolve-key fallbacks, and old resolution records all
resolve in place.

* no-mistakes(review): Fix captain answer replay and body preservation

* no-mistakes(review): Fix captain hold idempotency and legacy replay

* no-mistakes(review): Validate card close modes and compatibility routing

* no-mistakes(review): Enforce release replay mode matching

* no-mistakes(review): Prevent duplicate decision cards and released replay mismatches

* no-mistakes(review): Preserve answer columns and legacy resolve replays

* no-mistakes(document): Document strict replay and legacy compatibility

* no-mistakes(lint): Quote done literals to satisfy ShellCheck

* no-mistakes: apply CI fixes

* fix(rebase): keep collapsed captain hold board semantics
---
 .agents/skills/bearings/SKILL.md              |   16 +-
 .../bearings/assets/board-template.html       |   52 +-
 .../skills/captain-hold-lifecycle/SKILL.md    |   48 +
 .../skills/decision-hold-lifecycle/SKILL.md   |   47 +-
 .agents/skills/firstmate-orca/SKILL.md        |    2 +-
 .agents/skills/process-event-sources/SKILL.md |    8 +-
 .github/workflows/ci.yml                      |    4 +-
 AGENTS.md                                     |   11 +-
 bin/fm-bearings-board.sh                      |   35 +-
 bin/fm-bearings-snapshot.sh                   |   41 +-
 bin/fm-brief.sh                               |    4 +-
 bin/fm-captain-hold.sh                        |  877 +++++++++++
 bin/fm-classify-lib.sh                        |    2 +-
 bin/fm-decision-hold.sh                       |  953 ++----------
 bin/fm-fleet-snapshot.sh                      |   54 +-
 bin/fm-procevent-lavish.sh                    |   41 +-
 bin/fm-procevent.sh                           |   14 +-
 bin/fm-public-followup.sh                     |    2 +-
 bin/fm-send.sh                                |   75 +-
 bin/fm-teardown.sh                            |    6 +-
 bin/fm-test-isolation-proof.sh                |    2 +-
 bin/fm-test-run.sh                            |    8 +-
 docs/captain-hold-lifecycle.md                |   74 +
 docs/configuration.md                         |    4 +-
 docs/decision-hold-lifecycle.md               |  180 ---
 docs/documentation-audiences.json             |    6 +-
 docs/fm-test-isolation-proof.json             |   56 +-
 docs/fm-test-isolation-proof.md               |   64 +-
 docs/fm-test-portable-shards.md               |   56 +-
 docs/scripts.md                               |    3 +-
 docs/verification/process-event-sources.md    |    2 +-
 .../fm-backend-herdr-presentation-e2e.test.sh |   21 +-
 tests/fm-bearings-board.test.sh               |  160 +--
 tests/fm-bearings-snapshot.test.sh            |   47 +
 tests/fm-brief.test.sh                        |    8 +-
 tests/fm-captain-hold-lifecycle.test.sh       | 1045 ++++++++++++++
 tests/fm-decision-hold-lifecycle.test.sh      | 1278 -----------------
 tests/fm-fleet-snapshot-view.test.sh          |   22 +-
 38 files changed, 2572 insertions(+), 2756 deletions(-)
 create mode 100644 .agents/skills/captain-hold-lifecycle/SKILL.md
 create mode 100755 bin/fm-captain-hold.sh
 create mode 100644 docs/captain-hold-lifecycle.md
 delete mode 100644 docs/decision-hold-lifecycle.md
 create mode 100755 tests/fm-captain-hold-lifecycle.test.sh
 delete mode 100755 tests/fm-decision-hold-lifecycle.test.sh

diff --git a/.agents/skills/bearings/SKILL.md b/.agents/skills/bearings/SKILL.md
index 44199d0b55..37b48276b1 100644
--- a/.agents/skills/bearings/SKILL.md
+++ b/.agents/skills/bearings/SKILL.md
@@ -41,7 +41,8 @@ Board answers are acted on later under the normal authority rules; this skill's
    Keep the default local-only read unless the captain asks to include PRs.
    For registered secondmates, use the snapshot's structured-home classification and provenance.
    A parent event or bounded terminal contradiction is fallback evidence, never authority over readable structured home state.
-   Structured captain-held decisions come from `decision-hold-lifecycle` and appear under `decisions_open`.
+   A decision is simply a task held for the captain (`captain-hold-lifecycle`); every due, unblocked captain-held task appears under `decisions_open`, whatever its kind.
+   A captain hold deferred by date sits under `gates` with its `until <date>:` reason until it is due, and a hold whose reason or body carries an explicit deferred/superseded marker is suppressed from the default view with an `omitted` disclosure.
    Do not scrape reports, visual-review artifacts, raw status-event tails, or visible conversation history to supplement current state.
    A queued item under `gates` only becomes "next work" when its blocker is gone and its time/date gate has arrived.
    Until then it stays queued with the reason.
@@ -75,10 +76,11 @@ Board answers are acted on later under the normal authority rules; this skill's
 
 Compose the payload from the same snapshot with the same ranking judgment as the chat digest, plus these board rules:
 
-- A Captain's Call decision key is the FULL hold identity from `decisions_open`; a merge card's key is `merge.<task-id>`; the Charted Next dispatch picker's key is `dispatch.charted`.
+- A Captain's Call decision key is the captain-held TASK ID from `decisions_open` (legacy `<origin>-decision-<key>` rows are already task ids); a merge card's key is `merge.<task-id>`; the Charted Next dispatch picker's key is `dispatch.charted`.
+- Compose exactly one decision card per captain-held task id. When one task carries multiple questions, consolidate all of them and their options into that card; never emit duplicate cards with the same task-id key.
 - Decision cards carry agent-authored copy: a short noun-phrase title, one-line `about` and `decide` context rows, and option labels with hints, with the recommended option marked.
-- Every decision card must include at least one selectable option, and the board always renders freeform as a supplementary "something else" input, never the only control.
-- Do not use `__drop__` as an option value: that reserved answer is the card's Close / drop control, recognized by the keyed-answer intake as a decline.
+- Card `type` (decision, merge, credential) is your composing judgment from the row's content; no backlog field types a card for you.
+- When the card's task is a captain-gated WORK item (the answer should free it to proceed rather than complete it), set the card's `close: "release"` so the answer lifts the hold instead of closing the task; question-shaped items omit it.
 - Every Captain's Call item and every Underway, Recently Landed, and Charted Next row carries an explicit `repo` field. Fill it from the snapshot and task records wherever known; use null or an empty string only as the deliberate genuinely-no-repo marker, in which case the template may show the internal id. Ids otherwise stay in the payload only as the routing channel, and composed reasons name blockers in plain words.
 
 Run `build` once after composing the payload.
@@ -89,11 +91,7 @@ Never run `lavish-axi poll` for the board yourself: the armed source's supervise
 ### Handling a board wake
 
 A board answer arrives as an ordinary `procevent lavish <source-id> <sequence>` check wake. Identify it by comparing the wake source id with `bin/fm-procevent-lavish.sh source-id "$(bin/fm-bearings-board.sh path)"`, regardless of which answer kinds the result contains; then load `process-event-sources` and follow its contract for the result read, adapter classification, and the handled acknowledgement.
-Decision answers need no routing from you: the runner feeds the board's any-origin binding into `bin/fm-decision-hold.sh`'s one keyed-answer intake, which closes each full-identity hold at answer time.
-A reserved `__drop__` answer is the captain closing or dropping that hold, not a substantive choice and not a merge.
-The intake declines it through `bin/fm-decision-hold.sh` with a "dropped by captain" decision record, so the hold leaves Captain's Call on the next rebuild.
-Existing work routed behind that hold remains independent queued work; dropping does not close those dependents.
-Reconcile any other `skipped:` key yourself, using `resolve` when routed work exists.
+Decision answers need no routing from you: the runner feeds the board's binding into `bin/fm-captain-hold.sh`'s one keyed-answer intake, which closes or releases each answered captain-held task at answer time; reconcile any `skipped:` key yourself with a direct `answer`, and when the captain's answer is "later", record it as a deferral with `tasks-axi hold <id> ... --until <date>` instead of a closure.
 Route the non-decision keys yourself:
 
 - `merge.<task-id>` is the captain's explicit merge order; follow the merge ruling below.
diff --git a/.agents/skills/bearings/assets/board-template.html b/.agents/skills/bearings/assets/board-template.html
index f31463f074..786d14e424 100644
--- a/.agents/skills/bearings/assets/board-template.html
+++ b/.agents/skills/bearings/assets/board-template.html
@@ -91,8 +91,6 @@
 .fm-btn--primary:hover { background: var(--rust-600); }
 .fm-btn--gold { background: var(--gold-500); color: var(--navy-700); border-color: var(--ink-900); box-shadow: var(--shadow-hard-sm); }
 .fm-btn--gold:hover { background: var(--gold-600); color: var(--white); }
-.fm-btn--ghost { background: transparent; color: var(--text-muted); border-color: var(--border-default); box-shadow: none; }
-.fm-btn--ghost:hover { background: var(--paper-100); color: var(--text-strong); border-color: var(--ink-300); }
 .fm-btn[disabled] { opacity: 0.5; cursor: not-allowed; }
 
 /* ---- fm-card ---- */
@@ -221,9 +219,7 @@
   letter-spacing: 0.07em; color: var(--navy-700); background: var(--gold-300);
   border: 1px solid var(--gold-600); border-radius: var(--radius-xs); padding: 3px 7px 2px; }
 .bb-opt:has(input:checked) { border-color: var(--rust-500); background: var(--rust-050); box-shadow: inset 0 0 0 1px var(--rust-500); }
-.bb-decision__foot { display: flex; align-items: center; gap: 10px; margin-top: auto; flex-wrap: wrap; }
-.bb-drop { margin-left: auto; }
-.is-queued .bb-drop { display: none; }
+.bb-decision__foot { display: flex; align-items: center; gap: 10px; margin-top: auto; }
 .bb-queued {
   display: none; align-items: center; gap: 6px;
   font-size: var(--fs-2xs); font-weight: 800; text-transform: uppercase; letter-spacing: 0.07em;
@@ -521,14 +517,10 @@
     });
     form.appendChild(opts);
 
-    /* Decision cards always keep a supplementary "something else" box; merge
-       and credential cards keep the payload's allow_freeform flag. */
-    if (item.type === "decision" || item.allow_freeform) {
+    if (item.allow_freeform) {
       var ff = document.createElement("input");
       ff.type = "text"; ff.name = "note"; ff.className = "bb-freeform";
-      ff.placeholder = item.freeform_hint || (item.type === "decision"
-        ? "or something else…"
-        : "or answer in your own words…");
+      ff.placeholder = item.freeform_hint || "or answer in your own words…";
       form.appendChild(ff);
     }
 
@@ -542,18 +534,16 @@
     var answerLimit = el("span", "bb-limit");
     answerLimit.setAttribute("role", "alert");
     foot.appendChild(answerLimit);
-    var dropBtn = null;
-    if (item.type === "decision") {
-      dropBtn = el("button", "fm-btn fm-btn--sm fm-btn--ghost bb-drop", "Close / drop");
-      dropBtn.type = "button";
-      dropBtn.setAttribute("aria-label", "Close or drop this decision");
-      foot.appendChild(dropBtn);
-    }
     form.appendChild(foot);
 
-    function queueAnswer(answer) {
-      if (card.classList.contains("is-queued")) return;
+    form.addEventListener("submit", function (ev) {
+      ev.preventDefault();
       answerLimit.classList.remove("is-visible");
+      var fd = new FormData(form);
+      var value = fd.get("answer");
+      var note = (fd.get("note") || "").trim();
+      /* picked option, optionally annotated; a bare note is itself the answer */
+      var answer = value ? (note ? value + " - " + note : value) : note;
       if (!answer) return;
       if (utf8ByteLength(answer) > 512) {
         answerLimit.textContent = "Answer is too long to queue (512 bytes maximum).";
@@ -561,32 +551,20 @@
         return;
       }
       if (window.lavish && window.lavish.queuePrompt) {
+        /* close carries the composer-declared close mode: "release" frees a
+           captain-gated work item instead of completing a question task */
+        var ctxData = { question: item.key, answer: answer };
+        if (item.close) ctxData.close = item.close;
         window.lavish.queuePrompt(
           "Captain's Call answer - " + item.title + ": " + answer,
           { tag: "choice", text: item.title + " -> " + answer, element: form,
-            data: { question: item.key, answer: answer } }
+            data: ctxData }
         );
       }
       card.classList.add("is-queued");
       /* deal the next card once this one is answered */
       setTimeout(function () { showCard(active < cards.length - 1 ? active + 1 : active); }, 450);
-    }
-
-    form.addEventListener("submit", function (ev) {
-      ev.preventDefault();
-      var fd = new FormData(form);
-      var value = fd.get("answer");
-      var note = (fd.get("note") || "").trim();
-      /* picked option, optionally annotated; a bare note is itself the answer */
-      var answer = value ? (note ? value + " - " + note : value) : note;
-      queueAnswer(answer);
     });
-    if (dropBtn) {
-      dropBtn.addEventListener("click", function () {
-        /* reserved close/drop encoding; the keyed-answer intake declines it */
-        queueAnswer("__drop__");
-      });
-    }
 
     pad.appendChild(form);
     card.appendChild(pad);
diff --git a/.agents/skills/captain-hold-lifecycle/SKILL.md b/.agents/skills/captain-hold-lifecycle/SKILL.md
new file mode 100644
index 0000000000..36afda16ed
--- /dev/null
+++ b/.agents/skills/captain-hold-lifecycle/SKILL.md
@@ -0,0 +1,48 @@
+---
+name: captain-hold-lifecycle
+description: >-
+  Agent-only policy for completing investigations and visual reviews without losing unresolved captain calls, and for closing what the captain owns with his actual words.
+  Load before treating an investigation, scout report, structured review, or Lavish review as complete, before ending a visual review that exposed a captain decision, and when recording or routing the captain's answer.
+user-invocable: false
+metadata:
+  internal: true
+---
+
+# Captain-hold lifecycle
+
+A decision is not a separate thing: it is simply a task waiting on the captain.
+The one primitive is an ordinary backlog task held for the captain (`tasks-axi hold <id> --kind captain`), its identity is the task id, and `bin/fm-captain-hold.sh` owns the deterministic mechanics this policy relies on.
+The agent performs the semantic inventory because scripts must not infer captain calls from report prose, visual-review artifacts, terminal output, or chat.
+
+## Policy
+
+Every unresolved question that belongs to the captain and is discovered while producing, reading, presenting, or ending an investigation or visual review must be carried by a captain-held task in the authoritative backlog of the home that owns the originating work before that work or review may be treated as complete.
+Prefer holding the work item the question gates over minting a new row; create a new task only when no work item exists to hold.
+Put the question and its options in the hold reason, and keep one held task per genuine gate: a multi-question review is one held task pointing at its report, not a row per question. Represent that task with exactly one board card that consolidates its questions and options; never fan one task id into duplicate same-key cards.
+Register or re-hold through `bin/fm-captain-hold.sh hold`, which is idempotent per task id.
+After inventorying the whole report and review surface, run `bin/fm-captain-hold.sh complete` with every captain-held task id, or with `--none` only when the reviewed surface leaves nothing waiting on the captain.
+A completed investigation and an ended visual review use this same owner and completion command; a visual tool, including Lavish, never owns a parallel completion policy.
+Run the command in the originating work's authoritative `FM_HOME`; secondmate-owned work registers in that secondmate home's backlog, and a question already held anywhere is never re-registered as a second row.
+Do not close a captain-held task merely because the originating investigation completed, its report was archived, its visual review ended, or its task was torn down.
+
+Never close anything the captain owns without recording what he actually said: `bin/fm-captain-hold.sh answer` writes his exact words into the task and closes it in the same act, with `--release` when the answer frees a captain-gated work item to proceed instead of completing a question.
+When the captain says "later", that is an answer too: re-hold with `tasks-axi hold <id> ... --until <date>` so the item leaves the live Captain's Call and resurfaces on its date, instead of leaving a live-looking card or fabricating a closure.
+"A keyed answer closes its matching captain-held task" is one capability with one owner, `bin/fm-captain-hold.sh answers`, and every channel that carries a captain answer feeds it the same task id and answer; a channel never maps keys to tasks, records a decision, or closes anything itself.
+Chat already feeds it through `bin/fm-send.sh --resolve-key`, and a captured-answer source feeds it once bound with `bin/fm-captain-hold.sh bind <source-id>`; bind before arming the source, and key each structured question by the held task's id.
+An unbound source and a key that names no captain-held task both simply feed nothing: the answer is still captured and firstmate is still woken, and closing falls back to the direct command above.
+A captain-held task closed outside this owner leaves no durable answer, so the completion gate keeps failing until `answer` records the decision the captain actually gave.
+Resolved findings, recommendations that need no captain choice, and prose that merely sounds decision-like do not create held tasks.
+Bearings reads the resulting structured state and must never compensate by scraping historical reports, visual-review artifacts, terminal output, chat, or other prose.
+
+## Operating sequence
+
+1. Read the complete investigation result and complete the visual review before declaring either complete.
+2. Inventory only genuine unresolved choices that require the captain, and find the task each one gates.
+3. Hold that task - or create one captain-held task for the review's open questions - with a concise reason carrying the question and options.
+4. Run `complete` with the full captain-held inventory for that review pass.
+5. Relay the choices to the captain as decisions from Bearings' Captain's Call section under `AGENTS.md` section 9; do not use the word hold in captain chat.
+6. Close each call only through `answer` (or a channel that feeds `answers`), through `--until` when the captain defers it, or confirm a channel already closed it.
+7. Confirm Bearings reflects the outcome: answered calls leave Captain's Call, released work resumes, and deferred calls sit in Charted Next with their date.
+
+`bin/fm-captain-hold.sh --help` owns command syntax, close modes, legacy-identity compatibility, completion attestation, retry behavior, and close ordering.
+`docs/captain-hold-lifecycle.md` records the mechanism and regression evidence without restating this policy.
diff --git a/.agents/skills/decision-hold-lifecycle/SKILL.md b/.agents/skills/decision-hold-lifecycle/SKILL.md
index 04a78f6b2a..4d9533c628 100644
--- a/.agents/skills/decision-hold-lifecycle/SKILL.md
+++ b/.agents/skills/decision-hold-lifecycle/SKILL.md
@@ -1,50 +1,15 @@
 ---
 name: decision-hold-lifecycle
 description: >-
-  Agent-only policy for completing investigations and visual reviews without losing unresolved captain decisions.
-  Load before treating an investigation, scout report, structured review, or Lavish review as complete, before ending a visual review that exposed a decision, and when recording or routing the captain's answer.
+  Renamed pointer kept for in-flight briefs: the decisions concept collapsed into "a task held for the captain".
+  Load captain-hold-lifecycle instead; this stub only redirects and will be removed one release after the collapse.
 user-invocable: false
 metadata:
   internal: true
 ---
 
-# Durable unresolved-decision lifecycle
+# decision-hold-lifecycle (renamed)
 
-This skill is the single policy owner for unresolved captain decisions discovered by an investigation or visual review.
-
-## Policy
-
-Every unresolved decision that belongs to the captain and is discovered while producing, reading, presenting, or ending an investigation or visual review must become a structured captain-held work item in the authoritative backlog of the home that owns the originating work before that work or review may be treated as complete.
-The agent performs the semantic inventory because scripts must not infer decisions from report prose, visual-review artifacts, terminal output, or chat.
-Give each distinct unresolved decision a stable privacy-safe key, register it through `bin/fm-decision-hold.sh hold`, and use the same key on retry so registration is idempotent while different decisions retain different durable identities.
-After inventorying the whole report and review surface, run `bin/fm-decision-hold.sh complete` with every unresolved key, or with `--none` only when the reviewed surface contains no unresolved captain decision.
-A completed investigation and an ended visual review use this same owner and completion command; a visual tool, including Lavish, never owns a parallel completion policy.
-Run the command in the originating work's authoritative `FM_HOME`; main-home work creates main-home holds, and secondmate-owned work creates holds in that secondmate home's backlog rather than copying them into the main backlog.
-Do not close a hold merely because the originating investigation completed, its report was archived, its visual review ended, or its task was torn down.
-When the captain's answer authorizes follow-up work, the hold remains the authoritative Captain's Call item until that answer is durably recorded, dependent work is created in the same backlog and blocked by the hold, and `bin/fm-decision-hold.sh resolve` routes the answer by clearing those dependency edges before closing the hold.
-When the captain's answer routes no follow-up work at all, such as a declined proposal, `bin/fm-decision-hold.sh decline` records that answer and closes the hold; it never substitutes for routing work the captain did authorize.
-When the captain simply answers a hold that has no follow-up work routed behind it yet, `bin/fm-decision-hold.sh answer` records that answer and closes the hold, so answering is closing rather than a separate later act that can be forgotten.
-"A keyed answer closes its matching hold" is one capability with one owner, `bin/fm-decision-hold.sh answers`, and every channel that carries a captain answer feeds it the same `<decision-key>` and answer.
-The exact answer `__drop__` is the reserved close/drop encoding owned by that script's header: the intake declines the hold with a dropped-by-captain record rather than recording a substantive answer, and closes only that hold while existing dependents remain independent queued work.
-A channel never maps a key to a hold, records a decision, or closes anything itself, so no channel is special and a new one needs no new closing logic.
-Chat already feeds it: `bin/fm-send.sh --resolve-key` answers a decision in whichever ledger still holds it open, including a decision already transferred to its durable hold.
-A captured-answer source feeds it too once bound with `bin/fm-decision-hold.sh bind <source-id> <origin-id>`, or with `--any-origin` for a source that carries answers across origins, such as the bearings board; bind before arming the source, and key each structured question by the hold's own decision key, or by its full hold identity under an any-origin binding.
-An unbound source and a question slug that is not a decision key both simply feed nothing: the answer is still captured and firstmate is still woken, and closing falls back to the commands above.
-A hold closed outside this owner leaves no durable answer, so the completion gate keeps failing until `bin/fm-decision-hold.sh repair` records the decision the captain actually gave; neither unrouted path may stand in for an answer the captain has not given.
-Resolved findings, recommendations that need no captain choice, and prose that merely sounds decision-like do not create holds.
-Bearings reads the resulting structured state and must never compensate by scraping historical reports, visual-review artifacts, terminal output, chat, or other prose.
-
-## Operating sequence
-
-1. Read the complete investigation result and complete the visual review before declaring either complete.
-2. Inventory only genuine unresolved choices that require the captain.
-3. For each choice, choose a stable key and use the script's `hold` command with a concise title, reason, and repository.
-4. Run the script's `complete` command with the full unresolved-key inventory for that review pass.
-5. Relay the choices to the captain as decisions from Bearings' Captain's Call section under `AGENTS.md` section 9; do not use the word hold in captain chat.
-6. If the captain authorizes dependent work, record it with normal tasks-axi commands and block it by the hold identity.
-7. Put the captain's exact durable decision in a file and close the hold with the script's `resolve` command and every routed task, its `answer` command when the captain answered a hold with no routed work behind it, its `decline` command when the answer routes no work at all, or its `repair` command when the hold was already closed outside the script.
-   A hold that a channel already closed by feeding its keyed answer needs none of these; confirm it in step 8 instead.
-8. Confirm Bearings no longer shows the closed hold and that any routed work remains in structured backlog state.
-
-`bin/fm-decision-hold.sh --help` owns command syntax, identity construction, completion attestation, retry behavior, and close ordering.
-`docs/decision-hold-lifecycle.md` records the mechanism and regression evidence without restating this policy.
+The separate decision concept was collapsed into the one primitive the captain cares about: a task held for the captain.
+Read and follow `.agents/skills/captain-hold-lifecycle/SKILL.md`; it owns the completion gate, the recorded-answer rule, and every command this skill used to describe.
+Where an older brief says `bin/fm-decision-hold.sh`, that command still works as a one-release compatibility shim over `bin/fm-captain-hold.sh`.
diff --git a/.agents/skills/firstmate-orca/SKILL.md b/.agents/skills/firstmate-orca/SKILL.md
index d8d50b07b4..c6c23b0712 100644
--- a/.agents/skills/firstmate-orca/SKILL.md
+++ b/.agents/skills/firstmate-orca/SKILL.md
@@ -75,7 +75,7 @@ For a messy Orca-backed task:
 6. Stop and inspect if the recorded worktree path, Orca worktree id, or project checkout no longer matches expectations.
 
 Teardown remains governed by the normal firstmate landing rules.
-Scout work can be torn down after the report exists and the `decision-hold-lifecycle` completion gate passes.
+Scout work can be torn down after the report exists and the `captain-hold-lifecycle` completion gate passes.
 Ship work can be torn down only after the work is landed by its project mode.
 
 ## Smoke Test
diff --git a/.agents/skills/process-event-sources/SKILL.md b/.agents/skills/process-event-sources/SKILL.md
index 0abd9f3a20..9d400cc119 100644
--- a/.agents/skills/process-event-sources/SKILL.md
+++ b/.agents/skills/process-event-sources/SKILL.md
@@ -31,15 +31,15 @@ For a Lavish review artifact firstmate owns (a live investigating scout should h
 bin/fm-procevent-lavish.sh arm <artifact.html>
 ```
 
-When a source carries captain answers to decisions that already have durable holds, bind it to their origin BEFORE arming it, so it can never produce an answer that has nowhere to go:
+When a source carries captain answers to captain-held tasks, bind it BEFORE arming it, so it can never produce an answer that has nowhere to go:
 
 ```sh
-bin/fm-decision-hold.sh bind <source-id> <origin-id>
+bin/fm-captain-hold.sh bind <source-id>
 ```
 
-The runner then passes each captured result to that source's own adapter `answers` command and pipes the keyed answers it prints into the one keyed-answer intake, which owns every rule about what they mean.
+The runner then passes each captured result to that source's own adapter `answers` command and pipes the keyed answers it prints into the one keyed-answer intake, which owns every rule about what they mean; the keys are captain-held task ids.
 This is generic: any adapter with an `answers` command works, and the runner still wakes you to act on the result.
-`decision-hold-lifecycle` owns when a binding is required and what the keys must be.
+`captain-hold-lifecycle` owns when a binding is required and what the keys must be.
 
 A configured remote secondmate reply source is armed and handled through `bin/fm-procevent-remote-reply.sh`.
 Its header owns exact commands, while the adapter owns cursor continuity, validated deduplicated status ingest, path-confined document fetch, acknowledgement, and re-arming after a good delta.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fcfc4cb2df..ae4f6c0ae5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -385,8 +385,8 @@ jobs:
           bearings_output=$(/bin/bash tests/fm-bearings-snapshot.test.sh)
           printf '%s\n' "$bearings_output"
           bearings_count=$(printf '%s\n' "$bearings_output" | grep -c '^ok - ')
-          [ "$bearings_count" -eq 41 ] || {
-            echo "::error::expected 41 Bearings tests, got $bearings_count"
+          [ "$bearings_count" -eq 42 ] || {
+            echo "::error::expected 42 Bearings tests, got $bearings_count"
             exit 1
           }
 
diff --git a/AGENTS.md b/AGENTS.md
index d4d7011f57..086852d0f3 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -107,7 +107,7 @@ state/               runtime records and signals; gitignored
   pending-replies/   parent-owned secondmate pending-reply records (correlation id, delivery vs reply, recovery, escalation); fm-pending-reply-lib.sh
   procevent/         registered process-to-event sources, one private record per canonical source id; written only by bin/fm-procevent.sh, and their presence alone keeps supervision required (section 13)
   procevent-inbox/   private captured results and their durable handled-acknowledgement markers; source output lives here and never in an event line
-  decision-bindings/ private bindings from a captured-answer source id to one captain-hold origin or the cross-origin marker; written only by bin/fm-decision-hold.sh bind, dropped by unbind and by source retirement (section 13; docs/decision-hold-lifecycle.md)
+  decision-bindings/ private records marking a captured-answer source as feeding the keyed-answer intake, with a legacy origin on pre-collapse records; written only by bin/fm-captain-hold.sh bind, dropped by unbind and by source retirement (section 13; docs/captain-hold-lifecycle.md)
   when/              private condition->action watch specs, their trust bindings, and single-fire markers; written only by bin/fm-procevent-when.sh (section 13's process-event-sources trigger)
   x-inbox/           generated Relay pending mention payloads; fmx-respond drains it (section 14)
   x-context/         generated Relay durable per-request reply context and one-wake offer markers, keyed by request_id; survives inbox cleanup and expires within seven days (section 14; bin/fm-x-lib.sh)
@@ -371,7 +371,7 @@ Retire one only on an explicit captain or main-firstmate decision, after loading
 
 A completed scout must leave a self-contained report before its scratch worktree can be discarded; read and relay its findings, record the report as the Done artifact, and re-evaluate the queue.
 A report may recommend implementation but does not authorize it.
-Before treating the investigation or any visual review as complete, load `decision-hold-lifecycle`; teardown enforces that shared completion gate.
+Before treating the investigation or any visual review as complete, load `captain-hold-lifecycle`; teardown enforces that shared completion gate.
 When a scout's deliverable is a visual artifact the captain will iterate on, prefer keeping that scout alive to host its own Lavish loop rather than tearing it down and mediating from firstmate, so the scout keeps its investigation context and the captain iterates in one continuous session.
 When implementation is separately authorized, promote the existing scout through `bin/fm-promote.sh` rather than creating a duplicate task.
 The promoted worker must inventory scratch state, return to a clean default-branch base, carry over only intended fix changes, create the ship branch, and follow the project's selected delivery path while leaving scratch commits and debug edits behind and turning a reproduced bug into the regression test.
@@ -481,8 +481,9 @@ Mention cost as a courtesy when unusually much work is running, but never block
 `data/backlog.md` is the durable queue.
 It tracks work items only, never agents; persistent secondmates never appear as backlog items.
 Work routed to a secondmate is recorded in that secondmate home's own backlog, not the main backlog.
-When a main-side thread such as a pending captain decision or relay reminder is worth durable tracking, file it as its own work item; use `tasks-axi hold <id> --reason "<reason>" --kind captain` for a captain-gated thread.
-Unresolved decisions discovered by investigations or visual reviews follow `decision-hold-lifecycle`, which owns their mandatory backlog lifecycle.
+A decision is simply a task held for the captain: `tasks-axi hold <id> --reason "<reason>" --kind captain`, with `--until <date>` when the captain defers it.
+When a main-side thread such as a pending captain decision or relay reminder is worth durable tracking, file it as its own work item and hold it the same way.
+Captain calls discovered by investigations or visual reviews follow `captain-hold-lifecycle`, which owns their completion gate and recorded-answer rules.
 Update the backlog on every dispatch, completion, and decision for a work item.
 Re-evaluate queued work after every teardown and heartbeat, dispatching items only when dependencies and time gates have cleared.
 
@@ -531,7 +532,7 @@ These skills are not captain-invocable; load them only at their precise triggers
   Cloning or registering a project is add intake and uses the same trigger.
 - `stuck-crewmate-recovery` - load when the session-start digest reports an ordinary direct report's endpoint dead or its metadata has no window, or after a stale wake, looping pane, repeated confusion, an answered-by-brief question, an unresponsive crewmate, or a failed steer.
 - `secondmate-provisioning` - load before creating, seeding, validating, launching, handing backlog to, recovering, pushing inherited local material into, or retiring a secondmate home, and before editing `data/secondmates.md`.
-- `decision-hold-lifecycle` - load before treating an investigation or visual review as complete, before ending a visual review that exposed a decision, and when recording or routing the captain's answer.
+- `captain-hold-lifecycle` - load before treating an investigation or visual review as complete, before ending a visual review that exposed a captain decision, and when recording or routing the captain's answer.
 - `process-event-sources` - load before arming a long-polling source, before registering a deterministic condition->action watch (do X as soon as Y is true), and on any `procevent <adapter> <source-id> <sequence>` check wake.
   Never run a registered source's blocking command yourself in a conversational turn.
 - `fmx-respond` - load on an `x-mention <request_id>` `check:` wake to handle the mention, on an `x-mode-error ...` `check:` wake to report the Relay configuration blocker, on a `public-followup ...` `check:` wake or a startup-surfaced public commitment, and on any milestone or terminal wake for a Relay-linked task before posting its completion follow-up; relevant only when Relay is on.
diff --git a/bin/fm-bearings-board.sh b/bin/fm-bearings-board.sh
index fd336763ae..e8ce430956 100755
--- a/bin/fm-bearings-board.sh
+++ b/bin/fm-bearings-board.sh
@@ -15,13 +15,14 @@
 #            template at the stable board path. Establish or resume the Lavish
 #            session on that board BEFORE binding and arming its answer source,
 #            so a registered poll can never race a session that does not exist.
-#            Bind to the any-origin keyed-answer intake ALWAYS precedes arm, so
-#            the board can never produce an answer that has nowhere to go
-#            (decision-hold-lifecycle's ordering rule, enforced here rather
-#            than left to agent memory). Output starts with `board: <path>`,
-#            then includes lavish-axi's session output and the remaining status:
+#            Bind to the keyed-answer intake (bin/fm-captain-hold.sh) ALWAYS
+#            precedes arm, so the board can never produce an answer that has
+#            nowhere to go (captain-hold-lifecycle's ordering rule, enforced
+#            here rather than left to agent memory). Output starts with
+#            `board: <path>`, then includes lavish-axi's session output and
+#            the remaining status:
 #              served: <path>
-#              bound: <source-id> (any-origin)
+#              bound: <source-id>
 #              armed: <source-id>            (first registration)
 #              already-armed: <source-id>    (registration already present)
 # path       Print the stable board path for this home.
@@ -32,13 +33,8 @@
 # Captain's Call item explicitly carries `repo`; the composer fills it from the
 # snapshot and task records wherever known, and uses null or an empty string
 # only as the deliberate genuinely-no-repo marker. In that exceptional case
-# the template may display the routing id. Decision cards must include at least
-# one selectable option; every other Captain's Call item must either include an
-# option or explicitly allow freeform input. Option values cannot
-# be `__drop__`: that reserved answer is the board Close / drop encoding,
-# recognized by fm-decision-hold.sh's keyed-answer intake as a decline rather
-# than a substantive choice. Anything else refuses before the existing board
-# is touched.
+# the template may display the routing id. Anything else refuses before the
+# existing board is touched.
 #
 # The board path is stable - $FM_HOME/.lavish/bearings-board.html - so a
 # re-invocation rebuilds the same file in place, which keeps the same Lavish
@@ -90,14 +86,10 @@ validate_payload() {  # <data.json>
       and repo_marker
       and (.title | nonempty_string)
       and (.options | type == "array")
-      and (if .type == "decision"
-        then (.options | length) > 0
-        else ((.options | length) > 0 or .allow_freeform == true)
-        end)
+      and ((.options | length) > 0 or .allow_freeform == true)
       and ([.options[]
         | type == "object"
           and (.value | slug(128))
-          and .value != "__drop__"
           and (.label | nonempty_string)
           and optional_string("hint")] | all)
       and (optional_string("about"))
@@ -105,6 +97,7 @@ validate_payload() {  # <data.json>
       and (optional_string("detail"))
       and (optional_https_url("pr_url"))
       and (optional_string("freeform_hint"))
+      and ((has("close") | not) or (.close == "done" or .close == "release"))
       and ((has("allow_freeform") | not) or (.allow_freeform | type == "boolean"))
       and ((has("recommend_value") | not)
         or ((.recommend_value | slug(128))
@@ -186,9 +179,9 @@ command_build() {
 
   sid=$("$SCRIPT_DIR/fm-procevent-lavish.sh" source-id "$board") \
     || fail "cannot derive the board source id"
-  "$SCRIPT_DIR/fm-decision-hold.sh" bind "$sid" --any-origin >/dev/null \
-    || fail "cannot bind the board source to the any-origin intake"
-  printf 'bound: %s (any-origin)\n' "$sid"
+  "$SCRIPT_DIR/fm-captain-hold.sh" bind "$sid" >/dev/null \
+    || fail "cannot bind the board source to the keyed-answer intake"
+  printf 'bound: %s\n' "$sid"
 
   if "$SCRIPT_DIR/fm-procevent.sh" list | awk 'NR > 1 { print $1 }' | grep -Fxq "$sid"; then
     printf 'already-armed: %s\n' "$sid"
diff --git a/bin/fm-bearings-snapshot.sh b/bin/fm-bearings-snapshot.sh
index 5a23bec367..c64f4226db 100755
--- a/bin/fm-bearings-snapshot.sh
+++ b/bin/fm-bearings-snapshot.sh
@@ -22,6 +22,12 @@
 # This wrapper consumes canonical status decisions plus canonically normalized
 # backlog roles, unresolved blockers, and captain actionability. It never infers
 # decisions from report or visual-review prose or reimplements snapshot semantics.
+# Captain's Call is captain actionability itself: every due, unblocked task held
+# for the captain, whatever its kind. A captain hold deferred by date
+# (hold-until in the future) is not actionable and renders as a Charted Next
+# gate with its date; a row the canonical snapshot marks prose-deferred
+# (deferred_marker) leaves the default decisions and gates views and is
+# disclosed in omitted[], revealed by --all-decisions / --all-queued.
 #
 # Main-home inventory validity comes from the canonical snapshot's main_inventory
 # object (orphan structured in-flight without meta, unstructured current rows).
@@ -271,9 +277,15 @@ EOF
 fi
 
 # --- projection: canonical snapshot -> fm-bearings.v1 model (JSON) ----------
+BEARINGS_TODAY=${NOW%%T*}
+case "$BEARINGS_TODAY" in
+  [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]) : ;;
+  *) BEARINGS_TODAY=$(date -u +%Y-%m-%d) ;;
+esac
 MODEL=$(printf '%s' "$SNAP" | jq \
   --arg home "$HOME_LABEL" \
   --arg now "$NOW" \
+  --arg today "$BEARINGS_TODAY" \
   --arg prs "$PR_STATUS" \
   --arg fields "$FIELDS" \
   --argjson landed_n "$FM_BEARINGS_LANDED" \
@@ -312,7 +324,7 @@ MODEL=$(printf '%s' "$SNAP" | jq \
   | (($fl | index("paths")) != null) as $f_paths
   | (($fl | index("actions")) != null) as $f_actions
   | (($fl | index("endpoints")) != null) as $f_endpoints
-  | ([ .backlog.records[] | select(.state == "done" and .structured and .kind != "captain")
+  | ([ .backlog.records[] | select(.state == "done" and .structured and .hold_kind != "captain")
        | {id, title, pr_url, report_path, local_note, completion, home:"(main)", home_id:"(main)"} ]) as $main_done
   | ((.secondmate_landed.records) // []) as $mate_done
   | ($main_done + $mate_done) as $all_landed_rows
@@ -334,7 +346,8 @@ MODEL=$(printf '%s' "$SNAP" | jq \
          | select(.endpoint.exists == false or .endpoint.agent_alive == "dead")
          | {id:($m.id + "/" + .id),backend:"secondmate-home",target:(.endpoint.target // "-"),exists:.endpoint.exists,agent:.endpoint.agent_alive} ]) as $unhealthy_all
   | ([ (.secondmate_current.records // [])[]
-       | ([.decisions_open[]? | select(.source == "backlog" and .verb == "captain-hold")]) as $captain_holds
+       | ([.decisions_open[]? | select(.source == "backlog" and .verb == "captain-hold"
+            and .deferred_marker != true)]) as $captain_holds
        | ([.holds[]? | select(.source == "backlog")]) as $backlog_holds
        | . + {
            bearings_captain_holds:$captain_holds,
@@ -381,12 +394,19 @@ MODEL=$(printf '%s' "$SNAP" | jq \
             doing:([.active_children[] | .id + ": " + (.doing // .state)] | join("; ") | trunc(90))} ]) as $in_flight_all
   | ([ .backlog.records[]
          | select(.structured and .captain_actionable == true)
+         | select(($all_decisions == 1) or (.deferred_marker != true))
          | {id,key:.id,verb:"captain-hold",
             summary:((.title + ": " + .hold_reason) | trunc(90)),owner:"(main)"} ]
      + [ (.secondmate_current.records // [])[] as $m | $m.decisions_open[]?
          | select(.source == "backlog" and .verb == "captain-hold")
+         | select(($all_decisions == 1) or (.deferred_marker != true))
          | {id:($m.id + "/" + .id),key,verb,
             summary:(((.summary // .id) + ": " + (.reason // "captain decision pending")) | trunc(90)),owner:$m.id} ]) as $decisions_all
+  | ([ .backlog.records[]
+         | select(.structured and .captain_actionable == true and .deferred_marker == true) ]
+     + [ (.secondmate_current.records // [])[] | .decisions_open[]?
+         | select(.source == "backlog" and .verb == "captain-hold" and .deferred_marker == true) ]
+     | length) as $decisions_marked_deferred
   | ((if (.main_inventory.valid == false) then
         [{id:"(main-inventory)",
           title:((.main_inventory.reason // "main inventory invalid") | trunc(60)),
@@ -400,18 +420,24 @@ MODEL=$(printf '%s' "$SNAP" | jq \
              (.state == "queued" or
               (.state == "in_flight" and .current_role == "held" and ($working_ids | index($record.id) | not))))
          | select(.captain_actionable != true)
-         | select(($all_queued == 1)
-                  or (((.body_excerpt // "") | test("SUPERSEDED|NOT REQUIRED|NOT-REQUIRED|DEFERRED"; "i")) | not))
+         | select(($all_queued == 1) or (.deferred_marker != true)
+                  or ((.hold_until // null) != null and .hold_until > $today))
          | {id, title:(.title | trunc(60)),
             blocked_by:((.unresolved_blocker_ids // []) | if length > 0 then join(",") else "-" end | trunc(120)),
-            reason:((.hold_reason // .blocked_reason // "-") | trunc(40)),owner:"(main)"} ]
+            reason:((if (.hold_until // null) != null and .hold_until > $today
+                     then ("until " + .hold_until + ": " + (.hold_reason // .blocked_reason // "-"))
+                     else (.hold_reason // .blocked_reason // "-") end) | trunc(40)),owner:"(main)"} ]
      + [ (.secondmate_current.records // [])[] as $m
          | select($m.provenance.selected == "structured-home")
          | $m.queued[]?
          | select(.captain_actionable != true)
+         | select(($all_queued == 1) or (.deferred_marker != true)
+                  or ((.hold_until // null) != null and .hold_until > $today))
          | {id,title:(.title | trunc(60)),
             blocked_by:((.unresolved_blocker_ids // []) | if length > 0 then join(",") else "-" end | trunc(120)),
-            reason:((.hold_reason // .blocked_reason // "-") | trunc(40)),owner:$m.id} ]) as $gates_all
+            reason:((if (.hold_until // null) != null and .hold_until > $today
+                     then ("until " + .hold_until + ": " + (.hold_reason // .blocked_reason // "-"))
+                     else (.hold_reason // .blocked_reason // "-") end) | trunc(40)),owner:$m.id} ]) as $gates_all
   | ([ .scout_reports[]
        | . as $r
        | select(($all_reports == 1) or (($rel_ids | index($r.id)) != null))
@@ -446,7 +472,7 @@ MODEL=$(printf '%s' "$SNAP" | jq \
         (if $f_actions then empty else {surface:"watch/steer actions", reveal:"--fields actions"} end),
         (if $f_endpoints then empty else {surface:"healthy endpoint detail", reveal:"--fields endpoints"} end),
         (if $all_reports == 1 then empty else {surface:"full scout-report inventory", reveal:"--all-reports"} end),
-        (if $all_queued == 1 then empty else {surface:"superseded queued items", reveal:"--all-queued"} end),
+        (if $all_queued == 1 then empty else {surface:"superseded or prose-deferred queued items", reveal:"--all-queued"} end),
         (if $all_landed == 0 and ($per_home_capped | length) > ($done | length) then {surface:("landed showing \($done | length) of \($per_home_capped | length)" + (($done | map(.home_id) | unique | map(select(. != "(main)")) | length) as $k | if $k > 0 then " (incl. \($k) secondmate home(s))" else "" end)), reveal:"--all-landed"} else empty end),
         (if $all_landed == 0 and $home_cap_dropped > 0 then {surface:("landed per-home capped at \($landed_per_home_n) for \($home_cap_dropped) home(s)"), reveal:"--all-landed"} else empty end),
         (if (($snap.secondmate_landed.unreadable // []) | length) > 0 then {surface:("secondmate home(s) with unreadable backlog: \(($snap.secondmate_landed.unreadable // []) | length)"), reveal:"inspect the listed secondmate home backlogs"} else empty end),
@@ -464,6 +490,7 @@ MODEL=$(printf '%s' "$SNAP" | jq \
         (([($snap.secondmate_current.records // [])[] | select(.parent_event.activity_scan.input_truncated == true or .parent_event.activity_scan.retained_truncated == true)] | length) as $n | if $n > 0 then {surface:("secondmate parent activity evidence truncated for \($n) record(s)"), reveal:"raise FM_SNAPSHOT_PARENT_ACTIVITY_LINES, FM_SNAPSHOT_PARENT_ACTIVITY_BYTES, or FM_SNAPSHOT_PARENT_ACTIVITIES"} else empty end),
         (([($snap.secondmate_current.records // [])[] | select(.parent_event.activity_scan.available == false)] | length) as $n | if $n > 0 then {surface:("secondmate parent activity evidence unavailable for \($n) record(s)"), reveal:"inspect the parent status logs"} else empty end),
         (if $all_decisions == 0 and ($decisions_all | length) > $decisions_n then {surface:("decisions_open showing \($decisions_n) of \($decisions_all | length)"), reveal:"--all-decisions"} else empty end),
+        (if $all_decisions == 0 and $decisions_marked_deferred > 0 then {surface:("captain holds marked deferred or superseded: \($decisions_marked_deferred)"), reveal:"--all-decisions"} else empty end),
         (if $all_queued == 0 and ($gates_all | length) > $gates_n then {surface:("gates showing \($gates_n) of \($gates_all | length)"), reveal:"--all-queued"} else empty end),
         (if $all_reports == 0 and ($reports_all | length) > $reports_n then {surface:("reports showing \($reports_n) of \($reports_all | length)"), reveal:"--all-reports"} else empty end),
         (if $all_recorded_prs == 0 and ($recorded_prs_all | length) > $recorded_prs_n then {surface:("recorded_prs showing \($recorded_prs_n) of \($recorded_prs_all | length)"), reveal:"--all-recorded-prs"} else empty end),
diff --git a/bin/fm-brief.sh b/bin/fm-brief.sh
index 206e5a947a..7f707c1d1a 100755
--- a/bin/fm-brief.sh
+++ b/bin/fm-brief.sh
@@ -229,7 +229,7 @@ Marked requests also carry a privacy-safe \`corr=<id>\` token after the marker;
 Optional helper: \`bin/fm-secondmate-report.sh\` can append a correlated status line for you, but a plain \`echo\` that includes the same \`corr=<id>\` is equally valid - do not depend on the helper being present.
 For a terse result, a status line is the whole answer.
 For a detailed answer (an investigation, a plan, an audit), write it to a doc under your home's \`data/\` and append a status line that points to that doc - the scout-report pattern - so the main firstmate is woken and can read it.
-Before treating an investigation or visual review as complete, load \`decision-hold-lifecycle\` from this home's \`.agents/skills/\` and pass its shared completion gate.
+Before treating an investigation or visual review as complete, load \`captain-hold-lifecycle\` from this home's \`.agents/skills/\` and pass its shared completion gate.
 A message with NO marker is the captain typing directly into your pane: treat it as authoritative captain intervention and stay conversational exactly as you would for any captain message; do not force it onto the status path.
 
 # Escalation to main firstmate
@@ -340,7 +340,7 @@ The report is the only thing that survives, so anything worth keeping must be in
 Write your findings to \`$DATA/$ID/report.md\`.
 The report must stand alone: what you did, what you found, the evidence (commands run, output, file:line references), and what you recommend.
 If your deliverable is a visual artifact the captain will review and iterate on, you may host the Lavish review loop yourself (poll, revise, re-serve, staying alive) instead of handing it back to firstmate.
-Before reporting done, read and follow \`$FM_ROOT/.agents/skills/decision-hold-lifecycle/SKILL.md\` and pass its shared completion gate for the report and any visual review.
+Before reporting done, read and follow \`$FM_ROOT/.agents/skills/captain-hold-lifecycle/SKILL.md\` and pass its shared completion gate for the report and any visual review.
 When the report is complete, append \`done: {one-line conclusion}\` to the status file and stop.
 If your findings reveal work that should ship (e.g. you reproduced a bug and the fix is clear), say so in the report; firstmate may promote this task in place, and you would then receive mode-specific ship instructions as a follow-up message.
 EOF
diff --git a/bin/fm-captain-hold.sh b/bin/fm-captain-hold.sh
new file mode 100755
index 0000000000..d844024560
--- /dev/null
+++ b/bin/fm-captain-hold.sh
@@ -0,0 +1,877 @@
+#!/usr/bin/env bash
+# fm-captain-hold.sh - deterministic mechanics for tasks held for the captain.
+#
+# The semantic policy is owned once by
+# .agents/skills/captain-hold-lifecycle/SKILL.md. This script never reads
+# report, visual-review, chat, or terminal prose to guess whether the captain
+# owes an answer. The invoking agent decides what is genuinely waiting on the
+# captain; this script supplies guarded creation, a durable record of what the
+# captain actually said, the investigation completion gate, and the one
+# keyed-answer intake every channel feeds.
+#
+# There is no separate decision type. A captain call is an ordinary backlog
+# task held for the captain (`tasks-axi hold <id> --kind captain`), and its
+# identity is simply the task id. Older installs created derived
+# `<origin>-decision-<key>` identities through bin/fm-decision-hold.sh; those
+# rows are already plain task ids, so they keep working here unchanged, and
+# the legacy inputs noted below resolve them without a migration.
+# All backlog mutations run in the active FM_HOME, which keeps main-home and
+# secondmate-home ownership aligned with the work that discovered the call.
+#
+# Usage:
+#   fm-captain-hold.sh hold <task-id> --reason <reason> \
+#     [--title <title>] [--repo <repo>] [--origin <origin-id>] [--until YYYY-MM-DD]
+#   fm-captain-hold.sh answer <task-id> --decision-file <path> [--release]
+#   fm-captain-hold.sh answers [<legacy-origin> | --any-origin] --source <provenance>   (keyed answers on stdin)
+#   fm-captain-hold.sh bind <source-id> [<legacy-origin> | --any-origin]
+#   fm-captain-hold.sh unbind <source-id>
+#   fm-captain-hold.sh binding <source-id>
+#   fm-captain-hold.sh complete <origin-id> (--none | <task-id>...)
+#   fm-captain-hold.sh verify <origin-id>
+#
+# `hold` places an existing task under an active captain hold, or creates the
+# task first when no work item exists to hold (--title required to create; the
+# optional --origin records provenance in the new task's body and supplies the
+# default repo from that origin's metadata). Prefer holding the work item the
+# question gates over minting a new row. Repeating `hold` with the same id is
+# idempotent; a task already closed is refused rather than reopened. `--until`
+# records the captain's own deferral date through `tasks-axi hold --until`, so
+# a "revisit later" answer is stored as a date instead of a live card.
+#
+# `answer` records the captain's exact words and closes the call in the same
+# act. It requires a non-empty captain decision file of at most 8192 bytes,
+# writes a resolution block at the top of the task body (the previous body is
+# preserved below the block and archived through tasks-axi --archive-body),
+# then closes the task with `tasks-axi done` - or, with `--release`, lifts the
+# hold with `tasks-axi unhold` so a captain-gated WORK item resumes instead of
+# closing. An exact retry is idempotent only when its requested close mode
+# matches the newest record; a changed decision or a mode mismatch is rejected.
+# A re-held task may record a new answer on top. On a task already closed outside this script,
+# `answer` records the missing resolution block (the old `repair` path) only
+# when the task still carries the captain-hold provenance tasks-axi preserves
+# through a close, so an ordinary finished task cannot be dressed up as an
+# answered captain call. A hold that expired by date (`--until` in the past) is
+# still answerable: the surviving hold annotations, not tasks-axi's live
+# `held:` bit, prove the captain owned it.
+#
+# ONE KEYED-ANSWER INTAKE, FED BY EVERY CHANNEL.
+# "A keyed answer closes its matching captain-held task" is a single
+# capability, owned here and nowhere else. `answers` reads
+# `<task-id>\t<answer>\t<label>[\t<mode>]` lines on stdin and closes each named
+# task through the very same `answer` path above, so every guard applies
+# identically no matter which channel the answer arrived on. The key IS the
+# task id - no identity arithmetic. The optional fourth field selects the close:
+# empty or `done` completes the task, `release` lifts the hold so held work
+# resumes; anything else is skipped. A key that names no task, a task that is
+# not held for the captain, or a task already closed is reported as `skipped:`
+# and feeds nothing. A replayed delivery whose answer digest and requested
+# close mode both match the newest record is reported `closed:` and is a no-op;
+# a mode mismatch is skipped. The command exits nonzero when any key was
+# skipped. `--source` is provenance text recorded in the
+# durable decision, never a behavior switch: this command has no per-channel
+# branch and no knowledge of chat, review decks, or any transport.
+# Legacy input: an optional positional origin (or a stored concrete-origin
+# binding) makes a key that names no task fall back to the old
+# `<origin>-decision-<key>` identity, so an in-flight pre-collapse channel
+# keeps closing its rows; `--any-origin` and the stored `(any)` marker mean
+# what an absent origin means and are accepted for the same reason.
+#
+# A channel's ONLY job is to turn whatever it received into those keyed lines
+# and pipe them here. It must never map keys to tasks, build decision records,
+# choose a close mode beyond what its card declared, or close anything itself.
+#
+# `bind`, `unbind`, and `binding` record that a captured-answer SOURCE feeds
+# this intake, for any channel whose answers arrive detached from their origin
+# (a process-event source id, for example). The binding is a private record
+# under `state/decision-bindings/`; a source with no binding feeds nothing, so
+# this whole path is opt-in per source and an unbound source behaves as if it
+# did not exist. `bind` deliberately does not require the source to exist yet,
+# so a channel can be bound BEFORE it is armed. The optional second argument
+# exists only for legacy pre-collapse records and callers: a concrete origin is
+# stored verbatim and used as the composition fallback above, and
+# `--any-origin` stores the same `(any)` marker a plain `bind <source-id>`
+# stores. `binding` prints the stored value verbatim and `answers` accepts it,
+# so the process-event runner's feed seam is unchanged.
+#
+# `complete` is the shared investigation and visual-review completion gate.
+# It attests, in the origin task's metadata, the reviewed inventory of
+# captain-held tasks that carry the origin's unresolved captain calls.
+# `--none` is an explicit semantic attestation that the just-reviewed surface
+# has no unresolved captain call, and is refused while the origin still has an
+# open keyed status decision. With a non-empty inventory, every listed task is
+# verified durable (actively captain-held, or closed with a recorded answer),
+# the inventory is unioned idempotently into the metadata, and every still-open
+# keyed status decision is transferred to its durable owner with a
+# `captain-held [key=...]` status close naming the inventory. Later review
+# passes may add ids. A post-teardown visual review can complete against the
+# surviving report and tasks without recreating task state.
+# `verify` is read-only and is called by scout teardown, so teardown cannot
+# erase a source before this gate has succeeded: every recorded inventory
+# entry must still be durable and no keyed status decision may be open.
+# Metadata compatibility: the attestation keeps the historical
+# `decisions_reviewed=1` and `decision_keys=` keys, and an inventory entry that
+# names no existing task resolves through the legacy `<origin>-decision-<entry>`
+# identity, so pre-collapse metadata written by fm-decision-hold.sh verifies
+# unchanged. An entry that exists as a task id is always that task.
+#
+# Resolution records: the block written into the body names this script, the
+# decision digest, and a `Resolution mode:` of answered, released, or repaired.
+# Records written by the retired fm-decision-hold.sh (routed, declined,
+# answered, repaired) are recognized everywhere a record is read, so nothing
+# already closed needs rewriting.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
+FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
+DATA="${FM_DATA_OVERRIDE:-$FM_HOME/data}"
+
+# shellcheck source=bin/fm-classify-lib.sh
+# shellcheck disable=SC1091
+. "$SCRIPT_DIR/fm-classify-lib.sh"
+# shellcheck source=bin/fm-tasks-axi-lib.sh
+# shellcheck disable=SC1091
+. "$SCRIPT_DIR/fm-tasks-axi-lib.sh"
+# shellcheck source=bin/fm-wake-lib.sh
+# shellcheck disable=SC1091
+. "$SCRIPT_DIR/fm-wake-lib.sh"
+
+CAPTAIN_META_LOCK=
+CAPTAIN_META_LOCK_HELD=0
+captain_hold_cleanup() {
+  if [ "$CAPTAIN_META_LOCK_HELD" = 1 ]; then
+    fm_lock_release "$CAPTAIN_META_LOCK" || true
+    CAPTAIN_META_LOCK_HELD=0
+  fi
+}
+trap captain_hold_cleanup EXIT
+
+usage() {
+  awk '
+    NR == 1 { next }
+    /^#/ { sub(/^# ?/, ""); print; next }
+    { exit }
+  ' "$0"
+}
+
+fail() {
+  printf 'fm-captain-hold: %s\n' "$*" >&2
+  exit 1
+}
+
+validate_slug() {  # <label> <value>
+  local label=$1 value=$2
+  case "$value" in
+    ''|*[!A-Za-z0-9._-]*) fail "$label must be a non-empty privacy-safe slug: $value" ;;
+  esac
+}
+
+validate_one_line() {  # <label> <value>
+  local label=$1 value=$2
+  [ -n "$value" ] || fail "$label must not be empty"
+  case "$value" in
+    *$'\n'*|*$'\r'*) fail "$label must be one line" ;;
+  esac
+}
+
+sha256_text() {  # <text>
+  if command -v shasum >/dev/null 2>&1; then
+    printf '%s' "$1" | shasum -a 256 | awk '{print $1}'
+  elif command -v sha256sum >/dev/null 2>&1; then
+    printf '%s' "$1" | sha256sum | awk '{print $1}'
+  else
+    fail "shasum or sha256sum is required"
+  fi
+}
+
+# The legacy derived identity older installs minted for a captain call.
+# Kept only to resolve pre-collapse rows, metadata entries, and channel keys.
+legacy_hold_id() {  # <origin-id> <key>
+  printf '%s-decision-%s' "$1" "$2"
+}
+
+# The legacy any-origin binding marker. Slug validation rejects parentheses, so
+# no real origin id or task id can collide with it.
+BINDING_ANY='(any)'
+
+DECISION_TEXT=''
+DECISION_DIGEST=''
+
+load_decision() {  # <path>; sets DECISION_TEXT and DECISION_DIGEST
+  local path=$1 decision
+  [ -n "$path" ] || fail "--decision-file is required"
+  [ -f "$path" ] || fail "decision file does not exist: $path"
+  decision=$(cat "$path")
+  [ -n "$decision" ] || fail "decision file must not be empty"
+  [ "$(printf '%s' "$decision" | LC_ALL=C wc -c | tr -d ' ')" -le 8192 ] \
+    || fail "decision file exceeds 8192 bytes"
+  DECISION_TEXT=$decision
+  DECISION_DIGEST=$(sha256_text "$decision")
+}
+
+tasks_axi() {
+  (cd "$FM_HOME" && tasks-axi "$@")
+}
+
+require_tasks_axi() {
+  fm_tasks_axi_compatible || fail "compatible tasks-axi is required"
+  tasks-axi hold --help 2>&1 | grep -F -- '--kind captain' >/dev/null \
+    || fail "tasks-axi does not expose the captain-hold contract"
+}
+
+task_show() {  # <id>
+  tasks_axi show "$1" --full 2>/dev/null
+}
+
+show_field() {  # <show-output> <field>
+  local output=$1 field=$2
+  printf '%s\n' "$output" | sed -n "s/^  $field: //p" | head -1
+}
+
+decode_shown_value() {  # <shown-field>
+  local value=$1
+  case "$value" in
+    \"*\")
+      printf '%s' "$value" | perl -MJSON::PP -e '
+        local $/;
+        my $value = decode_json(<STDIN>);
+        binmode STDOUT, ":raw";
+        utf8::encode($value) if utf8::is_utf8($value);
+        print $value;
+      '
+      ;;
+    *) printf '%s' "$value" ;;
+  esac
+}
+
+# Decode show-encoded scalar fields and normalize the empty marker.
+show_field_value() {  # <show-output> <field>
+  local value
+  value=$(decode_shown_value "$(show_field "$1" "$2")")
+  [ "$value" != '-' ] || value=''
+  printf '%s' "$value"
+}
+
+origin_exists_here() {  # <origin-id>
+  [ -f "$STATE/$1.meta" ] && return 0
+  [ -f "$DATA/$1/report.md" ] && return 0
+  task_show "$1" >/dev/null 2>&1
+}
+
+list_has_key() {  # <comma-list> <key>
+  case ",$1," in
+    *",$2,"*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+sorted_key_union() {  # <comma-list> <newline-or-space-separated-new-keys>
+  local existing=$1 new=$2
+  {
+    printf '%s\n' "$existing" | tr ',' '\n'
+    printf '%s\n' "$new" | tr ' ' '\n'
+  } | sed '/^$/d' | LC_ALL=C sort -u | paste -sd, -
+}
+
+meta_value() {  # <meta> <key>
+  grep "^$2=" "$1" 2>/dev/null | tail -1 | cut -d= -f2- || true
+}
+
+origin_open_decisions() {  # <origin-id>
+  local origin=$1 meta="$STATE/$1.meta" status_file="$STATE/$1.status" open kind last verb
+  open=$(status_open_decisions "$status_file")
+  [ -n "$open" ] || return 0
+  [ -f "$meta" ] || { printf '%s' "$open"; return 0; }
+  kind=$(meta_value "$meta" kind)
+  [ -n "$kind" ] || kind=ship
+  if [ "$kind" != secondmate ]; then
+    last=$(last_status_line "$status_file")
+    verb=$(status_line_verb "$last")
+    case "$verb" in
+      done|failed) return 0 ;;
+    esac
+  fi
+  printf '%s' "$open"
+}
+
+# A resolution record written by this script or by the retired
+# fm-decision-hold.sh. Both carry the same leader-then-captain-decision shape.
+body_has_resolution_record() {  # <task-body>
+  case "$1" in
+    *"Resolution recorded by fm-captain-hold."*"Captain decision:"*) return 0 ;;
+    *"Resolution recorded by fm-decision-hold."*"Captain decision:"*) return 0 ;;
+  esac
+  return 1
+}
+
+# The recorded decision digest of either record format, from the show-escaped
+# body (multi-line bodies print as one quoted line with \n escapes). Records
+# are prepended, so the first match is the newest record.
+recorded_decision_digest() {  # <task-body>
+  local rest=$1
+  case "$rest" in
+    *"Decision digest: "*) rest=${rest#*"Decision digest: "} ;;
+    *) return 1 ;;
+  esac
+  rest=${rest%%\\n*}
+  rest=${rest%%$'\n'*}
+  printf '%s' "$rest"
+}
+
+# The newest record's `Resolution mode:` value; empty for a record predating it.
+recorded_resolution_mode() {  # <task-body>
+  local rest=$1
+  case "$rest" in
+    *"Resolution mode: "*) rest=${rest#*"Resolution mode: "} ;;
+    *) return 1 ;;
+  esac
+  rest=${rest%%\\n*}
+  rest=${rest%%$'\n'*}
+  printf '%s' "$rest"
+}
+
+resolution_block() {  # <mode>
+  printf 'Resolution recorded by fm-captain-hold.\nDecision digest: %s\nResolution mode: %s\n\nCaptain decision:\n%s\n' \
+    "$DECISION_DIGEST" "$1" "$DECISION_TEXT"
+}
+
+# Durable state of one captain call: an active captain hold (annotations
+# surviving even when a date gate has expired) or a recorded captain answer.
+verify_hold_durable() {  # <task-id>
+  local id=$1 show state hold_kind body
+  show=$(task_show "$id") || fail "captain-held task $id is absent from $FM_HOME/data/backlog.md"
+  state=$(show_field "$show" state)
+  hold_kind=$(show_field_value "$show" hold_kind)
+  body=$(show_field "$show" body)
+  if body_has_resolution_record "$body"; then
+    return 0
+  fi
+  if [ "$state" != "done" ] && [ "$hold_kind" = captain ]; then
+    return 0
+  fi
+  fail "captain-held task $id is neither held for the captain nor closed with a recorded captain answer"
+}
+
+# Resolve one inventory entry or channel key to the task that carries it: the
+# exact task id when it exists, else the legacy derived identity.
+resolve_entry() {  # <origin-or-empty> <entry>; prints the resolved id or fails
+  local origin=$1 entry=$2 legacy
+  if task_show "$entry" >/dev/null 2>&1; then
+    printf '%s' "$entry"
+    return 0
+  fi
+  if [ -n "$origin" ] && [ "$origin" != "$BINDING_ANY" ]; then
+    legacy=$(legacy_hold_id "$origin" "$entry")
+    if task_show "$legacy" >/dev/null 2>&1; then
+      printf '%s' "$legacy"
+      return 0
+    fi
+    fail "no captain-held task $entry and no legacy identity $legacy in $FM_HOME/data/backlog.md"
+  fi
+  fail "no captain-held task $entry in $FM_HOME/data/backlog.md"
+}
+
+command_hold() {
+  local id=${1:-} title='' reason='' repo='' origin='' until='' show state existing_title body='' hold_kind
+  [ "$#" -ge 1 ] || { usage >&2; exit 2; }
+  shift
+  while [ "$#" -gt 0 ]; do
+    case "$1" in
+      --title) shift; title=${1:-} ;;
+      --reason) shift; reason=${1:-} ;;
+      --repo) shift; repo=${1:-} ;;
+      --origin) shift; origin=${1:-} ;;
+      --until) shift; until=${1:-} ;;
+      *) usage >&2; exit 2 ;;
+    esac
+    shift
+  done
+  validate_slug task-id "$id"
+  validate_one_line reason "$reason"
+  case "$reason" in *'('*|*')'*) fail "reason must not contain parentheses (tasks-axi hold contract)" ;; esac
+  if [ -n "$origin" ]; then
+    validate_slug origin-id "$origin"
+  fi
+  if [ -n "$until" ]; then
+    case "$until" in
+      [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]) : ;;
+      *) fail "--until must be a YYYY-MM-DD date: $until" ;;
+    esac
+  fi
+  require_tasks_axi
+  if show=$(task_show "$id"); then
+    state=$(show_field "$show" state)
+    [ "$state" != "done" ] \
+      || fail "task $id is already closed; a new captain call needs its own task"
+    if [ -n "$title" ]; then
+      existing_title=$(show_field_value "$show" title)
+      [ "$existing_title" = "$title" ] || fail "existing task $id has a different title"
+    fi
+  else
+    [ -n "$title" ] || fail "--title is required to create task $id"
+    validate_one_line title "$title"
+    if [ -z "$repo" ] && [ -n "$origin" ] && [ -f "$STATE/$origin.meta" ]; then
+      repo=$(meta_value "$STATE/$origin.meta" project)
+      repo=${repo%/}
+      repo=${repo##*/}
+    fi
+    [ -n "$repo" ] || repo=firstmate
+    validate_one_line repo "$repo"
+    [ -z "$origin" ] || body=$(printf 'Origin: %s' "$origin")
+    if [ -n "$body" ]; then
+      tasks_axi add "$id" "$title" --repo "$repo" --body "$body" >/dev/null \
+        || fail "could not create task $id"
+    else
+      tasks_axi add "$id" "$title" --repo "$repo" >/dev/null \
+        || fail "could not create task $id"
+    fi
+  fi
+  if [ -n "$until" ]; then
+    tasks_axi hold "$id" --reason "$reason" --kind captain --until "$until" >/dev/null \
+      || fail "could not hold task $id for the captain"
+  else
+    tasks_axi hold "$id" --reason "$reason" --kind captain >/dev/null \
+      || fail "could not hold task $id for the captain"
+  fi
+  show=$(task_show "$id") || fail "task $id disappeared while holding it"
+  hold_kind=$(show_field_value "$show" hold_kind)
+  [ "$hold_kind" = captain ] || fail "task $id did not retain its captain hold"
+  printf '%s\n' "$id"
+}
+
+# Record a resolution block at the top of the task body, preserving the
+# previous body below it and archiving the pristine original.
+write_resolution_record() {  # <task-id> <mode> <shown-body>
+  local id=$1 mode=$2 body=$3 new_body tmp
+  new_body=$(resolution_block "$mode")
+  body=$(decode_shown_value "$body") \
+    || fail "could not decode the existing body for $id"
+  if [ -n "$body" ]; then
+    new_body=$(printf '%s\n\n%s' "$new_body" "$body")
+  fi
+  tmp=$(umask 077; mktemp "${TMPDIR:-/tmp}/fm-captain-hold-body.XXXXXX") \
+    || fail "cannot stage the resolution record"
+  if ! printf '%s\n' "$new_body" > "$tmp"; then
+    rm -f -- "$tmp"
+    fail "cannot stage the resolution record for $id"
+  fi
+  if ! tasks_axi update "$id" --body-file "$tmp" --archive-body >/dev/null; then
+    rm -f -- "$tmp"
+    fail "could not record the captain decision on $id"
+  fi
+  rm -f -- "$tmp"
+}
+
+close_answered() {  # <task-id> <release-0-or-1>
+  if [ "$2" = 1 ]; then
+    tasks_axi unhold "$1" >/dev/null || fail "could not release captain-held task $1"
+  else
+    tasks_axi "done" "$1" >/dev/null || fail "could not close answered captain-held task $1"
+  fi
+}
+
+command_answer() {
+  local id=${1:-} decision_file='' release=0 show state hold_kind body outcome recorded_mode
+  [ "$#" -ge 1 ] || { usage >&2; exit 2; }
+  shift
+  while [ "$#" -gt 0 ]; do
+    case "$1" in
+      --decision-file) shift; decision_file=${1:-} ;;
+      --release) release=1 ;;
+      *) usage >&2; exit 2 ;;
+    esac
+    shift
+  done
+  validate_slug task-id "$id"
+  load_decision "$decision_file"
+  require_tasks_axi
+  show=$(task_show "$id") || fail "captain-held task $id is absent from $FM_HOME/data/backlog.md"
+  state=$(show_field "$show" state)
+  hold_kind=$(show_field_value "$show" hold_kind)
+  body=$(show_field "$show" body)
+  if [ "$release" = 1 ]; then outcome=released; else outcome=answered; fi
+
+  if [ "$state" = "done" ]; then
+    if body_has_resolution_record "$body"; then
+      # An exact compatible retry is an idempotent no-op; drift is rejected.
+      [ "$(recorded_decision_digest "$body" || true)" = "$DECISION_DIGEST" ] \
+        || fail "captain-held task $id records a different captain decision"
+      recorded_mode=$(recorded_resolution_mode "$body" || true)
+      [ "$recorded_mode" != released ] \
+        || fail "task $id records this answer with mode released; a closed task cannot replay that release"
+      [ "$release" = 0 ] \
+        || fail "task $id records this answer with mode ${recorded_mode:-unknown}; --release cannot reopen a closed task"
+      printf 'answered: %s\n' "$id"
+      return 0
+    fi
+    [ "$release" = 0 ] || fail "task $id is already closed; --release cannot reopen it"
+    # Closed outside this script: record the captain's answer retroactively.
+    # tasks-axi keeps hold_kind through a close, so it is the surviving proof
+    # this really was the captain's item rather than ordinary finished work.
+    [ "$hold_kind" = captain ] \
+      || fail "task $id was never held for the captain; nothing to record an answer on"
+    write_resolution_record "$id" repaired "$body"
+    show=$(task_show "$id") || fail "task $id disappeared while recording the answer"
+    [ "$(show_field "$show" state)" = "done" ] || fail "recording the answer reopened closed task $id"
+    body_has_resolution_record "$(show_field "$show" body)" \
+      || fail "captain-held task $id did not retain its durable resolution record"
+    printf 'repaired: %s\n' "$id"
+    return 0
+  fi
+
+  if [ "$hold_kind" = captain ]; then
+    # Actively the captain's item (a date-expired hold keeps its annotations
+    # and stays answerable). A matching record means an interrupted close to
+    # finish; a different digest is a NEW answer on a re-held task and gets
+    # its own record on top. Either way the close mode is the caller's flag,
+    # checked against an interrupted close's recorded mode so a retry cannot
+    # silently flip a release into a close.
+    if body_has_resolution_record "$body" \
+      && [ "$(recorded_decision_digest "$body" || true)" = "$DECISION_DIGEST" ]; then
+      recorded_mode=$(recorded_resolution_mode "$body" || true)
+      case "$recorded_mode" in
+        released) [ "$release" = 1 ] || fail "task $id records this answer as a release; retry with --release" ;;
+        answered) [ "$release" = 0 ] || fail "task $id records this answer as a close; retry without --release" ;;
+      esac
+      close_answered "$id" "$release"
+      printf '%s: %s\n' "$outcome" "$id"
+      return 0
+    fi
+    write_resolution_record "$id" "$outcome" "$body"
+    close_answered "$id" "$release"
+    show=$(task_show "$id") || fail "task $id disappeared after closing"
+    body_has_resolution_record "$(show_field "$show" body)" \
+      || fail "captain-held task $id did not retain its durable resolution record"
+    printf '%s: %s\n' "$outcome" "$id"
+    return 0
+  fi
+
+  # Not held and not closed: only an already-recorded release replays cleanly.
+  if body_has_resolution_record "$body"; then
+    recorded_mode=$(recorded_resolution_mode "$body" || true)
+    [ "$(recorded_decision_digest "$body" || true)" = "$DECISION_DIGEST" ] \
+      || fail "task $id records a different captain decision with mode ${recorded_mode:-unknown}"
+    [ "$recorded_mode" = released ] && [ "$release" = 1 ] \
+      || fail "task $id records this answer with mode ${recorded_mode:-unknown}; replay requires matching --release"
+    printf 'released: %s\n' "$id"
+    return 0
+  fi
+  fail "task $id is not held for the captain; hold it first or name the right task"
+}
+
+# --- the one keyed-answer intake, and the source bindings that feed it --------
+
+BINDING_DIR="$STATE/decision-bindings"
+BINDING_SCHEMA=fm-decision-binding.v1
+
+validate_source_id() {  # <source-id>
+  validate_slug source-id "$1"
+  [ "${#1}" -le 64 ] || fail "source-id must be at most 64 characters: $1"
+}
+
+binding_path() { printf '%s/%s.origin\n' "$BINDING_DIR" "$1"; }
+
+# The stored binding value, or empty when the source is unbound. An unreadable
+# or wrong-schema record is a hard error rather than a silent "unbound":
+# feeding nothing is the safe direction only when it is a deliberate choice,
+# never when it is a corrupted record.
+read_binding() {  # <source-id>
+  local path origin schema
+  path=$(binding_path "$1")
+  [ -e "$path" ] || return 0
+  [ -f "$path" ] && [ ! -L "$path" ] || fail "decision binding is unsafe: $path"
+  schema=$(sed -n 's/^schema=//p' "$path" | head -1)
+  [ "$schema" = "$BINDING_SCHEMA" ] || fail "decision binding has an incompatible schema: $path"
+  origin=$(sed -n 's/^origin=//p' "$path" | head -1)
+  if [ "$origin" != "$BINDING_ANY" ]; then
+    case "$origin" in
+      ''|*[!A-Za-z0-9._-]*) fail "decision binding has an invalid origin id: $path" ;;
+    esac
+  fi
+  printf '%s\n' "$origin"
+}
+
+command_bind() {
+  local source=${1:-} origin=${2:-} dest tmp
+  [ "$#" -ge 1 ] && [ "$#" -le 2 ] || { usage >&2; exit 2; }
+  validate_source_id "$source"
+  if [ -z "$origin" ] || [ "$origin" = --any-origin ]; then
+    origin=$BINDING_ANY
+  else
+    validate_slug legacy-origin "$origin"
+  fi
+  (umask 077; mkdir -p "$BINDING_DIR") || fail "cannot create $BINDING_DIR"
+  [ -d "$BINDING_DIR" ] && [ ! -L "$BINDING_DIR" ] || fail "decision binding dir is unsafe: $BINDING_DIR"
+  dest=$(binding_path "$source")
+  tmp=$(umask 077; mktemp "$BINDING_DIR/.origin.XXXXXX") || fail "cannot stage the decision binding"
+  if ! { printf 'schema=%s\norigin=%s\n' "$BINDING_SCHEMA" "$origin" > "$tmp" \
+    && chmod 0600 "$tmp" && mv -f -- "$tmp" "$dest"; }; then
+    rm -f -- "$tmp"
+    fail "cannot record the decision binding for $source"
+  fi
+  printf 'bound: %s -> %s\n' "$source" "$origin"
+}
+
+command_unbind() {
+  local source=${1:-}
+  [ "$#" -eq 1 ] || { usage >&2; exit 2; }
+  validate_source_id "$source"
+  rm -f -- "$(binding_path "$source")"
+  printf 'unbound: %s\n' "$source"
+}
+
+command_binding() {
+  local source=${1:-} origin
+  [ "$#" -eq 1 ] || { usage >&2; exit 2; }
+  validate_source_id "$source"
+  origin=$(read_binding "$source") || exit 1
+  [ -n "$origin" ] || return 1
+  printf '%s\n' "$origin"
+}
+
+# The durable captain decision one keyed answer records. Pure function of its
+# inputs, so the same answer delivered twice is idempotent rather than a
+# conflicting decision.
+keyed_decision_text() {  # <source> <task-id> <answer> <label>
+  printf 'Captain answered this call through %s.\n' "$1"
+  printf 'Task: %s\n' "$2"
+  printf 'Answer: %s\n' "$3"
+  [ -z "$4" ] || printf 'Answer as shown to the captain: %s\n' "$4"
+}
+
+legacy_keyed_decision_text() {  # <source> <key> <answer> <label>
+  printf 'Captain answered this decision through %s.\n' "$1"
+  printf 'Decision key: %s\n' "$2"
+  printf 'Answer: %s\n' "$3"
+  [ -z "$4" ] || printf 'Answer as shown to the captain: %s\n' "$4"
+}
+
+sanitize_field() {  # <text>
+  printf '%s' "$1" | tr '\n\r\t' '   ' | LC_ALL=C tr -d '\000-\037\177' | cut -c1-512
+}
+
+command_answers() {
+  local origin='' source='' row rest key answer label mode id show state hold_kind body digest legacy_digest legacy_key
+  local recorded_digest recorded_mode tmp err closed=0 skipped=0 reason release_flag tab=$'\t'
+  while [ "$#" -gt 0 ]; do
+    case "$1" in
+      --source) shift; source=${1:-} ;;
+      --any-origin) origin=$BINDING_ANY ;;
+      --*) usage >&2; exit 2 ;;
+      *)
+        [ -z "$origin" ] || { usage >&2; exit 2; }
+        origin=$1
+        ;;
+    esac
+    shift
+  done
+  if [ -n "$origin" ] && [ "$origin" != "$BINDING_ANY" ]; then
+    validate_slug legacy-origin "$origin"
+  fi
+  [ -n "$source" ] || fail "--source provenance is required so the durable decision records where the answer came from"
+  source=$(sanitize_field "$source")
+  require_tasks_axi
+  tmp=$(umask 077; mktemp "${TMPDIR:-/tmp}/fm-keyed-decision.XXXXXX") || fail "cannot stage the captain decision"
+  err=$(umask 077; mktemp "${TMPDIR:-/tmp}/fm-keyed-decision-err.XXXXXX") \
+    || { rm -f -- "$tmp"; fail "cannot stage the captain decision diagnostics"; }
+  while IFS= read -r row; do
+    key=${row%%"$tab"*}
+    rest=''
+    case "$row" in *"$tab"*) rest=${row#*"$tab"} ;; esac
+    answer=${rest%%"$tab"*}
+    case "$rest" in *"$tab"*) rest=${rest#*"$tab"} ;; *) rest='' ;; esac
+    label=${rest%%"$tab"*}
+    case "$rest" in *"$tab"*) mode=${rest#*"$tab"} ;; *) mode='' ;; esac
+    [ -n "${key:-}" ] || continue
+    case "$key" in *[!A-Za-z0-9._-]*) continue ;; esac
+    [ "${#key}" -le 128 ] || continue
+    answer=$(sanitize_field "${answer:-}")
+    [ -n "$answer" ] || continue
+    label=$(sanitize_field "${label:-}")
+    release_flag=''
+    case "${mode:-}" in
+      ''|done) : ;;
+      release) release_flag=--release ;;
+      *)
+        printf 'skipped: %s (unknown close mode %s)\n' "$key" "$(sanitize_field "$mode")"
+        skipped=$((skipped + 1))
+        continue
+        ;;
+    esac
+    if ! id=$(resolve_entry "$origin" "$key" 2>/dev/null); then
+      printf 'skipped: %s (no captain-held task with that id)\n' "$key"
+      skipped=$((skipped + 1))
+      continue
+    fi
+    keyed_decision_text "$source" "$id" "$answer" "$label" > "$tmp" \
+      || fail "cannot stage the captain decision for $id"
+    digest=$(sha256_text "$(cat "$tmp")")
+    legacy_digest=''
+    if [ "$id" != "$key" ]; then
+      legacy_key=$key
+    elif { [ -z "$origin" ] || [ "$origin" = "$BINDING_ANY" ]; } \
+      && [ "${id#*-decision-}" != "$id" ]; then
+      legacy_key=${id#*-decision-}
+    else
+      legacy_key=''
+    fi
+    if [ -n "$legacy_key" ]; then
+      legacy_digest=$(sha256_text "$(legacy_keyed_decision_text "$source" "$legacy_key" "$answer" "$label")")
+    fi
+    show=$(task_show "$id") || { printf 'skipped: %s (absent)\n' "$id"; skipped=$((skipped + 1)); continue; }
+    state=$(show_field "$show" state)
+    hold_kind=$(show_field_value "$show" hold_kind)
+    body=$(show_field "$show" body)
+    recorded_digest=$(recorded_decision_digest "$body" || true)
+    recorded_mode=$(recorded_resolution_mode "$body" || true)
+    if body_has_resolution_record "$body" \
+      && { [ "$recorded_digest" = "$digest" ] \
+        || { case "$body" in *"Resolution recorded by fm-decision-hold."*) true ;; *) false ;; esac \
+          && [ -n "$legacy_digest" ] && [ "$recorded_digest" = "$legacy_digest" ]; }; }; then
+      if { [ -z "$release_flag" ] && [ "$state" = "done" ] && [ "$recorded_mode" != released ]; } \
+        || { [ "$release_flag" = --release ] && [ "$state" != "done" ] \
+          && [ "$hold_kind" != captain ] && [ "$recorded_mode" = released ]; }; then
+        printf 'closed: %s\n' "$id"
+        closed=$((closed + 1))
+        continue
+      fi
+    fi
+    if [ "$state" = "done" ]; then
+      printf 'skipped: %s (already closed)\n' "$id"
+      skipped=$((skipped + 1))
+      continue
+    fi
+    if [ "$hold_kind" != captain ]; then
+      printf 'skipped: %s (not held for the captain)\n' "$id"
+      skipped=$((skipped + 1))
+      continue
+    fi
+    # shellcheck disable=SC2086  # release_flag is empty or a single literal flag.
+    if "$0" answer "$id" --decision-file "$tmp" $release_flag </dev/null >/dev/null 2>"$err"; then
+      printf 'closed: %s\n' "$id"
+      closed=$((closed + 1))
+    else
+      reason=$(tr -d '\n' < "$err" | sed 's/^fm-captain-hold: //')
+      printf 'skipped: %s (%s)\n' "$id" "$reason"
+      skipped=$((skipped + 1))
+    fi
+  done
+  rm -f -- "$tmp" "$err"
+  printf 'answers: closed=%s skipped=%s\n' "$closed" "$skipped"
+  [ "$skipped" -eq 0 ]
+}
+
+command_complete() {
+  local origin=${1:-} meta previous='' supplied='' keys='' entry key status_file open raw_open has_meta=0 transfer_rc
+  [ "$#" -ge 2 ] || { usage >&2; exit 2; }
+  validate_slug origin-id "$origin"
+  shift
+  meta="$STATE/$origin.meta"
+  [ -f "$meta" ] && has_meta=1
+  if [ "$has_meta" = 1 ]; then
+    CAPTAIN_META_LOCK=$(fm_meta_lock_path "$meta") || fail "could not resolve task metadata lock"
+    fm_lock_acquire_wait "$CAPTAIN_META_LOCK"
+    CAPTAIN_META_LOCK_HELD=1
+    [ -f "$meta" ] || fail "task metadata disappeared while recording completion"
+  fi
+  require_tasks_axi
+  origin_exists_here "$origin" || fail "origin $origin is not owned by the active home $FM_HOME"
+  if [ "$#" -eq 1 ] && [ "$1" = --none ]; then
+    supplied=''
+  else
+    while [ "$#" -gt 0 ]; do
+      [ "$1" != --none ] || fail "--none cannot be combined with task ids"
+      validate_slug task-id "$1"
+      supplied="${supplied}${supplied:+ }$1"
+      shift
+    done
+  fi
+  if [ "$has_meta" = 1 ]; then
+    previous=$(meta_value "$meta" decision_keys)
+  fi
+  keys=$(sorted_key_union "$previous" "$supplied")
+  if [ -n "$keys" ]; then
+    while IFS= read -r entry; do
+      [ -n "$entry" ] || continue
+      verify_hold_durable "$(resolve_entry "$origin" "$entry")"
+    done <<EOF
+$(printf '%s\n' "$keys" | tr ',' '\n')
+EOF
+  fi
+
+  status_file="$STATE/$origin.status"
+  raw_open=$(status_open_decisions "$status_file")
+  open=$(origin_open_decisions "$origin")
+  if [ -n "$open" ] && [ -z "$keys" ]; then
+    fail "origin $origin still has open captain decisions in its status stream; hold a captain task for what remains, or answer them, before attesting --none"
+  fi
+
+  if [ "$has_meta" = 1 ]; then
+    if [ "$(meta_value "$meta" decisions_reviewed)" != 1 ] || [ "$previous" != "$keys" ]; then
+      printf 'decisions_reviewed=1\ndecision_keys=%s\n' "$keys" >> "$meta"
+    fi
+    fm_lock_release "$CAPTAIN_META_LOCK"
+    CAPTAIN_META_LOCK_HELD=0
+
+    # Transfer every still-open status decision to the durable captain-held
+    # inventory so the live status fold does not duplicate the same Captain's
+    # Call item. The transfer line is this home's own bookkeeping close,
+    # written by the turn that just reviewed the inventory, so it uses the
+    # guarded self-announced append (bin/fm-wake-lib.sh) and does not wake this
+    # same session; an append failure still fails this command loudly.
+    if [ -n "$keys" ]; then
+      while IFS=$'\t' read -r key _verb _summary; do
+        [ -n "$key" ] || continue
+        transfer_rc=0
+        fm_wake_status_append_self_announced "$STATE" "$status_file" \
+          "captain-held [key=$key]: tracked by $keys" || transfer_rc=$?
+        [ "$transfer_rc" -ne 2 ] || fail "cannot append the captain-held transfer for $origin/$key"
+      done <<EOF
+$raw_open
+EOF
+    fi
+  fi
+  printf 'complete: %s captain-call inventory reviewed%s\n' "$origin" "${keys:+ ($keys)}"
+}
+
+command_verify() {
+  local origin=${1:-} meta reviewed keys entry key open
+  [ "$#" -eq 1 ] || { usage >&2; exit 2; }
+  validate_slug origin-id "$origin"
+  meta="$STATE/$origin.meta"
+  [ -f "$meta" ] || fail "origin metadata is absent: $meta"
+  require_tasks_axi
+  reviewed=$(meta_value "$meta" decisions_reviewed)
+  [ "$reviewed" = 1 ] || fail "origin $origin has no completed captain-call inventory"
+  keys=$(meta_value "$meta" decision_keys)
+  if [ -n "$keys" ]; then
+    while IFS= read -r entry; do
+      [ -n "$entry" ] || continue
+      verify_hold_durable "$(resolve_entry "$origin" "$entry")"
+    done <<EOF
+$(printf '%s\n' "$keys" | tr ',' '\n')
+EOF
+  fi
+  open=$(origin_open_decisions "$origin")
+  while IFS=$'\t' read -r key _verb _summary; do
+    [ -n "$key" ] || continue
+    fail "open captain decision $origin/$key is not transferred to the captain-held inventory; re-run complete"
+  done <<EOF
+$open
+EOF
+  printf 'verified: %s captain-call inventory\n' "$origin"
+}
+
+case "${1:-}" in
+  hold) shift; command_hold "$@" ;;
+  answer) shift; command_answer "$@" ;;
+  answers) shift; command_answers "$@" ;;
+  bind) shift; command_bind "$@" ;;
+  unbind) shift; command_unbind "$@" ;;
+  binding) shift; command_binding "$@" ;;
+  complete) shift; command_complete "$@" ;;
+  verify) shift; command_verify "$@" ;;
+  -h|--help) usage ;;
+  *) usage >&2; exit 2 ;;
+esac
diff --git a/bin/fm-classify-lib.sh b/bin/fm-classify-lib.sh
index 30f0fd027c..db63c2b6bc 100755
--- a/bin/fm-classify-lib.sh
+++ b/bin/fm-classify-lib.sh
@@ -73,7 +73,7 @@ FM_PAUSE_RESURFACE_SECS_DEFAULT=3600
 # The resolution verb and durable-backlog-transfer verb that CLOSE a keyed
 # status decision opened by needs-decision or blocked. See status_open_decisions
 # below for the status-fold contract. The transfer verb is written only after
-# fm-decision-hold.sh has verified the corresponding captain-held backlog item.
+# fm-captain-hold.sh has verified the corresponding captain-held backlog item.
 FM_CLASSIFY_RESOLVE_VERB_DEFAULT='resolved'
 FM_CLASSIFY_CAPTAIN_HELD_VERB_DEFAULT='captain-held'
 
diff --git a/bin/fm-decision-hold.sh b/bin/fm-decision-hold.sh
index 794336b232..c1a7a6c9f0 100755
--- a/bin/fm-decision-hold.sh
+++ b/bin/fm-decision-hold.sh
@@ -1,158 +1,37 @@
 #!/usr/bin/env bash
-# fm-decision-hold.sh - deterministic mechanics for durable captain decisions.
+# fm-decision-hold.sh - transitional compatibility shim over bin/fm-captain-hold.sh.
 #
-# The semantic policy is owned once by
-# .agents/skills/decision-hold-lifecycle/SKILL.md. This script never reads report,
-# visual-review, chat, or terminal prose to guess whether a decision exists.
-# The invoking agent inventories unresolved decisions, assigns stable keys, and
-# routes dependent work. This script supplies deterministic identities, creates
-# and verifies structured tasks-axi captain holds, records completion attestation
-# in the originating task's metadata, and requires a durable captain decision
-# record before it closes or repairs a hold.
+# The separate "decision" concept collapsed into the one primitive the captain
+# cares about: a task held for the captain. bin/fm-captain-hold.sh owns every
+# surviving behavior; this shim only maps the retired command surface onto it so
+# in-flight work briefed before the collapse keeps working for one release, and
+# it will be removed in the release after the collapse lands.
 #
-# A hold identity is <origin-id>-decision-<decision-key>. Origin ids and decision
-# keys must already be privacy-safe slugs. Repeating `hold` with the same identity
-# is idempotent. A different decision key creates a different backlog identity.
-# All backlog mutations run in the active FM_HOME, which keeps main-home and
-# secondmate-home ownership aligned with the work that discovered the decision.
-#
-# Usage:
-#   fm-decision-hold.sh id <origin-id> <decision-key>
-#   fm-decision-hold.sh hold <origin-id> <decision-key> \
-#     --title <title> --reason <reason> [--repo <repo>]
-#   fm-decision-hold.sh complete <origin-id> (--none | <decision-key>...)
-#   fm-decision-hold.sh verify <origin-id>
-#   fm-decision-hold.sh resolve <origin-id> <decision-key> \
-#     --decision-file <path> --routed-to <task-id> [--routed-to <task-id>...]
-#   fm-decision-hold.sh answer <origin-id> <decision-key> --decision-file <path>
-#   fm-decision-hold.sh answers (<origin-id> | --any-origin) --source <provenance>   (keyed answers on stdin)
-#   fm-decision-hold.sh bind <source-id> (<origin-id> | --any-origin)
-#   fm-decision-hold.sh unbind <source-id>
-#   fm-decision-hold.sh binding <source-id>
-#   fm-decision-hold.sh decline <origin-id> <decision-key> --decision-file <path>
-#   fm-decision-hold.sh repair <origin-id> <decision-key> --decision-file <path>
-#
-# `complete` is the shared investigation and visual-review completion gate.
-# `--none` is an explicit semantic attestation that the just-reviewed surface has
-# no unresolved captain decision. Later review passes may add keys; a live task's
-# metadata inventory is unioned idempotently. A post-teardown visual review can
-# complete against the surviving report and holds without recreating task state.
-# `verify` is read-only and is called by scout teardown so teardown cannot erase a
-# source before this gate has succeeded.
-#
-# `resolve`, `answer`, and `decline` close active holds; `repair` attests a hold
-# already closed outside this script. All four paths require a non-empty captain
-# decision file of at most 8192 bytes, record the same durable resolution block in
-# the hold body, and store the decision digest plus routed identities so an exact
-# retry is idempotent while a changed decision or, for `resolve`, routed set is
-# rejected. New records include a `Resolution mode:` naming their path; older
-# routed records remain valid.
-#
-# `resolve` is the routed path. It requires every --routed-to task to exist and to
-# be blocked by the hold. It writes the captain decision and routed identities into
-# the hold body, clears those dependency edges, and only then marks the hold Done.
-# A failure before the final step leaves the captain hold open.
-#
-# `answer` is the answer-time closure path, the hold ledger's counterpart to
-# `fm-send.sh --resolve-key`: it exists so the act that carries the captain's
-# answer is the act that closes the hold, instead of leaving closure to a
-# separate later call nobody is forced to make. It records the captain's answer
-# on an actively held hold, records `(none)` as the routed identities because no
-# follow-up work has been routed behind the hold yet, and closes it. It shares
-# every guard the public `decline` path has, including the refusal while any task
-# is still blocked by the hold, so a substantive decision whose follow-up work is
-# already routed still goes through `resolve` and the routed-vs-unrouted
-# distinction survives. It says only that the captain answered; an ordinary
-# `decline` still says the captain answered with no follow-up work at all. The
-# reserved keyed-answer drop described below is the sole internal exception.
-#
-# ONE KEYED-ANSWER INTAKE, FED BY EVERY CHANNEL.
-# "A keyed answer closes its matching hold" is a single capability, owned here
-# and nowhere else. `answers` is its channel-agnostic entry point: it reads
-# `<decision-key>\t<answer>\t<label>` lines on stdin, maps each key to this
-# origin's `<origin-id>-decision-<key>` hold, and closes it through the very same
-# `answer` path above, except that the exact reserved answer `__drop__` closes
-# with a declined "dropped by captain" decision record rather than as a
-# substantive choice. Drop closes only the hold; existing dependent tasks remain
-# queued as independent work. Every other guard applies identically no matter
-# which channel the answer arrived on. With `--any-origin` in place of an origin
-# id, each key is instead a FULL hold identity `<origin>-decision-<key>`, split at its first
-# `-decision-`, so one source can carry answers for holds across origins - the
-# aggregation a bearings board needs. An origin id that itself contains
-# `-decision-` is outside any-origin resolution; bind such a source to its one
-# origin instead. A key with no `-decision-` separator (a merge or dispatch
-# instruction, for example) is reported as `skipped:` and feeds nothing, which
-# keeps non-decision answers out of the hold ledger by construction.
-# `--source` is provenance text recorded in the durable
-# decision, never a behavior switch: this command has no per-channel branch and
-# no knowledge of chat, review decks, or any transport.
-#
-# A channel's ONLY job is to turn whatever it received into those keyed lines and
-# pipe them here. It must never map keys to holds, build decision records, decide
-# resolve-versus-decline, or close a hold itself. Emitting `__drop__` is how a
-# channel reports that the captain dropped the decision; this intake, not the
-# channel, chooses `decline`. A future channel needs no change here at all.
-#
-# The decision text is a pure function of (source, key, answer, label), which is
-# what makes a replayed delivery an idempotent no-op rather than a rejected
-# "different captain decision". A key whose hold is absent or already closed is
-# reported as `skipped:`; a substantive answer whose hold still blocks routed
-# work is also skipped and left for `resolve`. A reserved drop still closes only
-# that hold, and the command exits nonzero when any key was skipped.
-#
-# `bind`, `unbind`, and `binding` record whether a captured-answer SOURCE belongs
-# to one origin or uses the any-origin intake, for any channel whose answers arrive detached from the origin (a
-# process-event source id, for example). The binding is a private record under
-# `state/decision-bindings/`; a source with no binding feeds nothing, so this
-# whole path is opt-in per source and an unbound source behaves as if it did not
-# exist. `bind` deliberately does not require the source to exist yet, so a
-# channel can be bound BEFORE it is armed and never produce an answer that has
-# nowhere to go. `bind <source-id> --any-origin` records the any-origin marker
-# instead of one origin; `binding` prints that marker verbatim and `answers`
-# accepts it, so the process-event runner feeds an any-origin source through the
-# same seam with no runner change.
-#
-# Public `decline` is the unrouted path for a decision the captain answered with
-# no follow-up work. It takes no --routed-to task, records `(none)` as the routed
-# identities, and closes an actively held hold. It refuses while any task is
-# still blocked by the hold, because releasing routed work without recording it
-# is `resolve`'s job. Only `answers` may invoke its private drop mode, which
-# closes the stale hold without closing or recording existing dependents.
-#
-# `repair` records the missing resolution block on a hold that was already closed
-# outside this script, so `verify` stops failing on an origin whose decision was
-# genuinely answered. It never reopens a hold, never clears a dependency edge, and
-# refuses a hold that is still actively held, so an unanswered decision keeps
-# blocking teardown until `resolve` or `decline` closes it with the captain's word.
-# It also refuses an identity that does not carry surviving captain-hold
-# provenance, so an ordinary captain-kind task cannot be repaired into a decision.
+# Mapping (old -> new):
+#   id <origin> <key>                      -> prints the legacy <origin>-decision-<key> identity
+#   hold <origin> <key> --title --reason [--repo]
+#                                          -> hold <origin>-decision-<key> --origin <origin> ...
+#   complete <origin> (--none | <key>...)  -> complete <origin> (--none | <origin>-decision-<key>...)
+#   verify <origin>                        -> verify <origin>
+#   resolve <origin> <key> --decision-file <f> --routed-to <id>...
+#                                          -> answer <origin>-decision-<key> with the routed ids
+#                                             appended to the decision text, then clear the
+#                                             recorded blocked-by edges through tasks-axi; an
+#                                             exact replay of a pre-collapse routed record reuses
+#                                             its historical digest and text before clearing edges
+#   answer|decline|repair <origin> <key> --decision-file <f>
+#                                          -> answer <origin>-decision-<key> --decision-file <f>
+#   answers (<origin> | --any-origin) --source <p>
+#                                          -> answers with the same positional (the intake resolves
+#                                             task ids first and legacy identities second)
+#   bind <source> (<origin> | --any-origin) -> bind <source> [<origin>]
+#   unbind | binding <source>              -> unchanged
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
 FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
-STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
-DATA="${FM_DATA_OVERRIDE:-$FM_HOME/data}"
-
-# shellcheck source=bin/fm-classify-lib.sh
-# shellcheck disable=SC1091
-. "$SCRIPT_DIR/fm-classify-lib.sh"
-# shellcheck source=bin/fm-tasks-axi-lib.sh
-# shellcheck disable=SC1091
-. "$SCRIPT_DIR/fm-tasks-axi-lib.sh"
-# shellcheck source=bin/fm-wake-lib.sh
-# shellcheck disable=SC1091
-. "$SCRIPT_DIR/fm-wake-lib.sh"
-
-DECISION_META_LOCK=
-DECISION_META_LOCK_HELD=0
-decision_hold_cleanup() {
-  if [ "$DECISION_META_LOCK_HELD" = 1 ]; then
-    fm_lock_release "$DECISION_META_LOCK" || true
-    DECISION_META_LOCK_HELD=0
-  fi
-}
-trap decision_hold_cleanup EXIT
+CAPTAIN_HOLD="$SCRIPT_DIR/fm-captain-hold.sh"
 
 usage() {
   awk '
@@ -168,400 +47,66 @@ fail() {
 }
 
 validate_slug() {  # <label> <value>
-  local label=$1 value=$2
-  case "$value" in
-    ''|*[!A-Za-z0-9._-]*) fail "$label must be a non-empty privacy-safe slug: $value" ;;
-  esac
-}
-
-validate_one_line() {  # <label> <value>
-  local label=$1 value=$2
-  [ -n "$value" ] || fail "$label must not be empty"
-  case "$value" in
-    *$'\n'*|*$'\r'*) fail "$label must be one line" ;;
+  case "$2" in
+    ''|*[!A-Za-z0-9._-]*) fail "$1 must be a non-empty privacy-safe slug: $2" ;;
   esac
 }
 
-sha256_text() {  # <text>
-  if command -v shasum >/dev/null 2>&1; then
-    printf '%s' "$1" | shasum -a 256 | awk '{print $1}'
-  elif command -v sha256sum >/dev/null 2>&1; then
-    printf '%s' "$1" | sha256sum | awk '{print $1}'
-  else
-    fail "shasum or sha256sum is required"
-  fi
-}
-
-hold_id() {  # <origin-id> <decision-key>
+compose() {  # <origin> <key>
   validate_slug origin-id "$1"
   validate_slug decision-key "$2"
-  printf '%s-decision-%s\n' "$1" "$2"
-}
-
-# The routed-identity token recorded when a close path routes no work. Slug
-# validation rejects parentheses, so no real task identity can collide with it.
-ROUTED_NONE='(none)'
-
-DECISION_TEXT=''
-DECISION_DIGEST=''
-
-load_decision() {  # <path>; sets DECISION_TEXT and DECISION_DIGEST
-  local path=$1 decision
-  [ -n "$path" ] || fail "--decision-file is required"
-  [ -f "$path" ] || fail "decision file does not exist: $path"
-  decision=$(cat "$path")
-  [ -n "$decision" ] || fail "decision file must not be empty"
-  [ "$(printf '%s' "$decision" | LC_ALL=C wc -c | tr -d ' ')" -le 8192 ] \
-    || fail "decision file exceeds 8192 bytes"
-  DECISION_TEXT=$decision
-  DECISION_DIGEST=$(sha256_text "$decision")
+  printf '%s-decision-%s' "$1" "$2"
 }
 
-tasks_axi() {
-  (cd "$FM_HOME" && tasks-axi "$@")
+task_show() {
+  (cd "$FM_HOME" && tasks-axi show "$1" --full) 2>/dev/null
 }
 
-require_tasks_axi() {
-  fm_tasks_axi_compatible || fail "compatible tasks-axi is required"
-  tasks-axi hold --help 2>&1 | grep -F -- '--kind captain' >/dev/null \
-    || fail "tasks-axi does not expose the captain-hold contract"
-}
-
-task_show() {  # <id>
-  tasks_axi show "$1" --full 2>/dev/null
-}
-
-show_field() {  # <show-output> <field>
+show_field() {
   local output=$1 field=$2
   printf '%s\n' "$output" | sed -n "s/^  $field: //p" | head -1
 }
 
-origin_exists_here() {  # <origin-id>
-  [ -f "$STATE/$1.meta" ] && return 0
-  [ -f "$DATA/$1/report.md" ] && return 0
-  task_show "$1" >/dev/null 2>&1
-}
-
-list_has_key() {  # <comma-list> <key>
-  case ",$1," in
-    *",$2,"*) return 0 ;;
-    *) return 1 ;;
-  esac
-}
-
-sorted_key_union() {  # <comma-list> <newline-or-space-separated-new-keys>
-  local existing=$1 new=$2
-  {
-    printf '%s\n' "$existing" | tr ',' '\n'
-    printf '%s\n' "$new" | tr ' ' '\n'
-  } | sed '/^$/d' | LC_ALL=C sort -u | paste -sd, -
-}
-
-meta_value() {  # <meta> <key>
-  grep "^$2=" "$1" 2>/dev/null | tail -1 | cut -d= -f2- || true
-}
-
-origin_open_decisions() {  # <origin-id>
-  local origin=$1 meta="$STATE/$1.meta" status_file="$STATE/$1.status" open kind last verb
-  open=$(status_open_decisions "$status_file")
-  [ -n "$open" ] || return 0
-  [ -f "$meta" ] || { printf '%s' "$open"; return 0; }
-  kind=$(meta_value "$meta" kind)
-  [ -n "$kind" ] || kind=ship
-  if [ "$kind" != secondmate ]; then
-    last=$(last_status_line "$status_file")
-    verb=$(status_line_verb "$last")
-    case "$verb" in
-      done|failed) return 0 ;;
-    esac
-  fi
-  printf '%s' "$open"
-}
-
-body_has_resolution_record() {  # <hold-body>
-  case "$1" in
-    *"Resolution recorded by fm-decision-hold."*"Routed work:"*) return 0 ;;
-  esac
-  return 1
-}
-
-resolution_body() {  # <mode> <routed-csv> [routed-task-id...]
-  local mode=$1 routed_csv=$2 body dep
-  shift 2
-  # Command substitution strips the trailing newline, so restore it before the
-  # routed-work list to keep each entry on its own durable backlog line.
-  body=$(printf 'Resolution recorded by fm-decision-hold.\nDecision digest: %s\nRouted identities: %s\nResolution mode: %s\n\nCaptain decision:\n%s\n\nRouted work:' \
-    "$DECISION_DIGEST" "$routed_csv" "$mode" "$DECISION_TEXT")
-  body="${body}"$'\n'
-  if [ "$#" -eq 0 ]; then
-    body="${body}${ROUTED_NONE}"$'\n'
-  else
-    for dep in "$@"; do
-      body="${body}- ${dep}"$'\n'
-    done
-  fi
-  printf '%s' "$body"
-}
-
-# tasks-axi quotes multi-entry blocked_by as "a,b,c"; strip so edge ids match.
-normalized_blocked_by() {  # <show-output>
+normalized_blocked_by() {
   local blocked
   blocked=$(show_field "$1" blocked_by | tr -d '[:space:]')
   blocked=${blocked#\"}
   blocked=${blocked%\"}
+  [ "$blocked" != - ] || blocked=''
   printf '%s' "$blocked"
 }
 
-# Space-separated ids of live work still blocked by <hold-id>. The listing is only
-# a cheap prefilter whose first field is always an unquoted id; every candidate is
-# confirmed against its own authoritative record before it is reported.
-tasks_blocked_by() {  # <hold-id>
-  local id=$1 rows row candidate show found=''
-  rows=$(tasks_axi list --fields blocked_by) \
-    || fail "could not read backlog work while checking what $id still blocks"
-  while IFS= read -r row; do
-    case "$row" in
-      *"$id"*) : ;;
-      *) continue ;;
-    esac
-    candidate=${row%%,*}
-    candidate=${candidate// /}
-    [ -n "$candidate" ] || continue
-    [ "$candidate" != "$id" ] || continue
-    case "$candidate" in
-      *[!A-Za-z0-9._-]*) continue ;;
-    esac
-    show=$(task_show "$candidate") || continue
-    list_has_key "$(normalized_blocked_by "$show")" "$id" || continue
-    found="${found}${found:+ }$candidate"
-  done <<EOF
-$rows
-EOF
-  printf '%s' "$found"
-}
-
-verify_hold_active() {  # <hold-id>
-  local id=$1 show state held kind hold_kind
-  show=$(task_show "$id") || fail "captain hold $id is absent from $FM_HOME/data/backlog.md"
-  state=$(show_field "$show" state)
-  held=$(show_field "$show" held)
-  kind=$(show_field "$show" kind)
-  hold_kind=$(show_field "$show" hold_kind)
-  [ "$state" = queued ] || fail "captain hold $id is not queued (state=$state)"
-  [ "$held" = yes ] || fail "captain hold $id is not active"
-  [ "$kind" = captain ] || fail "backlog item $id is not kind captain"
-  [ "$hold_kind" = captain ] || fail "backlog item $id is not held for the captain"
-}
-
-verify_hold_resolved() {  # <hold-id>
-  local id=$1 show state kind body
-  show=$(task_show "$id") || return 1
-  state=$(show_field "$show" state)
-  kind=$(show_field "$show" kind)
-  body=$(show_field "$show" body)
-  [ "$state" = "done" ] || return 1
-  [ "$kind" = captain ] || return 1
-  body_has_resolution_record "$body"
-}
-
-verify_hold_durable() {  # <hold-id>
-  local id=$1 show state held kind hold_kind body
-  show=$(task_show "$id") || fail "captain decision $id is absent from $FM_HOME/data/backlog.md"
-  state=$(show_field "$show" state)
-  held=$(show_field "$show" held)
-  kind=$(show_field "$show" kind)
-  hold_kind=$(show_field "$show" hold_kind)
-  body=$(show_field "$show" body)
-  if [ "$state" = queued ] && [ "$held" = yes ] && [ "$kind" = captain ] && [ "$hold_kind" = captain ]; then
-    return 0
-  fi
-  if [ "$state" = "done" ] && [ "$kind" = captain ] && body_has_resolution_record "$body"; then
-    return 0
-  fi
-  fail "captain decision $id is neither actively held nor durably resolved"
-}
-
-verify_resolution_identity() {
-  local id=$1 hold_body=$2 decision_digest=$3 routed_csv=$4 resolution_prefix resolution_fields recorded_digest recorded_routes
-  resolution_prefix='"Resolution recorded by fm-decision-hold.\nDecision digest: '
-  case "$hold_body" in
-    "$resolution_prefix"*) resolution_fields=${hold_body#"$resolution_prefix"} ;;
-    *) fail "captain hold $id has no retry identity record" ;;
-  esac
-  case "$resolution_fields" in
-    *'\nRouted identities: '*'\n\nCaptain decision:'*) : ;;
-    *) fail "captain hold $id has an invalid retry identity record" ;;
+list_has_key() {
+  case ",$1," in
+    *",$2,"*) return 0 ;;
+    *) return 1 ;;
   esac
-  recorded_digest=${resolution_fields%%\\n*}
-  resolution_fields=${resolution_fields#*\\nRouted identities: }
-  recorded_routes=${resolution_fields%%\\n*}
-  [ "$recorded_digest" = "$decision_digest" ] \
-    || fail "captain hold $id records a different captain decision"
-  [ "$recorded_routes" = "$routed_csv" ] \
-    || fail "captain hold $id records different routed work"
-}
-
-command_id() {
-  [ "$#" -eq 2 ] || { usage >&2; exit 2; }
-  hold_id "$1" "$2"
-}
-
-command_hold() {
-  local origin=${1:-} key=${2:-} title='' reason='' repo='' id show state kind existing_title body
-  [ "$#" -ge 2 ] || { usage >&2; exit 2; }
-  shift 2
-  while [ "$#" -gt 0 ]; do
-    case "$1" in
-      --title) shift; title=${1:-} ;;
-      --reason) shift; reason=${1:-} ;;
-      --repo) shift; repo=${1:-} ;;
-      *) usage >&2; exit 2 ;;
-    esac
-    shift
-  done
-  validate_slug origin-id "$origin"
-  validate_slug decision-key "$key"
-  validate_one_line title "$title"
-  validate_one_line reason "$reason"
-  case "$reason" in *'('*|*')'*) fail "reason must not contain parentheses (tasks-axi hold contract)" ;; esac
-  require_tasks_axi
-  origin_exists_here "$origin" || fail "origin $origin is not owned by the active home $FM_HOME"
-  id=$(hold_id "$origin" "$key")
-  if show=$(task_show "$id"); then
-    state=$(show_field "$show" state)
-    kind=$(show_field "$show" kind)
-    existing_title=$(show_field "$show" title)
-    [ "$state" != "done" ] || fail "captain decision $id is already durably resolved; use a new decision key for a new decision"
-    [ "$kind" = captain ] || fail "existing backlog identity $id is not kind captain"
-    [ "$existing_title" = "$title" ] || fail "existing captain hold $id has a different title"
-  else
-    if [ -z "$repo" ] && [ -f "$STATE/$origin.meta" ]; then
-      repo=$(meta_value "$STATE/$origin.meta" project)
-      repo=${repo%/}
-      repo=${repo##*/}
-    fi
-    [ -n "$repo" ] || repo=firstmate
-    validate_one_line repo "$repo"
-    body=$(printf 'Origin: %s\nDecision key: %s\nState: awaiting captain decision.' "$origin" "$key")
-    tasks_axi add "$id" "$title" --kind captain --repo "$repo" --body "$body" >/dev/null \
-      || fail "could not create captain decision item $id"
-  fi
-  tasks_axi hold "$id" --reason "$reason" --kind captain >/dev/null \
-    || fail "could not activate captain hold $id"
-  verify_hold_active "$id"
-  printf '%s\n' "$id"
 }
 
-command_complete() {
-  local origin=${1:-} meta previous='' supplied='' keys='' key status_file open raw_open key_seen=0 has_meta=0
-  [ "$#" -ge 2 ] || { usage >&2; exit 2; }
-  validate_slug origin-id "$origin"
-  shift
-  meta="$STATE/$origin.meta"
-  [ -f "$meta" ] && has_meta=1
-  if [ "$has_meta" = 1 ]; then
-    DECISION_META_LOCK=$(fm_meta_lock_path "$meta") || fail "could not resolve task metadata lock"
-    fm_lock_acquire_wait "$DECISION_META_LOCK"
-    DECISION_META_LOCK_HELD=1
-    [ -f "$meta" ] || fail "task metadata disappeared while recording completion"
-  fi
-  require_tasks_axi
-  origin_exists_here "$origin" || fail "origin $origin is not owned by the active home $FM_HOME"
-  if [ "$#" -eq 1 ] && [ "$1" = --none ]; then
-    supplied=''
+sha256_text() {
+  if command -v shasum >/dev/null 2>&1; then
+    printf '%s' "$1" | shasum -a 256 | awk '{print $1}'
+  elif command -v sha256sum >/dev/null 2>&1; then
+    printf '%s' "$1" | sha256sum | awk '{print $1}'
   else
-    while [ "$#" -gt 0 ]; do
-      [ "$1" != --none ] || fail "--none cannot be combined with decision keys"
-      validate_slug decision-key "$1"
-      supplied="${supplied}${supplied:+ }$1"
-      shift
-    done
-  fi
-  if [ "$has_meta" = 1 ]; then
-    previous=$(meta_value "$meta" decision_keys)
-  fi
-  keys=$(sorted_key_union "$previous" "$supplied")
-  if [ -n "$keys" ]; then
-    while IFS= read -r key; do
-      [ -n "$key" ] || continue
-      verify_hold_durable "$(hold_id "$origin" "$key")"
-    done <<EOF
-$(printf '%s\n' "$keys" | tr ',' '\n')
-EOF
-  fi
-
-  status_file="$STATE/$origin.status"
-  raw_open=$(status_open_decisions "$status_file")
-  open=$(origin_open_decisions "$origin")
-  while IFS=$'\t' read -r key _verb _summary; do
-    [ -n "$key" ] || continue
-    list_has_key "$keys" "$key" \
-      || fail "open structured decision $origin/$key has no captain-held inventory entry"
-  done <<EOF
-$open
-EOF
-
-  if [ "$has_meta" = 1 ]; then
-    if [ "$(meta_value "$meta" decisions_reviewed)" != 1 ] || [ "$previous" != "$keys" ]; then
-      printf 'decisions_reviewed=1\ndecision_keys=%s\n' "$keys" >> "$meta"
-    fi
-    fm_lock_release "$DECISION_META_LOCK"
-    DECISION_META_LOCK_HELD=0
-
-    # Transfer any still-open status decision to its durable backlog owner so the
-    # live status fold does not duplicate the same Captain's Call item.
-    # The transfer line is this home's own bookkeeping close, written by the
-    # turn that just reviewed the decision, so it uses the guarded
-    # self-announced append (bin/fm-wake-lib.sh) and does not wake this same
-    # session; an append failure still fails this command loudly.
-    while IFS=$'\t' read -r key _verb _summary; do
-      [ -n "$key" ] || continue
-      list_has_key "$keys" "$key" || continue
-      transfer_rc=0
-      fm_wake_status_append_self_announced "$STATE" "$status_file" \
-        "captain-held [key=$key]: tracked by $(hold_id "$origin" "$key")" || transfer_rc=$?
-      [ "$transfer_rc" -ne 2 ] || fail "cannot append the captain-held transfer for $origin/$key"
-      key_seen=1
-    done <<EOF
-$raw_open
-EOF
+    fail "shasum or sha256sum is required"
   fi
-  : "$key_seen"
-  printf 'complete: %s decision inventory reviewed%s\n' "$origin" "${keys:+ ($keys)}"
 }
 
-command_verify() {
-  local origin=${1:-} meta reviewed keys key open
-  [ "$#" -eq 1 ] || { usage >&2; exit 2; }
-  validate_slug origin-id "$origin"
-  meta="$STATE/$origin.meta"
-  [ -f "$meta" ] || fail "origin metadata is absent: $meta"
-  require_tasks_axi
-  reviewed=$(meta_value "$meta" decisions_reviewed)
-  [ "$reviewed" = 1 ] || fail "origin $origin has no completed unresolved-decision inventory"
-  keys=$(meta_value "$meta" decision_keys)
-  if [ -n "$keys" ]; then
-    while IFS= read -r key; do
-      [ -n "$key" ] || continue
-      verify_hold_durable "$(hold_id "$origin" "$key")"
-    done <<EOF
-$(printf '%s\n' "$keys" | tr ',' '\n')
-EOF
-  fi
-  open=$(origin_open_decisions "$origin")
-  while IFS=$'\t' read -r key _verb _summary; do
-    [ -n "$key" ] || continue
-    list_has_key "$keys" "$key" \
-      || fail "open structured decision $origin/$key is outside the reviewed inventory"
-    verify_hold_durable "$(hold_id "$origin" "$key")"
-  done <<EOF
-$open
-EOF
-  printf 'verified: %s unresolved-decision inventory\n' "$origin"
+recorded_field() {
+  local rest=$1 label=$2
+  case "$rest" in
+    *"$label: "*) rest=${rest#*"$label: "} ;;
+    *) return 1 ;;
+  esac
+  rest=${rest%%\\n*}
+  rest=${rest%%$'\n'*}
+  printf '%s' "$rest"
 }
 
 command_resolve() {
-  local origin=${1:-} key=${2:-} decision_file='' id='' body='' routed='' routed_csv='' dep show blocked state hold_show hold_body resolution_recorded=0
+  local origin=${1:-} key=${2:-} decision_file='' routed='' routed_csv id dep tmp answer_file show state blocked hold_show hold_body
+  local resolution_recorded=0 legacy_replay=0 decision_text decision_digest recorded_digest recorded_routes
   [ "$#" -ge 2 ] || { usage >&2; exit 2; }
   shift 2
   while [ "$#" -gt 0 ]; do
@@ -572,368 +117,116 @@ command_resolve() {
     esac
     shift
   done
-  validate_slug origin-id "$origin"
-  validate_slug decision-key "$key"
-  load_decision "$decision_file"
-  [ -n "$routed" ] || fail "at least one --routed-to task is required; use decline when the captain's answer routes no work"
+  id=$(compose "$origin" "$key")
+  [ -n "$decision_file" ] || fail "--decision-file is required"
+  [ -f "$decision_file" ] || fail "decision file does not exist: $decision_file"
+  [ -n "$routed" ] || fail "at least one --routed-to task is required; use answer when the captain's answer routes no work"
   routed=$(printf '%s\n' "$routed" | tr ' ' '\n' | sed '/^$/d' | LC_ALL=C sort -u | paste -sd' ' -)
-  routed_csv=$(printf '%s\n' "$routed" | tr ' ' ',')
-  require_tasks_axi
-  id=$(hold_id "$origin" "$key")
-  if verify_hold_resolved "$id"; then
-    hold_show=$(task_show "$id")
-    hold_body=$(show_field "$hold_show" body)
-    verify_resolution_identity "$id" "$hold_body" "$DECISION_DIGEST" "$routed_csv"
-    printf 'resolved: %s\n' "$id"
-    return 0
-  fi
-  verify_hold_active "$id"
-  hold_show=$(task_show "$id")
+  routed_csv=$(printf '%s' "$routed" | tr ' ' ',')
+  decision_text=$(cat "$decision_file")
+  [ -n "$decision_text" ] || fail "decision file must not be empty"
+  decision_digest=$(sha256_text "$decision_text")
+  hold_show=$(task_show "$id") || fail "captain decision $id does not exist in the active home"
   hold_body=$(show_field "$hold_show" body)
   case "$hold_body" in
-    *"Resolution recorded by fm-decision-hold."*)
-      verify_resolution_identity "$id" "$hold_body" "$DECISION_DIGEST" "$routed_csv"
+    *"Resolution recorded by fm-decision-hold."*"Routed identities: "*)
+      recorded_digest=$(recorded_field "$hold_body" "Decision digest" || true)
+      recorded_routes=$(recorded_field "$hold_body" "Routed identities" || true)
+      [ "$recorded_digest" = "$decision_digest" ] \
+        || fail "captain decision $id records a different captain decision"
+      [ "$recorded_routes" = "$routed_csv" ] \
+        || fail "captain decision $id records different routed work"
+      resolution_recorded=1
+      legacy_replay=1
+      ;;
+    *"Resolution recorded by fm-captain-hold."*)
       resolution_recorded=1
       ;;
   esac
-
   for dep in $routed; do
     show=$(task_show "$dep") || fail "routed task $dep does not exist in the active home"
     state=$(show_field "$show" state)
     [ "$state" != "done" ] || [ "$resolution_recorded" = 1 ] \
       || fail "routed task $dep is already done"
     blocked=$(normalized_blocked_by "$show")
-    if ! list_has_key "$blocked" "$id"; then
-      case "$hold_body" in
-        *"Resolution recorded by fm-decision-hold."*"- $dep"*) : ;;
-        *) fail "routed task $dep is not durably blocked by $id" ;;
-      esac
-    fi
+    list_has_key "$blocked" "$id" || [ "$resolution_recorded" = 1 ] \
+      || fail "routed task $dep is not durably blocked by $id"
   done
-
-  # shellcheck disable=SC2086  # routed is a validated space-separated slug list.
-  body=$(resolution_body routed "$routed_csv" $routed)
-  tasks_axi update "$id" --body "$body" >/dev/null \
-    || fail "could not record the captain decision on $id"
+  tmp=$(umask 077; mktemp "${TMPDIR:-/tmp}/fm-decision-hold-resolve.XXXXXX") \
+    || fail "cannot stage the captain decision"
+  if ! { cat "$decision_file" && printf '\n\nRouted work:\n' \
+    && printf '%s\n' "$routed" | tr ' ' '\n' | sed 's/^/- /'; } > "$tmp"; then
+    rm -f -- "$tmp"
+    fail "cannot stage the captain decision for $id"
+  fi
+  answer_file=$tmp
+  [ "$legacy_replay" = 0 ] || answer_file=$decision_file
+  if ! "$CAPTAIN_HOLD" answer "$id" --decision-file "$answer_file"; then
+    rm -f -- "$tmp"
+    exit 1
+  fi
+  rm -f -- "$tmp"
   for dep in $routed; do
     show=$(task_show "$dep") || fail "routed task $dep disappeared before routing"
     if list_has_key "$(normalized_blocked_by "$show")" "$id"; then
-      tasks_axi unblock "$dep" --by "$id" >/dev/null \
+      (cd "$FM_HOME" && tasks-axi unblock "$dep" --by "$id" >/dev/null) \
         || fail "could not route the recorded decision to $dep"
     fi
   done
-  tasks_axi "done" "$id" >/dev/null || fail "could not close resolved captain hold $id"
-  verify_hold_resolved "$id" || fail "captain hold $id did not retain its durable resolution record"
   printf 'resolved: %s -> %s\n' "$id" "$routed"
 }
 
-parse_decision_only_flags() {  # <args...>; prints the --decision-file value
-  local decision_file=''
-  while [ "$#" -gt 0 ]; do
-    case "$1" in
-      --decision-file) shift; decision_file=${1:-} ;;
-      *) usage >&2; exit 2 ;;
-    esac
-    shift
-  done
-  printf '%s' "$decision_file"
-}
-
-# The one non-routing close path, shared by `answer`, `decline`, and the reserved
-# drop intake. Answer and decline refuse still-routed work. Drop closes only the
-# stale hold, leaving existing dependent tasks as independent work.
-close_unrouted_hold() {  # <mode> <outcome-word> <preserve-routed> <origin-id> <decision-key> <flag-args...>
-  local mode=$1 outcome=$2 preserve_routed=$3 origin=$4 key=$5 decision_file id body hold_show hold_body state dependents
-  shift 5
-  decision_file=$(parse_decision_only_flags "$@") || exit 2
+command_complete() {
+  local origin=${1:-} mapped=''
+  [ "$#" -ge 2 ] || { usage >&2; exit 2; }
   validate_slug origin-id "$origin"
-  validate_slug decision-key "$key"
-  load_decision "$decision_file"
-  require_tasks_axi
-  id=$(hold_id "$origin" "$key")
-  if verify_hold_resolved "$id"; then
-    hold_show=$(task_show "$id")
-    hold_body=$(show_field "$hold_show" body)
-    verify_resolution_identity "$id" "$hold_body" "$DECISION_DIGEST" "$ROUTED_NONE"
-    printf '%s: %s\n' "$outcome" "$id"
-    return 0
+  shift
+  if [ "$#" -eq 1 ] && [ "$1" = --none ]; then
+    exec "$CAPTAIN_HOLD" complete "$origin" --none
   fi
-  hold_show=$(task_show "$id") || fail "captain hold $id is absent from $FM_HOME/data/backlog.md"
-  state=$(show_field "$hold_show" state)
-  [ "$state" != "done" ] \
-    || fail "captain hold $id was closed outside fm-decision-hold; use repair to record the captain decision"
-  verify_hold_active "$id"
-  hold_body=$(show_field "$hold_show" body)
-  case "$hold_body" in
-    *"Resolution recorded by fm-decision-hold."*)
-      verify_resolution_identity "$id" "$hold_body" "$DECISION_DIGEST" "$ROUTED_NONE"
-      ;;
-  esac
-  dependents=$(tasks_blocked_by "$id") || exit 1
-  [ -z "$dependents" ] || [ "$preserve_routed" = yes ] \
-    || fail "captain hold $id still blocks routed work ($dependents); use resolve to record that work"
-  body=$(resolution_body "$mode" "$ROUTED_NONE")
-  tasks_axi update "$id" --body "$body" >/dev/null \
-    || fail "could not record the captain decision on $id"
-  tasks_axi "done" "$id" >/dev/null || fail "could not close $mode captain hold $id"
-  verify_hold_resolved "$id" || fail "captain hold $id did not retain its durable resolution record"
-  printf '%s: %s\n' "$outcome" "$id"
+  for key in "$@"; do
+    [ "$key" != --none ] || fail "--none cannot be combined with decision keys"
+    mapped="${mapped}${mapped:+ }$(compose "$origin" "$key")"
+  done
+  # shellcheck disable=SC2086  # mapped is a validated space-separated slug list.
+  exec "$CAPTAIN_HOLD" complete "$origin" $mapped
 }
 
-command_answer() {
+command_close() {  # <origin> <key> <flag-args...>
+  local origin=${1:-} key=${2:-} id
   [ "$#" -ge 2 ] || { usage >&2; exit 2; }
-  close_unrouted_hold answered answered no "$@"
-}
-
-# --- the one keyed-answer intake, and the source bindings that feed it --------
-
-BINDING_DIR="$STATE/decision-bindings"
-BINDING_SCHEMA=fm-decision-binding.v1
-
-# The any-origin binding marker. Slug validation rejects parentheses, so no real
-# origin id can collide with it; `binding` prints it and `answers` accepts it,
-# which is what lets the runner's feed seam carry an any-origin source unchanged.
-BINDING_ANY='(any)'
-
-# Reserved close/drop answer. Exact match after sanitize. The bearings board's
-# Close / drop control emits this value; this intake declines the matching hold
-# with a "dropped by captain" record rather than recording a substantive answer.
-DROP_ANSWER='__drop__'
-
-validate_source_id() {  # <source-id>
-  validate_slug source-id "$1"
-  [ "${#1}" -le 64 ] || fail "source-id must be at most 64 characters: $1"
-}
-
-binding_path() { printf '%s/%s.origin\n' "$BINDING_DIR" "$1"; }
-
-# The origin a captured-answer source belongs to, or empty when it is unbound.
-# An unreadable or wrong-schema record is a hard error rather than a silent
-# "unbound": feeding nothing is the safe direction only when it is a deliberate
-# choice, never when it is a corrupted record.
-read_binding() {  # <source-id>
-  local path origin schema
-  path=$(binding_path "$1")
-  [ -e "$path" ] || return 0
-  [ -f "$path" ] && [ ! -L "$path" ] || fail "decision binding is unsafe: $path"
-  schema=$(sed -n 's/^schema=//p' "$path" | head -1)
-  [ "$schema" = "$BINDING_SCHEMA" ] || fail "decision binding has an incompatible schema: $path"
-  origin=$(sed -n 's/^origin=//p' "$path" | head -1)
-  if [ "$origin" != "$BINDING_ANY" ]; then
-    case "$origin" in
-      ''|*[!A-Za-z0-9._-]*) fail "decision binding has an invalid origin id: $path" ;;
-    esac
-  fi
-  printf '%s\n' "$origin"
-}
-
-command_bind() {
-  local source=${1:-} origin=${2:-} dest tmp
-  [ "$#" -eq 2 ] || { usage >&2; exit 2; }
-  validate_source_id "$source"
-  if [ "$origin" = --any-origin ]; then
-    origin=$BINDING_ANY
-  else
-    validate_slug origin-id "$origin"
-  fi
-  (umask 077; mkdir -p "$BINDING_DIR") || fail "cannot create $BINDING_DIR"
-  [ -d "$BINDING_DIR" ] && [ ! -L "$BINDING_DIR" ] || fail "decision binding dir is unsafe: $BINDING_DIR"
-  dest=$(binding_path "$source")
-  tmp=$(umask 077; mktemp "$BINDING_DIR/.origin.XXXXXX") || fail "cannot stage the decision binding"
-  if ! { printf 'schema=%s\norigin=%s\n' "$BINDING_SCHEMA" "$origin" > "$tmp" \
-    && chmod 0600 "$tmp" && mv -f -- "$tmp" "$dest"; }; then
-    rm -f -- "$tmp"
-    fail "cannot record the decision binding for $source"
-  fi
-  printf 'bound: %s -> %s\n' "$source" "$origin"
-}
-
-command_unbind() {
-  local source=${1:-}
-  [ "$#" -eq 1 ] || { usage >&2; exit 2; }
-  validate_source_id "$source"
-  rm -f -- "$(binding_path "$source")"
-  printf 'unbound: %s\n' "$source"
-}
-
-command_binding() {
-  local source=${1:-} origin
-  [ "$#" -eq 1 ] || { usage >&2; exit 2; }
-  validate_source_id "$source"
-  origin=$(read_binding "$source") || exit 1
-  [ -n "$origin" ] || return 1
-  printf '%s\n' "$origin"
-}
-
-# The durable captain decision one keyed answer records. Pure function of its
-# inputs, so the same answer delivered twice is idempotent rather than a
-# conflicting decision.
-keyed_decision_text() {  # <source> <key> <answer> <label>
-  printf 'Captain answered this decision through %s.\n' "$1"
-  printf 'Decision key: %s\n' "$2"
-  printf 'Answer: %s\n' "$3"
-  [ -z "$4" ] || printf 'Answer as shown to the captain: %s\n' "$4"
-}
-
-# The durable record for a reserved close/drop answer. Pure function of source,
-# key, and label so a replayed drop is idempotent; it never records `__drop__`
-# as if it were a substantive choice.
-keyed_drop_decision_text() {  # <source> <key> <label>
-  printf 'Captain dropped this decision through %s.\n' "$1"
-  printf 'Decision key: %s\n' "$2"
-  printf 'dropped by captain\n'
-  [ -z "$3" ] || printf 'Answer as shown to the captain: %s\n' "$3"
-}
-
-sanitize_field() {  # <text>
-  printf '%s' "$1" | tr '\n\r\t' '   ' | LC_ALL=C tr -d '\000-\037\177' | cut -c1-512
-}
-
-command_answers() {
-  local origin=${1:-} source='' any=0 key answer label hold k_origin k_key tmp err closed=0 skipped=0 reason
-  [ "$#" -ge 1 ] || { usage >&2; exit 2; }
-  shift
+  id=$(compose "$origin" "$key")
+  shift 2
+  local decision_file=''
   while [ "$#" -gt 0 ]; do
     case "$1" in
-      --source) shift; source=${1:-} ;;
+      --decision-file) shift; decision_file=${1:-} ;;
       *) usage >&2; exit 2 ;;
     esac
     shift
   done
-  # `binding` prints the stored marker, so accept both the flag spelling a human
-  # types and the marker the runner pipes through unchanged.
-  if [ "$origin" = --any-origin ] || [ "$origin" = "$BINDING_ANY" ]; then
-    any=1
-    origin=$BINDING_ANY
-  else
-    validate_slug origin-id "$origin"
-  fi
-  [ -n "$source" ] || fail "--source provenance is required so the durable decision records where the answer came from"
-  source=$(sanitize_field "$source")
-  require_tasks_axi
-  tmp=$(umask 077; mktemp "${TMPDIR:-/tmp}/fm-keyed-decision.XXXXXX") || fail "cannot stage the captain decision"
-  err=$(umask 077; mktemp "${TMPDIR:-/tmp}/fm-keyed-decision-err.XXXXXX") \
-    || { rm -f -- "$tmp"; fail "cannot stage the captain decision diagnostics"; }
-  while IFS=$'\t' read -r key answer label; do
-    [ -n "${key:-}" ] || continue
-    case "$key" in *[!A-Za-z0-9._-]*) continue ;; esac
-    if [ "$any" = 1 ]; then
-      [ "${#key}" -le 128 ] || continue
-    else
-      [ "${#key}" -le 64 ] || continue
-    fi
-    answer=$(sanitize_field "${answer:-}")
-    [ -n "$answer" ] || continue
-    label=$(sanitize_field "${label:-}")
-    if [ "$any" = 1 ]; then
-      # Each key is a full hold identity; split at its FIRST -decision- so the
-      # origin half can never swallow a later separator inside the decision key.
-      case "$key" in
-        *-decision-*) : ;;
-        *)
-          printf 'skipped: %s (not a full hold identity)\n' "$key"
-          skipped=$((skipped + 1))
-          continue
-          ;;
-      esac
-      k_origin=${key%%-decision-*}
-      k_key=${key#*-decision-}
-      hold=$key
-    else
-      k_origin=$origin
-      k_key=$key
-      hold="$origin-decision-$key"
-    fi
-    if [ "$answer" = "$DROP_ANSWER" ]; then
-      keyed_drop_decision_text "$source" "$k_key" "$label" > "$tmp" \
-        || fail "cannot stage the captain decision for $hold"
-      if "$0" decline "$k_origin" "$k_key" --decision-file "$tmp" --drop >/dev/null 2>"$err"; then
-        printf 'closed: %s\n' "$hold"
-        closed=$((closed + 1))
-      else
-        reason=$(tr -d '\n' < "$err" | sed 's/^fm-decision-hold: //')
-        printf 'skipped: %s (%s)\n' "$hold" "$reason"
-        skipped=$((skipped + 1))
-      fi
-      continue
-    fi
-    keyed_decision_text "$source" "$k_key" "$answer" "$label" > "$tmp" \
-      || fail "cannot stage the captain decision for $hold"
-    if "$0" answer "$k_origin" "$k_key" --decision-file "$tmp" >/dev/null 2>"$err"; then
-      printf 'closed: %s\n' "$hold"
-      closed=$((closed + 1))
-    else
-      reason=$(tr -d '\n' < "$err" | sed 's/^fm-decision-hold: //')
-      printf 'skipped: %s (%s)\n' "$hold" "$reason"
-      skipped=$((skipped + 1))
-    fi
-  done
-  rm -f -- "$tmp" "$err"
-  printf 'answers: closed=%s skipped=%s origin=%s\n' "$closed" "$skipped" "$origin"
-  [ "$skipped" -eq 0 ]
-}
-
-command_decline() {
-  local preserve_routed=no last
-  [ "$#" -ge 2 ] || { usage >&2; exit 2; }
-  if [ "${!#}" = --drop ]; then
-    preserve_routed=yes
-    last=$(($# - 1))
-    set -- "${@:1:last}"
-  fi
-  close_unrouted_hold declined declined "$preserve_routed" "$@"
+  exec "$CAPTAIN_HOLD" answer "$id" --decision-file "$decision_file"
 }
 
-command_repair() {
-  local origin=${1:-} key=${2:-} decision_file id body show state kind hold_kind hold_body
+command_hold() {
+  local origin=${1:-} key=${2:-} id
   [ "$#" -ge 2 ] || { usage >&2; exit 2; }
+  id=$(compose "$origin" "$key")
   shift 2
-  decision_file=$(parse_decision_only_flags "$@") || exit 2
-  validate_slug origin-id "$origin"
-  validate_slug decision-key "$key"
-  load_decision "$decision_file"
-  require_tasks_axi
-  id=$(hold_id "$origin" "$key")
-  show=$(task_show "$id") || fail "captain decision $id is absent from $FM_HOME/data/backlog.md"
-  kind=$(show_field "$show" kind)
-  [ "$kind" = captain ] || fail "backlog item $id is not kind captain"
-  # tasks-axi keeps hold_kind after a close, so it is the surviving proof that
-  # this identity really was a captain hold rather than an ordinary captain-kind
-  # task that was never held for the captain at all.
-  hold_kind=$(show_field "$show" hold_kind)
-  [ "$hold_kind" = captain ] \
-    || fail "backlog item $id was never held for the captain; repair records a captain decision only on a captain hold"
-  state=$(show_field "$show" state)
-  hold_body=$(show_field "$show" body)
-  if [ "$state" = "done" ] && body_has_resolution_record "$hold_body"; then
-    verify_resolution_identity "$id" "$hold_body" "$DECISION_DIGEST" "$ROUTED_NONE"
-    printf 'repaired: %s\n' "$id"
-    return 0
-  fi
-  [ "$state" = "done" ] \
-    || fail "captain hold $id is still open (state=$state); use resolve or decline to close it with the captain's decision"
-  body=$(resolution_body repaired "$ROUTED_NONE")
-  tasks_axi update "$id" --body "$body" >/dev/null \
-    || fail "could not record the captain decision on $id"
-  show=$(task_show "$id") || fail "captain decision $id disappeared while recording the repair"
-  [ "$(show_field "$show" state)" = "done" ] || fail "repairing $id reopened a closed captain decision"
-  verify_hold_resolved "$id" || fail "captain hold $id did not retain its durable resolution record"
-  printf 'repaired: %s\n' "$id"
+  exec "$CAPTAIN_HOLD" hold "$id" --origin "$origin" "$@"
 }
 
 case "${1:-}" in
-  id) shift; command_id "$@" ;;
+  id) shift; [ "$#" -eq 2 ] || { usage >&2; exit 2; }; compose "$1" "$2"; printf '\n' ;;
   hold) shift; command_hold "$@" ;;
   complete) shift; command_complete "$@" ;;
-  verify) shift; command_verify "$@" ;;
+  verify) shift; exec "$CAPTAIN_HOLD" verify "$@" ;;
   resolve) shift; command_resolve "$@" ;;
-  answer) shift; command_answer "$@" ;;
-  answers) shift; command_answers "$@" ;;
-  bind) shift; command_bind "$@" ;;
-  unbind) shift; command_unbind "$@" ;;
-  binding) shift; command_binding "$@" ;;
-  decline) shift; command_decline "$@" ;;
-  repair) shift; command_repair "$@" ;;
+  answer|decline|repair) shift; command_close "$@" ;;
+  answers) shift; exec "$CAPTAIN_HOLD" answers "$@" ;;
+  bind) shift; exec "$CAPTAIN_HOLD" bind "$@" ;;
+  unbind) shift; exec "$CAPTAIN_HOLD" unbind "$@" ;;
+  binding) shift; exec "$CAPTAIN_HOLD" binding "$@" ;;
   -h|--help) usage ;;
   *) usage >&2; exit 2 ;;
 esac
diff --git a/bin/fm-fleet-snapshot.sh b/bin/fm-fleet-snapshot.sh
index bc7f1a3c47..c257d110be 100755
--- a/bin/fm-fleet-snapshot.sh
+++ b/bin/fm-fleet-snapshot.sh
@@ -15,11 +15,21 @@
 #     data/backlog.md and cover In flight, Queued, and Done.
 #     Canonical tasks-axi rows are structured; free-form non-empty lines in
 #     those sections are preserved as unstructured records.
-#     Structured rows preserve captain-hold metadata such as hold_kind and
-#     hold_reason when tasks-axi emits it. They also carry normalized current_role,
-#     requires_child_metadata, blocked_by_ids, unresolved_blocker_ids, and
-#     captain_actionable fields. Repeated blocker tokens remain ordered; a blocker
-#     resolves only when its structured record is Done, and missing ids stay open.
+#     Structured rows preserve captain-hold metadata such as hold_kind,
+#     hold_reason, and hold_until when tasks-axi emits it. They also carry
+#     normalized current_role, requires_child_metadata, blocked_by_ids,
+#     unresolved_blocker_ids, captain_actionable, and deferred_marker fields.
+#     Repeated blocker tokens remain ordered; a blocker resolves only when its
+#     structured record is Done, and missing ids stay open.
+#     captain_actionable means "waiting on the captain now": queued, held for
+#     the captain, unblocked, and due (no hold_until, or hold_until at or
+#     before the observation date, matching tasks-axi's own date-gate rule).
+#     There is no separate decision type: any captain-held task is the same
+#     primitive, whatever kind its row carries.
+#     deferred_marker is a presentation hint only: the row's hold reason or
+#     body carries an explicit SUPERSEDED / NOT REQUIRED / DEFERRED marker.
+#     It never changes captain_actionable; renderers may use it to keep
+#     prose-deferred rows out of default views.
 #   tasks[]: one row per state/<id>.meta, sorted by id.
 #     current_state is parsed from bin/fm-crew-state.sh <id> and preserves
 #     state, source, detail, and raw line separately.
@@ -74,6 +84,14 @@ else
     || date +%s)
 fi
 case "$SNAPSHOT_EPOCH" in ''|*[!0-9]*) SNAPSHOT_EPOCH=$(date +%s) ;; esac
+# The observation date gates captain-hold deferral: a `hold-until` date still in
+# the future keeps a captain hold out of captain_actionable until it is due
+# (tasks-axi's own contract: the hold is inactive on and after that date).
+SNAPSHOT_TODAY=${SNAPSHOT_NOW%%T*}
+case "$SNAPSHOT_TODAY" in
+  [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]) : ;;
+  *) SNAPSHOT_TODAY=$(date -u +%Y-%m-%d) ;;
+esac
 
 # Cross-home bounds are explicit so one broken or unexpectedly large home cannot
 # hang or explode the parent snapshot.
@@ -151,8 +169,9 @@ validated registered-home handoff. It is local-only, skips nested secondmate
 aggregation, and marks inventory contradictions or unavailable child state invalid.
 Its invalidity object names the normalized failure kind and affected ids.
 Actionable tasks-axi captain holds appear as decisions_open and stay visible in
-queued with hold_reason, hold_kind, and plural blocker fields for downstream
-projections. A captain hold is actionable only when every blocker is Done.
+queued with hold_reason, hold_kind, hold_until, deferred_marker, and plural
+blocker fields for downstream projections. A captain hold is actionable only
+when every blocker is Done and any hold-until date has arrived.
 Cross-home reads use FM_SNAPSHOT_SECONDMATES (default 20, 0 lifts the count
 bound), FM_SNAPSHOT_SECONDMATE_TIMEOUT, and FM_SNAPSHOT_SECONDMATE_MAX_BYTES.
 Terminal contradiction evidence uses
@@ -258,7 +277,7 @@ backlog_json() {  # [<backlog-path>] - defaults to this home's $BACKLOG
   fi
 
   # shellcheck disable=SC2094
-  jq -Rn --arg path "$backlog" '
+  jq -Rn --arg path "$backlog" --arg today "$SNAPSHOT_TODAY" '
     def trim: gsub("^[[:space:]]+|[[:space:]]+$"; "");
     def section_state:
       if . == "In flight" then "in_flight"
@@ -277,7 +296,7 @@ backlog_json() {  # [<backlog-path>] - defaults to this home's $BACKLOG
     def links($rest): [$rest | scan(url_pattern)];
     def strip_trailing_metadata:
       reduce range(0; 20) as $_ (.;
-        sub("[[:space:]]*\\([[:space:]]*(?:(?:repo|kind|priority|hold|hold-kind):[[:space:]]*[^)]*|(?:since|merged|reported|done)[[:space:]]+[^)]*)[[:space:]]*\\)[[:space:]]*$"; ""));
+        sub("[[:space:]]*\\([[:space:]]*(?:(?:repo|kind|priority|hold|hold-kind|hold-until):[[:space:]]*[^)]*|(?:since|merged|reported|done)[[:space:]]+[^)]*)[[:space:]]*\\)[[:space:]]*$"; ""));
     def strip_title_artifacts:
       sub("[[:space:]]+-[[:space:]]+data/[^[:space:])]+/report\\.md$"; "")
       | sub("[[:space:]]+data/[^[:space:])]+/report\\.md$"; "")
@@ -337,6 +356,7 @@ backlog_json() {  # [<backlog-path>] - defaults to this home's $BACKLOG
              priority:metadata($rest; "priority"),
              hold_reason:metadata($rest; "hold"),
              hold_kind:metadata($rest; "hold-kind"),
+             hold_until:metadata($rest; "hold-until"),
              blocked_by:cap($rest; ".*blocked-by:[[:space:]]*(?<v>[^[:space:])]+).*"),
              blocked_by_ids:blocked_by_ids($rest),
              blocked_reason:blocked_reason($rest),
@@ -393,8 +413,12 @@ backlog_json() {  # [<backlog-path>] - defaults to this home's $BACKLOG
                else "done" end)
           | .requires_child_metadata = (.current_role == "worker")
           | .captain_actionable =
-              (.state == "queued" and .kind == "captain" and .hold_kind == "captain"
-               and .hold_reason != null and (.unresolved_blocker_ids | length) == 0)
+              (.state == "queued" and .hold_kind == "captain"
+               and .hold_reason != null and (.unresolved_blocker_ids | length) == 0
+               and (.hold_until == null or .hold_until <= $today))
+          | .deferred_marker =
+              ((((.hold_reason // "") + " " + (.body_excerpt // ""))
+                | test("SUPERSEDED|NOT REQUIRED|NOT-REQUIRED|DEFERRED"; "i")))
         else . end)
     | del(.section,.order)
   ' < "$backlog"
@@ -660,8 +684,10 @@ secondmate_home_summary_json() {  # <backlog-json> <tasks-json>
     | ([ $queued_all[]
          | select(.captain_actionable == true)
          | {id,key:.id,verb:"captain-hold",summary:(.title | trunc(160)),
-            reason:(.hold_reason | trunc(160)),source:"backlog"} ]) as $captain_holds_all
-    | ([ $backlog.records[]? | select(.state == "done" and .structured and .kind != "captain")
+            reason:(.hold_reason | trunc(160)),
+            hold_until:(.hold_until // null),
+            deferred_marker:(.deferred_marker // false),source:"backlog"} ]) as $captain_holds_all
+    | ([ $backlog.records[]? | select(.state == "done" and .structured and .hold_kind != "captain")
          | {id:(.id | trunc(120)),title:(.title | trunc(120)),
             pr_url:((.pr_url // null) | if . == null then null else trunc(500) end),
             report_path:((.report_path // null) | if . == null then null else trunc(500) end),
@@ -757,6 +783,8 @@ secondmate_home_summary_json() {  # <backlog-json> <tasks-json>
           blocked_reason:((.blocked_reason // null) | if . == null then null else trunc(160) end),
           hold_reason:((.hold_reason // null) | if . == null then null else trunc(160) end),
           hold_kind:((.hold_kind // null) | if . == null then null else trunc(40) end),
+          hold_until:((.hold_until // null) | if . == null then null else trunc(40) end),
+          deferred_marker:(.deferred_marker // false),
           captain_actionable:(.captain_actionable // false),
           repo:((.repo // null) | if . == null then null else trunc(120) end),
           kind:((.kind // null) | if . == null then null else trunc(40) end)}][:$queued_n]),
diff --git a/bin/fm-procevent-lavish.sh b/bin/fm-procevent-lavish.sh
index fb5eee0686..03bba8c31b 100755
--- a/bin/fm-procevent-lavish.sh
+++ b/bin/fm-procevent-lavish.sh
@@ -23,11 +23,11 @@
 #
 # `answers` is this adapter's half of the generic keyed-answer contract in
 # bin/fm-procevent.sh. It reports what the captain actually chose, as
-# `<decision-key>\t<answer>\t<label>` lines, and stops there. It maps nothing to a
-# hold, records no decision, and closes nothing: a captain answer is not special to
-# Lavish, so every rule about what a keyed answer DOES belongs to the one intake in
-# bin/fm-decision-hold.sh, which the runner feeds. A Lavish review is just an
-# ephemeral discussion format that happens to carry answers.
+# `<task-id>\t<answer>\t<label>` lines, and stops there. It maps nothing to a
+# task, records no decision, and closes nothing: a captain answer is not special
+# to Lavish, so every rule about what a keyed answer DOES belongs to the one
+# intake in bin/fm-captain-hold.sh, which the runner feeds. A Lavish review is
+# just an ephemeral discussion format that happens to carry answers.
 #
 # Only rows tagged `choice` are read. A freeform captain message is prose that may
 # contain anything, and must never be able to forge a decision key.
@@ -158,8 +158,9 @@ cmd_terminal() {
   return 1
 }
 
-# Print `key<TAB>answer<TAB>label` for every structured choice the captain
-# submitted in a captured result. The published response frames queued feedback as
+# Print `key<TAB>answer<TAB>label[<TAB>mode]` for every structured choice the
+# captain submitted in a captured result; the optional mode column relays the
+# card's declared close mode (`done` or `release`) to the keyed-answer intake. The published response frames queued feedback as
 # a `prompts[N]{field,...}:` header followed by exactly N indented CSV rows whose
 # quoted fields carry JSON-style escapes, so this reads the declared field ORDER
 # rather than assuming a fixed column, and takes only rows whose `tag` field is
@@ -167,14 +168,14 @@ cmd_terminal() {
 # source of decision keys. A row that does not carry both a slug-shaped `question`
 # and an `answer` inside its `Context data:` block is skipped, so a deck that does
 # not key its forms by decision key simply yields nothing.
-# The question cap is 128 so a FULL hold identity (<origin>-decision-<key>) fits
-# for an any-origin bound deck such as the bearings board; the security property
-# is the slug SHAPE, which is unchanged.
+# The question cap is 128 so any task id fits, including the long legacy
+# `<origin>-decision-<key>` identities pre-collapse decks still carry; the
+# security property is the slug SHAPE, which is unchanged.
 cmd_answers() {
   local file=${1-}
   [ -n "$file" ] || usage
   [ -f "$file" ] && [ ! -L "$file" ] || die "result file does not exist: $file"
-  perl -e '
+  perl -MJSON::PP -e '
     use strict; use warnings;
     my ($path) = @ARGV;
     open my $fh, "<", $path or exit 1;
@@ -213,11 +214,17 @@ cmd_answers() {
       my $prompt = $f{prompt};
       next unless defined $prompt && $prompt =~ /Context data:\s*(\{.*\})/s;
       my $ctx = $1;
-      next unless $ctx =~ /"question"\s*:\s*"((?:[^"\\]|\\.)*)"/;
-      my $key = $1;
-      next unless $ctx =~ /"answer"\s*:\s*"((?:[^"\\]|\\.)*)"/;
-      my $answer = $1;
-      $_ =~ s/\\(.)/$1/g for ($key, $answer);
+      my $data = eval { decode_json($ctx) };
+      next unless ref($data) eq "HASH";
+      my $key = $data->{question};
+      my $answer = $data->{answer};
+      next if !defined($key) || ref($key) || !defined($answer) || ref($answer);
+      my $mode = "";
+      if (exists $data->{close}) {
+        next if !defined($data->{close}) || ref($data->{close})
+          || ($data->{close} ne "done" && $data->{close} ne "release");
+        $mode = $data->{close};
+      }
       next unless $key =~ /\A[A-Za-z0-9._-]{1,128}\z/;
       next unless length $answer && length($answer) <= 512;
       my $label = defined $f{text} ? $f{text} : "";
@@ -226,7 +233,7 @@ cmd_answers() {
       # A re-answered form appears again later in the queue; the last submission wins.
       if (defined $seen{$key}) { $out[$seen{$key}] = undef }
       $seen{$key} = scalar @out;
-      push @out, "$key\t$answer\t$label";
+      push @out, length $mode ? "$key\t$answer\t$label\t$mode" : "$key\t$answer\t$label";
     }
     print "$_\n" for grep { defined } @out;
   ' "$file"
diff --git a/bin/fm-procevent.sh b/bin/fm-procevent.sh
index 1061859e3c..c26a240222 100755
--- a/bin/fm-procevent.sh
+++ b/bin/fm-procevent.sh
@@ -77,10 +77,10 @@
 #
 # Keyed captain answers are adapter-owned through one more seam of the same kind,
 # and this runner still decides nothing about them. Some sources carry the
-# captain's answer to a durable decision. What such an answer MEANS is owned once,
-# by bin/fm-decision-hold.sh's keyed-answer intake, and reaching it must not
-# depend on an agent remembering. So after capture, a source that has been bound
-# to a decision origin has its result passed to
+# captain's answer to a captain-held task. What such an answer MEANS is owned
+# once, by bin/fm-captain-hold.sh's keyed-answer intake, and reaching it must not
+# depend on an agent remembering. So after capture, a bound source
+# has its result passed to
 # `bin/fm-procevent-<adapter>.sh answers <result-file>`, and whatever that prints
 # is piped straight into that one intake. The adapter reports only what the
 # captain chose; the intake owns every rule about what happens next. This runner
@@ -181,11 +181,11 @@ feed_keyed_answers() {  # <adapter> <source-id> <result-file>
   local adapter=$1 id=$2 result=$3 script origin seq
   script=$(adapter_script "$adapter")
   [ -f "$script" ] && [ ! -L "$script" ] || return 1
-  origin=$("$SCRIPT_DIR/fm-decision-hold.sh" binding "$id" 2>/dev/null) || return 1
+  origin=$("$SCRIPT_DIR/fm-captain-hold.sh" binding "$id" 2>/dev/null) || return 1
   [ -n "$origin" ] || return 1
   seq=$(fm_procevent_result_sequence "$result") || return 1
   "$script" answers "$result" 2>/dev/null \
-    | "$SCRIPT_DIR/fm-decision-hold.sh" answers "$origin" \
+    | "$SCRIPT_DIR/fm-captain-hold.sh" answers "$origin" \
         --source "the captured result $id sequence $seq" >/dev/null 2>&1
 }
 
@@ -710,7 +710,7 @@ cmd_retire() {
   # A retired source produces no further answer, so drop any decision binding it
   # carried. Generic and idempotent: the binding owner is asked to forget this
   # source id, and an unbound source is unaffected.
-  "$SCRIPT_DIR/fm-decision-hold.sh" unbind "$id" >/dev/null 2>&1 || true
+  "$SCRIPT_DIR/fm-captain-hold.sh" unbind "$id" >/dev/null 2>&1 || true
   printf 'retired: %s\n' "$id"
 }
 
diff --git a/bin/fm-public-followup.sh b/bin/fm-public-followup.sh
index aa754d9e64..caa6cc44aa 100755
--- a/bin/fm-public-followup.sh
+++ b/bin/fm-public-followup.sh
@@ -143,7 +143,7 @@ require_tools() {
 }
 
 # Every tasks-axi call runs from the home whose backlog owns the obligation, the
-# same convention bin/fm-decision-hold.sh uses for typed backlog state.
+# same convention bin/fm-captain-hold.sh uses for typed backlog state.
 tx() { (cd "$FM_HOME" && tasks-axi "$@"); }
 
 # obligation_json <id>: the complete typed obligation payload on stdout, empty
diff --git a/bin/fm-send.sh b/bin/fm-send.sh
index cc199c9b01..512df6245c 100755
--- a/bin/fm-send.sh
+++ b/bin/fm-send.sh
@@ -74,19 +74,20 @@
 # backend or remote transport.
 #
 # Chat is also a channel that carries keyed captain answers, so the same flag
-# feeds bin/fm-decision-hold.sh's one keyed-answer intake for any key that names
-# a durable decision hold on the target task. fm-send maps nothing to a hold and
-# closes nothing itself; it hands the intake `<key>\t<answer>\t<label>` exactly
-# as every other channel does, and the intake owns what that means. This is what
-# lets an answer reach a decision that has already been transferred from the live
-# status log to its durable hold, which the status ledger alone can no longer
-# close.
+# feeds bin/fm-captain-hold.sh's one keyed-answer intake for any key that names
+# a captain-held task in this home - the key as a task id itself, or through
+# the legacy `<task>-decision-<key>` identity for pre-collapse rows. fm-send
+# closes nothing itself; it hands the intake `<task-id>\t<answer>\t<label>`
+# exactly as every other channel does, and the intake owns what that means.
+# This is what lets an answer reach a decision that has already been
+# transferred from the live status log to its durable captain-held task, which
+# the status ledger alone can no longer close.
 #
 # Each named key must therefore currently be open in ONE of the two ledgers: open
 # in this home's status log per status_open_decisions (bin/fm-classify-lib.sh), or
-# an active captain hold for the target task. A key in neither is refused before
-# sending, so a mistyped key cannot deliver an answer while silently orphaning the
-# decision. A failed or unconfirmed send never closes a key (a remote
+# a still-open captain-held task resolved as above. A key in neither is refused
+# before sending, so a mistyped key cannot deliver an answer while silently
+# orphaning the decision. A failed or unconfirmed send never closes a key (a remote
 # delivered-with-pending-confirmation outcome counts as delivered - see the
 # remote paragraph above); a
 # delivered answer whose closing append fails exits nonzero with the exact
@@ -388,21 +389,32 @@ fi
 # silently leaves its decision open.
 RESOLVE_STATUS_FILE=
 # Which ledger each answered key belongs to. A key still open in the status log
-# is owned by the status log: fm-decision-hold's `complete` closes that live copy
-# at the moment it transfers a decision to its durable hold, so "still open in
-# status" and "already a hold" are the two sides of one transfer, never both at
-# once. Checking the hold only for keys the status log no longer owns also keeps
-# the common path free of any backlog read.
+# is owned by the status log: fm-captain-hold's `complete` closes that live copy
+# at the moment it transfers a decision to its durable captain-held task, so
+# "still open in status" and "already held" are the two sides of one transfer,
+# never both at once. Checking the backlog only for keys the status log no
+# longer owns also keeps the common path free of any backlog read.
 RESOLVE_STATUS_KEYS=
 RESOLVE_HOLD_KEYS=
 
-fm_send_hold_is_active() {  # <task-id> <decision-key>
-  local show
+# Resolve a --resolve-key key that the status log no longer owns to the
+# captain-held task that carries it: the key as a task id itself (the collapsed
+# identity - a captain call IS a task held for the captain), then the legacy
+# derived `<task>-decision-<key>` identity for pre-collapse rows. Answerable
+# means not closed and still carrying the captain-hold annotations tasks-axi
+# preserves even past a hold-until date.
+fm_send_hold_resolved_id() {  # <task-id> <decision-key>
+  local show id state hold_kind
   command -v tasks-axi >/dev/null 2>&1 || return 1
-  show=$( (cd "$FM_HOME" && tasks-axi show "$1-decision-$2" --full) 2>/dev/null ) || return 1
-  case "$show" in *"held: yes"*) : ;; *) return 1 ;; esac
-  case "$show" in *"hold_kind: captain"*) : ;; *) return 1 ;; esac
-  case "$show" in *"state: queued"*) return 0 ;; esac
+  for id in "$2" "$1-decision-$2"; do
+    show=$( (cd "$FM_HOME" && tasks-axi show "$id" --full) 2>/dev/null ) || continue
+    state=$(printf '%s\n' "$show" | sed -n 's/^  state: //p' | head -1)
+    hold_kind=$(printf '%s\n' "$show" | sed -n 's/^  hold_kind: //p' | head -1)
+    [ "$state" != "done" ] || continue
+    [ "$hold_kind" = captain ] || continue
+    printf '%s\n' "$id"
+    return 0
+  done
   return 1
 }
 
@@ -430,13 +442,13 @@ if [ -n "$RESOLVE_KEYS" ]; then
         ;;
     esac
     # Not open in the status log. A decision already transferred to its durable
-    # hold is exactly this case, and it is answerable - just through the other
-    # ledger - so check there before refusing.
-    if fm_send_hold_is_active "$RESOLVE_TASK_ID" "$k"; then
-      RESOLVE_HOLD_KEYS="${RESOLVE_HOLD_KEYS}${RESOLVE_HOLD_KEYS:+ }$k"
+    # captain-held task is exactly this case, and it is answerable - just
+    # through the other ledger - so check there before refusing.
+    if resolved_hold_id=$(fm_send_hold_resolved_id "$RESOLVE_TASK_ID" "$k"); then
+      RESOLVE_HOLD_KEYS="${RESOLVE_HOLD_KEYS}${RESOLVE_HOLD_KEYS:+ }$resolved_hold_id"
       continue
     fi
-    echo "error: --resolve-key '$k': no open decision or blocker with that key in $RESOLVE_STATUS_FILE, and no active captain decision $RESOLVE_TASK_ID-decision-$k (already closed or mistyped). Re-check the OPEN DECISIONS listing, then resend without that key or with the right one; nothing was sent." >&2
+    echo "error: --resolve-key '$k': no open decision or blocker with that key in $RESOLVE_STATUS_FILE, and no captain-held task '$k' or '$RESOLVE_TASK_ID-decision-$k' still open (already closed or mistyped). Re-check the OPEN DECISIONS listing, then resend without that key or with the right one; nothing was sent." >&2
     exit 1
   done
 fi
@@ -463,9 +475,10 @@ fm_send_close_resolved_keys() {  # <answer-text>
   done
 }
 
-# Feed the answered hold keys to the ONE keyed-answer intake, as keyed lines,
-# exactly the way every other channel does. fm-send decides nothing here: it does
-# not map a key to a hold, build a decision record, or choose a close path.
+# Feed the answered captain-held tasks to the ONE keyed-answer intake, as keyed
+# lines, exactly the way every other channel does. fm-send decides nothing here:
+# it does not build a decision record or choose a close path; the keys were
+# already resolved to task ids above, so the intake needs no legacy origin.
 fm_send_feed_resolved_holds() {  # <answer-text>
   local note=$1 k lines=''
   [ -n "$RESOLVE_HOLD_KEYS" ] || return 0
@@ -473,9 +486,9 @@ fm_send_feed_resolved_holds() {  # <answer-text>
   for k in $RESOLVE_HOLD_KEYS; do
     lines="${lines}${k}"$'\t'"${note}"$'\t'$'\n'
   done
-  if ! printf '%s' "$lines" | "$SCRIPT_DIR/fm-decision-hold.sh" answers "$RESOLVE_TASK_ID" \
+  if ! printf '%s' "$lines" | "$SCRIPT_DIR/fm-captain-hold.sh" answers \
     --source "a firstmate answer sent to $RESOLVE_TASK_ID" >/dev/null 2>&1; then
-    echo "error: the answer was delivered to $T, but this captain decision could not be closed: ${RESOLVE_HOLD_KEYS}. Close it with fm-decision-hold.sh (answer, or resolve when it routes work) - do not resend the answer." >&2
+    echo "error: the answer was delivered to $T, but this captain-held task could not be closed: ${RESOLVE_HOLD_KEYS}. Close it with fm-captain-hold.sh answer - do not resend the answer." >&2
     return 1
   fi
 }
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index 4178217c91..c39c3f7c6a 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -2322,9 +2322,9 @@ if [ "$KIND" = scout ] && [ "$FORCE" != "--force" ]; then
     exit 1
   fi
   if ! FM_HOME="$FM_HOME" FM_STATE_OVERRIDE="$STATE" FM_DATA_OVERRIDE="$DATA" \
-      FM_CONFIG_OVERRIDE="$CONFIG" "$SCRIPT_DIR/fm-decision-hold.sh" verify "$ID" >/dev/null; then
-    echo "REFUSED: scout task $ID has not passed the unresolved-decision completion gate." >&2
-    echo "Inventory its report and any visual review through bin/fm-decision-hold.sh before teardown." >&2
+      FM_CONFIG_OVERRIDE="$CONFIG" "$SCRIPT_DIR/fm-captain-hold.sh" verify "$ID" >/dev/null; then
+    echo "REFUSED: scout task $ID has not passed the captain-call completion gate." >&2
+    echo "Inventory its report and any visual review through bin/fm-captain-hold.sh before teardown." >&2
     exit 1
   fi
 fi
diff --git a/bin/fm-test-isolation-proof.sh b/bin/fm-test-isolation-proof.sh
index 4aceb1a104..137aff8b26 100755
--- a/bin/fm-test-isolation-proof.sh
+++ b/bin/fm-test-isolation-proof.sh
@@ -153,11 +153,11 @@ list_parallel_candidates() {
 tests/fm-arm-pretool-check.test.sh
 tests/fm-backend-herdr.test.sh
 tests/fm-brief.test.sh
+tests/fm-captain-hold-lifecycle.test.sh
 tests/fm-cd-pretool-check.test.sh
 tests/fm-composer-ghost.test.sh
 tests/fm-composer-lib.test.sh
 tests/fm-crew-state.test.sh
-tests/fm-decision-hold-lifecycle.test.sh
 tests/fm-ensure-agents-md.test.sh
 tests/fm-grok-harness.test.sh
 tests/fm-herdr-lab.test.sh
diff --git a/bin/fm-test-run.sh b/bin/fm-test-run.sh
index fbb47e08c1..73eb3519c3 100755
--- a/bin/fm-test-run.sh
+++ b/bin/fm-test-run.sh
@@ -138,7 +138,7 @@ family_for_basename() {
     fm-calm-pi-extension.test.sh|fm-cd-pretool-check.test.sh|\
     fm-classify-decision-key.test.sh|\
     fm-composer-ghost.test.sh|fm-composer-lib.test.sh|\
-    fm-crew-state.test.sh|fm-decision-hold-lifecycle.test.sh|\
+    fm-crew-state.test.sh|fm-captain-hold-lifecycle.test.sh|\
     fm-documentation-audiences.test.sh|fm-ensure-agents-md.test.sh|fm-grok-harness.test.sh|\
     fm-kimi-harness.test.sh|fm-muse-harness.test.sh|fm-herdr-lab.test.sh|fm-lint.test.sh|\
     fm-lint-workflows.test.sh|\
@@ -281,11 +281,11 @@ list_proven_isolated() {
 tests/fm-arm-pretool-check.test.sh
 tests/fm-backend-herdr.test.sh
 tests/fm-brief.test.sh
+tests/fm-captain-hold-lifecycle.test.sh
 tests/fm-cd-pretool-check.test.sh
 tests/fm-composer-ghost.test.sh
 tests/fm-composer-lib.test.sh
 tests/fm-crew-state.test.sh
-tests/fm-decision-hold-lifecycle.test.sh
 tests/fm-ensure-agents-md.test.sh
 tests/fm-grok-harness.test.sh
 tests/fm-herdr-lab.test.sh
@@ -312,7 +312,7 @@ list_portable_parallel_1() {
   cat <<'EOF'
 tests/fm-x-mode.test.sh
 tests/fm-cd-pretool-check.test.sh
-tests/fm-decision-hold-lifecycle.test.sh
+tests/fm-captain-hold-lifecycle.test.sh
 tests/fm-test-run.test.sh
 tests/fm-composer-ghost.test.sh
 tests/fm-grok-harness.test.sh
@@ -966,7 +966,7 @@ families_for_changed_path() {
     bin/fm-lint.sh|bin/fm-lint-workflows.sh|bin/fm-install-shellcheck.sh|\
     bin/fm-install-actionlint.sh|\
     bin/fm-brief.sh|bin/fm-ensure-agents-md.sh|bin/fm-crew-state.sh|\
-    bin/fm-decision-hold.sh|bin/fm-supervision*|bin/fm-transition-lib.sh|\
+    bin/fm-captain-hold.sh|bin/fm-decision-hold.sh|bin/fm-supervision*|bin/fm-transition-lib.sh|\
     bin/fm-tmux-lib.sh|bin/fm-marker-lib.sh|bin/fm-operational-input.sh|bin/fm-tasks-axi-lib.sh|\
     bin/fm-vendor-auth-probe.sh|\
     bin/fm-primary-scope-lib.sh|bin/fm-project-mode.sh|bin/fm-promote.sh|\
diff --git a/docs/captain-hold-lifecycle.md b/docs/captain-hold-lifecycle.md
new file mode 100644
index 0000000000..5803a6b349
--- /dev/null
+++ b/docs/captain-hold-lifecycle.md
@@ -0,0 +1,74 @@
+# Captain-hold lifecycle mechanism
+
+The normative policy is owned by `.agents/skills/captain-hold-lifecycle/SKILL.md` and is not restated here.
+This document records the deterministic mechanism, structured surfaces, compatibility contract, and privacy-safe regression evidence.
+
+## Mechanism
+
+A decision is not a separate thing in this system: it is an ordinary backlog task held for the captain, and the task id is the identity every surface and channel uses.
+`bin/fm-captain-hold.sh` is the only lifecycle command layered on that primitive.
+The command runs tasks-axi in the active `FM_HOME`, so the existing backlog remains the only durable work database and a secondmate-owned captain call stays in the secondmate home.
+It never reads report bodies, review artifacts, terminal output, or chat.
+
+The `hold` subcommand places an existing task under an active captain hold, or creates the task when nothing exists to hold, then verifies the hold through `tasks-axi hold <id> --reason <reason> --kind captain`.
+Repeats are idempotent, a closed task is refused rather than reopened, and `--until` stores the captain's own deferral date through tasks-axi's date gate.
+
+The `answer` subcommand records the captain's exact words and closes the call in the same act.
+It requires a non-empty captain decision file of at most 8192 bytes, writes a resolution block carrying the decision digest and a `Resolution mode:` at the top of the task body (the previous body is preserved below the block and archived through tasks-axi `--archive-body`), then runs `tasks-axi done` - or `tasks-axi unhold` under `--release`, so a captain-gated work item resumes instead of closing.
+An exact retry is idempotent only when the requested close mode matches the newest record; a drifted answer or mode mismatch is rejected, while a re-held task accepts a new answer as a new record on top.
+On a task closed outside the script, `answer` records the missing block only when the captain-hold annotations tasks-axi preserves through a close prove the captain owned it, and it verifies the task stays closed.
+A hold whose `--until` date has passed keeps those annotations while tasks-axi reports it no longer held, so an expired deferral remains answerable.
+
+The `complete` subcommand unions the reviewed captain-held task ids into `decision_keys=` and appends `decisions_reviewed=1` while originating task metadata is live.
+A post-teardown visual review can complete against the surviving report and durable tasks without recreating volatile task metadata.
+It accepts `--none` as an explicit semantic inventory result, refused while the origin still has a lifecycle-open keyed status decision, and verifies every listed task against tasks-axi before recording completion.
+With a non-empty inventory it appends a `captain-held [key=<key>]: tracked by <inventory>` transfer event for every still-open keyed status decision, which `bin/fm-classify-lib.sh` recognizes as closing the live status copy without claiming that the captain has answered it.
+
+Scout teardown calls the read-only `verify` subcommand after checking for the report and before removing any source state.
+`verify` requires the recorded attestation, requires every recorded inventory entry to still be durable (actively captain-held, or carrying a recorded answer), and fails on any keyed status decision that opened after the last `complete`, which makes re-running `complete` the repair.
+The `--force` path remains the explicit captain-approved discard escape hatch.
+
+## Answer-time closure
+
+"A keyed answer closes its matching captain-held task" is one capability with one owner.
+`answers` is its channel-agnostic entry point: it reads `<task-id>\t<answer>\t<label>[\t<mode>]` lines and closes each named task through the same `answer` path, so every guard applies identically no matter which channel the answer arrived on.
+The optional mode column carries a card-declared close: `done` (default) completes the task and `release` lifts the hold so held work resumes; any other value is skipped.
+A key that names no task, names a task that is not captain-held, or names a task already closed is reported as `skipped:` and feeds nothing; a replay whose answer and requested close mode match the newest record is an idempotent `closed:`, while a mode mismatch is skipped; and the command exits nonzero when any key was skipped.
+`--source` is provenance text recorded in the durable decision, never a behavior switch, and the command carries no per-channel branch.
+
+`bind`, `unbind`, and `binding` record that a captured-answer source feeds this intake, as a private record under `state/decision-bindings/`; an unbound source feeds nothing, so the path is opt-in per source, and `bind` deliberately does not require the source to exist yet.
+
+Two channels feed that one intake today, and both are ordinary callers rather than special cases.
+`bin/fm-send.sh --resolve-key` is the chat channel: its status-log close is unchanged for a key the status log still owns, and a key the status log no longer owns is resolved to a still-open captain-held task - the key as a task id, then the legacy derived identity - and fed as one keyed line.
+`bin/fm-procevent.sh` is the captured-result channel: after capture, a bound source has its result passed to `bin/fm-procevent-<adapter>.sh answers <result-file>` and whatever that prints is piped into the intake, so any adapter with an `answers` command works and the runner names no adapter, parses no result, and carries no decision rule.
+`bin/fm-procevent-lavish.sh answers` is one such adapter command; it reads only rows tagged `choice`, relays a card's declared close mode, and can never let freeform captain prose forge a task id or a mode.
+
+## Structured read surfaces
+
+`bin/fm-fleet-snapshot.sh` parses canonical tasks-axi `(hold: ...)`, `(hold-kind: ...)`, and `(hold-until: ...)` metadata alongside existing backlog fields.
+It resolves every repeated `blocked-by:` edge against structured Done records, keeps missing blockers unresolved, and classifies a captain hold as `captain_actionable` - waiting on the captain now - only when it is queued, unblocked, and due, whatever kind its row carries.
+It also emits a presentation-only `deferred_marker` when a hold's reason or body carries an explicit SUPERSEDED / NOT REQUIRED / DEFERRED marker.
+Its secondmate-home summary classifies an actionable captain hold as `captain_decision` and preserves blocked or deferred captain holds as queued work in the owning home.
+
+`bin/fm-bearings-snapshot.sh` projects actionable captain holds into `decisions_open` and leaves blocked captain holds in ordinary queued gates.
+A date-deferred captain hold renders as a gate with its `until <date>:` reason; a prose-deferred one leaves the default views with an `omitted[]` disclosure, revealed by `--all-decisions` / `--all-queued`.
+Recently Landed excludes a record that closed while still held for the captain (surviving `hold-kind: captain` on a Done row), so answered questions do not masquerade as shipped work; a work item released before completion keeps no hold annotations and lands normally.
+The projection remains read-only and does not inspect historical prose beyond the canonical snapshot's marker.
+
+## Compatibility with pre-collapse installs
+
+Older installs created derived `<origin>-decision-<key>` identities through the retired `bin/fm-decision-hold.sh`.
+Those rows are already plain task ids, so they render, answer, verify, and close through the collapsed surfaces with no data migration.
+Three legacy inputs are resolved in place: a `decision_keys=` metadata entry that names no task resolves through `<origin>-decision-<entry>`; a channel key that names no task resolves the same way when the source's binding carries a concrete legacy origin; and resolution records written by the old script are recognized wherever a record is read.
+The shim recognizes an exact replay of a pre-collapse routed resolution by its historical answer digest and routed ids, then finishes any still-recorded dependency-edge cleanup without rewriting the old decision text.
+`bin/fm-decision-hold.sh` itself remains for one release as a thin command-mapping shim over `bin/fm-captain-hold.sh`, so in-flight work briefed before the collapse keeps working; its header owns the exact mapping.
+
+## Verification record
+
+Verification date: 2026-08-20.
+
+The focused end-to-end regression suite is `tests/fm-captain-hold-lifecycle.test.sh`, using only synthetic `sample` identities and decision text.
+It proves: a report-only unresolved captain call refuses `--none` completion before teardown can erase the source; non-forced scout teardown always requires the durable inventory verification; the recorded-answer guard (a bare `tasks-axi done` close fails `verify` until `answer` records the captain's word, and an ordinary finished task cannot be dressed up as an answered call); answer-time closure through a bound channel with task-id keys, including the `release` close mode, mode-matched replay idempotence, and the refusal of drifted, mode-mismatched, absent, unheld, and already-closed keys; the chat channel reaching the same intake; deferral through `--until` leaving `captain_actionable` false until due; and every legacy path (composed identities through the shim, pre-collapse `decision_keys=` metadata, routed-resolution replay, and a concrete-origin binding).
+
+Projection regressions live in `tests/fm-fleet-snapshot-view.test.sh` (hold-until parsing, the due gate, kind-independent captain actionability, deferred_marker, title stripping) and `tests/fm-bearings-snapshot.test.sh` (Captain's Call membership, the dated-gate rendering, prose-deferral suppression with disclosure, and the landed exclusion by surviving captain-hold annotations).
+The exact commands and their summarized outputs are recorded in the shipping PR's evidence; run the three suites above plus `tests/fm-send-resolve-key.test.sh`, `tests/fm-bearings-board.test.sh`, and `bin/fm-lint.sh` to refresh this record.
diff --git a/docs/configuration.md b/docs/configuration.md
index 49ec682871..8b11f46865 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -480,8 +480,8 @@ Announcement ordering is adapter-declared through `bin/fm-procevent-<adapter>.sh
 The remote-secondmate reply adapter declares itself self-announcing: a captured reply reaches its local status mirror and settles its correlated pending-reply expectation without any handler step, the mirrored status bytes are the single wake for one remote note through the same signal classification a local secondmate's append gets, a byte-identical replayed capture adds no bytes and stays quiet, and only a capture the adapter could not fully apply is published as a `check` wake, whose adapter handling remains idempotent.
 
 Keyed captain answers use one more seam of the same kind, and the runner still decides nothing about them.
-Some sources carry the captain's answer to a durable decision, and what such an answer means is owned once by `bin/fm-decision-hold.sh`'s keyed-answer intake rather than by any channel.
-A source bound with `bin/fm-decision-hold.sh bind` therefore has each captured result passed to `bin/fm-procevent-<adapter>.sh answers <result-file>`, and whatever that prints is piped straight into that intake.
+Some sources carry the captain's answer to a captain-held task, and what such an answer means is owned once by `bin/fm-captain-hold.sh`'s keyed-answer intake rather than by any channel.
+A source bound with `bin/fm-captain-hold.sh bind` therefore has each captured result passed to `bin/fm-procevent-<adapter>.sh answers <result-file>`, and whatever that prints is piped straight into that intake.
 A binding can select one decision origin or the script's cross-origin mode; the command header owns the exact forms and key interpretation.
 The adapter reports only what the captain chose; the intake owns every rule about what happens next, so the runner names no adapter, parses no result, and carries no decision rule, and a future source needs nothing here beyond an `answers` command and a binding.
 Feeding is independent of handling: it never acknowledges a result and never suppresses a wake, because recording the answer is transcription while acting on it is firstmate's judgement.
diff --git a/docs/decision-hold-lifecycle.md b/docs/decision-hold-lifecycle.md
deleted file mode 100644
index eb5e15972c..0000000000
--- a/docs/decision-hold-lifecycle.md
+++ /dev/null
@@ -1,180 +0,0 @@
-# Decision hold lifecycle mechanism
-
-The normative policy is owned by `.agents/skills/decision-hold-lifecycle/SKILL.md` and is not restated here.
-This document records the deterministic mechanism, structured surfaces, and privacy-safe regression evidence.
-
-## Mechanism
-
-`bin/fm-decision-hold.sh` is the only lifecycle command for an investigation or visual review's unresolved captain decisions.
-The command runs tasks-axi in the active `FM_HOME`, so the existing backlog remains the only durable work database and a secondmate-owned decision stays in the secondmate home.
-It never reads report bodies, review artifacts, terminal output, or chat.
-
-The `hold` subcommand maps an originating work id and stable decision key to `<origin-id>-decision-<decision-key>`.
-It creates a kind `captain` backlog item when absent and invokes `tasks-axi hold <id> --reason <reason> --kind captain` on every retry.
-It rejects an identity collision, a changed title, and attempts to reopen an already resolved identity.
-
-The `complete` subcommand unions the reviewed keys into `decision_keys=` and appends `decisions_reviewed=1` while originating task metadata is live.
-A post-teardown visual review can complete against the surviving report and durable holds without recreating volatile task metadata.
-It accepts `--none` as an explicit semantic inventory result, not as inferred absence.
-It verifies every listed identity against tasks-axi before recording completion.
-For an open keyed status decision, it appends a `captain-held [key=<key>]: ...` transfer event only after the matching backlog hold is durable.
-`bin/fm-classify-lib.sh` recognizes that transfer as closing the live status copy without claiming that the captain has answered it.
-
-Scout teardown calls the script's read-only `verify` subcommand after checking for the report and before removing any source state.
-The `--force` path remains the explicit captain-approved discard escape hatch.
-
-The `resolve`, `answer`, and `decline` subcommands close active holds, while `repair` attests a hold already closed outside the script.
-All four require a non-empty captain decision file and record the same resolution block in the hold body with the decision digest, routed identities, and a `Resolution mode:` naming the path.
-An exact retry is idempotent, while a changed decision or, for `resolve`, a changed routed-task set is rejected.
-
-The `resolve` subcommand is the routed path and additionally requires at least one existing dependent task whose structured `blocked-by` edge points to the hold.
-It clears each dependency edge through tasks-axi and marks the hold Done only after those writes succeed.
-An exact retry can finish a partial routing operation, and a failed intermediate step leaves the hold open.
-
-The public `answer` and `decline` subcommands share one unrouted close implementation and differ only in the `Resolution mode:` they record and the outcome word they print, so neither can drift into a weaker ordinary close than the other.
-Both ordinarily record `(none)` as the routed identities and refuse while any task in the same backlog is still blocked by the hold, because releasing routed work without recording it is `resolve`'s job.
-The keyed-answer intake's reserved drop is the sole exception: its internal decline invocation closes only the stale hold and deliberately leaves existing dependents as independent queued work.
-Every candidate found in the listing prefilter is confirmed against its own structured record before the refusal is reported.
-`answer` exists so the act carrying a captain answer can also be the act that closes its hold; an ordinary `decline` continues to mean the stronger claim that the answer routes no follow-up work at all.
-
-The `repair` subcommand records the resolution block on a hold that was already closed outside the script, such as by a direct `tasks-axi done`, so an origin whose decision was genuinely answered stops failing `verify`.
-It refuses a hold that is still actively held, never reopens a closed hold, and never clears a dependency edge, so an unanswered decision keeps blocking teardown until the captain's word closes it.
-It also requires the identity to carry the captain-hold provenance that tasks-axi preserves through a close, so an ordinary captain-kind task that was never held cannot be repaired into a resolved decision.
-
-## Answer-time closure
-
-The live status-log decision ledger has always had answer-time closure through `bin/fm-send.sh --resolve-key`: answering a keyed decision closes it in the same act.
-The durable hold ledger did not, so an answer could be captured, believed, and even implemented while its hold stayed open, and the captain could then be asked to re-answer a decision already on disk.
-
-"A keyed answer closes its matching hold" is now one capability with one owner.
-`answers` is its channel-agnostic entry point: it reads a key, answer, and label on each input line and closes the matching hold through the same `answer` path, except that the exact reserved answer `__drop__` closes with a declined, "dropped by captain" decision record rather than as a substantive choice.
-For a single-origin intake the key is the decision key mapped under that bound origin; for the cross-origin intake it is the full hold identity, while keys that do not name a full decision hold feed nothing.
-`--source` is provenance text recorded in the durable decision, never a behavior switch, and the command carries no per-channel branch and no knowledge of chat, review decks, or any transport.
-A channel's only job is to turn whatever it received into those keyed lines and pipe them in; it never maps keys to holds, builds decision records, chooses between the close paths, or closes a hold itself.
-Emitting `__drop__` is how a channel reports that the captain dropped the decision; the intake, not the channel, chooses `decline`.
-The decision text is a pure function of source, key, answer, and label, which is what makes a replayed delivery an idempotent no-op rather than a rejected different decision.
-A key whose hold is absent or already closed is reported as skipped, as is a substantive answer whose hold still blocks routed work; a reserved drop instead closes only that hold while existing dependents remain independent queued work.
-The command exits nonzero when any key was skipped.
-
-`bind`, `unbind`, and `binding` record whether a captured-answer source belongs to one origin or uses the cross-origin intake, for a channel whose answers arrive detached from the origin.
-The binding is a private record under `state/decision-bindings/`, and a source with no binding feeds nothing, so the path is opt-in per source.
-`bind` deliberately does not require the source to exist yet, so a channel can be bound before it is armed and never produce an answer that has nowhere to go.
-The script header and `--help` own the exact cross-origin marker, identity split, limits, and refusal behavior.
-
-Two channels feed that one intake today, and both are ordinary callers rather than special cases.
-
-`bin/fm-send.sh --resolve-key` is the chat channel.
-Its existing status-log close is unchanged for a key the status log still owns.
-For a key the status log no longer owns it checks whether that key names an active captain hold on the target task, and feeds the answer as one keyed line if so, which is what lets chat answer a decision already transferred to its hold.
-A key open in neither ledger is still refused before anything is sent.
-Because `complete` closes the live status copy at the moment it transfers a decision to its hold, the two ledgers are the two sides of one transfer and never both own a key at once, so the common path still performs no backlog read.
-
-`bin/fm-procevent.sh` is the captured-result channel, and its wiring is generic.
-After capture, a bound source has its result passed to `bin/fm-procevent-<adapter>.sh answers <result-file>` and whatever that prints is piped into the intake, so any adapter with an `answers` command works and the runner names no adapter, parses no result, and carries no decision rule.
-Feeding is independent of handling: it never acknowledges a result and never suppresses a wake, so recording the captain's answer cannot retire the notification firstmate needs in order to act on it.
-`bin/fm-procevent-lavish.sh answers` is one such adapter command; it reports the structured choices a review captured and stops there, reading only rows tagged `choice` so freeform captain prose can never forge a decision key.
-
-## Structured read surfaces
-
-`bin/fm-fleet-snapshot.sh` parses canonical tasks-axi `(hold: ...)` and `(hold-kind: captain)` metadata alongside existing backlog fields.
-It resolves every repeated `blocked-by:` edge against structured Done records, keeps missing blockers unresolved, and classifies only an unblocked captain hold as actionable.
-Its secondmate-home summary classifies an actionable captain hold as `captain_decision` and preserves blocked captain holds as queued work in the owning home.
-
-`bin/fm-bearings-snapshot.sh` projects actionable captain holds into `decisions_open` and leaves blocked captain holds in ordinary queued gates.
-It excludes completed kind `captain` records from Recently Landed.
-The projection remains read-only and does not inspect historical prose.
-
-## Verification record
-
-Verification date: 2026-07-14.
-Additional quoted `blocked_by` regression verification date: 2026-07-17.
-Plural blocker-readiness and mixed-home projection verification date: 2026-07-22.
-Unrouted close-path verification date: 2026-08-13.
-Answer-time closure verification date: 2026-08-16.
-Cross-origin answer-time closure verification date: 2026-08-19.
-Reserved close/drop answer verification date: 2026-08-20.
-
-The focused end-to-end regression uses only synthetic `sample` identities and decision text.
-It begins with a completed investigation and visual review whose genuine unresolved choice exists only in the report.
-The initial Bearings snapshot correctly has no open decision, and the new teardown gate refuses to erase the source.
-A later regression covers tasks-axi's quoted multi-entry `blocked_by` output so `resolve` matches the first, middle, and last ids and rejects a genuinely absent id.
-
-Three further regressions cover the close paths that route no work.
-A declined decision closes with a recorded answer, satisfies `verify`, leaves Bearings' Captain's Call, and is refused while the hold still blocks routed work.
-A hold closed by a direct `tasks-axi done` reproduces the shape that fails `verify` and blocks teardown, and `repair` with a captain decision file clears both.
-An unanswered decision still blocks completion and teardown, and neither `decline` nor `repair` can close a hold that is still actively held or supply an answer with a missing or empty decision file.
-`repair` also refuses a closed captain-kind task that was never held for the captain.
-
-Three answer-time closure regressions run against the published poll response shape, with synthetic `sample` identities.
-A bound source whose origin exposes six holds captures one review carrying five structured choices plus one freeform message, and the runner feeds it through a fixture adapter that is not the review adapter at all, so what is proven is that any bound channel with an `answers` command gets closure rather than that one channel is wired specially.
-Four holds whose answers route no work close, the one still blocking routed work is skipped and stays available to `resolve`, and the one whose key appears only inside the freeform prose never closes.
-The capture is left unacknowledged throughout, so the wake firstmate needs in order to act on the answers is never retired.
-A replayed delivery closes nothing new and is not rejected as a different decision, a source with no binding closes nothing at all, and the `answer` subcommand itself refuses an empty or missing decision file, an absent hold, and a drifted retry.
-A separate regression drives the real `fm-send` over a stubbed transport to prove the chat channel reaches the same intake for a decision already transferred to its hold, which the status ledger alone can no longer close.
-The cross-origin regression drives a bound source through the real runner and adapter interface, closes full-identity holds from different origins, and proves that over-limit, malformed, non-decision, routed-work, absent-hold, and replayed answers all fail or skip without weakening the existing guards.
-A reserved `__drop__` answer through that same published poll shape declines the matching hold with a dropped-by-captain record and leaves Bearings' Captain's Call even when existing independent work is routed behind it; that dependent work remains queued and is not closed.
-
-The final verification commands and their exact summarized outputs follow.
-
-```text
-$ bash tests/fm-decision-hold-lifecycle.test.sh
-ok - report-only unresolved decision is reproduced and completion refuses before loss
-ok - non-forced scout teardown always requires durable inventory verification
-ok - a declined decision closes with a recorded answer and no routed work
-ok - a decision closed outside the script is repairable and then clears teardown
-ok - an unanswered decision still blocks completion and resists both unrouted close paths
-ok - captain holds are idempotent, distinct, teardown-safe, Bearings-visible, and durably routed before close
-ok - completion and verification validate origins before constructing paths
-ok - ended visual review follows the same decision-hold completion owner
-ok - resolved findings and decision-like prose do not create false holds
-ok - terminal single-owner stale status decisions do not block empty inventory
-ok - main-home and secondmate-home captain holds remain correctly routed
-ok - resolve matches first/middle/last in quoted blocked_by and rejects a genuinely absent id
-ok - a bound channel's captured answers close their captain holds at answer time
-ok - a channel source with no decision binding closes nothing
-ok - an any-origin bound source closes full-identity holds across origins
-ok - the answer path keeps every guard the unrouted close path already had
-ok - the chat channel feeds the same keyed-answer intake a captured review does
-
-$ bash tests/fm-bearings-board.test.sh
-ok - path prints the stable home-scoped board location
-ok - build refuses malformed payloads before touching the board
-ok - build keeps freeform-only credential cards valid
-ok - build injects the payload, binds any-origin, then arms the source
-ok - registration can consume answers only after any-origin binding exists
-ok - build establishes the Lavish session before binding and arming
-ok - rebuild refreshes the board in place without double-arming
-ok - build refuses a template without exactly one data slot
-ok - a reserved close/drop answer declines the hold and leaves Captain's Call
-
-$ bash tests/fm-fleet-snapshot-view.test.sh
-ok - backlog normalization preserves strict roles and resolves every blocker compatibly
-ok - durable captain-held transfer closes the duplicate live status decision
-ok - snapshot parses tasks-axi rows and respects operational overrides
-
-$ bash tests/fm-bearings-snapshot.test.sh
-ok - a completed scout with decision-like report prose is a pointer, not pending
-ok - an authoritative captain hold surfaces end-to-end
-ok - action-free items (working/done/queued/landed) do not leak into Captain's Call
-ok - main and secondmate captain actionability use the same blocker readiness
-
-$ bash tests/fm-send-resolve-key.test.sh
-ok - fm-send --resolve-key: the answer send itself closes the open decision
-ok - fm-send --resolve-key: a key that is not open refuses loudly before anything is sent
-(13 assertions total; the status-log ledger's behavior is unchanged)
-
-$ bash tests/fm-brief.test.sh
-ok - fm-brief.sh: investigation and visual-review completions load the shared decision policy
-
-$ bash tests/fm-teardown.test.sh
-ok - the run abort and the leaked-process reap both complete before the destructive worktree return
-
-$ bin/fm-lint.sh
-fm-lint.sh: ShellCheck 0.11.0 (pinned 0.11.0)
-
-$ bin/fm-doc-audience-check.sh
-fm-doc-audience-check: ok surfaces=68 local_links=253
-
-$ git diff --check
-(no output)
-```
diff --git a/docs/documentation-audiences.json b/docs/documentation-audiences.json
index 4889467bd4..f644fcb805 100644
--- a/docs/documentation-audiences.json
+++ b/docs/documentation-audiences.json
@@ -128,6 +128,10 @@
       "path": ".agents/skills/bootstrap-diagnostics/SKILL.md",
       "audience": "agent-runtime"
     },
+    {
+      "path": ".agents/skills/captain-hold-lifecycle/SKILL.md",
+      "audience": "agent-runtime"
+    },
     {
       "path": ".agents/skills/decision-hold-lifecycle/SKILL.md",
       "audience": "agent-runtime"
@@ -245,7 +249,7 @@
       "audience": "operator-current"
     },
     {
-      "path": "docs/decision-hold-lifecycle.md",
+      "path": "docs/captain-hold-lifecycle.md",
       "audience": "maintainer-architecture"
     },
     {
diff --git a/docs/fm-test-isolation-proof.json b/docs/fm-test-isolation-proof.json
index ec605bf10f..376ba99845 100644
--- a/docs/fm-test-isolation-proof.json
+++ b/docs/fm-test-isolation-proof.json
@@ -1,36 +1,36 @@
 {
   "concurrency": 4,
-  "finished_at": "2026-07-29T23:21:46Z",
+  "finished_at": "2026-08-21T00:45:57Z",
   "fm_test_run_jobs_enabled": false,
   "kind": "isolation-proof",
   "production_sharding_enabled": false,
-  "run_id": "fm-isolation-1785367157179-18165",
+  "run_id": "fm-isolation-1787273044622-10250",
   "scripts": [
-    {"duration_ms": 46788, "exit": 0, "path": "tests/fm-arm-pretool-check.test.sh", "worker": 1},
-    {"duration_ms": 48294, "exit": 0, "path": "tests/fm-backend-herdr.test.sh", "worker": 2},
-    {"duration_ms": 2224, "exit": 0, "path": "tests/fm-brief.test.sh", "worker": 3},
-    {"duration_ms": 34207, "exit": 0, "path": "tests/fm-cd-pretool-check.test.sh", "worker": 4},
-    {"duration_ms": 9065, "exit": 0, "path": "tests/fm-composer-ghost.test.sh", "worker": 5},
-    {"duration_ms": 64, "exit": 0, "path": "tests/fm-composer-lib.test.sh", "worker": 6},
-    {"duration_ms": 25365, "exit": 0, "path": "tests/fm-crew-state.test.sh", "worker": 7},
-    {"duration_ms": 30771, "exit": 0, "path": "tests/fm-decision-hold-lifecycle.test.sh", "worker": 8},
-    {"duration_ms": 581, "exit": 0, "path": "tests/fm-ensure-agents-md.test.sh", "worker": 9},
-    {"duration_ms": 6251, "exit": 0, "path": "tests/fm-grok-harness.test.sh", "worker": 10},
-    {"duration_ms": 15422, "exit": 0, "path": "tests/fm-herdr-lab.test.sh", "worker": 11},
-    {"duration_ms": 5237, "exit": 0, "path": "tests/fm-lint.test.sh", "worker": 12},
-    {"duration_ms": 2945, "exit": 0, "path": "tests/fm-pi-primary-types.test.sh", "worker": 13},
-    {"duration_ms": 8564, "exit": 0, "path": "tests/fm-pr-merge.test.sh", "worker": 14},
-    {"duration_ms": 2875, "exit": 0, "path": "tests/fm-review-diff.test.sh", "worker": 15},
-    {"duration_ms": 5644, "exit": 0, "path": "tests/fm-send-popup-settle.test.sh", "worker": 16},
-    {"duration_ms": 2911, "exit": 0, "path": "tests/fm-send-settle.test.sh", "worker": 17},
-    {"duration_ms": 2747, "exit": 0, "path": "tests/fm-send-strict.test.sh", "worker": 18},
-    {"duration_ms": 855, "exit": 0, "path": "tests/fm-spawn-batch.test.sh", "worker": 19},
-    {"duration_ms": 703, "exit": 0, "path": "tests/fm-supervision-instructions.test.sh", "worker": 20},
-    {"duration_ms": 15674, "exit": 0, "path": "tests/fm-test-run.test.sh", "worker": 21},
-    {"duration_ms": 4816, "exit": 0, "path": "tests/fm-tmux-submit-busy.test.sh", "worker": 22},
-    {"duration_ms": 248, "exit": 0, "path": "tests/fm-transition-lib.test.sh", "worker": 23},
-    {"duration_ms": 52939, "exit": 0, "path": "tests/fm-x-mode.test.sh", "worker": 24}
+    {"duration_ms": 27529, "exit": 0, "path": "tests/fm-arm-pretool-check.test.sh", "worker": 1},
+    {"duration_ms": 45356, "exit": 0, "path": "tests/fm-backend-herdr.test.sh", "worker": 2},
+    {"duration_ms": 1315, "exit": 0, "path": "tests/fm-brief.test.sh", "worker": 3},
+    {"duration_ms": 35095, "exit": 0, "path": "tests/fm-captain-hold-lifecycle.test.sh", "worker": 4},
+    {"duration_ms": 16582, "exit": 0, "path": "tests/fm-cd-pretool-check.test.sh", "worker": 5},
+    {"duration_ms": 5569, "exit": 0, "path": "tests/fm-composer-ghost.test.sh", "worker": 6},
+    {"duration_ms": 3544, "exit": 0, "path": "tests/fm-composer-lib.test.sh", "worker": 7},
+    {"duration_ms": 17558, "exit": 0, "path": "tests/fm-crew-state.test.sh", "worker": 8},
+    {"duration_ms": 513, "exit": 0, "path": "tests/fm-ensure-agents-md.test.sh", "worker": 9},
+    {"duration_ms": 6768, "exit": 0, "path": "tests/fm-grok-harness.test.sh", "worker": 10},
+    {"duration_ms": 9562, "exit": 0, "path": "tests/fm-herdr-lab.test.sh", "worker": 11},
+    {"duration_ms": 9766, "exit": 0, "path": "tests/fm-lint.test.sh", "worker": 12},
+    {"duration_ms": 598, "exit": 0, "path": "tests/fm-pi-primary-types.test.sh", "worker": 13},
+    {"duration_ms": 6290, "exit": 0, "path": "tests/fm-pr-merge.test.sh", "worker": 14},
+    {"duration_ms": 2166, "exit": 0, "path": "tests/fm-review-diff.test.sh", "worker": 15},
+    {"duration_ms": 4563, "exit": 0, "path": "tests/fm-send-popup-settle.test.sh", "worker": 16},
+    {"duration_ms": 2753, "exit": 0, "path": "tests/fm-send-settle.test.sh", "worker": 17},
+    {"duration_ms": 3025, "exit": 0, "path": "tests/fm-send-strict.test.sh", "worker": 18},
+    {"duration_ms": 975, "exit": 0, "path": "tests/fm-spawn-batch.test.sh", "worker": 19},
+    {"duration_ms": 331, "exit": 0, "path": "tests/fm-supervision-instructions.test.sh", "worker": 20},
+    {"duration_ms": 20922, "exit": 0, "path": "tests/fm-test-run.test.sh", "worker": 21},
+    {"duration_ms": 4021, "exit": 0, "path": "tests/fm-tmux-submit-busy.test.sh", "worker": 22},
+    {"duration_ms": 99, "exit": 0, "path": "tests/fm-transition-lib.test.sh", "worker": 23},
+    {"duration_ms": 35415, "exit": 0, "path": "tests/fm-x-mode.test.sh", "worker": 24}
   ],
-  "started_at": "2026-07-29T23:19:17Z",
-  "summary": {"duration_ms": 149010, "failed": 0, "total": 24}
+  "started_at": "2026-08-21T00:44:04Z",
+  "summary": {"duration_ms": 113278, "failed": 0, "total": 24}
 }
diff --git a/docs/fm-test-isolation-proof.md b/docs/fm-test-isolation-proof.md
index 716dca73a5..3ee9b18f3b 100644
--- a/docs/fm-test-isolation-proof.md
+++ b/docs/fm-test-isolation-proof.md
@@ -6,30 +6,30 @@ This record is the concurrent isolation proof for the portable parallel candidat
 
 ## Verification
 
-- Date: 2026-07-29
-- Command: `bin/fm-test-isolation-proof.sh --jobs 4 --json /tmp/fm-source-content-test-cleanup-r1-isolation.json`
-- Result: `FM_ISOLATION_SUMMARY total=24 failed=0 concurrency=4 duration_ms=149010`
+- Date: 2026-08-20
+- Command: `bin/fm-test-isolation-proof.sh --jobs 4 --json /tmp/fm-isolation-proof.json`
+- Result: `FM_ISOLATION_SUMMARY total=24 failed=0 concurrency=4 duration_ms=113278`
 
 | Field | Value |
 |---|---|
-| `run_id` | `fm-isolation-1785367157179-18165` |
-| `started_at` | `2026-07-29T23:19:17Z` |
-| `finished_at` | `2026-07-29T23:21:46Z` |
+| `run_id` | `fm-isolation-1787273044622-10250` |
+| `started_at` | `2026-08-21T00:44:04Z` |
+| `finished_at` | `2026-08-21T00:45:57Z` |
 | concurrency | 4 |
 | candidates | 24 |
 | failed | 0 |
-| wall duration | 149010 ms |
+| wall duration | 113278 ms |
 
 ## Candidate set
 
 - `tests/fm-arm-pretool-check.test.sh`
 - `tests/fm-backend-herdr.test.sh`
 - `tests/fm-brief.test.sh`
+- `tests/fm-captain-hold-lifecycle.test.sh`
 - `tests/fm-cd-pretool-check.test.sh`
 - `tests/fm-composer-ghost.test.sh`
 - `tests/fm-composer-lib.test.sh`
 - `tests/fm-crew-state.test.sh`
-- `tests/fm-decision-hold-lifecycle.test.sh`
 - `tests/fm-ensure-agents-md.test.sh`
 - `tests/fm-grok-harness.test.sh`
 - `tests/fm-herdr-lab.test.sh`
@@ -51,30 +51,30 @@ This record is the concurrent isolation proof for the portable parallel candidat
 
 | duration_ms | exit | worker | script |
 |---:|---:|---:|---|
-| 52939 | 0 | 24 | `tests/fm-x-mode.test.sh` |
-| 48294 | 0 | 2 | `tests/fm-backend-herdr.test.sh` |
-| 46788 | 0 | 1 | `tests/fm-arm-pretool-check.test.sh` |
-| 34207 | 0 | 4 | `tests/fm-cd-pretool-check.test.sh` |
-| 30771 | 0 | 8 | `tests/fm-decision-hold-lifecycle.test.sh` |
-| 25365 | 0 | 7 | `tests/fm-crew-state.test.sh` |
-| 15674 | 0 | 21 | `tests/fm-test-run.test.sh` |
-| 15422 | 0 | 11 | `tests/fm-herdr-lab.test.sh` |
-| 9065 | 0 | 5 | `tests/fm-composer-ghost.test.sh` |
-| 8564 | 0 | 14 | `tests/fm-pr-merge.test.sh` |
-| 6251 | 0 | 10 | `tests/fm-grok-harness.test.sh` |
-| 5644 | 0 | 16 | `tests/fm-send-popup-settle.test.sh` |
-| 5237 | 0 | 12 | `tests/fm-lint.test.sh` |
-| 4816 | 0 | 22 | `tests/fm-tmux-submit-busy.test.sh` |
-| 2945 | 0 | 13 | `tests/fm-pi-primary-types.test.sh` |
-| 2911 | 0 | 17 | `tests/fm-send-settle.test.sh` |
-| 2875 | 0 | 15 | `tests/fm-review-diff.test.sh` |
-| 2747 | 0 | 18 | `tests/fm-send-strict.test.sh` |
-| 2224 | 0 | 3 | `tests/fm-brief.test.sh` |
-| 855 | 0 | 19 | `tests/fm-spawn-batch.test.sh` |
-| 703 | 0 | 20 | `tests/fm-supervision-instructions.test.sh` |
-| 581 | 0 | 9 | `tests/fm-ensure-agents-md.test.sh` |
-| 248 | 0 | 23 | `tests/fm-transition-lib.test.sh` |
-| 64 | 0 | 6 | `tests/fm-composer-lib.test.sh` |
+| 45356 | 0 | 2 | `tests/fm-backend-herdr.test.sh` |
+| 35415 | 0 | 24 | `tests/fm-x-mode.test.sh` |
+| 35095 | 0 | 4 | `tests/fm-captain-hold-lifecycle.test.sh` |
+| 27529 | 0 | 1 | `tests/fm-arm-pretool-check.test.sh` |
+| 20922 | 0 | 21 | `tests/fm-test-run.test.sh` |
+| 17558 | 0 | 8 | `tests/fm-crew-state.test.sh` |
+| 16582 | 0 | 5 | `tests/fm-cd-pretool-check.test.sh` |
+| 9766 | 0 | 12 | `tests/fm-lint.test.sh` |
+| 9562 | 0 | 11 | `tests/fm-herdr-lab.test.sh` |
+| 6768 | 0 | 10 | `tests/fm-grok-harness.test.sh` |
+| 6290 | 0 | 14 | `tests/fm-pr-merge.test.sh` |
+| 5569 | 0 | 6 | `tests/fm-composer-ghost.test.sh` |
+| 4563 | 0 | 16 | `tests/fm-send-popup-settle.test.sh` |
+| 4021 | 0 | 22 | `tests/fm-tmux-submit-busy.test.sh` |
+| 3544 | 0 | 7 | `tests/fm-composer-lib.test.sh` |
+| 3025 | 0 | 18 | `tests/fm-send-strict.test.sh` |
+| 2753 | 0 | 17 | `tests/fm-send-settle.test.sh` |
+| 2166 | 0 | 15 | `tests/fm-review-diff.test.sh` |
+| 1315 | 0 | 3 | `tests/fm-brief.test.sh` |
+| 975 | 0 | 19 | `tests/fm-spawn-batch.test.sh` |
+| 598 | 0 | 13 | `tests/fm-pi-primary-types.test.sh` |
+| 513 | 0 | 9 | `tests/fm-ensure-agents-md.test.sh` |
+| 331 | 0 | 20 | `tests/fm-supervision-instructions.test.sh` |
+| 99 | 0 | 23 | `tests/fm-transition-lib.test.sh` |
 
 ## Scope
 
diff --git a/docs/fm-test-portable-shards.md b/docs/fm-test-portable-shards.md
index 5cf681a501..3d295a072a 100644
--- a/docs/fm-test-portable-shards.md
+++ b/docs/fm-test-portable-shards.md
@@ -5,35 +5,35 @@
 
 ## Verification inputs
 
-The current candidate timings came from the 2026-07-29 concurrent proof recorded in [fm-test-isolation-proof.md](fm-test-isolation-proof.md).
+The current candidate timings came from the 2026-08-20 concurrent proof recorded in [fm-test-isolation-proof.md](fm-test-isolation-proof.md).
 The proof ran 24 candidates with four workers and no failures.
 
 | duration_ms | script |
 |---:|---|
-| 52939 | `tests/fm-x-mode.test.sh` |
-| 48294 | `tests/fm-backend-herdr.test.sh` |
-| 46788 | `tests/fm-arm-pretool-check.test.sh` |
-| 34207 | `tests/fm-cd-pretool-check.test.sh` |
-| 30771 | `tests/fm-decision-hold-lifecycle.test.sh` |
-| 25365 | `tests/fm-crew-state.test.sh` |
-| 15674 | `tests/fm-test-run.test.sh` |
-| 15422 | `tests/fm-herdr-lab.test.sh` |
-| 9065 | `tests/fm-composer-ghost.test.sh` |
-| 8564 | `tests/fm-pr-merge.test.sh` |
-| 6251 | `tests/fm-grok-harness.test.sh` |
-| 5644 | `tests/fm-send-popup-settle.test.sh` |
-| 5237 | `tests/fm-lint.test.sh` |
-| 4816 | `tests/fm-tmux-submit-busy.test.sh` |
-| 2945 | `tests/fm-pi-primary-types.test.sh` |
-| 2911 | `tests/fm-send-settle.test.sh` |
-| 2875 | `tests/fm-review-diff.test.sh` |
-| 2747 | `tests/fm-send-strict.test.sh` |
-| 2224 | `tests/fm-brief.test.sh` |
-| 855 | `tests/fm-spawn-batch.test.sh` |
-| 703 | `tests/fm-supervision-instructions.test.sh` |
-| 581 | `tests/fm-ensure-agents-md.test.sh` |
-| 248 | `tests/fm-transition-lib.test.sh` |
-| 64 | `tests/fm-composer-lib.test.sh` |
+| 45356 | `tests/fm-backend-herdr.test.sh` |
+| 35415 | `tests/fm-x-mode.test.sh` |
+| 35095 | `tests/fm-captain-hold-lifecycle.test.sh` |
+| 27529 | `tests/fm-arm-pretool-check.test.sh` |
+| 20922 | `tests/fm-test-run.test.sh` |
+| 17558 | `tests/fm-crew-state.test.sh` |
+| 16582 | `tests/fm-cd-pretool-check.test.sh` |
+| 9766 | `tests/fm-lint.test.sh` |
+| 9562 | `tests/fm-herdr-lab.test.sh` |
+| 6768 | `tests/fm-grok-harness.test.sh` |
+| 6290 | `tests/fm-pr-merge.test.sh` |
+| 5569 | `tests/fm-composer-ghost.test.sh` |
+| 4563 | `tests/fm-send-popup-settle.test.sh` |
+| 4021 | `tests/fm-tmux-submit-busy.test.sh` |
+| 3544 | `tests/fm-composer-lib.test.sh` |
+| 3025 | `tests/fm-send-strict.test.sh` |
+| 2753 | `tests/fm-send-settle.test.sh` |
+| 2166 | `tests/fm-review-diff.test.sh` |
+| 1315 | `tests/fm-brief.test.sh` |
+| 975 | `tests/fm-spawn-batch.test.sh` |
+| 598 | `tests/fm-pi-primary-types.test.sh` |
+| 513 | `tests/fm-ensure-agents-md.test.sh` |
+| 331 | `tests/fm-supervision-instructions.test.sh` |
+| 99 | `tests/fm-transition-lib.test.sh` |
 
 ## Parallel lanes
 
@@ -41,9 +41,9 @@ The two parallel lanes use longest-processing-time assignment from those measure
 
 | Lane | Script count | Estimated duration |
 |---|---:|---:|
-| `portable-parallel-1` | 11 | 162436 ms (~162.4 s) |
-| `portable-parallel-2` | 13 | 162754 ms (~162.8 s) |
-| imbalance | | 318 ms |
+| `portable-parallel-1` | 11 | 134295 ms (~134.3 s) |
+| `portable-parallel-2` | 13 | 126020 ms (~126.0 s) |
+| imbalance | | 8275 ms |
 
 `bin/fm-test-run.sh` contains the exact ordered memberships in `list_portable_parallel_1` and `list_portable_parallel_2`.
 
diff --git a/docs/scripts.md b/docs/scripts.md
index 72a509c600..2e7078535e 100644
--- a/docs/scripts.md
+++ b/docs/scripts.md
@@ -26,7 +26,8 @@ The shared no-mistakes gate refusal for fleet lifecycle entrypoints is summarize
 | `fm-remote-doctor.sh`    | Check, and with `--fix` repair, one remote account's second-mate readiness (remote job worker, Herdr, Aqua launch agents, PATH, and required tools) |
 | `fm-backlog-handoff.sh`  | Validate and delegate queued backlog-item moves into a secondmate home               |
 | `fm-backlog-receive.sh`  | Idempotently ingest one confined remote handoff outbox through tasks-axi             |
-| `fm-decision-hold.sh`    | Create, verify, complete, close, and repair durable captain-held decisions       |
+| `fm-captain-hold.sh`     | Hold tasks for the captain, record his answers, and gate investigation completion |
+| `fm-decision-hold.sh`    | One-release compatibility shim mapping the retired decision commands onto fm-captain-hold.sh |
 | `fm-brief.sh`            | Scaffold ship (explicit `--mode`), scout, secondmate-charter, and Herdr-lab briefs   |
 | `fm-herdr-lab.sh`        | Provision and guardedly operate an isolated, never-default Herdr lab session         |
 | `fm-install-herdr.sh`    | Install CI's exact-version Herdr pin with official asset URL, SHA-256, and protocol checks |
diff --git a/docs/verification/process-event-sources.md b/docs/verification/process-event-sources.md
index 6570c79ac1..8102d057ac 100644
--- a/docs/verification/process-event-sources.md
+++ b/docs/verification/process-event-sources.md
@@ -83,7 +83,7 @@ Exercised by `tests/fm-procevent.test.sh` against a fake blocking source whose c
 | proactive-delivery crash and drain boundaries | dotted and underscored source ids at the same sequence receive distinct markers; a concurrent drain cannot consume between queue revalidation and marker commit; failed output, failed marker commit, and a crash before marker commit leave replay available, while successful output still ends the actionable cycle and a crash after marker commit suppresses a duplicate |
 | adapter-owned terminal verdict | two fixture adapters - one that ends on any result, one with no terminal knowledge - decide the outcome alone: the first has its registration and claim retired automatically after one capture and is never restarted, the second stays armed |
 | adapter-owned application of a captured result | a remote-secondmate reply captured through the real relay in an isolated home reaches that secondmate's local status mirror, settles its correlated pending-reply expectation, re-arms the next cursor-anchored source, and is acknowledged, with no handler step or duplicate `check` wake; its new mirrored bytes remain visible to the watcher's signal gate, while a cursor-loss whole-log recapture that adds no bytes is acknowledged quietly; for an already-escalated request, the same path closes the exact decision so the open-decision fold clears and remains clear; a capture whose adapter application fails because local storage for a referenced remote document is obstructed is left unacknowledged and receives the fallback `check` wake, and the handler's own `handle` still applies it in full after storage recovers |
-| generic keyed-answer feed | `tests/fm-decision-hold-lifecycle.test.sh` drives a single-origin bound source through the real runner with a fixture adapter, then drives a cross-origin source through the real runner and Lavish adapter interface, proving both reach the one keyed-answer intake: named holds close at capture time, routed-work and absent holds skip, malformed or over-limit keys feed nothing, replays are idempotent, an unbound source closes nothing, and capture remains independent of the handler wake. |
+| generic keyed-answer feed | `tests/fm-captain-hold-lifecycle.test.sh` drives a bound source through the real runner with a fixture adapter that only prints keyed lines, proving any bound channel reaches the one keyed-answer intake: named captain-held tasks close at capture time, a card-declared release mode frees held work, keys naming no captain-held task skip, freeform prose forges nothing, matching answer-and-mode replays are idempotent while mode mismatches refuse, an unbound source closes nothing, and capture remains independent of the handler wake. |
 | terminal retirement preserves the result | the retired source's captured output, its announced event, its handled acknowledgement, and later explicit `retire` all still behave normally |
 | registration-generation retirement | an old terminal runner preserves a concurrently replaced registration and releases ownership so the replacement runs independently; injected registration-removal failure retains a terminal claim, performs no second poll, and completes idempotently once removal recovers |
 | one `Send & End`, one result | an armed Lavish source driven against a stand-in for the published poll, which delivers the final `session_ended` feedback once and empty ended sessions afterward, polls exactly once, captures exactly one result, publishes one distinct event, and retires itself |
diff --git a/tests/fm-backend-herdr-presentation-e2e.test.sh b/tests/fm-backend-herdr-presentation-e2e.test.sh
index 39b0e13b51..ac62abb427 100755
--- a/tests/fm-backend-herdr-presentation-e2e.test.sh
+++ b/tests/fm-backend-herdr-presentation-e2e.test.sh
@@ -421,6 +421,15 @@ teardown_task() {  # <id> <home>
     "$ROOT/bin/fm-teardown.sh" "$id" --force
 }
 
+finish_concurrent_teardown() {  # <id> <status> <stdout> <stderr>
+  local id=$1 status=$2 out=$3 err=$4
+  [ "$status" -ne 0 ] || return 0
+  grep -F "session presentation lock is contended" "$err" >/dev/null 2>&1 \
+    || fail "projected teardown $id failed unexpectedly: $(cat "$err")"
+  teardown_task "$id" "$HOME_DIR" > "$out" 2> "$err" \
+    || fail "projected teardown $id retry failed after presentation cleanup completed: $(cat "$err")"
+}
+
 normalize_meta() {  # <meta>
   sed -E \
     -e 's|^window=.*$|window=<herdr-container-id>|' \
@@ -886,8 +895,10 @@ teardown_task order-a "$HOME_DIR" > "$TMP_ROOT/order-a-teardown.out" 2> "$TMP_RO
 ORDER_A_TEARDOWN_PID=$!
 teardown_task order-b "$HOME_DIR" > "$TMP_ROOT/order-b-teardown.out" 2> "$TMP_ROOT/order-b-teardown.err" &
 ORDER_B_TEARDOWN_PID=$!
-wait "$ORDER_A_TEARDOWN_PID" || fail "projected ordering fixture A teardown failed"
-wait "$ORDER_B_TEARDOWN_PID" || fail "projected ordering fixture B teardown failed"
+if wait "$ORDER_A_TEARDOWN_PID"; then ORDER_A_TEARDOWN_STATUS=0; else ORDER_A_TEARDOWN_STATUS=$?; fi
+if wait "$ORDER_B_TEARDOWN_PID"; then ORDER_B_TEARDOWN_STATUS=0; else ORDER_B_TEARDOWN_STATUS=$?; fi
+finish_concurrent_teardown order-a "$ORDER_A_TEARDOWN_STATUS" "$TMP_ROOT/order-a-teardown.out" "$TMP_ROOT/order-a-teardown.err"
+finish_concurrent_teardown order-b "$ORDER_B_TEARDOWN_STATUS" "$TMP_ROOT/order-b-teardown.out" "$TMP_ROOT/order-b-teardown.err"
 assert_focus_is "$CAPTAIN_FOCUS" "concurrent projected teardowns"
 teardown_task order-fail "$HOME_DIR" > "$TMP_ROOT/order-fail-teardown.out" 2> "$TMP_ROOT/order-fail-teardown.err" \
   || fail "projected ordering failure fixture teardown failed"
@@ -928,8 +939,10 @@ for ROUND in 1 2 3; do
   WAVE_A_TEARDOWN_PID=$!
   teardown_task "focus-$ROUND-b" "$HOME_DIR" > "$TMP_ROOT/focus-$ROUND-b-teardown.out" 2> "$TMP_ROOT/focus-$ROUND-b-teardown.err" &
   WAVE_B_TEARDOWN_PID=$!
-  wait "$WAVE_A_TEARDOWN_PID" || fail "focus wave $ROUND teardown A failed"
-  wait "$WAVE_B_TEARDOWN_PID" || fail "focus wave $ROUND teardown B failed"
+  if wait "$WAVE_A_TEARDOWN_PID"; then WAVE_A_TEARDOWN_STATUS=0; else WAVE_A_TEARDOWN_STATUS=$?; fi
+  if wait "$WAVE_B_TEARDOWN_PID"; then WAVE_B_TEARDOWN_STATUS=0; else WAVE_B_TEARDOWN_STATUS=$?; fi
+  finish_concurrent_teardown "focus-$ROUND-a" "$WAVE_A_TEARDOWN_STATUS" "$TMP_ROOT/focus-$ROUND-a-teardown.out" "$TMP_ROOT/focus-$ROUND-a-teardown.err"
+  finish_concurrent_teardown "focus-$ROUND-b" "$WAVE_B_TEARDOWN_STATUS" "$TMP_ROOT/focus-$ROUND-b-teardown.out" "$TMP_ROOT/focus-$ROUND-b-teardown.err"
   assert_focus_is "$CAPTAIN_FOCUS" "focus wave $ROUND concurrent teardowns"
   WAVE_REMAINING=$(lab workspace list | jq -r '.result.workspaces[].label')
   [ "$WAVE_REMAINING" = $'firstmate\n2ndmate-alpha\n2ndmate-bravo' ] \
diff --git a/tests/fm-bearings-board.test.sh b/tests/fm-bearings-board.test.sh
index 5025dacca5..a0807d87a7 100644
--- a/tests/fm-bearings-board.test.sh
+++ b/tests/fm-bearings-board.test.sh
@@ -170,30 +170,6 @@ test_build_refuses_malformed_payloads_before_touching_the_board() {
   set +e; out=$(run_board "$home" build "$data" 2>&1); rc=$?; set -e
   [ "$rc" -ne 0 ] || fail "an unanswerable captains_call item was accepted"
 
-  write_valid_payload "$data"
-  jq '.captains_call[0].options = [] | .captains_call[0].allow_freeform = true' "$data" > "$data.tmp" \
-    && mv "$data.tmp" "$data"
-  set +e; out=$(run_board "$home" build "$data" 2>&1); rc=$?; set -e
-  [ "$rc" -ne 0 ] || fail "a freeform-only captains_call item without options was accepted"
-
-  write_valid_payload "$data"
-  jq '.captains_call[1].options = [] | .captains_call[1].allow_freeform = false' "$data" > "$data.tmp" \
-    && mv "$data.tmp" "$data"
-  set +e; out=$(run_board "$home" build "$data" 2>&1); rc=$?; set -e
-  [ "$rc" -ne 0 ] || fail "an optionless merge card with freeform disabled was accepted"
-
-  write_valid_payload "$data"
-  jq '.captains_call[0].type = "credential"
-    | .captains_call[0].options = []
-    | del(.captains_call[0].allow_freeform)' "$data" > "$data.tmp" && mv "$data.tmp" "$data"
-  set +e; out=$(run_board "$home" build "$data" 2>&1); rc=$?; set -e
-  [ "$rc" -ne 0 ] || fail "an optionless credential card without freeform permission was accepted"
-
-  write_valid_payload "$data"
-  jq '.captains_call[0].options[0].value = "__drop__"' "$data" > "$data.tmp" && mv "$data.tmp" "$data"
-  set +e; out=$(run_board "$home" build "$data" 2>&1); rc=$?; set -e
-  [ "$rc" -ne 0 ] || fail "a captains_call option reserved for close/drop was accepted"
-
   write_valid_payload "$data"
   jq '.captains_call[1].pr_url = "javascript:alert(1)"' "$data" > "$data.tmp" && mv "$data.tmp" "$data"
   set +e; out=$(run_board "$home" build "$data" 2>&1); rc=$?; set -e
@@ -214,22 +190,6 @@ test_build_refuses_malformed_payloads_before_touching_the_board() {
   pass "build refuses malformed payloads before touching the board"
 }
 
-test_build_accepts_a_freeform_only_credential_card() {
-  local home data board
-  home=$(make_home credential)
-  data="$home/payload.json"
-  board="$home/.lavish/bearings-board.html"
-  write_valid_payload "$data"
-  jq '.captains_call[0].type = "credential"
-    | .captains_call[0].options = []
-    | .captains_call[0].allow_freeform = true' "$data" > "$data.tmp" && mv "$data.tmp" "$data"
-
-  run_board "$home" build "$data" >/dev/null \
-    || fail "a freeform-only credential card was refused"
-  [ -f "$board" ] || fail "a valid freeform-only credential card did not build a board"
-  pass "build keeps freeform-only credential cards valid"
-}
-
 test_build_injects_binds_then_arms() {
   local home data board out sid
   home=$(make_home build)
@@ -240,7 +200,7 @@ test_build_injects_binds_then_arms() {
   out=$(run_board "$home" build "$data") || fail "a valid payload did not build"
   assert_contains "$out" "board: $board" "build did not report the board path: $out"
   assert_contains "$out" "served: $board" "build did not establish the Lavish session: $out"
-  assert_contains "$out" "(any-origin)" "build did not report the any-origin binding: $out"
+  assert_contains "$out" "bound: " "build did not report the answer binding: $out"
   assert_contains "$out" "armed: " "the first build did not arm the board source: $out"
   assert_present "$board" "build reported success without a board"
 
@@ -410,128 +370,10 @@ test_build_refuses_a_template_without_exactly_one_slot() {
   pass "build refuses a template without exactly one data slot"
 }
 
-# The board Close / drop control emits the reserved answer `__drop__`. The
-# keyed-answer intake must decline that hold with a dropped-by-captain record
-# so it leaves Captain's Call, without treating the encoding as a choice.
-test_drop_answer_declines_the_hold_without_a_substantive_choice() {
-  local home origin key hold routed_hold result out show json rc
-  home=$(make_home drop-close)
-  origin=sample-board-drop
-  key=stale-choice
-  hold="$origin-decision-$key"
-  result="$home/drop.result"
-
-  command -v tasks-axi >/dev/null 2>&1 || { echo "skip: tasks-axi not found"; return 0; }
-  cp "$ROOT/.tasks.toml" "$home/.tasks.toml"
-  cat > "$home/data/backlog.md" <<'EOF'
-## In flight
-
-## Queued
-
-## Done
-EOF
-  fm_write_meta "$home/state/$origin.meta" "project=$home/projects/sample" "kind=scout"
-  (cd "$home" && tasks-axi add "$origin" "Review sample board drop" --kind scout --repo sample --start) >/dev/null \
-    || fail "could not create the drop-close origin"
-  run_decisions "$home" hold "$origin" "$key" \
-    --title "Drop this stale choice" --reason "captain stale choice pending" --repo sample >/dev/null \
-    || fail "could not create the drop-close captain hold"
-  run_decisions "$home" complete "$origin" "$key" >/dev/null \
-    || fail "completion failed for the drop-close hold"
-
-  json=$(PATH="$home/fakebin:$PATH" FM_HOME="$home" FM_BEARINGS_NOW=2026-08-20T12:00:00Z \
-    "$ROOT/bin/fm-bearings-snapshot.sh" --json) \
-    || fail "Bearings failed before a reserved close/drop"
-  printf '%s' "$json" | jq -e --arg hold "$hold" '
-    .decisions_open | any(.id == $hold)
-  ' >/dev/null || fail "the drop-close hold was not an open Captain's Call before drop: $json"
-
-  cat > "$result" <<EOF
-session:
-  file: /bearings-board.html
-  status: feedback
-prompts[1]{uid,prompt,selector,tag,text}:
-  "2","Stale choice: __drop__\\n\\nContext data:\\n{\\n  \\"question\\": \\"$hold\\",\\n  \\"answer\\": \\"__drop__\\"\\n}","form",choice,"Stale choice -> __drop__"
-EOF
-
-  out=$(PATH="$home/fakebin:$PATH" FM_HOME="$home" \
-    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
-    "$ROOT/bin/fm-procevent-lavish.sh" answers "$result") \
-    || fail "the adapter did not report the reserved close/drop answer"
-  assert_contains "$out" "$hold	__drop__" \
-    "the adapter dropped the reserved close/drop encoding: $out"
-
-  set +e
-  out=$(printf '%s\n' "$out" | run_decisions "$home" answers --any-origin \
-    --source "the captured result board-drop sequence 1" 2>&1)
-  rc=$?
-  set -e
-  [ "$rc" -eq 0 ] || fail "a reserved close/drop answer did not close its hold: $out"
-  assert_contains "$out" "closed: $hold" "the intake did not close the dropped hold: $out"
-
-  show=$(cd "$home" && tasks-axi show "$hold" --full) \
-    || fail "the dropped captain hold disappeared"
-  assert_contains "$show" "state: done" "a reserved close/drop answer left the hold open"
-  assert_contains "$show" "Resolution mode: declined" \
-    "a reserved close/drop answer was recorded as a substantive answer"
-  assert_contains "$show" "dropped by captain" \
-    "a reserved close/drop answer lost the dropped-by-captain decision record"
-  assert_not_contains "$show" "Answer: __drop__" \
-    "a reserved close/drop answer was recorded as if __drop__ were a choice"
-
-  json=$(PATH="$home/fakebin:$PATH" FM_HOME="$home" FM_BEARINGS_NOW=2026-08-20T12:00:00Z \
-    "$ROOT/bin/fm-bearings-snapshot.sh" --json) \
-    || fail "Bearings failed after a reserved close/drop"
-  printf '%s' "$json" | jq -e --arg hold "$hold" '
-    (.decisions_open | any(.id == $hold) | not)
-  ' >/dev/null || fail "a dropped decision remained an open Captain's Call: $json"
-
-  set +e
-  out=$(printf '%s\t%s\t%s\n' "$hold" "__drop__" "Stale choice -> __drop__" \
-    | run_decisions "$home" answers --any-origin \
-      --source "the captured result board-drop sequence 1" 2>&1)
-  rc=$?
-  set -e
-  [ "$rc" -eq 0 ] || fail "replaying an identical close/drop was not idempotent: $out"
-
-  routed_hold=$(run_decisions "$home" hold "$origin" still-routed \
-    --title "Still routed" --reason "captain routed choice pending" --repo sample) \
-    || fail "could not create the routed drop-close hold"
-  (cd "$home" && tasks-axi add sample-routed-drop "Apply the routed drop" \
-    --kind ship --repo sample --blocked-by "$routed_hold") >/dev/null \
-    || fail "could not route work behind the drop-close hold"
-  set +e
-  out=$(printf '%s\t%s\t%s\n' "$routed_hold" "__drop__" "Close / drop" \
-    | run_decisions "$home" answers --any-origin \
-      --source "the captured result board-drop sequence 2" 2>&1)
-  rc=$?
-  set -e
-  [ "$rc" -eq 0 ] || fail "a close/drop did not close a hold with existing routed work: $out"
-  assert_contains "$out" "closed: $routed_hold" \
-    "a close/drop on routed work was not reported as closed: $out"
-  show=$(cd "$home" && tasks-axi show "$routed_hold" --full)
-  assert_contains "$show" "state: done" \
-    "a close/drop left the routed hold open"
-  show=$(cd "$home" && tasks-axi show sample-routed-drop --full)
-  assert_contains "$show" "state: queued" \
-    "a close/drop cascaded into the existing dependent work"
-  assert_contains "$show" "blocked: no" \
-    "existing dependent work did not become independent after the hold closed"
-  json=$(PATH="$home/fakebin:$PATH" FM_HOME="$home" FM_BEARINGS_NOW=2026-08-20T12:00:00Z \
-    "$ROOT/bin/fm-bearings-snapshot.sh" --json) \
-    || fail "Bearings failed after dropping a hold with routed work"
-  printf '%s' "$json" | jq -e --arg hold "$routed_hold" '
-    (.decisions_open | any(.id == $hold) | not)
-  ' >/dev/null || fail "a dropped routed decision remained in Captain's Call: $json"
-  pass "a reserved close/drop answer declines the hold and leaves Captain's Call"
-}
-
 test_path_is_stable_and_home_scoped
 test_build_refuses_malformed_payloads_before_touching_the_board
-test_build_accepts_a_freeform_only_credential_card
 test_build_injects_binds_then_arms
 test_registration_cannot_consume_before_any_origin_binding
 test_build_does_not_bind_or_arm_when_session_start_fails
 test_rebuild_is_idempotent_and_does_not_double_arm
 test_build_refuses_a_template_without_exactly_one_slot
-test_drop_answer_declines_the_hold_without_a_substantive_choice
diff --git a/tests/fm-bearings-snapshot.test.sh b/tests/fm-bearings-snapshot.test.sh
index e955608fdb..3ff7722216 100755
--- a/tests/fm-bearings-snapshot.test.sh
+++ b/tests/fm-bearings-snapshot.test.sh
@@ -970,6 +970,52 @@ test_superseded_queued_item_dropped_by_default() {
   pass "superseded queued items are dropped by default and restored with --all-queued"
 }
 
+# The collapsed captain-call contract: any due, unblocked captain-held task is
+# Captain's Call whatever its kind; a date-deferred hold is a dated gate until
+# due; a prose-deferred hold leaves the default views with a disclosure; and
+# Recently Landed excludes only what closed while still held for the captain.
+test_collapsed_captain_call_deferral_and_landed() {
+  local home fakebin json
+  home=$(make_home collapsed-call)
+  mkdir -p "$home/data"
+  cat > "$home/data/backlog.md" <<'EOF'
+## In flight
+
+## Queued
+- [ ] work-gate - Captain-gated ship work (repo: firstmate) (kind: ship) (hold: captain go needed) (hold-kind: captain)
+- [ ] later-call - Deferred captain call (repo: firstmate) (kind: captain) (hold: revisit with the captain) (hold-kind: captain) (hold-until: 2026-08-01)
+- [ ] due-call - Due captain call (repo: firstmate) (kind: captain) (hold: overdue captain choice) (hold-kind: captain) (hold-until: 2026-07-11)
+- [ ] parked-call - Prose-parked captain call (repo: firstmate) (kind: ship) (hold: DEFERRED by captain revisit later) (hold-kind: captain)
+- [ ] external-gate - Externally held work (repo: firstmate) (kind: ship) (hold: upstream release pending) (hold-kind: external)
+
+## Done
+- [x] answered-call - Answered captain question (repo: firstmate) (kind: captain) (done 2026-07-10) (hold: captain choice pending) (hold-kind: captain)
+- [x] shipped-work - Ordinary landed work (repo: firstmate) (kind: ship) (merged 2026-07-10)
+EOF
+  fakebin=$(make_fakebin "$home")
+  json=$(run "$home" "$fakebin" --json)
+  printf '%s' "$json" | jq -e '
+    (.decisions_open | any(.[]; .id == "work-gate"))
+      and (.decisions_open | any(.[]; .id == "due-call"))
+      and (.decisions_open | any(.[]; .id == "later-call") | not)
+      and (.decisions_open | any(.[]; .id == "parked-call") | not)
+      and (.decisions_open | any(.[]; .id == "external-gate") | not)
+      and (.gates | any(.[]; .id == "later-call" and (.reason | startswith("until 2026-08-01"))))
+      and (.gates | any(.[]; .id == "work-gate") | not)
+      and (.gates | any(.[]; .id == "parked-call") | not)
+      and (.gates | any(.[]; .id == "external-gate"))
+      and (.landed | any(.[]; .id == "shipped-work"))
+      and (.landed | any(.[]; .id == "answered-call") | not)
+      and (.omitted | any(.[]; .surface | startswith("captain holds marked deferred")))
+  ' >/dev/null || fail "the collapsed captain-call projection is wrong: $json"
+  json=$(run "$home" "$fakebin" --json --all-decisions --all-queued)
+  printf '%s' "$json" | jq -e '
+    (.decisions_open | any(.[]; .id == "parked-call"))
+      and (.gates | any(.[]; .id == "parked-call") | not)
+  ' >/dev/null || fail "--all-decisions must reveal the prose-deferred call: $json"
+  pass "captain-held tasks of any kind reach Captain's Call, deferral is honored, and landed excludes answered calls"
+}
+
 test_include_prs_is_the_only_fetch_path() {
   local home fakebin json
   home=$(make_home prs); write_fixture "$home"
@@ -1932,6 +1978,7 @@ test_include_prs_is_the_only_fetch_path
 test_partial_github_failure_degrades
 test_perl_fallback_bounds_github_call
 test_section_caps_and_expansion_flags
+test_collapsed_captain_call_deferral_and_landed
 test_pr_repository_cap_and_expansion
 test_per_repository_pr_cap_is_disclosed
 test_projection_and_toon_fail_closed
diff --git a/tests/fm-brief.test.sh b/tests/fm-brief.test.sh
index c5ee3d00f0..704edd8609 100755
--- a/tests/fm-brief.test.sh
+++ b/tests/fm-brief.test.sh
@@ -678,15 +678,15 @@ test_scout_and_secondmate_load_decision_hold_policy() {
   FM_HOME="$home" FM_ROOT_OVERRIDE="$ROOT" \
     "$ROOT/bin/fm-brief.sh" sample-investigation sample --scout >/dev/null 2>&1
   scout="$home/data/sample-investigation/brief.md"
-  assert_grep "$ROOT/.agents/skills/decision-hold-lifecycle/SKILL.md" "$scout" \
-    "scout brief did not load the unresolved-decision policy before done"
+  assert_grep "$ROOT/.agents/skills/captain-hold-lifecycle/SKILL.md" "$scout" \
+    "scout brief did not load the captain-call policy before done"
   assert_grep "pass its shared completion gate for the report and any visual review" "$scout" \
     "scout brief did not cross-reference visual-review completion"
   FM_HOME="$home" FM_ROOT_OVERRIDE="$ROOT" FM_SECONDMATE_CHARTER='sample reviews' \
     "$ROOT/bin/fm-brief.sh" sample-mate --secondmate --no-projects >/dev/null 2>&1
   charter="$home/data/sample-mate/brief.md"
-  assert_grep "load \`decision-hold-lifecycle\`" "$charter" \
-    "secondmate charter did not load the shared decision policy for detailed investigations"
+  assert_grep "load \`captain-hold-lifecycle\`" "$charter" \
+    "secondmate charter did not load the shared captain-call policy for detailed investigations"
   pass "fm-brief.sh: investigation and visual-review completions load the shared decision policy"
 }
 
diff --git a/tests/fm-captain-hold-lifecycle.test.sh b/tests/fm-captain-hold-lifecycle.test.sh
new file mode 100755
index 0000000000..7ff15188ce
--- /dev/null
+++ b/tests/fm-captain-hold-lifecycle.test.sh
@@ -0,0 +1,1045 @@
+#!/usr/bin/env bash
+# End-to-end tests for captain-held tasks: the one primitive behind "a decision
+# is simply a task waiting on the captain", its completion gate, its recorded
+# answers, and the legacy compatibility for pre-collapse decision identities.
+set -u
+
+# shellcheck source=tests/lib.sh
+# shellcheck disable=SC1091
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+TEARDOWN="$ROOT/bin/fm-teardown.sh"
+BEARINGS="$ROOT/bin/fm-bearings-snapshot.sh"
+TMP_ROOT=$(fm_test_tmproot fm-captain-hold)
+TASKS_AXI_BIN=$(command -v tasks-axi || true)
+
+command -v jq >/dev/null 2>&1 || { echo "skip: jq not found"; exit 0; }
+command -v tasks-axi >/dev/null 2>&1 || { echo "skip: tasks-axi not found"; exit 0; }
+
+make_home() {  # <name>
+  local home="$TMP_ROOT/$1" fakebin
+  mkdir -p "$home/data" "$home/state" "$home/config" "$home/projects"
+  cp "$ROOT/.tasks.toml" "$home/.tasks.toml"
+  cat > "$home/data/backlog.md" <<'EOF'
+## In flight
+
+## Queued
+
+## Done
+EOF
+  fakebin=$(fm_fakebin "$home")
+  fm_fake_exit0 "$fakebin" tmux treehouse no-mistakes gh gh-axi
+  printf '%s\n' "$home"
+}
+
+# The Lavish review adapter, run against this suite's isolated home. The
+# machine-wide process-event claim root is redirected into the fixture so arming
+# a review here can never contend with a real one on this machine.
+run_lavish() {  # <home> <command args...>
+  local home=$1
+  shift
+  PATH="$home/fakebin:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
+    FM_PROCEVENT_CLAIM_ROOT="$home/procevent-claims" \
+    "$ROOT/bin/fm-procevent-lavish.sh" "$@"
+}
+
+run_bearings() {  # <home>
+  local home=$1
+  PATH="$home/fakebin:$PATH" FM_HOME="$home" FM_BEARINGS_NOW=2026-07-14T12:00:00Z \
+    "$BEARINGS" --json
+}
+
+run_teardown() {  # <home> <id>
+  local home=$1 id=$2
+  PATH="$home/fakebin:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
+    FM_CONFIG_OVERRIDE="$home/config" "$TEARDOWN" "$id"
+}
+
+tasks_in() {  # <home> <tasks-axi args...>
+  local home=$1
+  shift
+  (cd "$home" && tasks-axi "$@")
+}
+
+run_captain() {  # <home> <command args...>
+  local home=$1
+  shift
+  PATH="$home/fakebin:$PATH" REAL_TASKS_AXI="$TASKS_AXI_BIN" \
+    FM_HOME="$home" FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
+    FM_CONFIG_OVERRIDE="$home/config" "$ROOT/bin/fm-captain-hold.sh" "$@"
+}
+
+# The retired command surface, kept for one release as a shim; in-flight
+# pre-collapse work still drives the lifecycle through these spellings.
+run_shim() {  # <home> <command args...>
+  local home=$1
+  shift
+  PATH="$home/fakebin:$PATH" REAL_TASKS_AXI="$TASKS_AXI_BIN" \
+    FM_HOME="$home" FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
+    FM_CONFIG_OVERRIDE="$home/config" "$ROOT/bin/fm-decision-hold.sh" "$@"
+}
+
+write_origin_meta() {  # <home> <id> [kind]
+  local home=$1 id=$2 kind=${3:-scout}
+  fm_write_meta "$home/state/$id.meta" \
+    "window=firstmate:fm-$id" \
+    "worktree=$home/projects/missing-$id" \
+    "project=$home/projects/sample" \
+    "harness=codex" \
+    "kind=$kind" \
+    "mode=$kind"
+}
+
+# Reproduces the loss exactly with privacy-safe synthetic names: the investigation
+# and visual review have ended, the only genuine unresolved captain call is report
+# prose, no held backlog item or open status exists, and the authoritative
+# Bearings view correctly omits it. Completion must now refuse before teardown can
+# erase the source.
+test_uninventoried_report_decision_refuses_completion() {
+  local home id json rc
+  home=$(make_home omitted-decision)
+  id=sample-route-review
+  mkdir -p "$home/data/$id"
+  cat > "$home/data/backlog.md" <<EOF
+## In flight
+- [ ] $id - Investigate sample routing (repo: sample) (kind: scout) (since 2026-07-14)
+
+## Queued
+
+## Done
+EOF
+  write_origin_meta "$home" "$id"
+  printf 'done: report and visual review complete\n' > "$home/state/$id.status"
+  cat > "$home/data/$id/report.md" <<'EOF'
+# Sample route review
+
+The evidence is complete.
+The captain still needs to choose route north or route south before follow-up work starts.
+EOF
+
+  json=$(run_bearings "$home") || fail "Bearings failed for unresolved-call regression"
+  printf '%s' "$json" | jq -e '
+    (.decisions_open | length) == 0
+      and (.gates | length) == 0
+      and (.reports | any(.id == "sample-route-review"))
+  ' >/dev/null || fail "the pre-policy omission shape was not reproduced: $json"
+
+  set +e
+  run_teardown "$home" "$id" > "$home/teardown.out" 2> "$home/teardown.err"
+  rc=$?
+  set -e
+  [ "$rc" -ne 0 ] || fail "completed investigation teardown erased a report-only unresolved captain call"
+  assert_present "$home/state/$id.meta" "refused completion must preserve investigation metadata"
+  assert_grep "REFUSED" "$home/teardown.err" "refusal must be explicit"
+  pass "report-only unresolved captain call is reproduced and completion refuses before loss"
+}
+
+# The completion gate on the collapsed primitive: an origin with open keyed
+# status decisions refuses --none, refuses an inventory naming absent tasks,
+# attests a verified inventory of captain-held task ids, and transfers every
+# still-open status decision to that durable inventory.
+test_completion_gate_attests_and_transfers() {
+  local home id json open before after
+  home=$(make_home completion-gate)
+  id=sample-systems-review
+  mkdir -p "$home/data/$id"
+  tasks_in "$home" add "$id" "Investigate sample systems" --kind scout --repo sample --start >/dev/null \
+    || fail "could not create investigation backlog fixture"
+  write_origin_meta "$home" "$id"
+  cat > "$home/state/$id.status" <<'EOF'
+working: report drafted
+needs-decision [key=route]: choose route north or route south
+needs-decision [key=access]: choose open or restricted sample access
+EOF
+  cat > "$home/data/$id/report.md" <<'EOF'
+# Sample systems review
+
+Two choices remain unresolved: the route and the sample access level.
+A separate recommendation is already resolved and requires no captain action.
+EOF
+
+  if run_captain "$home" complete "$id" --none > "$home/none.out" 2> "$home/none.err"; then
+    fail "--none attested while captain calls were still open in the status stream"
+  fi
+  assert_no_grep "decisions_reviewed=1" "$home/state/$id.meta" \
+    "failed completion recorded a false completion attestation"
+  if run_captain "$home" complete "$id" sample-route-call > "$home/absent.out" 2> "$home/absent.err"; then
+    fail "completion accepted an inventory entry that names no task"
+  fi
+
+  run_captain "$home" hold sample-route-call \
+    --title "Choose route: north, south" --reason "captain route and access choices pending" \
+    --repo sample --origin "$id" >/dev/null \
+    || fail "could not register the captain-held task"
+  run_captain "$home" hold sample-route-call \
+    --title "Choose route: north, south" --reason "captain route and access choices pending" \
+    --repo sample >/dev/null \
+    || fail "idempotent hold retry failed"
+  [ "$(grep -cE "^- \[ \] sample-route-call -" "$home/data/backlog.md")" = 1 ] \
+    || fail "idempotent retry duplicated the captain-held task"
+  if run_captain "$home" hold sample-route-call --title "A different title" \
+    --reason "captain route and access choices pending" > "$home/title.out" 2> "$home/title.err"; then
+    fail "hold accepted a changed title on an existing task"
+  fi
+
+  FM_STATE_OVERRIDE="$home/state" bash -c '
+    . "$1"
+    sig=$(fm_wake_signal_sig "$3") || exit 1
+    printf "%s" "$sig" > "$(fm_wake_signal_seen_path "$2" "$3")"
+  ' _ "$ROOT/bin/fm-wake-lib.sh" "$home/state" "$home/state/$id.status" \
+    || fail "could not prime the announced decision baseline"
+  run_captain "$home" complete "$id" sample-route-call >/dev/null \
+    || fail "shared investigation completion gate failed"
+  FM_STATE_OVERRIDE="$home/state" bash -c '
+    . "$1"; fm_wake_signal_seen_current "$2" "$3"
+  ' _ "$ROOT/bin/fm-wake-lib.sh" "$home/state" "$home/state/$id.status" \
+    || fail "captain-held bookkeeping closes re-woke their own home"
+  assert_grep "decisions_reviewed=1" "$home/state/$id.meta" "completion attestation missing"
+  assert_grep "decision_keys=sample-route-call" "$home/state/$id.meta" "inventory was not recorded as task ids"
+  open=$(bash -c '. "$1"; status_open_decisions "$2"' _ \
+    "$ROOT/bin/fm-classify-lib.sh" "$home/state/$id.status")
+  [ -z "$open" ] || fail "captain-held transfer did not close the live status decisions: $open"
+  grep -F 'captain-held [key=route]: tracked by sample-route-call' "$home/state/$id.status" >/dev/null \
+    || fail "the transfer line does not name the tracking inventory"
+
+  before=$(shasum -a 256 "$home/data/backlog.md" | awk '{print $1}')
+  json=$(run_bearings "$home") || fail "Bearings failed with a captain-held task"
+  after=$(shasum -a 256 "$home/data/backlog.md" | awk '{print $1}')
+  [ "$before" = "$after" ] || fail "Bearings mutated the authoritative backlog"
+  printf '%s' "$json" | jq -e '
+    (.decisions_open | any(.id == "sample-route-call" and .verb == "captain-hold" and .owner == "(main)"))
+      and (.gates | any(.id == "sample-route-call") | not)
+  ' >/dev/null || fail "Bearings did not surface the captain-held task: $json"
+
+  run_teardown "$home" "$id" >/dev/null 2> "$home/teardown.err" \
+    || fail "reviewed investigation teardown failed: $(cat "$home/teardown.err")"
+  tasks_in "$home" "done" "$id" --report "data/$id/report.md" --keep 0 >/dev/null \
+    || fail "could not archive completed investigation"
+  json=$(run_bearings "$home") || fail "Bearings failed after source teardown and archival"
+  printf '%s' "$json" | jq -e '
+    (.decisions_open | any(.id == "sample-route-call" and .verb == "captain-hold"))
+      and (.in_flight | any(.id == "sample-systems-review") | not)
+  ' >/dev/null || fail "teardown or archival erased a captain-held task: $json"
+  pass "the completion gate attests captain-held inventory and transfers open status decisions"
+}
+
+# The recorded-answer rule: answering closes with the captain's exact words, an
+# exact retry is idempotent, a drifted retry is rejected, dependent work routed
+# behind the answered task is released by the close, and the completion gate is
+# satisfied only by a recorded answer.
+test_answer_records_and_closes() {
+  local home id json show
+  home=$(make_home answer-close)
+  id=sample-guard-review
+  mkdir -p "$home/data/$id"
+  tasks_in "$home" add "$id" "Guard the answer path" --kind scout --repo sample --start >/dev/null \
+    || fail "could not create the answer-guard origin"
+  write_origin_meta "$home" "$id"
+  printf 'done: report complete\n' > "$home/state/$id.status"
+  printf '# Guard review\n\nOne captain choice remains.\n' > "$home/data/$id/report.md"
+  run_captain "$home" hold sample-guard-call \
+    --title "Choose the guard option" --reason "captain guard choice pending" --repo sample >/dev/null \
+    || fail "could not register the captain-held task"
+  run_captain "$home" complete "$id" sample-guard-call >/dev/null \
+    || fail "completion failed for the held inventory"
+  tasks_in "$home" add sample-guard-work "Apply the guard option" \
+    --kind ship --repo sample --blocked-by sample-guard-call >/dev/null \
+    || fail "could not route work behind the captain-held task"
+
+  printf '' > "$home/empty.txt"
+  if run_captain "$home" answer sample-guard-call --decision-file "$home/empty.txt" \
+    > "$home/empty-answer.out" 2> "$home/empty-answer.err"; then
+    fail "answer accepted an empty captain decision"
+  fi
+  if run_captain "$home" answer sample-guard-call > "$home/bare-answer.out" 2> "$home/bare-answer.err"; then
+    fail "answer accepted a close with no captain decision file at all"
+  fi
+  printf 'An answer the captain never gave.\n' > "$home/invented.txt"
+  if run_captain "$home" answer sample-absent-call --decision-file "$home/invented.txt" \
+    > "$home/absent-answer.out" 2> "$home/absent-answer.err"; then
+    fail "answer invented a resolution for a task that does not exist"
+  fi
+  if run_captain "$home" answer sample-guard-work --decision-file "$home/invented.txt" \
+    > "$home/unheld-answer.out" 2> "$home/unheld-answer.err"; then
+    fail "answer closed a task that is not held for the captain"
+  fi
+  show=$(tasks_in "$home" show sample-guard-call --full)
+  assert_contains "$show" "state: queued" "a refused answer closed the captain-held task"
+  assert_contains "$show" "held: yes" "a refused answer released the captain-held task"
+
+  printf 'Captain chose the guard option.\n' > "$home/guard-decision.txt"
+  run_captain "$home" answer sample-guard-call --decision-file "$home/guard-decision.txt" >/dev/null \
+    || fail "answer could not close the captain-held task"
+  show=$(tasks_in "$home" show sample-guard-call --full)
+  assert_contains "$show" "state: done" "an answered captain-held task did not close"
+  assert_contains "$show" "Resolution recorded by fm-captain-hold" "the answered task lost the decision record"
+  assert_contains "$show" "Resolution mode: answered" "the answered task did not record its close path"
+  assert_contains "$show" "Captain chose the guard option." \
+    "the answered task did not record the captain decision text"
+  run_captain "$home" answer sample-guard-call --decision-file "$home/guard-decision.txt" >/dev/null \
+    || fail "identical answer retry was not idempotent"
+  printf 'Captain chose something else entirely.\n' > "$home/drifted.txt"
+  if run_captain "$home" answer sample-guard-call --decision-file "$home/drifted.txt" \
+    > "$home/drifted-answer.out" 2> "$home/drifted-answer.err"; then
+    fail "answer retry accepted a different captain decision"
+  fi
+  # The answered call releases the work routed behind it: a Done blocker reads
+  # as resolved everywhere.
+  show=$(tasks_in "$home" show sample-guard-work --full)
+  assert_contains "$show" "blocked: no" "the recorded answer did not release dependent work"
+  run_captain "$home" verify "$id" >/dev/null \
+    || fail "an answered captain call did not satisfy the completion gate"
+  json=$(run_bearings "$home") || fail "Bearings failed after the answer"
+  printf '%s' "$json" | jq -e '
+    (.decisions_open | any(.id == "sample-guard-call") | not)
+      and (.gates | any(.id == "sample-guard-call") | not)
+      and (.landed | any(.id == "sample-guard-call") | not)
+  ' >/dev/null || fail "an answered captain call still renders somewhere it should not: $json"
+  pass "answer records the captain's words, closes idempotently, and releases routed work"
+}
+
+# --release lifts the hold instead of closing, preserving the work item's own
+# body under the record; a re-held task later accepts a new answer.
+test_release_frees_held_work() {
+  local home show out
+  home=$(make_home release-work)
+  tasks_in "$home" add sample-widget "Ship the sample widget" --kind ship --repo sample \
+    --body 'The widget plan body. Literal escape: \n. Unicode: café.' >/dev/null \
+    || fail "could not create the held work item"
+  run_captain "$home" hold sample-widget --reason "captain go needed before shipping" >/dev/null \
+    || fail "could not hold the work item for the captain"
+  printf 'Go: ship it as planned.\n' > "$home/go.txt"
+  run_captain "$home" answer sample-widget --decision-file "$home/go.txt" --release >/dev/null \
+    || fail "answer --release failed on the held work item"
+  show=$(tasks_in "$home" show sample-widget --full)
+  assert_contains "$show" "state: queued" "a released work item did not stay queued"
+  assert_contains "$show" "held: no" "a released work item kept its hold"
+  assert_contains "$show" "Resolution mode: released" "the release did not record its close path"
+  assert_contains "$show" "Go: ship it as planned." "the release lost the captain's words"
+  assert_contains "$show" "The widget plan body." "the release destroyed the work item body"
+  assert_contains "$show" 'Literal escape: \\n. Unicode: café.' \
+    "the release corrupted escaped or Unicode body text"
+  run_captain "$home" answer sample-widget --decision-file "$home/go.txt" --release >/dev/null \
+    || fail "identical release retry was not idempotent"
+  if run_captain "$home" answer sample-widget --decision-file "$home/go.txt" \
+    > "$home/wrong-mode.out" 2> "$home/wrong-mode.err"; then
+    fail "a released answer replay without --release reported completion"
+  fi
+  assert_grep "mode released" "$home/wrong-mode.err" \
+    "the mismatched replay did not name the recorded release mode"
+  show=$(tasks_in "$home" show sample-widget --full)
+  assert_contains "$show" "state: queued" "a mismatched release replay closed the work item"
+  assert_contains "$show" "held: no" "a mismatched release replay re-held the work item"
+
+  tasks_in "$home" add sample-empty-label-widget "Ship without a display label" \
+    --kind ship --repo sample >/dev/null
+  run_captain "$home" hold sample-empty-label-widget --reason "captain go needed" >/dev/null
+  out=$(printf 'sample-empty-label-widget\tgo\t\trelease\n' \
+    | run_captain "$home" answers --source "empty-label release fixture") \
+    || fail "an empty answer label shifted the release close mode"
+  assert_contains "$out" "closed: sample-empty-label-widget" \
+    "the empty-label release was not accepted"
+  show=$(tasks_in "$home" show sample-empty-label-widget --full)
+  assert_contains "$show" "state: queued" "an empty-label release completed its work item"
+  assert_contains "$show" "held: no" "an empty-label release did not lift the hold"
+  assert_contains "$show" "Resolution mode: released" \
+    "an empty-label release recorded the wrong close mode"
+
+  # A NEW captain gate on the same task later takes a NEW answer.
+  run_captain "$home" hold sample-widget --reason "captain pricing call needed" >/dev/null \
+    || fail "could not re-hold the released work item"
+  printf 'Price it at nine dollars.\n' > "$home/price.txt"
+  run_captain "$home" answer sample-widget --decision-file "$home/price.txt" --release >/dev/null \
+    || fail "a re-held task refused a new answer"
+  show=$(tasks_in "$home" show sample-widget --full)
+  assert_contains "$show" "Price it at nine dollars." "the new answer was not recorded"
+  assert_contains "$show" "Go: ship it as planned." "the new answer erased the earlier record"
+
+  tasks_in "$home" "done" sample-widget >/dev/null \
+    || fail "could not complete the released work item normally"
+  if run_captain "$home" answer sample-widget --decision-file "$home/price.txt" \
+    > "$home/closed-wrong-mode.out" 2> "$home/closed-wrong-mode.err"; then
+    fail "a completed release replay without --release reported an answer"
+  fi
+  assert_grep "mode released" "$home/closed-wrong-mode.err" \
+    "the completed replay did not name the recorded release mode"
+  show=$(tasks_in "$home" show sample-widget --full)
+  assert_contains "$show" "state: done" "a refused completed replay changed task state"
+  pass "release frees held work with the captain's words recorded and the body preserved"
+}
+
+# Deferral is a date, not a live card: hold --until keeps the task out of
+# captain_actionable until due, tasks-axi's own date-gate expiry keeps the task
+# answerable, and Bearings renders the wait as a dated gate.
+test_deferral_leaves_captains_call_until_due() {
+  local home json snap show
+  home=$(make_home deferral)
+  run_captain "$home" hold sample-later-call --title "Revisit the sample plan" \
+    --reason "captain deferred revisit later" --repo sample --until 2026-08-01 >/dev/null \
+    || fail "could not register the deferred captain call"
+  run_captain "$home" hold sample-now-call --title "Decide the sample cut" \
+    --reason "captain cut choice pending" --repo sample >/dev/null \
+    || fail "could not register the live captain call"
+  if run_captain "$home" hold sample-bad-date --title "Bad date" \
+    --reason "captain choice" --until 2026-8-1 > "$home/bad-date.out" 2> "$home/bad-date.err"; then
+    fail "hold accepted a malformed --until date"
+  fi
+
+  snap=$(PATH="$home/fakebin:$PATH" FM_HOME="$home" FM_STATE_OVERRIDE="$home/state" \
+    FM_DATA_OVERRIDE="$home/data" FM_CONFIG_OVERRIDE="$home/config" \
+    FM_PROJECTS_OVERRIDE="$home/projects" FM_SNAPSHOT_NOW=2026-07-14T12:00:00Z \
+    "$ROOT/bin/fm-fleet-snapshot.sh" --json) || fail "fleet snapshot failed"
+  printf '%s' "$snap" | jq -e '
+    ([.backlog.records[] | select(.id == "sample-later-call")][0]) as $later
+    | ([.backlog.records[] | select(.id == "sample-now-call")][0]) as $now
+    | $later.captain_actionable == false and $later.hold_until == "2026-08-01"
+      and $now.captain_actionable == true and $now.hold_until == null
+      and ($later.title | contains("hold-until") | not)
+  ' >/dev/null || fail "the due gate or hold-until parsing is wrong: $snap"
+
+  json=$(run_bearings "$home") || fail "Bearings failed with a deferred call"
+  printf '%s' "$json" | jq -e '
+    (.decisions_open | any(.id == "sample-now-call"))
+      and (.decisions_open | any(.id == "sample-later-call") | not)
+      and (.gates | any(.id == "sample-later-call" and (.reason | startswith("until 2026-08-01"))))
+  ' >/dev/null || fail "the deferred call did not render as a dated gate: $json"
+
+  # On its date the call is due again - and still answerable even though
+  # tasks-axi reports the expired hold as no longer held.
+  snap=$(PATH="$home/fakebin:$PATH" FM_HOME="$home" FM_STATE_OVERRIDE="$home/state" \
+    FM_DATA_OVERRIDE="$home/data" FM_CONFIG_OVERRIDE="$home/config" \
+    FM_PROJECTS_OVERRIDE="$home/projects" FM_SNAPSHOT_NOW=2026-08-01T12:00:00Z \
+    "$ROOT/bin/fm-fleet-snapshot.sh" --json) || fail "fleet snapshot failed at the due date"
+  printf '%s' "$snap" | jq -e '
+    [.backlog.records[] | select(.id == "sample-later-call")][0].captain_actionable == true
+  ' >/dev/null || fail "a due deferral did not resurface as captain-actionable"
+  show=$(tasks_in "$home" show sample-later-call --full)
+  assert_contains "$show" "hold_kind: captain" "the expired deferral lost its captain-hold annotations"
+  printf 'Answered on the due date.\n' > "$home/due.txt"
+  run_captain "$home" answer sample-later-call --decision-file "$home/due.txt" >/dev/null \
+    || fail "an expired deferral was not answerable"
+  pass "a deferred captain call leaves the live Captain's Call until its date and stays answerable"
+}
+
+# The recorded-answer guard survives an out-of-band close: a bare tasks-axi done
+# fails verify until answer records the captain's word, and an ordinary finished
+# task can never be dressed up as an answered captain call.
+test_out_of_band_close_is_recordable() {
+  local home id show
+  home=$(make_home out-of-band)
+  id=sample-fullrun-review
+  mkdir -p "$home/data/$id"
+  tasks_in "$home" add "$id" "Investigate the sample full run" --kind scout --repo sample --start >/dev/null \
+    || fail "could not create out-of-band origin"
+  write_origin_meta "$home" "$id"
+  printf 'done: report complete\n' > "$home/state/$id.status"
+  printf '# Sample full run review\n\nOne captain choice remains.\n' > "$home/data/$id/report.md"
+  run_captain "$home" hold sample-submission-call --title "Choose the sample submission" \
+    --reason "captain submission choice pending" --repo sample --origin "$id" >/dev/null \
+    || fail "could not register the captain-held task"
+  run_captain "$home" complete "$id" sample-submission-call >/dev/null \
+    || fail "completion failed before the out-of-band close"
+
+  tasks_in "$home" "done" sample-submission-call >/dev/null \
+    || fail "could not reproduce the direct out-of-band close"
+  if run_captain "$home" verify "$id" > "$home/broken-verify.out" 2> "$home/broken-verify.err"; then
+    fail "verification passed a captain call closed with no recorded answer"
+  fi
+  if run_teardown "$home" "$id" > "$home/broken-teardown.out" 2> "$home/broken-teardown.err"; then
+    fail "teardown proceeded while a captain call had no recorded answer"
+  fi
+  assert_present "$home/state/$id.meta" "refused teardown removed investigation metadata"
+
+  printf 'Declined: do not submit the sample full run upstream.\n' > "$home/submission.txt"
+  run_captain "$home" answer sample-submission-call --decision-file "$home/submission.txt" >/dev/null \
+    || fail "answer could not record the missing captain decision on the closed task"
+  show=$(tasks_in "$home" show sample-submission-call --full)
+  assert_contains "$show" "state: done" "recording the answer reopened the closed task"
+  assert_contains "$show" "Resolution mode: repaired" "the retroactive record did not name its path"
+  assert_contains "$show" "Declined: do not submit the sample full run upstream." \
+    "the retroactive record lost the captain decision text"
+  run_captain "$home" verify "$id" >/dev/null \
+    || fail "the recorded answer did not satisfy the completion gate"
+  run_captain "$home" answer sample-submission-call --decision-file "$home/submission.txt" >/dev/null \
+    || fail "identical retroactive retry was not idempotent"
+  printf 'A different answer entirely.\n' > "$home/drifted.txt"
+  if run_captain "$home" answer sample-submission-call --decision-file "$home/drifted.txt" \
+    > "$home/drifted.out" 2> "$home/drifted.err"; then
+    fail "a drifted retry overwrote the recorded captain decision"
+  fi
+  run_teardown "$home" "$id" >/dev/null 2> "$home/teardown.err" \
+    || fail "teardown still refused after the answer was recorded: $(cat "$home/teardown.err")"
+
+  # An ordinary finished task was never the captain's item; recording an
+  # invented answer on it must be refused.
+  tasks_in "$home" add sample-ordinary-work "Ordinary finished work" --kind ship --repo sample >/dev/null
+  tasks_in "$home" "done" sample-ordinary-work >/dev/null
+  printf 'An answer the captain never gave.\n' > "$home/invented.txt"
+  if run_captain "$home" answer sample-ordinary-work --decision-file "$home/invented.txt" \
+    > "$home/never-held.out" 2> "$home/never-held.err"; then
+    fail "an ordinary finished task was dressed up as an answered captain call"
+  fi
+  assert_grep "never held for the captain" "$home/never-held.err" \
+    "the refusal must say the task carries no captain-hold provenance"
+  pass "an out-of-band close is recordable with the captain's word and nothing else"
+}
+
+# A post-teardown visual review completes against the surviving report and
+# durable tasks, with no volatile task metadata and no second decision database.
+test_visual_review_uses_shared_completion_owner() {
+  local home id json
+  home=$(make_home visual-review)
+  id=sample-board-review
+  mkdir -p "$home/data/$id"
+  tasks_in "$home" add "$id" "Review the sample board" --kind scout --repo sample --start >/dev/null
+  write_origin_meta "$home" "$id"
+  printf 'done: investigation complete\n' > "$home/state/$id.status"
+  printf '# Sample board investigation\n\nThe initial findings need no captain choice.\n' > "$home/data/$id/report.md"
+  run_captain "$home" complete "$id" --none >/dev/null \
+    || fail "initial investigation could not pass the shared completion owner"
+  run_teardown "$home" "$id" >/dev/null 2> "$home/visual-teardown.err" \
+    || fail "completed investigation teardown failed: $(cat "$home/visual-teardown.err")"
+  tasks_in "$home" "done" "$id" --report "data/$id/report.md" --keep 0 >/dev/null
+
+  mkdir -p "$home/.lavish"
+  printf '<html><body>Synthetic sample board</body></html>\n' > "$home/.lavish/sample-board.html"
+  run_captain "$home" hold sample-layout-call --title "Choose the sample layout" \
+    --reason "captain layout choice pending" --repo sample --origin "$id" >/dev/null \
+    || fail "post-teardown visual review could not use the shared hold owner"
+  run_captain "$home" complete "$id" sample-layout-call >/dev/null \
+    || fail "post-teardown visual review could not use the shared completion owner"
+  json=$(run_bearings "$home") || fail "Bearings failed after the ended visual review"
+  printf '%s' "$json" | jq -e '
+    .decisions_open | any(.id == "sample-layout-call" and .verb == "captain-hold")
+  ' >/dev/null || fail "ended visual review did not leave its durable Captain Call: $json"
+  [ ! -e "$home/data/visual-review-decisions.json" ] \
+    || fail "visual review created a second decision database"
+  pass "ended visual review follows the same captain-hold completion owner"
+}
+
+test_none_inventory_and_resolved_prose_do_not_create_holds() {
+  local home id json
+  home=$(make_home no-false-holds)
+  id=sample-resolved-review
+  mkdir -p "$home/data/$id"
+  tasks_in "$home" add "$id" "Review a resolved sample finding" --kind scout --repo sample --start >/dev/null
+  write_origin_meta "$home" "$id"
+  printf 'resolved [key=old-choice]: the sample choice was already recorded\ndone: report complete\n' \
+    > "$home/state/$id.status"
+  cat > "$home/data/$id/report.md" <<'EOF'
+# Resolved sample finding
+
+Decision record: the earlier choice is resolved.
+The recommendation is informational and needs no captain action.
+EOF
+  run_captain "$home" complete "$id" --none >/dev/null \
+    || fail "explicit no-call inventory failed"
+  json=$(run_bearings "$home") || fail "Bearings failed for no-call inventory"
+  printf '%s' "$json" | jq -e '
+    (.decisions_open | any(.id | startswith("sample-resolved-review")) | not)
+  ' >/dev/null || fail "resolved findings or decision-like prose created a false captain call: $json"
+  pass "resolved findings and decision-like prose do not create captain-held tasks"
+}
+
+test_terminal_single_owner_status_decision_does_not_block_empty_inventory() {
+  local home id open secondmate
+  home=$(make_home stale-terminal-decision)
+  id=sample-terminal-review
+  mkdir -p "$home/data/$id"
+  tasks_in "$home" add "$id" "Review a terminal sample finding" --kind scout --repo sample --start >/dev/null
+  write_origin_meta "$home" "$id"
+  printf 'needs-decision [key=default]: choose route A or route B\ndone: report complete\n' \
+    > "$home/state/$id.status"
+  printf '# Terminal sample review\n\nNo unresolved captain choice remains.\n' > "$home/data/$id/report.md"
+  open=$(bash -c '. "$1"; status_open_decisions "$2"' _ \
+    "$ROOT/bin/fm-classify-lib.sh" "$home/state/$id.status")
+  assert_contains "$open" "default" "fixture must retain the raw stale status decision"
+  run_captain "$home" complete "$id" --none >/dev/null \
+    || fail "terminal single-owner stale status decision blocked empty inventory completion"
+  run_captain "$home" verify "$id" >/dev/null \
+    || fail "terminal single-owner stale status decision blocked inventory verification"
+  run_teardown "$home" "$id" >/dev/null 2> "$home/terminal-teardown.err" \
+    || fail "terminal single-owner stale status decision blocked teardown: $(cat "$home/terminal-teardown.err")"
+
+  secondmate=sample-secondmate
+  write_origin_meta "$home" "$secondmate" secondmate
+  printf 'needs-decision [key=route]: choose route A or route B\ndone: heartbeat complete\n' \
+    > "$home/state/$secondmate.status"
+  if run_captain "$home" complete "$secondmate" --none \
+    > "$home/secondmate-terminal.out" 2> "$home/secondmate-terminal.err"; then
+    fail "secondmate terminal status decision was incorrectly cleared"
+  fi
+  pass "terminal single-owner stale status decisions do not block empty inventory"
+}
+
+test_secondmate_hold_stays_in_authoritative_home() {
+  local parent mate fakebin origin json
+  parent=$(make_home main-routing)
+  mate="$TMP_ROOT/sample-mate-home"
+  mkdir -p "$mate/data" "$mate/state" "$mate/config" "$mate/projects" "$mate/bin"
+  cp "$ROOT/.tasks.toml" "$mate/.tasks.toml"
+  printf '# Synthetic secondmate home\n' > "$mate/AGENTS.md"
+  printf 'sample-mate\n' > "$mate/.fm-secondmate-home"
+  cat > "$mate/data/backlog.md" <<'EOF'
+## In flight
+
+## Queued
+
+## Done
+EOF
+  fakebin=$(fm_fakebin "$mate")
+  fm_fake_exit0 "$fakebin" tmux treehouse no-mistakes gh gh-axi
+  origin=sample-mate-review
+  mkdir -p "$mate/data/$origin"
+  tasks_in "$mate" add "$origin" "Investigate secondmate sample" --kind scout --repo sample --start >/dev/null
+  write_origin_meta "$mate" "$origin"
+  printf 'done: report and visual review complete\n' > "$mate/state/$origin.status"
+  printf '# Sample secondmate review\n\nOne captain choice remains.\n' > "$mate/data/$origin/report.md"
+  run_captain "$mate" hold sample-release-call --title "Choose the sample release" \
+    --reason "captain release choice pending" --repo sample --origin "$origin" >/dev/null \
+    || fail "secondmate-owned hold creation failed"
+  run_captain "$mate" complete "$origin" sample-release-call >/dev/null \
+    || fail "secondmate-owned completion failed"
+  run_teardown "$mate" "$origin" >/dev/null 2> "$mate/teardown.err" \
+    || fail "secondmate investigation teardown failed: $(cat "$mate/teardown.err")"
+  tasks_in "$mate" "done" "$origin" --report "data/$origin/report.md" --keep 0 >/dev/null
+
+  printf -- '- sample-mate - synthetic scope (home: %s; scope: sample reviews; projects: sample; added 2026-07-14)\n' \
+    "$mate" > "$parent/data/secondmates.md"
+  fm_write_secondmate_meta "$parent/state/sample-mate.meta" "$mate" \
+    "firstmate:fm-sample-mate" sample
+  json=$(run_bearings "$parent") || fail "parent Bearings could not read the secondmate captain call"
+  printf '%s' "$json" | jq -e '
+    .decisions_open | any(.owner == "sample-mate" and .verb == "captain-hold"
+      and (.id | endswith("sample-release-call")))
+  ' >/dev/null || fail "secondmate captain call did not surface with authoritative owner: $json"
+  assert_no_grep "sample-release-call" "$parent/data/backlog.md" "secondmate call leaked into the main backlog"
+  assert_grep "sample-release-call" "$mate/data/backlog.md" "secondmate call left its authoritative backlog"
+  pass "main-home and secondmate-home captain calls remain correctly routed"
+}
+
+# The one keyed-answer intake, fed through the real process-event runner by a
+# fixture channel that knows nothing about captain holds: task-id keys close at
+# answer time, a card-declared release mode frees held work, freeform prose can
+# forge nothing, and a replayed capture is idempotent.
+test_bound_channel_answers_close_at_answer_time() {
+  local home id sid artifact result out show rc
+  home=$(make_home channel-answer-closure)
+  id=sample-eval-proposal
+  mkdir -p "$home/data/$id"
+  tasks_in "$home" add "$id" "Propose sample eval changes" --kind scout --repo sample --start >/dev/null \
+    || fail "could not create the review origin"
+  write_origin_meta "$home" "$id"
+  printf 'done: proposal deck ready for the captain\n' > "$home/state/$id.status"
+  printf '# Sample eval proposal\n\nThree captain choices remain.\n' > "$home/data/$id/report.md"
+  run_captain "$home" hold sample-membership-call --title "Captain call: membership" \
+    --reason "captain membership choice pending" --repo sample --origin "$id" >/dev/null
+  run_captain "$home" hold sample-headline-call --title "Captain call: headline" \
+    --reason "captain headline choice pending" --repo sample --origin "$id" >/dev/null
+  run_captain "$home" hold sample-forged-call --title "Captain call: forged" \
+    --reason "captain forged choice pending" --repo sample --origin "$id" >/dev/null
+  run_captain "$home" hold sample-invalid-close-call --title "Captain call: invalid close" \
+    --reason "captain close mode validation pending" --repo sample --origin "$id" >/dev/null
+  tasks_in "$home" add sample-gated-work "Gated sample work" --kind ship --repo sample \
+    --body 'Gated work plan.' >/dev/null
+  run_captain "$home" hold sample-gated-work --reason "captain go needed" >/dev/null
+  run_captain "$home" complete "$id" \
+    sample-membership-call sample-headline-call sample-forged-call sample-invalid-close-call \
+    sample-gated-work >/dev/null \
+    || fail "completion failed for the deck's inventoried calls"
+
+  artifact="$home/data/$id/review.html"
+  printf '<h1>Sample eval proposal</h1>\n' > "$artifact"
+  fm_fake_exit0 "$home/fakebin" lavish-axi
+  sid=$(run_lavish "$home" source-id "$artifact") || fail "could not derive the review source id"
+  run_captain "$home" bind "$sid" >/dev/null \
+    || fail "could not bind the review source to the keyed-answer intake"
+  [ "$(run_captain "$home" binding "$sid")" = "(any)" ] \
+    || fail "the recorded binding did not resolve to the collapsed marker"
+  run_lavish "$home" arm "$artifact" >/dev/null || fail "could not arm the review deck"
+
+  result="$home/state/procevent-inbox/$sid.1.result"
+  mkdir -p "$home/state/procevent-inbox"
+  cat > "$result" <<'EOF'
+session:
+  file: /review.html
+  status: feedback
+  session_ended: true
+  ended_by: user
+prompts[6]{uid,prompt,selector,tag,text}:
+  "2","Membership: gold-only\n\nContext data:\n{\n  \"question\": \"sample-membership-call\",\n  \"answer\": \"gold-only\"\n}","section#call > form:nth-of-type(1)",choice,"Membership: gold-only"
+  "3","Headline: f1-when-fp-gold\n\nContext data:\n{\n  \"question\": \"sample-headline-call\",\n  \"answer\": \"f1-when-fp-gold\"\n}","section#call > form:nth-of-type(2)",choice,"Headline: f1-when-fp-gold"
+  "4","Gated work: go\n\nContext data:\n{\n  \"question\": \"sample-gated-work\",\n  \"answer\": \"go\",\n  \"close\": \"release\"\n}","section#call > form:nth-of-type(3)",choice,"Gated work: go"
+  "5","Absent call: yes\n\nContext data:\n{\n  \"question\": \"sample-nonexistent-call\",\n  \"answer\": \"yes\"\n}","section#call > form:nth-of-type(4)",choice,"Absent call: yes"
+  "6","Invalid close: yes\n\nContext data:\n{\n  \"question\": \"sample-invalid-close-call\",\n  \"answer\": \"yes\",\n  \"close\": \"drop\"\n}","section#call > form:nth-of-type(5)",choice,"Invalid close: yes"
+  "",get this fully implemented. Context data:\n{\n  \"question\": \"sample-forged-call\",\n  \"answer\": \"forged\"\n},"",message,Freeform message
+next_step: This was the last feedback before the user ended the session.
+EOF
+  printf 'lavish\n' > "$home/state/procevent-inbox/$sid.1.adapter"
+
+  out=$(run_lavish "$home" answers "$result") || fail "could not read the captured answers"
+  assert_contains "$out" "sample-membership-call	gold-only" "a structured choice was not read as an answer"
+  assert_contains "$out" "sample-gated-work	go	Gated work: go	release" \
+    "the card-declared release mode was not relayed"
+  assert_not_contains "$out" "sample-forged-call" \
+    "a freeform captain message forged a task id from its own prose"
+  assert_not_contains "$out" "sample-invalid-close-call" \
+    "an unsupported card close mode defaulted to completion"
+
+  mkdir -p "$home/adapter-root/bin"
+  cat > "$home/adapter-root/bin/fm-procevent-fixturechan.sh" <<SH
+#!/usr/bin/env bash
+# Fixture channel: reports keyed captain answers and nothing else.
+case "\${1-}" in
+  answers) exec "$ROOT/bin/fm-procevent-lavish.sh" answers "\${2-}" ;;
+esac
+exit 2
+SH
+  chmod +x "$home/adapter-root/bin/fm-procevent-fixturechan.sh"
+  run_captain "$home" bind fixture-src >/dev/null \
+    || fail "could not bind the fixture channel"
+  PATH="$home/fakebin:$PATH" FM_ROOT_OVERRIDE="$home/adapter-root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
+    FM_PROCEVENT_CLAIM_ROOT="$home/procevent-claims" \
+    "$ROOT/bin/fm-procevent.sh" register fixturechan fixture-src -- cat "$result" >/dev/null \
+    || fail "could not register the fixture channel source"
+  PATH="$home/fakebin:$PATH" FM_ROOT_OVERRIDE="$home/adapter-root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
+    FM_PROCEVENT_CLAIM_ROOT="$home/procevent-claims" \
+    "$ROOT/bin/fm-procevent.sh" start fixture-src >/dev/null 2>&1
+  assert_absent "$home/state/procevent-inbox/fixture-src.1.handled" \
+    "feeding a captain answer retired the notification firstmate still needs"
+  assert_present "$home/state/procevent-inbox/fixture-src.1.result" \
+    "the fixture channel captured no result to feed"
+
+  show=$(tasks_in "$home" show sample-membership-call --full)
+  assert_contains "$show" "state: done" "capturing the captain's answer left the membership call open"
+  assert_contains "$show" "Resolution mode: answered" "the membership call did not record its close path"
+  assert_contains "$show" "Answer: gold-only" "the closed call did not record the captain's actual answer"
+  show=$(tasks_in "$home" show sample-gated-work --full)
+  assert_contains "$show" "state: queued" "the released work item did not stay queued"
+  assert_contains "$show" "held: no" "the card-declared release did not lift the hold"
+  assert_contains "$show" "Resolution mode: released" "the released work did not record its close path"
+  assert_contains "$show" "Gated work plan." "the released work item lost its body"
+  show=$(tasks_in "$home" show sample-forged-call --full)
+  assert_contains "$show" "state: queued" "a forged key from freeform prose closed a captain call"
+  show=$(tasks_in "$home" show sample-invalid-close-call --full)
+  assert_contains "$show" "state: queued" "an unsupported card close mode closed a captain call"
+  assert_contains "$show" "held: yes" "an unsupported card close mode released a captain call"
+
+  # Replaying the same capture is a no-op, not a rejected different decision. A
+  # run that could not close every answered key still reports nonzero.
+  set +e
+  out=$(run_lavish "$home" answers "$result" \
+    | run_captain "$home" answers --source "the captured result fixture-src sequence 1" 2>&1)
+  rc=$?
+  set -e
+  [ "$rc" -ne 0 ] || fail "a run that skipped a key reported success"
+  assert_contains "$out" "closed: sample-membership-call" \
+    "replaying an identical capture was not idempotent: $out"
+  assert_contains "$out" "closed: sample-gated-work" \
+    "replaying an identical released answer was not idempotent: $out"
+  assert_contains "$out" "skipped: sample-nonexistent-call" \
+    "a key naming no task was not reported as skipped: $out"
+
+  printf 'Captain answered the forged call directly.\n' > "$home/forged.txt"
+  run_captain "$home" answer sample-forged-call --decision-file "$home/forged.txt" >/dev/null \
+    || fail "could not close the untouched call through the answer path"
+  printf 'Captain answered the invalid-close call directly.\n' > "$home/invalid-close.txt"
+  run_captain "$home" answer sample-invalid-close-call --decision-file "$home/invalid-close.txt" >/dev/null \
+    || fail "could not close the invalid-close call through the answer path"
+  run_captain "$home" verify "$id" >/dev/null \
+    || fail "answered calls did not satisfy the completion gate"
+  pass "a bound channel's captured answers close their captain-held tasks at answer time"
+}
+
+# Answer-time closure is opt-in per source. A channel with no binding must behave
+# exactly as it always did: capture, announce, close nothing.
+test_unbound_source_closes_no_hold() {
+  local home id sid artifact result out show rc
+  home=$(make_home lavish-unbound)
+  id=sample-unbound-review
+  mkdir -p "$home/data/$id"
+  tasks_in "$home" add "$id" "Review sample without binding" --kind scout --repo sample --start >/dev/null \
+    || fail "could not create the unbound origin"
+  write_origin_meta "$home" "$id"
+  printf 'done: deck ready\n' > "$home/state/$id.status"
+  printf '# Unbound review\n\nOne captain choice remains.\n' > "$home/data/$id/report.md"
+  run_captain "$home" hold sample-only-call --title "Captain call: only choice" \
+    --reason "captain only choice pending" --repo sample --origin "$id" >/dev/null \
+    || fail "could not register the unbound call"
+
+  artifact="$home/data/$id/review.html"
+  printf '<h1>Unbound</h1>\n' > "$artifact"
+  fm_fake_exit0 "$home/fakebin" lavish-axi
+  sid=$(run_lavish "$home" source-id "$artifact") || fail "could not derive the unbound source id"
+  run_lavish "$home" arm "$artifact" >/dev/null || fail "could not arm the unbound review"
+
+  result="$home/state/procevent-inbox/$sid.1.result"
+  mkdir -p "$home/state/procevent-inbox"
+  cat > "$result" <<'EOF'
+session:
+  file: /review.html
+  status: feedback
+prompts[1]{uid,prompt,selector,tag,text}:
+  "2","Only choice: yes\n\nContext data:\n{\n  \"question\": \"sample-only-call\",\n  \"answer\": \"yes\"\n}","form",choice,"Only choice: yes"
+EOF
+  set +e
+  out=$(run_captain "$home" binding "$sid" 2>&1)
+  rc=$?
+  set -e
+  [ "$rc" -ne 0 ] || fail "an unbound source reported a binding"
+  [ -z "$out" ] || fail "an unbound source printed a binding: $out"
+  show=$(tasks_in "$home" show sample-only-call --full)
+  assert_contains "$show" "state: queued" "an unbound review closed a captain call"
+  assert_contains "$show" "held: yes" "an unbound review released a captain call"
+  pass "a channel source with no decision binding closes nothing"
+}
+
+# Everything a pre-collapse install already has keeps working: composed
+# identities through the shim, short decision keys in recorded metadata, a
+# concrete-origin binding, and the chat fallback for old rows.
+test_legacy_identities_keep_working() {
+  local home id hold out show legacy_text legacy_digest old_hold
+  home=$(make_home legacy-compat)
+  id=sample-legacy-review
+  mkdir -p "$home/data/$id"
+  tasks_in "$home" add "$id" "Legacy-shaped review" --kind scout --repo sample --start >/dev/null
+  write_origin_meta "$home" "$id"
+  printf 'done: report complete\n' > "$home/state/$id.status"
+  printf '# Legacy review\n\nTwo captain choices remain.\n' > "$home/data/$id/report.md"
+
+  hold=$(run_shim "$home" id "$id" pick-one)
+  [ "$hold" = "$id-decision-pick-one" ] || fail "the shim identity was not deterministic: $hold"
+  out=$(run_shim "$home" hold "$id" pick-one \
+    --title "Pick one" --reason "captain choice pending" --repo sample) \
+    || fail "the shim hold path failed"
+  [ "$out" = "$hold" ] || fail "the shim hold did not print the composed identity: $out"
+  run_shim "$home" hold "$id" keep-two \
+    --title "Keep two" --reason "captain second choice pending" --repo sample >/dev/null \
+    || fail "the shim second hold failed"
+  show=$(tasks_in "$home" show "$hold" --full)
+  assert_contains "$show" "hold_kind: captain" "the shim-created row is not a plain captain-held task"
+
+  # A pre-collapse metadata attestation records SHORT keys; verify must resolve
+  # them through the legacy composed identity.
+  printf 'decisions_reviewed=1\ndecision_keys=keep-two,pick-one\n' >> "$home/state/$id.meta"
+  run_captain "$home" verify "$id" >/dev/null \
+    || fail "legacy short-key metadata did not verify against composed identities"
+
+  # The shim's routed close records the routed work inside the captain decision
+  # and clears the recorded edge.
+  tasks_in "$home" add sample-legacy-work "Apply the legacy choice" \
+    --kind ship --repo sample --blocked-by "$hold" >/dev/null
+  tasks_in "$home" add sample-unrouted-work "Unrouted legacy work" \
+    --kind ship --repo sample >/dev/null
+  printf 'Use route north.\n' > "$home/route.txt"
+  if run_shim "$home" resolve "$id" pick-one --decision-file "$home/route.txt" \
+    --routed-to sample-missing-work > "$home/missing-route.out" 2> "$home/missing-route.err"; then
+    fail "the shim resolve accepted a missing routed task"
+  fi
+  if run_shim "$home" resolve "$id" pick-one --decision-file "$home/route.txt" \
+    --routed-to sample-unrouted-work > "$home/unrouted.out" 2> "$home/unrouted.err"; then
+    fail "the shim resolve accepted work not blocked by the legacy decision"
+  fi
+  show=$(tasks_in "$home" show "$hold" --full)
+  assert_contains "$show" "state: queued" "invalid shim routing closed the legacy decision"
+  assert_not_contains "$show" "Resolution recorded" "invalid shim routing recorded an answer"
+  run_shim "$home" resolve "$id" pick-one --decision-file "$home/route.txt" \
+    --routed-to sample-legacy-work >/dev/null \
+    || fail "the shim resolve path failed"
+  show=$(tasks_in "$home" show "$hold" --full)
+  assert_contains "$show" "state: done" "the shim resolve did not close the row"
+  assert_contains "$show" "Use route north." "the shim resolve lost the captain decision"
+  assert_contains "$show" "- sample-legacy-work" "the shim resolve lost the routed identities"
+  show=$(tasks_in "$home" show sample-legacy-work --full)
+  assert_contains "$show" "blocked: no" "the shim resolve did not release the routed work"
+
+  old_hold=$(run_shim "$home" hold "$id" old-route \
+    --title "Old routed choice" --reason "captain old route pending" --repo sample)
+  tasks_in "$home" add sample-old-routed-work "Apply the old routed choice" \
+    --kind ship --repo sample --blocked-by "$old_hold" >/dev/null
+  printf 'Use the historical route.\n' > "$home/old-route.txt"
+  legacy_text=$(cat "$home/old-route.txt")
+  if command -v shasum >/dev/null 2>&1; then
+    legacy_digest=$(printf '%s' "$legacy_text" | shasum -a 256 | awk '{print $1}')
+  else
+    legacy_digest=$(printf '%s' "$legacy_text" | sha256sum | awk '{print $1}')
+  fi
+  printf 'Resolution recorded by fm-decision-hold.\nDecision digest: %s\nRouted identities: sample-old-routed-work\nResolution mode: routed\n\nCaptain decision:\n%s\n\nRouted work:\n- sample-old-routed-work\n' \
+    "$legacy_digest" "$legacy_text" > "$home/old-route-body.txt"
+  tasks_in "$home" update "$old_hold" --body-file "$home/old-route-body.txt" --archive-body >/dev/null
+  run_shim "$home" resolve "$id" old-route --decision-file "$home/old-route.txt" \
+    --routed-to sample-old-routed-work >/dev/null \
+    || fail "the shim did not replay a matching pre-collapse routed record"
+  show=$(tasks_in "$home" show "$old_hold" --full)
+  assert_contains "$show" "state: done" "the replayed legacy resolve did not close its hold"
+  show=$(tasks_in "$home" show sample-old-routed-work --full)
+  assert_contains "$show" "blocked_by: none" "the replayed legacy resolve did not clear its recorded edge"
+
+  # The shim decline path maps onto the same recorded answer.
+  printf 'Declined: keep the current shape.\n' > "$home/decline.txt"
+  run_shim "$home" decline "$id" keep-two --decision-file "$home/decline.txt" >/dev/null \
+    || fail "the shim decline path failed"
+  run_captain "$home" verify "$id" >/dev/null \
+    || fail "shim-closed rows did not satisfy the completion gate"
+
+  # A concrete-origin binding (a pre-collapse record) makes short channel keys
+  # resolve through the composed identity.
+  run_shim "$home" hold "$id" third-choice \
+    --title "Third choice" --reason "captain third choice pending" --repo sample >/dev/null
+  run_shim "$home" bind legacy-src "$id" >/dev/null || fail "the shim bind path failed"
+  [ "$(run_captain "$home" binding legacy-src)" = "$id" ] \
+    || fail "the concrete-origin binding was not preserved"
+  printf 'third-choice\toption b\t\n' \
+    | run_captain "$home" answers "$(run_captain "$home" binding legacy-src)" \
+        --source "legacy channel" >/dev/null \
+    || fail "a short key did not resolve through the concrete-origin binding"
+  show=$(tasks_in "$home" show "$id-decision-third-choice" --full)
+  assert_contains "$show" "state: done" "the legacy-keyed answer did not close its row"
+
+  run_shim "$home" hold "$id" fourth-choice \
+    --title "Fourth choice" --reason "captain fourth choice pending" --repo sample >/dev/null
+  legacy_text=$(printf 'Captain answered this decision through legacy replay.\nDecision key: fourth-choice\nAnswer: option c\n')
+  if command -v shasum >/dev/null 2>&1; then
+    legacy_digest=$(printf '%s' "$legacy_text" | shasum -a 256 | awk '{print $1}')
+  else
+    legacy_digest=$(printf '%s' "$legacy_text" | sha256sum | awk '{print $1}')
+  fi
+  printf 'Resolution recorded by fm-decision-hold.\nDecision digest: %s\nRouted identities: none\nResolution mode: answered\n\nCaptain decision:\n%s\n' \
+    "$legacy_digest" "$legacy_text" > "$home/legacy-body.txt"
+  tasks_in "$home" update "$id-decision-fourth-choice" --body-file "$home/legacy-body.txt" --archive-body >/dev/null
+  tasks_in "$home" "done" "$id-decision-fourth-choice" >/dev/null
+  out=$(printf 'fourth-choice\toption c\t\n' \
+    | run_captain "$home" answers "$id" --source "legacy replay") \
+    || fail "an identical pre-collapse keyed answer was not idempotent"
+  assert_contains "$out" "closed: $id-decision-fourth-choice" \
+    "the pre-collapse keyed answer digest was treated as drift"
+  out=$(printf '%s-decision-fourth-choice\toption c\t\n' "$id" \
+    | run_captain "$home" answers --source "legacy replay") \
+    || fail "a full legacy task-id replay without an origin was not idempotent"
+  assert_contains "$out" "closed: $id-decision-fourth-choice" \
+    "the origin-free legacy replay digest was treated as drift"
+  pass "legacy identities, metadata, bindings, and the shim keep working"
+}
+
+# The intake is channel-agnostic, so chat must reach it the same way a captured
+# review does - for a task-id key, and for a legacy composed identity.
+test_chat_channel_feeds_the_same_keyed_answer_intake() {
+  local home id fb show
+  home=$(make_home chat-channel)
+  id=sample-chat-review
+  mkdir -p "$home/data/$id"
+  tasks_in "$home" add "$id" "Review sample chat routing" --kind scout --repo sample --start >/dev/null \
+    || fail "could not create the chat-channel origin"
+  write_origin_meta "$home" "$id" ship
+  printf 'needs-decision [key=chat-choice]: pick option A or option B\n' > "$home/state/$id.status"
+  printf '# Chat review\n\nTwo captain choices remain.\n' > "$home/data/$id/report.md"
+  run_shim "$home" hold "$id" chat-choice \
+    --title "Choose the sample chat option" --reason "captain chat choice pending" --repo sample >/dev/null \
+    || fail "could not register the legacy chat row"
+  run_captain "$home" hold sample-chat-followup --title "Choose the chat follow-up" \
+    --reason "captain follow-up choice pending" --repo sample >/dev/null \
+    || fail "could not register the task-id chat call"
+  run_captain "$home" complete "$id" "$id-decision-chat-choice" sample-chat-followup >/dev/null \
+    || fail "completion failed for the chat calls"
+  grep -F 'captain-held [key=chat-choice]' "$home/state/$id.status" >/dev/null \
+    || fail "precondition: completion did not transfer the decision to its durable owner"
+
+  fb="$home/fakebin"
+  cat > "$fb/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "${1:-}" in
+  send-keys)
+    shift
+    literal=0
+    while [ $# -gt 0 ]; do
+      case "$1" in
+        -t) shift 2 ;;
+        -l) literal=1; shift ;;
+        *) break ;;
+      esac
+    done
+    if [ "$literal" = 1 ]; then
+      printf '%s' "${1:-}" >> "$FM_SEND_LOG"
+    fi
+    exit 0 ;;
+  display-message)
+    for a in "$@"; do case "$a" in *cursor_y*) printf '1\n'; exit 0 ;; esac; done
+    printf 'fakepane\n'; exit 0 ;;
+  capture-pane) printf '╭────╮\n│    │\n╰────╯\n'; exit 0 ;;
+  list-windows) exit 0 ;;
+esac
+exit 0
+SH
+  chmod +x "$fb/tmux"
+
+  : > "$home/send.log"
+  env PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$home" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
+    FM_SEND_LOG="$home/send.log" FM_SEND_SETTLE=0 \
+    "$ROOT/bin/fm-send.sh" "$id" --resolve-key chat-choice "go with option A" >/dev/null 2>&1 \
+    || fail "an answer to a transferred legacy decision was refused by the chat channel"
+  assert_contains "$(cat "$home/send.log")" "go with option A" "the answer text never reached the worker"
+  show=$(tasks_in "$home" show "$id-decision-chat-choice" --full)
+  assert_contains "$show" "state: done" "a chat answer left the legacy row open"
+  assert_contains "$show" "Answer: go with option A" "the chat-answered row lost the captain answer"
+
+  : > "$home/send.log"
+  env PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$home" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
+    FM_SEND_LOG="$home/send.log" FM_SEND_SETTLE=0 \
+    "$ROOT/bin/fm-send.sh" "$id" --resolve-key sample-chat-followup "take the second option" >/dev/null 2>&1 \
+    || fail "an answer keyed by a task id was refused by the chat channel"
+  show=$(tasks_in "$home" show sample-chat-followup --full)
+  assert_contains "$show" "state: done" "a chat answer left the task-id call open"
+  assert_contains "$show" "Resolution mode: answered" "the chat-answered call did not record its close path"
+  assert_contains "$show" "Answer: take the second option" "the chat-answered call lost the captain answer"
+  assert_contains "$show" "answer sent to $id" "the chat-answered call lost its channel provenance"
+
+  if env PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$home" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
+    FM_SEND_LOG="$home/send.log" FM_SEND_SETTLE=0 \
+    "$ROOT/bin/fm-send.sh" "$id" --resolve-key sample-chat-followup "again" \
+    > "$home/closed-key.out" 2> "$home/closed-key.err"; then
+    fail "a key already closed in both ledgers was accepted"
+  fi
+  run_captain "$home" verify "$id" >/dev/null \
+    || fail "chat-answered calls did not satisfy the completion gate"
+  pass "the chat channel feeds the same keyed-answer intake a captured review does"
+}
+
+test_origin_slug_validation_precedes_path_construction() {
+  local home
+  home=$(make_home slug-validation)
+  if run_captain "$home" complete "../escape" --none > "$home/escape.out" 2> "$home/escape.err"; then
+    fail "complete accepted a path-escaping origin id"
+  fi
+  assert_grep "privacy-safe slug" "$home/escape.err" "the refusal must name the slug contract"
+  if run_captain "$home" verify "../escape" > "$home/escape-verify.out" 2> "$home/escape-verify.err"; then
+    fail "verify accepted a path-escaping origin id"
+  fi
+  if run_captain "$home" hold "bad id" --title "x" --reason "y" > "$home/bad-hold.out" 2> "$home/bad-hold.err"; then
+    fail "hold accepted an invalid task id"
+  fi
+  pass "completion and verification validate origins before constructing paths"
+}
+
+test_uninventoried_report_decision_refuses_completion
+test_completion_gate_attests_and_transfers
+test_answer_records_and_closes
+test_release_frees_held_work
+test_deferral_leaves_captains_call_until_due
+test_out_of_band_close_is_recordable
+test_visual_review_uses_shared_completion_owner
+test_none_inventory_and_resolved_prose_do_not_create_holds
+test_terminal_single_owner_status_decision_does_not_block_empty_inventory
+test_secondmate_hold_stays_in_authoritative_home
+test_bound_channel_answers_close_at_answer_time
+test_unbound_source_closes_no_hold
+test_legacy_identities_keep_working
+test_chat_channel_feeds_the_same_keyed_answer_intake
+test_origin_slug_validation_precedes_path_construction
diff --git a/tests/fm-decision-hold-lifecycle.test.sh b/tests/fm-decision-hold-lifecycle.test.sh
deleted file mode 100755
index ad81510fb8..0000000000
--- a/tests/fm-decision-hold-lifecycle.test.sh
+++ /dev/null
@@ -1,1278 +0,0 @@
-#!/usr/bin/env bash
-# End-to-end tests for durable captain-held decisions discovered by investigations
-# and visual reviews.
-set -u
-
-# shellcheck source=tests/lib.sh
-# shellcheck disable=SC1091
-. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
-
-TEARDOWN="$ROOT/bin/fm-teardown.sh"
-BEARINGS="$ROOT/bin/fm-bearings-snapshot.sh"
-TMP_ROOT=$(fm_test_tmproot fm-decision-hold)
-TASKS_AXI_BIN=$(command -v tasks-axi || true)
-
-command -v jq >/dev/null 2>&1 || { echo "skip: jq not found"; exit 0; }
-command -v tasks-axi >/dev/null 2>&1 || { echo "skip: tasks-axi not found"; exit 0; }
-
-make_home() {  # <name>
-  local home="$TMP_ROOT/$1" fakebin
-  mkdir -p "$home/data" "$home/state" "$home/config" "$home/projects"
-  cp "$ROOT/.tasks.toml" "$home/.tasks.toml"
-  cat > "$home/data/backlog.md" <<'EOF'
-## In flight
-
-## Queued
-
-## Done
-EOF
-  fakebin=$(fm_fakebin "$home")
-  fm_fake_exit0 "$fakebin" tmux treehouse no-mistakes gh gh-axi
-  printf '%s\n' "$home"
-}
-
-# The Lavish review adapter, run against this suite's isolated home. The
-# machine-wide process-event claim root is redirected into the fixture so arming
-# a review here can never contend with a real one on this machine.
-run_lavish() {  # <home> <command args...>
-  local home=$1
-  shift
-  PATH="$home/fakebin:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
-    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
-    FM_PROCEVENT_CLAIM_ROOT="$home/procevent-claims" \
-    "$ROOT/bin/fm-procevent-lavish.sh" "$@"
-}
-
-run_procevent() {  # <home> <command args...>
-  local home=$1
-  shift
-  PATH="$home/fakebin:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
-    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
-    FM_PROCEVENT_CLAIM_ROOT="$home/procevent-claims" \
-    "$ROOT/bin/fm-procevent.sh" "$@"
-}
-
-run_bearings() {  # <home>
-  local home=$1
-  PATH="$home/fakebin:$PATH" FM_HOME="$home" FM_BEARINGS_NOW=2026-07-14T12:00:00Z \
-    "$BEARINGS" --json
-}
-
-run_teardown() {  # <home> <id>
-  local home=$1 id=$2
-  PATH="$home/fakebin:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
-    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
-    FM_CONFIG_OVERRIDE="$home/config" "$TEARDOWN" "$id"
-}
-
-# Reproduces the loss exactly with privacy-safe synthetic names: the investigation
-# and visual review have ended, the only genuine unresolved decision is report prose,
-# no held backlog item or open status exists, and the authoritative Bearings view
-# correctly omits it. Completion must now refuse before teardown can erase the source.
-test_uninventoried_report_decision_refuses_completion() {
-  local home id json rc
-  home=$(make_home omitted-decision)
-  id=sample-route-review
-  mkdir -p "$home/data/$id"
-  cat > "$home/data/backlog.md" <<EOF
-## In flight
-- [ ] $id - Investigate sample routing (repo: sample) (kind: scout) (since 2026-07-14)
-
-## Queued
-
-## Done
-EOF
-  fm_write_meta "$home/state/$id.meta" \
-    "window=firstmate:fm-$id" \
-    "worktree=$home/projects/missing-scratch" \
-    "project=$home/projects/sample" \
-    "harness=codex" \
-    "kind=scout" \
-    "mode=scout"
-  printf 'done: report and visual review complete\n' > "$home/state/$id.status"
-  cat > "$home/data/$id/report.md" <<'EOF'
-# Sample route review
-
-The evidence is complete.
-The captain still needs to choose route north or route south before follow-up work starts.
-EOF
-
-  json=$(run_bearings "$home") || fail "Bearings failed for unresolved-decision regression"
-  printf '%s' "$json" | jq -e '
-    (.decisions_open | length) == 0
-      and (.gates | length) == 0
-      and (.reports | any(.id == "sample-route-review"))
-  ' >/dev/null || fail "the pre-policy omission shape was not reproduced: $json"
-
-  set +e
-  run_teardown "$home" "$id" > "$home/teardown.out" 2> "$home/teardown.err"
-  rc=$?
-  set -e
-  [ "$rc" -ne 0 ] || fail "completed investigation teardown erased a report-only unresolved decision"
-  assert_present "$home/state/$id.meta" "refused completion must preserve investigation metadata"
-  assert_grep "REFUSED" "$home/teardown.err" "refusal must be explicit"
-  pass "report-only unresolved decision is reproduced and completion refuses before loss"
-}
-
-tasks_in() {  # <home> <tasks-axi args...>
-  local home=$1
-  shift
-  (cd "$home" && tasks-axi "$@")
-}
-
-run_decisions() {  # <home> <command args...>
-  local home=$1
-  shift
-  PATH="$home/fakebin:$PATH" REAL_TASKS_AXI="$TASKS_AXI_BIN" \
-    FM_HOME="$home" FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
-    FM_CONFIG_OVERRIDE="$home/config" "$ROOT/bin/fm-decision-hold.sh" "$@"
-}
-
-write_origin_meta() {  # <home> <id> [kind]
-  local home=$1 id=$2 kind=${3:-scout}
-  fm_write_meta "$home/state/$id.meta" \
-    "window=firstmate:fm-$id" \
-    "worktree=$home/projects/missing-$id" \
-    "project=$home/projects/sample" \
-    "harness=codex" \
-    "kind=$kind" \
-    "mode=$kind"
-}
-
-test_structured_holds_survive_teardown_and_route_resolution() {
-  local home id route_hold access_hold before after json open show
-  home=$(make_home durable-lifecycle)
-  id=sample-systems-review
-  mkdir -p "$home/data/$id"
-  tasks_in "$home" add "$id" "Investigate sample systems" --kind scout --repo sample --start >/dev/null \
-    || fail "could not create investigation backlog fixture"
-  write_origin_meta "$home" "$id"
-  cat > "$home/state/$id.status" <<'EOF'
-needs-decision [key=route]: choose route north or route south
-needs-decision [key=access]: choose open or restricted sample access
-done: report and visual review complete
-EOF
-  cat > "$home/data/$id/report.md" <<'EOF'
-# Sample systems review
-
-Two choices remain unresolved: the route and the sample access level.
-A separate recommendation is already resolved and requires no captain action.
-EOF
-
-  if run_decisions "$home" complete "$id" route access > "$home/early-complete.out" 2> "$home/early-complete.err"; then
-    fail "completion succeeded before unresolved decisions had captain holds"
-  fi
-  assert_no_grep "decisions_reviewed=1" "$home/state/$id.meta" \
-    "failed completion recorded a false completion attestation"
-
-  route_hold=$(run_decisions "$home" hold "$id" route \
-    --title "Choose the sample route" --reason "captain route choice pending" --repo sample) \
-    || fail "could not register route hold"
-  [ "$route_hold" = "$id-decision-route" ] || fail "route hold identity was not deterministic: $route_hold"
-  run_decisions "$home" hold "$id" route \
-    --title "Choose the sample route" --reason "captain route choice pending" --repo sample >/dev/null \
-    || fail "idempotent hold retry failed"
-  if run_decisions "$home" complete "$id" route access > "$home/partial-complete.out" 2> "$home/partial-complete.err"; then
-    fail "completion succeeded while one of two distinct decisions lacked a hold"
-  fi
-  access_hold=$(run_decisions "$home" hold "$id" access \
-    --title "Choose the sample access level" --reason "captain access choice pending" --repo sample) \
-    || fail "could not register access hold"
-  [ "$access_hold" = "$id-decision-access" ] || fail "access hold identity was not distinct: $access_hold"
-  [ "$(grep -cE "^- \[ \] $route_hold -" "$home/data/backlog.md")" = 1 ] \
-    || fail "idempotent retry duplicated the route hold"
-  [ "$(grep -cE "^- \[ \] $access_hold -" "$home/data/backlog.md")" = 1 ] \
-    || fail "second decision did not retain one distinct backlog identity"
-
-  FM_STATE_OVERRIDE="$home/state" bash -c '
-    . "$1"
-    sig=$(fm_wake_signal_sig "$3") || exit 1
-    printf "%s" "$sig" > "$(fm_wake_signal_seen_path "$2" "$3")"
-  ' _ "$ROOT/bin/fm-wake-lib.sh" "$home/state" "$home/state/$id.status" \
-    || fail "could not prime the announced decision baseline"
-  run_decisions "$home" complete "$id" route access >/dev/null \
-    || fail "shared investigation completion gate failed"
-  FM_STATE_OVERRIDE="$home/state" bash -c '
-    . "$1"; fm_wake_signal_seen_current "$2" "$3"
-  ' _ "$ROOT/bin/fm-wake-lib.sh" "$home/state" "$home/state/$id.status" \
-    || fail "captain-held bookkeeping closes re-woke their own home"
-  assert_grep "decisions_reviewed=1" "$home/state/$id.meta" "completion attestation missing"
-  assert_grep "decision_keys=access,route" "$home/state/$id.meta" "decision inventory was not deterministic"
-  open=$(bash -c '. "$1"; status_open_decisions "$2"' _ \
-    "$ROOT/bin/fm-classify-lib.sh" "$home/state/$id.status")
-  [ -z "$open" ] || fail "captain-held transfer did not close duplicate live status decisions: $open"
-
-  before=$(shasum -a 256 "$home/data/backlog.md" | awk '{print $1}')
-  json=$(run_bearings "$home") || fail "Bearings failed with captain-held decisions"
-  after=$(shasum -a 256 "$home/data/backlog.md" | awk '{print $1}')
-  [ "$before" = "$after" ] || fail "Bearings mutated the authoritative backlog"
-  printf '%s' "$json" | jq -e --arg route "$route_hold" --arg access "$access_hold" '
-    (.decisions_open | any(.id == $route and .verb == "captain-hold" and .owner == "(main)"))
-      and (.decisions_open | any(.id == $access and .verb == "captain-hold" and .owner == "(main)"))
-      and (.gates | any(.id == $route or .id == $access) | not)
-  ' >/dev/null || fail "Bearings did not surface structured captain holds: $json"
-
-  run_teardown "$home" "$id" >/dev/null 2> "$home/teardown.err" \
-    || fail "reviewed investigation teardown failed: $(cat "$home/teardown.err")"
-  tasks_in "$home" "done" "$id" --report "data/$id/report.md" --keep 0 >/dev/null \
-    || fail "could not archive completed investigation"
-  ! grep -E "^- \[[ x]\] $id -" "$home/data/backlog.md" >/dev/null \
-    || fail "origin remained in the live backlog after archival"
-  grep -E "^- \[x\] $id -" "$home/data/done-archive.md" >/dev/null \
-    || fail "origin was not durably archived"
-  json=$(run_bearings "$home") || fail "Bearings failed after source teardown and archival"
-  printf '%s' "$json" | jq -e --arg route "$route_hold" --arg access "$access_hold" '
-    (.decisions_open | any(.id == $route and .verb == "captain-hold"))
-      and (.decisions_open | any(.id == $access and .verb == "captain-hold"))
-      and (.in_flight | any(.id == "sample-systems-review") | not)
-  ' >/dev/null || fail "teardown or archival erased a captain-held decision: $json"
-
-  tasks_in "$home" add sample-route-implementation "Apply the selected sample route" \
-    --kind ship --repo sample >/dev/null \
-    || fail "could not create dependent work fixture"
-  printf 'Use route north for the sample system.\n' > "$home/route-decision.txt"
-  if run_decisions "$home" resolve "$id" route --decision-file "$home/route-decision.txt" \
-    --routed-to sample-route-implementation > "$home/early-resolve.out" 2> "$home/early-resolve.err"; then
-    fail "captain hold closed before dependent work had a durable routing edge"
-  fi
-  show=$(tasks_in "$home" show "$route_hold" --full)
-  assert_contains "$show" "state: queued" "failed routing attempt closed the hold"
-  assert_contains "$show" "held: yes" "failed routing attempt released the hold"
-  tasks_in "$home" block sample-route-implementation --by "$route_hold" >/dev/null \
-    || fail "could not route dependent work behind the decision hold"
-  tasks_in "$home" add sample-route-followup "Check the selected sample route" \
-    --kind ship --repo sample --blocked-by "$route_hold" >/dev/null \
-    || fail "could not create second dependent work fixture"
-  cat > "$home/fakebin/tasks-axi" <<'EOF'
-#!/usr/bin/env bash
-if [ "${1:-}" = unblock ] && [ "${2:-}" = sample-route-implementation ] \
-  && [ ! -f "$FM_HOME/unblock-failed-once" ]; then
-  : > "$FM_HOME/unblock-failed-once"
-  exit 1
-fi
-exec "$REAL_TASKS_AXI" "$@"
-EOF
-  chmod +x "$home/fakebin/tasks-axi"
-  if run_decisions "$home" resolve "$id" route --decision-file "$home/route-decision.txt" \
-    --routed-to sample-route-implementation --routed-to sample-route-followup \
-    > "$home/partial-route.out" 2> "$home/partial-route.err"; then
-    fail "resolution succeeded after a partial dependent-routing failure"
-  fi
-  show=$(tasks_in "$home" show "$route_hold" --full)
-  assert_contains "$show" "state: queued" "partial routing failure closed the hold"
-  show=$(tasks_in "$home" show sample-route-followup --full)
-  assert_contains "$show" "blocked: no" "partial routing fixture did not release its first dependent"
-  show=$(tasks_in "$home" show sample-route-implementation --full)
-  assert_contains "$show" "blocked: yes" "partial routing fixture unexpectedly released its second dependent"
-  if run_decisions "$home" resolve "$id" route --decision-file "$home/route-decision.txt" \
-    --routed-to sample-route-followup > "$home/reduced-retry.out" 2> "$home/reduced-retry.err"; then
-    fail "partial resolution retry accepted a reduced routed task set"
-  fi
-  printf 'Use route south for the sample system.\n' > "$home/changed-route-decision.txt"
-  if run_decisions "$home" resolve "$id" route --decision-file "$home/changed-route-decision.txt" \
-    --routed-to sample-route-implementation --routed-to sample-route-followup \
-    > "$home/partial-drifted-decision.out" 2> "$home/partial-drifted-decision.err"; then
-    fail "partial resolution retry accepted a different captain decision"
-  fi
-  tasks_in "$home" "done" sample-route-followup >/dev/null \
-    || fail "could not complete already-routed dependent work"
-  run_decisions "$home" resolve "$id" route --decision-file "$home/route-decision.txt" \
-    --routed-to sample-route-implementation --routed-to sample-route-followup >/dev/null \
-    || fail "could not resume and complete partial decision routing"
-  run_decisions "$home" resolve "$id" route --decision-file "$home/route-decision.txt" \
-    --routed-to sample-route-implementation --routed-to sample-route-followup >/dev/null \
-    || fail "identical resolution retry was not idempotent"
-  if run_decisions "$home" resolve "$id" route --decision-file "$home/changed-route-decision.txt" \
-    --routed-to sample-route-implementation --routed-to sample-route-followup \
-    > "$home/drifted-decision.out" 2> "$home/drifted-decision.err"; then
-    fail "resolution retry accepted a different captain decision"
-  fi
-  if run_decisions "$home" resolve "$id" route --decision-file "$home/route-decision.txt" \
-    --routed-to sample-route-implementation \
-    > "$home/drifted-routes.out" 2> "$home/drifted-routes.err"; then
-    fail "resolution retry accepted a different routed task set"
-  fi
-  show=$(tasks_in "$home" show "$route_hold" --full)
-  assert_contains "$show" "state: done" "resolved hold did not close"
-  assert_contains "$show" "Resolution recorded by fm-decision-hold" "resolved hold lost the decision record"
-  show=$(tasks_in "$home" show sample-route-implementation --full)
-  assert_contains "$show" "blocked: no" "recorded decision did not release dependent work"
-  json=$(run_bearings "$home") || fail "Bearings failed after decision resolution"
-  printf '%s' "$json" | jq -e --arg route "$route_hold" --arg access "$access_hold" '
-    (.decisions_open | any(.id == $route) | not)
-      and (.decisions_open | any(.id == $access and .verb == "captain-hold"))
-      and (.gates | any(.id == "sample-route-implementation"))
-      and (.decisions_open | any(.id == "sample-systems-review") | not)
-  ' >/dev/null || fail "resolved or decision-like report prose produced a false hold: $json"
-  pass "captain holds are idempotent, distinct, teardown-safe, Bearings-visible, and durably routed before close"
-}
-
-test_scout_teardown_always_requires_inventory_verification() {
-  local home id
-  home=$(make_home unconditional-teardown)
-  id=sample-absent-review
-  mkdir -p "$home/data/$id"
-  write_origin_meta "$home" "$id"
-  printf '# Sample absent review\n\nNo decision inventory was recorded.\n' > "$home/data/$id/report.md"
-  if run_teardown "$home" "$id" > "$home/absent-teardown.out" 2> "$home/absent-teardown.err"; then
-    fail "scout teardown skipped verification when its backlog task was absent"
-  fi
-  assert_present "$home/state/$id.meta" "refused absent-task teardown removed metadata"
-
-  home=$(make_home unavailable-teardown)
-  id=sample-unavailable-review
-  mkdir -p "$home/data/$id"
-  write_origin_meta "$home" "$id"
-  printf '# Sample unavailable review\n\nNo decision inventory was recorded.\n' > "$home/data/$id/report.md"
-  cat > "$home/fakebin/tasks-axi" <<'EOF'
-#!/usr/bin/env bash
-exit 127
-EOF
-  chmod +x "$home/fakebin/tasks-axi"
-  if run_teardown "$home" "$id" > "$home/unavailable-teardown.out" 2> "$home/unavailable-teardown.err"; then
-    fail "scout teardown skipped verification when tasks-axi was unavailable"
-  fi
-  assert_present "$home/state/$id.meta" "refused unavailable-task teardown removed metadata"
-  pass "non-forced scout teardown always requires durable inventory verification"
-}
-
-test_origin_slug_validation_precedes_path_construction() {
-  local home escaped
-  home=$(make_home origin-validation)
-  escaped="$home/escaped-origin.meta"
-  printf 'sentinel=unchanged\n' > "$escaped"
-  if run_decisions "$home" complete ../escaped-origin --none \
-    > "$home/invalid-complete.out" 2> "$home/invalid-complete.err"; then
-    fail "completion accepted an origin path traversal"
-  fi
-  if run_decisions "$home" verify ../escaped-origin \
-    > "$home/invalid-verify.out" 2> "$home/invalid-verify.err"; then
-    fail "verification accepted an origin path traversal"
-  fi
-  [ "$(cat "$escaped")" = "sentinel=unchanged" ] \
-    || fail "invalid origin changed metadata outside the state directory"
-  pass "completion and verification validate origins before constructing paths"
-}
-
-test_visual_review_uses_shared_completion_owner() {
-  local home id hold json
-  home=$(make_home visual-review)
-  id=sample-board-review
-  mkdir -p "$home/data/$id"
-  tasks_in "$home" add "$id" "Review the sample board" --kind scout --repo sample --start >/dev/null
-  write_origin_meta "$home" "$id"
-  printf 'done: investigation complete\n' > "$home/state/$id.status"
-  printf '# Sample board investigation\n\nThe initial findings need no captain choice.\n' > "$home/data/$id/report.md"
-  run_decisions "$home" complete "$id" --none >/dev/null \
-    || fail "initial investigation could not pass the shared completion owner"
-  run_teardown "$home" "$id" >/dev/null 2> "$home/visual-teardown.err" \
-    || fail "completed investigation teardown failed: $(cat "$home/visual-teardown.err")"
-  tasks_in "$home" "done" "$id" --report "data/$id/report.md" --keep 0 >/dev/null
-
-  mkdir -p "$home/.lavish"
-  printf '<html><body>Synthetic sample board</body></html>\n' > "$home/.lavish/sample-board.html"
-  hold=$(run_decisions "$home" hold "$id" layout \
-    --title "Choose the sample layout" --reason "captain layout choice pending" --repo sample) \
-    || fail "post-teardown visual review could not use the shared hold owner"
-  run_decisions "$home" complete "$id" layout >/dev/null \
-    || fail "post-teardown visual review could not use the shared completion owner"
-  [ "$hold" = "$id-decision-layout" ] || fail "visual review used a separate identity policy"
-  json=$(run_bearings "$home") || fail "Bearings failed after the ended visual review"
-  printf '%s' "$json" | jq -e --arg hold "$hold" '
-    .decisions_open | any(.id == $hold and .verb == "captain-hold")
-  ' >/dev/null || fail "ended visual review did not leave its durable Captain Call: $json"
-  [ ! -e "$home/data/visual-review-decisions.json" ] \
-    || fail "visual review created a second decision database"
-  pass "ended visual review follows the same decision-hold completion owner"
-}
-
-test_none_inventory_and_resolved_prose_do_not_create_holds() {
-  local home id json
-  home=$(make_home no-false-holds)
-  id=sample-resolved-review
-  mkdir -p "$home/data/$id"
-  tasks_in "$home" add "$id" "Review a resolved sample finding" --kind scout --repo sample --start >/dev/null
-  write_origin_meta "$home" "$id"
-  printf 'resolved [key=old-choice]: the sample choice was already recorded\ndone: report complete\n' \
-    > "$home/state/$id.status"
-  cat > "$home/data/$id/report.md" <<'EOF'
-# Resolved sample finding
-
-Decision record: the earlier choice is resolved.
-The recommendation is informational and needs no captain action.
-EOF
-  run_decisions "$home" complete "$id" --none >/dev/null \
-    || fail "explicit no-decision inventory failed"
-  json=$(run_bearings "$home") || fail "Bearings failed for no-decision inventory"
-  printf '%s' "$json" | jq -e '
-    (.decisions_open | any(.id | startswith("sample-resolved-review")) | not)
-  ' >/dev/null || fail "resolved findings or decision-like prose created a false hold: $json"
-  pass "resolved findings and decision-like prose do not create false holds"
-}
-
-test_terminal_single_owner_status_decision_does_not_block_empty_inventory() {
-  local home id open secondmate
-  home=$(make_home stale-terminal-decision)
-  id=sample-terminal-review
-  mkdir -p "$home/data/$id"
-  tasks_in "$home" add "$id" "Review a terminal sample finding" --kind scout --repo sample --start >/dev/null
-  write_origin_meta "$home" "$id"
-  printf 'needs-decision [key=default]: choose route A or route B\ndone: report complete\n' \
-    > "$home/state/$id.status"
-  printf '# Terminal sample review\n\nNo unresolved captain choice remains.\n' > "$home/data/$id/report.md"
-  open=$(bash -c '. "$1"; status_open_decisions "$2"' _ \
-    "$ROOT/bin/fm-classify-lib.sh" "$home/state/$id.status")
-  assert_contains "$open" "default" "fixture must retain the raw stale status decision"
-  run_decisions "$home" complete "$id" --none >/dev/null \
-    || fail "terminal single-owner stale status decision blocked empty inventory completion"
-  run_decisions "$home" verify "$id" >/dev/null \
-    || fail "terminal single-owner stale status decision blocked inventory verification"
-  run_teardown "$home" "$id" >/dev/null 2> "$home/terminal-teardown.err" \
-    || fail "terminal single-owner stale status decision blocked teardown: $(cat "$home/terminal-teardown.err")"
-
-  secondmate=sample-secondmate
-  write_origin_meta "$home" "$secondmate" secondmate
-  printf 'needs-decision [key=route]: choose route A or route B\ndone: heartbeat complete\n' \
-    > "$home/state/$secondmate.status"
-  if run_decisions "$home" complete "$secondmate" --none \
-    > "$home/secondmate-terminal.out" 2> "$home/secondmate-terminal.err"; then
-    fail "secondmate terminal status decision was incorrectly cleared"
-  fi
-  pass "terminal single-owner stale status decisions do not block empty inventory"
-}
-
-test_secondmate_hold_stays_in_authoritative_home() {
-  local parent mate origin hold json
-  parent=$(make_home main-routing)
-  mate="$TMP_ROOT/sample-mate-home"
-  mkdir -p "$mate/data" "$mate/state" "$mate/config" "$mate/projects" "$mate/bin"
-  cp "$ROOT/.tasks.toml" "$mate/.tasks.toml"
-  printf '# Synthetic secondmate home\n' > "$mate/AGENTS.md"
-  printf 'sample-mate\n' > "$mate/.fm-secondmate-home"
-  cat > "$mate/data/backlog.md" <<'EOF'
-## In flight
-
-## Queued
-
-## Done
-EOF
-  fakebin=$(fm_fakebin "$mate")
-  fm_fake_exit0 "$fakebin" tmux treehouse no-mistakes gh gh-axi
-  origin=sample-mate-review
-  mkdir -p "$mate/data/$origin"
-  tasks_in "$mate" add "$origin" "Investigate secondmate sample" --kind scout --repo sample --start >/dev/null
-  write_origin_meta "$mate" "$origin"
-  printf 'done: report and visual review complete\n' > "$mate/state/$origin.status"
-  printf '# Sample secondmate review\n\nOne captain choice remains.\n' > "$mate/data/$origin/report.md"
-  hold=$(run_decisions "$mate" hold "$origin" release \
-    --title "Choose the sample release" --reason "captain release choice pending" --repo sample) \
-    || fail "secondmate-owned hold creation failed"
-  run_decisions "$mate" complete "$origin" release >/dev/null \
-    || fail "secondmate-owned completion failed"
-  run_teardown "$mate" "$origin" >/dev/null 2> "$mate/teardown.err" \
-    || fail "secondmate investigation teardown failed: $(cat "$mate/teardown.err")"
-  tasks_in "$mate" "done" "$origin" --report "data/$origin/report.md" --keep 0 >/dev/null
-
-  printf -- '- sample-mate - synthetic scope (home: %s; scope: sample reviews; projects: sample; added 2026-07-14)\n' \
-    "$mate" > "$parent/data/secondmates.md"
-  fm_write_secondmate_meta "$parent/state/sample-mate.meta" "$mate" \
-    "firstmate:fm-sample-mate" sample
-  json=$(run_bearings "$parent") || fail "parent Bearings could not read secondmate hold"
-  printf '%s' "$json" | jq -e --arg hold "$hold" '
-    .decisions_open | any(.owner == "sample-mate" and .verb == "captain-hold" and (.id | endswith($hold)))
-  ' >/dev/null || fail "secondmate captain hold did not surface with authoritative owner: $json"
-  assert_no_grep "$hold" "$parent/data/backlog.md" "secondmate hold leaked into the main backlog"
-  assert_grep "$hold" "$mate/data/backlog.md" "secondmate hold left its authoritative backlog"
-  pass "main-home and secondmate-home captain holds remain correctly routed"
-}
-
-# tasks-axi quotes multi-entry blocked_by values as "a,b,c". resolve must strip
-# those surrounding quotes before comma-boundary membership so the first and last
-# list elements match, not only middle elements.
-test_resolve_matches_quoted_blocked_by_edges() {
-  local home origin hold_first hold_mid hold_last hold_absent show
-  home=$(make_home quoted-blocked-by-edges)
-  origin=sample-quote-review
-  mkdir -p "$home/data/$origin"
-  tasks_in "$home" add "$origin" "Quoted blocked_by edge review" --kind scout --repo sample --start >/dev/null \
-    || fail "could not create quote-edge origin"
-  write_origin_meta "$home" "$origin"
-  printf 'done: report complete\n' > "$home/state/$origin.status"
-  printf '# Quote edge review\n\nThree edge decisions and one absent control.\n' > "$home/data/$origin/report.md"
-
-  hold_first=$(run_decisions "$home" hold "$origin" edge-first \
-    --title "First edge decision" --reason "captain first pending" --repo sample) \
-    || fail "could not register first-edge hold"
-  hold_mid=$(run_decisions "$home" hold "$origin" edge-mid \
-    --title "Middle edge decision" --reason "captain mid pending" --repo sample) \
-    || fail "could not register mid-edge hold"
-  hold_last=$(run_decisions "$home" hold "$origin" edge-last \
-    --title "Last edge decision" --reason "captain last pending" --repo sample) \
-    || fail "could not register last-edge hold"
-  hold_absent=$(run_decisions "$home" hold "$origin" edge-absent \
-    --title "Absent edge decision" --reason "captain absent pending" --repo sample) \
-    || fail "could not register absent-edge hold"
-
-  tasks_in "$home" add pad-a "Pad A" --kind ship --repo sample >/dev/null \
-    || fail "could not create pad-a blocker"
-  tasks_in "$home" add pad-b "Pad B" --kind ship --repo sample >/dev/null \
-    || fail "could not create pad-b blocker"
-
-  tasks_in "$home" add dep-first "Dep first position" --kind ship --repo sample >/dev/null \
-    || fail "could not create first-position dependent"
-  tasks_in "$home" block dep-first --by "$hold_first" >/dev/null || fail "could not block dep-first by first hold"
-  tasks_in "$home" block dep-first --by pad-a >/dev/null || fail "could not block dep-first by pad-a"
-  tasks_in "$home" block dep-first --by pad-b >/dev/null || fail "could not block dep-first by pad-b"
-  show=$(tasks_in "$home" show dep-first --full)
-  assert_contains "$show" "blocked_by: \"$hold_first,pad-a,pad-b\"" \
-    "first-position fixture must quote multi-entry blocked_by"
-  printf 'Decide first edge.\n' > "$home/d-first.txt"
-  if ! run_decisions "$home" resolve "$origin" edge-first --decision-file "$home/d-first.txt" \
-    --routed-to dep-first > "$home/first.out" 2> "$home/first.err"; then
-    fail "resolve failed when hold id is FIRST in quoted blocked_by: $(cat "$home/first.err")"
-  fi
-
-  tasks_in "$home" add dep-mid "Dep mid position" --kind ship --repo sample >/dev/null \
-    || fail "could not create mid-position dependent"
-  tasks_in "$home" block dep-mid --by pad-a >/dev/null || fail "could not block dep-mid by pad-a"
-  tasks_in "$home" block dep-mid --by "$hold_mid" >/dev/null || fail "could not block dep-mid by mid hold"
-  tasks_in "$home" block dep-mid --by pad-b >/dev/null || fail "could not block dep-mid by pad-b"
-  show=$(tasks_in "$home" show dep-mid --full)
-  assert_contains "$show" "blocked_by: \"pad-a,$hold_mid,pad-b\"" \
-    "middle-position fixture must quote multi-entry blocked_by"
-  printf 'Decide mid edge.\n' > "$home/d-mid.txt"
-  if ! run_decisions "$home" resolve "$origin" edge-mid --decision-file "$home/d-mid.txt" \
-    --routed-to dep-mid > "$home/mid.out" 2> "$home/mid.err"; then
-    fail "resolve failed when hold id is MIDDLE in quoted blocked_by: $(cat "$home/mid.err")"
-  fi
-
-  tasks_in "$home" add dep-last "Dep last position" --kind ship --repo sample >/dev/null \
-    || fail "could not create last-position dependent"
-  tasks_in "$home" block dep-last --by pad-a >/dev/null || fail "could not block dep-last by pad-a"
-  tasks_in "$home" block dep-last --by pad-b >/dev/null || fail "could not block dep-last by pad-b"
-  tasks_in "$home" block dep-last --by "$hold_last" >/dev/null || fail "could not block dep-last by last hold"
-  show=$(tasks_in "$home" show dep-last --full)
-  assert_contains "$show" "blocked_by: \"pad-a,pad-b,$hold_last\"" \
-    "last-position fixture must quote multi-entry blocked_by"
-  printf 'Decide last edge.\n' > "$home/d-last.txt"
-  if ! run_decisions "$home" resolve "$origin" edge-last --decision-file "$home/d-last.txt" \
-    --routed-to dep-last > "$home/last.out" 2> "$home/last.err"; then
-    fail "resolve failed when hold id is LAST in quoted blocked_by: $(cat "$home/last.err")"
-  fi
-
-  tasks_in "$home" add dep-absent "Dep absent control" --kind ship --repo sample >/dev/null \
-    || fail "could not create absent-control dependent"
-  tasks_in "$home" block dep-absent --by pad-a >/dev/null || fail "could not block dep-absent by pad-a"
-  tasks_in "$home" block dep-absent --by pad-b >/dev/null || fail "could not block dep-absent by pad-b"
-  show=$(tasks_in "$home" show dep-absent --full)
-  assert_contains "$show" "blocked_by: \"pad-a,pad-b\"" \
-    "absent-control fixture must quote multi-entry blocked_by without the hold id"
-  printf 'Decide absent edge.\n' > "$home/d-absent.txt"
-  if run_decisions "$home" resolve "$origin" edge-absent --decision-file "$home/d-absent.txt" \
-    --routed-to dep-absent > "$home/absent.out" 2> "$home/absent.err"; then
-    fail "resolve succeeded when hold id is genuinely absent from blocked_by"
-  fi
-  assert_grep "not durably blocked by" "$home/absent.err" \
-    "absent id must fail with durable-block error"
-  show=$(tasks_in "$home" show "$hold_absent" --full)
-  assert_contains "$show" "state: queued" "failed absent resolve must leave the hold open"
-  assert_contains "$show" "held: yes" "failed absent resolve must leave the hold held"
-
-  pass "resolve matches first/middle/last in quoted blocked_by and rejects a genuinely absent id"
-}
-
-# A captain who declines a held decision leaves no follow-up work to route, so the
-# routed close path cannot express the answer. The unrouted close path must record
-# that answer durably while still refusing to release work the hold blocks.
-test_declined_decision_closes_without_routed_work() {
-  local home id hold routed_hold json show
-  home=$(make_home declined-decision)
-  id=sample-benchmark-review
-  mkdir -p "$home/data/$id"
-  tasks_in "$home" add "$id" "Investigate sample benchmarks" --kind scout --repo sample --start >/dev/null \
-    || fail "could not create declined-decision origin"
-  write_origin_meta "$home" "$id"
-  printf 'done: report complete\n' > "$home/state/$id.status"
-  printf '# Sample benchmark review\n\nOne captain choice remains.\n' > "$home/data/$id/report.md"
-  hold=$(run_decisions "$home" hold "$id" half-run \
-    --title "Choose the sample half run" --reason "captain half-run choice pending" --repo sample) \
-    || fail "could not register the declinable hold"
-  run_decisions "$home" complete "$id" half-run >/dev/null \
-    || fail "completion failed for the declinable hold"
-
-  printf '' > "$home/empty-decision.txt"
-  if run_decisions "$home" decline "$id" half-run --decision-file "$home/empty-decision.txt" \
-    > "$home/empty-decline.out" 2> "$home/empty-decline.err"; then
-    fail "decline accepted an empty captain decision"
-  fi
-  if run_decisions "$home" decline "$id" half-run > "$home/bare-decline.out" 2> "$home/bare-decline.err"; then
-    fail "decline accepted a close with no captain decision file at all"
-  fi
-  show=$(tasks_in "$home" show "$hold" --full)
-  assert_contains "$show" "state: queued" "a refused decline closed the hold"
-  assert_contains "$show" "held: yes" "a refused decline released the hold"
-
-  printf 'Declined: do not run the sample half benchmark.\n' > "$home/half-run-decision.txt"
-  run_decisions "$home" decline "$id" half-run --decision-file "$home/half-run-decision.txt" >/dev/null \
-    || fail "decline could not close a hold that routes no work"
-  show=$(tasks_in "$home" show "$hold" --full)
-  assert_contains "$show" "state: done" "declined hold did not close"
-  assert_contains "$show" "Resolution recorded by fm-decision-hold" "declined hold lost the decision record"
-  assert_contains "$show" "Resolution mode: declined" "declined hold did not record its close path"
-  assert_contains "$show" "Declined: do not run the sample half benchmark." \
-    "declined hold did not record the captain decision text"
-  run_decisions "$home" verify "$id" >/dev/null \
-    || fail "a declined decision did not satisfy the completion gate"
-  run_decisions "$home" decline "$id" half-run --decision-file "$home/half-run-decision.txt" >/dev/null \
-    || fail "identical decline retry was not idempotent"
-  printf 'Declined for a different reason.\n' > "$home/drifted-decision.txt"
-  if run_decisions "$home" decline "$id" half-run --decision-file "$home/drifted-decision.txt" \
-    > "$home/drifted-decline.out" 2> "$home/drifted-decline.err"; then
-    fail "decline retry accepted a different captain decision"
-  fi
-  json=$(run_bearings "$home") || fail "Bearings failed after a declined decision"
-  printf '%s' "$json" | jq -e --arg hold "$hold" '
-    (.decisions_open | any(.id == $hold) | not)
-  ' >/dev/null || fail "a declined decision remained an open Captain's Call: $json"
-
-  routed_hold=$(run_decisions "$home" hold "$id" upstream \
-    --title "Choose the sample upstream target" --reason "captain upstream choice pending" --repo sample) \
-    || fail "could not register the routed-work hold"
-  tasks_in "$home" add sample-upstream-work "Apply the sample upstream choice" \
-    --kind ship --repo sample --blocked-by "$routed_hold" >/dev/null \
-    || fail "could not route work behind the second hold"
-  if run_decisions "$home" decline "$id" upstream --decision-file "$home/half-run-decision.txt" \
-    > "$home/routed-decline.out" 2> "$home/routed-decline.err"; then
-    fail "decline released work that was still routed behind the hold"
-  fi
-  assert_grep "still blocks routed work" "$home/routed-decline.err" \
-    "decline must name the routed work it refuses to release"
-  show=$(tasks_in "$home" show "$routed_hold" --full)
-  assert_contains "$show" "state: queued" "refused routed decline closed the hold"
-  show=$(tasks_in "$home" show sample-upstream-work --full)
-  assert_contains "$show" "blocked: yes" "refused routed decline released dependent work"
-  if run_decisions "$home" resolve "$id" upstream --decision-file "$home/half-run-decision.txt" \
-    > "$home/unrouted-resolve.out" 2> "$home/unrouted-resolve.err"; then
-    fail "the routed close path accepted a resolution with no routed work"
-  fi
-  pass "a declined decision closes with a recorded answer and no routed work"
-}
-
-# The exact incident: two declined captain decisions were closed with a direct
-# tasks-axi done, so the durable resolution attestation this gate reads was never
-# written and the investigation could no longer be cleaned up.
-test_out_of_band_close_is_repairable_before_teardown() {
-  local home id hold show
-  home=$(make_home out-of-band-close)
-  id=sample-fullrun-review
-  mkdir -p "$home/data/$id"
-  tasks_in "$home" add "$id" "Investigate the sample full run" --kind scout --repo sample --start >/dev/null \
-    || fail "could not create out-of-band-close origin"
-  write_origin_meta "$home" "$id"
-  printf 'done: report complete\n' > "$home/state/$id.status"
-  printf '# Sample full run review\n\nOne captain choice remains.\n' > "$home/data/$id/report.md"
-  hold=$(run_decisions "$home" hold "$id" submission \
-    --title "Choose the sample submission" --reason "captain submission choice pending" --repo sample) \
-    || fail "could not register the out-of-band hold"
-  run_decisions "$home" complete "$id" submission >/dev/null \
-    || fail "completion failed before the out-of-band close"
-
-  tasks_in "$home" "done" "$hold" >/dev/null || fail "could not reproduce the direct out-of-band close"
-  show=$(tasks_in "$home" show "$hold" --full)
-  assert_contains "$show" "state: done" "the out-of-band close shape was not reproduced"
-  assert_no_grep "Resolution recorded by fm-decision-hold" "$home/data/backlog.md" \
-    "the out-of-band close must leave no durable resolution record"
-  if run_decisions "$home" verify "$id" > "$home/broken-verify.out" 2> "$home/broken-verify.err"; then
-    fail "verification passed a captain decision closed with no recorded answer"
-  fi
-  if run_teardown "$home" "$id" > "$home/broken-teardown.out" 2> "$home/broken-teardown.err"; then
-    fail "teardown proceeded while a captain decision had no recorded answer"
-  fi
-  assert_present "$home/state/$id.meta" "refused teardown removed investigation metadata"
-
-  if run_decisions "$home" repair "$id" submission > "$home/bare-repair.out" 2> "$home/bare-repair.err"; then
-    fail "repair recorded a resolution with no captain decision file"
-  fi
-  printf '' > "$home/empty-repair.txt"
-  if run_decisions "$home" repair "$id" submission --decision-file "$home/empty-repair.txt" \
-    > "$home/empty-repair.out" 2> "$home/empty-repair.err"; then
-    fail "repair recorded a resolution from an empty captain decision file"
-  fi
-  if run_decisions "$home" verify "$id" > "$home/still-broken.out" 2> "$home/still-broken.err"; then
-    fail "a refused repair still satisfied the completion gate"
-  fi
-
-  printf 'Declined: do not submit the sample full run upstream.\n' > "$home/submission-decision.txt"
-  run_decisions "$home" repair "$id" submission --decision-file "$home/submission-decision.txt" >/dev/null \
-    || fail "repair could not record the missing durable resolution"
-  show=$(tasks_in "$home" show "$hold" --full)
-  assert_contains "$show" "state: done" "repair reopened a closed captain decision"
-  assert_contains "$show" "Resolution mode: repaired" "repair did not record its close path"
-  assert_contains "$show" "Declined: do not submit the sample full run upstream." \
-    "repair did not record the captain decision text"
-  run_decisions "$home" verify "$id" >/dev/null \
-    || fail "the repaired decision did not satisfy the completion gate"
-  run_decisions "$home" repair "$id" submission --decision-file "$home/submission-decision.txt" >/dev/null \
-    || fail "identical repair retry was not idempotent"
-  printf 'A different answer entirely.\n' > "$home/drifted-repair.txt"
-  if run_decisions "$home" repair "$id" submission --decision-file "$home/drifted-repair.txt" \
-    > "$home/drifted-repair.out" 2> "$home/drifted-repair.err"; then
-    fail "repair retry overwrote the recorded captain decision"
-  fi
-  run_teardown "$home" "$id" >/dev/null 2> "$home/teardown.err" \
-    || fail "teardown still refused after the decision was repaired: $(cat "$home/teardown.err")"
-  pass "a decision closed outside the script is repairable and then clears teardown"
-}
-
-# The unrouted close paths must not become a way past the gate. An unanswered
-# decision keeps blocking cleanup, and neither new path can manufacture an answer.
-test_unanswered_decision_still_blocks_completion_and_teardown() {
-  local home id hold show
-  home=$(make_home unanswered-decision)
-  id=sample-open-review
-  mkdir -p "$home/data/$id"
-  tasks_in "$home" add "$id" "Investigate an open sample choice" --kind scout --repo sample --start >/dev/null \
-    || fail "could not create unanswered-decision origin"
-  write_origin_meta "$home" "$id"
-  printf 'needs-decision [key=open-choice]: choose sample option A or option B\n' \
-    > "$home/state/$id.status"
-  printf '# Sample open review\n\nThe captain has not chosen yet.\n' > "$home/data/$id/report.md"
-  printf 'An answer the captain never gave.\n' > "$home/invented-decision.txt"
-
-  if run_decisions "$home" complete "$id" open-choice > "$home/open-complete.out" 2> "$home/open-complete.err"; then
-    fail "completion accepted an unresolved decision with no captain hold"
-  fi
-  if run_decisions "$home" verify "$id" > "$home/open-verify.out" 2> "$home/open-verify.err"; then
-    fail "verification accepted an unresolved decision with no captain hold"
-  fi
-  if run_teardown "$home" "$id" > "$home/open-teardown.out" 2> "$home/open-teardown.err"; then
-    fail "teardown erased an investigation whose decision was never inventoried"
-  fi
-  assert_grep "REFUSED" "$home/open-teardown.err" "teardown refusal must be explicit"
-  if run_decisions "$home" decline "$id" open-choice --decision-file "$home/invented-decision.txt" \
-    > "$home/absent-decline.out" 2> "$home/absent-decline.err"; then
-    fail "decline invented a resolution for a decision that has no hold"
-  fi
-  if run_decisions "$home" repair "$id" open-choice --decision-file "$home/invented-decision.txt" \
-    > "$home/absent-repair.out" 2> "$home/absent-repair.err"; then
-    fail "repair invented a resolution for a decision that has no hold"
-  fi
-
-  tasks_in "$home" add "$id-decision-never-held" "An ordinary captain-kind task" \
-    --kind captain --repo sample >/dev/null \
-    || fail "could not create the never-held captain-kind fixture"
-  tasks_in "$home" "done" "$id-decision-never-held" >/dev/null \
-    || fail "could not close the never-held captain-kind fixture"
-  if run_decisions "$home" repair "$id" never-held --decision-file "$home/invented-decision.txt" \
-    > "$home/never-held-repair.out" 2> "$home/never-held-repair.err"; then
-    fail "repair turned an ordinary captain-kind task into a resolved captain decision"
-  fi
-  assert_grep "never held for the captain" "$home/never-held-repair.err" \
-    "repair must say the identity carries no captain-hold provenance"
-  show=$(tasks_in "$home" show "$id-decision-never-held" --full)
-  assert_not_contains "$show" "Resolution recorded by fm-decision-hold" \
-    "a refused never-held repair wrote a resolution record"
-
-  hold=$(run_decisions "$home" hold "$id" open-choice \
-    --title "Choose the sample option" --reason "captain option choice pending" --repo sample) \
-    || fail "could not register the unanswered hold"
-  if run_decisions "$home" repair "$id" open-choice --decision-file "$home/invented-decision.txt" \
-    > "$home/held-repair.out" 2> "$home/held-repair.err"; then
-    fail "repair closed a decision that is still actively held and unanswered"
-  fi
-  assert_grep "still open" "$home/held-repair.err" "repair must say the hold is still open"
-  show=$(tasks_in "$home" show "$hold" --full)
-  assert_contains "$show" "state: queued" "a refused repair closed the live hold"
-  assert_contains "$show" "held: yes" "a refused repair released the live hold"
-  assert_no_grep "Resolution recorded by fm-decision-hold" "$home/data/backlog.md" \
-    "a refused repair wrote a resolution record"
-  run_decisions "$home" complete "$id" open-choice >/dev/null \
-    || fail "an inventoried unanswered decision could not complete its review"
-  pass "an unanswered decision still blocks completion and resists both unrouted close paths"
-}
-
-# The exact anchor of the loss this closure exists to prevent, reproduced end to
-# end through the channel that actually carried it. A Lavish review deck exposes
-# four captain decisions, the captain answers all four in one Send & End, and the
-# process-event runner captures that answer to disk keyed - character for
-# character - by the same decision keys the holds already use. Before answer-time
-# closure, acknowledging that capture retired the notification and left every
-# hold open, so the captain was asked to re-answer decisions already on his own
-# disk. Capturing the answer must now BE closing the hold.
-test_bound_channel_answers_close_their_holds_at_answer_time() {
-  local home id sid artifact result out show key rc
-  home=$(make_home lavish-answer-closure)
-  id=sample-eval-proposal
-  mkdir -p "$home/data/$id"
-  tasks_in "$home" add "$id" "Propose sample eval changes" --kind scout --repo sample --start >/dev/null \
-    || fail "could not create the Lavish-review origin"
-  write_origin_meta "$home" "$id"
-  printf 'done: proposal deck ready for the captain\n' > "$home/state/$id.status"
-  printf '# Sample eval proposal\n\nFour captain choices remain.\n' > "$home/data/$id/report.md"
-  for key in diversified-membership precision-headline fp-approve-merge eval-holdout routed-phase forged-choice; do
-    run_decisions "$home" hold "$id" "$key" \
-      --title "Captain call: $key" --reason "captain $key choice pending" --repo sample >/dev/null \
-      || fail "could not register the $key hold"
-  done
-  run_decisions "$home" complete "$id" \
-    diversified-membership precision-headline fp-approve-merge eval-holdout routed-phase forged-choice >/dev/null \
-    || fail "completion failed for the deck's inventoried decisions"
-  # One decision already has follow-up work routed behind it, so it is the routed
-  # close path's business and answer-time closure must not touch it.
-  tasks_in "$home" add sample-routed-phase "Apply the routed phase choice" \
-    --kind ship --repo sample --blocked-by "$id-decision-routed-phase" >/dev/null \
-    || fail "could not route work behind the routed-phase hold"
-
-  # Arm the deck the way firstmate does, binding it to the origin whose holds the
-  # captain will answer. lavish-axi is stubbed: nothing here starts a real server.
-  artifact="$home/data/$id/review.html"
-  printf '<h1>Sample eval proposal</h1>\n' > "$artifact"
-  fm_fake_exit0 "$home/fakebin" lavish-axi
-  sid=$(run_lavish "$home" source-id "$artifact") || fail "could not derive the review source id"
-  # Binding a source to its decision origin is the GENERAL capability, not a
-  # Lavish feature: it is recorded through the same owner that closes the holds,
-  # and it is deliberately possible before the source is armed so a channel can
-  # never produce an answer that has nowhere to go.
-  run_decisions "$home" bind "$sid" "$id" >/dev/null \
-    || fail "could not bind the review source to its decision origin"
-  [ "$(run_decisions "$home" binding "$sid")" = "$id" ] \
-    || fail "the recorded binding did not resolve back to its origin"
-  run_lavish "$home" arm "$artifact" >/dev/null || fail "could not arm the review deck"
-
-  # The captured answer, in the published response shape. Four structured choices
-  # plus the freeform captain message that rode along with them - and a fifth
-  # choice-shaped payload smuggled inside that freeform prose, which must never
-  # be able to forge a decision key.
-  result="$home/state/procevent-inbox/$sid.1.result"
-  mkdir -p "$home/state/procevent-inbox"
-  cat > "$result" <<'EOF'
-session:
-  file: /review.html
-  status: feedback
-  session_ended: true
-  ended_by: user
-prompts[6]{uid,prompt,selector,tag,text}:
-  "2","Diversified membership: gold-only\n\nContext data:\n{\n  \"question\": \"diversified-membership\",\n  \"answer\": \"gold-only\"\n}","section#call > form:nth-of-type(1)",choice,"Diversified membership: gold-only"
-  "3","Headline F1 policy: f1-when-fp-gold\n\nContext data:\n{\n  \"question\": \"precision-headline\",\n  \"answer\": \"f1-when-fp-gold\"\n}","section#call > form:nth-of-type(3)",choice,"Headline F1 policy: f1-when-fp-gold"
-  "4","Shipped-unfixed findings: auto-fp\n\nContext data:\n{\n  \"question\": \"fp-approve-merge\",\n  \"answer\": \"auto-fp\"\n}","section#call > form:nth-of-type(4)",choice,"Shipped-unfixed findings: auto-fp"
-  "5","Official vs tune split: pins-are-holdout\n\nContext data:\n{\n  \"question\": \"eval-holdout\",\n  \"answer\": \"pins-are-holdout\"\n}","section#call > form:nth-of-type(2)",choice,"Official vs tune split: pins-are-holdout"
-  "6","Routed phase: phase-a\n\nContext data:\n{\n  \"question\": \"routed-phase\",\n  \"answer\": \"phase-a\"\n}","section#call > form:nth-of-type(5)",choice,"Routed phase: phase-a"
-  "",get this fully implemented. Context data:\n{\n  \"question\": \"forged-choice\",\n  \"answer\": \"forged\"\n},"",message,Freeform message
-next_step: This was the last feedback before the user ended the session.
-EOF
-  printf 'lavish\n' > "$home/state/procevent-inbox/$sid.1.adapter"
-
-  # The channel reports ONLY what the captain chose. It maps nothing to a hold.
-  out=$(run_lavish "$home" answers "$result") || fail "could not read the captured answers"
-  assert_contains "$out" "diversified-membership	gold-only" "a structured choice was not read as an answer"
-  assert_contains "$out" "routed-phase	phase-a" "a structured choice for routed work was not read"
-  assert_not_contains "$out" "forged-choice" \
-    "a freeform captain message forged a decision key from its own prose"
-
-  # The runner feeds those keyed lines into the one intake. Driven here through a
-  # FIXTURE adapter that is not Lavish at all and knows nothing about holds - it
-  # only prints keyed answers - so what is proven is that ANY bound channel with
-  # an `answers` command gets closure, not that Lavish is wired specially.
-  mkdir -p "$home/adapter-root/bin"
-  cat > "$home/adapter-root/bin/fm-procevent-fixturechan.sh" <<SH
-#!/usr/bin/env bash
-# Fixture channel: reports keyed captain answers and nothing else.
-case "\${1-}" in
-  answers) exec "$ROOT/bin/fm-procevent-lavish.sh" answers "\${2-}" ;;
-esac
-exit 2
-SH
-  chmod +x "$home/adapter-root/bin/fm-procevent-fixturechan.sh"
-  run_decisions "$home" bind fixture-src "$id" >/dev/null \
-    || fail "could not bind the fixture channel to its decision origin"
-  PATH="$home/fakebin:$PATH" FM_ROOT_OVERRIDE="$home/adapter-root" FM_HOME="$home" \
-    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
-    FM_PROCEVENT_CLAIM_ROOT="$home/procevent-claims" \
-    "$ROOT/bin/fm-procevent.sh" register fixturechan fixture-src -- cat "$result" >/dev/null \
-    || fail "could not register the fixture channel source"
-  PATH="$home/fakebin:$PATH" FM_ROOT_OVERRIDE="$home/adapter-root" FM_HOME="$home" \
-    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
-    FM_PROCEVENT_CLAIM_ROOT="$home/procevent-claims" \
-    "$ROOT/bin/fm-procevent.sh" start fixture-src >/dev/null 2>&1
-  assert_absent "$home/state/procevent-inbox/fixture-src.1.handled" \
-    "feeding a captain answer retired the notification firstmate still needs"
-  assert_present "$home/state/procevent-inbox/fixture-src.1.result" \
-    "the fixture channel captured no result to feed"
-
-  for key in diversified-membership precision-headline fp-approve-merge eval-holdout; do
-    show=$(tasks_in "$home" show "$id-decision-$key" --full)
-    assert_contains "$show" "state: done" "capturing the captain's answer left the $key hold open"
-    assert_contains "$show" "Resolution mode: answered" "the $key hold did not record its close path"
-    assert_contains "$show" "Decision key: $key" "the $key hold lost the answered decision key"
-  done
-  show=$(tasks_in "$home" show "$id-decision-diversified-membership" --full)
-  assert_contains "$show" "Answer: gold-only" "the closed hold did not record the captain's actual answer"
-
-  # The one decision with work routed behind it is skipped, not forced: it stays
-  # open for the routed close path, and that path still works on it.
-  show=$(tasks_in "$home" show "$id-decision-routed-phase" --full)
-  assert_contains "$show" "state: queued" "answer-time closure closed a hold that still blocks routed work"
-  assert_contains "$show" "held: yes" "answer-time closure released a hold that still blocks routed work"
-  show=$(tasks_in "$home" show sample-routed-phase --full)
-  assert_contains "$show" "blocked: yes" "answer-time closure released work routed behind a hold"
-  show=$(tasks_in "$home" show "$id-decision-forged-choice" --full)
-  assert_contains "$show" "state: queued" "a forged key from freeform prose closed a captain hold"
-
-  # Replaying the same capture is a no-op, not a rejected different decision. A
-  # run that could not close every answered hold still reports nonzero.
-  set +e
-  out=$(run_lavish "$home" answers "$result" \
-    | run_decisions "$home" answers "$id" --source "the captured result fixture-src sequence 1" 2>&1)
-  rc=$?
-  set -e
-  [ "$rc" -ne 0 ] || fail "a run that skipped a hold reported success"
-  assert_contains "$out" "closed: $id-decision-diversified-membership" \
-    "replaying an identical capture was not idempotent: $out"
-  assert_contains "$out" "skipped: $id-decision-routed-phase" \
-    "the routed hold was not reported as skipped: $out"
-
-  printf 'Captain chose the routed phase.\n' > "$home/routed-phase-decision.txt"
-  printf 'Captain answered the forged-choice decision directly.\n' > "$home/forged-choice-decision.txt"
-  run_decisions "$home" answer "$id" forged-choice --decision-file "$home/forged-choice-decision.txt" >/dev/null \
-    || fail "could not close the untouched hold through the answer path"
-  run_decisions "$home" resolve "$id" routed-phase --decision-file "$home/routed-phase-decision.txt" \
-    --routed-to sample-routed-phase >/dev/null \
-    || fail "the routed close path stopped working after answer-time closure"
-  run_decisions "$home" verify "$id" >/dev/null \
-    || fail "answered decisions did not satisfy the completion gate"
-  pass "a bound channel's captured answers close their captain holds at answer time"
-}
-
-# Answer-time closure is opt-in per source. A channel with no binding must behave
-# exactly as it always did: capture, announce, close nothing.
-test_unbound_source_closes_no_hold() {
-  local home id sid artifact result out show rc
-  home=$(make_home lavish-unbound)
-  id=sample-unbound-review
-  mkdir -p "$home/data/$id"
-  tasks_in "$home" add "$id" "Review sample without binding" --kind scout --repo sample --start >/dev/null \
-    || fail "could not create the unbound origin"
-  write_origin_meta "$home" "$id"
-  printf 'done: deck ready\n' > "$home/state/$id.status"
-  printf '# Unbound review\n\nOne captain choice remains.\n' > "$home/data/$id/report.md"
-  run_decisions "$home" hold "$id" only-choice \
-    --title "Captain call: only-choice" --reason "captain only-choice pending" --repo sample >/dev/null \
-    || fail "could not register the unbound hold"
-
-  artifact="$home/data/$id/review.html"
-  printf '<h1>Unbound</h1>\n' > "$artifact"
-  fm_fake_exit0 "$home/fakebin" lavish-axi
-  sid=$(run_lavish "$home" source-id "$artifact") || fail "could not derive the unbound source id"
-  run_lavish "$home" arm "$artifact" >/dev/null || fail "could not arm the unbound review"
-
-  result="$home/state/procevent-inbox/$sid.1.result"
-  mkdir -p "$home/state/procevent-inbox"
-  cat > "$result" <<'EOF'
-session:
-  file: /review.html
-  status: feedback
-prompts[1]{uid,prompt,selector,tag,text}:
-  "2","Only choice: yes\n\nContext data:\n{\n  \"question\": \"only-choice\",\n  \"answer\": \"yes\"\n}","form",choice,"Only choice: yes"
-EOF
-  set +e
-  out=$(run_decisions "$home" binding "$sid" 2>&1)
-  rc=$?
-  set -e
-  [ "$rc" -ne 0 ] || fail "an unbound source reported a decision origin"
-  [ -z "$out" ] || fail "an unbound source printed an origin: $out"
-  show=$(tasks_in "$home" show "$id-decision-only-choice" --full)
-  assert_contains "$show" "state: queued" "an unbound review closed a captain hold"
-  assert_contains "$show" "held: yes" "an unbound review released a captain hold"
-  pass "a channel source with no decision binding closes nothing"
-}
-
-# An any-origin bound source carries answers whose keys are FULL hold identities,
-# so one aggregation surface (the bearings board) can close decisions across
-# origins - including identities longer than the old 64-character adapter cap -
-# while a key with no -decision- separator (a merge or dispatch instruction)
-# feeds nothing, a routed hold stays skipped for the routed close path, and the
-# runner's feed seam carries the whole flow with no runner change.
-test_any_origin_binding_closes_across_origins() {
-  local home alpha beta origin feedback out show long_key long_id overlong_key rc
-  home=$(make_home any-origin-board)
-  alpha=sample-alpha-review
-  beta=sample-instruction-layer-refinement-review
-  for origin in "$alpha" "$beta"; do
-    mkdir -p "$home/data/$origin"
-    tasks_in "$home" add "$origin" "Review $origin" --kind scout --repo sample --start >/dev/null \
-      || fail "could not create origin $origin"
-    write_origin_meta "$home" "$origin"
-    printf 'done: deck ready\n' > "$home/state/$origin.status"
-    printf '# %s\n\nDecisions remain.\n' "$origin" > "$home/data/$origin/report.md"
-  done
-  run_decisions "$home" hold "$alpha" route-choice \
-    --title "Captain call: route-choice" --reason "captain route choice pending" --repo sample >/dev/null \
-    || fail "could not register the alpha hold"
-  run_decisions "$home" hold "$alpha" routed-phase \
-    --title "Captain call: routed-phase" --reason "captain routed phase pending" --repo sample >/dev/null \
-    || fail "could not register the alpha routed hold"
-  long_key=perishable-first-admission-choice
-  long_id="$beta-decision-$long_key"
-  [ "${#long_id}" -ge 81 ] \
-    || fail "fixture regression: the full identity must exceed the old 64-char cap (got ${#long_id})"
-  run_decisions "$home" hold "$beta" "$long_key" \
-    --title "Captain call: $long_key" --reason "captain admission choice pending" --repo sample >/dev/null \
-    || fail "could not register the beta hold"
-  run_decisions "$home" complete "$alpha" route-choice routed-phase >/dev/null \
-    || fail "completion failed for alpha"
-  run_decisions "$home" complete "$beta" "$long_key" >/dev/null \
-    || fail "completion failed for beta"
-  tasks_in "$home" add sample-routed-work "Apply the routed phase" \
-    --kind ship --repo sample --blocked-by "$alpha-decision-routed-phase" >/dev/null \
-    || fail "could not route work behind the alpha routed hold"
-
-  run_decisions "$home" bind board-src --any-origin >/dev/null \
-    || fail "could not record the any-origin binding"
-  [ "$(run_decisions "$home" binding board-src)" = "(any)" ] \
-    || fail "the any-origin binding did not resolve to its marker"
-
-  # The captured board answer: two cross-origin full-identity answers, a merge
-  # instruction with no -decision- separator, a nonexistent identity, an answer
-  # for the routed hold, a 129-char key over the adapter cap, and a non-slug key.
-  overlong_key=$(printf 'x%.0s' {1..129})
-  feedback="$home/board-feedback.txt"
-  cat > "$feedback" <<EOF
-session:
-  file: /bearings-board.html
-  status: feedback
-prompts[7]{uid,prompt,selector,tag,text}:
-  "2","Route: north\\n\\nContext data:\\n{\\n  \\"question\\": \\"$alpha-decision-route-choice\\",\\n  \\"answer\\": \\"north\\"\\n}","form",choice,"Route: north"
-  "3","Admission: perishable-first\\n\\nContext data:\\n{\\n  \\"question\\": \\"$long_id\\",\\n  \\"answer\\": \\"perishable-first\\"\\n}","form",choice,"Admission: perishable-first"
-  "4","Merge order\\n\\nContext data:\\n{\\n  \\"question\\": \\"merge.sample-task\\",\\n  \\"answer\\": \\"merge\\"\\n}","form",choice,"Merge: sample-task"
-  "5","Ghost\\n\\nContext data:\\n{\\n  \\"question\\": \\"$alpha-decision-ghost\\",\\n  \\"answer\\": \\"yes\\"\\n}","form",choice,"Ghost: yes"
-  "6","Routed phase: phase-a\\n\\nContext data:\\n{\\n  \\"question\\": \\"$alpha-decision-routed-phase\\",\\n  \\"answer\\": \\"phase-a\\"\\n}","form",choice,"Routed phase: phase-a"
-  "7","Overlong\\n\\nContext data:\\n{\\n  \\"question\\": \\"$overlong_key\\",\\n  \\"answer\\": \\"yes\\"\\n}","form",choice,"Overlong: yes"
-  "8","Bad shape\\n\\nContext data:\\n{\\n  \\"question\\": \\"bad key\\",\\n  \\"answer\\": \\"yes\\"\\n}","form",choice,"Bad shape: yes"
-EOF
-
-  # The adapter admits a full identity past the old 64-char cap and still
-  # refuses shape violations - both proven through its executable interface.
-  out=$(run_lavish "$home" answers "$feedback") || fail "could not read the captured answers"
-  assert_contains "$out" "$long_id	perishable-first" \
-    "an 81-char full hold identity did not survive the adapter"
-  assert_not_contains "$out" "$overlong_key" "a 129-char question key passed the adapter cap"
-  assert_not_contains "$out" "bad key" "a non-slug question key passed the adapter"
-
-  # Fed through the real runner seam: `binding` prints the marker and the feed
-  # pipes it into the one intake unchanged, exactly as production does.
-  mkdir -p "$home/adapter-root/bin"
-  cat > "$home/adapter-root/bin/fm-procevent-boardchan.sh" <<SH
-#!/usr/bin/env bash
-# Fixture channel: reports keyed captain answers and nothing else.
-case "\${1-}" in
-  answers) exec "$ROOT/bin/fm-procevent-lavish.sh" answers "\${2-}" ;;
-esac
-exit 2
-SH
-  chmod +x "$home/adapter-root/bin/fm-procevent-boardchan.sh"
-  PATH="$home/fakebin:$PATH" FM_ROOT_OVERRIDE="$home/adapter-root" FM_HOME="$home" \
-    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
-    FM_PROCEVENT_CLAIM_ROOT="$home/procevent-claims" \
-    "$ROOT/bin/fm-procevent.sh" register boardchan board-src -- cat "$feedback" >/dev/null \
-    || fail "could not register the board fixture source"
-  PATH="$home/fakebin:$PATH" FM_ROOT_OVERRIDE="$home/adapter-root" FM_HOME="$home" \
-    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
-    FM_PROCEVENT_CLAIM_ROOT="$home/procevent-claims" \
-    "$ROOT/bin/fm-procevent.sh" start board-src >/dev/null 2>&1
-  assert_present "$home/state/procevent-inbox/board-src.1.result" \
-    "the board fixture channel captured no result to feed"
-  assert_absent "$home/state/procevent-inbox/board-src.1.handled" \
-    "feeding a captain answer retired the notification firstmate still needs"
-
-  show=$(tasks_in "$home" show "$alpha-decision-route-choice" --full)
-  assert_contains "$show" "state: done" "the alpha hold stayed open after an any-origin feed"
-  assert_contains "$show" "Resolution mode: answered" "the alpha hold did not record its close path"
-  assert_contains "$show" "Decision key: route-choice" \
-    "the recorded key is not the hold's own short decision key"
-  show=$(tasks_in "$home" show "$long_id" --full)
-  assert_contains "$show" "state: done" "the cross-origin long-identity hold stayed open"
-  assert_contains "$show" "Answer: perishable-first" \
-    "the long-identity hold did not record the captain's actual answer"
-  show=$(tasks_in "$home" show "$alpha-decision-routed-phase" --full)
-  assert_contains "$show" "state: queued" "any-origin closure closed a hold that still blocks routed work"
-  assert_contains "$show" "held: yes" "any-origin closure released a hold that still blocks routed work"
-
-  # Replay through the intake directly: idempotent for closed holds, `skipped:`
-  # diagnostics for everything the feed must leave alone, nonzero because keys
-  # were skipped.
-  set +e
-  out=$(run_lavish "$home" answers "$feedback" \
-    | run_decisions "$home" answers --any-origin \
-        --source "the captured result board-src sequence 1" 2>&1)
-  rc=$?
-  set -e
-  [ "$rc" -ne 0 ] || fail "an any-origin run that skipped keys reported success"
-  assert_contains "$out" "closed: $alpha-decision-route-choice" \
-    "replaying an identical any-origin capture was not idempotent: $out"
-  assert_contains "$out" "closed: $long_id" \
-    "replaying the long-identity answer was not idempotent: $out"
-  assert_contains "$out" "skipped: merge.sample-task (not a full hold identity)" \
-    "a merge instruction key was not skipped as a non-identity: $out"
-  assert_contains "$out" "skipped: $alpha-decision-ghost" \
-    "a nonexistent identity was not reported skipped: $out"
-  assert_contains "$out" "skipped: $alpha-decision-routed-phase" \
-    "the routed hold was not reported skipped: $out"
-  assert_contains "$out" "origin=(any)" "the summary line did not name the any-origin marker: $out"
-
-  printf 'Captain chose the routed phase.\n' > "$home/routed-phase-decision.txt"
-  run_decisions "$home" resolve "$alpha" routed-phase \
-    --decision-file "$home/routed-phase-decision.txt" --routed-to sample-routed-work >/dev/null \
-    || fail "the routed close path stopped working after any-origin closure"
-  run_decisions "$home" verify "$alpha" >/dev/null \
-    || fail "alpha's answered decisions did not satisfy the completion gate"
-  run_decisions "$home" verify "$beta" >/dev/null \
-    || fail "beta's answered decision did not satisfy the completion gate"
-  pass "an any-origin bound source closes full-identity holds across origins"
-}
-
-# The answer verb is the hold ledger's answer-time closure primitive, so it must
-# carry every guard the unrouted close path already had. Weakening any of them to
-# reach closure would trade the loss this fixes for a worse one.
-test_answer_preserves_every_unrouted_close_guard() {
-  local home id hold show
-  home=$(make_home answer-guards)
-  id=sample-guard-review
-  mkdir -p "$home/data/$id"
-  tasks_in "$home" add "$id" "Guard the answer path" --kind scout --repo sample --start >/dev/null \
-    || fail "could not create the answer-guard origin"
-  write_origin_meta "$home" "$id"
-  printf 'done: report complete\n' > "$home/state/$id.status"
-  printf '# Guard review\n\nOne captain choice remains.\n' > "$home/data/$id/report.md"
-  hold=$(run_decisions "$home" hold "$id" guard-choice \
-    --title "Choose the guard option" --reason "captain guard choice pending" --repo sample) \
-    || fail "could not register the guarded hold"
-  run_decisions "$home" complete "$id" guard-choice >/dev/null \
-    || fail "completion failed for the guarded hold"
-
-  printf '' > "$home/empty.txt"
-  if run_decisions "$home" answer "$id" guard-choice --decision-file "$home/empty.txt" \
-    > "$home/empty-answer.out" 2> "$home/empty-answer.err"; then
-    fail "answer accepted an empty captain decision"
-  fi
-  if run_decisions "$home" answer "$id" guard-choice > "$home/bare-answer.out" 2> "$home/bare-answer.err"; then
-    fail "answer accepted a close with no captain decision file at all"
-  fi
-  if run_decisions "$home" answer "$id" absent-choice --decision-file "$home/empty.txt" \
-    > "$home/absent-answer.out" 2> "$home/absent-answer.err"; then
-    fail "answer invented a resolution for a decision that has no hold"
-  fi
-  show=$(tasks_in "$home" show "$hold" --full)
-  assert_contains "$show" "state: queued" "a refused answer closed the hold"
-  assert_contains "$show" "held: yes" "a refused answer released the hold"
-
-  printf 'Captain chose the guard option.\n' > "$home/guard-decision.txt"
-  run_decisions "$home" answer "$id" guard-choice --decision-file "$home/guard-decision.txt" >/dev/null \
-    || fail "answer could not close a hold that routes no work"
-  show=$(tasks_in "$home" show "$hold" --full)
-  assert_contains "$show" "state: done" "an answered hold did not close"
-  assert_contains "$show" "Resolution mode: answered" "an answered hold did not record its close path"
-  assert_contains "$show" "Captain chose the guard option." \
-    "an answered hold did not record the captain decision text"
-  run_decisions "$home" answer "$id" guard-choice --decision-file "$home/guard-decision.txt" >/dev/null \
-    || fail "identical answer retry was not idempotent"
-  printf 'Captain chose something else entirely.\n' > "$home/drifted.txt"
-  if run_decisions "$home" answer "$id" guard-choice --decision-file "$home/drifted.txt" \
-    > "$home/drifted-answer.out" 2> "$home/drifted-answer.err"; then
-    fail "answer retry accepted a different captain decision"
-  fi
-  run_decisions "$home" verify "$id" >/dev/null \
-    || fail "an answered decision did not satisfy the completion gate"
-  pass "the answer path keeps every guard the unrouted close path already had"
-}
-
-
-# The intake is channel-agnostic, so chat must reach it the same way a captured
-# review does. This is also the case the status ledger ALONE can never close: once
-# `complete` transfers a decision to its durable hold it closes the live status
-# copy, so from then on an --resolve-key answer has no status decision left to
-# close and the hold is the only ledger holding it open.
-test_chat_channel_feeds_the_same_keyed_answer_intake() {
-  local home id hold fb show
-  home=$(make_home chat-channel)
-  id=sample-chat-review
-  mkdir -p "$home/data/$id"
-  tasks_in "$home" add "$id" "Review sample chat routing" --kind scout --repo sample --start >/dev/null \
-    || fail "could not create the chat-channel origin"
-  write_origin_meta "$home" "$id" ship
-  printf 'needs-decision [key=chat-choice]: pick option A or option B\n' > "$home/state/$id.status"
-  printf '# Chat review\n\nOne captain choice remains.\n' > "$home/data/$id/report.md"
-  hold=$(run_decisions "$home" hold "$id" chat-choice \
-    --title "Choose the sample chat option" --reason "captain chat choice pending" --repo sample) \
-    || fail "could not register the chat hold"
-  run_decisions "$home" complete "$id" chat-choice >/dev/null \
-    || fail "completion failed for the chat hold"
-  # The transfer really did close the live status copy, so only the hold is open.
-  grep -F 'captain-held [key=chat-choice]' "$home/state/$id.status" >/dev/null \
-    || fail "precondition: completion did not transfer the decision to its hold"
-
-  fb="$home/fakebin"
-  cat > "$fb/tmux" <<'SH'
-#!/usr/bin/env bash
-set -u
-case "${1:-}" in
-  send-keys)
-    [ "${FM_FAKE_TMUX_SEND_FAIL:-0}" = 1 ] && exit 1
-    shift
-    literal=0
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        -t) shift 2 ;;
-        -l) literal=1; shift ;;
-        *) break ;;
-      esac
-    done
-    if [ "$literal" = 1 ]; then
-      printf '%s' "${1:-}" >> "$FM_SEND_LOG"
-    fi
-    exit 0 ;;
-  display-message)
-    for a in "$@"; do case "$a" in *cursor_y*) printf '1\n'; exit 0 ;; esac; done
-    printf 'fakepane\n'; exit 0 ;;
-  capture-pane) printf '╭────╮\n│    │\n╰────╯\n'; exit 0 ;;
-  list-windows) exit 0 ;;
-esac
-exit 0
-SH
-  chmod +x "$fb/tmux"
-
-  : > "$home/send.log"
-  env PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$home" FM_HOME="$home" \
-    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
-    FM_SEND_LOG="$home/send.log" FM_SEND_SETTLE=0 \
-    "$ROOT/bin/fm-send.sh" "$id" --resolve-key chat-choice "go with option A" >/dev/null 2>&1 \
-    || fail "an answer to a transferred decision was refused by the chat channel"
-  assert_contains "$(cat "$home/send.log")" "go with option A" "the answer text never reached the worker"
-
-  show=$(tasks_in "$home" show "$hold" --full)
-  assert_contains "$show" "state: done" "a chat answer left its captain hold open"
-  assert_contains "$show" "Resolution mode: answered" "the chat-answered hold did not record its close path"
-  assert_contains "$show" "Answer: go with option A" "the chat-answered hold lost the captain answer"
-  assert_contains "$show" "answer sent to $id" "the chat-answered hold lost its channel provenance"
-  run_decisions "$home" verify "$id" >/dev/null \
-    || fail "a chat-answered decision did not satisfy the completion gate"
-  pass "the chat channel feeds the same keyed-answer intake a captured review does"
-}
-
-test_uninventoried_report_decision_refuses_completion
-
-test_scout_teardown_always_requires_inventory_verification
-test_declined_decision_closes_without_routed_work
-test_out_of_band_close_is_repairable_before_teardown
-test_unanswered_decision_still_blocks_completion_and_teardown
-test_structured_holds_survive_teardown_and_route_resolution
-test_origin_slug_validation_precedes_path_construction
-test_visual_review_uses_shared_completion_owner
-test_none_inventory_and_resolved_prose_do_not_create_holds
-test_terminal_single_owner_status_decision_does_not_block_empty_inventory
-test_secondmate_hold_stays_in_authoritative_home
-test_resolve_matches_quoted_blocked_by_edges
-test_bound_channel_answers_close_their_holds_at_answer_time
-test_unbound_source_closes_no_hold
-test_any_origin_binding_closes_across_origins
-test_answer_preserves_every_unrouted_close_guard
-test_chat_channel_feeds_the_same_keyed_answer_intake
diff --git a/tests/fm-fleet-snapshot-view.test.sh b/tests/fm-fleet-snapshot-view.test.sh
index f47c70f2fa..a4dd150083 100755
--- a/tests/fm-fleet-snapshot-view.test.sh
+++ b/tests/fm-fleet-snapshot-view.test.sh
@@ -456,6 +456,9 @@ test_backlog_tasks_axi_forms_and_overrides() {
 - [ ] parenthetical-title - Refresh sidebar (mobile) (repo: beta) (kind: ship)
 - [ ] blocked-reason - Blocked Reason (repo: beta) (kind: ship) blocked-by: queued-comma - waits on queued-comma
 - [ ] sample-decision-route - Choose sample route (repo: sample) (kind: captain) (since 2026-07-14) (hold: captain route choice pending) (hold-kind: captain)
+- [ ] dated-route - Deferred sample route (repo: sample) (kind: ship) (hold: captain sent this to later) (hold-kind: captain) (hold-until: 2026-09-01)
+- [ ] captain-gated-work - Captain-gated ship work (repo: sample) (kind: ship) (hold: captain go pending) (hold-kind: captain)
+- [ ] parked-prose - Parked captain call (repo: sample) (kind: ship) (hold: DEFERRED by captain) (hold-kind: captain)
 
 ## Done
 - [x] done-comma - Done Comma Task https://github.com/kunchenguid/firstmate/pull/42 (repo: gamma, merged 2026-07-09) (kind: ship)
@@ -474,7 +477,8 @@ EOF
   record_claude_idle "$home/state" bold-task
   printf 'done: report ready\n' > "$home/state/bold-task.status"
   fakebin=$(make_fakebin "$home")
-  out=$(PATH="$fakebin:$PATH" FM_HOME="$home" FM_DATA_OVERRIDE="$data" FM_PROJECTS_OVERRIDE="$projects" "$SNAPSHOT" --json)
+  out=$(PATH="$fakebin:$PATH" FM_HOME="$home" FM_DATA_OVERRIDE="$data" FM_PROJECTS_OVERRIDE="$projects" \
+    FM_SNAPSHOT_NOW=2026-07-14T00:00:00Z "$SNAPSHOT" --json)
   printf '%s' "$out" | jq -e --arg data "$data" --arg projects "$projects" '
     .roots.data == $data
       and .roots.projects == $projects
@@ -514,7 +518,23 @@ EOF
       and .kind == "captain"
       and .hold_reason == "captain route choice pending"
       and .hold_kind == "captain"
+      and .captain_actionable == true
   ' >/dev/null || fail "tasks-axi captain-hold metadata did not parse"
+  printf '%s' "$out" | jq -e '
+    .backlog.records[] | select(.id == "dated-route")
+    | .title == "Deferred sample route"
+      and .hold_until == "2026-09-01"
+      and .captain_actionable == false
+      and .deferred_marker == false
+  ' >/dev/null || fail "a dated captain hold did not defer or strip its hold-until from the title"
+  printf '%s' "$out" | jq -e '
+    .backlog.records[] | select(.id == "captain-gated-work")
+    | .kind == "ship" and .captain_actionable == true and .deferred_marker == false
+  ' >/dev/null || fail "captain actionability must not depend on the row kind"
+  printf '%s' "$out" | jq -e '
+    .backlog.records[] | select(.id == "parked-prose")
+    | .captain_actionable == true and .deferred_marker == true
+  ' >/dev/null || fail "a prose-deferred captain hold did not carry the presentation marker"
   printf '%s' "$out" | jq -e '
     .backlog.records[] | select(.id == "done-comma")
     | .repo == "gamma"

From 3f035336f9df7331e195bc6279cc1577e1cf4b49 Mon Sep 17 00:00:00 2001
From: Kun Chen <3233006+kunchenguid@users.noreply.github.com>
Date: Fri, 21 Aug 2026 01:00:26 -0700
Subject: [PATCH 04/11] fix: bound recovery announcements and preserve
 supervision (#2733)

* fix(watch): announce recovery once per generation and keep successors supervising

A lost Pi/OpenCode handling handshake re-announced the same recovery
generation on every cycle and spent the successor's first ~55s blind, so
a real crew event could be ignored and then dropped. Record the
announcement in the durable marker, confirm the handshake before the
follow-up without swallowing failure, and enter the poll loop immediately.

* no-mistakes(review): Tighten recovery event timing regression

* no-mistakes(document): Document recovery-loop supervision guarantees
---
 .opencode/plugins/fm-primary-watch-arm.js |  70 +++++--
 .pi/extensions/fm-primary-pi-watch.ts     |  76 +++++++-
 bin/fm-test-run.sh                        |   4 +-
 bin/fm-wake-drain.sh                      |   6 +-
 bin/fm-wake-lib.sh                        |  91 +++++++--
 bin/fm-watch-arm.sh                       |   2 +-
 bin/fm-watch.sh                           |  27 ++-
 docs/verification/supervision.md          |  16 ++
 docs/watcher-continuity.md                |  11 +-
 tests/fm-pi-watch-extension.test.sh       | 120 +++++++++---
 tests/fm-watch-arm.test.sh                |  33 ++--
 tests/fm-watch-recovery-loop.test.sh      | 222 ++++++++++++++++++++++
 tests/wake-helpers.sh                     |   5 +
 13 files changed, 588 insertions(+), 95 deletions(-)
 create mode 100755 tests/fm-watch-recovery-loop.test.sh

diff --git a/.opencode/plugins/fm-primary-watch-arm.js b/.opencode/plugins/fm-primary-watch-arm.js
index e88c248f78..d4e8850bb2 100644
--- a/.opencode/plugins/fm-primary-watch-arm.js
+++ b/.opencode/plugins/fm-primary-watch-arm.js
@@ -184,7 +184,7 @@ function observeArmOutput(stdout, stderr, settleReadiness) {
   }
 }
 
-async function sendPrompt(paths, client, sessionID, text, recovery) {
+async function sendPrompt(paths, client, sessionID, text) {
   const encoded = await encodeFirstmateOperationalInput(paths.root, "watcher", text);
   await client.session.promptAsync({
     path: { id: sessionID },
@@ -192,17 +192,56 @@ async function sendPrompt(paths, client, sessionID, text, recovery) {
       parts: [{ type: "text", text: encoded }],
     },
   });
-  if (recovery) {
+}
+
+function confirmHandlingDelivery(paths, recovery) {
+  try {
     const result = spawnSync(
       "bash",
       [`${paths.root}/bin/fm-watch-arm.sh`, "--handling-delivered", recovery.generation, "--watcher-pid", recovery.watcherPid],
       {
         cwd: paths.root,
+        encoding: "utf8",
         env: { ...process.env, FM_HOME: paths.home, FM_STATE_OVERRIDE: paths.state, FM_ROOT_OVERRIDE: paths.root },
       },
     );
-    if (result.status !== 0) throw new Error("watcher recovery delivery could not be confirmed");
+    if (result.status === 0) return { ok: true, detail: "" };
+    const stderr = String(result.stderr || "").trim();
+    return {
+      ok: false,
+      detail: `watcher: FAILED - handling delivery confirmation was rejected (status=${result.status ?? "none"} generation=${recovery.generation} watcherPid=${recovery.watcherPid})${stderr ? `\n${stderr}` : ""}`,
+    };
+  } catch (error) {
+    return {
+      ok: false,
+      detail: `watcher: FAILED - handling delivery confirmation could not be executed (generation=${recovery.generation} watcherPid=${recovery.watcherPid})\n${String(error?.message ?? error)}`,
+    };
+  }
+}
+
+function confirmHandlingDeliveryWithRetry(paths, recovery) {
+  const snapshot = () => armRecovery.get(child) ?? recovery;
+  const first = confirmHandlingDelivery(paths, snapshot());
+  if (first.ok) return first;
+  return confirmHandlingDelivery(paths, snapshot());
+}
+
+async function deliverActionableWake(paths, client, sessionID, message, recovery) {
+  if (recovery) {
+    const confirmed = confirmHandlingDeliveryWithRetry(paths, recovery);
+    if (!confirmed.ok) {
+      if (recovery.watcherPid) {
+        try {
+          process.kill(Number(recovery.watcherPid), 0);
+        } catch {
+          await retireArm(child);
+        }
+      }
+      await sendPrompt(paths, client, sessionID, wakePrompt(`${message}\n\n${confirmed.detail}`));
+      return;
+    }
   }
+  await sendPrompt(paths, client, sessionID, wakePrompt(message));
 }
 
 function wakePrompt(reason) {
@@ -211,6 +250,7 @@ function wakePrompt(reason) {
 
 function surfaceFailure(paths, client, sessionID, reason) {
   void sendPrompt(paths, client, sessionID, wakePrompt(reason)).catch(() => {
+    // OpenCode owns delivery errors; continuity restoration never waits on prompting.
   });
 }
 
@@ -353,18 +393,26 @@ function spawnArm(paths, sessionID, client, predecessorArmPid = "") {
     settleReadiness(classification.kind === "actionable" ? "wake" : "failed");
     const predecessor = String(armChild.pid ?? "");
     if (classification.kind === "actionable") {
+      if (restorationInFlight) return;
       retryFailures = 0;
       setArmStatus("wake");
-      const previousRestoration = restorationInFlight;
-      const restoration = previousRestoration
-        ? previousRestoration.catch(() => "").then(() => restoreAfterActionableClose(paths, sessionID, client, predecessor))
-        : restoreAfterActionableClose(paths, sessionID, client, predecessor);
+      const restoration = restoreAfterActionableClose(paths, sessionID, client, predecessor);
       restorationInFlight = restoration;
-      void restoration.then((result) => {
+      void restoration.then(async (result) => {
+        try {
+          const message = result.failure ? `${classification.message}\n\n${result.failure}` : classification.message;
+          await deliverActionableWake(paths, client, sessionID, message, result.recovery);
+        } finally {
+          if (restorationInFlight === restoration) restorationInFlight = null;
+        }
+      }).catch((error) => {
         if (restorationInFlight === restoration) restorationInFlight = null;
-        const message = result.failure ? `${classification.message}\n\n${result.failure}` : classification.message;
-        return sendPrompt(paths, client, sessionID, wakePrompt(message), result.recovery);
-      }).catch(() => {
+        surfaceFailure(
+          paths,
+          client,
+          sessionID,
+          `watcher: FAILED - OpenCode could not deliver an actionable wake\n${String(error?.message ?? error)}`,
+        );
       });
       return;
     }
diff --git a/.pi/extensions/fm-primary-pi-watch.ts b/.pi/extensions/fm-primary-pi-watch.ts
index 923ec6c310..95a7eedd8d 100644
--- a/.pi/extensions/fm-primary-pi-watch.ts
+++ b/.pi/extensions/fm-primary-pi-watch.ts
@@ -241,7 +241,6 @@ export default function (pi: ExtensionAPI) {
   async function sendWake(
     owner: SessionGeneration,
     message: string,
-    recovery?: { generation: string; watcherPid: string },
   ): Promise<void> {
     if (!generationIsLive(owner)) return;
     const content = encodeFirstmateOperationalInput(
@@ -249,17 +248,68 @@ export default function (pi: ExtensionAPI) {
       `FIRSTMATE WATCHER WAKE: ${message}\n\nRun bin/fm-wake-drain.sh first and handle the queued wake. Watcher continuity is extension-owned.`,
     );
     await pi.sendUserMessage(content, { deliverAs: "followUp" });
-    if (recovery) {
+  }
+
+  function confirmHandlingDelivery(recovery: { generation: string; watcherPid: string }): {
+    ok: boolean;
+    detail: string;
+  } {
+    try {
       const result = spawnSync(
         "bash",
         [armScript, "--handling-delivered", recovery.generation, "--watcher-pid", recovery.watcherPid],
         {
           cwd: fmRoot,
+          encoding: "utf8",
           env: { ...process.env, FM_HOME: fmHome, FM_STATE_OVERRIDE: state, FM_ROOT_OVERRIDE: fmRoot },
         },
       );
-      if (result.status !== 0) throw new Error("watcher recovery delivery could not be confirmed");
+      if (result.status === 0) return { ok: true, detail: "" };
+      const stderr = (result.stderr || "").trim();
+      return {
+        ok: false,
+        detail: `watcher: FAILED - handling delivery confirmation was rejected (status=${result.status ?? "none"} generation=${recovery.generation} watcherPid=${recovery.watcherPid})${stderr ? `\n${stderr}` : ""}`,
+      };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return {
+        ok: false,
+        detail: `watcher: FAILED - handling delivery confirmation could not be executed (generation=${recovery.generation} watcherPid=${recovery.watcherPid})\n${message}`,
+      };
+    }
+  }
+
+  function confirmHandlingDeliveryWithRetry(
+    owner: SessionGeneration,
+    recovery: { generation: string; watcherPid: string },
+  ): { ok: boolean; detail: string } {
+    const snapshot = (): { generation: string; watcherPid: string } => {
+      const current = owner.child ? armRecovery.get(owner.child) : undefined;
+      return current ?? recovery;
+    };
+    const first = confirmHandlingDelivery(snapshot());
+    if (first.ok) return first;
+    return confirmHandlingDelivery(snapshot());
+  }
+
+  async function deliverActionableWake(
+    owner: SessionGeneration,
+    message: string,
+    recovery?: { generation: string; watcherPid: string },
+  ): Promise<void> {
+    if (!generationIsLive(owner)) return;
+    if (recovery) {
+      const confirmed = confirmHandlingDeliveryWithRetry(owner, recovery);
+      if (!confirmed.ok) {
+        const watcherPid = recovery.watcherPid;
+        if (!pidAlive(watcherPid)) {
+          await retireArm(owner.child);
+        }
+        await sendWake(owner, `${message}\n\n${confirmed.detail}`);
+        return;
+      }
     }
+    await sendWake(owner, message);
   }
 
   function surfaceFailure(owner: SessionGeneration, message: string): void {
@@ -448,16 +498,22 @@ export default function (pi: ExtensionAPI) {
       const classification = classifyClose(stdout, stderr, code, signal);
       const predecessor = String(armChild.pid ?? "");
       if (classification.kind === "actionable") {
+        if (owner.restoring) return;
         owner.retryFailures = 0;
         owner.restoring = true;
         void (async () => {
-          const restoration = await restoreAfterActionableClose(owner, predecessor);
-          if (generationIsLive(owner)) owner.restoring = false;
-          if (!generationIsLive(owner)) return;
-          const message = restoration.failure ? `${classification.message}\n\n${restoration.failure}` : classification.message;
-          await sendWake(owner, message, restoration.recovery);
-        })().catch(() => {
-        });
+          try {
+            const restoration = await restoreAfterActionableClose(owner, predecessor);
+            if (!generationIsLive(owner)) return;
+            const message = restoration.failure ? `${classification.message}\n\n${restoration.failure}` : classification.message;
+            await deliverActionableWake(owner, message, restoration.recovery);
+          } catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            surfaceFailure(owner, `watcher: FAILED - Pi extension could not deliver an actionable wake\n${detail}`);
+          } finally {
+            if (generationIsLive(owner)) owner.restoring = false;
+          }
+        })();
         return;
       }
       if (owner.restoring) return;
diff --git a/bin/fm-test-run.sh b/bin/fm-test-run.sh
index 73eb3519c3..0dc8c08244 100755
--- a/bin/fm-test-run.sh
+++ b/bin/fm-test-run.sh
@@ -155,7 +155,8 @@ family_for_basename() {
     fm-session-lock-ancestry.test.sh|fm-cursor-primary.test.sh|\
     fm-supervision-events.test.sh|fm-turnend-guard.test.sh|fm-wake-daemon-lifecycle-e2e.test.sh|\
     fm-wake-drain-unread-status.test.sh|\
-    fm-wake-queue.test.sh|fm-watch-arm.test.sh|fm-watch-checkpoint.test.sh|fm-watch-triage.test.sh|\
+    fm-wake-queue.test.sh|fm-watch-arm.test.sh|fm-watch-checkpoint.test.sh|fm-watch-recovery-loop.test.sh|\
+    fm-watch-triage.test.sh|\
     fm-watcher-lock.test.sh|fm-inactive-reconcile.test.sh)
       printf '%s\n' watcher-wake-lock
       ;;
@@ -417,6 +418,7 @@ tests/fm-operational-input.test.sh 184
 tests/fm-pending-reply.test.sh 7328
 tests/fm-pi-primary-live-e2e.test.sh 19
 tests/fm-pi-watch-extension.test.sh 16386
+tests/fm-watch-recovery-loop.test.sh 80000
 tests/fm-pr-check-security.test.sh 199573
 tests/fm-procevent.test.sh 42789
 tests/fm-public-followup.test.sh 23365
diff --git a/bin/fm-wake-drain.sh b/bin/fm-wake-drain.sh
index fcf46a5516..277b889228 100755
--- a/bin/fm-wake-drain.sh
+++ b/bin/fm-wake-drain.sh
@@ -271,7 +271,7 @@ if [ ! -s "$FM_WAKE_QUEUE" ]; then
   fm_recovery_marker_snapshot "$RECOVERY_MARKER" || true
   RECOVERY_MARKER_TOKEN=$FM_RECOVERY_MARKER_TOKEN
   case "$RECOVERY_MARKER_TOKEN" in
-    pending:downtime:*)
+    pending:downtime:*|announced:downtime:*)
       fm_recovery_marker_begin_handling "$RECOVERY_MARKER" || {
         echo "wake drain: decision recovery could not begin handling safely" >&2
         exit 1
@@ -279,7 +279,7 @@ if [ ! -s "$FM_WAKE_QUEUE" ]; then
       RECOVERY_MARKER_TOKEN=$FM_RECOVERY_MARKER_TOKEN
       RECOVERY_ACK_REQUIRED=true
       ;;
-    pending:handling:*) RECOVERY_ACK_REQUIRED=true ;;
+    pending:handling:*|announced:handling:*) RECOVERY_ACK_REQUIRED=true ;;
   esac
   fm_lock_release "$FM_WAKE_QUEUE_LOCK"
   DRAIN_LOCK_HELD=false
@@ -327,7 +327,7 @@ fi
 fm_recovery_marker_snapshot "$RECOVERY_MARKER" || exit 1
 RECOVERY_MARKER_TOKEN=$FM_RECOVERY_MARKER_TOKEN
 case "$RECOVERY_MARKER_TOKEN" in
-  pending:*|acked:*) ;;
+  pending:*|announced:*|acked:*) ;;
   *) echo "wake drain: durable wakes have no recovery generation" >&2; exit 1 ;;
 esac
 fm_lock_release "$FM_WAKE_QUEUE_LOCK"
diff --git a/bin/fm-wake-lib.sh b/bin/fm-wake-lib.sh
index ff32d88196..3fe596889b 100755
--- a/bin/fm-wake-lib.sh
+++ b/bin/fm-wake-lib.sh
@@ -476,6 +476,9 @@ fm_lock_recheck_stale_owner() {
 FM_RECOVERY_MARKER_TOKEN=
 FM_RECOVERY_MARKER_ACTION='none'
 
+# Token grammar (one owner): <pending|announced|acked>:<handling|downtime>:<generation>
+# docs/watcher-continuity.md owns the recovery-episode contract, including the
+# once-per-generation announcement rule for unacknowledged downtime.
 fm_recovery_marker_read() {
   local marker=$1 line count
   FM_RECOVERY_MARKER_TOKEN=
@@ -484,7 +487,7 @@ fm_recovery_marker_read() {
   [ "$count" = 1 ] || return 1
   IFS= read -r line < "$marker" || return 1
   case "$line" in
-    pending:handling:*|pending:downtime:*|acked:handling:*|acked:downtime:*) ;;
+    pending:handling:*|pending:downtime:*|announced:handling:*|announced:downtime:*|acked:handling:*|acked:downtime:*) ;;
     *) return 1 ;;
   esac
   case "${line##*:}" in
@@ -498,11 +501,12 @@ _fm_atomic_replace() {
 }
 
 _fm_recovery_marker_write_locked() {
-  local marker=$1 kind=$2 generation=${3:-} tmp
+  local marker=$1 kind=$2 generation=${3:-} status=${4:-pending} tmp
   case "$kind" in handling|downtime) ;; *) return 1 ;; esac
+  case "$status" in pending|announced) ;; *) return 1 ;; esac
   tmp=$(mktemp "${marker}.tmp.XXXXXX") || return 1
   [ -n "$generation" ] || generation="$(fm_current_pid).$(date +%s).${tmp##*.}"
-  if ! printf 'pending:%s:%s\n' "$kind" "$generation" > "$tmp" \
+  if ! printf '%s:%s:%s\n' "$status" "$kind" "$generation" > "$tmp" \
     || ! chmod 0600 "$tmp" \
     || ! _fm_atomic_replace "$tmp" "$marker"; then
     rm -f -- "$tmp"
@@ -510,11 +514,13 @@ _fm_recovery_marker_write_locked() {
   fi
 }
 
-# Preserve a pending episode's generation across downtime republication so its
-# outstanding acknowledgement remains usable; docs/watcher-continuity.md owns
-# the recovery contract and sequence-safety rationale.
+# Preserve a pending or announced episode's generation across downtime
+# republication so its outstanding acknowledgement remains usable, and keep an
+# already-announced generation announced so it cannot be re-presented until a
+# new down stretch mints a new generation.
+# docs/watcher-continuity.md owns the recovery contract and sequence-safety rationale.
 _fm_recovery_marker_publish() {
-  local marker=$1 kind=${2:-downtime} lock saved_token generation=''
+  local marker=$1 kind=${2:-downtime} lock saved_token generation='' status=pending
   case "$kind" in handling|downtime) ;; *) return 1 ;; esac
   lock="${marker}.lock"
   fm_lock_acquire_wait "$lock" || return 1
@@ -529,12 +535,19 @@ _fm_recovery_marker_publish() {
     saved_token=$FM_RECOVERY_MARKER_TOKEN
     if fm_recovery_marker_read "$marker"; then
       case "$FM_RECOVERY_MARKER_TOKEN" in
-        pending:handling:*|pending:downtime:*) generation=${FM_RECOVERY_MARKER_TOKEN##*:} ;;
+        pending:handling:*|pending:downtime:*)
+          generation=${FM_RECOVERY_MARKER_TOKEN##*:}
+          status=pending
+          ;;
+        announced:handling:*|announced:downtime:*)
+          generation=${FM_RECOVERY_MARKER_TOKEN##*:}
+          status=announced
+          ;;
       esac
     fi
     FM_RECOVERY_MARKER_TOKEN=$saved_token
   fi
-  if ! _fm_recovery_marker_write_locked "$marker" "$kind" "$generation"; then
+  if ! _fm_recovery_marker_write_locked "$marker" "$kind" "$generation" "$status"; then
     fm_lock_release "$lock"
     return 1
   fi
@@ -556,7 +569,7 @@ _fm_recovery_marker_begin_handling() {
     return 3
   fi
   case "$line" in
-    pending:handling:*) ;;
+    pending:handling:*|announced:handling:*) ;;
     pending:downtime:*)
       if ! _fm_recovery_marker_write_locked "$marker" handling "$generation"; then
         fm_lock_release "$lock"
@@ -564,6 +577,13 @@ _fm_recovery_marker_begin_handling() {
       fi
       FM_RECOVERY_MARKER_TOKEN="pending:handling:$generation"
       ;;
+    announced:downtime:*)
+      if ! _fm_recovery_marker_write_locked "$marker" handling "$generation" announced; then
+        fm_lock_release "$lock"
+        return 1
+      fi
+      FM_RECOVERY_MARKER_TOKEN="announced:handling:$generation"
+      ;;
     *) fm_lock_release "$lock"; return 1 ;;
   esac
   fm_lock_release "$lock"
@@ -590,8 +610,9 @@ _fm_recovery_marker_ack() {
   fi
   line=$FM_RECOVERY_MARKER_TOKEN
   case "$line" in
-    pending:*) line="acked:${line#pending:}" ;;
+    pending:*|announced:*) line="acked:${line#*:}" ;;
     acked:*) fm_lock_release "$lock"; return 0 ;;
+    *) fm_lock_release "$lock"; return 1 ;;
   esac
   tmp=$(mktemp "${marker}.tmp.XXXXXX") || { fm_lock_release "$lock"; return 1; }
   if ! printf '%s\n' "$line" > "$tmp" \
@@ -615,7 +636,7 @@ _fm_recovery_marker_arm_check() {
   fi
   if [ ! -e "$marker" ] && [ ! -L "$marker" ]; then
     if [ -s "$FM_WAKE_QUEUE" ]; then
-      if ! _fm_recovery_marker_write_locked "$marker" downtime; then
+      if ! _fm_recovery_marker_write_locked "$marker" downtime "" announced; then
         fm_lock_release "$lock"
         fm_lock_release "$FM_WAKE_QUEUE_LOCK"
         return 1
@@ -634,7 +655,7 @@ _fm_recovery_marker_arm_check() {
         return 1
       }
     if ! mv -- "$marker" "$quarantine/marker" \
-      || ! _fm_recovery_marker_write_locked "$marker" downtime; then
+      || ! _fm_recovery_marker_write_locked "$marker" downtime "" announced; then
       rmdir "$quarantine" 2>/dev/null || true
       fm_lock_release "$lock"
       fm_lock_release "$FM_WAKE_QUEUE_LOCK"
@@ -647,16 +668,24 @@ _fm_recovery_marker_arm_check() {
   fi
   line=$FM_RECOVERY_MARKER_TOKEN
   case "$line" in
-    pending:handling:*)
+    pending:handling:*|announced:handling:*|announced:downtime:*)
       FM_RECOVERY_MARKER_ACTION='wait'
       fm_lock_release "$lock"
       fm_lock_release "$FM_WAKE_QUEUE_LOCK"
       return 0
       ;;
-    pending:downtime:*) FM_RECOVERY_MARKER_ACTION='recover' ;;
+    pending:downtime:*)
+      if ! _fm_recovery_marker_write_locked "$marker" downtime "${line##*:}" announced; then
+        fm_lock_release "$lock"
+        fm_lock_release "$FM_WAKE_QUEUE_LOCK"
+        return 1
+      fi
+      FM_RECOVERY_MARKER_TOKEN="announced:downtime:${line##*:}"
+      FM_RECOVERY_MARKER_ACTION='recover'
+      ;;
     acked:*)
       if [ -s "$FM_WAKE_QUEUE" ]; then
-        if ! _fm_recovery_marker_write_locked "$marker" downtime; then
+        if ! _fm_recovery_marker_write_locked "$marker" downtime "" announced; then
           fm_lock_release "$lock"
           fm_lock_release "$FM_WAKE_QUEUE_LOCK"
           return 1
@@ -670,6 +699,29 @@ _fm_recovery_marker_arm_check() {
   fm_lock_release "$FM_WAKE_QUEUE_LOCK"
 }
 
+# A non-successor watcher start after an announced-but-unacked episode is a new
+# down stretch: mint a fresh pending generation so a still-open decision or
+# buried note can be presented once more. Handling successors must not call
+# this, because Option B re-arm is not a new down stretch.
+_fm_recovery_marker_reopen_announced() {
+  local marker=$1 lock
+  lock="${marker}.lock"
+  fm_lock_acquire_wait "$lock" || return 1
+  if ! fm_recovery_marker_read "$marker"; then
+    fm_lock_release "$lock"
+    return 0
+  fi
+  case "$FM_RECOVERY_MARKER_TOKEN" in
+    announced:*)
+      if ! _fm_recovery_marker_write_locked "$marker" downtime ""; then
+        fm_lock_release "$lock"
+        return 1
+      fi
+      ;;
+  esac
+  fm_lock_release "$lock"
+}
+
 fm_recovery_transition() {
   local marker=$1 action=$2 target=${3:-} value=${4:-}
   case "$action" in
@@ -682,6 +734,9 @@ fm_recovery_transition() {
     arm-check)
       _fm_recovery_marker_arm_check "$marker"
       ;;
+    reopen-announced)
+      _fm_recovery_marker_reopen_announced "$marker"
+      ;;
     release-lock)
       [ -n "$target" ] || return 1
       _fm_recovery_marker_publish "$marker" "${value:-downtime}" || return 1
@@ -723,6 +778,10 @@ fm_recovery_marker_arm_check() {
   fm_recovery_transition "$1" arm-check
 }
 
+fm_recovery_marker_reopen_announced() {
+  fm_recovery_transition "$1" reopen-announced
+}
+
 fm_lock_try_acquire() {
   local lockdir=$1 pid steal cur rc steal_owner primary_owner
   FM_LOCK_HELD_PID=
diff --git a/bin/fm-watch-arm.sh b/bin/fm-watch-arm.sh
index 5ba132401a..d134f51940 100755
--- a/bin/fm-watch-arm.sh
+++ b/bin/fm-watch-arm.sh
@@ -376,7 +376,7 @@ handling_successor_generation() {
   [ -n "${FM_WATCH_PREDECESSOR_ARM_PID:-}" ] || return 0
   fm_recovery_marker_snapshot "$STATE/.watcher-down" || return 1
   case "$FM_RECOVERY_MARKER_TOKEN" in
-    pending:downtime:*|pending:handling:*) printf '%s' "${FM_RECOVERY_MARKER_TOKEN##*:}" ;;
+    pending:downtime:*|pending:handling:*|announced:downtime:*|announced:handling:*) printf '%s' "${FM_RECOVERY_MARKER_TOKEN##*:}" ;;
     acked:*|'') ;;
     *) return 1 ;;
   esac
diff --git a/bin/fm-watch.sh b/bin/fm-watch.sh
index a3f78fcc33..795fddb518 100755
--- a/bin/fm-watch.sh
+++ b/bin/fm-watch.sh
@@ -774,6 +774,12 @@ WATCHER_RECOVERY_PENDING=0
 if [ -n "${FM_LOCK_RECOVERED_PID:-}" ]; then
   WATCHER_RECOVERY_PENDING=1
 fi
+if [ "${FM_WATCH_HANDLING_SUCCESSOR:-0}" != 1 ]; then
+  if ! fm_recovery_marker_reopen_announced "$WATCHER_DOWNTIME_MARKER"; then
+    echo "watcher: recovery state could not be reopened safely; retaining stale lock evidence" >&2
+    exit 1
+  fi
+fi
 if ! fm_recovery_marker_arm_check "$WATCHER_DOWNTIME_MARKER"; then
   echo "watcher: recovery state could not be consumed safely; retaining stale lock evidence" >&2
   exit 1
@@ -828,6 +834,12 @@ if ! fm_pr_poll_retirement_recover_all "$STATE" "$SCRIPT_DIR/fm-pr-poll.sh"; the
 fi
 
 resurface_after_downtime() {
+  # Handling successors already have a predecessor-delivered wake on the way.
+  # Re-announcing from this cycle is what turned a lost handshake into an
+  # unbounded recovery loop; stay in the poll loop and supervise instead.
+  if [ "${FM_WATCH_HANDLING_SUCCESSOR:-0}" = 1 ]; then
+    return 0
+  fi
   if [ "$WATCHER_RECOVERY_PENDING" -ne 1 ]; then
     if ! fm_recovery_marker_arm_check "$WATCHER_DOWNTIME_MARKER"; then
       echo "watcher: recovery state could not be consumed safely" >&2
@@ -838,21 +850,6 @@ resurface_after_downtime() {
   wake "check: rearm-resurface"
 }
 
-if [ "${FM_WATCH_HANDLING_SUCCESSOR:-0}" = 1 ]; then
-  touch "$STATE/.last-watcher-beat"
-  handling_wait=0
-  while [ "$handling_wait" -lt 600 ]; do
-    fm_recovery_marker_snapshot "$WATCHER_DOWNTIME_MARKER" || true
-    case "$FM_RECOVERY_MARKER_TOKEN" in
-      pending:downtime:*) ;;
-      *) break ;;
-    esac
-    sleep 0.05
-    handling_wait=$((handling_wait + 1))
-  done
-  [ "$handling_wait" -lt 600 ] || WATCHER_RECOVERY_PENDING=1
-fi
-
 while :; do
   # Self-eviction: if the singleton lock no longer names this process, a second
   # watcher has taken over (e.g. a transient duplicate from a racy arm). Stand
diff --git a/docs/verification/supervision.md b/docs/verification/supervision.md
index d0837023d3..8ae889f30f 100644
--- a/docs/verification/supervision.md
+++ b/docs/verification/supervision.md
@@ -446,6 +446,21 @@ Observed guarantee: after ordinary `session_shutdown` for `/new`, `/resume`, and
 Stale prior-generation tool callbacks could not mutate the active child, repeated transitions kept exactly one live arm cycle, and terminal `quit` still refused late rearm.
 Plain Pi and pi-signed share the same tracked `.pi/extensions/fm-primary-pi-watch.ts` path, so both inherit the generation owner; other primary harnesses are not applicable because they do not use this Pi extension lifecycle.
 
+The once-per-generation recovery bound and immediate handling-successor poll were verified on 2026-08-21 with the tracked Pi extension, real watcher processes, and an isolated home.
+The regression forced handling confirmation to fail, observed one recovery follow-up across the former repeat window, confirmed the successor remained live, and then proved a separate handling successor durably queued a crew event within the bounded poll window.
+
+```sh
+bin/fm-test-run.sh tests/fm-watch-recovery-loop.test.sh
+```
+
+Observed output:
+
+```text
+ok - a resurfacing handling successor stays alive and supervises instead of going blind
+ok - unacknowledged recovery is announced at most once per generation and the successor stays alive
+FM_TEST_SUMMARY total=1 failed=0 skipped_gate=0 duration_ms=59357
+```
+
 Deterministic entry points:
 
 ```sh
@@ -453,6 +468,7 @@ tests/fm-pi-watch-extension.test.sh
 tests/fm-pi-primary-types.test.sh
 tests/fm-watcher-lock.test.sh
 tests/fm-watch-arm.test.sh
+tests/fm-watch-recovery-loop.test.sh
 tests/fm-wake-queue.test.sh
 tests/fm-subagent-pretool-check.test.sh
 tests/fm-claude-stop-autoarm.test.sh
diff --git a/docs/watcher-continuity.md b/docs/watcher-continuity.md
index 1a94ec0ede..aedc87d57a 100644
--- a/docs/watcher-continuity.md
+++ b/docs/watcher-continuity.md
@@ -23,6 +23,8 @@ While supervision is still needed and away mode remains inactive, an actionable
 ## Actionable wake ordering
 
 After an actionable Pi or OpenCode child close, the adapter starts and verifies one singleton successor before it delivers the original wake.
+It confirms the handling handoff against that successor before scheduling the follow-up, retries once against the current generation and successor, and treats a failed confirmation as a restoration failure: it classifies the error, retires a successor that is no longer alive, and surfaces exactly one typed message.
+A failed confirmation is never swallowed.
 It waits at most one readiness timeout per attempt, then sends TERM and waits a bounded retirement confirmation before the next lock-verified exponential retry.
 If the unready arm does not retire within that bound, the adapter keeps ownership, starts no overlapping retry, and delivers the typed fallback immediately.
 When that retained arm later closes, its actual close is classified as a new supervised event without replaying the earlier fallback.
@@ -31,8 +33,8 @@ This is deliberate Option B ordering: the fleet is protected before the model ha
 
 Claude's Stop hook starts the successor arm at the next Stop after the handling turn, rather than before notification as Pi and OpenCode do.
 The durable wake queue preserves actionable events during the residual active-turn window, and the bounded turn-end guard enforces recovery at Stop when no watcher or auto-arm claim is present.
-For every supported arm path, a successor that observes an accepted down stretch emits `check: rearm-resurface` through the ordinary durable handling path before settling into its live wait.
-That recovery presentation includes all unacknowledged queue rows, the cursor-folded OPEN DECISIONS set, and still-unread informational status lines, so a still-open decision or a buried `note:` answer reappears even when recovery has no queue row of its own.
+The recovery-episode contract below owns once-per-generation announcement.
+A handling successor does not re-announce; it enters its poll loop immediately and keeps scanning signals, stale panes, and checks.
 The model no longer re-arms after ordinary wakes.
 No PreToolUse hook denies fleet commands based on watcher status.
 A genuine auto-arm failure describes the automatic mechanism as broken and never directs a routine manual background arm.
@@ -46,7 +48,9 @@ The turn-end guard remains the final backstop rather than the normal continuity
 ## Recovery episode acknowledgement
 
 A recovery episode is one generation of `state/.watcher-down`, and it is retired only by the generation-bound acknowledgement the drain prints as `WAKE_ACK_REQUIRED`.
-Every watcher close and every durable queue append publishes downtime, so a downtime republication of any pending episode reuses its generation instead of minting a new one.
+An unacknowledged downtime generation is announced at most once: the first recovery marks that generation announced, and later arms wait until a new down stretch mints a new generation.
+A non-successor watcher start after an announced-but-unacked episode is a new down stretch and mints a fresh generation so buried decisions still resurface once.
+Every watcher close and every durable queue append publishes downtime, so a downtime republication of any pending episode reuses its generation instead of minting a new one, and an already-announced generation stays announced.
 That reuse keeps a watcher close inside the handling window from orphaning the acknowledgement already presented and trapping later arms in repeated recovery presentation.
 An acknowledgement carries two separable facts: queue-row consumption is bound to the monotonic `--ack-through` sequence, while only retiring the episode is bound to `--recovery-generation`.
 A generation mismatch therefore does not block consumption of rows through that sequence; it is a non-fatal result that names its own remedy - re-drain, then acknowledge the newer episode.
@@ -78,6 +82,7 @@ Only the watcher process touches `state/.last-watcher-beat`; no helper process c
 `tests/fm-pi-watch-extension.test.sh` checks Pi's first-cycle-or-explicit-repair tool metadata and ownership-based redundant-call no-ops, then simulates actionable and empty child closes against the actual Pi and OpenCode close handlers, blocks prompt delivery to prove the successor launches first, verifies single-flight behavior, changes the session lock before close to prove ownership is rechecked, and hangs each successor arm to prove bounded fallback delivery includes the typed restoration failure.
 The same suite covers ordinary same-process session replacement for `/new`, `/resume`, and `/fork`, same-instance shutdown-plus-start, stale prior-generation callbacks, repeated transitions with exactly one live cycle, disappearance of the shutting-down refusal after a valid replacement activates, and terminal quit still refusing late rearm.
 `tests/fm-watch-arm.test.sh` covers durable queue replay, real remote parent-replies ingestion into the authoritative status log, decision-only OPEN DECISIONS recovery, interrupted handling replay, generation-bound acknowledgement, a persistent live successor after recovery, a watcher close inside the handling window that must leave the printed acknowledgement valid, and the self-healing moved-generation acknowledgement that consumes its handled rows and names its remedy.
+`tests/fm-watch-recovery-loop.test.sh` covers the once-per-generation announcement bound with the real Pi extension against a refused handling handshake, and a handling successor that must surface a real crew event instead of going blind.
 `tests/fm-watcher-lock.test.sh` covers verified-successor attach, recovery publication before stale-lock removal, the typed self-eviction failure, bounded and successor-linked lifecycle rows, and a SIGSTOP counterfactual that distinguishes a live PID from a stale beacon before classifying termination.
 `tests/fm-subagent-pretool-check.test.sh` proves Claude retains only the non-status Bash seatbelts.
 `tests/fm-claude-stop-autoarm.test.sh` covers the auto-arm's scope, stale and live session owners, unchanged AFK and need boundaries, single-flight, bounded failure retries, benign live-watcher cycle ends, one-notice failure episodes, and exit-2 translation.
diff --git a/tests/fm-pi-watch-extension.test.sh b/tests/fm-pi-watch-extension.test.sh
index 9e29adc793..5af0ef9106 100755
--- a/tests/fm-pi-watch-extension.test.sh
+++ b/tests/fm-pi-watch-extension.test.sh
@@ -365,7 +365,7 @@ const pi = {
   },
   sendUserMessage: async () => {
     rowsAtDelivery = existsSync(process.env.FM_ARM_LOG)
-      ? readFileSync(process.env.FM_ARM_LOG, "utf8").trim().split("\n").length
+      ? readFileSync(process.env.FM_ARM_LOG, "utf8").trim().split("\n").filter((row) => row.startsWith("arm=")).length
       : 0;
     deliveryStarted = true;
     await deliveryBlocked;
@@ -383,22 +383,23 @@ for (let i = 0; i < 250; i += 1) {
   await new Promise((resolve) => setTimeout(resolve, 10));
 }
 const rows = readFileSync(process.env.FM_ARM_LOG, "utf8").trim().split("\n");
-if (rows.length !== 2) throw new Error(`expected one successor arm, got ${rows.length}: ${rows.join(" | ")}`);
+const armRows = rows.filter((row) => row.startsWith("arm="));
+if (armRows.length !== 2) throw new Error(`expected one successor arm, got ${armRows.length}: ${rows.join(" | ")}`);
 if (!deliveryStarted) throw new Error("wake delivery did not begin");
 if (rowsAtDelivery !== 2) throw new Error(`wake delivery began before successor establishment (${rowsAtDelivery} arm rows)`);
-if (!/predecessor=[0-9]+/.test(rows[1])) throw new Error(`successor did not receive predecessor identity: ${rows[1]}`);
+if (!/predecessor=[0-9]+/.test(armRows[1])) throw new Error(`successor did not receive predecessor identity: ${armRows[1]}`);
+if (!rows.some((row) => row.startsWith("confirmed generation=fixture-generation"))) {
+  throw new Error(`handling delivery was not confirmed before the follow-up: ${rows.join(" | ")}`);
+}
 await new Promise((resolve) => setTimeout(resolve, 100));
 const stableRows = readFileSync(process.env.FM_ARM_LOG, "utf8").trim().split("\n");
-if (stableRows.length !== 2) throw new Error(`delivery was confirmed before the prompt succeeded: ${stableRows.join(" | ")}`);
-releaseDelivery();
-for (let i = 0; i < 100; i += 1) {
-  if (readFileSync(process.env.FM_ARM_LOG, "utf8").includes("confirmed generation=fixture-generation")) break;
-  await new Promise((resolve) => setTimeout(resolve, 10));
+if (stableRows.filter((row) => row.startsWith("arm=")).length !== 2) {
+  throw new Error(`blocked follow-up started extra arm work: ${stableRows.join(" | ")}`);
 }
-const confirmedRows = readFileSync(process.env.FM_ARM_LOG, "utf8").trim().split("\n");
-if (confirmedRows.filter((row) => row.startsWith("confirmed ")).length !== 1) {
-  throw new Error(`successful prompt delivery was not confirmed exactly once: ${confirmedRows.join(" | ")}`);
+if (stableRows.filter((row) => row.startsWith("confirmed ")).length !== 1) {
+  throw new Error(`successful prompt delivery was not confirmed exactly once: ${stableRows.join(" | ")}`);
 }
+releaseDelivery();
 writeFileSync(process.env.FM_STOP_FILE, "stop\n");
 process.exit(0);
 EOF
@@ -409,6 +410,79 @@ EOF
   pass "Pi actionable close starts one successor before wake delivery settles"
 }
 
+test_pi_handling_delivery_failure_is_typed_once() {
+  local repo home plugin log stop out status
+  repo="$TMP_ROOT/pi-handling-fail-root"
+  home="$TMP_ROOT/pi-handling-fail-home"
+  log="$TMP_ROOT/pi-handling-fail.log"
+  stop="$TMP_ROOT/pi-handling-fail.stop"
+  mkdir -p "$repo/bin" "$home/state" "$home/config"
+  install_pi_watch_extension_fixture "$repo"
+  plugin="$repo/.pi/extensions/fm-primary-pi-watch.ts"
+  cat > "$repo/bin/fm-watch-arm.sh" <<'SH'
+#!/usr/bin/env bash
+if [ "${1:-}" = --handling-delivered ]; then
+  printf 'refused generation=%s watcher=%s\n' "$2" "$4" >> "${FM_ARM_LOG:?}"
+  exit 1
+fi
+printf 'arm=%s predecessor=%s\n' "$$" "${FM_WATCH_PREDECESSOR_ARM_PID:-none}" >> "${FM_ARM_LOG:?}"
+count=$(grep -c '^arm=' "$FM_ARM_LOG")
+if [ "$count" -eq 1 ]; then
+  printf 'watcher: started pid=%s (beacon fresh)\n' "$$"
+  printf 'signal: synthetic actionable close\n'
+  exit 0
+fi
+printf 'watcher: started pid=%s (beacon fresh) recovery-generation=fixture-generation\n' "$$"
+trap 'exit 0' TERM INT
+while [ ! -e "$FM_STOP_FILE" ]; do sleep 0.02; done
+SH
+  chmod +x "$repo/bin/fm-watch-arm.sh"
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_STOP_FILE="$stop" node --input-type=module 2>&1 <<'EOF'
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+
+let tool = null;
+let prompt = "";
+const pi = {
+  on() {},
+  registerCommand() {},
+  registerTool(candidate) {
+    if (candidate.name === "fm_watch_arm_pi") tool = candidate;
+  },
+  sendUserMessage: async (message) => {
+    prompt += message;
+  },
+};
+writeFileSync(`${process.env.FM_HOME}/state/.lock`, `${process.pid}\n`);
+const mod = await import(pathToFileURL(process.env.PLUGIN).href);
+mod.default(pi);
+await tool.execute("tool-call-handling-fail", {}, undefined, undefined, {});
+for (let i = 0; i < 250 && !prompt.includes("handling delivery confirmation was rejected"); i += 1) {
+  await new Promise((resolve) => setTimeout(resolve, 20));
+}
+if (!prompt.includes("FIRSTMATE WATCHER WAKE")) throw new Error(`missing follow-up: ${prompt}`);
+if (!prompt.includes("handling delivery confirmation was rejected")) {
+  throw new Error(`failed handshake was swallowed: ${prompt}`);
+}
+if ((prompt.match(/FIRSTMATE WATCHER WAKE/g) || []).length !== 1) {
+  throw new Error(`failed handshake was not a single typed message: ${prompt}`);
+}
+const rows = existsSync(process.env.FM_ARM_LOG)
+  ? readFileSync(process.env.FM_ARM_LOG, "utf8").trim().split("\n")
+  : [];
+if (rows.filter((row) => row.startsWith("refused ")).length < 1) {
+  throw new Error(`handling-delivered was never attempted: ${rows.join(" | ")}`);
+}
+writeFileSync(process.env.FM_STOP_FILE, "stop\n");
+process.exit(0);
+EOF
+)
+  status=$?
+  expect_code 0 "$status" "Pi must surface a refused handling handshake as one typed failure"
+  [ -z "$out" ] || fail "Pi handling-delivery failure test printed output: $out"
+  pass "Pi refused handling handshake is classified and not swallowed"
+}
+
 test_pi_hung_successor_falls_back_to_typed_wake() {
   local repo home plugin log out status
   repo="$TMP_ROOT/pi-hung-successor-root"
@@ -1451,7 +1525,7 @@ const client = {
   session: {
     promptAsync: async () => {
       rowsAtPrompt = existsSync(process.env.FM_ARM_LOG)
-        ? readFileSync(process.env.FM_ARM_LOG, "utf8").trim().split("\n").length
+        ? readFileSync(process.env.FM_ARM_LOG, "utf8").trim().split("\n").filter((row) => row.startsWith("arm=")).length
         : 0;
       prompts += 1;
       await promptBlocked;
@@ -1474,22 +1548,23 @@ for (let i = 0; i < 250; i += 1) {
   await new Promise((resolve) => setTimeout(resolve, 10));
 }
 const rows = readFileSync(process.env.FM_ARM_LOG, "utf8").trim().split("\n");
-if (rows.length !== 2) throw new Error(`expected one successor arm, got ${rows.length}: ${rows.join(" | ")}`);
+const armRows = rows.filter((row) => row.startsWith("arm="));
+if (armRows.length !== 2) throw new Error(`expected one successor arm, got ${armRows.length}: ${rows.join(" | ")}`);
 if (prompts !== 1) throw new Error(`expected one blocked wake prompt, got ${prompts}`);
 if (rowsAtPrompt !== 2) throw new Error(`wake prompt began before successor establishment (${rowsAtPrompt} arm rows)`);
-if (!/predecessor=[0-9]+/.test(rows[1])) throw new Error(`successor did not receive predecessor identity: ${rows[1]}`);
+if (!/predecessor=[0-9]+/.test(armRows[1])) throw new Error(`successor did not receive predecessor identity: ${armRows[1]}`);
+if (!rows.some((row) => row.startsWith("confirmed generation=fixture-generation"))) {
+  throw new Error(`handling delivery was not confirmed before the follow-up: ${rows.join(" | ")}`);
+}
 await new Promise((resolve) => setTimeout(resolve, 100));
 const stableRows = readFileSync(process.env.FM_ARM_LOG, "utf8").trim().split("\n");
-if (stableRows.length !== 2) throw new Error(`delivery was confirmed before the prompt succeeded: ${stableRows.join(" | ")}`);
-releasePrompt();
-for (let i = 0; i < 100; i += 1) {
-  if (readFileSync(process.env.FM_ARM_LOG, "utf8").includes("confirmed generation=fixture-generation")) break;
-  await new Promise((resolve) => setTimeout(resolve, 10));
+if (stableRows.filter((row) => row.startsWith("arm=")).length !== 2) {
+  throw new Error(`blocked follow-up started extra arm work: ${stableRows.join(" | ")}`);
 }
-const confirmedRows = readFileSync(process.env.FM_ARM_LOG, "utf8").trim().split("\n");
-if (confirmedRows.filter((row) => row.startsWith("confirmed ")).length !== 1) {
-  throw new Error(`successful prompt delivery was not confirmed exactly once: ${confirmedRows.join(" | ")}`);
+if (stableRows.filter((row) => row.startsWith("confirmed ")).length !== 1) {
+  throw new Error(`successful prompt delivery was not confirmed exactly once: ${stableRows.join(" | ")}`);
 }
+releasePrompt();
 writeFileSync(process.env.FM_STOP_FILE, "stop\n");
 EOF
   )
@@ -2155,6 +2230,7 @@ test_pi_tool_returns_agent_tool_result
 test_pi_redundant_tool_call_is_owned_noop
 test_pi_scheduled_retry_call_is_owned_noop
 test_pi_actionable_close_starts_single_successor_before_delivery
+test_pi_handling_delivery_failure_is_typed_once
 test_pi_hung_successor_falls_back_to_typed_wake
 test_pi_unretired_successor_falls_back_without_retry
 test_pi_late_unretired_close_resumes_supervision
diff --git a/tests/fm-watch-arm.test.sh b/tests/fm-watch-arm.test.sh
index 0115330671..2a3a5173c4 100755
--- a/tests/fm-watch-arm.test.sh
+++ b/tests/fm-watch-arm.test.sh
@@ -121,7 +121,7 @@ ack_wakes() {  # <state>
   rm -f "$err"
   if [ -z "$sequence" ] || [ -z "$generation" ]; then
     [ ! -s "$state/.wake-queue" ] || return 1
-    case "$(cat "$state/.watcher-down" 2>/dev/null || true)" in pending:*) return 1 ;; esac
+    case "$(cat "$state/.watcher-down" 2>/dev/null || true)" in pending:*|announced:*) return 1 ;; esac
     return 0
   fi
   FM_STATE_OVERRIDE="$state" "$DRAIN" --ack-through "$sequence" \
@@ -439,7 +439,7 @@ test_delivery_gap_wake_is_recovered_once() {
 }
 
 test_interrupted_handling_is_redrained_on_rearm() {
-  local dir home state fakebin first_arm recovery_arm generation_before sequence generation handling_watcher_pid
+  local dir home state fakebin first_arm recovery_arm sequence generation handling_watcher_pid handling_generation generation_replay
   dir=$(make_case interrupted-handling-redrain)
   home="$dir/home"
   state="$dir/state"
@@ -462,32 +462,39 @@ test_interrupted_handling_is_redrained_on_rearm() {
   grep "$(printf '\tsignal\tinterrupted.status\t')" "$state/.wake-queue" >/dev/null \
     || fail "pre-successor crash recovery removed the unacknowledged durable wake"
   case "$(cat "$state/.watcher-down" 2>/dev/null || true)" in
-    pending:downtime:*) ;;
+    pending:downtime:*|announced:downtime:*) ;;
     *) fail "reason emission marked recovery handled before a successor was established" ;;
   esac
-  generation_before=$(sed -n 's/^pending:downtime:\(.*\)$/\1/p' "$state/.watcher-down")
+  generation_before=$(recovery_marker_generation "$state/.watcher-down")
+  [ -n "$generation_before" ] || fail "crash-gap recovery left no recovery generation"
 
   start_rearm_arm "$home" "$state" "$fakebin" "$dir/reason-emit-crash-replay.out"
   wait_for_exit "$ARM_PID" 80 || fail "a crash after reason emission stranded the durable wake"
   recovery_arm=$ARM_PID
   grep -F 'check: rearm-resurface' "$dir/reason-emit-crash-replay.out" >/dev/null \
     || fail "a crash after reason emission did not re-drain recovery"
-  [ "$(cat "$state/.watcher-down" 2>/dev/null || true)" = "pending:downtime:$generation_before" ] \
-    || fail "reason-emission replay replaced or prematurely handled its generation"
+  generation_replay=$(recovery_marker_generation "$state/.watcher-down")
+  [ -n "$generation_replay" ] \
+    || fail "reason-emission replay left no recovery generation"
   grep "$(printf '\tsignal\tinterrupted.status\t')" "$state/.wake-queue" >/dev/null \
     || fail "reason-emission replay removed the unacknowledged durable wake"
 
   start_rearm_arm "$home" "$state" "$fakebin" "$dir/handling-successor-arm.out" "$recovery_arm"
   is_live_non_zombie "$ARM_PID" \
     || fail "expected handling successor looped on the pending durable wake"
-  [ "$(cat "$state/.watcher-down" 2>/dev/null || true)" = "pending:downtime:$generation_before" ] \
-    || fail "successor launch marked recovery handled before prompt delivery"
+  case "$(cat "$state/.watcher-down" 2>/dev/null || true)" in
+    announced:downtime:*|pending:downtime:*) ;;
+    *) fail "successor launch marked recovery handled before prompt delivery" ;;
+  esac
+  handling_generation=$(recovery_marker_generation "$state/.watcher-down")
   handling_watcher_pid=$(sed -n 's/^watcher: started pid=\([0-9][0-9]*\).* recovery-generation=.*$/\1/p' "$dir/handling-successor-arm.out")
-  FM_HOME="$home" FM_STATE_OVERRIDE="$state" "$WATCH_ARM" --handling-delivered "$generation_before" \
+  FM_HOME="$home" FM_STATE_OVERRIDE="$state" "$WATCH_ARM" --handling-delivered "$handling_generation" \
     --watcher-pid "$handling_watcher_pid" \
     || fail "confirmed prompt delivery did not begin handling"
-  [ "$(cat "$state/.watcher-down" 2>/dev/null || true)" = "pending:handling:$generation_before" ] \
-    || fail "confirmed prompt delivery did not transition its recovery generation"
+  case "$(cat "$state/.watcher-down" 2>/dev/null || true)" in
+    pending:handling:"$handling_generation"|announced:handling:"$handling_generation") ;;
+    *) fail "confirmed prompt delivery did not transition its recovery generation" ;;
+  esac
   ! grep -F 'check: rearm-resurface' "$dir/handling-successor-arm.out" >/dev/null \
     || fail "expected handling successor emitted a recursive recovery wake"
   FM_HOME="$home" FM_STATE_OVERRIDE="$state" "$DRAIN" > "$dir/interrupted-drain.out" \
@@ -501,7 +508,7 @@ test_interrupted_handling_is_redrained_on_rearm() {
   kill -TERM "$ARM_PID" 2>/dev/null || fail "could not interrupt the handling successor"
   wait "$ARM_PID" 2>/dev/null || true
   case "$(cat "$state/.watcher-down" 2>/dev/null || true)" in
-    pending:downtime:*) ;;
+    pending:downtime:*|announced:downtime:*) ;;
     *) fail "interrupted pre-handling successor did not persist downtime recovery" ;;
   esac
 
@@ -620,7 +627,7 @@ test_markerless_legacy_queue_is_recovered_on_arm() {
   grep -F 'check: rearm-resurface' "$dir/arm.out" >/dev/null \
     || fail "markerless legacy queue did not trigger recovery"
   case "$(cat "$state/.watcher-down" 2>/dev/null || true)" in
-    pending:downtime:*) ;;
+    pending:downtime:*|announced:downtime:*) ;;
     *) fail "markerless legacy queue was not adopted into downtime recovery" ;;
   esac
   FM_HOME="$home" FM_STATE_OVERRIDE="$state" "$DRAIN" > "$dir/drain.out" \
diff --git a/tests/fm-watch-recovery-loop.test.sh b/tests/fm-watch-recovery-loop.test.sh
new file mode 100755
index 0000000000..9dae5ed3d5
--- /dev/null
+++ b/tests/fm-watch-recovery-loop.test.sh
@@ -0,0 +1,222 @@
+#!/usr/bin/env bash
+# Pin the Pi/OpenCode recovery-loop fix: one announcement per generation, and a
+# handling successor that keeps supervising instead of going blind.
+set -u
+
+# shellcheck source=tests/wake-helpers.sh
+. "$(dirname "${BASH_SOURCE[0]}")/wake-helpers.sh"
+
+WATCH="$ROOT/bin/fm-watch.sh"
+TMP_ROOT=$(fm_test_tmproot fm-watch-recovery-loop)
+export NODE_NO_WARNINGS=1
+
+install_pi_watch_extension_fixture() {
+  local repo=$1
+  mkdir -p \
+    "$repo/.pi/extensions/lib" \
+    "$repo/node_modules/@earendil-works/pi-coding-agent" \
+    "$repo/node_modules/@earendil-works/pi-tui" \
+    "$repo/node_modules/typebox" \
+    "$repo/bin"
+  cp "$ROOT/.pi/extensions/fm-primary-pi-watch.ts" "$repo/.pi/extensions/fm-primary-pi-watch.ts"
+  cp "$ROOT/.pi/extensions/lib/fm-calm-visibility.ts" "$repo/.pi/extensions/lib/fm-calm-visibility.ts"
+  cp "$ROOT/.pi/extensions/lib/fm-operational-input.ts" "$repo/.pi/extensions/lib/fm-operational-input.ts"
+  cp "$ROOT/bin/fm-operational-input.sh" "$repo/bin/fm-operational-input.sh"
+  chmod +x "$repo/bin/fm-operational-input.sh"
+  cat > "$repo/node_modules/@earendil-works/pi-coding-agent/package.json" <<'JSON'
+{"name":"@earendil-works/pi-coding-agent","type":"module","exports":"./index.js"}
+JSON
+  cat > "$repo/node_modules/@earendil-works/pi-coding-agent/index.js" <<'JS'
+export function getMarkdownTheme() { return {}; }
+export class UserMessageComponent {
+  render() { return []; }
+  invalidate() {}
+}
+JS
+  cat > "$repo/node_modules/@earendil-works/pi-tui/package.json" <<'JSON'
+{"name":"@earendil-works/pi-tui","type":"module","exports":"./index.js"}
+JSON
+  cat > "$repo/node_modules/@earendil-works/pi-tui/index.js" <<'JS'
+export class Box {
+  addChild() {}
+  clear() {}
+  setBgFn() {}
+}
+export class Container {}
+export class Text {}
+JS
+  cat > "$repo/node_modules/typebox/package.json" <<'JSON'
+{"name":"typebox","type":"module","exports":"./index.js"}
+JSON
+  cat > "$repo/node_modules/typebox/index.js" <<'JS'
+export const Type = {
+  Object(properties) {
+    return { type: "object", properties, additionalProperties: false };
+  },
+};
+JS
+}
+
+# T1: a lost --handling-delivered handshake must not re-announce forever.
+# The real Pi extension drives the real arm/watcher, with only the handshake
+# RPC forced to fail. After the first recovery follow-up, wait past the old
+# ~52s loop period so a regression would emit a second follow-up.
+test_unacknowledged_recovery_is_announced_once_per_generation() {
+  local repo home plugin fakebin out status lock_pid messages
+  repo="$TMP_ROOT/t1-root"
+  home="$TMP_ROOT/t1-home"
+  fakebin="$TMP_ROOT/t1-fakebin"
+  mkdir -p "$repo/bin" "$home/state" "$home/config" "$fakebin"
+  install_pi_watch_extension_fixture "$repo"
+  plugin="$repo/.pi/extensions/fm-primary-pi-watch.ts"
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+exit 0
+SH
+  chmod +x "$fakebin/tmux"
+  cat > "$repo/bin/fm-watch-arm.sh" <<SH
+#!/usr/bin/env bash
+if [ "\${1:-}" = --handling-delivered ]; then
+  exit 1
+fi
+export FM_ROOT_OVERRIDE="$ROOT"
+export PATH="$fakebin:\$PATH"
+exec "$ROOT/bin/fm-watch-arm.sh" "\$@"
+SH
+  chmod +x "$repo/bin/fm-watch-arm.sh"
+  : > "$home/state/seed.meta"
+  printf 'pending:downtime:seed.1.aaa\n' > "$home/state/.watcher-down"
+  chmod 600 "$home/state/.watcher-down"
+  printf '%s\t1\tcheck\tseed\tcheck: seed recovery\n' "$(date +%s)" > "$home/state/.wake-queue"
+  out=$(
+    PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" \
+      FM_STATE_OVERRIDE="$home/state" PATH="$fakebin:$PATH" \
+      FM_POLL=1 FM_SIGNAL_GRACE=0 FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 \
+      node --input-type=module 2>&1 <<'EOF'
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+
+let tool = null;
+const prompts = [];
+const pi = {
+  on() {},
+  registerCommand() {},
+  registerTool(candidate) {
+    if (candidate.name === "fm_watch_arm_pi") tool = candidate;
+  },
+  sendUserMessage: async (message) => {
+    prompts.push(String(message));
+  },
+};
+writeFileSync(`${process.env.FM_HOME}/state/.lock`, `${process.pid}\n`);
+const mod = await import(pathToFileURL(process.env.PLUGIN).href);
+mod.default(pi);
+if (!tool) throw new Error("Pi watch tool was not registered");
+await tool.execute("tool-call-t1", {}, undefined, undefined, {});
+const deadline = Date.now() + 75000;
+let firstAt = 0;
+while (Date.now() < deadline) {
+  const rearm = prompts.filter((message) => message.includes("check: rearm-resurface"));
+  if (rearm.length > 1) {
+    throw new Error(`unbounded recovery loop: ${rearm.length} rearm-resurface follow-ups`);
+  }
+  if (rearm.length === 1 && firstAt === 0) firstAt = Date.now();
+  if (firstAt && Date.now() - firstAt >= 55000) break;
+  await new Promise((resolve) => setTimeout(resolve, 200));
+}
+const rearm = prompts.filter((message) => message.includes("check: rearm-resurface"));
+if (rearm.length !== 1) {
+  throw new Error(`expected exactly one recovery follow-up, got ${rearm.length}: ${prompts.join(" || ")}`);
+}
+const lockPid = existsSync(`${process.env.FM_HOME}/state/.watch.lock/pid`)
+  ? readFileSync(`${process.env.FM_HOME}/state/.watch.lock/pid`, "utf8").trim()
+  : "";
+if (!/^[0-9]+$/.test(lockPid)) throw new Error("successor watcher lock pid missing");
+try {
+  process.kill(Number(lockPid), 0);
+} catch {
+  throw new Error(`successor watcher ${lockPid} is not alive`);
+}
+const marker = readFileSync(`${process.env.FM_HOME}/state/.watcher-down`, "utf8").trim();
+if (!marker.startsWith("announced:") && !marker.startsWith("pending:")) {
+  throw new Error(`successor did not keep a live recovery episode: ${marker}`);
+}
+console.log(`T1_MESSAGES=${rearm.length}`);
+console.log(`T1_LOCK_PID=${lockPid}`);
+console.log(`T1_MARKER=${marker}`);
+process.exit(0);
+EOF
+  )
+  status=$?
+  if [ "${FM_TEST_EVIDENCE:-0}" = 1 ]; then
+    printf '%s\n' "$out"
+  fi
+  lock_pid=$(sed -n 's/^T1_LOCK_PID=//p' <<<"$out" | tail -1)
+  messages=$(sed -n 's/^T1_MESSAGES=//p' <<<"$out" | tail -1)
+  if [ -n "$lock_pid" ]; then
+    kill -TERM "$lock_pid" 2>/dev/null || true
+  fi
+  expect_code 0 "$status" "an unacknowledged recovery must be announced at most once per generation: $out"
+  [ "$messages" = 1 ] || fail "T1 did not report a single recovery follow-up: $out"
+  pass "unacknowledged recovery is announced at most once per generation and the successor stays alive"
+}
+
+# T2: a handling successor must enter its poll loop immediately and surface a
+# real crew event instead of sitting in a pre-loop wait that refreshes the
+# liveness beacon and then exits with a synthetic rearm-resurface.
+test_handling_successor_does_not_go_blind() {
+  local dir home state fakebin child event_start now out
+  dir=$(make_case recovery-gap-successor)
+  home="$dir/home"
+  state="$dir/state"
+  fakebin="$dir/fakebin"
+  mkdir -p "$home/data"
+  : > "$state/crew.meta"
+  printf 'pending:downtime:gap.1.aaa\n' > "$state/.watcher-down"
+  chmod 600 "$state/.watcher-down"
+  out="$dir/watch.out"
+  PATH="$fakebin:$PATH" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    FM_POLL=1 FM_SIGNAL_GRACE=0 FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=600 \
+    FM_WATCH_HANDLING_SUCCESSOR=1 "$WATCH" > "$out" 2>&1 &
+  child=$!
+  now=0
+  while [ "$now" -lt 40 ]; do
+    [ "$(cat "$state/.watch.lock/pid" 2>/dev/null || true)" = "$child" ] && break
+    sleep 0.1
+    now=$((now + 1))
+  done
+  [ "$(cat "$state/.watch.lock/pid" 2>/dev/null || true)" = "$child" ] \
+    || { kill -TERM "$child" 2>/dev/null || true; fail "handling successor did not take the watcher lock"; }
+  sleep 0.4
+  printf 'done: crew finished its task\n' >> "$state/crew.status"
+  event_start=$(date +%s)
+  now=0
+  while [ "$now" -lt 5 ]; do
+    if grep -q '^signal:' "$out" 2>/dev/null; then
+      break
+    fi
+    sleep 0.5
+    now=$((now + 1))
+  done
+  if ! grep -q '^signal:' "$out" 2>/dev/null; then
+    kill -TERM "$child" 2>/dev/null || true
+    wait "$child" 2>/dev/null || true
+    fail "handling successor did not surface the crew event within a poll interval or two (waited $(( $(date +%s) - event_start ))s): $(cat "$out")"
+  fi
+  grep -F 'crew.status' "$out" >/dev/null \
+    || { kill -TERM "$child" 2>/dev/null || true; fail "handling successor did not name the crew status file: $(cat "$out")"; }
+  grep "$(printf '\tsignal\tcrew.status\t')" "$state/.wake-queue" >/dev/null \
+    || { kill -TERM "$child" 2>/dev/null || true; fail "handling successor did not enqueue a durable row for the crew event"; }
+  ! grep -F 'check: rearm-resurface' "$out" >/dev/null \
+    || { kill -TERM "$child" 2>/dev/null || true; fail "handling successor emitted synthetic recovery instead of supervising: $(cat "$out")"; }
+  if [ "${FM_TEST_EVIDENCE:-0}" = 1 ]; then
+    printf 'T2_WATCH_OUTPUT=%s\n' "$(tr '\n' ' ' < "$out")"
+    printf 'T2_QUEUE_ROW=%s\n' "$(grep "$(printf '\tsignal\tcrew.status\t')" "$state/.wake-queue" | tail -1)"
+  fi
+  kill -TERM "$child" 2>/dev/null || true
+  wait "$child" 2>/dev/null || true
+  pass "a resurfacing handling successor stays alive and supervises instead of going blind"
+}
+
+test_handling_successor_does_not_go_blind
+test_unacknowledged_recovery_is_announced_once_per_generation
diff --git a/tests/wake-helpers.sh b/tests/wake-helpers.sh
index 99481201cb..8e6281a576 100644
--- a/tests/wake-helpers.sh
+++ b/tests/wake-helpers.sh
@@ -123,6 +123,11 @@ prime_status_seen() {  # <state> <file>
   ' _ "$ROOT/bin/fm-wake-lib.sh" "$1" "$2"
 }
 
+# Print the generation from a recovery marker token of any status/kind.
+recovery_marker_generation() {  # <marker-file>
+  sed -n 's/^[^:]*:[^:]*:\(.*\)$/\1/p' "$1"
+}
+
 # Acknowledge a drain from its captured stderr (the WAKE_ACK_REQUIRED line).
 ack_drain_err() {  # <state> <stderr-file>
   local state=$1 err=$2 sequence generation

From d3342dcfef8785752538dfc33eee0bea78c3f399 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micka=C3=ABl=20R=C3=A9mond?= <mremond@process-one.net>
Date: Fri, 21 Aug 2026 16:24:02 +0200
Subject: [PATCH 05/11] fix(bin): surface captain-call record divergence
 (#2744)

* fix(bin): signal a captain call resolved in the log but still held

A captain call has two records and closing one has never closed the
other: a `resolved [key=...]` line closes the status-log fold, while the
backlog task held for the captain closes only through
`fm-captain-hold.sh answer`. Answering on the status side alone left no
trace of the disagreement - the fold went quiet, the durable record kept
saying the captain owed an answer, and nothing warned. The defect was
never the separation; it was the silence.

Add `fm-captain-hold.sh diverged`, a read-only report of that
contradiction, and print it from `fm-wake-drain.sh` as a bounded RECORD
DIVERGENCE section beside OPEN DECISIONS on every drain. It flags one
condition: a task still open and still carrying the captain-hold
annotations whose key was closed on the status side by the resolve verb,
under the collapsed identity or the legacy derived one.

It closes nothing, ever. A captain call closed wrongly leaves review
entirely, which is worse than the noise, so both reconciliation
directions stay human-owned and the printed hint names both - a
resolution is not proof the captain ruled, since a call can dissolve on a
false premise or turn out to have been a question of fact.

Three states are deliberately not divergence: a `captain-held` close is
the verified transfer `complete` writes, a still-open keyed decision
belongs to the OPEN DECISIONS fold, and a captain call with no routed
work item is legitimate rather than incomplete, so routed work is no part
of the test.

`fm-classify-lib.sh` gains `status_key_closing_verb`, which reports how
the status side currently reads one key by replaying the existing
`_fm_decision_fold_line` rule rather than re-deriving it, so the two
closing verbs stay distinguishable in one place. The per-wake cost is one
`tasks-axi list`, one key scan per status log, and the precise per-key
fold only for a key that already names a still-open task; the call is
hard-bounded so a slow backlog tool can never delay wake presentation.

* fix(document): Correct divergence lifecycle documentation

* fix(document): Neutralize divergence lifecycle prose
---
 .../skills/captain-hold-lifecycle/SKILL.md    |   8 +-
 AGENTS.md                                     |   4 +-
 bin/fm-captain-hold.sh                        | 124 +++++++++++++++
 bin/fm-classify-lib.sh                        |  69 +++++++++
 bin/fm-wake-drain.sh                          |  66 +++++++-
 docs/architecture.md                          |   1 +
 docs/captain-hold-lifecycle.md                |  27 +++-
 docs/scripts.md                               |   4 +-
 tests/fm-captain-hold-lifecycle.test.sh       | 141 +++++++++++++++++-
 tests/fm-classify-decision-key.test.sh        |  68 ++++++++-
 10 files changed, 502 insertions(+), 10 deletions(-)

diff --git a/.agents/skills/captain-hold-lifecycle/SKILL.md b/.agents/skills/captain-hold-lifecycle/SKILL.md
index 36afda16ed..eaa7acad20 100644
--- a/.agents/skills/captain-hold-lifecycle/SKILL.md
+++ b/.agents/skills/captain-hold-lifecycle/SKILL.md
@@ -2,7 +2,7 @@
 name: captain-hold-lifecycle
 description: >-
   Agent-only policy for completing investigations and visual reviews without losing unresolved captain calls, and for closing what the captain owns with his actual words.
-  Load before treating an investigation, scout report, structured review, or Lavish review as complete, before ending a visual review that exposed a captain decision, and when recording or routing the captain's answer.
+  Load before treating an investigation, scout report, structured review, or Lavish review as complete, before ending a visual review that exposed a captain decision, when recording or routing the captain's answer, and on any RECORD DIVERGENCE line the wake drain prints.
 user-invocable: false
 metadata:
   internal: true
@@ -34,6 +34,12 @@ A captain-held task closed outside this owner leaves no durable answer, so the c
 Resolved findings, recommendations that need no captain choice, and prose that merely sounds decision-like do not create held tasks.
 Bearings reads the resulting structured state and must never compensate by scraping historical reports, visual-review artifacts, terminal output, chat, or other prose.
 
+A captain call can be written down twice - as the keyed status decision the fold reads, and as the backlog task held for the captain - and those two records can disagree without either surface saying so.
+`bin/fm-captain-hold.sh diverged` reports that contradiction and the wake drain prints it as `RECORD DIVERGENCE`; it closes nothing, because a captain call closed wrongly leaves review entirely, which is worse than the noise.
+Read such a line as "these two records disagree", never as "the captain ruled and someone forgot to file it": a call can dissolve because its premise was false, or turn out to have been a question of fact rather than the captain's to answer.
+Reconcile it with what actually happened - `answer` when the captain's own words exist to record, and a fresh `needs-decision` line re-opening the status decision when that resolution was not the captain's word.
+The absence of a routed work item is not a divergence and the guard never requires one: when the decision IS the deliverable there is nothing to route.
+
 ## Operating sequence
 
 1. Read the complete investigation result and complete the visual review before declaring either complete.
diff --git a/AGENTS.md b/AGENTS.md
index 086852d0f3..ddcf1573f2 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -162,6 +162,7 @@ When that section reports its checks still in progress it names exactly what is
    Presented records remain durable until the handling turn runs the generation-bound acknowledgement printed by the drain.
    Every locked drain also prints a bounded fleet-wide `OPEN DECISIONS` section when durable decision records remain open, including when the queue itself is empty; reconcile those entries before continuing.
    The same drain prints every still-unread `note:` line and pending-reply resolution since the last presentation in an unbounded `UNREAD STATUS` section, so an answer buried under a later routine line is not dropped; those lines are not re-printed after that presentation.
+   It also prints a bounded `RECORD DIVERGENCE` section naming every captain call the status log reads as resolved while its backlog task is still held; nothing is closed for you, and `captain-hold-lifecycle` owns the reconciliation.
    When the lock could not be acquired and verified, the queue is left untouched because no session mutation is authorized, and the guard's tangle/watcher-liveness alarms still print in read-only advisory mode without drain, supervision repair, or checkout repair commands.
 4. **Supervision operating instructions** - after the wake queue and before both digests, the digest emits exactly one operating block for the detected primary harness, followed by the read-once contract that governs them.
    The script itself never starts supervision; the emitted harness protocol owns the exact wait or wake mechanism.
@@ -390,6 +391,7 @@ At the start of every wake-handling turn, drain the durable wake queue before pe
 Session start is the only exception because its one-shot digest already presented the queue while locked or deliberately left it untouched in lock-refused read-only mode.
 Treat any `OPEN DECISIONS` section from the drain as actionable reconciliation input even when no wake record was queued.
 Treat any `UNREAD STATUS` section as newly surfaced status that must be read this turn; those lines are not re-printed after this presentation.
+Treat any `RECORD DIVERGENCE` section as a contradiction between two records of one captain call, never as proof the captain ruled; load `captain-hold-lifecycle` and reconcile it in whichever direction the evidence supports.
 After handling all emitted wakes and reconciling the OPEN DECISIONS and UNREAD STATUS sections, run the exact generation-bound `--ack-through` command printed as `WAKE_ACK_REQUIRED`; interruption before that acknowledgement deliberately leaves the work durable for idempotent re-handling.
 A status line is a wake event, not current state; use `bin/fm-crew-state.sh` when current state matters, especially before re-escalating an old decision, blocker, or pause.
 A declared `paused:` event means a bounded external wait expected to clear on its own, while `blocked:` means firstmate action is needed.
@@ -532,7 +534,7 @@ These skills are not captain-invocable; load them only at their precise triggers
   Cloning or registering a project is add intake and uses the same trigger.
 - `stuck-crewmate-recovery` - load when the session-start digest reports an ordinary direct report's endpoint dead or its metadata has no window, or after a stale wake, looping pane, repeated confusion, an answered-by-brief question, an unresponsive crewmate, or a failed steer.
 - `secondmate-provisioning` - load before creating, seeding, validating, launching, handing backlog to, recovering, pushing inherited local material into, or retiring a secondmate home, and before editing `data/secondmates.md`.
-- `captain-hold-lifecycle` - load before treating an investigation or visual review as complete, before ending a visual review that exposed a captain decision, and when recording or routing the captain's answer.
+- `captain-hold-lifecycle` - load before treating an investigation or visual review as complete, before ending a visual review that exposed a captain decision, when recording or routing the captain's answer, and on any `RECORD DIVERGENCE` line from the wake drain.
 - `process-event-sources` - load before arming a long-polling source, before registering a deterministic condition->action watch (do X as soon as Y is true), and on any `procevent <adapter> <source-id> <sequence>` check wake.
   Never run a registered source's blocking command yourself in a conversational turn.
 - `fmx-respond` - load on an `x-mention <request_id>` `check:` wake to handle the mention, on an `x-mode-error ...` `check:` wake to report the Relay configuration blocker, on a `public-followup ...` `check:` wake or a startup-surfaced public commitment, and on any milestone or terminal wake for a Relay-linked task before posting its completion follow-up; relevant only when Relay is on.
diff --git a/bin/fm-captain-hold.sh b/bin/fm-captain-hold.sh
index d844024560..cb429d9523 100755
--- a/bin/fm-captain-hold.sh
+++ b/bin/fm-captain-hold.sh
@@ -28,6 +28,7 @@
 #   fm-captain-hold.sh binding <source-id>
 #   fm-captain-hold.sh complete <origin-id> (--none | <task-id>...)
 #   fm-captain-hold.sh verify <origin-id>
+#   fm-captain-hold.sh diverged
 #
 # `hold` places an existing task under an active captain hold, or creates the
 # task first when no work item exists to hold (--title required to create; the
@@ -114,6 +115,9 @@
 # identity, so pre-collapse metadata written by fm-decision-hold.sh verifies
 # unchanged. An entry that exists as a task id is always that task.
 #
+# `diverged` is the read-only guard over the seam between the two records of
+# one captain call. See "record divergence" beside command_diverged below.
+#
 # Resolution records: the block written into the body names this script, the
 # decision digest, and a `Resolution mode:` of answered, released, or repaired.
 # Records written by the retired fm-decision-hold.sh (routed, declined,
@@ -863,6 +867,125 @@ EOF
   printf 'verified: %s captain-call inventory\n' "$origin"
 }
 
+# --- record divergence ------------------------------------------------------
+#
+# A captain call can be written down twice, and until now nothing said when
+# those two records disagreed. A `resolved [key=...]` line closes the status-log
+# fold outright; the structured captain-held task is closed by a SEPARATE act
+# (`answer` above). Closing only on the status side therefore looks complete
+# there while the durable record still says the captain owes an answer and
+# keeps resurfacing it. The defect was never the separation; it was the silence.
+#
+# `diverged` is a read-only report of that contradiction and nothing else. It
+# closes NOTHING. A captain call closed wrongly disappears without review, which
+# is strictly worse than the noise this prints, so reconciling a divergence stays
+# a human-owned act - and it runs in either direction: record what the captain
+# actually said with `answer`, or re-open the status decision when that
+# resolution was not the captain's word.
+#
+# What it flags, and only this: a task that is still open and still carries the
+# captain-hold annotations, whose key was closed on the status side by the
+# RESOLVE verb. The other closing verb is not a divergence: a `captain-held`
+# close is the VERIFIED transfer to that very task, written by command_complete
+# only after verifying it, so the structured row staying open behind it is the
+# correct state. Neither is a still-open status decision - the OPEN DECISIONS
+# fold already owns that one.
+#
+# Routed work is deliberately irrelevant. When the decision IS the deliverable
+# there is nothing to route, so the test is only whether the status side already
+# declared this task's key resolved.
+# Nor does the report interpret why that resolution exists. A call can turn out
+# not to be a captain arbitration at all - a premise can dissolve, or a question
+# of fact can prove its first reading wrong - so the report says only that the
+# two records disagree and names both reconciliation directions above.
+#
+# Cost stays flat on a healthy home: one `tasks-axi list`, one key scan per
+# status log, and the precise per-key fold only for a key that already names a
+# still-open task. If tasks-axi is unavailable or its listing cannot be parsed,
+# the guard cannot read the structured record and prints nothing.
+#
+# Output: one `<task-id>\t<origin>\t<key>\t<title>` line per divergence, in
+# status-log then key order; nothing when the two records agree.
+
+# Every still-open task id in this home's backlog, one per line. Only the first
+# two comma-separated listing fields are read - both are slugs that precede any
+# quoted title - so a title containing commas or quotes cannot shift them.
+open_task_ids() {
+  tasks_axi list 2>/dev/null | awk -F, '
+    /^  [A-Za-z0-9._-]+,/ {
+      id = $1
+      sub(/^ +/, "", id)
+      if ($2 != "done") print id
+    }
+  '
+}
+
+# Every key token stated anywhere in a status log. A cheap candidate scan: it
+# over-includes tokens that are only prose, and status_key_closing_verb below is
+# what actually decides what the stream says about a key.
+status_log_key_tokens() {  # <status-file>
+  grep -o '\[key=[A-Za-z0-9._-]*\]' "$1" 2>/dev/null |
+    sed 's/^\[key=//; s/\]$//' | LC_ALL=C sort -u
+}
+
+list_has_line() {  # <newline-separated-list> <value>
+  case $'\n'"$1"$'\n' in
+    *$'\n'"$2"$'\n'*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+command_diverged() {
+  local ids resolve f origin tokens id keys key show title
+  [ "$#" -eq 0 ] || { usage >&2; exit 2; }
+  # Both records must belong to the SAME home or the comparison is meaningless:
+  # tasks-axi reads $FM_HOME's backlog, so a state dir pointed somewhere else
+  # would report one home's status logs against another home's tasks. Every
+  # production caller pairs the two; a mismatch stays silent rather than
+  # inventing a cross-home divergence.
+  [ "$STATE" = "$FM_HOME/state" ] || return 0
+  # A read-only listing on a per-wake path, so it skips the mutation-oriented
+  # compatibility floor and its extra probes: a listing this parser cannot read
+  # simply yields no candidates and the report stays silent.
+  command -v tasks-axi >/dev/null 2>&1 || return 0
+  ids=$(open_task_ids) || return 0
+  [ -n "$ids" ] || return 0
+  resolve=${FM_CLASSIFY_RESOLVE_VERB:-$FM_CLASSIFY_RESOLVE_VERB_DEFAULT}
+  for f in "$STATE"/*.status; do
+    [ -f "$f" ] && [ -r "$f" ] && [ ! -L "$f" ] || continue
+    origin=$(basename "$f"); origin=${origin%.status}
+    tokens=$(status_log_key_tokens "$f")
+    [ -n "$tokens" ] || continue
+    while IFS= read -r id; do
+      [ -n "$id" ] || continue
+      # The keys that could name this task in THIS log: the collapsed identity
+      # (the key IS the task id) and, for a pre-collapse row, the legacy derived
+      # one this origin would have minted.
+      keys=$id
+      case "$id" in
+        "$origin-decision-"?*) keys="$keys"$'\n'"${id#"$origin-decision-"}" ;;
+      esac
+      while IFS= read -r key; do
+        list_has_line "$tokens" "$key" || continue
+        [ "$(status_key_closing_verb "$f" "$key")" = "$resolve" ] || continue
+        show=$(task_show "$id") || continue
+        [ "$(show_field "$show" state)" != "done" ] || continue
+        [ "$(show_field_value "$show" hold_kind)" = captain ] || continue
+        # The title is the only free-text field here, and the report is
+        # TAB-separated, so it goes through the same sanitizer every other
+        # emitted field uses rather than being trusted to stay one clean line.
+        title=$(sanitize_field "$(show_field_value "$show" title)")
+        printf '%s\t%s\t%s\t%s\n' "$id" "$origin" "$key" "$title"
+        break
+      done <<INNER
+$keys
+INNER
+    done <<EOF
+$ids
+EOF
+  done
+}
+
 case "${1:-}" in
   hold) shift; command_hold "$@" ;;
   answer) shift; command_answer "$@" ;;
@@ -872,6 +995,7 @@ case "${1:-}" in
   binding) shift; command_binding "$@" ;;
   complete) shift; command_complete "$@" ;;
   verify) shift; command_verify "$@" ;;
+  diverged) shift; command_diverged "$@" ;;
   -h|--help) usage ;;
   *) usage >&2; exit 2 ;;
 esac
diff --git a/bin/fm-classify-lib.sh b/bin/fm-classify-lib.sh
index db63c2b6bc..4cfbe197eb 100755
--- a/bin/fm-classify-lib.sh
+++ b/bin/fm-classify-lib.sh
@@ -351,6 +351,75 @@ status_open_decisions() {  # <status-file>
   printf '%s' "$open"
 }
 
+# 0 when <key> has a record in a folded "<key>\t<verb>\t<note>" open set.
+_fm_open_set_has() {  # <open-set> <key>
+  case "$1" in
+    "$2"$'\t'*|*$'\n'"$2"$'\t'*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+# The verb stored for <key> in a folded open set (empty when it has no record).
+_fm_open_set_verb() {  # <open-set> <key>
+  local line
+  while IFS= read -r line; do
+    case "$line" in
+      "$2"$'\t'*) line=${line#*$'\t'}; printf '%s' "${line%%$'\t'*}"; return 0 ;;
+    esac
+  done <<EOF
+$1
+EOF
+  return 0
+}
+
+# The verb that last moved <key> in a status stream, which is what tells a
+# consumer HOW the status side currently reads that key. Prints the opening verb
+# (needs-decision or blocked) while the key is still open, the closing verb
+# (resolved, or the captain-held durable-transfer verb) once it is closed, and
+# nothing at all when no line in the stream ever stated a transition for it.
+#
+# The distinction between the two closing verbs is the whole point: a
+# `captain-held` close is the VERIFIED handoff to a durable captain-held task
+# (fm-captain-hold.sh complete writes it only after verifying that task), so the
+# structured row staying open afterwards is correct. A `resolved` close claims
+# the question is settled outright, so a structured row still open behind it is a
+# contradiction between the two records - see fm-captain-hold.sh's `diverged`.
+#
+# Semantics are not re-derived here: every line goes through the same
+# _fm_decision_fold_line rule the two folds use, and the reported verb is read
+# off the transitions that rule produces. Only lines whose parsed key equals the
+# requested one can move that key, so a caller-supplied key other than "default"
+# lets the scan pre-filter the stream to lines carrying its token and stay cheap
+# on a long log.
+status_key_closing_verb() {  # <status-file> <key>
+  local f=$1 want=$2 line resolve held open='' was verb='' stream
+  [ -f "$f" ] && [ -r "$f" ] && [ ! -L "$f" ] || return 0
+  [ -n "$want" ] || return 0
+  resolve=${FM_CLASSIFY_RESOLVE_VERB:-$FM_CLASSIFY_RESOLVE_VERB_DEFAULT}
+  held=${FM_CLASSIFY_CAPTAIN_HELD_VERB:-$FM_CLASSIFY_CAPTAIN_HELD_VERB_DEFAULT}
+  if [ "$want" = default ]; then
+    stream=$(cat "$f") || return 0
+  else
+    stream=$(grep -F "[key=$want]" "$f") || stream=''
+  fi
+  [ -n "$stream" ] || return 0
+  while IFS= read -r line || [ -n "$line" ]; do
+    was=0
+    _fm_open_set_has "$open" "$want" && was=1
+    open=$(_fm_decision_fold_line "$open" "$line" "$resolve" "$held")
+    if [ "$was" = 1 ] && ! _fm_open_set_has "$open" "$want"; then
+      verb=$(status_line_verb "$line")
+    fi
+  done <<EOF
+$stream
+EOF
+  if _fm_open_set_has "$open" "$want"; then
+    _fm_open_set_verb "$open" "$want"
+    return 0
+  fi
+  printf '%s' "$verb"
+}
+
 # Fleet-wide wrapper around status_open_decisions: scans every task's status
 # log under <state> and prefixes each still-open decision with its owning task
 # id, so a per-wake or per-session surface can print the consolidated open set
diff --git a/bin/fm-wake-drain.sh b/bin/fm-wake-drain.sh
index 277b889228..203765be80 100755
--- a/bin/fm-wake-drain.sh
+++ b/bin/fm-wake-drain.sh
@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 # Present durable watcher wake records, optionally acknowledge handled records,
 # annotate every unread line for validated signal status keys, surface unread
-# informational status lines and OPEN DECISIONS, then assert liveness.
+# informational status lines, OPEN DECISIONS, and captain-call record
+# divergence, then assert liveness.
 #
 # Keep sequence-bound row consumption independent from generation-bound episode
 # retirement; docs/watcher-continuity.md owns the recovery contract.
@@ -14,6 +15,8 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 . "$SCRIPT_DIR/fm-classify-lib.sh"
 # shellcheck source=bin/fm-line-cap-lib.sh
 . "$SCRIPT_DIR/fm-line-cap-lib.sh"
+# shellcheck source=bin/fm-timeout-lib.sh
+. "$SCRIPT_DIR/fm-timeout-lib.sh"
 
 DRAIN_TMP=
 DRAIN_LOCK_HELD=false
@@ -174,6 +177,66 @@ EOF
   printf "OPEN DECISIONS: close one by answering it: bin/fm-send.sh <task> --resolve-key <key> '<answer>'\n" || return 1
 }
 
+# Print the RECORD DIVERGENCE section: every captain call whose two records
+# contradict each other - the status log says a key was resolved outright while
+# the task held for the captain is still open. Nothing here closes anything; the
+# section exists because posting the resolution alone reads as complete on the
+# status side, so the durable record can keep saying the captain owes an answer
+# with no warning at all. bin/fm-captain-hold.sh's `diverged` owns which pairs
+# count and why; this prints what it reports.
+#
+# Bounded and silent like OPEN DECISIONS above: nothing prints when the two
+# records agree, which is the common case. If tasks-axi is unavailable, the
+# guard cannot read the structured record and stays silent. A guard failure
+# never changes the drain's exit status - a supervision turn must still present
+# its wakes when the backlog tool is having a bad day.
+print_record_divergence_section() {
+  local diverged task origin key title line shown=0 omitted=0 bound
+  local output='' used=0 bytes item_bytes=220 global_bytes=2000
+
+  # A non-positive bound is not a bound (bin/fm-timeout-lib.sh), so a bad
+  # override falls back to the default rather than disabling the deadline.
+  bound=${FM_DIVERGENCE_TIMEOUT:-20}
+  case "$bound" in ''|*[!0-9]*|0) bound=20 ;; esac
+
+  # Bounded, because this runs at the top of every supervision turn: a backlog
+  # tool having a bad day must cost the drain a few seconds at worst, never the
+  # presentation of the wakes it exists to deliver.
+  diverged=$(fm_run_timed "$bound" "$SCRIPT_DIR/fm-captain-hold.sh" diverged 2>/dev/null) || return 0
+  [ -n "$diverged" ] || return 0
+
+  while IFS=$(printf '\t') read -r task origin key title; do
+    [ -n "$task" ] || continue
+    line="$task [key=$key] reads resolved in $origin's status log but is still held for the captain"
+    [ -z "$title" ] || line="$line: $title"
+    fm_cap_line_var "$line" $((item_bytes - 1))
+    line=$FM_LINE_CAP_LINE
+    bytes=$(( ${#line} + 1 ))
+    if [ $((used + bytes)) -gt "$global_bytes" ]; then
+      omitted=$((omitted + 1))
+      continue
+    fi
+    output="$output$line
+"
+    used=$((used + bytes))
+    shown=$((shown + 1))
+  done <<EOF
+$diverged
+EOF
+
+  [ "$shown" -gt 0 ] || [ "$omitted" -gt 0 ] || return 0
+  printf 'RECORD DIVERGENCE (answered in the status log, still held in the backlog - nothing was closed automatically):\n' || return 1
+  printf '%s' "$output" || return 1
+  if [ "$omitted" -gt 0 ]; then
+    printf 'RECORD DIVERGENCE: %d more omitted (byte cap)\n' "$omitted" || return 1
+  fi
+  # Both directions, deliberately. The status resolution is not proof the
+  # captain ruled: a call can dissolve, or turn out to have been a question of
+  # fact. Reconcile with what actually happened - never by closing on the
+  # strength of this line.
+  printf 'RECORD DIVERGENCE: reconcile each one - record the captain'"'"'s own words with bin/fm-captain-hold.sh answer <task> --decision-file <path>, or re-open the status decision when that resolution was not the captain'"'"'s word.\n' || return 1
+}
+
 print_status_sections() {
   local snapshot=${1:-} fully_presented=${2:-} acknowledged
   if [ -z "$snapshot" ]; then snapshot=$(status_presentation_snapshot "$STATE") || return 1; fi
@@ -181,6 +244,7 @@ print_status_sections() {
   acknowledged=$(status_acknowledge_presented_snapshot "$STATE" "$snapshot" "$fully_presented") || return 1
   print_unread_status_section "$snapshot" || return 1
   print_open_decisions_section "$snapshot" || return 1
+  print_record_divergence_section || return 1
   status_commit_presentation_snapshot "$STATE" "$acknowledged"
 }
 
diff --git a/docs/architecture.md b/docs/architecture.md
index a1d7d77753..b2950073d5 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -38,6 +38,7 @@ Crew status files are append-only wake-event logs, not current-state fields.
 Because of that, a per-wake read of only the latest line can bury an earlier still-open `needs-decision`/`blocked` under later unrelated appends; `fm-wake-drain.sh` prints a separate, fleet-wide OPEN DECISIONS section on every presentation (including the empty-queue path session-start relies on), built through `fm-classify-lib.sh`'s cursor-backed incremental scan using the authoritative `status_open_decisions` fold semantics so the buried decision keeps surfacing until it is explicitly resolved while each presentation folds only new status-log appends.
 The drain coordinates that fold and its annotations through a locked fleet-wide snapshot whose `.status-presentation-cursor` manifest records each status file's identity and last-presented byte offset.
 A queued signal annotation prints every status line still unread at that cursor, while the fleet-wide UNREAD STATUS section prints `note:` lines and reserved-key pending-reply resolutions once even on an empty-queue drain because those verbs never enter the OPEN DECISIONS fold.
+A third bounded section, RECORD DIVERGENCE, prints on the same drains for the opposite failure: the status fold went quiet on a key that the durable captain-held task still shows as open, so the status side reads as complete while the two records contradict each other; `bin/fm-captain-hold.sh diverged` decides what counts and closes nothing, and `docs/captain-hold-lifecycle.md` owns the mechanism.
 A failed read, output, or concurrent-replacement check prevents the snapshot cursor from advancing across uncertain bytes, and teardown retires a task's manifest row before that task ID can be reused.
 The explicit resolution is written by the actor that answers, not the busy worker: `fm-send`'s `--resolve-key` appends the closing `resolved` line to this home's own copy of the ledger at answer time, which covers crewmates, local secondmates, and remote secondmates identically because a remote mate's escalations reach that local copy through the parent-replies ingest and only the answer message itself crosses the transport.
 This home's answerer close, pending-reply escalation close, and captain-held transfer use the provenance-guarded append owned by `bin/fm-wake-lib.sh`, so they advance the watcher marker only across their own bytes when all earlier bytes were already announced; pending or interleaved foreign bytes fail toward an ordinary wake.
diff --git a/docs/captain-hold-lifecycle.md b/docs/captain-hold-lifecycle.md
index 5803a6b349..cb8d5cea29 100644
--- a/docs/captain-hold-lifecycle.md
+++ b/docs/captain-hold-lifecycle.md
@@ -55,6 +55,25 @@ A date-deferred captain hold renders as a gate with its `until <date>:` reason;
 Recently Landed excludes a record that closed while still held for the captain (surviving `hold-kind: captain` on a Done row), so answered questions do not masquerade as shipped work; a work item released before completion keeps no hold annotations and lands normally.
 The projection remains read-only and does not inspect historical prose beyond the canonical snapshot's marker.
 
+## Record divergence
+
+A captain call can have two records, and closing one does not close the other.
+A `resolved [key=...]` line closes the status-log fold; the structured captain-held task closes only through `answer`.
+Until this guard existed, closing on the status side alone left no trace of the disagreement: the fold went quiet, the durable record kept saying the captain owed an answer, and nothing warned.
+
+`bin/fm-captain-hold.sh diverged` is the read-only report of that state, and `bin/fm-wake-drain.sh` prints it as a bounded `RECORD DIVERGENCE` section beside OPEN DECISIONS on every drain.
+It flags exactly one condition: a task still open and still carrying the captain-hold annotations, whose key was closed on the status side by the resolve verb, resolved through the collapsed identity (the key is the task id) or the legacy derived one.
+It closes nothing, ever - a captain call closed wrongly leaves review entirely, so both reconciliation directions stay human-owned and the printed hint names both.
+
+Three states are deliberately not divergence.
+A `captain-held [key=...]` close is the verified transfer `complete` writes, so the structured row staying open behind it is correct; `bin/fm-classify-lib.sh`'s `status_key_closing_verb` is what keeps the two closing verbs distinguishable.
+A still-open keyed status decision belongs to the OPEN DECISIONS fold.
+And the absence of a routed work item is legitimate rather than incomplete - when the decision is the deliverable there is nothing to route - so routed work is no part of the test.
+
+Cost stays flat: one `tasks-axi list`, one key scan per status log, and the precise per-key fold only for a key that already names a still-open task.
+The comparison is refused unless the status directory is the active home's own, since tasks-axi reads that home's backlog and a mismatch would report one home's logs against another's tasks.
+If tasks-axi is unavailable or its listing cannot be parsed, the guard cannot read the structured record and prints nothing.
+
 ## Compatibility with pre-collapse installs
 
 Older installs created derived `<origin>-decision-<key>` identities through the retired `bin/fm-decision-hold.sh`.
@@ -65,10 +84,12 @@ The shim recognizes an exact replay of a pre-collapse routed resolution by its h
 
 ## Verification record
 
-Verification date: 2026-08-20.
+Verification date: 2026-08-21.
 
 The focused end-to-end regression suite is `tests/fm-captain-hold-lifecycle.test.sh`, using only synthetic `sample` identities and decision text.
-It proves: a report-only unresolved captain call refuses `--none` completion before teardown can erase the source; non-forced scout teardown always requires the durable inventory verification; the recorded-answer guard (a bare `tasks-axi done` close fails `verify` until `answer` records the captain's word, and an ordinary finished task cannot be dressed up as an answered call); answer-time closure through a bound channel with task-id keys, including the `release` close mode, mode-matched replay idempotence, and the refusal of drifted, mode-mismatched, absent, unheld, and already-closed keys; the chat channel reaching the same intake; deferral through `--until` leaving `captain_actionable` false until due; and every legacy path (composed identities through the shim, pre-collapse `decision_keys=` metadata, routed-resolution replay, and a concrete-origin binding).
+It proves: the reconstructed silent-divergence case is signalled - a status resolution over a still-open captain-held task reaches both `diverged` and the drain's `RECORD DIVERGENCE` section, under the collapsed and the legacy identity alike, while the backlog task, its hold, and the status log all survive the report unchanged and the printed hint names both reconciliation directions; the false-signal boundary holds - a captain call with no routed work item, a verified `captain-held` transfer, a still-open status decision, an already answered call, and an ordinary task whose keyed question was answered all stay silent; a report-only unresolved captain call refuses `--none` completion before teardown can erase the source; non-forced scout teardown always requires the durable inventory verification; the recorded-answer guard (a bare `tasks-axi done` close fails `verify` until `answer` records the captain's word, and an ordinary finished task cannot be dressed up as an answered call); answer-time closure through a bound channel with task-id keys, including the `release` close mode, mode-matched replay idempotence, and the refusal of drifted, mode-mismatched, absent, unheld, and already-closed keys; the chat channel reaching the same intake; deferral through `--until` leaving `captain_actionable` false until due; and every legacy path (composed identities through the shim, pre-collapse `decision_keys=` metadata, routed-resolution replay, and a concrete-origin binding).
+
+`tests/fm-classify-decision-key.test.sh` pins `status_key_closing_verb` itself: it separates a resolution from the durable-transfer close and from a still-open key, reports the last real transition across re-openings and both key positions, and treats a prose mention as no transition.
 
 Projection regressions live in `tests/fm-fleet-snapshot-view.test.sh` (hold-until parsing, the due gate, kind-independent captain actionability, deferred_marker, title stripping) and `tests/fm-bearings-snapshot.test.sh` (Captain's Call membership, the dated-gate rendering, prose-deferral suppression with disclosure, and the landed exclusion by surviving captain-hold annotations).
-The exact commands and their summarized outputs are recorded in the shipping PR's evidence; run the three suites above plus `tests/fm-send-resolve-key.test.sh`, `tests/fm-bearings-board.test.sh`, and `bin/fm-lint.sh` to refresh this record.
+The exact commands and their summarized outputs are recorded in the shipping PR's evidence; run the four suites above plus `tests/fm-send-resolve-key.test.sh`, `tests/fm-bearings-board.test.sh`, and `bin/fm-lint.sh` to refresh this record.
diff --git a/docs/scripts.md b/docs/scripts.md
index 2e7078535e..3c77501a36 100644
--- a/docs/scripts.md
+++ b/docs/scripts.md
@@ -26,7 +26,7 @@ The shared no-mistakes gate refusal for fleet lifecycle entrypoints is summarize
 | `fm-remote-doctor.sh`    | Check, and with `--fix` repair, one remote account's second-mate readiness (remote job worker, Herdr, Aqua launch agents, PATH, and required tools) |
 | `fm-backlog-handoff.sh`  | Validate and delegate queued backlog-item moves into a secondmate home               |
 | `fm-backlog-receive.sh`  | Idempotently ingest one confined remote handoff outbox through tasks-axi             |
-| `fm-captain-hold.sh`     | Hold tasks for the captain, record his answers, and gate investigation completion |
+| `fm-captain-hold.sh`     | Hold tasks for the captain, record the captain's answers, gate investigation completion, and report record divergence between the status log and the backlog |
 | `fm-decision-hold.sh`    | One-release compatibility shim mapping the retired decision commands onto fm-captain-hold.sh |
 | `fm-brief.sh`            | Scaffold ship (explicit `--mode`), scout, secondmate-charter, and Herdr-lab briefs   |
 | `fm-herdr-lab.sh`        | Provision and guardedly operate an isolated, never-default Herdr lab session         |
@@ -91,7 +91,7 @@ The shared no-mistakes gate refusal for fleet lifecycle entrypoints is summarize
 | `fm-tasks-axi-lib.sh`    | Shared backlog-backend selector and `tasks-axi` compatibility probe                  |
 | `fm-quota-axi-lib.sh`    | Shared `quota-axi` compatibility floor for the bootstrap diagnostic                  |
 | `fm-vendor-auth-probe.sh`| Run one hard-bounded, non-destructive authentication probe of a named vendor CLI and report the fact |
-| `fm-wake-drain.sh`       | Present durable watcher wakes, unread informational status lines, and OPEN DECISIONS, consume acknowledged rows through their sequence, retire only the matching recovery generation, then assert supervision health |
+| `fm-wake-drain.sh`       | Present durable watcher wakes, unread informational status lines, OPEN DECISIONS, and captain-call RECORD DIVERGENCE, consume acknowledged rows through their sequence, retire only the matching recovery generation, then assert supervision health |
 | `fm-wake-lib.sh`         | Shared durable wake queue, recovery generations, portable locks, and watcher identity/health helpers |
 | `fm-classify-lib.sh`     | Shared wake-classification vocabulary, durable keyed-decision folds and scans, and unread informational status-line selection |
 | `fm-send.sh`             | Send one verified literal line or supported key through the target's recorded backend |
diff --git a/tests/fm-captain-hold-lifecycle.test.sh b/tests/fm-captain-hold-lifecycle.test.sh
index 7ff15188ce..d5f8d2a527 100755
--- a/tests/fm-captain-hold-lifecycle.test.sh
+++ b/tests/fm-captain-hold-lifecycle.test.sh
@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 # End-to-end tests for captain-held tasks: the one primitive behind "a decision
 # is simply a task waiting on the captain", its completion gate, its recorded
-# answers, and the legacy compatibility for pre-collapse decision identities.
+# answers, the record-divergence guard over its two records, and the legacy
+# compatibility for pre-collapse decision identities.
 set -u
 
 # shellcheck source=tests/lib.sh
@@ -1028,6 +1029,142 @@ test_origin_slug_validation_precedes_path_construction() {
   pass "completion and verification validate origins before constructing paths"
 }
 
+# --- record divergence ------------------------------------------------------
+
+run_drain() {  # <home>
+  local home=$1
+  PATH="$home/fakebin:$PATH" REAL_TASKS_AXI="$TASKS_AXI_BIN" \
+    FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_STATE_OVERRIDE="$home/state" \
+    FM_DATA_OVERRIDE="$home/data" FM_CONFIG_OVERRIDE="$home/config" \
+    "$ROOT/bin/fm-wake-drain.sh" 2>/dev/null
+}
+
+# Reconstructs the 2026-08-06 loss with synthetic names: the answer was posted
+# as a `resolved [key=...]` line and nothing else, so the status fold went quiet
+# while the durable captain-held task stayed open and kept reading as if the
+# captain had never spoken. Both identities that can carry a captain call must
+# be caught - the collapsed one (the key IS the task id) and the legacy derived
+# one a pre-collapse origin minted - and the report must reach the drain, which
+# is where firstmate actually looks.
+test_status_resolution_over_an_open_hold_is_signalled() {
+  local home id out drain
+  home=$(make_home divergence-signalled)
+  id=sample-route-review
+  tasks_in "$home" add "$id" "Investigate sample routing" --kind scout --repo sample --start >/dev/null \
+    || fail "could not create the investigation fixture"
+  write_origin_meta "$home" "$id"
+  run_captain "$home" hold sample-route-call \
+    --title "Choose route: north or south" --reason "captain route choice pending" \
+    --repo sample --origin "$id" >/dev/null \
+    || fail "could not register the collapsed-identity captain call"
+  run_captain "$home" hold "$id-decision-access" \
+    --title "Open or restricted sample access" --reason "captain access choice pending" \
+    --repo sample --origin "$id" >/dev/null \
+    || fail "could not register the legacy-identity captain call"
+  cat > "$home/state/$id.status" <<'EOF'
+working: report drafted
+needs-decision [key=sample-route-call]: north or south
+resolved [key=sample-route-call]: answered: north
+needs-decision [key=access]: open or restricted sample access
+resolved [key=access]: answered: restricted
+done: report complete
+EOF
+
+  out=$(run_captain "$home" diverged) || fail "diverged failed on the reconstructed loss"
+  printf '%s\n' "$out" | grep -F "sample-route-call	$id	sample-route-call" >/dev/null \
+    || fail "the collapsed-identity divergence was not signalled: $out"
+  printf '%s\n' "$out" | grep -F "$id-decision-access	$id	access" >/dev/null \
+    || fail "the legacy-identity divergence was not signalled: $out"
+
+  drain=$(run_drain "$home") || fail "the drain failed while reporting divergence"
+  printf '%s\n' "$drain" | grep -F 'RECORD DIVERGENCE' >/dev/null \
+    || fail "the divergence never reached the drain: $drain"
+  printf '%s\n' "$drain" | grep -F 'sample-route-call [key=sample-route-call]' >/dev/null \
+    || fail "the drain section omitted the collapsed-identity divergence: $drain"
+  printf '%s\n' "$drain" | grep -F "$id-decision-access [key=access]" >/dev/null \
+    || fail "the drain section omitted the legacy-identity divergence: $drain"
+
+  # It signals; it never closes. Both records must survive the report unchanged,
+  # because closing a captain call wrongly removes it from review entirely.
+  assert_grep "sample-route-call" "$home/data/backlog.md" "the report must not remove the captain-held task"
+  tasks_in "$home" show sample-route-call --full | grep -E '^  held: yes' >/dev/null \
+    || fail "the report released or closed the captain-held task"
+  [ "$(grep -c '^resolved \[key=sample-route-call\]' "$home/state/$id.status")" = 1 ] \
+    || fail "the report rewrote the status log"
+
+  # And it names BOTH reconciliation directions. A status resolution is not proof
+  # the captain ruled: one of the real cases dissolved because its premise was
+  # false and another was a question of fact whose first reading was wrong, so
+  # the only safe instruction is "reconcile with what actually happened".
+  printf '%s\n' "$drain" | grep -F 'fm-captain-hold.sh answer' >/dev/null \
+    || fail "the drain section does not say how to record the captain's answer: $drain"
+  printf '%s\n' "$drain" | grep -F 're-open the status decision' >/dev/null \
+    || fail "the drain section does not offer the re-open direction: $drain"
+  pass "a status resolution over a still-open captain-held task is signalled, not closed"
+}
+
+# The false-signal boundary, driven by the shapes that are genuinely fine. A
+# captain call whose deliverable IS the decision has no routed work item at all,
+# and that is legitimate: routed work must never be part of the test. Nor may a
+# verified `captain-held` transfer, a still-open status decision, an already
+# answered call, or an ordinary task that merely had a keyed question answered.
+test_legitimate_holds_produce_no_divergence_signal() {
+  local home id out drain answer
+  home=$(make_home divergence-no-false-signal)
+  id=sample-systems-review
+  tasks_in "$home" add "$id" "Investigate sample systems" --kind scout --repo sample --start >/dev/null \
+    || fail "could not create the investigation fixture"
+  write_origin_meta "$home" "$id"
+
+  # (1) The decision IS the deliverable: held for the captain, nothing routed,
+  # no status line anywhere naming it.
+  run_captain "$home" hold sample-standalone-call \
+    --title "Adopt the sample naming convention" --reason "captain call with no routed work" \
+    --repo sample >/dev/null || fail "could not register the deliverable-is-the-decision call"
+  # (2) The verified transfer: still open structurally, closed on the status side
+  # by the captain-held verb command_complete writes.
+  run_captain "$home" hold sample-transfer-call \
+    --title "Choose the sample retention window" --reason "captain retention choice pending" \
+    --repo sample >/dev/null || fail "could not register the transferred call"
+  # (4) An already answered call whose status line reads resolved.
+  run_captain "$home" hold sample-answered-call \
+    --title "Choose the sample export format" --reason "captain export choice pending" \
+    --repo sample >/dev/null || fail "could not register the answered call"
+  answer="$home/answer.txt"
+  printf 'Export as CSV.\n' > "$answer"
+  run_captain "$home" answer sample-answered-call --decision-file "$answer" >/dev/null \
+    || fail "could not record the captain answer fixture"
+  # (5) An ordinary in-flight work item that is not held for the captain.
+  tasks_in "$home" add sample-plain-work "Ordinary sample work" --kind ship --repo sample --start >/dev/null \
+    || fail "could not create the ordinary work fixture"
+
+  cat > "$home/state/$id.status" <<'EOF'
+working: report drafted
+needs-decision [key=sample-transfer-call]: choose the retention window
+captain-held [key=sample-transfer-call]: tracked by sample-transfer-call
+needs-decision [key=sample-open-call]: still open on both sides
+needs-decision [key=sample-answered-call]: choose the export format
+resolved [key=sample-answered-call]: answered: CSV
+needs-decision [key=sample-plain-work]: worker question about the sample fixture
+resolved [key=sample-plain-work]: answered: go ahead
+EOF
+  # (3) A still-open status decision whose structured twin is also still open.
+  run_captain "$home" hold sample-open-call \
+    --title "Choose the sample refresh cadence" --reason "captain cadence choice pending" \
+    --repo sample >/dev/null || fail "could not register the still-open call"
+
+  out=$(run_captain "$home" diverged) || fail "diverged failed on the legitimate shapes"
+  [ -z "$out" ] || fail "legitimate captain holds produced a false divergence signal: $out"
+
+  drain=$(run_drain "$home") || fail "the drain failed on the legitimate shapes"
+  if printf '%s\n' "$drain" | grep -F 'RECORD DIVERGENCE' >/dev/null; then
+    fail "the drain printed a divergence section with nothing diverging: $drain"
+  fi
+  printf '%s\n' "$drain" | grep -F 'sample-open-call' >/dev/null \
+    || fail "setup error: the still-open decision should still reach OPEN DECISIONS: $drain"
+  pass "a captain call with no routed work, a verified transfer, an open decision, and an answered call all stay silent"
+}
+
 test_uninventoried_report_decision_refuses_completion
 test_completion_gate_attests_and_transfers
 test_answer_records_and_closes
@@ -1043,3 +1180,5 @@ test_unbound_source_closes_no_hold
 test_legacy_identities_keep_working
 test_chat_channel_feeds_the_same_keyed_answer_intake
 test_origin_slug_validation_precedes_path_construction
+test_status_resolution_over_an_open_hold_is_signalled
+test_legitimate_holds_produce_no_divergence_signal
diff --git a/tests/fm-classify-decision-key.test.sh b/tests/fm-classify-decision-key.test.sh
index 57adb376db..8c4196a8a2 100755
--- a/tests/fm-classify-decision-key.test.sh
+++ b/tests/fm-classify-decision-key.test.sh
@@ -11,7 +11,10 @@
 # verb, regardless of order or count. These tests drive the REAL
 # status_line_verb / status_open_decisions / status_open_decisions_incremental
 # functions over crafted status files and assert their folded output, never the
-# fold's own source text. Cross-drain cursor persistence and the incremental
+# fold's own source text. Also covers status_key_closing_verb, which reports how
+# the status side currently reads one key so a consumer can tell a settled key
+# from one handed to a durable captain-held task (bin/fm-captain-hold.sh
+# diverged). Cross-drain cursor persistence and the incremental
 # cost bound live in tests/fm-wake-drain-open-decisions-cursor.test.sh; the
 # drain wiring lives in tests/fm-wake-drain-open-decisions.test.sh.
 set -u
@@ -272,3 +275,66 @@ test_corr_only_tag_opens_as_default_like_a_bare_line
 test_key_only_before_colon_still_opens_no_regression
 test_blocked_and_resolved_are_tag_order_independent
 test_incremental_agrees_with_full_fold_across_appends
+
+# status_key_closing_verb reports HOW the status side currently reads one key,
+# which is what lets a consumer tell a settled key from a key handed to a
+# durable captain-held task. The two closing verbs must stay distinguishable:
+# `resolved` claims the question is settled outright, while `captain-held` is
+# the verified transfer to that task, so treating them alike would either lose
+# the record-divergence signal or invent one on every correct transfer.
+test_closing_verb_separates_resolution_from_durable_transfer() {
+  local dir f
+  dir=$(case_dir closing-verb)
+  f="$dir/a.status"
+  cat > "$f" <<'EOF'
+working: started
+needs-decision [key=route]: north or south
+resolved [key=route]: answered: north
+needs-decision [key=access]: open or restricted
+captain-held [key=access]: tracked by sample-access-call
+blocked [key=creds]: need the deploy token
+done: everything else shipped
+EOF
+  [ "$(status_key_closing_verb "$f" route)" = resolved ] \
+    || fail "a resolved key did not report the resolve verb: '$(status_key_closing_verb "$f" route)'"
+  [ "$(status_key_closing_verb "$f" access)" = captain-held ] \
+    || fail "a durable-transfer close reported the wrong verb: '$(status_key_closing_verb "$f" access)'"
+  [ "$(status_key_closing_verb "$f" creds)" = blocked ] \
+    || fail "a still-open key must report its opening verb: '$(status_key_closing_verb "$f" creds)'"
+  [ -z "$(status_key_closing_verb "$f" never-mentioned)" ] \
+    || fail "a key with no transition line reported a verb"
+  [ -z "$(status_key_closing_verb "$dir/absent.status" route)" ] \
+    || fail "an absent status file reported a verb"
+  pass "status_key_closing_verb separates resolution, durable transfer, and still-open"
+}
+
+# The reported verb is the LAST transition, read through the same fold rule as
+# everything else: the colon-first key position counts, a re-opened key reports
+# open again, and a prose mention is never a transition.
+test_closing_verb_tracks_the_last_transition_in_both_positions() {
+  local dir f
+  dir=$(case_dir closing-verb-last)
+  f="$dir/a.status"
+  cat > "$f" <<'EOF'
+needs-decision: [key=route] colon-first open
+resolved: [key=route] colon-first close
+EOF
+  [ "$(status_key_closing_verb "$f" route)" = resolved ] \
+    || fail "a colon-first resolution was not seen: '$(status_key_closing_verb "$f" route)'"
+
+  printf 'needs-decision [key=route]: re-opened after a bad answer\n' >> "$f"
+  [ "$(status_key_closing_verb "$f" route)" = needs-decision ] \
+    || fail "a re-opened key still reported closed: '$(status_key_closing_verb "$f" route)'"
+
+  printf 'resolved [key=route]: answered: south after all\n' >> "$f"
+  [ "$(status_key_closing_verb "$f" route)" = resolved ] \
+    || fail "the last of several transitions was not reported: '$(status_key_closing_verb "$f" route)'"
+
+  printf 'working: a later append that only mentions [key=route] as prose\n' >> "$f"
+  [ "$(status_key_closing_verb "$f" route)" = resolved ] \
+    || fail "a prose mention changed the reported verb: '$(status_key_closing_verb "$f" route)'"
+  pass "status_key_closing_verb reports the last real transition, in either key position"
+}
+
+test_closing_verb_separates_resolution_from_durable_transfer
+test_closing_verb_tracks_the_last_transition_in_both_positions

From 4d2cb0ca5a85d700f8a89e354f9e0eb42b38a64b Mon Sep 17 00:00:00 2001
From: Inthuson <iaminthuson@gmail.com>
Date: Fri, 21 Aug 2026 15:24:46 +0100
Subject: [PATCH 06/11] fix(bin): re-arm after an abandoned auto-arm claim and
 defer a wedge escalation while a worktree is written (#2524)

* fix(watch): re-arm supervision after an abandoned auto-arm claim

A Claude auto-arm cycle that armed, delivered one rewake, and exited left
its single-flight lock behind. Both Stop-event participants then deferred
to that lock forever, because its recorded pid was still live: the
turn-end guard read it as recovery under way and allowed the stop, and the
next Stop firing treated it as another owner and declined to arm. On
2026-08-14 a home with two tasks in flight lost supervision for about 40
minutes with no watcher process and no watcher lock, its beacon frozen at
the one delivery, and both crewmates' finished reports sat in the durable
queue until an operator drained it by hand.

Abandonment is now proven from the epoch ledger instead of inferred from
pid liveness. A lock whose holder pid matches the ledger's own owner_pid
while the recorded outcome is anything other than arming has already
finished its decision, so that claim is reclaimed under the lock's steal
mutex, stops counting as recovery ownership in the guard, and is cleared
by the guard's terminal check rather than deferred to. A failed clear
re-blocks instead of allowing a blind stop, and an arming entry stays in
flight however old it is, because its owner foregrounds the arm for the
whole watcher cycle.

Issue #2251's PR #2263 does not cover this failure. It is closed and
unmerged, lives entirely in bin/fm-watch-arm.sh, and retires the stalled
watcher and matching stale watcher lock of an arm that is currently
running. Here no arm and no watcher were running and no watcher lock
existed, so it has nothing to retire and the home stays blind.

tests/fm-claude-stop-autoarm.test.sh covers the reclaim, the still-arming
and unnamed-owner cases that must keep the gate closed, and the failed
clear. tests/fm-turnend-guard.test.sh covers the guard side of the same
boundary. Both fail without this change.

* fix(watch): defer a wedge escalation while the task worktree is written

The wedge detector had two inputs, rendered pane quietness and the run
step, and neither can see a crew that is writing source, then tests, then
documentation behind a static pane. On 2026-08-14 one crewmate produced
eight consecutive possible-wedge escalations in a single afternoon, three
of them demanding deep inspection, while it was demonstrably working and
then committed. Every one of them cost a supervision turn to disprove by
hand.

Add write activity inside the crew's own recorded worktree as a third
liveness input. crew_worktree_written_since compares the worktree against
the caller's existing idle-window timer file, so -newer needs no clock
arithmetic, no temp file, and no portable mtime write. The probe runs only
inside the branch that was about to escalate, which bounds it to one
pruned, depth-bounded walk per window per FM_STALE_ESCALATE_SECS and
leaves the per-poll stale sweep exactly as cheap as before.

Positive evidence defers rather than cancels. The idle timer restarts so
the next window probes again, the escalation counter is neither advanced
nor reset so a later genuine wedge keeps the demand-deep-inspection
history it earned, and a .writing-since marker ages the whole deferral
chain so the pane still re-surfaces once per FM_PAUSE_RESURFACE_SECS,
through the same throttle shape a declared pause already uses, labeled as
a recheck rather than a wedge. This can only reduce false positives: every
absence of evidence, including no recorded worktree, a torn-down worktree,
a missing anchor, and a failed walk, falls through to the unchanged
escalation schedule, so a crew that writes nothing still escalates on the
existing timetable.

What the signal cannot see, by design or by construction:

- CPU burn with no writes, such as a long compaction, is invisible. That
  case keeps the old behavior exactly.
- A commit-only phase writes only .git, which is pruned first so that
  firstmate's own read-only git commands against the worktree can never
  make the probe self-fulfilling.
- Writes under the pruned generated trees, or deeper than
  FM_WORKTREE_WRITE_MAXDEPTH, do not count.
- The probe cannot attribute a write to the crew, so a background build or
  another process touching the tree looks the same. The hourly re-surface
  is what bounds that, and a churny file cannot buy silence.
- The away-mode daemon's own escalation path is deliberately untouched.

tests/fm-watch-triage.test.sh covers the classifier including the .git
prune, both halves of the live case on one fixture (quiet plus writing
defers, quiet plus silent still escalates and counts), and the bounded
re-surface. All three fail without this change.

* no-mistakes(review): prove autoarm claims by identity; skip mate-home write probe

* no-mistakes(document): document away-mode wedge boundary and probe filesystem limit

* no-mistakes(document): qualify turn-end recovery condition for abandoned auto-arm claims

* fix(watch): keep a write deferral scoped to its own idle window

Two consistency gaps in the worktree write probe, both found while reviewing
the wedge-deferral change on this branch.

A write deferral is a bounded chain: its .writing-since marker ages the whole
chain so a churning worktree still re-surfaces once per resurface window. That
is only sound while the chain belongs to the current quiet stretch, so every
path that restarts the idle-window timer has to drop it too. Two did not: the
corrupt-timer repair in wedge_timer_check, and both first-sight branches for a
captain-relevant status. A chain left over from an earlier quiet stretch made
the first deferral of the new window re-surface immediately instead of after a
full fresh window.

FM_WORKTREE_WRITE_PRUNE is a skip list, so clearing it reads as "skip nothing"
and is the obvious way to widen the probe to the whole depth-bounded tree.
Instead an empty list reported no evidence at all, quietly costing the wedge
detector its third liveness input on a home that meant to widen the walk. An
empty list now widens the walk, and the header says so.

Neither change alters when a stall that writes nothing escalates.

Regressions in tests/fm-watch-triage.test.sh cover all three paths and each
one fails on the pre-fix code.

* no-mistakes(review): honor an empty write-prune, bound the probe, share window_key

* no-mistakes(document): align probe knob count and guard regression-coverage ownership

* no-mistakes(lint): silence deliberate single-quote SC2016 in write-prune env test
---
 AGENTS.md                            |   2 +-
 bin/fm-classify-lib.sh               | 108 +++++-
 bin/fm-claude-stop-autoarm.sh        |  24 +-
 bin/fm-supervise-daemon.sh           |   3 +-
 bin/fm-test-run.sh                   |   5 +-
 bin/fm-turnend-guard.sh              |  26 +-
 bin/fm-wake-lib.sh                   | 135 ++++++++
 bin/fm-watch.sh                      | 163 ++++++---
 docs/architecture.md                 |   9 +-
 docs/configuration.md                |   3 +
 docs/turnend-guard.md                |  11 +-
 docs/watcher-continuity.md           |   5 +-
 tests/fm-afk-return.test.sh          |   3 +
 tests/fm-claude-stop-autoarm.test.sh | 216 ++++++++++++
 tests/fm-gotmp.test.sh               |   6 +
 tests/fm-turnend-guard.test.sh       |  80 +++++
 tests/fm-watch-triage.test.sh        | 473 +++++++++++++++++++++++++++
 17 files changed, 1208 insertions(+), 64 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index ddcf1573f2..25f65632d9 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -123,7 +123,7 @@ state/               runtime records and signals; gitignored
   .watch.lock .wake-queue.lock watcher singleton and queue serialization locks
   .claude-autoarm.lock .claude-autoarm-epoch .claude-autoarm-failure-notified .claude-autoarm-failure-alarmed .turnend-claude-blocks .turnend-claude-blocks.lock   Claude Stop auto-arm single-flight, epoch, failure-episode, attended-alarm, guard-budget, and budget-lock records; never touch
   .cursor-park-owner .cursor-park-owner.lock .turnend-cursor-blocks   Cursor stop-hook owner record, publication and commit lock, and bounded repair-nag budget; never touch
-  .hash-* .count-* .stale-* .stale-since-* .paused-* .wedge-escalations-* .seen-* .hb-surfaced-* .last-* .heartbeat-streak   watcher internals; never touch
+  .hash-* .count-* .stale-* .stale-since-* .paused-* .wedge-escalations-* .writing-* .seen-* .hb-surfaced-* .last-* .heartbeat-streak   watcher internals; never touch
   .watch-triage.log  watcher's absorbed-wake debug log (size-capped); never relied on, safe to delete
   .last-watcher-beat watcher liveness beacon, touched every poll (including while absorbing benign wakes); guard scripts read it
   .subsuper-* .supervise-daemon.*   sub-supervisor internals; never touch
diff --git a/bin/fm-classify-lib.sh b/bin/fm-classify-lib.sh
index 4cfbe197eb..d650112ddb 100755
--- a/bin/fm-classify-lib.sh
+++ b/bin/fm-classify-lib.sh
@@ -13,7 +13,7 @@
 # daemon keeps its escalation-digest seen-markers; the watcher keeps its .seen-*
 # signatures).
 #
-# There are two documented exceptions. The absorb classification
+# There are three documented exceptions. The absorb classification
 # (crew_absorb_class and its working/paused wrappers) is NOT a pure status-file
 # read: it reuses bin/fm-crew-state.sh, which may make a bounded no-mistakes call,
 # to decide whether a crew that just stopped its turn or went stale is working,
@@ -23,7 +23,9 @@
 # open-decisions fold" below) also writes: it persists a per-status-file byte
 # cursor and folded open-set as a side effect, so a per-drain fleet-wide scan
 # stays bounded by new appends instead of re-reading each task's whole lifetime
-# log every time.
+# log every time. crew_worktree_written_since reads the task's meta file and walks
+# a bounded slice of its worktree instead of a status file, so callers run it only
+# at the moment they would otherwise escalate.
 
 # Directory of this library, used to locate the sibling fm-crew-state.sh reader.
 # Resolved at source time from BASH_SOURCE so it works whether sourced by a
@@ -35,6 +37,19 @@ _FM_CLASSIFY_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd 2>/dev/null)"
 # or no-mistakes install; absent, it points at the real sibling script.
 FM_CREW_STATE_BIN="${FM_CREW_STATE_BIN:-$_FM_CLASSIFY_LIB_DIR/fm-crew-state.sh}"
 
+# fm_run_timed, the shared hard bound the worktree write probe below puts around
+# its one filesystem walk. bin/fm-timeout-lib.sh owns bounded execution for this
+# repo, so nothing here re-derives the coreutils/BSD/perl selection. That library
+# declares `set -u` for its own hygiene, which a sourced sibling must not impose on
+# THIS library's consumers - several of them deliberately run without it - so the
+# caller's setting is restored around the source.
+case $- in *u*) _fm_classify_nounset=on ;; *) _fm_classify_nounset=off ;; esac
+# shellcheck source=bin/fm-timeout-lib.sh
+# shellcheck disable=SC1091
+. "$_FM_CLASSIFY_LIB_DIR/fm-timeout-lib.sh"
+[ "$_fm_classify_nounset" = on ] || set +u
+unset _fm_classify_nounset
+
 # Captain-relevant status verbs. A status line carrying any of these is work
 # firstmate must see. Lines without these verbs are no-verb signals: the watcher
 # absorbs them only with positive provably-working evidence, while the daemon uses
@@ -1202,6 +1217,95 @@ crew_is_paused() {  # <id>
   [ "$(crew_absorb_class "$1")" = paused ]
 }
 
+# Directories excluded from the worktree write probe below, and the depth it walks.
+# The excluded set is everything a supervisor read or a package manager can write
+# without the crew doing any work - .git first, so firstmate's own read-only git
+# commands against the worktree can never make the probe self-fulfilling - plus the
+# large generated trees that would make the walk expensive. Both are overridable so
+# a home with an unusual layout can widen or narrow the probe. The list is a skip
+# list, so clearing it skips nothing and widens the walk to the whole depth-bounded
+# tree; it never disables the probe, which would quietly cost the wedge detector a
+# liveness input on a home that meant to widen it. Defaulted with the plain form so
+# an explicitly empty value stays empty: clearing the knob in the environment is the
+# documented way to ask for that wider walk, and treating empty as unset would hand
+# the default skip list back to exactly the home that asked for more coverage.
+FM_WORKTREE_WRITE_PRUNE=${FM_WORKTREE_WRITE_PRUNE-'.git node_modules .venv venv __pycache__ .mypy_cache .pytest_cache .ruff_cache .tox target dist build .next .cache vendor'}
+FM_WORKTREE_WRITE_MAXDEPTH=${FM_WORKTREE_WRITE_MAXDEPTH:-6}
+
+# Wall-clock seconds the probe's single walk may take. The walk runs synchronously
+# inside the caller's poll loop at the exact moment an escalation would otherwise
+# fire, and -xdev keeps it out of a nested mount but cannot help when the worktree
+# root ITSELF sits on a hung network or container mount; unbounded, such a walk
+# would wedge the very supervisor that exists to notice a wedge, stalling its
+# heartbeat instead of escalating. Hitting the bound is a negative outcome like
+# every other: it reads as no evidence, so the caller's escalation schedule is
+# untouched and a stall that writes nothing still escalates on the existing
+# schedule. A value that is not a positive integer is not a bound at all (`timeout
+# 0` and the perl fallback's `alarm 0` both disable the deadline), so the default
+# applies instead; the check lives at the point of use so an in-process override
+# gets it too.
+FM_WORKTREE_WRITE_TIMEOUT=${FM_WORKTREE_WRITE_TIMEOUT:-10}
+
+# 0 when some regular file under <id>'s recorded worktree is newer than
+# <anchor-file>: positive evidence the crew is still producing work even though its
+# rendered pane has gone quiet. This is the third liveness input the wedge detector
+# has, after pane quietness and the run step, and it exists because neither of
+# those can see a crew that is writing source, then tests, then documentation
+# behind a static pane - the 2026-08-14 case of eight consecutive possible-wedge
+# escalations against a crew that was demonstrably working the whole time.
+#
+# 1 for every other outcome, including an id with no recorded worktree, a worktree
+# that is gone, a missing anchor, and a walk that fails or finds nothing. Absence of
+# evidence therefore always leaves the caller's existing escalation schedule
+# untouched, so a crew that writes nothing still escalates exactly as before.
+#
+# A kind=secondmate task records a provisioned firstmate home, not a code tree, and
+# such a home runs its OWN supervision inside it: its state/ directory churns a
+# watcher beacon, pane hashes, and heartbeats whether or not the mate is producing
+# anything, so a walk there would report liveness for a mate that has done nothing.
+# Those homes are excluded outright rather than by pruning "state", which would also
+# hide a legitimate source directory of that name in an ordinary worktree. The
+# exclusion is a negative outcome like any other, so an unproductive mate keeps
+# escalating on the caller's unchanged schedule.
+#
+# The anchor is the caller's own idle-window timer file, whose mtime already marks
+# when the quiet window opened, so `-newer` needs no clock arithmetic, no temp
+# file, and no portable mtime-setting. Not a pure status-file read (see the header):
+# one pruned, depth-bounded, wall-clock-bounded walk per call, which callers must
+# reach only when they are otherwise about to escalate, never on every poll. A walk
+# that outlives FM_WORKTREE_WRITE_TIMEOUT is killed and reported as no evidence, so
+# a hung mount costs the escalation nothing but the bound. -xdev holds that walk to the
+# worktree's own filesystem rather than descending into a nested network or container
+# mount, so a write that lands only under such a mount is one more negative outcome.
+crew_worktree_written_since() {  # <id> <state> <anchor-file>
+  local id=$1 state=$2 anchor=$3 wt kind name hit bound
+  local -a names=() prune=()
+  [ -n "$id" ] || return 1
+  [ -f "$anchor" ] || return 1
+  wt=$(grep '^worktree=' "$state/$id.meta" 2>/dev/null | tail -1 | cut -d= -f2- || true)
+  [ -n "$wt" ] && [ -d "$wt" ] || return 1
+  kind=$(grep '^kind=' "$state/$id.meta" 2>/dev/null | tail -1 | cut -d= -f2- || true)
+  [ "$kind" != secondmate ] || return 1
+  if [ -e "$wt/.fm-secondmate-home" ] || [ -L "$wt/.fm-secondmate-home" ]; then
+    return 1
+  fi
+  read -r -a names <<< "$FM_WORKTREE_WRITE_PRUNE"
+  for name in ${names[@]+"${names[@]}"}; do
+    [ "${#prune[@]}" -eq 0 ] || prune+=( -o )
+    prune+=( -name "$name" )
+  done
+  bound=$FM_WORKTREE_WRITE_TIMEOUT
+  case "$bound" in ''|*[!0-9]*|0) bound=10 ;; esac
+  if [ "${#prune[@]}" -gt 0 ]; then
+    hit=$(fm_run_timed "$bound" find "$wt" -xdev -maxdepth "$FM_WORKTREE_WRITE_MAXDEPTH" \
+      \( "${prune[@]}" \) -prune -o -type f -newer "$anchor" -print -quit 2>/dev/null || true)
+  else
+    hit=$(fm_run_timed "$bound" find "$wt" -xdev -maxdepth "$FM_WORKTREE_WRITE_MAXDEPTH" \
+      -type f -newer "$anchor" -print -quit 2>/dev/null || true)
+  fi
+  [ -n "$hit" ]
+}
+
 # 0 (benign/absorb) if EVERY task referenced by a no-verb "signal:" wake is provably
 # working; 1 (actionable/surface) if any is not, or no task can be resolved. Pass the
 # same space-separated file list as signal_reason_is_actionable. Files are mapped to
diff --git a/bin/fm-claude-stop-autoarm.sh b/bin/fm-claude-stop-autoarm.sh
index 806be1bfab..89ce011f6b 100755
--- a/bin/fm-claude-stop-autoarm.sh
+++ b/bin/fm-claude-stop-autoarm.sh
@@ -23,7 +23,10 @@
 #   - Single-flight: Claude does not dedupe async hooks, so a home-scoped owner
 #     lock (state/.claude-autoarm.lock) admits exactly one owner; every other
 #     concurrent firing exits 0 without translating, which keeps one event
-#     epoch on exactly one recovery turn.
+#     epoch on exactly one recovery turn. A lock left behind by a claim whose
+#     ledger outcome is already terminal, or whose recorded pid-identity no
+#     longer matches its live pid, is reclaimed once rather than deferred to
+#     forever (fm_autoarm_claim_abandoned in bin/fm-wake-lib.sh).
 #   - Foreground arm: the owner runs bin/fm-watch-arm.sh in the FOREGROUND of
 #     this hook-owned process tree (never shell &); Claude owns the process
 #     group, so its timeout/session teardown kills arm and watcher together.
@@ -135,7 +138,24 @@ fi
 # Claude runs one background process per firing with no dedupe. Exactly one
 # owner foregrounds the arm and translates its close; every other firing exits
 # 0 so one watcher cycle maps to at most one exit-2 rewake.
-fm_lock_try_acquire "$OWNER_LOCK" || exit 0
+#
+# A claim whose own ledger entry or recorded pid-identity proves its supervision
+# decision already finished is abandoned, not in flight: deferring to it forever
+# is what leaves a home unsupervised with no watcher and no lock
+# (fm_autoarm_claim_abandoned in bin/fm-wake-lib.sh owns that proof and its
+# race-free reclaim). Reclaim it once and retry; anything still genuinely
+# deciding keeps the lock and this firing stays inert.
+if ! fm_lock_try_acquire "$OWNER_LOCK"; then
+  fm_autoarm_release_abandoned "$STATE" || exit 0
+  fm_lock_try_acquire "$OWNER_LOCK" || exit 0
+fi
+# Record WHO this claim is before publishing the role both Stop participants read
+# as ownership. A bare pid the operating system later hands to an unrelated live
+# process is exactly what makes a killed claim look in flight forever, in the two
+# shapes the ledger cannot settle: an entry still reading arming, and no entry at
+# all. Best effort; a home whose identity cannot be recorded keeps the ledger-only
+# boundary rather than losing its claim.
+fm_autoarm_claim_record_identity "$STATE" || true
 if ! fm_lock_set_role "$OWNER_LOCK" autoarm; then
   fm_lock_release "$OWNER_LOCK"
   exit 0
diff --git a/bin/fm-supervise-daemon.sh b/bin/fm-supervise-daemon.sh
index ff123a7faf..c772bd3a15 100755
--- a/bin/fm-supervise-daemon.sh
+++ b/bin/fm-supervise-daemon.sh
@@ -471,7 +471,8 @@ clear_pause_tracking() {  # <window> <state>
   watcher_key=$(_stale_key "$win")
   rm -f "$state/.subsuper-paused-$key" "$state/.subsuper-stale-$key" \
     "$state/.paused-$watcher_key" "$state/.paused-rechecked-$watcher_key" "$state/.paused-resurfaced-$watcher_key" \
-    "$state/.stale-$watcher_key" "$state/.stale-since-$watcher_key" "$state/.wedge-escalations-$watcher_key"
+    "$state/.stale-$watcher_key" "$state/.stale-since-$watcher_key" "$state/.wedge-escalations-$watcher_key" \
+    "$state/.writing-since-$watcher_key" "$state/.writing-resurfaced-$watcher_key"
 }
 
 reconcile_pause_tracking() {  # <window> <state> <last-status-line>
diff --git a/bin/fm-test-run.sh b/bin/fm-test-run.sh
index 0dc8c08244..f6b6749ef8 100755
--- a/bin/fm-test-run.sh
+++ b/bin/fm-test-run.sh
@@ -925,12 +925,13 @@ families_for_changed_path() {
       ;;
     bin/fm-timeout-lib.sh)
       # The shared hard bound: session start's runtime bound, the fleet/bearings
-      # snapshots, the vendor auth probe, and the stow cascade's per-home step
-      # all depend on it.
+      # snapshots, the vendor auth probe, the stow cascade's per-home step, and
+      # the wedge detector's worktree write probe all depend on it.
       printf '%s\n' session-bootstrap
       printf '%s\n' snapshot-bearings
       printf '%s\n' pure-contract-unit
       printf '%s\n' secondmate
+      printf '%s\n' watcher-wake-lock
       ;;
     bin/fm-pr-*|bin/fm-merge-local.sh|bin/fm-teardown.sh|bin/fm-review-diff.sh|\
     bin/fm-x-*|bin/fm-check*)
diff --git a/bin/fm-turnend-guard.sh b/bin/fm-turnend-guard.sh
index f3b4285511..43e7045706 100755
--- a/bin/fm-turnend-guard.sh
+++ b/bin/fm-turnend-guard.sh
@@ -52,7 +52,9 @@
 #   1. a live identity-matched watcher with a fresh beacon allows immediately;
 #   2. otherwise wait briefly (FM_CLAUDE_AUTOARM_SYNC_WAIT_MS, default 800ms)
 #      for the auto-arm to claim this home (state/.claude-autoarm.lock owner
-#      alive) or to record a fresh actionable exit-2 outcome
+#      alive, with a supervision decision still open rather than a claim its own
+#      ledger entry or recorded pid-identity already settles as finished) or to
+#      record a fresh actionable exit-2 outcome
 #      (state/.claude-autoarm-epoch) for this event epoch - either proof allows
 #      without consuming a continuation, so one event epoch yields exactly one recovery turn;
 #      the first fresh exhausted-failure epoch preserves the bounded progression,
@@ -259,7 +261,15 @@ autoarm_owns_recovery() {
   fm_watcher_healthy "$STATE" "$WATCH" "$GRACE" "$FM_HOME" && return 0
   pid=$(cat "$OWNER_LOCK/pid" 2>/dev/null || true)
   role=$(fm_lock_role "$OWNER_LOCK" 2>/dev/null || true)
-  if fm_pid_alive "$pid" && [ "$role" = autoarm ]; then
+  # A live auto-arm owner is only evidence of ownership while its supervision
+  # decision is still open. Once its own ledger entry records a terminal outcome,
+  # or its recorded pid-identity stops matching the pid holding the lock, the lock
+  # is abandoned, and treating it as ownership is what let a dead watcher go
+  # unnoticed for turn after turn. Fall through instead: the outcome cases below
+  # still cover a claim that finished moments ago, so a genuine handoff is not
+  # duplicated, while a stale one now reaches the block.
+  if fm_pid_alive "$pid" && [ "$role" = autoarm ] \
+    && ! fm_autoarm_claim_abandoned "$STATE"; then
     [ ! -e "$FAILURE_NOTICE" ] || budget_account_current_epoch || true
     return 0
   fi
@@ -298,10 +308,18 @@ terminal_fail_open() {
   if ! fm_lock_try_acquire "$OWNER_LOCK"; then
     pid=$(cat "$OWNER_LOCK/pid" 2>/dev/null || true)
     role=$(fm_lock_role "$OWNER_LOCK" 2>/dev/null || true)
-    if fm_pid_alive "$pid" && [ "$role" = autoarm ]; then
+    # Same abandonment test as autoarm_owns_recovery: a claim whose ledger entry
+    # is already terminal, or whose recorded pid-identity no longer matches the
+    # live pid, is not a concurrent owner to step aside for. Stepping aside for one
+    # here allows the stop silently, and the episode's one attended alarm would
+    # never fire, so clear the abandoned claim and let this decision finish
+    # instead. Failing to clear it re-blocks rather than allowing.
+    if fm_pid_alive "$pid" && [ "$role" = autoarm ] \
+      && ! fm_autoarm_claim_abandoned "$STATE"; then
       return 2
     fi
-    return 1
+    fm_autoarm_release_abandoned "$STATE" || return 1
+    fm_lock_try_acquire "$OWNER_LOCK" || return 1
   fi
   if ! fm_lock_set_role "$OWNER_LOCK" terminal-check; then
     fm_lock_release "$OWNER_LOCK"
diff --git a/bin/fm-wake-lib.sh b/bin/fm-wake-lib.sh
index 3fe596889b..28249b661f 100755
--- a/bin/fm-wake-lib.sh
+++ b/bin/fm-wake-lib.sh
@@ -982,6 +982,141 @@ fm_failure_episode_reset() {
   return 0
 }
 
+# --- Claude Stop auto-arm claim abandonment ----------------------------------
+# Both Stop-event participants (bin/fm-claude-stop-autoarm.sh and
+# bin/fm-turnend-guard.sh --claude) stand down for whoever holds the auto-arm's
+# single-flight owner lock, on the premise that a live holder is still deciding
+# supervision. A holder that has already FINISHED that decision but never
+# released the lock turns the courtesy into indefinite silence: every later
+# async firing exits at the lock, the epoch ledger freezes at its last outcome,
+# and each following turn end allows a blind stop while nothing re-arms the
+# watcher. Observed 2026-08-14: one delivered rewake, then a beacon that went
+# 40 minutes without a beat, no watcher lock at all, two workers in flight, and
+# both of their reports unread until an operator drained the queue by hand.
+#
+# One abandonment proof is the ledger, not pid liveness, because both ways a
+# finished claim keeps a live pid - reuse of the recorded pid, and a hook still
+# blocked writing its rewake banner - look alive:
+#
+#   1. the owner lock exists and carries the auto-arm role,
+#   2. its recorded pid is numeric,
+#   3. the ledger's owner_pid is exactly that pid, and
+#   4. the ledger's outcome is present and is not "arming".
+#
+# Condition 3 is what makes reclaiming race-free. A fresh claimant creates the
+# lock BEFORE it writes "arming", so until it does the ledger still names the
+# PREVIOUS owner and the two pids cannot match; a just-started claim is never
+# mistaken for an abandoned one. Condition 4 treats "arming" as in progress no
+# matter how old, because the owner foregrounds fm-watch-arm.sh for the whole
+# watcher cycle, which legitimately runs for hours.
+#
+# The ledger alone cannot prove every abandonment, though: an entry still reading
+# "arming", or no entry at all, says nothing about a recorded pid the operating
+# system has since handed to an unrelated live process - the same lapse, reached
+# when a session teardown kills a claim's whole process group before it can record
+# any outcome or run its release trap. So the claim also records the pid-identity
+# every other supervision lock in this repo records (fm_pid_identity above, used by
+# state/.watch.lock, the supervise-daemon lock, and the AFK launch lock), and a
+# recorded identity that no longer matches the live pid is abandonment on its own,
+# whatever the ledger says. That identity is written BEFORE the auto-arm role is
+# published, and every participant requires that role first, so a claim that is
+# genuinely mid-flight is never read as identity-less. A claim carrying no recorded
+# identity at all (an older build, a hand-edited lock) keeps exactly the
+# ledger-only reasoning above, and an identity that cannot be recomputed for the
+# live pid proves nothing either way, so it falls through to the ledger too.
+_fm_autoarm_epoch_field() {  # <epoch-file> <field>
+  local file=$1 field=$2 tok
+  local -a toks=()
+  [ -r "$file" ] || return 1
+  # 2> before <: a failed input redirection reports through whatever stderr is
+  # current when it runs, so the suppression has to be established first.
+  IFS=' ' read -r -a toks 2>/dev/null < "$file" || return 1
+  for tok in ${toks[@]+"${toks[@]}"}; do
+    case "$tok" in
+      "$field="?*) printf '%s\n' "${tok#*=}"; return 0 ;;
+    esac
+  done
+  return 1
+}
+
+# Record the claiming process's pid-identity inside the auto-arm owner lock, the
+# way every other supervision lock in this repo records it. Best effort by design:
+# a platform where fm_pid_identity cannot answer keeps the ledger-only reasoning
+# rather than losing the claim, and a record that cannot be completed leaves NO
+# identity file behind, so a partial write can never read as a mismatch against
+# its own live owner. Call it before publishing the auto-arm role.
+fm_autoarm_claim_record_identity() {  # <state-dir>
+  local state=$1 lock pid held identity back
+  lock="$state/.claude-autoarm.lock"
+  # Resolve the pid into a variable FIRST: expanding ${BASHPID:-$$} inside the
+  # command substitution below would resolve it in that subshell, recording the
+  # identity of a process that exits immediately and leaving every later reader
+  # with a permanent mismatch against the real owner.
+  pid=${BASHPID:-$$}
+  # The identity must describe the pid the lock publishes, so record it only for a
+  # lock this process actually holds (the same ownership test as fm_lock_set_role).
+  held=$(cat "$lock/pid" 2>/dev/null || true)
+  [ "$held" = "$pid" ] || return 1
+  identity=$(fm_pid_identity "$pid" 2>/dev/null) || return 1
+  [ -n "$identity" ] || return 1
+  if ! printf '%s\n' "$identity" > "$lock/pid-identity" 2>/dev/null; then
+    rm -f "$lock/pid-identity" 2>/dev/null || true
+    return 1
+  fi
+  back=$(cat "$lock/pid-identity" 2>/dev/null || true)
+  if [ "$back" != "$identity" ]; then
+    rm -f "$lock/pid-identity" 2>/dev/null || true
+    return 1
+  fi
+  return 0
+}
+
+fm_autoarm_claim_abandoned() {  # <state-dir>
+  local state=$1 epoch lock role pid owner outcome recorded current
+  lock="$state/.claude-autoarm.lock"
+  epoch="$state/.claude-autoarm-epoch"
+  [ -e "$lock" ] || [ -L "$lock" ] || return 1
+  role=$(fm_lock_role "$lock")
+  [ "$role" = autoarm ] || return 1
+  pid=$(cat "$lock/pid" 2>/dev/null || true)
+  case "$pid" in
+    ''|*[!0-9]*) return 1 ;;
+  esac
+  recorded=$(cat "$lock/pid-identity" 2>/dev/null || true)
+  if [ -n "$recorded" ] && current=$(fm_pid_identity "$pid" 2>/dev/null) \
+    && [ -n "$current" ] && [ "$current" != "$recorded" ]; then
+    return 0
+  fi
+  owner=$(_fm_autoarm_epoch_field "$epoch" owner_pid) || return 1
+  [ "$owner" = "$pid" ] || return 1
+  outcome=$(_fm_autoarm_epoch_field "$epoch" outcome) || return 1
+  case "$outcome" in
+    ''|arming) return 1 ;;
+  esac
+  return 0
+}
+
+# Remove a proven-abandoned auto-arm claim so the next claimant can arm.
+# The proof is re-verified while holding the lock's steal mutex, which is the
+# same serialization fm_lock_try_acquire uses for stale-owner reclaim: while it
+# is held no other process can publish the primary lock, so the window between
+# proving abandonment and removing the lock cannot swallow a genuine new claim.
+fm_autoarm_release_abandoned() {  # <state-dir>
+  local state=$1 lock steal
+  lock="$state/.claude-autoarm.lock"
+  steal="$lock.steal"
+  fm_autoarm_claim_abandoned "$state" || return 1
+  fm_lock_try_acquire "$steal" || return 1
+  if ! fm_autoarm_claim_abandoned "$state"; then
+    fm_lock_release "$steal"
+    return 1
+  fi
+  fm_lock_remove_path "$lock" || true
+  fm_lock_release "$steal"
+  [ -e "$lock" ] || [ -L "$lock" ] || return 0
+  return 1
+}
+
 fm_wake_clean_field() {
   LC_ALL=C tr '\t\r\n' '   '
 }
diff --git a/bin/fm-watch.sh b/bin/fm-watch.sh
index 795fddb518..a056045dfd 100755
--- a/bin/fm-watch.sh
+++ b/bin/fm-watch.sh
@@ -30,7 +30,14 @@
 #                          also carries a "demand-deep-inspection" marker so the
 #                          wake payload itself, not just repetition, forces a
 #                          closer look instead of another routine supervision
-#                          resume. Unless afk is active. A genuinely busy pane
+#                          resume. Unless afk is active. A pane whose own task
+#                          worktree was written during the quiet window is
+#                          deferred rather than escalated (wedge_defer_writing),
+#                          because files appearing there are liveness the pane and
+#                          the run step cannot show; that deferral still
+#                          re-surfaces once per PAUSE_RESURFACE_SECS, and a pane
+#                          that writes nothing keeps the unchanged schedule.
+#                          A genuinely busy pane
 #                          (window_is_busy true) is exempt from the above, but
 #                          only up to BUSY_TURN_MAX_SECS with no completed turn
 #                          (state/<id>.turn-ended, or the spawn record before any
@@ -254,6 +261,20 @@ window_label() {
   [ -n "$task" ] && printf 'fm-%s' "$task"
 }
 
+# The ONE derivation of a window's per-window marker key: `:`, `/` and `.` become
+# `_` so a window name is usable as a filename suffix. Every per-window file the
+# watcher keeps is named by it (.hash-, .count-, .stale-, .stale-since-,
+# .wedge-escalations-, .paused-*, .writing-*), and live homes hold those markers on
+# disk under the current format, so the format lives here alone: a second copy is
+# how a future change to it silently orphans a window's markers instead of clearing
+# them. The helpers below take the derived key rather than re-deriving it, so one
+# poll of one window derives it once.
+window_key() {  # <window>
+  local key=${1//:/_}
+  key=${key//\//_}
+  printf '%s' "${key//./_}"
+}
+
 recorded_windows() {
   local meta w seen=
   for meta in "$STATE"/*.meta; do
@@ -280,6 +301,57 @@ recorded_windows() {
 # below).
 FM_WEDGE_DEMAND_INSPECT_COUNT=${FM_WEDGE_DEMAND_INSPECT_COUNT:-3}
 
+# One bounded re-surface for a pane the watcher is deliberately absorbing, so no
+# absorb can rot invisibly. <age> is how long the current absorb has held and
+# <throttle> is the per-window marker whose mtime records the last re-surface, so
+# once past PAUSE_RESURFACE_SECS the pane wakes once per window rather than every
+# poll. Shared by the declared-pause absorb and the worktree-write deferral so the
+# two cadences cannot drift apart; each caller owns its own marker and reason.
+# Returns without waking while either the absorb or the throttle is inside the
+# window; wake() itself exits the cycle, exactly as it does inline.
+resurface_absorbed() {  # <window> <throttle-marker> <age> <reason>
+  local win=$1 throttle=$2 age=$3 reason=$4
+  [ "$age" -ge "$PAUSE_RESURFACE_SECS" ] || return 0
+  [ "$(age_of "$throttle")" -ge "$PAUSE_RESURFACE_SECS" ] || return 0   # 999999 when no prior re-surface
+  fm_wake_append stale "$win" "$reason" || exit 1
+  date +%s > "$throttle"
+  wake "$reason"
+}
+
+# Defer ONE wedge escalation for a pane that went quiet while its own task
+# worktree is demonstrably still being written (crew_worktree_written_since in
+# fm-classify-lib.sh). The pane and the run step both say nothing is happening;
+# the worktree says otherwise, and files appearing in it is the harder signal to
+# fake, so the escalation is deferred rather than fired. Deliberately a DEFERRAL,
+# not a cancellation: the idle timer restarts, so the next window probes again,
+# and a .writing-since-<key> marker ages the whole deferral chain so the pane
+# still re-surfaces once every PAUSE_RESURFACE_SECS through the shared
+# resurface_absorbed above - literally the same bounded cadence a declared pause
+# uses, throttled by its own .writing-resurfaced-<key> marker - and a crew whose
+# worktree churns without real progress cannot stay invisible. The escalation
+# counter is left alone: it is neither advanced (this is not an escalation) nor
+# reset (a later genuine escalation must still carry the demand-deep-inspection
+# history it had already earned).
+wedge_defer_writing() {  # <window> <since-file> <triage-label> <idle-age>
+  local win=$1 since_file=$2 label=$3 age=$4 key wsf wage
+  key=$(window_key "$win")
+  wsf="$STATE/.writing-since-$key"
+  [ -e "$wsf" ] || date +%s > "$wsf"
+  wage=$(age_of "$wsf")
+  date +%s > "$since_file"
+  resurface_absorbed "$win" "$STATE/.writing-resurfaced-$key" "$wage" \
+    "stale: $win (idle ${age}s, writing its worktree for ${wage}s, rechecked on a long cadence not a wedge; confirm the writes are real progress)"
+  triage_log "absorbed $label (worktree written since the idle window opened, idle ${age}s): $win"
+}
+
+# Drop a window's write-deferral chain wherever its stale bookkeeping resets, so
+# the bounded re-surface cadence is measured from the CURRENT quiet stretch and a
+# long-finished one cannot make the next deferral resurface immediately.
+clear_write_tracking() {  # <window-key>
+  local key=$1
+  rm -f "$STATE/.writing-since-$key" "$STATE/.writing-resurfaced-$key"
+}
+
 # Repeat-poll wedge-timer bookkeeping for an already-classified stale hash
 # absorbed as provably-working - repairs a missing/corrupt timer (self-heals a
 # watcher restart between recording the hash and recording the timer), or
@@ -288,17 +360,25 @@ FM_WEDGE_DEMAND_INSPECT_COUNT=${FM_WEDGE_DEMAND_INSPECT_COUNT:-3}
 # both places a hash can be absorbed this way: the plain non-terminal path,
 # and the stale_is_terminal-overridden path (a captain-relevant status-log
 # line that an active run/busy pane outranked).
-wedge_timer_check() {  # <window> <since-file> <triage-label> <escalation-count-file>
-  local win=$1 since_file=$2 label=$3 escalation_file=$4 since age n reason
+# The worktree write probe runs ONLY here, inside the at-threshold branch that is
+# about to escalate: at most one bounded walk per window per STALE_ESCALATE_SECS,
+# never per poll.
+wedge_timer_check() {  # <window> <since-file> <triage-label> <escalation-count-file> <task>
+  local win=$1 since_file=$2 label=$3 escalation_file=$4 task=$5 since age n reason
   since=$(cat "$since_file" 2>/dev/null || true)
   case "$since" in
     ''|*[!0-9]*)
       date +%s > "$since_file"
+      clear_write_tracking "$(window_key "$win")"
       triage_log "absorbed $label timer reset: $win"
       ;;
     *)
       age=$(( $(date +%s) - since ))
       if [ "$age" -ge "$STALE_ESCALATE_SECS" ]; then
+        if crew_worktree_written_since "$task" "$STATE" "$since_file"; then
+          wedge_defer_writing "$win" "$since_file" "$label" "$age"
+          return 0
+        fi
         n=$(( $(cat "$escalation_file" 2>/dev/null || echo 0) + 1 ))
         echo "$n" > "$escalation_file"
         reason="stale: $win (idle ${age}s, possible wedge, escalation $n)"
@@ -307,6 +387,7 @@ wedge_timer_check() {  # <window> <since-file> <triage-label> <escalation-count-
         fi
         fm_wake_append stale "$win" "$reason" || exit 1
         rm -f "$since_file"
+        clear_write_tracking "$(window_key "$win")"
         wake "$reason"
       fi
       ;;
@@ -333,27 +414,22 @@ busy_turn_over_age() {  # <task>
 # cheap: it NEVER re-reads crew state. The re-surface age is anchored on the
 # status file mtime, not a per-hash marker, so a churny idle pane (a ticking
 # clock, a token counter) cannot keep resetting the cadence the way a hash-tied
-# timer would. A .paused-resurfaced-<key> throttle marker records the last
-# re-surface epoch so, once past the window, it fires once per window rather than
-# every poll. Advances the stale suppressor to <hash> and flags the key paused.
+# timer would. The bounded re-surface itself is the shared resurface_absorbed
+# above, throttled by this window's own .paused-resurfaced-<key> marker. Advances
+# the stale suppressor to <hash> and flags the key paused.
 handle_paused_stale() {  # <window> <task> <hash>
-  local win=$1 task=$2 h=$3 key statusf mtime age rf rf_age reason
-  key=$(printf '%s' "$win" | tr ':/.' '___')
+  local win=$1 task=$2 h=$3 key statusf mtime age
+  key=$(window_key "$win")
   printf '%s' "$h" > "$STATE/.stale-$key"
   : > "$STATE/.paused-$key"
   rm -f "$STATE/.stale-since-$key" "$STATE/.wedge-escalations-$key"
+  clear_write_tracking "$key"
   statusf="$STATE/$task.status"
   mtime=$(stat_mtime "$statusf")
   case "$mtime" in ''|*[!0-9]*) mtime=$(date +%s) ;; esac
   age=$(( $(date +%s) - mtime ))
-  rf="$STATE/.paused-resurfaced-$key"
-  rf_age=$(age_of "$rf")   # 999999 when no prior re-surface
-  if [ "$age" -ge "$PAUSE_RESURFACE_SECS" ] && [ "$rf_age" -ge "$PAUSE_RESURFACE_SECS" ]; then
-    reason="stale: $win (paused ${age}s, awaiting external - declared pause, rechecked on a long cadence not a wedge; confirm the wait still holds)"
-    fm_wake_append stale "$win" "$reason" || exit 1
-    date +%s > "$rf"
-    wake "$reason"
-  fi
+  resurface_absorbed "$win" "$STATE/.paused-resurfaced-$key" "$age" \
+    "stale: $win (paused ${age}s, awaiting external - declared pause, rechecked on a long cadence not a wedge; confirm the wait still holds)"
   triage_log "absorbed stale (paused, awaiting external, age ${age}s): $win"
 }
 
@@ -377,24 +453,19 @@ busy_turn_bound_check() {  # <window> <task> <hash> <since-file> <escalation-fil
     handle_paused_stale "$win" "$task" "$h"
     return 0
   fi
-  wedge_timer_check "$win" "$since_file" "busy (no completed turn)" "$escalation_file"
+  wedge_timer_check "$win" "$since_file" "busy (no completed turn)" "$escalation_file" "$task"
   return 1
 }
 
-clear_pause_state() {  # <window>
-  local win=$1 key
-  key=${win//:/_}
-  key=${key//\//_}
-  key=${key//./_}
+clear_pause_state() {  # <window-key>
+  local key=$1
   rm -f "$STATE/.paused-$key" "$STATE/.paused-rechecked-$key" "$STATE/.paused-resurfaced-$key"
 }
 
-clear_pause_tracking() {  # <window>
-  local win=$1 key
-  key=${win//:/_}
-  key=${key//\//_}
-  key=${key//./_}
-  clear_pause_state "$win"
+clear_pause_tracking() {  # <window-key>
+  local key=$1
+  clear_pause_state "$key"
+  clear_write_tracking "$key"
   rm -f "$STATE/.stale-$key" "$STATE/.stale-since-$key" "$STATE/.wedge-escalations-$key"
 }
 
@@ -403,9 +474,7 @@ clear_pause_tracking() {  # <window>
 # fm-crew-state has fallen back to stopped or unknown.
 pause_state_class() {  # <window> <task>
   local win=$1 task=$2 key last recheck_file class agent_alive
-  key=${win//:/_}
-  key=${key//\//_}
-  key=${key//./_}
+  key=$(window_key "$win")
   last=$(last_status_line "$STATE/$task.status")
   recheck_file="$STATE/.paused-rechecked-$key"
   if ! status_is_paused_or_captain_held "$last"; then
@@ -449,10 +518,11 @@ pause_state_class() {  # <window> <task>
 
 surface_nonterminal_stale() {  # <window> <hash>
   local win=$1 h=$2 key task last
-  key=$(printf '%s' "$win" | tr ':/.' '___')
+  key=$(window_key "$win")
   fm_wake_append stale "$win" "stale: $win" || exit 1
   printf '%s' "$h" > "$STATE/.stale-$key"
   rm -f "$STATE/.stale-since-$key"
+  clear_write_tracking "$key"
   task=$(window_to_task "$win" "$STATE")
   last=$(last_status_line "$STATE/$task.status")
   if status_is_paused_or_captain_held "$last"; then
@@ -1031,19 +1101,16 @@ EOF
   while IFS= read -r w; do
     kind=$(window_kind "$w")
     task=$(window_to_task "$w" "$STATE")
-    key=${w//:/_}
-    key=${key//\//_}
-    key=${key//./_}
+    key=$(window_key "$w")
     last=$(last_status_line "$STATE/$task.status")
     if ! status_is_paused_or_captain_held "$last" && [ -e "$STATE/.paused-$key" ]; then
-      clear_pause_tracking "$w"
+      clear_pause_tracking "$key"
     fi
     if [ "$kind" = secondmate ] && ! status_is_paused "$last"; then
       continue
     fi
     tail40=$(fm_backend_capture "$(window_backend "$w")" "$w" 40 "$(window_label "$w")" 2>/dev/null) || continue
     h=$(printf '%s' "$tail40" | hash_pane)
-    key=$(printf '%s' "$w" | tr ':/.' '___')
     hf="$STATE/.hash-$key"
     cf="$STATE/.count-$key"
     sf="$STATE/.stale-$key"
@@ -1066,7 +1133,7 @@ EOF
         if [ "$kind" = secondmate ]; then
           case "$(pause_state_class "$w" "$task")" in
             paused) handle_paused_stale "$w" "$task" "$h" ;;
-            *)      clear_pause_tracking "$w" ;;
+            *)      clear_pause_tracking "$key" ;;
           esac
         elif afk_present; then
           # Daemon owns triage: one-shot per distinct stale hash, as before.
@@ -1094,11 +1161,13 @@ EOF
             if crew_is_provably_working "$(window_to_task "$w" "$STATE")"; then
               printf '%s' "$h" > "$sf"
               date +%s > "$ssf"
+              clear_write_tracking "$key"
               triage_log "absorbed stale (provably working, overriding a stale captain-relevant status): $w"
             else
               fm_wake_append stale "$w" "stale: $w" || exit 1
               printf '%s' "$h" > "$sf"
               rm -f "$ssf"
+              clear_write_tracking "$key"
               mark_surfaced "$STATE/$(window_to_task "$w" "$STATE").status"
               wake "stale: $w"
             fi
@@ -1107,7 +1176,7 @@ EOF
             # wedge timer is running for it) - keep treating it that way
             # without re-reading the crew state every poll, and without
             # letting the still-captain-relevant log line re-surface it.
-            wedge_timer_check "$w" "$ssf" "stale (overridden terminal status)" "$ewf"
+            wedge_timer_check "$w" "$ssf" "stale (overridden terminal status)" "$ewf" "$task"
           fi
           # else: already surfaced as genuinely terminal on a prior poll of
           # this same hash - nothing left to do (matches the original,
@@ -1131,7 +1200,7 @@ EOF
             task=$(window_to_task "$w" "$STATE")
             case "$(pause_state_class "$w" "$task")" in
               working)
-                clear_pause_tracking "$w"
+                clear_pause_tracking "$key"
                 printf '%s' "$h" > "$sf"
                 date +%s > "$ssf"
                 triage_log "absorbed non-terminal stale (provably working): $w"
@@ -1148,14 +1217,14 @@ EOF
             if [ -e "$pf" ] || status_is_paused_or_captain_held "$(last_status_line "$STATE/$task.status")"; then
               case "$(pause_state_class "$w" "$task")" in
                 paused)  handle_paused_stale "$w" "$task" "$h" ;;
-                working) clear_pause_state "$w"
+                working) clear_pause_state "$key"
                          printf '%s' "$h" > "$sf"
-                         wedge_timer_check "$w" "$ssf" "non-terminal stale (provably working after a declared pause)" "$ewf"
+                         wedge_timer_check "$w" "$ssf" "non-terminal stale (provably working after a declared pause)" "$ewf" "$task"
                          triage_log "absorbed non-terminal stale (provably working): $w" ;;
                 *)       handle_paused_stale "$w" "$task" "$h" ;;
               esac
             else
-              wedge_timer_check "$w" "$ssf" "non-terminal stale" "$ewf"
+              wedge_timer_check "$w" "$ssf" "non-terminal stale" "$ewf" "$task"
             fi
           fi
         fi
@@ -1169,13 +1238,14 @@ EOF
           busy_turn_bound_check "$w" "$task" "$h" "$ssf" "$ewf" && paused_bound=0
         else
           rm -f "$ssf" "$ewf"
+          clear_write_tracking "$key"
         fi
         # A busy pane normally means real work resumed, so stale pause bookkeeping
         # is cleared - but not in the same poll the declared-pause cadence just
         # recorded it, or the re-surface throttle it depends on would be erased and
         # the pause would re-surface every poll instead of once per long cadence.
         if [ "$paused_bound" -ne 0 ] && [ -e "$pf" ] && { [ "$n" -ge 2 ] || ! status_is_paused_or_captain_held "$(last_status_line "$STATE/$(window_to_task "$w" "$STATE").status")"; }; then
-          clear_pause_tracking "$w"
+          clear_pause_tracking "$key"
         fi
       fi
     else
@@ -1186,17 +1256,18 @@ EOF
         busy_turn_bound_check "$w" "$task" "$h" "$ssf" "$ewf" && paused_bound=0
       else
         rm -f "$ssf" "$ewf"
+        clear_write_tracking "$key"
       fi
       task=$(window_to_task "$w" "$STATE")
       if ! afk_present && status_is_paused_or_captain_held "$(last_status_line "$STATE/$task.status")" && [ "$busy_now" -ne 0 ]; then
         case "$(pause_state_class "$w" "$task")" in
           paused) handle_paused_stale "$w" "$task" "$h" ;;
-          *)      clear_pause_tracking "$w" ;;
+          *)      clear_pause_tracking "$key" ;;
         esac
       elif [ "$paused_bound" -ne 0 ] && [ -e "$pf" ]; then
         # Same rule as the stable-hash branch: never clear pause bookkeeping the
         # declared-pause cadence recorded on this very poll.
-        clear_pause_tracking "$w"
+        clear_pause_tracking "$key"
       fi
     fi
   done < <(recorded_windows)
diff --git a/docs/architecture.md b/docs/architecture.md
index b2950073d5..bfcd2dc0e8 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -9,9 +9,13 @@ firstmate's always-loaded operating contract and routing index for conditional p
 ## Event-driven supervision
 
 A zero-token bash watcher (`bin/fm-watch.sh`) sleeps on the fleet, classifies detected wakes in bash, and wakes the first mate only when something is actionable.
-Actionable wakes include captain-relevant status signals, no-verb signals whose crew is not provably working, authenticated check output such as PR merge polling or a Relay mention, stale panes whose crew is not provably working whether their status log looks terminal or non-terminal, provably-working stale panes that persist past `FM_STALE_ESCALATE_SECS`, declared external waits that remain paused past `FM_PAUSE_RESURFACE_SECS`, and heartbeat backstop hits.
+Actionable wakes include captain-relevant status signals, no-verb signals whose crew is not provably working, authenticated check output such as PR merge polling or a Relay mention, stale panes whose crew is not provably working whether their status log looks terminal or non-terminal, provably-working stale panes that persist past `FM_STALE_ESCALATE_SECS` without their own task worktree being written, declared external waits that remain paused past `FM_PAUSE_RESURFACE_SECS`, and heartbeat backstop hits.
 Repeated provably-working stale escalations on the same unchanged pane add an escalation count to the wake reason and, at `FM_WEDGE_DEMAND_INSPECT_COUNT`, a `demand-deep-inspection` marker.
-A busy pane is otherwise exempt from staleness, but only until its latest `state/<id>.turn-ended` marker reaches `FM_BUSY_TURN_MAX_SECS`, or its `state/<id>.meta` spawn record reaches that age before any turn completes; past that bound it is routed through the same wedge escalation, with the identical reason, escalation count, and `demand-deep-inspection` marker, for inspection only - never an automatic interrupt, signal, or restart.
+A pane holding a file newer than the start of its own quiet window, anywhere in the worktree recorded for that task, is deferred instead of escalated, because a crew writing source, then tests, then documentation behind a static pane is liveness that neither pane quietness nor the run step can show.
+That deferral re-surfaces on the same `FM_PAUSE_RESURFACE_SECS` cadence as a declared wait, with a reason naming the write evidence rather than a wedge, and it is bounded to one pruned, depth-bounded, wall-clock-bounded walk (`FM_WORKTREE_WRITE_PRUNE`, `FM_WORKTREE_WRITE_MAXDEPTH`, `FM_WORKTREE_WRITE_TIMEOUT`) taken only in the branch that was about to escalate, never on every poll.
+Every absence of write evidence, including a missing worktree record, a torn-down worktree, a walk that outlives its wall-clock bound on a hung mount, and a failed walk, leaves the existing escalation schedule untouched, so a crew that writes nothing still escalates exactly as before.
+A secondmate is never probed at all, because the worktree recorded for it is a provisioned firstmate home whose own supervision keeps writing inside it whether or not the mate produces anything, so its panes keep escalating on the unchanged schedule.
+A busy pane is otherwise exempt from staleness, but only until its latest `state/<id>.turn-ended` marker reaches `FM_BUSY_TURN_MAX_SECS`, or its `state/<id>.meta` spawn record reaches that age before any turn completes; past that bound it is routed through the same wedge escalation, with the identical reason, escalation count, worktree-write deferral, and `demand-deep-inspection` marker, for inspection only - never an automatic interrupt, signal, or restart.
 A crew that declared an external wait (`paused:`) or a verified captain-held transfer is the one exception to that bound: its busy verdict supplies liveness while identifying the long-running foreground call as the declared wait, so it takes the bounded `FM_PAUSE_RESURFACE_SECS` recheck instead of a wedge escalation.
 Lifting the declaration restores the unchanged busy-pane wedge path, while a pane that is no longer busy returns to the existing idle declared-wait classification.
 Those actionable wakes are written to a durable local queue (`state/.wake-queue`) only after generation-bound recovery evidence is published, so an interrupted watcher or handling turn can be recovered without losing the queue record.
@@ -92,6 +96,7 @@ The watcher and daemon share `bin/fm-classify-lib.sh` for captain-relevant statu
 Terminal verbs remain captain-relevant, while a nonterminal progress verb cannot become terminal merely because its prose contains a legacy free-text token such as `merged`; bare legacy free-text lines remain compatible.
 The always-on watcher also uses that library's absorb classification on no-verb signals and first-sighting stale panes before status-log terminality is trusted, while the daemon maintains distinct wedge and declared-pause recheck cadences.
 In away mode, seen-status dedupe does not clear possible-wedge aging for nonterminal progress, so housekeeping still re-escalates an unchanged idle pane at the configured bound.
+Away-mode housekeeping has no worktree-write deferral of its own, so while `state/.afk` exists a quiet crew that is writing its own worktree still escalates as a possible wedge at that bound.
 The daemon escalates captain-relevant events, plus a bounded recheck for a declared pause that remains idle, as one batched, single-line digest using the canonical `away-supervisor` kind from `bin/fm-operational-input.sh` so firstmate can distinguish it structurally from real messages.
 Its supervisor injection path supports tmux and herdr panes, with `FM_SUPERVISOR_BACKEND` and `FM_SUPERVISOR_TARGET` resolved independently from the task-spawn backend.
 Pane existence, busy checks, composer checks, capture, and verified submit route through `bin/fm-backend.sh`: tmux keeps the same submit core used by the tmux send backend, while herdr uses native agent-state submit confirmation on idle baselines, a composer empty fallback when native stays idle, and a pre-Enter rendered-footer transition when that baseline is unavailable.
diff --git a/docs/configuration.md b/docs/configuration.md
index 8b11f46865..277e925e7c 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -591,6 +591,9 @@ FM_STALE_ESCALATE_SECS=240         # idle seconds before a provably-working stal
 FM_BUSY_TURN_MAX_SECS=3600         # maximum age of a busy pane's latest state/<id>.turn-ended marker, or its state/<id>.meta spawn record before any turn completes, before the same wedge escalation used for a provably-working non-busy stale takes over; inspection-only, never an automatic interrupt or restart; a declared external wait or verified captain-held transfer takes the FM_PAUSE_RESURFACE_SECS recheck below instead
 FM_PAUSE_RESURFACE_SECS=3600       # seconds before the watcher re-surfaces a declared external wait or verified captain-held transfer for a recheck, including a live busy pane past FM_BUSY_TURN_MAX_SECS; the away-mode daemon uses the same setting for declared external waits
 FM_WEDGE_DEMAND_INSPECT_COUNT=3    # consecutive provably-working stale escalations on the same unchanged pane before demand-deep-inspection is added
+FM_WORKTREE_WRITE_PRUNE='.git node_modules .venv venv __pycache__ .mypy_cache .pytest_cache .ruff_cache .tox target dist build .next .cache vendor'   # directory names the wedge detector's task-worktree write probe skips; the default keeps .git out so a supervisor's own read-only git command can never look like crew progress; set it to the empty string to prune nothing, which widens the probe to the whole depth-bounded tree rather than disabling it
+FM_WORKTREE_WRITE_MAXDEPTH=6       # depth that same probe walks below the recorded worktree; it runs only at the moment a wedge escalation would otherwise fire, never on every poll; no probe knob applies to a secondmate, whose recorded worktree is a provisioned home the probe skips entirely
+FM_WORKTREE_WRITE_TIMEOUT=10       # wall-clock seconds that one walk may take, so a worktree on a hung mount cannot stall the watcher poll that started it; hitting the bound reads as no write evidence, which leaves the escalation schedule exactly as it was; a value that is not a positive integer falls back to the default
 FM_WATCH_TRIAGE_LOG_MAX_BYTES=262144   # size cap for the watcher's absorbed-wake debug log
 FM_FLEET_SYNC_BOOTSTRAP_TIMEOUT=     # optional seconds allowed for bootstrap's best-effort clone refresh; unset/blank defaults to max(20, 5 + 3 * origin-backed-project-count)
 FM_FLEET_PRUNE=1        # set to 0 to skip pruning local branches whose upstream is gone
diff --git a/docs/turnend-guard.md b/docs/turnend-guard.md
index 3620230f83..de9b5ed922 100644
--- a/docs/turnend-guard.md
+++ b/docs/turnend-guard.md
@@ -72,7 +72,14 @@ In the default Codex mode, a true value lets the second stop finish after one fo
 
 Claude runs the guard with `--claude`, which ignores `stop_hook_active` and cooperates with the Stop-owned auto-arm.
 Claude Code sets `stop_hook_active=true` on every stop after any stop-hook continuation, including `asyncRewake` rewakes, which re-opened the 2026-07-21 blind window under the default one-shot behavior.
-The Claude mode waits up to `FM_CLAUDE_AUTOARM_SYNC_WAIT_MS` (default 800 milliseconds) and allows the stop when the watcher is healthy, `state/.claude-autoarm.lock` has a live `autoarm` role owner whose eventual failure must exit 2, or `state/.claude-autoarm-epoch` contains a fresh actionable rewake owned by this event epoch.
+The Claude mode waits up to `FM_CLAUDE_AUTOARM_SYNC_WAIT_MS` (default 800 milliseconds) and allows the stop when the watcher is healthy, `state/.claude-autoarm.lock` has a live `autoarm` role owner whose supervision decision is still open and whose eventual failure must exit 2, or `state/.claude-autoarm-epoch` contains a fresh actionable rewake owned by this event epoch.
+A live owner counts as that proof only while its decision is open, which the ledger settles: an entry naming that owner's own pid with any outcome other than `arming` means the claim already finished, so the lock is abandoned rather than in flight.
+The guard then stops reading it as recovery under way, the terminal check clears it instead of stepping aside for it, and the next Stop-owned firing reclaims it and arms rather than deferring.
+Without that boundary a cycle that armed, delivered one rewake, and exited left both Stop participants deferring to its leftover lock indefinitely, so on 2026-08-14 a home with two tasks in flight and a beacon 40 minutes cold ended every turn blind until an operator intervened.
+An `arming` entry stays in flight however old it is, because the owner foregrounds the arm for the whole watcher cycle.
+The shapes the ledger cannot settle are settled by identity instead: the claim records the same `pid-identity` file every other supervision lock records, before it publishes its `autoarm` role, so a recorded identity that no longer matches the pid holding the lock proves abandonment on its own even while the entry still reads `arming` or no ledger entry exists at all.
+That covers a claim whose process group was killed before it could record any outcome and whose pid the operating system later handed to an unrelated live process.
+A claim carrying no recorded identity keeps the ledger-only boundary, and a failed reclaim re-blocks rather than allowing a blind stop.
 Fresh `failed` and `failed-suppressed` outcomes enter or advance the failure progression instead of acting as unconditional recovery proof.
 The auto-arm itself rechecks the healthy watcher predicate and retries a bounded number of times before reporting a genuine failure.
 The first fresh exhausted-failure epoch preserves its handoff without consuming a blocked-stop count, while later fresh failed epochs advance the same monotonic progression instead of resetting it.
@@ -146,7 +153,7 @@ That warning uses `bin/fm-supervision-instructions.sh --repair-line`, so it alwa
 
 ## Regression coverage
 
-`tests/fm-turnend-guard.test.sh` covers the predicate, main and secondmate primary scope, child-worktree exclusion, `FM_HOME` and `FM_STATE_OVERRIDE` precedence, the live-lock and fresh-beacon guard predicate, the cooperative `--claude` claim wait, monotonic failed-epoch progression, bounded attended fail-open, post-alarm continuation suppression, positive recovery reset, Pi logical-run latching, missing-`jq` behavior, all five primary registrations, Grok native and legacy selection, typed field precedence, malformed input, and exactly-one-path safety.
+`tests/fm-turnend-guard.test.sh` covers the predicate, main and secondmate primary scope, child-worktree exclusion, `FM_HOME` and `FM_STATE_OVERRIDE` precedence, the live-lock and fresh-beacon guard predicate, the cooperative `--claude` claim wait, monotonic failed-epoch progression, bounded attended fail-open, post-alarm continuation suppression, positive recovery reset, the abandoned auto-arm claim cases that must block or clear instead of allowing a blind stop, Pi logical-run latching, missing-`jq` behavior, all five primary registrations, Grok native and legacy selection, typed field precedence, malformed input, and exactly-one-path safety.
 `tests/fm-guard-stale-banner.test.sh` covers the pull-guard predicate, including the persistent-model fresh-leftover-beacon negative control, the auto-arm model's healthy fresh-beacon-without-a-watcher case and stale-beacon alarm, and the extension model's live-watcher path, ownership-qualified fresh hand-off, held-lock failures, independently broken ownership signals, stale-beacon alarm, queued-wake warning, and Pi and pi-signed harness routing.
 It also covers true-reason banner wording and reason-keyed episode dedup surviving a beacon mtime change.
 `tests/fm-cursor-primary.test.sh` covers the Cursor park end to end over real processes with no harness installed: each tracked Claude-shaped entrypoint standing down on a Cursor payload, both follow-up sources, the bounded repair nag and its reset, the nested loop bounds, supersession, away-mode and lock-ownership inertness, child-worktree exclusion, and that the adapter never exits 2.
diff --git a/docs/watcher-continuity.md b/docs/watcher-continuity.md
index aedc87d57a..cf458e2640 100644
--- a/docs/watcher-continuity.md
+++ b/docs/watcher-continuity.md
@@ -32,7 +32,7 @@ After the configured retry bound is exhausted, it delivers the original wake wit
 This is deliberate Option B ordering: the fleet is protected before the model handles the wake whenever restoration succeeds, but the model is never left blind when it does not.
 
 Claude's Stop hook starts the successor arm at the next Stop after the handling turn, rather than before notification as Pi and OpenCode do.
-The durable wake queue preserves actionable events during the residual active-turn window, and the bounded turn-end guard enforces recovery at Stop when no watcher or auto-arm claim is present.
+The durable wake queue preserves actionable events during the residual active-turn window, and the bounded turn-end guard enforces recovery at Stop when no watcher is live and no auto-arm claim is still deciding, so a leftover claim whose own decision already finished cannot suppress it ([`turnend-guard.md`](turnend-guard.md#harness-integrations) owns that boundary).
 The recovery-episode contract below owns once-per-generation announcement.
 A handling successor does not re-announce; it enters its poll loop immediately and keeps scanning signals, stale panes, and checks.
 The model no longer re-arms after ordinary wakes.
@@ -86,8 +86,9 @@ The same suite covers ordinary same-process session replacement for `/new`, `/re
 `tests/fm-watcher-lock.test.sh` covers verified-successor attach, recovery publication before stale-lock removal, the typed self-eviction failure, bounded and successor-linked lifecycle rows, and a SIGSTOP counterfactual that distinguishes a live PID from a stale beacon before classifying termination.
 `tests/fm-subagent-pretool-check.test.sh` proves Claude retains only the non-status Bash seatbelts.
 `tests/fm-claude-stop-autoarm.test.sh` covers the auto-arm's scope, stale and live session owners, unchanged AFK and need boundaries, single-flight, bounded failure retries, benign live-watcher cycle ends, one-notice failure episodes, and exit-2 translation.
+It also covers abandoned single-flight claims: a claim the ledger shows already finished, and one whose recorded pid-identity no longer matches its live pid while the ledger still reads arming or is absent entirely, are both reclaimed so a lapsed home re-arms, while an identity-matched claim still arming, one the ledger does not name, and the guard's own terminal check keep the gate closed ([`turnend-guard.md`](turnend-guard.md) owns that boundary).
 `FM_CLAUDE_LIVE_E2E=1 tests/fm-claude-stop-autoarm-live-e2e.test.sh` starts with the reproduced stale-lock state, runs session start first, completes two tokenless cycles, and checks the competing-live-owner negative control.
-`tests/fm-turnend-guard.test.sh` covers the cooperative `--claude` guard, including monotonic failed-epoch progression, the integrated bounded fail-open, post-alarm continuation suppression, and positive recovery reset.
+`tests/fm-turnend-guard.test.sh` covers the cooperative `--claude` guard, including monotonic failed-epoch progression, the integrated bounded fail-open, post-alarm continuation suppression, and positive recovery reset; [`turnend-guard.md`](turnend-guard.md#regression-coverage) lists that suite's full coverage, including the abandoned-claim cases.
 
 ## Active limits and verification
 
diff --git a/tests/fm-afk-return.test.sh b/tests/fm-afk-return.test.sh
index 537b1bff97..c345e4f55e 100755
--- a/tests/fm-afk-return.test.sh
+++ b/tests/fm-afk-return.test.sh
@@ -19,6 +19,9 @@ install_runner() {  # <case-dir>
   cp "$ROOT/bin/fm-afk-return.sh" "$dir/bin/"
   cp "$ROOT/bin/fm-wake-lib.sh" "$dir/bin/"
   cp "$ROOT/bin/fm-classify-lib.sh" "$dir/bin/"
+  # fm-timeout-lib.sh: the shared hard bound fm-classify-lib.sh sources for the
+  # wedge detector's bounded worktree write probe.
+  cp "$ROOT/bin/fm-timeout-lib.sh" "$dir/bin/"
   cat > "$dir/bin/fm-afk-launch.sh" <<'SH'
 #!/usr/bin/env bash
 [ "${1:-}" = stop ] || exit 2
diff --git a/tests/fm-claude-stop-autoarm.test.sh b/tests/fm-claude-stop-autoarm.test.sh
index 7015fc4995..ff095c3291 100755
--- a/tests/fm-claude-stop-autoarm.test.sh
+++ b/tests/fm-claude-stop-autoarm.test.sh
@@ -534,6 +534,215 @@ test_single_flight_admits_exactly_one_owner() {
   pass "auto-arm: concurrent firings admit one owner and one rewake translation"
 }
 
+# --- abandoned single-flight claim recovery -----------------------------------
+# The 2026-08-14 lapse: one cycle armed, beat its beacon, delivered a single
+# rewake, and exited, leaving its owner lock behind with a live pid. The single
+# flight gate then turned every later firing into exit 0, so with two tasks in
+# flight and a beacon 40 minutes cold nothing re-armed and both workers' reports
+# sat unread until an operator drained the queue by hand. The lock alone is not
+# enough to prove that: the ledger naming that same pid with a finished outcome,
+# or a recorded pid-identity the live pid no longer matches, is what distinguishes
+# an abandoned claim from one still deciding.
+
+# Fabricate a held owner lock: <dir> <pid> <role>. Plain-dir shape on purpose -
+# the hook must reclaim whatever a crashed or blocked owner left behind.
+record_autoarm_owner() {
+  local dir=$1 pid=$2 role=${3:-autoarm}
+  mkdir -p "$dir/state/.claude-autoarm.lock"
+  printf '%s\n' "$pid" > "$dir/state/.claude-autoarm.lock/pid"
+  printf '%s\n' "$role" > "$dir/state/.claude-autoarm.lock/role"
+}
+
+# Record the pid-identity a claim leaves inside its own lock: <dir> <pid>. The
+# claim writes the identity of the process that took the lock, so passing a pid
+# OTHER than the lock's own reproduces pid reuse - the recorded claimant is gone
+# and an unrelated live process now answers to its number.
+record_autoarm_owner_identity() {
+  local dir=$1 pid=$2 identity
+  identity=$(fm_test_pid_identity "$pid") || return 1
+  [ -n "$identity" ] || return 1
+  printf '%s\n' "$identity" > "$dir/state/.claude-autoarm.lock/pid-identity"
+}
+
+# <dir> <epoch-seq> <owner-pid> <outcome>, aged well past any freshness window.
+record_autoarm_epoch() {
+  local dir=$1 seq=$2 owner=$3 outcome=$4
+  printf 'epoch=%s owner_pid=%s outcome=%s updated_at=1\n' "$seq" "$owner" "$outcome" \
+    > "$dir/state/.claude-autoarm-epoch"
+  touch -t 202001010000 "$dir/state/.claude-autoarm-epoch"
+}
+
+epoch_field() {
+  local dir=$1 field=$2
+  sed -n "s/^.*[[:space:]]\{0,1\}$field=\([A-Za-z0-9_-]*\).*\$/\1/p" \
+    "$dir/state/.claude-autoarm-epoch" 2>/dev/null || true
+}
+
+test_abandoned_owner_claim_is_reclaimed_and_rearms() {
+  local dir out status pid
+  dir=$(make_primary_dir "$TMP_ROOT/abandoned-claim")
+  : > "$dir/state/task1.meta"
+  : > "$dir/state/task2.meta"
+  write_arm_fixture "$dir" actionable
+  sleep 60 &
+  pid=$!
+  record_autoarm_owner "$dir" "$pid"
+  record_autoarm_epoch "$dir" 464 "$pid" rewake
+  out=$(run_autoarm "$dir" 2>/dev/null); status=$?
+  kill "$pid" 2>/dev/null || true
+  wait "$pid" 2>/dev/null || true
+  expect_code 2 "$status" "a claim whose ledger outcome is already terminal must be reclaimed, not deferred to forever"
+  [ -e "$dir/state/arm-ran" ] || fail "abandoned claim left the home unarmed with work in flight"
+  assert_contains "$out" "firstmate watcher wake" "the reclaimed cycle must still translate its wake"
+  [ "$(epoch_field "$dir" epoch)" -gt 464 ] || fail "reclaimed cycle did not advance the frozen ledger: $(epoch_field "$dir" epoch)"
+  [ "$(epoch_outcome "$dir")" = rewake ] || fail "reclaimed cycle did not record its own outcome: $(epoch_outcome "$dir")"
+  [ "$(epoch_field "$dir" owner_pid)" != "$pid" ] || fail "reclaimed ledger still names the abandoned owner"
+  assert_absent "$dir/state/.claude-autoarm.lock" "reclaimed cycle left an owner lock behind"
+  assert_absent "$dir/state/.claude-autoarm.lock.steal" "reclaim left its serialization mutex behind"
+  pass "auto-arm: an abandoned owner claim is reclaimed so a lapsed cycle re-arms"
+}
+
+test_arming_claim_is_never_reclaimed() {
+  local dir out status pid
+  dir=$(make_primary_dir "$TMP_ROOT/arming-claim")
+  : > "$dir/state/task1.meta"
+  write_arm_fixture "$dir" actionable
+  sleep 60 &
+  pid=$!
+  record_autoarm_owner "$dir" "$pid"
+  # An owner foregrounds the arm for the whole watcher cycle, so "arming" is in
+  # progress no matter how old its ledger entry is.
+  record_autoarm_epoch "$dir" 464 "$pid" arming
+  out=$(run_autoarm "$dir" 2>/dev/null); status=$?
+  kill "$pid" 2>/dev/null || true
+  wait "$pid" 2>/dev/null || true
+  expect_code 0 "$status" "a claim still arming must keep the single-flight gate closed"
+  [ -z "$out" ] || fail "deferring to an arming claim produced output: $out"
+  assert_absent "$dir/state/arm-ran" "an arming claim was stolen and double-armed"
+  [ "$(epoch_field "$dir" epoch)" = 464 ] || fail "deferred firing rewrote the arming ledger entry"
+  assert_present "$dir/state/.claude-autoarm.lock" "an arming claim lost its owner lock"
+  pass "auto-arm: an owner still arming is never reclaimed, however long the cycle runs"
+}
+
+test_claim_not_named_by_the_ledger_is_never_reclaimed() {
+  local dir out status pid
+  dir=$(make_primary_dir "$TMP_ROOT/unnamed-claim")
+  : > "$dir/state/task1.meta"
+  write_arm_fixture "$dir" actionable
+  sleep 60 &
+  pid=$!
+  record_autoarm_owner "$dir" "$pid"
+  # A fresh claimant holds the lock before it writes "arming", so until it does
+  # the ledger still names the PREVIOUS owner. Requiring the two pids to match is
+  # what keeps that window from being mistaken for abandonment.
+  record_autoarm_epoch "$dir" 464 999 rewake
+  out=$(run_autoarm "$dir" 2>/dev/null); status=$?
+  kill "$pid" 2>/dev/null || true
+  wait "$pid" 2>/dev/null || true
+  expect_code 0 "$status" "a live claim the ledger does not name is unproven and must be left alone"
+  [ -z "$out" ] || fail "deferring to an unnamed claim produced output: $out"
+  assert_absent "$dir/state/arm-ran" "a claim the ledger does not name was stolen and double-armed"
+  assert_present "$dir/state/.claude-autoarm.lock" "an unproven claim lost its owner lock"
+  pass "auto-arm: a live claim the ledger does not name is never reclaimed"
+}
+
+# The same unrecoverable lapse, reached where the ledger cannot prove it: a session
+# teardown kills the claim's whole process group before it records any outcome, so
+# the entry still reads "arming" (in flight however old, by contract) while the
+# recorded pid is later handed to an unrelated live process. Only the identity the
+# claim recorded inside its own lock separates that from a real arm in progress.
+test_pid_reused_arming_claim_is_reclaimed_and_rearms() {
+  local dir out status pid
+  dir=$(make_primary_dir "$TMP_ROOT/reused-pid-arming")
+  : > "$dir/state/task1.meta"
+  : > "$dir/state/task2.meta"
+  write_arm_fixture "$dir" actionable
+  sleep 60 &
+  pid=$!
+  record_autoarm_owner "$dir" "$pid"
+  record_autoarm_owner_identity "$dir" "$$" || fail "could not record a claim pid-identity"
+  record_autoarm_epoch "$dir" 464 "$pid" arming
+  out=$(run_autoarm "$dir" 2>/dev/null); status=$?
+  kill "$pid" 2>/dev/null || true
+  wait "$pid" 2>/dev/null || true
+  expect_code 2 "$status" "a claim whose recorded identity no longer matches its live pid must be reclaimed, arming entry or not"
+  [ -e "$dir/state/arm-ran" ] || fail "a reused-pid claim left the home unarmed with work in flight"
+  assert_contains "$out" "firstmate watcher wake" "the reclaimed cycle must still translate its wake"
+  [ "$(epoch_field "$dir" epoch)" -gt 464 ] || fail "reclaimed cycle did not advance the frozen ledger: $(epoch_field "$dir" epoch)"
+  assert_absent "$dir/state/.claude-autoarm.lock" "reclaimed cycle left an owner lock behind"
+  assert_absent "$dir/state/.claude-autoarm.lock.steal" "reclaim left its serialization mutex behind"
+  pass "auto-arm: a claim whose pid was reused is reclaimed even while its ledger entry still reads arming"
+}
+
+# The other ledger-blind shape: no ledger at all (a fresh or hand-cleared home)
+# plus a reused pid. Without the recorded identity nothing proves abandonment, so
+# every later firing exits at the lock and the home never re-arms.
+test_pid_reused_claim_with_no_ledger_is_reclaimed_and_rearms() {
+  local dir out status pid
+  dir=$(make_primary_dir "$TMP_ROOT/reused-pid-no-ledger")
+  : > "$dir/state/task1.meta"
+  write_arm_fixture "$dir" actionable
+  sleep 60 &
+  pid=$!
+  record_autoarm_owner "$dir" "$pid"
+  record_autoarm_owner_identity "$dir" "$$" || fail "could not record a claim pid-identity"
+  assert_absent "$dir/state/.claude-autoarm-epoch" "this case must start with no ledger at all"
+  out=$(run_autoarm "$dir" 2>/dev/null); status=$?
+  kill "$pid" 2>/dev/null || true
+  wait "$pid" 2>/dev/null || true
+  expect_code 2 "$status" "a reused-pid claim with no ledger to consult must still be reclaimed"
+  [ -e "$dir/state/arm-ran" ] || fail "a reused-pid claim with no ledger left the home unarmed"
+  assert_contains "$out" "firstmate watcher wake" "the reclaimed cycle must still translate its wake"
+  [ "$(epoch_outcome "$dir")" = rewake ] || fail "reclaimed cycle did not record its own outcome: $(epoch_outcome "$dir")"
+  assert_absent "$dir/state/.claude-autoarm.lock" "reclaimed cycle left an owner lock behind"
+  pass "auto-arm: a reused-pid claim is reclaimed even with no ledger entry to prove it"
+}
+
+# The negative control for the identity leg: a claim whose recorded identity still
+# matches the process holding the lock is genuinely in flight, so an arm that has
+# legitimately been running for hours must keep the single-flight gate closed.
+test_identity_matched_arming_claim_is_never_reclaimed() {
+  local dir out status pid
+  dir=$(make_primary_dir "$TMP_ROOT/identity-matched-arming")
+  : > "$dir/state/task1.meta"
+  write_arm_fixture "$dir" actionable
+  sleep 60 &
+  pid=$!
+  record_autoarm_owner "$dir" "$pid"
+  record_autoarm_owner_identity "$dir" "$pid" || fail "could not record a claim pid-identity"
+  record_autoarm_epoch "$dir" 464 "$pid" arming
+  out=$(run_autoarm "$dir" 2>/dev/null); status=$?
+  kill "$pid" 2>/dev/null || true
+  wait "$pid" 2>/dev/null || true
+  expect_code 0 "$status" "an identity-matched claim still arming must keep the single-flight gate closed"
+  [ -z "$out" ] || fail "deferring to an identity-matched arming claim produced output: $out"
+  assert_absent "$dir/state/arm-ran" "an identity-matched arming claim was stolen and double-armed"
+  [ "$(epoch_field "$dir" epoch)" = 464 ] || fail "deferred firing rewrote the arming ledger entry"
+  assert_present "$dir/state/.claude-autoarm.lock" "an identity-matched arming claim lost its owner lock"
+  pass "auto-arm: an identity-matched owner still arming is never reclaimed"
+}
+
+test_terminal_check_claim_is_never_reclaimed() {
+  local dir out status pid
+  dir=$(make_primary_dir "$TMP_ROOT/terminal-check-claim")
+  : > "$dir/state/task1.meta"
+  write_arm_fixture "$dir" actionable
+  sleep 60 &
+  pid=$!
+  # The synchronous guard takes the same lock under its own role while it decides
+  # the attended fail-open. Reclaiming that would race the guard's own decision.
+  record_autoarm_owner "$dir" "$pid" terminal-check
+  record_autoarm_epoch "$dir" 464 "$pid" failed-suppressed
+  out=$(run_autoarm "$dir" 2>/dev/null); status=$?
+  kill "$pid" 2>/dev/null || true
+  wait "$pid" 2>/dev/null || true
+  expect_code 0 "$status" "the guard's own terminal-check claim must never be reclaimed by the arm hook"
+  [ -z "$out" ] || fail "deferring to a terminal-check claim produced output: $out"
+  assert_absent "$dir/state/arm-ran" "a terminal-check claim was stolen and double-armed"
+  assert_present "$dir/state/.claude-autoarm.lock" "a terminal-check claim lost its owner lock"
+  pass "auto-arm: the guard's terminal-check claim is never reclaimed"
+}
+
 test_need_vanished_mid_cycle_closes_quietly() {
   local dir out status
   dir=$(make_primary_dir "$TMP_ROOT/vanished")
@@ -595,6 +804,13 @@ test_benign_cycle_end_with_live_watcher_is_silent
 test_positive_recovery_budget_contention_preserves_episode
 test_arms_for_x_mode_poll_need_without_inflight
 test_single_flight_admits_exactly_one_owner
+test_abandoned_owner_claim_is_reclaimed_and_rearms
+test_arming_claim_is_never_reclaimed
+test_claim_not_named_by_the_ledger_is_never_reclaimed
+test_pid_reused_arming_claim_is_reclaimed_and_rearms
+test_pid_reused_claim_with_no_ledger_is_reclaimed_and_rearms
+test_identity_matched_arming_claim_is_never_reclaimed
+test_terminal_check_claim_is_never_reclaimed
 test_need_vanished_mid_cycle_closes_quietly
 test_afk_mid_cycle_suppresses_rewake
 test_active_in_marked_secondmate_home
diff --git a/tests/fm-gotmp.test.sh b/tests/fm-gotmp.test.sh
index ecf41b933c..f247b7ff3d 100755
--- a/tests/fm-gotmp.test.sh
+++ b/tests/fm-gotmp.test.sh
@@ -65,6 +65,9 @@ make_fake_root() {
   # ownership are sourced by teardown.
   ln -s "$ROOT/bin/fm-control-lib.sh" "$fake/bin/fm-control-lib.sh"
   ln -s "$ROOT/bin/fm-classify-lib.sh" "$fake/bin/fm-classify-lib.sh"
+  # fm-timeout-lib.sh: the shared hard bound fm-classify-lib.sh sources for the
+  # wedge detector's bounded worktree write probe.
+  ln -s "$ROOT/bin/fm-timeout-lib.sh" "$fake/bin/fm-timeout-lib.sh"
   ln -s "$ROOT/bin/fm-wake-lib.sh" "$fake/bin/fm-wake-lib.sh"
   # fm-gate-refuse-lib.sh: teardown sources it before any fleet mutation.
   ln -s "$ROOT/bin/fm-gate-refuse-lib.sh" "$fake/bin/fm-gate-refuse-lib.sh"
@@ -143,6 +146,9 @@ test_teardown_skips_gracefully_without_tasktmp() {
   ln -s "$ROOT/bin/fm-lock-lib.sh" "$fake/bin/fm-lock-lib.sh"
   ln -s "$ROOT/bin/fm-control-lib.sh" "$fake/bin/fm-control-lib.sh"
   ln -s "$ROOT/bin/fm-classify-lib.sh" "$fake/bin/fm-classify-lib.sh"
+  # fm-timeout-lib.sh: the shared hard bound fm-classify-lib.sh sources for the
+  # wedge detector's bounded worktree write probe.
+  ln -s "$ROOT/bin/fm-timeout-lib.sh" "$fake/bin/fm-timeout-lib.sh"
   ln -s "$ROOT/bin/fm-wake-lib.sh" "$fake/bin/fm-wake-lib.sh"
   # fm-gate-refuse-lib.sh: teardown sources it before any fleet mutation.
   ln -s "$ROOT/bin/fm-gate-refuse-lib.sh" "$fake/bin/fm-gate-refuse-lib.sh"
diff --git a/tests/fm-turnend-guard.test.sh b/tests/fm-turnend-guard.test.sh
index ac02c7c37c..5c21f4d430 100755
--- a/tests/fm-turnend-guard.test.sh
+++ b/tests/fm-turnend-guard.test.sh
@@ -1299,6 +1299,83 @@ test_hook_claude_mode_allows_on_fresh_rewake_epoch() {
   pass "fm-turnend-guard --claude: fresh rewake epoch prevents a duplicate continuation for the same event"
 }
 
+# The 2026-08-14 lapse: a cycle armed, delivered one rewake, exited, and left its
+# owner lock behind holding a live pid. Both Stop participants read that lock as
+# "recovery is already under way", so with work in flight and a beacon 40 minutes
+# cold every turn ended blind and nothing re-armed. A stale ledger outcome for
+# the lock's own pid is the proof that no decision is in flight any more.
+test_hook_claude_mode_blocks_on_abandoned_autoarm_claim() {
+  local dir out status pid
+  dir=$(make_primary_dir "$TMP_ROOT/hook-claude-abandoned-claim")
+  : > "$dir/state/task1.meta"
+  : > "$dir/state/task2.meta"
+  sleep 60 &
+  pid=$!
+  record_autoarm_owner "$dir" "$pid"
+  printf 'epoch=464 owner_pid=%s outcome=rewake updated_at=1\n' "$pid" > "$dir/state/.claude-autoarm-epoch"
+  touch -t 202001010000 "$dir/state/.claude-autoarm-epoch"
+  out=$(FM_CLAUDE_AUTOARM_SYNC_WAIT_MS=200 run_hook_claude "$dir" true); status=$?
+  kill "$pid" 2>/dev/null || true
+  wait "$pid" 2>/dev/null || true
+  expect_code 2 "$status" "an owner lock left behind by a finished claim must not pass for recovery under way"
+  assert_contains "$out" "TURN WOULD END BLIND" "abandoned-claim block must carry the blind-turn banner"
+  assert_contains "$out" "2 task(s) in flight" "abandoned-claim block must name the unsupervised work"
+  pass "fm-turnend-guard --claude: an abandoned auto-arm claim no longer allows a blind stop (incident regression)"
+}
+
+# The ledger-blind variant of the same lapse: a session teardown killed the claim's
+# process group before it could record any outcome, so its entry still reads
+# "arming" - in flight however old, by contract - while the recorded pid now belongs
+# to an unrelated live process. The identity the claim wrote into its own lock is
+# the only thing that separates that from a real arm still running.
+test_hook_claude_mode_blocks_on_pid_reused_arming_claim() {
+  local dir out status pid identity
+  dir=$(make_primary_dir "$TMP_ROOT/hook-claude-reused-pid-claim")
+  : > "$dir/state/task1.meta"
+  : > "$dir/state/task2.meta"
+  sleep 60 &
+  pid=$!
+  record_autoarm_owner "$dir" "$pid"
+  # The claim recorded ITS OWN identity; this test shell now stands in for the
+  # unrelated process that inherited the number.
+  identity=$(fm_test_pid_identity "$$") || fail "could not compute a claim pid-identity"
+  printf '%s\n' "$identity" > "$dir/state/.claude-autoarm.lock/pid-identity"
+  printf 'epoch=464 owner_pid=%s outcome=arming updated_at=1\n' "$pid" > "$dir/state/.claude-autoarm-epoch"
+  touch -t 202001010000 "$dir/state/.claude-autoarm-epoch"
+  out=$(FM_CLAUDE_AUTOARM_SYNC_WAIT_MS=200 run_hook_claude "$dir" true); status=$?
+  kill "$pid" 2>/dev/null || true
+  wait "$pid" 2>/dev/null || true
+  expect_code 2 "$status" "a claim whose recorded identity no longer matches its live pid must not pass for recovery under way"
+  assert_contains "$out" "TURN WOULD END BLIND" "reused-pid claim block must carry the blind-turn banner"
+  assert_contains "$out" "2 task(s) in flight" "reused-pid claim block must name the unsupervised work"
+  pass "fm-turnend-guard --claude: a claim whose pid was reused stops counting as recovery even while its entry reads arming"
+}
+
+# The same abandoned claim on the terminal path: stepping aside for it allowed the
+# stop silently AND spent no attended alarm, so a genuinely broken automatic
+# mechanism stayed invisible. The guard must clear the claim and finish instead.
+test_hook_claude_mode_terminal_fail_open_clears_abandoned_claim() {
+  local dir out status pid
+  dir=$(make_primary_dir "$TMP_ROOT/hook-claude-abandoned-terminal")
+  : > "$dir/state/task1.meta"
+  : > "$dir/state/.claude-autoarm-failure-notified"
+  seed_claude_budget "$dir" 4 3
+  sleep 60 &
+  pid=$!
+  record_autoarm_owner "$dir" "$pid"
+  printf 'epoch=3 owner_pid=%s outcome=failed-suppressed updated_at=1\n' "$pid" > "$dir/state/.claude-autoarm-epoch"
+  touch -t 202001010000 "$dir/state/.claude-autoarm-epoch"
+  out=$(FM_CLAUDE_AUTOARM_SYNC_WAIT_MS=200 run_hook_claude "$dir" true); status=$?
+  kill "$pid" 2>/dev/null || true
+  wait "$pid" 2>/dev/null || true
+  expect_code 0 "$status" "the verified attended fail-open still ends the turn once it is spent"
+  assert_contains "$out" 'FIRSTMATE SUPERVISION IS GENUINELY DOWN' "an abandoned claim suppressed the episode's attended alarm"
+  assert_present "$dir/state/.claude-autoarm-failure-alarmed" "abandoned-claim terminal path did not consume the one-time alarm"
+  assert_absent "$dir/state/.claude-autoarm.lock" "abandoned-claim terminal path left the stale claim in place"
+  assert_absent "$dir/state/.claude-autoarm.lock.steal" "abandoned-claim reclaim left its serialization mutex behind"
+  pass "fm-turnend-guard --claude: the terminal path clears an abandoned claim instead of stepping aside silently"
+}
+
 test_hook_claude_mode_preserves_fresh_failed_progression() {
   local dir out status count
   dir=$(make_primary_dir "$TMP_ROOT/hook-claude-failed-epoch")
@@ -1653,6 +1730,9 @@ test_hook_claude_mode_allows_when_autoarm_owner_alive
 test_hook_claude_mode_repeated_failed_to_arming_interleavings_reach_fail_open
 test_hook_claude_mode_terminal_boundary_excludes_starting_owner
 test_hook_claude_mode_allows_on_fresh_rewake_epoch
+test_hook_claude_mode_blocks_on_abandoned_autoarm_claim
+test_hook_claude_mode_blocks_on_pid_reused_arming_claim
+test_hook_claude_mode_terminal_fail_open_clears_abandoned_claim
 test_hook_claude_mode_preserves_fresh_failed_progression
 test_hook_claude_mode_integrated_monotonic_fail_open
 test_hook_claude_mode_recovery_contention_is_not_ordinary_allow
diff --git a/tests/fm-watch-triage.test.sh b/tests/fm-watch-triage.test.sh
index 87979184a8..569d8a50b4 100755
--- a/tests/fm-watch-triage.test.sh
+++ b/tests/fm-watch-triage.test.sh
@@ -367,6 +367,175 @@ test_crew_absorb_class_classifier() {
   pass "crew_absorb_class: working/paused/none from one read; crew_is_paused and crew_is_provably_working agree"
 }
 
+# The wedge detector's third liveness input: writes inside the crew's own recorded
+# worktree. Every negative outcome must report "no evidence" so the caller keeps
+# its existing escalation schedule, and a supervisor-side git read (which touches
+# .git, never tracked files) must not be able to fake a positive.
+test_crew_worktree_written_since_classifier() {
+  local dir state anchor wt home statedir_wt
+  dir=$(make_case classify-worktree-writes); state="$dir/state"
+  anchor="$state/anchor"; wt="$dir/wt"; home="$dir/mate-home"; statedir_wt="$dir/wt-with-state"
+  mkdir -p "$wt/src" "$wt/.git/objects"
+  printf 'old\n' > "$wt/src/existing.c"
+  set_mtime "$(( $(date +%s) - 300 ))" "$wt/src/existing.c"
+  : > "$anchor"
+  set_mtime "$(( $(date +%s) - 120 ))" "$anchor"
+
+  # No recorded worktree at all: absence of evidence, never a positive.
+  printf 'window=test:fm-a\nkind=ship\n' > "$state/a.meta"
+  ! crew_worktree_written_since a "$state" "$anchor" \
+    || fail "a task with no recorded worktree reported write evidence"
+  # Recorded but gone (torn down): still no evidence.
+  printf 'window=test:fm-b\nkind=ship\nworktree=%s\n' "$dir/missing" > "$state/b.meta"
+  ! crew_worktree_written_since b "$state" "$anchor" \
+    || fail "a torn-down worktree reported write evidence"
+  # Present, but nothing written since the anchor.
+  printf 'window=test:fm-c\nkind=ship\nworktree=%s\n' "$wt" > "$state/c.meta"
+  ! crew_worktree_written_since c "$state" "$anchor" \
+    || fail "a quiet worktree reported write evidence"
+  # A missing anchor cannot be compared against: no evidence.
+  ! crew_worktree_written_since c "$state" "$state/absent-anchor" \
+    || fail "a missing anchor reported write evidence"
+  # Only .git churn (what firstmate's own read-only git commands touch): pruned.
+  printf 'pack\n' > "$wt/.git/objects/fresh"
+  printf 'ref\n' > "$wt/.git/index"
+  ! crew_worktree_written_since c "$state" "$anchor" \
+    || fail ".git churn alone reported write evidence (a supervisor read could fake liveness)"
+  # A real file written after the anchor: positive evidence.
+  printf 'new\n' > "$wt/src/new.c"
+  crew_worktree_written_since c "$state" "$anchor" \
+    || fail "a file written after the anchor was not reported as write evidence"
+  # An empty id is never evidence.
+  ! crew_worktree_written_since "" "$state" "$anchor" || fail "an empty id reported write evidence"
+
+  # A secondmate records a provisioned firstmate home, not a code tree, and such a
+  # home supervises itself: its own watcher beacon, pane hashes, and heartbeats keep
+  # its state/ churning whether or not the mate produced anything.
+  mkdir -p "$home/state"
+  printf 'sm-classify-1\n' > "$home/.fm-secondmate-home"
+  printf 'beat\n' > "$home/state/.last-watcher-beat"
+  printf 'window=remote:sm\nkind=secondmate\nworktree=%s\n' "$home" > "$state/sm.meta"
+  ! crew_worktree_written_since sm "$state" "$anchor" \
+    || fail "a secondmate's own home supervision churn reported crew write evidence"
+  # The home marker alone is enough, even when the record does not say secondmate.
+  printf 'window=test:fm-sm2\nkind=ship\nworktree=%s\n' "$home" > "$state/sm2.meta"
+  ! crew_worktree_written_since sm2 "$state" "$anchor" \
+    || fail "a marked firstmate home reported crew write evidence"
+  # But an ordinary worktree that merely holds a directory named state is real
+  # work: only the home is excluded, never a source directory of that name.
+  mkdir -p "$statedir_wt/state"
+  printf 'machine\n' > "$statedir_wt/state/machine.go"
+  printf 'window=test:fm-d\nkind=ship\nworktree=%s\n' "$statedir_wt" > "$state/d.meta"
+  crew_worktree_written_since d "$state" "$anchor" \
+    || fail "a source directory named state was hidden from the write probe"
+  pass "crew_worktree_written_since: real writes are evidence; no worktree, no anchor, quiet trees, .git churn and a mate's own home are not"
+}
+
+# FM_WORKTREE_WRITE_PRUNE is a skip list, so clearing it skips nothing and is the
+# obvious way to widen the probe to the whole depth-bounded tree. An empty list must
+# therefore widen the walk rather than report no evidence at all, which would
+# quietly cost the wedge detector its third liveness input on a home that cleared
+# the knob to get more coverage, not less.
+test_empty_write_prune_widens_the_probe() {
+  local dir state anchor wt saved
+  dir=$(make_case classify-empty-write-prune); state="$dir/state"
+  anchor="$state/anchor"; wt="$dir/wt"
+  mkdir -p "$wt/src" "$wt/.git"
+  : > "$anchor"
+  set_mtime "$(( $(date +%s) - 120 ))" "$anchor"
+  printf 'window=test:fm-e\nkind=ship\nworktree=%s\n' "$wt" > "$state/e.meta"
+  saved=$FM_WORKTREE_WRITE_PRUNE
+  FM_WORKTREE_WRITE_PRUNE=''
+  # A quiet tree is still no evidence, so the caller's schedule is untouched.
+  ! crew_worktree_written_since e "$state" "$anchor" \
+    || fail "an empty prune list reported write evidence for a quiet worktree"
+  printf 'new\n' > "$wt/src/new.c"
+  crew_worktree_written_since e "$state" "$anchor" \
+    || fail "an empty prune list disabled the probe instead of widening it"
+  # Widened means nothing is skipped, including what the default list prunes.
+  set_mtime "$(( $(date +%s) - 900 ))" "$wt/src/new.c"
+  printf 'pack\n' > "$wt/.git/index"
+  crew_worktree_written_since e "$state" "$anchor" \
+    || fail "an empty prune list still skipped a directory the default list prunes"
+  # Restoring the default prunes .git again, so a supervisor's own read-only git
+  # command still cannot fake liveness.
+  FM_WORKTREE_WRITE_PRUNE=$saved
+  ! crew_worktree_written_since e "$state" "$anchor" \
+    || fail "the default prune list stopped keeping .git out of the probe"
+  pass "an empty FM_WORKTREE_WRITE_PRUNE widens the probe to the whole depth-bounded tree instead of disabling it"
+}
+
+# The same widening, reached the way a home actually configures it: through the
+# process ENVIRONMENT, not an in-process assignment made after the library was
+# sourced. An empty exported value must survive as empty, because defaulting it with
+# the colon form reads "explicitly cleared" as "never set" and hands the default skip
+# list straight back to the one home that asked for a wider walk.
+# shellcheck disable=SC2016 # single quotes are deliberate: the library path, state dir, and anchor expand inside the bash -c child, not here
+test_empty_write_prune_from_the_environment_widens_the_probe() {
+  local dir state anchor wt
+  dir=$(make_case classify-empty-write-prune-env); state="$dir/state"
+  anchor="$state/anchor"; wt="$dir/wt"
+  mkdir -p "$wt/.git/objects"
+  : > "$anchor"
+  set_mtime "$(( $(date +%s) - 120 ))" "$anchor"
+  printf 'window=test:fm-wenv\nkind=ship\nworktree=%s\n' "$wt" > "$state/wenv.meta"
+  # The one thing written since the anchor sits exactly where the DEFAULT list prunes.
+  printf 'pack\n' > "$wt/.git/objects/fresh"
+  env -u FM_WORKTREE_WRITE_PRUNE \
+    bash -c '. "$1"; crew_worktree_written_since wenv "$2" "$3"' _ \
+    "$ROOT/bin/fm-classify-lib.sh" "$state" "$anchor" \
+    && fail "the default skip list let .git churn count as write evidence"
+  FM_WORKTREE_WRITE_PRUNE='' \
+    bash -c '. "$1"; crew_worktree_written_since wenv "$2" "$3"' _ \
+    "$ROOT/bin/fm-classify-lib.sh" "$state" "$anchor" \
+    || fail "an empty FM_WORKTREE_WRITE_PRUNE in the environment fell back to the default skip list instead of widening the probe"
+  pass "an empty FM_WORKTREE_WRITE_PRUNE exported into the environment prunes nothing, widening the probe"
+}
+
+# The probe's walk runs synchronously inside the poll that was about to escalate, so
+# it must be wall-clock bounded: -xdev keeps it out of a nested mount, but a worktree
+# root that is ITSELF on a hung mount would otherwise stall the very supervisor that
+# exists to notice a wedge. A fake find that never returns in time stands in for that
+# mount. Hitting the bound must read as NO evidence, exactly like every other
+# negative outcome, so the caller's escalation schedule is untouched.
+test_worktree_write_probe_is_wall_clock_bounded() {
+  local dir state anchor wt slowbin fastbin started elapsed
+  dir=$(make_case classify-write-probe-bound); state="$dir/state"
+  anchor="$state/anchor"; wt="$dir/wt"; slowbin="$dir/slowbin"; fastbin="$dir/fastbin"
+  mkdir -p "$wt/src" "$slowbin" "$fastbin"
+  : > "$anchor"
+  set_mtime "$(( $(date +%s) - 120 ))" "$anchor"
+  printf 'window=test:fm-slow\nkind=ship\nworktree=%s\n' "$wt" > "$state/slow.meta"
+  # Both stand-ins report the same hit; only one of them takes longer than the bound
+  # to do it, so the prompt one shows what a positive outcome looks like and the
+  # bounded assertion below cannot pass merely because the fake failed.
+  cat > "$fastbin/find" <<'SH'
+#!/usr/bin/env bash
+set -u
+printf '%s\n' "$1/hit"
+SH
+  cat > "$slowbin/find" <<'SH'
+#!/usr/bin/env bash
+set -u
+sleep 30
+printf '%s\n' "$1/hit"
+SH
+  chmod +x "$fastbin/find" "$slowbin/find"
+  PATH="$fastbin:$PATH" \
+    bash -c '. "$1"; crew_worktree_written_since slow "$2" "$3"' _ \
+    "$ROOT/bin/fm-classify-lib.sh" "$state" "$anchor" \
+    || fail "a walk that reported a hit inside its bound was not read as write evidence"
+  started=$(date +%s)
+  PATH="$slowbin:$PATH" FM_WORKTREE_WRITE_TIMEOUT=1 \
+    bash -c '. "$1"; crew_worktree_written_since slow "$2" "$3"' _ \
+    "$ROOT/bin/fm-classify-lib.sh" "$state" "$anchor" \
+    && fail "a walk that outlived its bound was reported as write evidence"
+  elapsed=$(( $(date +%s) - started ))
+  [ "$elapsed" -lt 10 ] \
+    || fail "the worktree write probe was not wall-clock bounded: one walk held the caller for ${elapsed}s"
+  pass "the worktree write probe is wall-clock bounded, and hitting the bound reads as no write evidence"
+}
+
 # signal_crew_provably_working: a no-verb "signal:" wake is benign ONLY when EVERY
 # task it references is provably working; if any crew has stopped, or no task can be
 # resolved, it surfaces. Files map to ids by stripping .status / .turn-ended.
@@ -1636,6 +1805,301 @@ test_nonterminal_stale_repairs_missing_or_corrupt_timer() {
   pass "matching non-terminal stale suppressors repair missing or corrupt stale-since timers"
 }
 
+# --- quiet pane, worktree still being written: deferred, never wedge-escalated -
+# The live 2026-08-14 case: one crew produced eight consecutive possible-wedge
+# escalations in an afternoon, three of them demanding deep inspection, while it
+# was demonstrably writing source, then tests, then documentation. The detector's
+# two inputs (pane quietness, run step) cannot see that, so the pane looks frozen.
+# Both halves of the contract are asserted on the SAME fixture, because the whole
+# point is that only the worktree evidence differs: writing defers, silent
+# escalates on the unchanged schedule.
+test_wedge_escalation_deferred_while_worktree_is_written() {
+  local dir state fakebin out drain_out capture_file window key pane_hash sig pid wt back
+  dir=$(make_case wedge-worktree-writes); state="$dir/state"; fakebin="$dir/fakebin"
+  out="$dir/watch.out"; drain_out="$dir/drain.out"; capture_file="$dir/pane.txt"
+  window="test:fm-writing"; wt="$dir/wt"
+  mkdir -p "$wt/src"
+  printf 'idle building output' > "$capture_file"
+  printf 'window=%s\nkind=ship\nworktree=%s\n' "$window" "$wt" > "$state/writing.meta"
+  printf 'working: implementing\n' > "$state/writing.status"
+  sig=$(seen_sig "$state/writing.status"); printf '%s' "$sig" > "$state/.seen-writing_status"
+  key=$(printf '%s' "$window" | tr ':/.' '___')
+  pane_hash=$(hash_text "idle building output")
+  printf '%s' "$pane_hash" > "$state/.hash-$key"
+  printf '1\n' > "$state/.count-$key"
+  # Already-classified hash with an idle window that opened 500s ago, so the very
+  # first stale poll lands straight on the at-threshold wedge branch (this repeat
+  # path never re-reads crew state, so the worktree evidence is the only input
+  # that can change the outcome).
+  printf '%s' "$pane_hash" > "$state/.stale-$key"
+  back=$(( $(date +%s) - 500 ))
+  echo "$back" > "$state/.stale-since-$key"
+  set_mtime "$back" "$state/.stale-since-$key"
+
+  # Phase A: the crew wrote a file after the idle window opened. Deferred.
+  printf 'int main(void) { return 0; }\n' > "$wt/src/main.c"
+  PATH="$fakebin:$PATH" FM_FAKE_TMUX_WINDOW="$window" FM_FAKE_TMUX_CAPTURE="$capture_file" \
+    FM_STATE_OVERRIDE="$state" FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_STALE_ESCALATE_SECS=240 \
+    FM_PAUSE_RESURFACE_SECS=999 FM_POLL=1 FM_SIGNAL_GRACE=1 \
+    FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
+  pid=$!
+  if ! wait_live "$pid" 30; then
+    reap "$pid"; fail "watcher wedge-escalated a quiet pane whose worktree was being written: $(cat "$out")"
+  fi
+  [ ! -s "$out" ] || { reap "$pid"; fail "a written-worktree deferral printed a wake reason: $(cat "$out")"; }
+  [ ! -s "$state/.wake-queue" ] || { reap "$pid"; fail "a written-worktree deferral enqueued a wake"; }
+  [ -e "$state/.writing-since-$key" ] || { reap "$pid"; fail "the write-deferral chain marker was not recorded"; }
+  [ ! -e "$state/.wedge-escalations-$key" ] || { reap "$pid"; fail "a deferral advanced the wedge escalation counter"; }
+  [ "$(cat "$state/.stale-since-$key" 2>/dev/null || echo 0)" -gt "$back" ] \
+    || { reap "$pid"; fail "a deferral did not restart the idle timer, so the next window cannot re-probe"; }
+  reap "$pid"
+  ack_stopped_cycle "$state" || fail "could not acknowledge the intentional phase-A watcher stop"
+
+  # Phase B: same fixture, same quiet pane, but nothing written during this idle
+  # window (the crew really is stalled). The unchanged schedule must still fire.
+  set_mtime "$(( $(date +%s) - 900 ))" "$wt/src/main.c"
+  echo "$back" > "$state/.stale-since-$key"
+  set_mtime "$back" "$state/.stale-since-$key"
+  : > "$out"
+  PATH="$fakebin:$PATH" FM_FAKE_TMUX_WINDOW="$window" FM_FAKE_TMUX_CAPTURE="$capture_file" \
+    FM_STATE_OVERRIDE="$state" FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_STALE_ESCALATE_SECS=240 \
+    FM_PAUSE_RESURFACE_SECS=999 FM_POLL=1 FM_SIGNAL_GRACE=1 \
+    FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
+  pid=$!
+  wait_for_exit "$pid" 40 || fail "a stalled crew that wrote nothing did not wedge-escalate on the existing schedule"
+  grep -F "stale: $window" "$out" >/dev/null || fail "the stalled-crew escalation did not print a stale wake"
+  grep -F "possible wedge" "$out" >/dev/null || fail "the stalled-crew escalation did not flag a possible wedge"
+  [ "$(cat "$state/.wedge-escalations-$key" 2>/dev/null || true)" = 1 ] || fail "the stalled-crew escalation was not counted"
+  [ ! -e "$state/.stale-since-$key" ] || fail "the idle timer was not cleared after a real escalation"
+  [ ! -e "$state/.writing-since-$key" ] || fail "the write-deferral chain outlived a real escalation"
+  FM_STATE_OVERRIDE="$state" "$DRAIN" > "$drain_out" 2>/dev/null || fail "drain after the stalled-crew escalation failed"
+  grep "$(printf '\tstale\t')" "$drain_out" | grep -F "$window" >/dev/null || fail "the stalled-crew escalation was not queued"
+  pass "a quiet pane writing its own worktree is deferred, while one writing nothing still wedge-escalates on the unchanged schedule"
+}
+
+# A deferral is not silence. A worktree can churn without real progress (a
+# rewritten log, a build touching the same file), so the whole deferral chain ages
+# and re-surfaces once per PAUSE_RESURFACE_SECS - the same bounded cadence a
+# declared pause uses - labeled as a recheck rather than a wedge.
+test_write_deferral_resurfaces_on_the_bounded_cadence() {
+  local dir state fakebin out drain_out capture_file window key pane_hash sig pid wt back
+  dir=$(make_case wedge-worktree-resurface); state="$dir/state"; fakebin="$dir/fakebin"
+  out="$dir/watch.out"; drain_out="$dir/drain.out"; capture_file="$dir/pane.txt"
+  window="test:fm-churn"; wt="$dir/wt"
+  mkdir -p "$wt/src"
+  printf 'idle building output' > "$capture_file"
+  printf 'window=%s\nkind=ship\nworktree=%s\n' "$window" "$wt" > "$state/churn.meta"
+  printf 'working: implementing\n' > "$state/churn.status"
+  sig=$(seen_sig "$state/churn.status"); printf '%s' "$sig" > "$state/.seen-churn_status"
+  key=$(printf '%s' "$window" | tr ':/.' '___')
+  pane_hash=$(hash_text "idle building output")
+  printf '%s' "$pane_hash" > "$state/.hash-$key"
+  printf '1\n' > "$state/.count-$key"
+  printf '%s' "$pane_hash" > "$state/.stale-$key"
+  back=$(( $(date +%s) - 500 ))
+  echo "$back" > "$state/.stale-since-$key"
+  set_mtime "$back" "$state/.stale-since-$key"
+  # This pane has been deferring on write evidence for 500s already.
+  : > "$state/.writing-since-$key"
+  set_mtime "$back" "$state/.writing-since-$key"
+  printf 'churn\n' > "$wt/src/main.c"
+
+  PATH="$fakebin:$PATH" FM_FAKE_TMUX_WINDOW="$window" FM_FAKE_TMUX_CAPTURE="$capture_file" \
+    FM_STATE_OVERRIDE="$state" FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_STALE_ESCALATE_SECS=240 \
+    FM_PAUSE_RESURFACE_SECS=240 FM_POLL=1 FM_SIGNAL_GRACE=1 \
+    FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
+  pid=$!
+  wait_for_exit "$pid" 40 || fail "a long-running write deferral never re-surfaced on the bounded cadence"
+  grep -F "stale: $window" "$out" >/dev/null || fail "the write-deferral recheck did not print a stale wake"
+  grep -F "writing its worktree" "$out" >/dev/null || fail "the write-deferral recheck was not labeled as such"
+  grep -F "possible wedge" "$out" >/dev/null && fail "a write-deferral recheck was mislabeled a possible wedge"
+  [ -e "$state/.writing-resurfaced-$key" ] || fail "the write-deferral re-surface throttle marker was not recorded"
+  [ ! -e "$state/.wedge-escalations-$key" ] || fail "a write-deferral recheck advanced the wedge escalation counter"
+  FM_STATE_OVERRIDE="$state" "$DRAIN" > "$drain_out" 2>/dev/null || fail "drain after the write-deferral recheck failed"
+  grep "$(printf '\tstale\t')" "$drain_out" | grep -F "$window" >/dev/null || fail "the write-deferral recheck was not queued"
+  pass "a write deferral re-surfaces once on the bounded pause cadence, so a churning worktree cannot stay invisible"
+}
+
+# The worktree recorded for a secondmate is a provisioned firstmate home, and that
+# home runs its OWN supervision inside itself: its watcher beacon, pane hashes and
+# heartbeats keep state/ churning whether or not the mate produced anything. Reading
+# that as crew progress would quietly relax the kind-agnostic busy-turn backstop from
+# the escalation cadence to the hourly recheck for work that produced nothing, so the
+# probe must report no evidence and the unchanged schedule must still fire.
+test_secondmate_home_supervision_churn_is_not_write_evidence() {
+  local dir state fakebin out drain_out capture_file window key sig pid home back
+  dir=$(make_case secondmate-home-churn); state="$dir/state"; fakebin="$dir/fakebin"
+  out="$dir/watch.out"; drain_out="$dir/drain.out"; capture_file="$dir/pane.txt"
+  window="test:fm-mate"; home="$dir/mate-home"
+  mkdir -p "$home/state"
+  printf 'sm-mate\n' > "$home/.fm-secondmate-home"
+  printf 'Working... (12.3s)' > "$capture_file"
+  printf 'window=%s\nkind=ship\nharness=pi\nworktree=%s\n' "$window" "$home" > "$state/mate.meta"
+  record_pi_busy "$state" mate
+  # An ordinary crew recording a provisioned mate home is the route that actually
+  # reaches the probe: a kind=secondmate window of its own is triaged only under a
+  # declared pause, and a declared pause takes the bounded recheck cadence instead of
+  # the wedge timer. The home marker alone is what excludes the walk, so the exclusion
+  # is what this asserts. A busy pane is bounded by its completed-turn age; no turn
+  # ever completed here, so the spawn record itself is aged past the bound that routes
+  # it into the wedge timer.
+  printf 'working: implementing\n' > "$state/mate.status"
+  sig=$(seen_sig "$state/mate.status"); printf '%s' "$sig" > "$state/.seen-mate_status"
+  key=$(printf '%s' "$window" | tr ':/.' '___')
+  set_mtime "$(( $(date +%s) - 4000 ))" "$state/mate.meta"
+  back=$(( $(date +%s) - 500 ))
+  echo "$back" > "$state/.stale-since-$key"
+  set_mtime "$back" "$state/.stale-since-$key"
+  # The only thing written since the idle window opened is the mate home's own
+  # supervision bookkeeping.
+  printf 'beat\n' > "$home/state/.last-watcher-beat"
+
+  PATH="$fakebin:$PATH" FM_FAKE_TMUX_WINDOW="$window" FM_FAKE_TMUX_CAPTURE="$capture_file" \
+    FM_STATE_OVERRIDE="$state" FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" \
+    FM_STALE_ESCALATE_SECS=240 FM_BUSY_TURN_MAX_SECS=1 FM_PAUSE_RESURFACE_SECS=999 \
+    FM_POLL=1 FM_SIGNAL_GRACE=1 FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
+  pid=$!
+  wait_for_exit "$pid" 40 || fail "a mate home's own supervision churn deferred an escalation it must not defer"
+  grep -F "stale: $window" "$out" >/dev/null || fail "the mate-home escalation did not print a stale wake"
+  grep -F "possible wedge" "$out" >/dev/null || fail "the mate-home escalation did not flag a possible wedge"
+  [ ! -e "$state/.writing-since-$key" ] || fail "a mate's provisioned home was probed as if it were a code tree"
+  [ "$(cat "$state/.wedge-escalations-$key" 2>/dev/null || true)" = 1 ] || fail "the mate escalation was not counted"
+  FM_STATE_OVERRIDE="$state" "$DRAIN" > "$drain_out" 2>/dev/null || fail "drain after the mate escalation failed"
+  grep "$(printf '\tstale\t')" "$drain_out" | grep -F "$window" >/dev/null || fail "the mate escalation was not queued"
+  pass "a secondmate's own home supervision churn is not crew write evidence, so a pane recording that home keeps the unchanged escalation schedule"
+}
+
+# A write deferral is a bounded chain, not a permanent one: its .writing-since
+# marker ages the whole chain so a churning worktree still re-surfaces once per
+# PAUSE_RESURFACE_SECS. That only holds while the chain belongs to the CURRENT quiet
+# stretch, so every path that restarts the idle-window timer must drop it too. The
+# reachable case is a pane that deferred on write evidence and later has its timer
+# repaired: a long-finished chain would make the first deferral of the new window
+# re-surface immediately instead of after a fresh window.
+test_timer_repair_drops_a_finished_write_deferral_chain() {
+  local dir state fakebin out capture_file window key pane_hash sig pid wt back
+  dir=$(make_case wedge-write-chain-timer-repair); state="$dir/state"; fakebin="$dir/fakebin"
+  out="$dir/watch.out"; capture_file="$dir/pane.txt"
+  window="test:fm-chain-repair"; wt="$dir/wt"
+  mkdir -p "$wt/src"
+  printf 'idle building output' > "$capture_file"
+  printf 'window=%s\nkind=ship\nworktree=%s\n' "$window" "$wt" > "$state/chain-repair.meta"
+  printf 'working: implementing\n' > "$state/chain-repair.status"
+  sig=$(seen_sig "$state/chain-repair.status"); printf '%s' "$sig" > "$state/.seen-chain-repair_status"
+  key=$(printf '%s' "$window" | tr ':/.' '___')
+  pane_hash=$(hash_text "idle building output")
+  printf '%s' "$pane_hash" > "$state/.hash-$key"
+  printf '1\n' > "$state/.count-$key"
+  printf '%s' "$pane_hash" > "$state/.stale-$key"
+  # A deferral chain left over from an earlier quiet stretch, already well past the
+  # bounded re-surface window.
+  back=$(( $(date +%s) - 5000 ))
+  : > "$state/.writing-since-$key"
+  set_mtime "$back" "$state/.writing-since-$key"
+  # The idle-window timer is corrupt, so this poll repairs it and opens a NEW quiet
+  # window without probing the worktree at all.
+  printf 'corrupt\n' > "$state/.stale-since-$key"
+
+  PATH="$fakebin:$PATH" FM_FAKE_TMUX_WINDOW="$window" FM_FAKE_TMUX_CAPTURE="$capture_file" \
+    FM_STATE_OVERRIDE="$state" FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" \
+    FM_STALE_ESCALATE_SECS=240 FM_PAUSE_RESURFACE_SECS=240 FM_POLL=1 FM_SIGNAL_GRACE=1 \
+    FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
+  pid=$!
+  wait_numeric_file "$state/.stale-since-$key" 30 \
+    || { reap "$pid"; fail "the corrupt idle-window timer was not repaired"; }
+  [ ! -e "$state/.writing-since-$key" ] \
+    || { reap "$pid"; fail "an idle-window timer repair kept a finished write-deferral chain"; }
+  [ ! -s "$state/.wake-queue" ] || { reap "$pid"; fail "the idle-window timer repair enqueued a wake"; }
+  reap "$pid"
+  ack_stopped_cycle "$state" || fail "could not acknowledge the intentional timer-repair watcher stop"
+
+  # The new quiet window now crosses the escalation threshold while the crew writes
+  # its worktree. That deferral must get a FRESH re-surface window rather than
+  # inheriting the finished chain's age.
+  back=$(( $(date +%s) - 500 ))
+  echo "$back" > "$state/.stale-since-$key"
+  set_mtime "$back" "$state/.stale-since-$key"
+  printf 'int main(void) { return 0; }\n' > "$wt/src/main.c"
+  : > "$out"
+  PATH="$fakebin:$PATH" FM_FAKE_TMUX_WINDOW="$window" FM_FAKE_TMUX_CAPTURE="$capture_file" \
+    FM_STATE_OVERRIDE="$state" FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" \
+    FM_STALE_ESCALATE_SECS=240 FM_PAUSE_RESURFACE_SECS=240 FM_POLL=1 FM_SIGNAL_GRACE=1 \
+    FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
+  pid=$!
+  if ! wait_live "$pid" 30; then
+    reap "$pid"
+    fail "the first deferral of a new quiet window re-surfaced at once, so it inherited a finished chain: $(cat "$out")"
+  fi
+  [ ! -s "$out" ] || { reap "$pid"; fail "a fresh write deferral printed a wake reason: $(cat "$out")"; }
+  [ ! -s "$state/.wake-queue" ] || { reap "$pid"; fail "a fresh write deferral enqueued a wake"; }
+  [ -e "$state/.writing-since-$key" ] || { reap "$pid"; fail "the new deferral recorded no chain marker"; }
+  [ ! -e "$state/.writing-resurfaced-$key" ] \
+    || { reap "$pid"; fail "a fresh write deferral spent its bounded re-surface on the first poll"; }
+  reap "$pid"
+  pass "an idle-window timer repair drops a finished write-deferral chain, so the next deferral gets a fresh re-surface window"
+}
+
+# The same chain must not outlive either first-sight path through a captain-relevant
+# status line, because both also open a new idle window: the provably-working absorb
+# and the plain surface.
+test_terminal_first_sight_drops_a_finished_write_deferral_chain() {
+  local dir state fakebin out capture_file window key pane_hash sig pid wt back
+  dir=$(make_case wedge-write-chain-first-sight); state="$dir/state"; fakebin="$dir/fakebin"
+  out="$dir/watch.out"; capture_file="$dir/pane.txt"
+  window="test:fm-chain-firstsight"; wt="$dir/wt"
+  mkdir -p "$wt/src"
+  printf 'no-mistakes axi run: validating...' > "$capture_file"
+  printf 'window=%s\nkind=ship\nworktree=%s\n' "$window" "$wt" > "$state/chain-first.meta"
+  printf 'done: implementation complete, ready to validate\n' > "$state/chain-first.status"
+  sig=$(seen_sig "$state/chain-first.status"); printf '%s' "$sig" > "$state/.seen-chain-first_status"
+  key=$(printf '%s' "$window" | tr ':/.' '___')
+  pane_hash=$(hash_text "no-mistakes axi run: validating...")
+  printf '%s' "$pane_hash" > "$state/.hash-$key"
+  printf '1\n' > "$state/.count-$key"
+  back=$(( $(date +%s) - 5000 ))
+  : > "$state/.writing-since-$key"
+  set_mtime "$back" "$state/.writing-since-$key"
+  export FM_FAKE_CREW_STATE='state: working · source: run-step · validating (running)'
+
+  # First sight of this hash, absorbed because the active run outranks the stale
+  # captain-relevant line. The absorb opens a new idle window, so the finished chain
+  # must go with it.
+  PATH="$fakebin:$PATH" FM_FAKE_TMUX_WINDOW="$window" FM_FAKE_TMUX_CAPTURE="$capture_file" \
+    FM_STATE_OVERRIDE="$state" FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" \
+    FM_STALE_ESCALATE_SECS=999 FM_PAUSE_RESURFACE_SECS=240 FM_POLL=1 FM_SIGNAL_GRACE=1 \
+    FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
+  pid=$!
+  if ! wait_live "$pid" 30; then
+    reap "$pid"; fail "the overridden terminal status was not absorbed on first sight: $(cat "$out")"
+  fi
+  [ "$(cat "$state/.stale-$key" 2>/dev/null || true)" = "$pane_hash" ] \
+    || { reap "$pid"; fail "the first-sight absorb did not advance the stale suppressor"; }
+  [ ! -e "$state/.writing-since-$key" ] \
+    || { reap "$pid"; fail "the provably-working first-sight absorb kept a finished write-deferral chain"; }
+  reap "$pid"
+  ack_stopped_cycle "$state" || fail "could not acknowledge the intentional first-sight absorb stop"
+
+  # Same pane, first sight again, but nothing overrides the status line now, so it
+  # surfaces. That path drops the idle-window timer, so it must drop the chain too.
+  rm -f "$state/.stale-$key" "$state/.stale-since-$key"
+  printf '1\n' > "$state/.count-$key"
+  : > "$state/.writing-since-$key"
+  set_mtime "$back" "$state/.writing-since-$key"
+  FM_FAKE_CREW_STATE='state: unknown · source: none · no run, no busy pane'
+  : > "$out"
+  PATH="$fakebin:$PATH" FM_FAKE_TMUX_WINDOW="$window" FM_FAKE_TMUX_CAPTURE="$capture_file" \
+    FM_STATE_OVERRIDE="$state" FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" \
+    FM_STALE_ESCALATE_SECS=999 FM_PAUSE_RESURFACE_SECS=240 FM_POLL=1 FM_SIGNAL_GRACE=1 \
+    FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
+  pid=$!
+  wait_for_exit "$pid" 40 || fail "a first-sight captain-relevant status was not surfaced"
+  grep -F "stale: $window" "$out" >/dev/null || fail "the first-sight surface did not print a stale wake"
+  [ ! -e "$state/.writing-since-$key" ] \
+    || fail "the first-sight surface kept a finished write-deferral chain"
+  unset FM_FAKE_CREW_STATE
+  pass "both first-sight paths through a captain-relevant status drop a finished write-deferral chain with the idle window"
+}
+
 # --- triage debug log stays size capped -------------------------------------
 
 test_triage_log_size_cap_accepts_spaced_wc_counts() {
@@ -2097,6 +2561,10 @@ test_classifier_primitives
 test_crew_is_provably_working_classifier
 test_status_is_paused_classifier
 test_crew_absorb_class_classifier
+test_crew_worktree_written_since_classifier
+test_empty_write_prune_widens_the_probe
+test_empty_write_prune_from_the_environment_widens_the_probe
+test_worktree_write_probe_is_wall_clock_bounded
 test_signal_crew_provably_working_classifier
 test_secondmate_status_signal_never_absorbed_classifier
 test_provably_working_signal_absorbed
@@ -2128,6 +2596,11 @@ test_nonterminal_stale_pause_transitions_reclassify_unchanged_hash
 test_nonterminal_paused_rechecks_authoritative_state
 test_paused_authoritative_working_preserves_wedge_timer
 test_nonterminal_stale_repairs_missing_or_corrupt_timer
+test_wedge_escalation_deferred_while_worktree_is_written
+test_write_deferral_resurfaces_on_the_bounded_cadence
+test_secondmate_home_supervision_churn_is_not_write_evidence
+test_timer_repair_drops_a_finished_write_deferral_chain
+test_terminal_first_sight_drops_a_finished_write_deferral_chain
 test_triage_log_size_cap_accepts_spaced_wc_counts
 test_procevent_captured_result_surfaces_proactively
 test_procevent_unacknowledged_result_redrains_until_handled

From 3d125ad37378441b086d785bb24a555b1e46574a Mon Sep 17 00:00:00 2001
From: Inthuson <inthuson@amazon.com>
Date: Fri, 21 Aug 2026 19:21:45 +0100
Subject: [PATCH 07/11] fix(bin): give a captain hold the same bounded pause
 cadence as a declared pause (#2748)

* fix(bin): give a captain hold the same bounded pause cadence as a declared pause

Two supervisors read a finished task's last status line and disagreed about which
declarations mean an idle endpoint is expected. bin/fm-inactive-reconcile.sh
suppresses its inactive-outcome scan only on `captain-held`, while the away-mode
daemon's wedge path gated deferral on `paused` alone. Both read the LAST line, so
the two verbs are mutually exclusive and no finished task waiting on a person
could satisfy both at once. Marking 11 such tasks `captain-held:` silenced the
900s outcome scan and immediately produced five possible-wedge escalations in one
batch, because the 240s wedge detector no longer saw a pause verb.

fm-classify-lib.sh's status_is_paused_or_captain_held already owns the combined
question, and bin/fm-watch.sh's ordinary-crew wedge path already asked it. This
extends that same answer to the paths still asking the narrower one:

- bin/fm-supervise-daemon.sh, all six sites, which form one subsystem and have to
  move together. classify_stale returns the pause action, reconcile_pause_tracking
  and migrate_watcher_pause_markers record and migrate the marker, and
  housekeeping defers the wedge and then re-surfaces the recheck. Changing only
  the stale-persistence gate would defer the escalation while
  reconcile_pause_tracking recorded nothing, so the wedge marker would persist and
  the sweep would `continue` past it forever: quiet, but never re-surfacing.
- bin/fm-watch.sh's secondmate stale gate, whose downstream owner
  pause_state_class already treats both declarations identically.
- bin/fm-push-transition-lib.sh's absorb, where either declaration already names
  the human the transition would report and the wait is already durably recorded.

Quieting alone would be half a fix, so the bounded re-surface had to reach a hold
too. A hold has no current-state mapping, unlike `paused`, so authoritative crew
state reports it as unknown and pause_state_class received `none`. An ordinary
crew recovers pause classification from that state through confirmed agent death,
which proves no live decision gate is being silenced. A secondmate's endpoint
liveness is deliberately never read there, because an idle mate is healthy by
design, so that confirmation is unavailable by construction and cannot be
required: without recovering the classification for a mate, every caller silenced
a held mate outright and its hold would rot invisibly. That promotion is bounded
by the declared-wait guard at the top of the function, so it can only reclassify a
task that already declared a wait and shows no positive working evidence.

Two narrow `status_is_paused` calls are deliberately left alone.
bin/fm-crew-state.sh's map_log_state is a current-state reporting contract, not a
wedge path; reporting a hold as `paused` would erase the distinction
status_key_closing_verb and fm-captain-hold.sh depend on, where a `captain-held`
close is a verified durable transfer and a `resolved` close claims outright
settlement. fm-classify-lib.sh's call inside status_is_captain_relevant needs no
change because that function's own case list already returns non-relevant for
`captain-held`.

bin/fm-inactive-reconcile.sh keeps its `captain-held` suppression as it is. Its
guard exists because a finished task's crew state still reports done from a
higher-priority source than the log, and a declared pause needs no such guard: the
scan only reports done or failed, and nothing else reaches its record path.
Widening it would change a separate subsystem's reporting contract, which this
defect does not require.

Coverage extends the existing colocated patterns for these predicates and asserts
both halves. tests/fm-daemon.test.sh covers the classification, the wedge marker
converting to pause tracking with no escalation, the bounded re-surface with its
window reset, and the boundary case where an answered hold stops claiming the
cadence. tests/fm-watch-triage.test.sh covers a held secondmate re-surfacing on
the same bounded cadence without being labeled a wedge.
tests/fm-supervision-events.test.sh covers the absorbed push transition. Every one
of these fails on the pre-fix code except the answered-hold boundary case, which
is there to pin that the quieting was not widened too far.

The `paused:` workaround appended to those 11 tasks is live supervision state and
is untouched here. It can be retired once this lands.

* no-mistakes(review): name the captain in a held task's bounded recheck

* no-mistakes(document): extend declared-wait supervision docs to captain-held holds
---
 .agents/skills/afk/SKILL.md         |  9 +--
 bin/fm-classify-lib.sh              | 28 +++++++---
 bin/fm-push-transition-lib.sh       |  8 ++-
 bin/fm-supervise-daemon.sh          | 84 ++++++++++++++++------------
 bin/fm-watch.sh                     | 81 +++++++++++++++++++--------
 docs/architecture.md                | 14 ++---
 docs/configuration.md               |  2 +-
 docs/herdr-backend.md               |  2 +-
 tests/fm-daemon.test.sh             | 85 +++++++++++++++++++++++++++++
 tests/fm-supervision-events.test.sh | 13 +++++
 tests/fm-watch-triage.test.sh       | 52 +++++++++++++++++-
 11 files changed, 295 insertions(+), 83 deletions(-)

diff --git a/.agents/skills/afk/SKILL.md b/.agents/skills/afk/SKILL.md
index ba7546c160..c224eb9793 100644
--- a/.agents/skills/afk/SKILL.md
+++ b/.agents/skills/afk/SKILL.md
@@ -136,8 +136,8 @@ The daemon still clears its buffer only on the backend's `empty` success verdict
 
 The daemon wraps `fm-watch.sh`, runs the watcher as a child, presents every durable wake after each actionable watcher close, classifies each presented record in bash, and acknowledges the presented generation only after routing completes.
 It self-handles the routine majority without consuming a firstmate turn.
-Captain-relevant events, plus a bounded recheck of a declared external wait that remains idle, escalate to firstmate's context as one pre-read, single-line, batched digest.
-The classification predicates (the captain-relevant verb set, declared-pause vocabulary, signal/stale tests, and fleet-scan) live in the shared `bin/fm-classify-lib.sh`, the same library the always-on watcher uses for its own triage when afk is off, so the two modes apply one identical policy.
+Captain-relevant events, plus a bounded recheck of a declared wait that remains idle, escalate to firstmate's context as one pre-read, single-line, batched digest.
+The classification predicates (the captain-relevant verb set, declared-wait vocabulary, signal/stale tests, and fleet-scan) live in the shared `bin/fm-classify-lib.sh`, the same library the always-on watcher uses for its own triage when afk is off, so the two modes apply one identical policy.
 While `state/.afk` exists the daemon owns the watcher, so the watcher reverts to one-shot and lets the daemon do the triage - the two never run their triage at the same time.
 
 Classify each wake this way:
@@ -145,8 +145,9 @@ Classify each wake this way:
 - `signal` with a terminal captain verb (`done:`, `needs-decision:`, `blocked:`, or `failed:`) -> escalate.
   A nonterminal progress verb remains nonterminal even when its prose contains a legacy free-text token such as `PR ready`, `checks green`, `ready in branch`, or `merged`; only a bare legacy line with such a token escalates.
   Other signals with no captain-relevant status -> self-handle.
-- `signal` or `stale` for a declared `paused:` external wait -> self-handle and track the pause rather than a wedge.
-  If it remains declared and idle past `FM_PAUSE_RESURFACE_SECS` (default 3600s), housekeeping sends one awaiting-external recheck and resets the pause window.
+- `signal` or `stale` for a declared wait, either a `paused:` external wait or a verified `captain-held` transfer -> self-handle and track the pause rather than a wedge.
+  If it remains declared and idle past `FM_PAUSE_RESURFACE_SECS` (default 3600s), housekeeping sends one recheck and resets the pause window.
+  That recheck names which human the wait is on: the external dependency for `paused:`, and the captain themself for a `captain-held` transfer, who can answer the held decision or release the hold.
 - `check` -> always escalate. Check scripts print only when firstmate should wake.
 - `stale` with a terminal status or bare legacy captain-relevant line -> escalate.
   Nonterminal progress remains transient even when its prose contains a legacy free-text token or its seen-status marker already matches, so record a marker and self-handle.
diff --git a/bin/fm-classify-lib.sh b/bin/fm-classify-lib.sh
index d650112ddb..9915ece7d2 100755
--- a/bin/fm-classify-lib.sh
+++ b/bin/fm-classify-lib.sh
@@ -76,7 +76,7 @@ FM_CLASSIFY_CAPTAIN_RE_DEFAULT='done:|needs-decision:|blocked:|failed:|PR ready|
 # drift between the two consumers. FM_CLASSIFY_PAUSED_VERB overrides it.
 FM_CLASSIFY_PAUSED_VERB_DEFAULT='paused'
 
-# Bounded re-surface cadence for a declared pause or a dead-agent captain hold.
+# Bounded re-surface cadence for a declared pause or a verified captain hold.
 # Far longer than the wedge threshold (FM_STALE_ESCALATE_SECS, default 240s), it
 # avoids nagging a deliberate wait while ensuring a forgotten hold cannot rot
 # invisibly - it re-surfaces once for a recheck every window. One hour by default;
@@ -146,19 +146,31 @@ status_is_paused() {  # <status-line>
   [ "$verb" = "${FM_CLASSIFY_PAUSED_VERB:-$FM_CLASSIFY_PAUSED_VERB_DEFAULT}" ]
 }
 
-# 0 if a status line declares either an external-wait pause or a verified
-# captain-held transfer.
-# Both declarations can intentionally leave an exited crew's endpoint idle, so
-# the watcher applies its bounded pause cadence when agent death confirms that
-# no live decision gate is being silenced.
-status_is_paused_or_captain_held() {  # <status-line>
+# 0 if a status line's leading verb is the verified captain-held transfer verb.
+# The same pure verb read as status_is_paused, and the discriminator a supervisor
+# needs once a declared wait has already been recognized: the two declarations get
+# the same bounded cadence, but they block on DIFFERENT humans, so a recheck that
+# names an external dependency for a hold points the captain away from the fact
+# that they are the one who can clear it.
+status_is_captain_held() {  # <status-line>
   local line=$1 verb
-  status_is_paused "$line" && return 0
   [ -n "$line" ] || return 1
   verb=$(status_line_verb "$line")
   [ "$verb" = "${FM_CLASSIFY_CAPTAIN_HELD_VERB:-$FM_CLASSIFY_CAPTAIN_HELD_VERB_DEFAULT}" ]
 }
 
+# 0 if a status line declares either an external-wait pause or a verified
+# captain-held transfer.
+# Both declarations can intentionally leave a crew's endpoint idle, so both
+# supervisors give them one cadence: the away-mode daemon defers the wedge and
+# ages a pause marker instead, and the watcher applies its bounded pause cadence
+# once pause_state_class has admitted the wait (fm-watch.sh owns which liveness
+# evidence each kind of crew must supply for that).
+status_is_paused_or_captain_held() {  # <status-line>
+  local line=$1
+  status_is_paused "$line" || status_is_captain_held "$line"
+}
+
 # --- durable keyed decisions ------------------------------------------------
 #
 # The status stream is an append-only EVENT log. Reading it last-event-wins
diff --git a/bin/fm-push-transition-lib.sh b/bin/fm-push-transition-lib.sh
index 5ee55fd3b4..19d0a142a9 100644
--- a/bin/fm-push-transition-lib.sh
+++ b/bin/fm-push-transition-lib.sh
@@ -130,8 +130,12 @@ handle_push_transition() {  # <backend> <session> <record>
   [ -n "$pane_id" ] || { sleep 1; return; }
   window="$session:$pane_id"
   task=$(window_to_task "$window" "$STATE")
-  if status_is_paused "$(last_status_line "$STATE/$task.status")"; then
-    triage_log "absorbed push $to (declared pause, awaiting external): $window"
+  # A declared wait already names the human this transition would report: an
+  # external dependency, or the captain a verified hold transferred the work to.
+  # Either way the wait is durably recorded, so absorb the immediate escalation
+  # and leave the bounded re-surface to the watcher's own pause cadence.
+  if status_is_paused_or_captain_held "$(last_status_line "$STATE/$task.status")"; then
+    triage_log "absorbed push $to (declared wait, awaiting external or captain): $window"
     fm_backend_commit_transition "$backend" "$STATE" "$session" "$record" || exit 1
     return
   fi
diff --git a/bin/fm-supervise-daemon.sh b/bin/fm-supervise-daemon.sh
index c772bd3a15..86bad52b44 100755
--- a/bin/fm-supervise-daemon.sh
+++ b/bin/fm-supervise-daemon.sh
@@ -5,11 +5,11 @@
 # durable wake after an actionable close, acknowledges only after routing, and
 # either SELF-HANDLES the routine majority in bash (no firstmate turn) or
 # ESCALATES a batched, distilled digest to the supervisor pane on
-# captain-relevant events plus bounded declared-pause rechecks. This is the
+# captain-relevant events plus bounded declared-wait rechecks. This is the
 # token-efficient replacement for the prior always-inject daemon: routine
 # signal/stale/heartbeat wakes cost zero firstmate context; only done/
 # needs-decision/blocked/failed/persistent-wedge/check-output events and a
-# declared-pause recheck reach the LLM, and even then as one pre-read digest per
+# declared-wait recheck reach the LLM, and even then as one pre-read digest per
 # batch window.
 #
 # PRESENCE-GATING (the /afk contract). The daemon is the away-mode engine: it
@@ -41,11 +41,13 @@
 #     drain and acknowledges it only after routing completes.
 #   - Fail-safe-to-escalate: any wake the classifier cannot confidently mark
 #     routine is escalated.
-#   - Bounded wedge latency: a stale pane without a declared external wait is
-#     escalated only after it has been idle for STALE_ESCALATE_SECS
+#   - Bounded wedge latency: a stale pane without a declared wait is escalated
+#     only after it has been idle for STALE_ESCALATE_SECS
 #     (configurable), rechecked once. A wedged crewmate is therefore detected
-#     within STALE_ESCALATE_SECS + a tick, never lost. A declared pause instead
-#     gets its own longer PAUSE_RESURFACE_SECS recheck, never a wedge escalation.
+#     within STALE_ESCALATE_SECS + a tick, never lost. A declared wait - either a
+#     paused: external wait or a verified captain-held transfer, per
+#     fm-classify-lib.sh's combined predicate - instead gets its own longer
+#     PAUSE_RESURFACE_SECS recheck, never a wedge escalation.
 #     Crewmates are autonomous, so a delayed stale response does not stall a
 #     healthy crewmate's own progress.
 #     Buffered escalation delivery also has a max-defer alarm: if a digest stays
@@ -89,8 +91,9 @@
 #                                   kinds.
 #          FM_STALE_ESCALATE_SECS   idle seconds before a stale pane escalates
 #                                   as a possible wedge (default 240)
-#          FM_PAUSE_RESURFACE_SECS  idle seconds before a declared external wait
-#                                   re-surfaces as a recheck (default 3600)
+#          FM_PAUSE_RESURFACE_SECS  idle seconds before a declared wait (external
+#                                   or captain-held) re-surfaces as a recheck
+#                                   (default 3600)
 #          FM_ESCALATE_BATCH_SECS   buffer window for batched escalation
 #                                   digests; 0 = flush immediately (default 90)
 #          FM_HEARTBEAT_SCAN_SECS   cadence for the catch-all status scan
@@ -372,12 +375,13 @@ classify_stale() {  # <window> <state>
   local win=$1 state=$2 task last seen
   task=$(window_to_task "$win" "$state")
   last=$(last_status_line "$state/$task.status")
-  if [ -n "$last" ] && status_is_paused "$last"; then
-    # A DECLARED external-wait pause (fm-classify-lib.sh): an idle pane is EXPECTED,
-    # so this is not a wedge. The caller records a pause marker (long re-surface
-    # cadence in housekeeping) rather than a wedge stale marker. Cheap: reuses the
-    # status line already read, no fm-crew-state.sh call, mirroring the daemon's
-    # existing status-log classification.
+  if [ -n "$last" ] && status_is_paused_or_captain_held "$last"; then
+    # A DECLARED external-wait pause or a verified captain-held transfer
+    # (fm-classify-lib.sh owns which declarations qualify): an idle pane is
+    # EXPECTED, so this is not a wedge. The caller records a pause marker (long
+    # re-surface cadence in housekeeping) rather than a wedge stale marker. Cheap:
+    # reuses the status line already read, no fm-crew-state.sh call, mirroring the
+    # daemon's existing status-log classification.
     printf 'pause|paused (awaiting external), rechecked on a long cadence: %s' "$last"
     return
   fi
@@ -446,10 +450,11 @@ stale_marker_remove() {  # <window> <state>
   rm -f "$state/.subsuper-stale-$key"
 }
 
-# Pause marker: state/.subsuper-paused-<key> holds the epoch a declared pause was
-# first observed idle. Housekeeping ages it against PAUSE_RESURFACE_SECS (much
-# longer than a wedge) and re-surfaces the pause once per window. Recording is
-# create-if-absent so the timestamp is stable across a churny idle pane (many
+# Pause marker: state/.subsuper-paused-<key> holds the epoch a declared wait (a
+# paused: external wait or a verified captain-held transfer) was first observed
+# idle. Housekeeping ages it against PAUSE_RESURFACE_SECS (much longer than a
+# wedge) and re-surfaces the wait once per window. Recording is create-if-absent
+# so the timestamp is stable across a churny idle pane (many
 # distinct stale hashes map to one marker), keeping the cadence hash-immune.
 pause_marker_record() {  # <window> <state> - create if absent
   local win=$1 state=$2 key marker
@@ -481,7 +486,7 @@ reconcile_pause_tracking() {  # <window> <state> <last-status-line>
   key=$(_stale_key "$task")
   marker="$state/.subsuper-paused-$key"
   watcher_key=$(_stale_key "$win")
-  if status_is_paused "$last"; then
+  if status_is_paused_or_captain_held "$last"; then
     stale_marker_remove "$win" "$state"
     pause_marker_record "$win" "$state"
   elif [ -e "$marker" ] || [ -e "$state/.paused-$watcher_key" ]; then
@@ -499,7 +504,7 @@ migrate_watcher_pause_markers() {  # <state>
     key=$(_stale_key "$task")
     watcher_key=$(_stale_key "$win")
     last=$(last_status_line "$state/$task.status")
-    if status_is_paused "$last" || [ -e "$state/.subsuper-paused-$key" ] || [ -e "$state/.paused-$watcher_key" ]; then
+    if status_is_paused_or_captain_held "$last" || [ -e "$state/.subsuper-paused-$key" ] || [ -e "$state/.paused-$watcher_key" ]; then
       reconcile_pause_tracking "$win" "$state" "$last"
     fi
   done
@@ -954,9 +959,10 @@ _oldest_line_age() {  # <buf> -> seconds since the oldest buffered item first ar
 #     Never silently defer forever.
 #  2) stale recheck: for each pending stale marker past STALE_ESCALATE_SECS,
 #     re-peek the pane; still idle -> escalate (wedge); resumed -> clear marker.
-#  2b) pause re-surface: for each declared-pause marker past PAUSE_RESURFACE_SECS,
-#     re-peek; busy/gone -> clear; still idle + still paused -> escalate a recheck
-#     digest and reset the window (repeating bounded re-surface, never a wedge).
+#  2b) pause re-surface: for each declared-wait marker past PAUSE_RESURFACE_SECS,
+#     re-peek; busy/gone -> clear; still idle + still declaring the wait -> escalate
+#     a recheck digest naming which human the wait is on, and reset the window
+#     (repeating bounded re-surface, never a wedge).
 #  3) heartbeat scan: every HEARTBEAT_SCAN_SECS, grep state/*.status for a
 #     captain-relevant line the per-wake classifier missed and escalate it.
 housekeeping() {  # <state>
@@ -1007,7 +1013,7 @@ housekeeping() {  # <state>
     fi
     task=$(window_to_task "$win" "$state")
     last=$(last_status_line "$state/$task.status")
-    if [ -n "$last" ] && status_is_paused "$last"; then
+    if [ -n "$last" ] && status_is_paused_or_captain_held "$last"; then
       reconcile_pause_tracking "$win" "$state" "$last"
       continue
     fi
@@ -1022,12 +1028,15 @@ housekeeping() {  # <state>
     esac
   done
 
-  # (2b) pause re-surface recheck. A DECLARED external-wait pause idles by design,
-  # so it is rechecked on a much longer cadence than a wedge (PAUSE_RESURFACE_SECS)
-  # and never escalated as one - but it MUST re-surface, so a forgotten pause cannot
-  # rot invisibly. Past the window: busy (resumed) or gone -> drop; still idle and
-  # still declaring the pause -> escalate a recheck digest and reset the marker so
-  # the window repeats.
+  # (2b) pause re-surface recheck. A declared wait idles by design (fm-classify-lib.sh's
+  # status_is_paused_or_captain_held owns which declarations qualify), so it is
+  # rechecked on a much longer cadence than a wedge (PAUSE_RESURFACE_SECS) and never
+  # escalated as one - but it MUST re-surface, so neither a forgotten pause nor a
+  # forgotten captain hold can rot invisibly. Past the window: busy (resumed) or gone
+  # -> drop; still idle and still declaring the wait -> escalate a recheck digest and
+  # reset the marker so the window repeats. The digest names WHICH human the wait is
+  # on, because the captain is the one reading it: an external dependency for a
+  # paused: declaration, and the captain themself for a verified hold transfer.
   pause_secs=${FM_PAUSE_RESURFACE_SECS:-$FM_PAUSE_RESURFACE_SECS_DEFAULT}
   for marker in "$state"/.subsuper-paused-*; do
     [ -e "$marker" ] || continue
@@ -1038,7 +1047,7 @@ housekeeping() {  # <state>
     fi
     task=$(window_to_task "$win" "$state")
     last=$(last_status_line "$state/$task.status")
-    if [ -z "$last" ] || ! status_is_paused "$last"; then
+    if [ -z "$last" ] || ! status_is_paused_or_captain_held "$last"; then
       reconcile_pause_tracking "$win" "$state" "$last"
       continue
     fi
@@ -1050,7 +1059,10 @@ housekeeping() {  # <state>
       2) rm -f "$marker" ;;
       *)
         last=$(last_status_line "$state/$task.status")
-        if [ -n "$last" ] && status_is_paused "$last"; then
+        if [ -n "$last" ] && status_is_captain_held "$last"; then
+          escalate_add "$state" "captain-held ${age}s (awaiting the captain, answer the held decision or release the hold): $win"
+          _now > "$marker"
+        elif [ -n "$last" ] && status_is_paused "$last"; then
           escalate_add "$state" "paused ${age}s (awaiting external, recheck whether the wait still holds): $win"
           _now > "$marker"
         else
@@ -1237,10 +1249,10 @@ handle_wake() {  # <reason> <state>
       [ "${FM_ESCALATE_BATCH_SECS:-$ESCALATE_BATCH_SECS_DEFAULT}" -le 0 ] && { escalate_flush "$state" || true; }
       ;;
     pause)
-      # Declared external-wait pause: record a pause marker (long re-surface
-      # cadence in housekeeping) and drop any wedge stale marker, so a pane that
-      # transitioned working->paused is not still wedge-aged. Only stale produces
-      # this action.
+      # Declared wait, an external-wait pause or a verified captain-held transfer:
+      # record a pause marker (long re-surface cadence in housekeeping) and drop any
+      # wedge stale marker, so a pane that transitioned working->declared-wait is not
+      # still wedge-aged. Only stale produces this action.
       if [ "$kind" = "stale" ]; then
         stale_marker_remove "$arg" "$state"
         pause_marker_record "$arg" "$state"
diff --git a/bin/fm-watch.sh b/bin/fm-watch.sh
index a056045dfd..d1d59d3ceb 100755
--- a/bin/fm-watch.sh
+++ b/bin/fm-watch.sh
@@ -6,9 +6,10 @@
 # is absorbed only when the crew shows POSITIVE evidence it is still working (an
 # actively-running no-mistakes step, or a backend busy signal), and surfaced
 # otherwise, so a crew that finishes (or stops and waits) without a current
-# working signal is never silently swallowed. A declared external-wait pause is
-# the separate idle absorb case and re-surfaces only on its long bounded cadence,
-# although its initial no-verb status signal still surfaces in normal mode.
+# working signal is never silently swallowed. A declared wait, either a paused:
+# external wait or a verified captain-held transfer, is the separate idle absorb
+# case and re-surfaces only on its long bounded cadence, although its initial
+# no-verb status signal still surfaces in normal mode.
 # While state/.afk exists, the daemon owns triage and this watcher queues and exits
 # on every wake. Printed reason lines:
 #   signal: <file>...      status/turn-end signals, surfaced when a listed status
@@ -19,9 +20,11 @@
 #                          run-step or busy pane outranks even a captain-relevant log
 #                          line, since the crew's own log gets no new entry once
 #                          firstmate hands it to a no-mistakes validation. A declared
-#                          external-wait pause is absorbed instead with its own long
-#                          re-surface cadence, never as a wedge. Only when neither
-#                          absorb class applies does the log's last line decide:
+#                          external-wait pause or verified captain-held transfer is
+#                          absorbed instead with its own long re-surface cadence,
+#                          never as a wedge, and that recheck reason names which
+#                          human the wait is on. Only when neither absorb class
+#                          applies does the log's last line decide:
 #                          terminal (captain-relevant) or non-terminal (no verb),
 #                          both surfaced at once. A provably-working stale past the
 #                          wedge threshold also surfaces, with an "escalation N"
@@ -174,7 +177,9 @@ BUSY_TURN_MAX_SECS=${FM_BUSY_TURN_MAX_SECS:-3600}
 # A crew that declared a pause is idling on a known external wait, so its stale
 # pane is absorbed rather than wedge-escalated.
 # A captain-held or paused crew whose agent has confidently exited uses the same
-# bounded cadence, while a live or ambiguously read agent still surfaces once.
+# bounded cadence, while a live or ambiguously read agent still surfaces once; a
+# secondmate earns the cadence on its declaration alone, because its endpoint
+# liveness is deliberately never read (pause_state_class owns that split).
 # These cases re-surface once for a recheck every PAUSE_RESURFACE_SECS - far
 # longer than the wedge threshold, but finite so a forgotten hold cannot rot invisibly.
 PAUSE_RESURFACE_SECS=${FM_PAUSE_RESURFACE_SECS:-$FM_PAUSE_RESURFACE_SECS_DEFAULT}
@@ -417,8 +422,14 @@ busy_turn_over_age() {  # <task>
 # timer would. The bounded re-surface itself is the shared resurface_absorbed
 # above, throttled by this window's own .paused-resurfaced-<key> marker. Advances
 # the stale suppressor to <hash> and flags the key paused.
+#
+# The recheck names WHICH human the declared wait is on, because that is the whole
+# point of a recheck the captain reads: an external dependency for paused:, and the
+# captain themself for a verified hold. Only the captain-held verb takes the second
+# wording; a caller that reached the bounded cadence off pause tracking alone, with
+# no declaring verb left on the log, keeps the external-wait wording it always had.
 handle_paused_stale() {  # <window> <task> <hash>
-  local win=$1 task=$2 h=$3 key statusf mtime age
+  local win=$1 task=$2 h=$3 key statusf mtime age detail reason
   key=$(window_key "$win")
   printf '%s' "$h" > "$STATE/.stale-$key"
   : > "$STATE/.paused-$key"
@@ -428,9 +439,15 @@ handle_paused_stale() {  # <window> <task> <hash>
   mtime=$(stat_mtime "$statusf")
   case "$mtime" in ''|*[!0-9]*) mtime=$(date +%s) ;; esac
   age=$(( $(date +%s) - mtime ))
-  resurface_absorbed "$win" "$STATE/.paused-resurfaced-$key" "$age" \
-    "stale: $win (paused ${age}s, awaiting external - declared pause, rechecked on a long cadence not a wedge; confirm the wait still holds)"
-  triage_log "absorbed stale (paused, awaiting external, age ${age}s): $win"
+  if status_is_captain_held "$(last_status_line "$statusf")"; then
+    detail="captain-held, awaiting the captain"
+    reason="captain-held ${age}s, awaiting the captain - verified hold transfer, rechecked on a long cadence not a wedge; answer the held decision or release the hold"
+  else
+    detail="paused, awaiting external"
+    reason="paused ${age}s, awaiting external - declared pause, rechecked on a long cadence not a wedge; confirm the wait still holds"
+  fi
+  resurface_absorbed "$win" "$STATE/.paused-resurfaced-$key" "$age" "stale: $win ($reason)"
+  triage_log "absorbed stale ($detail, age ${age}s): $win"
 }
 
 # Apply the busy-pane completed-turn bound to a window whose bound has already
@@ -470,10 +487,11 @@ clear_pause_tracking() {  # <window-key>
 }
 
 # Reconcile a declared pause or captain-held status with authoritative crew state.
-# Only a confidently dead ordinary crew may recover paused classification after
-# fm-crew-state has fallen back to stopped or unknown.
+# After fm-crew-state has fallen back to stopped or unknown, paused classification is
+# recovered only for a confidently dead ordinary crew, or for a secondmate, whose
+# endpoint liveness this function deliberately never reads.
 pause_state_class() {  # <window> <task>
-  local win=$1 task=$2 key last recheck_file class agent_alive
+  local win=$1 task=$2 key last recheck_file class agent_alive kind
   key=$(window_key "$win")
   last=$(last_status_line "$STATE/$task.status")
   recheck_file="$STATE/.paused-rechecked-$key"
@@ -482,8 +500,12 @@ pause_state_class() {  # <window> <task>
     crew_absorb_class "$task"
     return
   fi
+  # Read once past the declared-wait gate and reused by both liveness gates below,
+  # so a mate's stale poll costs one metadata scan rather than one per gate, and the
+  # far more common no-declaration path above still costs none.
+  kind=$(window_kind "$win")
   if [ -e "$STATE/.paused-$key" ] && [ "$(age_of "$recheck_file")" -lt "$STALE_ESCALATE_SECS" ]; then
-    if [ "$(window_kind "$win")" != secondmate ]; then
+    if [ "$kind" != secondmate ]; then
       agent_alive=$(fm_backend_agent_alive "$(window_backend "$win")" "$win" 2>/dev/null) || agent_alive=unknown
       if [ "$agent_alive" != dead ]; then
         rm -f "$recheck_file"
@@ -500,7 +522,7 @@ pause_state_class() {  # <window> <task>
     printf 'working'
     return
   fi
-  if [ "$(window_kind "$win")" != secondmate ]; then
+  if [ "$kind" != secondmate ]; then
     agent_alive=$(fm_backend_agent_alive "$(window_backend "$win")" "$win" 2>/dev/null) || agent_alive=unknown
     if [ "$agent_alive" != dead ]; then
       rm -f "$recheck_file"
@@ -508,7 +530,15 @@ pause_state_class() {  # <window> <task>
       return
     fi
   fi
-  [ "$class" = none ] && [ "${agent_alive:-unknown}" = dead ] && class=paused
+  # Recover paused classification for a declared wait that authoritative crew state
+  # could not name. Reaching here already proves the only two admissible cases: an
+  # ordinary crew whose agent the gate above confirmed dead, so no live decision gate
+  # is being silenced, or a secondmate, whose endpoint liveness is deliberately never
+  # read and so cannot supply that confirmation. Without the mate case a mate's
+  # captain hold - which has no current-state mapping and so arrives as `none` -
+  # would be silenced by every caller rather than taking the bounded re-surface
+  # cadence, and a forgotten hold would rot invisibly.
+  [ "$class" = none ] && class=paused
   case "$class" in
     paused) date +%s > "$recheck_file" ;;
     *) rm -f "$recheck_file" ;;
@@ -1106,7 +1136,14 @@ EOF
     if ! status_is_paused_or_captain_held "$last" && [ -e "$STATE/.paused-$key" ]; then
       clear_pause_tracking "$key"
     fi
-    if [ "$kind" = secondmate ] && ! status_is_paused "$last"; then
+    # An idle secondmate endpoint is healthy by design, so a mate is admitted to
+    # the pane-stale path ONLY to serve a declared wait's bounded re-surface -
+    # the same declarations pause_state_class reconciles below, which is why this
+    # gate reads the shared predicate rather than the pause verb alone. Narrowing
+    # it to `paused` would leave a mate's captain hold rotting invisibly: the
+    # clear above already spares its pause tracking, but nothing would ever
+    # re-surface it.
+    if [ "$kind" = secondmate ] && ! status_is_paused_or_captain_held "$last"; then
       continue
     fi
     tail40=$(fm_backend_capture "$(window_backend "$w")" "$w" 40 "$(window_label "$w")" 2>/dev/null) || continue
@@ -1188,10 +1225,10 @@ EOF
           #   - working: an actively-running pipeline legitimately sits on a static
           #     pane (e.g. waiting on CI), so absorb and start the wedge timer so a
           #     genuinely frozen run still escalates past STALE_ESCALATE_SECS;
-          #   - paused: the crew declared an external wait, or a declared pause or
-          #     captain hold is paired with a confidently dead agent, so absorb on
-          #     the long PAUSE_RESURFACE_SECS cadence instead of wedge-escalating;
-          #   - none: no running pipeline, no exact busy verdict, no declared pause.
+          #   - paused: a declared wait pause_state_class admits (its header owns which
+          #     liveness evidence each kind of crew must supply), so absorb on the long
+          #     PAUSE_RESURFACE_SECS cadence instead of wedge-escalating;
+          #   - none: no running pipeline, no exact busy verdict, no admitted declared wait.
           #     Surface immediately so firstmate inspects the inconclusive state
           #     (it may be done via an interactive menu that wrote no done: status,
           #     waiting on a decision, or wedged) instead of leaving the finish to
diff --git a/docs/architecture.md b/docs/architecture.md
index bfcd2dc0e8..04e1d51eb2 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -9,7 +9,7 @@ firstmate's always-loaded operating contract and routing index for conditional p
 ## Event-driven supervision
 
 A zero-token bash watcher (`bin/fm-watch.sh`) sleeps on the fleet, classifies detected wakes in bash, and wakes the first mate only when something is actionable.
-Actionable wakes include captain-relevant status signals, no-verb signals whose crew is not provably working, authenticated check output such as PR merge polling or a Relay mention, stale panes whose crew is not provably working whether their status log looks terminal or non-terminal, provably-working stale panes that persist past `FM_STALE_ESCALATE_SECS` without their own task worktree being written, declared external waits that remain paused past `FM_PAUSE_RESURFACE_SECS`, and heartbeat backstop hits.
+Actionable wakes include captain-relevant status signals, no-verb signals whose crew is not provably working, authenticated check output such as PR merge polling or a Relay mention, stale panes whose crew is not provably working whether their status log looks terminal or non-terminal, provably-working stale panes that persist past `FM_STALE_ESCALATE_SECS` without their own task worktree being written, declared external waits and verified captain-held transfers that remain declared past `FM_PAUSE_RESURFACE_SECS`, and heartbeat backstop hits.
 Repeated provably-working stale escalations on the same unchanged pane add an escalation count to the wake reason and, at `FM_WEDGE_DEMAND_INSPECT_COUNT`, a `demand-deep-inspection` marker.
 A pane holding a file newer than the start of its own quiet window, anywhere in the worktree recorded for that task, is deferred instead of escalated, because a crew writing source, then tests, then documentation behind a static pane is liveness that neither pane quietness nor the run step can show.
 That deferral re-surfaces on the same `FM_PAUSE_RESURFACE_SECS` cadence as a declared wait, with a reason naming the write evidence rather than a wedge, and it is bounded to one pruned, depth-bounded, wall-clock-bounded walk (`FM_WORKTREE_WRITE_PRUNE`, `FM_WORKTREE_WRITE_MAXDEPTH`, `FM_WORKTREE_WRITE_TIMEOUT`) taken only in the branch that was about to escalate, never on every poll.
@@ -25,9 +25,9 @@ A concurrent replacement remains armed, every non-merged or invalid observation
 `bin/fm-pr-lib.sh` owns the receipt format and strict identity mechanics, while `bin/fm-watch.sh` owns queue-before-retirement ordering.
 No-verb wakes, such as `working:` notes and bare turn-ended signals, are benign only when `bin/fm-crew-state.sh` reports positive evidence that the crew is still working: an actively running no-mistakes step attributed to that crew's current code, or an exact busy verdict from the semantic busy-state contract.
 A `kind=secondmate` task's status signal is the parent-directed reply stream and is never absorbed as provably working; only its bare turn-ended signal retains the ordinary absorb rule.
-A crew that declares `paused:` for a known external wait is separately absorbed while idle and re-surfaced only on the longer pause cadence, rather than being treated as a possible wedge.
+A crew that declares `paused:` for a known external wait, or carries a verified `captain-held` transfer, is separately absorbed while idle and re-surfaced only on the longer pause cadence, rather than being treated as a possible wedge.
 For an ordinary crew that has stopped, the normal-mode watcher first surfaces one stale wake, then applies that same cadence to an unchanged `paused:` or durable `captain-held` endpoint only when the backend confidently reports its agent dead.
-Live or inconclusive liveness remains fail-open at that initial surface, and the secondmate idle-endpoint exemption is unchanged.
+Live or inconclusive liveness remains fail-open at that initial surface, and a secondmate's endpoint liveness is still never read at all; a mate is admitted to that same cadence only to serve a declared wait's bounded re-surface, so a forgotten pause or captain hold on a mate cannot rot invisibly.
 Its initial normal-mode status signal still surfaces through the no-verb path, while away mode self-handles that routine signal and owns the later recheck.
 Fresh stale panes use the same current-state read before trusting the status log, so an active run or a proven busy worker outranks an old captain-relevant status-log line left behind before validation.
 No-change heartbeats are also benign.
@@ -37,7 +37,7 @@ A secondmate retains a durable receipt for its idempotent report through the est
 Absorbed wakes advance their suppression markers, log to `state/.watch-triage.log`, and keep the watcher blocking without a queue record or LLM turn.
 Each `fm-wake-drain.sh` presentation runs the same liveness guard as the supervision scripts, so a lapsed watcher chain surfaces even on a turn that only handles queued wakes.
 Routine watcher polling, supervision no-ops, elapsed waiting time, and absorbed benign wakes stay silent.
-A declared external wait trades that silence for one bounded recheck per pause window, so a forgotten pause cannot remain invisible indefinitely.
+A declared external wait or verified captain-held transfer trades that silence for one bounded recheck per pause window, naming which human the wait is on, so neither a forgotten pause nor a forgotten hold can remain invisible indefinitely.
 Crew status files are append-only wake-event logs, not current-state fields.
 Because of that, a per-wake read of only the latest line can bury an earlier still-open `needs-decision`/`blocked` under later unrelated appends; `fm-wake-drain.sh` prints a separate, fleet-wide OPEN DECISIONS section on every presentation (including the empty-queue path session-start relies on), built through `fm-classify-lib.sh`'s cursor-backed incremental scan using the authoritative `status_open_decisions` fold semantics so the buried decision keeps surfacing until it is explicitly resolved while each presentation folds only new status-log appends.
 The drain coordinates that fold and its annotations through a locked fleet-wide snapshot whose `.status-presentation-cursor` manifest records each status file's identity and last-presented byte offset.
@@ -92,12 +92,12 @@ On every verified primary harness, tracked hook integration gives the primary se
 The guard covers the main primary and genuinely marked secondmate homes, exempts child crewmate/scout worktrees, is loop-safe per harness, and is documented in [turnend-guard.md](turnend-guard.md).
 
 A presence-gated sub-supervisor (`bin/fm-supervise-daemon.sh`) extends this for walk-away supervision: the `/afk` skill starts it through the tracked foreground helper `bin/fm-afk-start.sh`, after which the watcher reverts to daemon-managed one-shot mode and the daemon self-handles routine wakes in bash.
-The watcher and daemon share `bin/fm-classify-lib.sh` for captain-relevant status verbs, declared-external-wait vocabulary, and status-scan primitives.
+The watcher and daemon share `bin/fm-classify-lib.sh` for captain-relevant status verbs, declared-wait vocabulary (a `paused:` external wait and a verified `captain-held` transfer alike, through one combined predicate), and status-scan primitives.
 Terminal verbs remain captain-relevant, while a nonterminal progress verb cannot become terminal merely because its prose contains a legacy free-text token such as `merged`; bare legacy free-text lines remain compatible.
-The always-on watcher also uses that library's absorb classification on no-verb signals and first-sighting stale panes before status-log terminality is trusted, while the daemon maintains distinct wedge and declared-pause recheck cadences.
+The always-on watcher also uses that library's absorb classification on no-verb signals and first-sighting stale panes before status-log terminality is trusted, while the daemon maintains distinct wedge and declared-wait recheck cadences.
 In away mode, seen-status dedupe does not clear possible-wedge aging for nonterminal progress, so housekeeping still re-escalates an unchanged idle pane at the configured bound.
 Away-mode housekeeping has no worktree-write deferral of its own, so while `state/.afk` exists a quiet crew that is writing its own worktree still escalates as a possible wedge at that bound.
-The daemon escalates captain-relevant events, plus a bounded recheck for a declared pause that remains idle, as one batched, single-line digest using the canonical `away-supervisor` kind from `bin/fm-operational-input.sh` so firstmate can distinguish it structurally from real messages.
+The daemon escalates captain-relevant events, plus a bounded recheck for a declared pause or a verified captain-held transfer that remains idle, naming which human that wait is on, as one batched, single-line digest using the canonical `away-supervisor` kind from `bin/fm-operational-input.sh` so firstmate can distinguish it structurally from real messages.
 Its supervisor injection path supports tmux and herdr panes, with `FM_SUPERVISOR_BACKEND` and `FM_SUPERVISOR_TARGET` resolved independently from the task-spawn backend.
 Pane existence, busy checks, composer checks, capture, and verified submit route through `bin/fm-backend.sh`: tmux keeps the same submit core used by the tmux send backend, while herdr uses native agent-state submit confirmation on idle baselines, a composer empty fallback when native stays idle, and a pre-Enter rendered-footer transition when that baseline is unavailable.
 The retries-exhausted queued-Enter decision is owned by `fm_composer_queued_enter_verdict` in `bin/fm-composer-lib.sh`; tmux and herdr provide only their backend-specific busy signals.
diff --git a/docs/configuration.md b/docs/configuration.md
index 277e925e7c..5747a10a0a 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -589,7 +589,7 @@ FM_CAPTAIN_RE='done:|needs-decision:|blocked:|failed:|PR ready|checks green|read
 FM_CLASSIFY_PAUSED_VERB=paused     # leading status verb for a declared external wait; excluded from FM_CAPTAIN_RE and distinct from blocked
 FM_STALE_ESCALATE_SECS=240         # idle seconds before a provably-working stale pane escalates; stale panes whose crew is not provably working surface immediately unless they declare the pause verb
 FM_BUSY_TURN_MAX_SECS=3600         # maximum age of a busy pane's latest state/<id>.turn-ended marker, or its state/<id>.meta spawn record before any turn completes, before the same wedge escalation used for a provably-working non-busy stale takes over; inspection-only, never an automatic interrupt or restart; a declared external wait or verified captain-held transfer takes the FM_PAUSE_RESURFACE_SECS recheck below instead
-FM_PAUSE_RESURFACE_SECS=3600       # seconds before the watcher re-surfaces a declared external wait or verified captain-held transfer for a recheck, including a live busy pane past FM_BUSY_TURN_MAX_SECS; the away-mode daemon uses the same setting for declared external waits
+FM_PAUSE_RESURFACE_SECS=3600       # seconds before the watcher re-surfaces a declared external wait or verified captain-held transfer for a recheck, including a live busy pane past FM_BUSY_TURN_MAX_SECS; the away-mode daemon uses the same setting for a declared external wait or verified captain-held transfer
 FM_WEDGE_DEMAND_INSPECT_COUNT=3    # consecutive provably-working stale escalations on the same unchanged pane before demand-deep-inspection is added
 FM_WORKTREE_WRITE_PRUNE='.git node_modules .venv venv __pycache__ .mypy_cache .pytest_cache .ruff_cache .tox target dist build .next .cache vendor'   # directory names the wedge detector's task-worktree write probe skips; the default keeps .git out so a supervisor's own read-only git command can never look like crew progress; set it to the empty string to prune nothing, which widens the probe to the whole depth-bounded tree rather than disabling it
 FM_WORKTREE_WRITE_MAXDEPTH=6       # depth that same probe walks below the recorded worktree; it runs only at the moment a wedge escalation would otherwise fire, never on every poll; no probe knob applies to a secondmate, whose recorded worktree is a provisioned home the probe skips entirely
diff --git a/docs/herdr-backend.md b/docs/herdr-backend.md
index 22f9d967aa..029726f8be 100644
--- a/docs/herdr-backend.md
+++ b/docs/herdr-backend.md
@@ -275,7 +275,7 @@ Mid-session secondmate liveness is not implemented because idle secondmates are
 Protocol 16 can subscribe to `pane.agent_status_changed` over one bounded Unix-socket reader.
 `bin/fm-transition-lib.sh` owns the backend-neutral transition vocabulary and policy.
 The Herdr adapter subscribes before reconciling current levels, buffers edges during reconciliation, and returns fresh blocked transitions for this home's panes.
-The watcher maps the pane back to the task and skips secondmate endpoints and declared `paused:` waits.
+The watcher maps the pane back to the task and skips secondmate endpoints, declared `paused:` waits, and verified `captain-held` transfers, because a declared wait already names the human the fast escalation would report and is left to the watcher's own bounded pause cadence.
 
 The push path only shortens latency.
 Polling runs every cycle and remains the permanent fallback when protocol 16, the event schema, Python, connection, subscription, or repeated reader execution is unavailable.
diff --git a/tests/fm-daemon.test.sh b/tests/fm-daemon.test.sh
index ad0925be4d..f2b5201e4c 100755
--- a/tests/fm-daemon.test.sh
+++ b/tests/fm-daemon.test.sh
@@ -220,6 +220,21 @@ test_stale_paused_classifies_pause() {
   pass "paused reasons with captain phrases remain pause-classified"
 }
 
+# A verified captain-held transfer is the other declaration that leaves an idle pane
+# EXPECTED, so it earns the same pause action as paused: rather than being aged as a
+# wedge. The wait itself is already durable in the captain-held backlog task.
+test_stale_captain_held_classifies_pause() {
+  local dir state out held_reason
+  dir=$(make_supercase stale-captain-held)
+  state="$dir/state"
+  held_reason='captain-held [key=route]: tracked by task-decision-route'
+  status_is_captain_relevant "$held_reason" && fail "a captain-held transfer line was treated as captain-relevant"
+  printf '%s\n' "$held_reason" > "$state/held-w9h.status"
+  out=$(FM_STATE_OVERRIDE="$state" classify_stale "sess:fm-held-w9h" "$state")
+  case "$out" in pause\|*) ;; *) fail "captain-held transfer did not classify as pause: $out" ;; esac
+  pass "a captain-held transfer classifies as pause, not as a wedge candidate"
+}
+
 # handle_wake on a paused stale records a pause marker, drops any pre-existing wedge
 # marker (so a working->paused pane is not still wedge-aged), and does NOT escalate
 # on the wake itself - the recheck is housekeeping's job on the long cadence.
@@ -342,6 +357,7 @@ test_housekeeping_paused_resurfaces_and_resets() {
   PATH="$fakebin:$PATH" FM_FAKE_TMUX_WINDOW="$win" FM_FAKE_TMUX_CAPTURE="$pane" \
     FM_STATE_OVERRIDE="$state" FM_PAUSE_RESURFACE_SECS=240 housekeeping "$state"
   grep -F "awaiting external" "$state/.subsuper-escalations" >/dev/null 2>&1 || fail "declared pause was not re-surfaced as an awaiting-external recheck"
+  grep -F "awaiting the captain" "$state/.subsuper-escalations" >/dev/null 2>&1 && fail "declared pause named the captain instead of its external dependency"
   grep -F "possible wedge" "$state/.subsuper-escalations" >/dev/null 2>&1 && fail "declared pause was mislabeled a possible wedge"
   [ -e "$state/.subsuper-paused-$key" ] || fail "pause marker cleared instead of reset for the next window"
   age=$(( $(date +%s) - $(cat "$state/.subsuper-paused-$key" 2>/dev/null || echo 0) ))
@@ -349,6 +365,33 @@ test_housekeeping_paused_resurfaces_and_resets() {
   pass "housekeeping re-surfaces a stale declared pause on the long cadence and resets its window"
 }
 
+# The other half of quieting a captain-held task: it must NOT be silenced outright.
+# fm-classify-lib.sh's cadence comment is explicit that a forgotten hold cannot rot
+# invisibly, so a held task re-surfaces on the same bounded window as a pause, with
+# its marker reset so the window repeats instead of firing once. The digest the
+# captain reads must also name the captain rather than an external dependency: the
+# hold is waiting on the one person reading the digest, so borrowing the pause verb's
+# awaiting-external wording would point them away from being the blocker.
+test_housekeeping_captain_held_resurfaces_and_resets() {
+  local dir state fakebin win pane key age
+  dir=$(make_supercase captain-held-resurface)
+  state="$dir/state"; fakebin="$dir/fakebin"
+  win="sess:fm-held-w11h"; pane="$dir/pane.txt"
+  printf 'captain-held [key=route]: tracked by task-decision-route\n' > "$state/held-w11h.status"
+  printf 'idle prompt $\n' > "$pane"
+  key=$(printf '%s' "held-w11h" | tr ':/.' '___')
+  echo $(( $(date +%s) - 5000 )) > "$state/.subsuper-paused-$key"
+  PATH="$fakebin:$PATH" FM_FAKE_TMUX_WINDOW="$win" FM_FAKE_TMUX_CAPTURE="$pane" \
+    FM_STATE_OVERRIDE="$state" FM_PAUSE_RESURFACE_SECS=240 housekeeping "$state"
+  grep -F "awaiting the captain" "$state/.subsuper-escalations" >/dev/null 2>&1 || fail "a captain hold was silenced entirely instead of re-surfacing as a captain-owned recheck: $(cat "$state/.subsuper-escalations" 2>/dev/null || true)"
+  grep -F "awaiting external" "$state/.subsuper-escalations" >/dev/null 2>&1 && fail "a captain hold was re-surfaced as an external wait, hiding that the captain is the blocker"
+  grep -F "possible wedge" "$state/.subsuper-escalations" >/dev/null 2>&1 && fail "a captain hold was re-surfaced as a possible wedge"
+  [ -e "$state/.subsuper-paused-$key" ] || fail "captain-held marker cleared instead of reset for the next window"
+  age=$(( $(date +%s) - $(cat "$state/.subsuper-paused-$key" 2>/dev/null || echo 0) ))
+  [ "$age" -lt 60 ] || fail "captain-held marker was not reset to now on re-surface (age ${age}s)"
+  pass "housekeeping re-surfaces a forgotten captain hold on the long cadence and resets its window"
+}
+
 # A pause whose pane became busy again (the crew resumed) drops its marker without
 # escalating, exactly like a resumed wedge.
 test_housekeeping_paused_resumed_cleared() {
@@ -390,6 +433,25 @@ test_housekeeping_paused_unpaused_cleared() {
   pass "housekeeping clears a paused marker once the crew is no longer declaring the pause"
 }
 
+# Once the captain answers, the hold is no longer a declared wait: the resolved line
+# takes over the last-line read, so the pause cadence must stop claiming the task
+# rather than keep re-surfacing a settled decision.
+test_housekeeping_captain_held_resolved_cleared() {
+  local dir state fakebin win pane key
+  dir=$(make_supercase captain-held-resolved)
+  state="$dir/state"; fakebin="$dir/fakebin"
+  win="sess:fm-held-w13h"; pane="$dir/pane.txt"
+  printf 'captain-held [key=route]: tracked by task-decision-route\nresolved [key=route]: captain chose the direct path\n' > "$state/held-w13h.status"
+  printf 'idle prompt $\n' > "$pane"
+  key=$(printf '%s' "held-w13h" | tr ':/.' '___')
+  echo $(( $(date +%s) - 5000 )) > "$state/.subsuper-paused-$key"
+  PATH="$fakebin:$PATH" FM_FAKE_TMUX_WINDOW="$win" FM_FAKE_TMUX_CAPTURE="$pane" \
+    FM_STATE_OVERRIDE="$state" FM_PAUSE_RESURFACE_SECS=240 housekeeping "$state"
+  [ -e "$state/.subsuper-paused-$key" ] && fail "an answered captain hold kept its pause marker"
+  [ ! -s "$state/.subsuper-escalations" ] || fail "an answered captain hold was re-surfaced as a declared wait"
+  pass "housekeeping clears the pause marker once a captain hold is answered"
+}
+
 test_housekeeping_stale_marker_transitions_to_pause() {
   local dir state fakebin win pane key
   dir=$(make_supercase stale-to-paused)
@@ -406,6 +468,25 @@ test_housekeeping_stale_marker_transitions_to_pause() {
   pass "housekeeping moves an existing stale marker to pause before wedge escalation"
 }
 
+# The quieting half for a captain hold. A finished task marked captain-held is idle by
+# design, so an already-aged wedge marker converts to pause tracking on the next sweep
+# instead of firing the possible-wedge escalation.
+test_housekeeping_captain_held_stale_marker_transitions_to_pause() {
+  local dir state fakebin win pane key
+  dir=$(make_supercase stale-to-captain-held)
+  state="$dir/state"; fakebin="$dir/fakebin"; win="sess:fm-held-w14h"; pane="$dir/pane.txt"
+  printf 'captain-held [key=route]: tracked by task-decision-route\n' > "$state/held-w14h.status"
+  printf 'idle prompt $\n' > "$pane"
+  key=$(printf '%s' "held-w14h" | tr ':/.' '___')
+  echo $(( $(date +%s) - 5000 )) > "$state/.subsuper-stale-$key"
+  PATH="$fakebin:$PATH" FM_FAKE_TMUX_WINDOW="$win" FM_FAKE_TMUX_CAPTURE="$pane" \
+    FM_STATE_OVERRIDE="$state" FM_STALE_ESCALATE_SECS=240 housekeeping "$state"
+  [ -e "$state/.subsuper-paused-$key" ] || fail "a captain hold did not move its stale marker to pause tracking"
+  [ ! -e "$state/.subsuper-stale-$key" ] || fail "a captain hold remained wedge-aged"
+  [ ! -s "$state/.subsuper-escalations" ] || fail "a captain hold was escalated as a possible wedge"
+  pass "housekeeping moves a captain hold's existing stale marker to pause before wedge escalation"
+}
+
 test_housekeeping_pause_marker_transitions_to_clear() {
   local dir state fakebin win pane key
   dir=$(make_supercase paused-to-stale)
@@ -1853,6 +1934,7 @@ test_stale_transient_self_records_marker
 test_stale_diagnostic_wedge_survives_busy_housekeeping
 test_stale_terminal_escalates
 test_stale_paused_classifies_pause
+test_stale_captain_held_classifies_pause
 test_handle_wake_paused_records_pause_marker
 test_handle_wake_paused_signal_records_pause_marker
 test_handle_wake_terminal_signal_clears_pause_tracking
@@ -1862,9 +1944,12 @@ test_housekeeping_seeds_pause_marker_from_status
 test_housekeeping_persistent_stale_escalates
 test_housekeeping_resumed_stale_cleared
 test_housekeeping_paused_resurfaces_and_resets
+test_housekeeping_captain_held_resurfaces_and_resets
 test_housekeeping_paused_resumed_cleared
 test_housekeeping_paused_unpaused_cleared
+test_housekeeping_captain_held_resolved_cleared
 test_housekeeping_stale_marker_transitions_to_pause
+test_housekeeping_captain_held_stale_marker_transitions_to_pause
 test_housekeeping_pause_marker_transitions_to_clear
 test_housekeeping_herdr_persistent_stale_resolves_meta
 test_housekeeping_herdr_idle_busy_record_clears_stale
diff --git a/tests/fm-supervision-events.test.sh b/tests/fm-supervision-events.test.sh
index ca6c683907..57bd63d4b9 100755
--- a/tests/fm-supervision-events.test.sh
+++ b/tests/fm-supervision-events.test.sh
@@ -82,6 +82,19 @@ fi
 grep -q 'absorbed push' "$STATE_DIR/.watch-triage.log" 2>/dev/null || fail "the paused absorb should be logged to the triage log"
 pass "handle_push_transition: a declared-pause crew is absorbed (no fast wake), left to the poll loop's long cadence"
 
+# --- handle_push_transition: absorb for a verified captain-held transfer -------
+
+reset_state
+fm_write_meta "$STATE_DIR/tk2h.meta" "window=default:wG:pQ" "backend=herdr" "kind=ship"
+printf 'captain-held [key=route]: tracked by task-decision-route\n' > "$STATE_DIR/tk2h.status"
+handle_push_transition herdr default "$(mkrec wG:pQ blocked)"
+if [ -e "$STATE_DIR/.wake-queue" ] && grep -q 'stale' "$STATE_DIR/.wake-queue"; then
+  fail "a captain-held crew must NOT be fast-escalated: $(cat "$STATE_DIR/.wake-queue")"
+fi
+[ ! -s "$WAKE_LOG" ] || fail "a captain-held crew must not wake the supervisor from the event fast-path"
+grep -q 'absorbed push' "$STATE_DIR/.watch-triage.log" 2>/dev/null || fail "the captain-held absorb should be logged to the triage log"
+pass "handle_push_transition: a captain-held crew is absorbed (no fast wake), left to the poll loop's long cadence"
+
 # --- event_wait_or_sleep: secondmate windows are excluded from the pane list --
 
 reset_state
diff --git a/tests/fm-watch-triage.test.sh b/tests/fm-watch-triage.test.sh
index 569d8a50b4..149cf30952 100755
--- a/tests/fm-watch-triage.test.sh
+++ b/tests/fm-watch-triage.test.sh
@@ -337,7 +337,17 @@ test_status_is_paused_classifier() {
     || fail "captain-held transfer not recognized by the bounded-idle classifier"
   status_is_paused_or_captain_held 'resolved [key=route]: captain answered' \
     && fail "resolved decision remained classed as captain-held"
-  pass "status_is_paused: only the leading paused verb matches, and paused is not captain-relevant"
+  # The two declarations share one cadence but block on different humans, so the
+  # combined predicate cannot be the only discriminator: a recheck has to know which
+  # verb it is naming.
+  status_is_captain_held 'captain-held [key=route]: tracked by task-decision-route' \
+    || fail "captain-held verb not recognized"
+  status_is_captain_held 'paused: holding for the upstream release' \
+    && fail "a declared pause matched the captain-held verb"
+  status_is_captain_held 'working: the captain-held backlog item is next' \
+    && fail "a working line mentioning captain-held false-matched"
+  status_is_captain_held '' && fail "empty line classified as captain-held"
+  pass "status_is_paused: only the leading paused verb matches, paused is not captain-relevant, and the two declared-wait verbs stay separable"
 }
 
 # crew_absorb_class: the single fm-crew-state.sh read that returns BOTH absorb
@@ -1051,8 +1061,10 @@ test_exited_declared_pause_is_bounded_but_live_gate_surfaces() {
     FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
   pid=$!
   wait_for_exit "$pid" 100 || fail "captain-held dead-agent pane did not re-surface on the bounded cadence"
+  grep -F "awaiting the captain" "$state/.wake-queue" >/dev/null \
+    || fail "captain-held dead-agent pane surfaced as a stopped crew instead of a captain-owned recheck: $(cat "$state/.wake-queue")"
   grep -F "awaiting external" "$state/.wake-queue" >/dev/null \
-    || fail "captain-held dead-agent pane surfaced as a stopped crew"
+    && fail "captain-held dead-agent pane borrowed the pause verb's external-wait wording"
 
   dir=$(make_case alive-decision-gate); state="$dir/state"; fakebin="$dir/fakebin"
   out="$dir/watch.out"; capture_file="$dir/pane.txt"; statusf="$state/gate.status"
@@ -1124,11 +1136,46 @@ test_secondmate_paused_resurfaces_in_normal_mode() {
   wait_for_exit "$pid" 100 || fail "watcher did not re-surface a paused secondmate"
   grep -F "stale: $window" "$out" >/dev/null || fail "paused secondmate did not emit a stale recheck"
   grep -F "awaiting external" "$out" >/dev/null || fail "paused secondmate recheck omitted its external-wait reason"
+  grep -F "awaiting the captain" "$out" >/dev/null && fail "paused secondmate recheck named the captain instead of its external dependency"
   grep -F "possible wedge" "$out" >/dev/null && fail "paused secondmate was mislabeled a wedge"
   unset FM_FAKE_CREW_STATE
   pass "a declared paused secondmate re-surfaces on the bounded normal-mode cadence"
 }
 
+# A captain hold is the other declared wait, but unlike paused: it has no
+# current-state mapping, so a held mate reports `unknown` rather than `paused`.
+# The bounded re-surface must still reach it, or a mate's hold rots invisibly:
+# nothing else re-reads a quiet mate's endpoint.
+test_secondmate_captain_held_resurfaces_in_normal_mode() {
+  local dir state fakebin out capture_file statusf window key pane_hash sig pid back
+  dir=$(make_case secondmate-held-resurface); state="$dir/state"; fakebin="$dir/fakebin"
+  out="$dir/watch.out"; capture_file="$dir/pane.txt"; statusf="$state/secondmate-hold.status"
+  window="test:fm-secondmate-hold"
+  printf 'idle awaiting the captain\n' > "$capture_file"
+  printf 'window=%s\nkind=secondmate\n' "$window" > "$state/secondmate-hold.meta"
+  printf 'captain-held [key=route]: tracked by task-decision-route\n' > "$statusf"
+  back=$(( $(date +%s) - 500 ))
+  if [ "$(uname)" = Darwin ]; then touch -mt "$(date -r "$back" '+%Y%m%d%H%M.%S')" "$statusf"
+  else touch -m -d "@$back" "$statusf"; fi
+  sig=$(seen_sig "$statusf"); printf '%s' "$sig" > "$state/.seen-secondmate-hold_status"
+  key=$(printf '%s' "$window" | tr '.:/' '___')
+  pane_hash=$(hash_text "idle awaiting the captain")
+  printf '%s' "$pane_hash" > "$state/.hash-$key"
+  printf '1\n' > "$state/.count-$key"
+  export FM_FAKE_CREW_STATE='state: unknown · source: none · no current-state source available'
+  PATH="$fakebin:$PATH" FM_FAKE_TMUX_WINDOW="$window" FM_FAKE_TMUX_CAPTURE="$capture_file" \
+    FM_STATE_OVERRIDE="$state" FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_PAUSE_RESURFACE_SECS=240 FM_POLL=1 FM_SIGNAL_GRACE=1 \
+    FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
+  pid=$!
+  wait_for_exit "$pid" 100 || fail "watcher did not re-surface a captain-held secondmate"
+  grep -F "stale: $window" "$out" >/dev/null || fail "captain-held secondmate did not emit a stale recheck"
+  grep -F "awaiting the captain" "$out" >/dev/null || fail "captain-held secondmate recheck did not name the captain as the blocker: $(cat "$out")"
+  grep -F "awaiting external" "$out" >/dev/null && fail "captain-held secondmate recheck claimed an external wait"
+  grep -F "possible wedge" "$out" >/dev/null && fail "captain-held secondmate was mislabeled a wedge"
+  unset FM_FAKE_CREW_STATE
+  pass "a captain-held secondmate re-surfaces on the bounded normal-mode cadence"
+}
+
 test_secondmate_nonpaused_stale_remains_suppressed() {
   local dir state fakebin out capture_file statusf window key pane_hash sig pid
   dir=$(make_case secondmate-stale-suppressed); state="$dir/state"; fakebin="$dir/fakebin"
@@ -2590,6 +2637,7 @@ test_nonterminal_stale_not_working_surfaced
 test_nonterminal_stale_paused_absorbed_then_resurfaced
 test_exited_declared_pause_is_bounded_but_live_gate_surfaces
 test_secondmate_paused_resurfaces_in_normal_mode
+test_secondmate_captain_held_resurfaces_in_normal_mode
 test_secondmate_nonpaused_stale_remains_suppressed
 test_secondmate_unpause_clears_pause_tracking
 test_nonterminal_stale_pause_transitions_reclassify_unchanged_hash

From 738460d401b1115dab617c3859077973977615cb Mon Sep 17 00:00:00 2001
From: Kun Chen <3233006+kunchenguid@users.noreply.github.com>
Date: Fri, 21 Aug 2026 13:28:55 -0700
Subject: [PATCH 08/11] fix(bin): make lint prerequisites and harness tests
 reliable (#2758)

* fix(lint): name the installer when ShellCheck or actionlint is missing

A missing actionlint exited 127 like a bare command-not-found. Fail with
exit 1 and point at the pinned installer, matching the missing-ShellCheck
path, without weakening the version pin.

* test: isolate kimi and muse detection from inherited Cursor markers

Harness detection checks CURSOR_AGENT before ancestry, so these
markerless-adapter cases failed when the suite itself ran under Cursor.
Clear the verified markers the same way the secondmate harness tests already do.

* no-mistakes(document): Document Muse Cursor marker cleanup
---
 bin/fm-lint-workflows.sh        |  6 +++---
 bin/fm-lint.sh                  |  6 +++---
 docs/verification/muse.md       |  2 +-
 tests/fm-kimi-harness.test.sh   | 12 ++++++++++--
 tests/fm-lint-workflows.test.sh |  4 +++-
 tests/fm-lint.test.sh           | 20 ++++++++++++++++++++
 tests/fm-muse-harness.test.sh   | 21 ++++++++++++++++-----
 7 files changed, 56 insertions(+), 15 deletions(-)

diff --git a/bin/fm-lint-workflows.sh b/bin/fm-lint-workflows.sh
index 0e2d7b07e1..41883d1001 100755
--- a/bin/fm-lint-workflows.sh
+++ b/bin/fm-lint-workflows.sh
@@ -108,15 +108,15 @@ else
 fi
 
 if ! command -v actionlint >/dev/null 2>&1; then
-  printf 'fm-lint-workflows.sh: actionlint not found; install actionlint %s for CI parity.\n' \
+  printf 'fm-lint-workflows.sh: actionlint not found; install actionlint %s with bin/fm-install-actionlint.sh <destination-directory> and put that directory on PATH.\n' \
     "$REQUIRED_ACTIONLINT" >&2
-  exit 127
+  exit 1
 fi
 ACTIONLINT_BIN=$(command -v actionlint)
 resolved=$("$ACTIONLINT_BIN" -version | awk 'NR==1 {print; exit}')
 printf 'fm-lint-workflows.sh: actionlint %s (pinned %s)\n' "$resolved" "$REQUIRED_ACTIONLINT" >&2
 if [ "$resolved" != "$REQUIRED_ACTIONLINT" ]; then
-  printf 'fm-lint-workflows.sh: actionlint %s required for CI parity, found %s. Install %s.\n' \
+  printf 'fm-lint-workflows.sh: actionlint %s required for CI parity, found %s. Install %s with bin/fm-install-actionlint.sh <destination-directory>.\n' \
     "$REQUIRED_ACTIONLINT" "$resolved" "$REQUIRED_ACTIONLINT" >&2
   exit 1
 fi
diff --git a/bin/fm-lint.sh b/bin/fm-lint.sh
index d848a2ac83..53a3f0cff8 100755
--- a/bin/fm-lint.sh
+++ b/bin/fm-lint.sh
@@ -230,9 +230,9 @@ if [ "$LIST_FILES" -eq 1 ]; then
 fi
 
 if ! command -v shellcheck >/dev/null 2>&1; then
-  printf 'fm-lint.sh: ShellCheck not found; install ShellCheck %s for CI parity.\n' \
+  printf 'fm-lint.sh: ShellCheck not found; install ShellCheck %s with bin/fm-install-shellcheck.sh <destination-directory> and put that directory on PATH.\n' \
     "$REQUIRED_SHELLCHECK" >&2
-  exit 127
+  exit 1
 fi
 unset SHELLCHECK_OPTS
 SHELLCHECK_BIN=$(command -v shellcheck)
@@ -243,7 +243,7 @@ fi
 resolved=$("$SHELLCHECK_BIN" --version | awk '/^version:/ {print $2; exit}')
 printf 'fm-lint.sh: ShellCheck %s (pinned %s)\n' "$resolved" "$REQUIRED_SHELLCHECK" >&2
 if [ "$resolved" != "$REQUIRED_SHELLCHECK" ]; then
-  printf 'fm-lint.sh: ShellCheck %s required for CI parity, found %s. Install %s.\n' \
+  printf 'fm-lint.sh: ShellCheck %s required for CI parity, found %s. Install %s with bin/fm-install-shellcheck.sh <destination-directory>.\n' \
     "$REQUIRED_SHELLCHECK" "$resolved" "$REQUIRED_SHELLCHECK" >&2
   exit 1
 fi
diff --git a/docs/verification/muse.md b/docs/verification/muse.md
index bc7ffe64ba..11d7e3454b 100644
--- a/docs/verification/muse.md
+++ b/docs/verification/muse.md
@@ -48,7 +48,7 @@ $ grep -nE 'muse-bin|exec ' launcher.sh
 
 `ps -o comm= -p <pid>` returns the full executable path, whose basename is `muse-bin-<version>`.
 That is why both `bin/fm-harness.sh` and `bin/backends/tmux.sh` match the anchored prefix `muse-bin-*` rather than an exact name, and why neither can rely on an install-path component: `~/.local/bin/muse-bin-<version>` contains no `muse` path component.
-The Muse launch clears `CLAUDECODE`, `PI_CODING_AGENT`, `GROK_AGENT`, and `FM_PI_HARNESS` before the worker starts so foreign primary markers cannot override the versioned ancestry.
+The Muse launch clears `CLAUDECODE`, `PI_CODING_AGENT`, `GROK_AGENT`, `FM_PI_HARNESS`, `CURSOR_AGENT`, and `CURSOR_INVOKED_AS` before the worker starts so foreign primary markers cannot override the versioned ancestry.
 
 [`runtime-backends.md`](runtime-backends.md#agent-liveness-name-sources) owns the resulting tmux liveness verdict and its relationship to the portable decoy regression.
 
diff --git a/tests/fm-kimi-harness.test.sh b/tests/fm-kimi-harness.test.sh
index 869bfc93a1..768ee79991 100755
--- a/tests/fm-kimi-harness.test.sh
+++ b/tests/fm-kimi-harness.test.sh
@@ -5,6 +5,12 @@ set -u
 # shellcheck source=tests/lib.sh
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
+# bin/fm-harness.sh checks verified ENV markers before ancestry. A suite run
+# from inside Cursor, Claude, Pi, or Grok inherits those markers, which outrank
+# the fake ancestry the detection cases set up. Drop the ambient markers so the
+# asserted verdict does not depend on which harness launched the suite.
+unset CLAUDECODE PI_CODING_AGENT FM_PI_HARNESS GROK_AGENT CURSOR_AGENT CURSOR_INVOKED_AS
+
 SPAWN="$ROOT/bin/fm-spawn.sh"
 TEARDOWN="$ROOT/bin/fm-teardown.sh"
 KIMI_HOOK="$ROOT/bin/fm-kimi-turnend-hook.sh"
@@ -530,10 +536,12 @@ esac
 SH
   chmod +x "$fakebin/ps"
 
-  out=$(env -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+  out=$(env -u CLAUDECODE -u PI_CODING_AGENT -u FM_PI_HARNESS -u GROK_AGENT \
+    -u CURSOR_AGENT -u CURSOR_INVOKED_AS \
     PATH="$fakebin:$BASE_PATH" FM_CONFIG_OVERRIDE="$cfg" "$ROOT/bin/fm-harness.sh")
   [ "$out" = kimi ] || fail "kimi ancestry detection returned '$out'"
-  out=$(CLAUDECODE=1 PATH="$fakebin:$BASE_PATH" FM_CONFIG_OVERRIDE="$cfg" "$ROOT/bin/fm-harness.sh")
+  out=$(env -u CURSOR_AGENT -u CURSOR_INVOKED_AS \
+    CLAUDECODE=1 PATH="$fakebin:$BASE_PATH" FM_CONFIG_OVERRIDE="$cfg" "$ROOT/bin/fm-harness.sh")
   [ "$out" = claude ] || fail "verified env-marker precedence changed, got '$out'"
   pass "fm-harness: markerless kimi is detected by ancestry after env-marker precedence"
 }
diff --git a/tests/fm-lint-workflows.test.sh b/tests/fm-lint-workflows.test.sh
index ef611fbaa8..18bce37317 100755
--- a/tests/fm-lint-workflows.test.sh
+++ b/tests/fm-lint-workflows.test.sh
@@ -253,11 +253,13 @@ test_missing_actionlint_fails_closed() {
   done
   rc=0
   out=$(PATH="$fakebin" "$LINT_WF" --root "$tmp" 2>&1) || rc=$?
-  [ "$rc" -eq 127 ] || fail "missing actionlint expected exit 127, got $rc"$'\n'"$out"
+  [ "$rc" -eq 1 ] || fail "missing actionlint expected exit 1, got $rc"$'\n'"$out"
   assert_contains "$out" "actionlint not found" \
     "missing actionlint did not name the required linter"
   assert_contains "$out" "$REQUIRED" \
     "missing actionlint did not name the pinned version"
+  assert_contains "$out" "fm-install-actionlint.sh" \
+    "missing actionlint did not name the pinned installer"
   pass "missing actionlint fails closed"
 }
 
diff --git a/tests/fm-lint.test.sh b/tests/fm-lint.test.sh
index e7fd94fc95..33af053eb3 100755
--- a/tests/fm-lint.test.sh
+++ b/tests/fm-lint.test.sh
@@ -534,6 +534,25 @@ test_installer_rejects_unsupported_platform() {
   pass "ShellCheck installer rejects an unsupported OS or architecture"
 }
 
+test_missing_shellcheck_fails_closed() {
+  local tmp fakebin out rc tool
+  tmp=$(fm_test_tmproot fm-lint-noshellcheck)
+  fakebin=$(fm_fakebin "$tmp")
+  for tool in bash dirname; do
+    ln -s "$(command -v "$tool")" "$fakebin/$tool"
+  done
+  rc=0
+  out=$(PATH="$fakebin" CI=true GITHUB_ACTIONS=true "$LINT" 2>&1) || rc=$?
+  [ "$rc" -eq 1 ] || fail "missing ShellCheck expected exit 1, got $rc"$'\n'"$out"
+  assert_contains "$out" "ShellCheck not found" \
+    "missing ShellCheck did not name the required linter"
+  assert_contains "$out" "$REQUIRED" \
+    "missing ShellCheck did not name the pinned version"
+  assert_contains "$out" "fm-install-shellcheck.sh" \
+    "missing ShellCheck did not name the pinned installer"
+  pass "missing ShellCheck fails closed"
+}
+
 test_rejects_wrong_shellcheck_version() {
   # Version-independent: a fake shellcheck reporting a different version must be
   # refused before any lint, proving local and CI cannot silently diverge.
@@ -866,6 +885,7 @@ test_installer_rejects_wrong_checksum
 test_installer_falls_back_to_shasum
 test_installer_prefers_sha256sum_over_shasum
 test_installer_rejects_unsupported_platform
+test_missing_shellcheck_fails_closed
 test_rejects_wrong_shellcheck_version
 test_catches_a_real_lint_defect
 test_ignores_ambient_shellcheck_opts
diff --git a/tests/fm-muse-harness.test.sh b/tests/fm-muse-harness.test.sh
index ac077c9d8d..83a0747458 100755
--- a/tests/fm-muse-harness.test.sh
+++ b/tests/fm-muse-harness.test.sh
@@ -13,6 +13,13 @@ set -u
 # shellcheck source=tests/lib.sh
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
+# bin/fm-harness.sh checks verified ENV markers before ancestry. Muse is
+# markerless, so an inherited Cursor/Claude/Pi/Grok marker would outrank the
+# versioned muse-bin ancestor these detection cases launch. Drop the ambient
+# markers so the asserted verdict does not depend on which harness launched
+# the suite.
+unset CLAUDECODE PI_CODING_AGENT FM_PI_HARNESS GROK_AGENT CURSOR_AGENT CURSOR_INVOKED_AS
+
 SPAWN="$ROOT/bin/fm-spawn.sh"
 TEARDOWN="$ROOT/bin/fm-teardown.sh"
 HARNESS="$ROOT/bin/fm-harness.sh"
@@ -154,9 +161,10 @@ run_muse_spawn() {  # <home> <proj> <wt> <fakebin> <id> [extra args...]
 # string, so each case launches an actual renamed executable and asks
 # fm-harness.sh from a child of it.
 #
-# The foreign env markers are cleared because muse is markerless and the marker
-# layer deliberately outranks ancestry: with one retained, these cases would
-# assert the marker's verdict instead of the ancestry match they exist to pin.
+# The foreign env markers, including Cursor's, are cleared because muse is
+# markerless and the marker layer deliberately outranks ancestry: with one
+# retained, these cases would assert the marker's verdict instead of the
+# ancestry match they exist to pin.
 # The command substitution around the probe is load-bearing: a bare `-c <cmd>`
 # lets the shell exec the probe in place, which REPLACES the muse-bin-* process
 # name the walk is supposed to find. Real muse keeps its TUI process alive and
@@ -167,7 +175,8 @@ test_detects_versioned_process_ancestor() {
   mkdir -p "$dir"
   for bin in muse-bin-0.1.0-R708.1 muse-bin-9.9.9-RZZZ.9 muse; do
     cp "$(command -v bash)" "$dir/$bin"
-    out=$(env -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+    out=$(env -u CLAUDECODE -u PI_CODING_AGENT -u FM_PI_HARNESS -u GROK_AGENT \
+      -u CURSOR_AGENT -u CURSOR_INVOKED_AS \
       "$dir/$bin" -c "r=\$(\"$HARNESS\"); printf '%s' \"\$r\"")
     [ "$out" = muse ] || fail "fm-harness.sh under process '$bin' reported '$out', expected muse"
   done
@@ -182,7 +191,8 @@ test_detection_is_anchored() {
   mkdir -p "$dir"
   for bin in musescore amuse notmuse-bin muse-binary muse-bind; do
     cp "$(command -v bash)" "$dir/$bin"
-    out=$(env -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+    out=$(env -u CLAUDECODE -u PI_CODING_AGENT -u FM_PI_HARNESS -u GROK_AGENT \
+      -u CURSOR_AGENT -u CURSOR_INVOKED_AS \
       "$dir/$bin" -c "r=\$(\"$HARNESS\"); printf '%s' \"\$r\"")
     [ "$out" != muse ] || fail "fm-harness.sh misdetected unrelated process '$bin' as muse"
   done
@@ -197,6 +207,7 @@ $rec
 EOF
   result="$case_dir/harness-result"
   out=$(CLAUDECODE=1 PI_CODING_AGENT=true GROK_AGENT=1 FM_PI_HARNESS=pi-signed \
+    CURSOR_AGENT=1 CURSOR_INVOKED_AS=cursor-agent \
     FM_FAKE_EXECUTE_MUSE_LAUNCH=1 FM_FAKE_HARNESS_RESULT="$result" \
     run_muse_spawn "$home" "$proj" "$wt" "$fakebin" "$id" --mode no-mistakes --yolo off)
   status=$?

From 59e73937015c41863f6b1a4d5b03a2238e2cc3f8 Mon Sep 17 00:00:00 2001
From: Inthuson <inthuson@amazon.com>
Date: Fri, 21 Aug 2026 23:55:35 +0100
Subject: [PATCH 09/11] feat(bin): report watched tooling updates that are
 available or installed but inert (#2684)

* feat(checks): report tool updates that are available or installed but inert

Firstmate had no way to notice that tooling this home depends on needs an
update, and no way at all to notice the worse case: an update that installed
correctly and then did nothing.

That second case is why this exists. A tool that self-installs into
~/.local/bin while a version manager keeps its own older copy earlier on PATH
looks completely up to date to anything that asks only "is a newer version
published". On 2026-08-20 a Herdr update landed at 0.8.2 while an older 0.8.0
copy stayed earlier on PATH, so every Herdr command failed on a protocol
mismatch and firstmate could not read its own fleet.

bin/fm-tool-update-check.sh reports the two conditions separately:

  <tool> update available      a newer version exists at the update source.
  <tool> update not in effect  a newer copy is installed on this host, but
                               PATH still resolves an older one.

PATH skew is measured, never inferred. Every executable copy of a watched
command on PATH is asked for its own version and those answers are compared,
so one lookup cannot hide the skew, and a directory name is never read as a
version because a version manager's "latest" directory can hold an older
build. A copy that will not report a version is a check failure, not a pass.

The watched tools live in local, gitignored config/watched-tools.json, so
adding a tool is a config edit rather than a code change, and the file is
never propagated to another home. Update sources cover both shapes: a local
clone's commit distance from its remote branch, and a command's own version
and update announcement, including a tool like no-mistakes that prints its
version on one command and announces a new release on another.

The check prints one line when something needs attention and prints nothing
otherwise, so it rides the existing watcher state-check contract with its
trust binding instead of introducing a schedule of its own, and
state/.tool-updates keeps the same pending update from being reported on
every poll.

The check only reports. It never installs, updates, reorders PATH, touches a
version manager, or fetches into a watched repository; every git probe is
read-only.

Tests cover the skew case as a regression, and it was verified by mutation:
removing the skew report, or stopping after the first PATH hit as a single
lookup would, each make that test fail.

* no-mistakes(review): fix tool update check probe reporting, budget, and shim write

* no-mistakes(review): keep sweeps alive on broken patterns and oversized budgets

* no-mistakes(review): roll back failed arm, widen budget clamp, bound repo probe

* no-mistakes(review): guard git probes at the budget, record uncut findings

* no-mistakes(document): fix stale watched-tool report-record wording in docs and header

* no-mistakes: apply CI fixes

* no-mistakes: apply CI fixes

* no-mistakes: apply CI fixes

* no-mistakes: apply CI fixes

* no-mistakes: apply CI fixes

The behavior shard's watch-triage suite failed on the new worktree-write wedge
tests. Those five tests are the only ones in the file that do not use its
standard waits. They give a fixed 3 second liveness budget to the one poll that
now spawns the bounded worktree walk, and 4 seconds to an escalating watcher
where every other test in the file gives 10. On a loaded runner that poll
outlives the fixed budget, so the round is reaped before the deferral it asserts
on is recorded, and the test reports a lost deferral instead of the deferral
under test. Wait for a completed poll cycle through the file's own
wait_poll_cycle, which is what its header documents this hazard for, and use the
file's standard 100 tick exit budget.

Verified against a load that reproduces the failure: 11 of 12 runs failed
before, 8 of 8 pass after. Verified by mutation too, so the waits still prove
the behavior: removing the write deferral, and keeping a finished deferral chain
across an idle-timer repair, each still fail their test.
---
 .github/workflows/ci.yml            |    6 +-
 AGENTS.md                           |    2 +
 bin/fm-remote-job-worker.sh         |   11 +-
 bin/fm-test-run.sh                  |  184 +++--
 bin/fm-tool-update-check.sh         |  898 +++++++++++++++++++++++
 docs/configuration.md               |   64 ++
 docs/documentation-audiences.json   |    4 +
 docs/examples/watched-tools.json    |   24 +
 docs/fm-test-portable-shards.md     |   17 +-
 docs/scripts.md                     |    1 +
 tests/fm-pi-watch-extension.test.sh |   43 +-
 tests/fm-remote-job.test.sh         |   54 ++
 tests/fm-tool-update-check.test.sh  | 1039 +++++++++++++++++++++++++++
 tests/fm-watch-triage.test.sh       |   19 +-
 14 files changed, 2270 insertions(+), 96 deletions(-)
 create mode 100755 bin/fm-tool-update-check.sh
 create mode 100644 docs/examples/watched-tools.json
 create mode 100755 tests/fm-tool-update-check.test.sh

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ae4f6c0ae5..51480a5dcd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -129,10 +129,10 @@ jobs:
   tests-portable-serial:
     name: Behavior portable serial ${{ matrix.shard }}
     runs-on: ubuntu-latest
-    # Measured whole remainder is ~19 min of serial work; the balanced shards
-    # are ~4.8 min each. Cap is a hang tripwire with roughly 3x margin, not the
+    # Measured whole remainder is ~42 min of serial work; the balanced shards
+    # are ~10.6 min each. Cap is a hang tripwire with roughly 2x margin, not the
     # expected healthy end of the lane.
-    timeout-minutes: 15
+    timeout-minutes: 20
     strategy:
       # Every shard reports so one failure never hides another shard's result.
       fail-fast: false
diff --git a/AGENTS.md b/AGENTS.md
index 25f65632d9..83aa105a4f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -75,6 +75,7 @@ config/herdr-presentation-spaces  optional "off" opt-out from, or "on" opt-in to
 config/trace-context  optional presence flag enabling default-off native W3C trace-context propagation to spawned agents; LOCAL, gitignored; inherited by secondmate homes; see docs/configuration.md "Trace context propagation" and docs/trace-context.md
 config/cmux-socket-password  optional cmux control-socket password; LOCAL, gitignored; read fresh on every cmux CLI call and passed through without ever overriding an operator's own ambient CMUX_SOCKET_PASSWORD when absent (docs/cmux-backend.md "Setup")
 config/wedge-alarm  optional away-mode wedge-alarm active-alert directives; LOCAL, gitignored; absent means auto (macOS Notification Center when available); see docs/wedge-alarm.md
+config/watched-tools.json  optional list of the tools this home depends on, read by the update check armed with bin/fm-tool-update-check.sh; LOCAL, gitignored, firstmate-maintained but human-editable, and NOT inherited by secondmate homes; see docs/configuration.md "Watched tool updates"
 config/x-mode.env    generated Relay watcher cadence; LOCAL, gitignored; source before arming watcher when present
 data/                personal fleet records; LOCAL, gitignored as a whole
   backlog.md         task queue, dependencies, history
@@ -104,6 +105,7 @@ state/               runtime records and signals; gitignored
   .pr-check-migration.log  private per-task outcomes distinguishing rebuilt or canonically registered replacement polls, quarantined unarmed polls, and incomplete migrations
   .pr-check-migration-scan-v1  private marker proving the non-executing scan disabled every unsafe legacy check; .pr-check-migration-v1 separately records completed private repairs
   x-watch.check.sh   generated Relay poll shim; present only when opted in (section 14)
+  tool-updates.check.sh  generated watched-tool update poll shim and its .check-trust binding; present only after bin/fm-tool-update-check.sh arm; its report record .tool-updates is what keeps one pending update from being reported on every poll
   pending-replies/   parent-owned secondmate pending-reply records (correlation id, delivery vs reply, recovery, escalation); fm-pending-reply-lib.sh
   procevent/         registered process-to-event sources, one private record per canonical source id; written only by bin/fm-procevent.sh, and their presence alone keeps supervision required (section 13)
   procevent-inbox/   private captured results and their durable handled-acknowledgement markers; source output lives here and never in an event line
diff --git a/bin/fm-remote-job-worker.sh b/bin/fm-remote-job-worker.sh
index 2a49dd6694..edd123c859 100755
--- a/bin/fm-remote-job-worker.sh
+++ b/bin/fm-remote-job-worker.sh
@@ -291,8 +291,17 @@ worker_stop_active_execution() {
   WORKER_ACTIVE_JOB=
 }
 
+# Ignore, rather than restore the default disposition for, the signals this
+# handler answers. A replacement stops a Linux worker by signalling its whole
+# isolated group, and the supervisor in that group forwards a second stop signal
+# to this same serving child, so a repeat is the normal case and not an
+# exception. Restoring the default let that second signal kill the shutdown part
+# way through, which left the ownership lock behind holding a half-written temp
+# file that no later worker could clear, so every replacement then failed to
+# report ready. A shutdown that hangs is still stopped: the caller escalates to
+# KILL, which no disposition can block.
 worker_shutdown() {
-  trap - HUP INT TERM
+  trap '' HUP INT TERM
   worker_publish_quarantine || {
     worker_error "cannot guard worker ownership for shutdown"
     trap worker_shutdown HUP INT TERM
diff --git a/bin/fm-test-run.sh b/bin/fm-test-run.sh
index f6b6749ef8..3a9e1d7ae9 100755
--- a/bin/fm-test-run.sh
+++ b/bin/fm-test-run.sh
@@ -155,6 +155,7 @@ family_for_basename() {
     fm-session-lock-ancestry.test.sh|fm-cursor-primary.test.sh|\
     fm-supervision-events.test.sh|fm-turnend-guard.test.sh|fm-wake-daemon-lifecycle-e2e.test.sh|\
     fm-wake-drain-unread-status.test.sh|\
+    fm-tool-update-check.test.sh|\
     fm-wake-queue.test.sh|fm-watch-arm.test.sh|fm-watch-checkpoint.test.sh|fm-watch-recovery-loop.test.sh|\
     fm-watch-triage.test.sh|\
     fm-watcher-lock.test.sh|fm-inactive-reconcile.test.sh)
@@ -380,78 +381,123 @@ list_portable_serial() {
 # procedure.
 portable_serial_weight_hints() {
   cat <<'EOF'
-tests/fm-afk-inject-e2e.test.sh 34019
-tests/fm-afk-pi-herdr-return-e2e.test.sh 42
-tests/fm-afk-return.test.sh 1105
-tests/fm-ask-user-authority.test.sh 68
-tests/fm-backend-cmux-smoke.test.sh 29
-tests/fm-backend-cmux.test.sh 2349
+tests/fm-afk-inject-e2e.test.sh 35900
+tests/fm-afk-pi-herdr-return-e2e.test.sh 66
+tests/fm-afk-return.test.sh 3974
+tests/fm-ask-user-authority.test.sh 83
+tests/fm-backend-cmux-smoke.test.sh 30
+tests/fm-backend-cmux.test.sh 3351
 tests/fm-backend-herdr-focus-flash-e2e.test.sh 21
-tests/fm-backend-orca.test.sh 12041
-tests/fm-backend-tmux-smoke.test.sh 314
-tests/fm-backend-zellij-smoke.test.sh 21
-tests/fm-backend-zellij.test.sh 4225
-tests/fm-backend.test.sh 16370
-tests/fm-backlog-handoff.test.sh 2786
-tests/fm-bearings-snapshot.test.sh 60103
-tests/fm-bootstrap.test.sh 21912
-tests/fm-busy-adapter-wiring.test.sh 13962
-tests/fm-busy-state.test.sh 607
-tests/fm-calm-pi-extension.test.sh 203
-tests/fm-claude-stop-autoarm-live-e2e.test.sh 19
-tests/fm-claude-stop-autoarm.test.sh 60521
+tests/fm-backend-orca.test.sh 14681
+tests/fm-backend-tmux-smoke.test.sh 361
+tests/fm-backend-zellij-smoke.test.sh 22
+tests/fm-backend-zellij.test.sh 8297
+tests/fm-backend.test.sh 17169
+tests/fm-backlog-handoff.test.sh 4157
+tests/fm-bearings-board.test.sh 3385
+tests/fm-bearings-snapshot.test.sh 68659
+tests/fm-bootstrap.test.sh 38417
+tests/fm-busy-adapter-wiring.test.sh 14880
+tests/fm-busy-state.test.sh 714
+tests/fm-calm-pi-extension.test.sh 464
+tests/fm-classify-decision-key.test.sh 928
+tests/fm-claude-stop-autoarm-live-e2e.test.sh 30
+tests/fm-claude-stop-autoarm.test.sh 60633
+tests/fm-cmux-claude-composer-live-e2e.test.sh 20
 tests/fm-codex-continuity-live-e2e.test.sh 19
-tests/fm-daemon.test.sh 15140
-tests/fm-documentation-audiences.test.sh 572
-tests/fm-fleet-snapshot-view.test.sh 5902
-tests/fm-fleet-sync.test.sh 16417
-tests/fm-gate-refuse.test.sh 2839
-tests/fm-gitignore-config.test.sh 28
-tests/fm-gotmp.test.sh 308
+tests/fm-composer-matrix-live-e2e.test.sh 21
+tests/fm-control-relaunch.test.sh 31881
+tests/fm-control.test.sh 36712
+tests/fm-cursor-harness.test.sh 30071
+tests/fm-cursor-primary-live-e2e.test.sh 20
+tests/fm-cursor-primary.test.sh 52324
+tests/fm-daemon.test.sh 25834
+tests/fm-documentation-audiences.test.sh 642
+tests/fm-fleet-snapshot-view.test.sh 6995
+tests/fm-fleet-sync.test.sh 20194
+tests/fm-gate-refuse.test.sh 4071
+tests/fm-gitignore-config.test.sh 63
+tests/fm-gotmp.test.sh 762
 tests/fm-grok-continuity-live-e2e.test.sh 19
-tests/fm-grok-stop-live-e2e.test.sh 19
-tests/fm-guard-stale-banner.test.sh 2917
-tests/fm-herdr-session-cleanup.test.sh 4802
-tests/fm-kimi-harness.test.sh 12590
-tests/fm-opencode-primary-live-e2e.test.sh 18
-tests/fm-operational-input.test.sh 184
-tests/fm-pending-reply.test.sh 7328
-tests/fm-pi-primary-live-e2e.test.sh 19
-tests/fm-pi-watch-extension.test.sh 16386
-tests/fm-watch-recovery-loop.test.sh 80000
-tests/fm-pr-check-security.test.sh 199573
-tests/fm-procevent.test.sh 42789
-tests/fm-public-followup.test.sh 23365
-tests/fm-quota-array-dispatch-live-e2e.test.sh 19
-tests/fm-secondmate-harness.test.sh 87895
-tests/fm-secondmate-lifecycle-e2e.test.sh 4929
-tests/fm-secondmate-liveness.test.sh 12553
-tests/fm-secondmate-safety.test.sh 24432
-tests/fm-secondmate-sync.test.sh 12289
-tests/fm-send-secondmate-marker-herdr-e2e.test.sh 27
-tests/fm-send-secondmate-marker.test.sh 2136
-tests/fm-session-start.test.sh 37289
-tests/fm-sessionstart-nudge.test.sh 264
-tests/fm-sessionstart-instruction-refresh-live-e2e.test.sh 19
-tests/fm-shared-captain-inheritance.test.sh 3506
-tests/fm-spawn-dispatch-profile.test.sh 41351
-tests/fm-spawn-worktree-settle.test.sh 4598
-tests/fm-startup-memory-budget.test.sh 4260
-tests/fm-subagent-pretool-check.test.sh 901
-tests/fm-supervision-events.test.sh 413
-tests/fm-tangle-guard.test.sh 7230
-tests/fm-teardown-endpoint-safety.test.sh 1073
-tests/fm-teardown.test.sh 23237
-tests/fm-test-isolation-proof.test.sh 326
-tests/fm-turnend-guard.test.sh 5986
-tests/fm-update.test.sh 1894
-tests/fm-vendor-auth-probe.test.sh 42796
-tests/fm-wake-daemon-lifecycle-e2e.test.sh 4284
-tests/fm-wake-drain-unread-status.test.sh 4000
-tests/fm-wake-queue.test.sh 22787
-tests/fm-watch-checkpoint.test.sh 3943
-tests/fm-watch-triage.test.sh 113051
-tests/fm-watcher-lock.test.sh 98342
+tests/fm-grok-stop-live-e2e.test.sh 21
+tests/fm-guard-stale-banner.test.sh 11280
+tests/fm-harness-liveness-drift-live-e2e.test.sh 19
+tests/fm-herdr-session-cleanup.test.sh 14120
+tests/fm-herdr-submit-confirm-live-e2e.test.sh 20
+tests/fm-herdr-version-floor-live-e2e.test.sh 20
+tests/fm-inactive-reconcile.test.sh 41671
+tests/fm-kimi-harness.test.sh 15092
+tests/fm-lint-workflows.test.sh 744
+tests/fm-muse-harness.test.sh 27414
+tests/fm-muse-signals-live-e2e.test.sh 21
+tests/fm-on.test.sh 8602
+tests/fm-opencode-primary-live-e2e.test.sh 22
+tests/fm-operational-input.test.sh 246
+tests/fm-peek-remote.test.sh 848
+tests/fm-pending-reply.test.sh 19488
+tests/fm-pi-primary-live-e2e.test.sh 41
+tests/fm-pi-watch-extension.test.sh 17979
+tests/fm-pr-check-security.test.sh 250417
+tests/fm-procevent-when.test.sh 15249
+tests/fm-procevent.test.sh 53142
+tests/fm-project-origin.test.sh 105
+tests/fm-public-followup.test.sh 36301
+tests/fm-quota-array-dispatch-live-e2e.test.sh 18
+tests/fm-remote-backlog-handoff.test.sh 20389
+tests/fm-remote-doctor.test.sh 4705
+tests/fm-remote-entrypoint.test.sh 98
+tests/fm-remote-job-orphan-reap.test.sh 2903
+tests/fm-remote-job.test.sh 48068
+tests/fm-remote-reply.test.sh 40906
+tests/fm-remote-secondmate-lifecycle-e2e.test.sh 170240
+tests/fm-remote-secondmate-parent-binding.test.sh 13064
+tests/fm-remote-secondmate-trace-context.test.sh 39927
+tests/fm-secondmate-harness.test.sh 123471
+tests/fm-secondmate-lifecycle-e2e.test.sh 6539
+tests/fm-secondmate-liveness.test.sh 16365
+tests/fm-secondmate-safety.test.sh 49011
+tests/fm-secondmate-sync.test.sh 29236
+tests/fm-send-remote-delivery.test.sh 4892
+tests/fm-send-resolve-key.test.sh 13450
+tests/fm-send-secondmate-marker-herdr-e2e.test.sh 45
+tests/fm-send-secondmate-marker.test.sh 4439
+tests/fm-session-lock-ancestry.test.sh 1205
+tests/fm-session-start.test.sh 144836
+tests/fm-sessionstart-hook-live-e2e.test.sh 21
+tests/fm-sessionstart-instruction-refresh-live-e2e.test.sh 21
+tests/fm-sessionstart-nudge.test.sh 26684
+tests/fm-shared-captain-inheritance.test.sh 10672
+tests/fm-spawn-dispatch-profile.test.sh 57765
+tests/fm-spawn-pool-base-freshen.test.sh 13257
+tests/fm-spawn-worktree-settle.test.sh 4828
+tests/fm-startup-memory-budget.test.sh 6550
+tests/fm-startup-network.test.sh 48888
+tests/fm-stow-cascade.test.sh 2986
+tests/fm-subagent-pretool-check.test.sh 1066
+tests/fm-supervision-events.test.sh 1431
+tests/fm-tangle-guard.test.sh 8364
+tests/fm-task-delivery.test.sh 2414
+tests/fm-teardown-endpoint-safety.test.sh 7295
+tests/fm-teardown.test.sh 87400
+tests/fm-test-fixture-cleanup.test.sh 532
+tests/fm-test-isolation-proof.test.sh 451
+tests/fm-tmux-agent-liveness.test.sh 4065
+tests/fm-tool-update-check.test.sh 12846
+tests/fm-trace-context-lib.test.sh 194
+tests/fm-trace-context-spawn.test.sh 35325
+tests/fm-turnend-guard.test.sh 34915
+tests/fm-update.test.sh 5280
+tests/fm-vendor-auth-probe.test.sh 43243
+tests/fm-wake-daemon-lifecycle-e2e.test.sh 6219
+tests/fm-wake-drain-open-decisions-cursor.test.sh 17357
+tests/fm-wake-drain-open-decisions.test.sh 11300
+tests/fm-wake-drain-unread-status.test.sh 25214
+tests/fm-wake-queue.test.sh 30887
+tests/fm-watch-arm.test.sh 53598
+tests/fm-watch-checkpoint.test.sh 5293
+tests/fm-watch-recovery-loop.test.sh 58721
+tests/fm-watch-triage.test.sh 142409
+tests/fm-watcher-lock.test.sh 54364
 EOF
 }
 
diff --git a/bin/fm-tool-update-check.sh b/bin/fm-tool-update-check.sh
new file mode 100755
index 0000000000..bbaf7d2524
--- /dev/null
+++ b/bin/fm-tool-update-check.sh
@@ -0,0 +1,898 @@
+#!/usr/bin/env bash
+# fm-tool-update-check.sh - report watched tooling that has an update available,
+# and tooling whose update is installed but not in effect.
+#
+# Usage:
+#   fm-tool-update-check.sh [check]
+#   fm-tool-update-check.sh arm
+#   fm-tool-update-check.sh disarm
+#   fm-tool-update-check.sh --help
+#
+# `check` prints one line when something needs attention and prints nothing at
+# all otherwise, so it composes with the existing watcher state-check contract
+# instead of needing a schedule of its own. `arm` writes
+# state/tool-updates.check.sh and binds its bytes with fm-check-register.sh, so
+# the watcher dispatches it on its normal FM_CHECK_INTERVAL cadence and turns
+# its one line into a `check:` wake. `disarm` removes the shim, its trust
+# binding, and the report record.
+#
+# Two conditions are reported, and they are deliberately distinct:
+#
+#   "<tool> update available"      a newer version exists at the update source.
+#   "<tool> update not in effect"  a newer copy is installed on this host, but
+#                                  PATH still resolves an older one.
+#
+# The second condition is the reason this script exists. A tool that
+# self-installs into ~/.local/bin while a version manager keeps its own older
+# copy earlier on PATH looks fully up to date to anything that asks only "is a
+# newer version published". So PATH skew is measured, never inferred: every
+# executable copy on PATH is asked for its own version, and those answers are
+# compared. A directory name is never read as a version, because a version
+# manager's "latest" directory can hold an older build. A copy that will not
+# report a version is reported as a check failure rather than assumed current.
+#
+# What this script never does: it reports, and it repairs nothing. It does not
+# install, update, uninstall, reorder PATH, or touch any version manager's
+# configuration, and it never fetches into a watched git repository. Every git
+# probe is read-only (rev-parse, symbolic-ref, ls-remote, cat-file, merge-base,
+# rev-list), so a watched project is never mutated.
+#
+# The watched tools live in config/watched-tools.json, which is local and
+# gitignored, and is never propagated to another home. Adding a tool is a config
+# edit, never a code change. docs/configuration.md owns that schema.
+#
+# Probing costs real time, so `check` runs its probes at most once per
+# FM_TOOL_UPDATE_INTERVAL (default 900, 0 disables the gate, otherwise 60..86400)
+# and stays silent in between. Each probe is bounded by
+# FM_TOOL_UPDATE_PROBE_SECS (default 5, valid 1..30) and a whole sweep by
+# FM_TOOL_UPDATE_BUDGET_SECS (default 20, valid 1..120).
+#
+# The sweep has to finish inside the watcher's own per check bound, because a run
+# the watcher kills prints nothing and writes no record, so it would repeat that
+# silence on every poll. That coupling is enforced rather than assumed: a budget
+# larger than FM_CHECK_TIMEOUT (default 30, read from this check's own
+# environment because the watcher runs it as a direct child) allows is cut down
+# to what fits, and the cut is reported in the report line so the operator sees
+# it. A budget that cannot be read as a whole number from 1 to 120 is still
+# refused outright.
+#
+# The report record state/.tool-updates is written only when a sweep runs to its
+# end, and it carries the whole finding set the last report was made from,
+# uncut, so the same pending update is reported once rather than on every poll
+# while a new finding that lands past the one-line cut is still news. A sweep
+# killed part way through leaves no record and is retried, instead of
+# suppressing its finding.
+set -u
+export LC_ALL=C
+# A watched git remote must never stop to ask for credentials; an unauthenticated
+# probe has to fail inside its bound instead of waiting for an answer.
+export GIT_TERMINAL_PROMPT=0
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}}"
+STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
+CONFIG="${FM_CONFIG_OVERRIDE:-$FM_HOME/config}/watched-tools.json"
+RECORD="$STATE/.tool-updates"
+CHECK_ID=tool-updates
+CHECK_SHIM="$STATE/$CHECK_ID.check.sh"
+CHECK_TRUST="$STATE/$CHECK_ID.check-trust"
+REGISTER_BIN="$SCRIPT_DIR/fm-check-register.sh"
+RECORD_SCHEMA=fm-tool-updates-v1
+# Wider than the digest default because one finding names two absolute paths and
+# their two versions, and several tools can report in the same sweep.
+MAX_LINE=1000
+
+# shellcheck source=bin/fm-timeout-lib.sh
+. "$SCRIPT_DIR/fm-timeout-lib.sh"
+# shellcheck source=bin/fm-pr-lib.sh
+. "$SCRIPT_DIR/fm-pr-lib.sh"
+# shellcheck source=bin/fm-line-cap-lib.sh
+. "$SCRIPT_DIR/fm-line-cap-lib.sh"
+# shellcheck source=bin/fm-check-lib.sh
+. "$SCRIPT_DIR/fm-check-lib.sh"
+
+usage() {
+  cat <<'EOF'
+Usage:
+  fm-tool-update-check.sh [check]   report watched tools needing attention (silent when current)
+  fm-tool-update-check.sh arm       write and register state/tool-updates.check.sh
+  fm-tool-update-check.sh disarm    remove the check shim, its trust binding, and the record
+  fm-tool-update-check.sh --help    print this help
+
+Watched tools are read from config/watched-tools.json (local, gitignored).
+See docs/configuration.md for the schema and docs/examples/watched-tools.json for a starting point.
+EOF
+}
+
+die_usage() {
+  printf 'fm-tool-update-check: %s\n' "$1" >&2
+  usage >&2
+  exit 2
+}
+
+INTERVAL=${FM_TOOL_UPDATE_INTERVAL:-900}
+case "$INTERVAL" in
+  ''|*[!0-9]*)
+    printf 'fm-tool-update-check: FM_TOOL_UPDATE_INTERVAL must be 0 or a whole number from 60 to 86400\n' >&2
+    exit 2
+    ;;
+esac
+if [ "$INTERVAL" -ne 0 ] && { [ "$INTERVAL" -lt 60 ] || [ "$INTERVAL" -gt 86400 ]; }; then
+  printf 'fm-tool-update-check: FM_TOOL_UPDATE_INTERVAL must be 0 or a whole number from 60 to 86400\n' >&2
+  exit 2
+fi
+
+PROBE_SECS=${FM_TOOL_UPDATE_PROBE_SECS:-5}
+case "$PROBE_SECS" in
+  ''|*[!0-9]*|0)
+    printf 'fm-tool-update-check: FM_TOOL_UPDATE_PROBE_SECS must be a whole number from 1 to 30\n' >&2
+    exit 2
+    ;;
+esac
+if [ "$PROBE_SECS" -gt 30 ]; then
+  printf 'fm-tool-update-check: FM_TOOL_UPDATE_PROBE_SECS must be a whole number from 1 to 30\n' >&2
+  exit 2
+fi
+
+BUDGET_SECS=${FM_TOOL_UPDATE_BUDGET_SECS:-20}
+case "$BUDGET_SECS" in
+  ''|*[!0-9]*|0)
+    printf 'fm-tool-update-check: FM_TOOL_UPDATE_BUDGET_SECS must be a whole number from 1 to 120\n' >&2
+    exit 2
+    ;;
+esac
+if [ "$BUDGET_SECS" -gt 120 ]; then
+  printf 'fm-tool-update-check: FM_TOOL_UPDATE_BUDGET_SECS must be a whole number from 1 to 120\n' >&2
+  exit 2
+fi
+
+# The smallest bound a probe can be given, because fm_run_timed treats a
+# non-positive bound as no bound.
+PROBE_MIN_SECS=1
+# Both clocks here count whole seconds, so a probe can start when the arithmetic
+# says a second is left while almost none of it really is, and it still gets a
+# full bound.
+CLOCK_ROUNDING_SECS=1
+# fm_run_timed asks its runner for -k 1, so a probe that does not stop on TERM is
+# only killed a second after its bound.
+KILL_GRACE_SECS=1
+
+# The watcher's per check bound, read from this check's own environment. The
+# watcher runs the check as a direct child, so an operator who raised it is seen
+# here too, and when it is unset both sides resolve the same default.
+CHECK_TIMEOUT=${FM_CHECK_TIMEOUT:-30}
+case "$CHECK_TIMEOUT" in
+  ''|*[!0-9]*|0) CHECK_TIMEOUT=30 ;;
+esac
+# The last probe of a sweep can end this far past the deadline, so that is what
+# the budget has to leave the watcher's own bound.
+BUDGET_MAX=$((CHECK_TIMEOUT - PROBE_MIN_SECS - CLOCK_ROUNDING_SECS - KILL_GRACE_SECS))
+[ "$BUDGET_MAX" -ge 1 ] || BUDGET_MAX=1
+# Cut rather than refuse. A refusal is reported once and then suppressed by the
+# no-nag gate, which leaves the detector dead and quiet, and a check that goes
+# silent is worse than a check that reports something awkward.
+BUDGET_CUT_FROM=
+if [ "$BUDGET_SECS" -gt "$BUDGET_MAX" ]; then
+  BUDGET_CUT_FROM=$BUDGET_SECS
+  BUDGET_SECS=$BUDGET_MAX
+fi
+
+# --- small helpers ----------------------------------------------------------
+
+# The record epoch is overridable so a test can drive the cadence gate; the
+# sweep budget always uses real time so a frozen epoch cannot disable it.
+record_epoch_now() {
+  case "${FM_TOOL_UPDATE_NOW:-}" in
+    ''|*[!0-9]*) date +%s ;;
+    *) printf '%s\n' "$FM_TOOL_UPDATE_NOW" ;;
+  esac
+}
+
+real_epoch() { date +%s; }
+
+FINDINGS=
+DEADLINE=0
+INCOMPLETE_REPORTED=0
+
+# Each finding is flattened to a single line here, because the whole report must
+# stay one line for the wake record.
+emit() {
+  local text
+  text=$(printf '%s' "$1" | tr '\t\r\n' '   ')
+  if [ -z "$FINDINGS" ]; then
+    FINDINGS=$text
+  else
+    FINDINGS="$FINDINGS; $text"
+  fi
+}
+
+budget_exhausted() {
+  [ "$(real_epoch)" -ge "$DEADLINE" ]
+}
+
+# True while the sweep budget still has room for another probe. When it does not,
+# it records once which tool the sweep did not finish, so a sweep that cannot
+# finish says so rather than being killed by the watcher with nothing printed.
+budget_allows() {
+  local name=$1
+  budget_exhausted || return 0
+  if [ "$INCOMPLETE_REPORTED" -eq 0 ]; then
+    INCOMPLETE_REPORTED=1
+    emit "check incomplete: the time budget ran out before $name"
+  fi
+  return 1
+}
+
+# The bound for one probe: the probe bound, cut down to whatever the sweep
+# budget has left, so no probe can run past the end of the sweep. Never below
+# PROBE_MIN_SECS, because fm_run_timed treats a non-positive bound as no bound.
+probe_bound() {
+  local left
+  left=$((DEADLINE - $(real_epoch)))
+  if [ "$left" -lt "$PROBE_MIN_SECS" ]; then
+    printf '%s\n' "$PROBE_MIN_SECS"
+  elif [ "$left" -lt "$PROBE_SECS" ]; then
+    printf '%s\n' "$left"
+  else
+    printf '%s\n' "$PROBE_SECS"
+  fi
+}
+
+# First dotted number in the text, so "herdr 0.8.2" and "v1.46.0" both work.
+parse_version() {
+  printf '%s' "$1" | grep -oE '[0-9]+(\.[0-9]+)+' | head -n 1
+}
+
+# version_newer <a> <b>: true when version a is numerically newer than b.
+version_newer() {
+  local a=$1 b=$2 i left right
+  local -a ap bp
+  IFS=. read -r -a ap <<< "$a"
+  IFS=. read -r -a bp <<< "$b"
+  i=0
+  while [ "$i" -lt "${#ap[@]}" ] || [ "$i" -lt "${#bp[@]}" ]; do
+    left=$((10#${ap[i]:-0}))
+    right=$((10#${bp[i]:-0}))
+    if [ "$left" -gt "$right" ]; then
+      return 0
+    elif [ "$left" -lt "$right" ]; then
+      return 1
+    fi
+    i=$((i + 1))
+  done
+  return 1
+}
+
+commit_phrase() {
+  if [ "$1" = 1 ]; then
+    printf '1 commit\n'
+  else
+    printf '%s commits\n' "$1"
+  fi
+}
+
+# --- watched tool registry --------------------------------------------------
+
+CONFIG_PROBLEM=
+
+# jq can check that an announce_pattern is a non-empty single-line string, but
+# only grep can say whether it compiles as an extended regular expression. A
+# pattern grep refuses would silently disable that tool's update source, which is
+# the exact failure this script exists to prevent.
+announce_pattern_usable() {
+  local pattern=$1 status
+  printf '%s' '' | grep -qE -- "$pattern" 2>/dev/null
+  status=$?
+  [ "$status" -le 1 ]
+}
+
+# Deliberately separate from config_validate, and asked only by arm. Arming is a
+# deliberate operator action that should fail loudly, but a sweep must not treat
+# one tool's unusable pattern as a reason to stop watching every other tool: that
+# would let a one character typo turn the PATH skew detector off. So `check`
+# reports this per tool instead, in command_findings.
+config_announce_patterns_usable() {
+  local name announce
+  while IFS=$FIELD_SEP read -r name _ _ announce _; do
+    [ -n "$announce" ] || continue
+    if ! announce_pattern_usable "$announce"; then
+      CONFIG_PROBLEM="tool $name announce_pattern is not a usable extended regular expression"
+      return 1
+    fi
+  done < <(config_records)
+  return 0
+}
+
+config_validate() {
+  local problem status
+  if ! command -v jq >/dev/null 2>&1; then
+    CONFIG_PROBLEM='jq is required to read the watched tool registry'
+    return 1
+  fi
+  problem=$(jq -r '
+    def tool_problem($t):
+      if ($t | type) != "object" then "every entry in tools must be an object"
+      elif ($t.name | type) != "string" or ($t.name | length) == 0 then "every tool needs a non-empty name"
+      elif ($t.name | test("^[A-Za-z0-9._+-]+$") | not) then "tool name \($t.name) may use only letters, digits, dot, underscore, plus, and dash"
+      elif ($t | has("command") | not) and ($t | has("git") | not) then "tool \($t.name) needs command, git, or both"
+      elif ($t | has("command")) and (($t.command | type) != "string" or ($t.command | test("^[A-Za-z0-9._+-]+$") | not)) then "tool \($t.name) command must be a bare executable name"
+      elif ($t | has("version_args")) and (($t.version_args | type) != "array" or ($t.version_args | length) == 0) then "tool \($t.name) version_args must be a non-empty array"
+      elif ($t | has("version_args")) and ([$t.version_args[] | select((type != "string") or (test("^[A-Za-z0-9._=+/:-]+$") | not))] | length) > 0 then "tool \($t.name) version_args must be simple flag strings without spaces"
+      elif ($t | has("announce_pattern")) and (($t.announce_pattern | type) != "string" or ($t.announce_pattern | length) == 0 or ($t.announce_pattern | test("[[:cntrl:]]"))) then "tool \($t.name) announce_pattern must be a non-empty single-line string"
+      elif ($t | has("announce_pattern")) and (($t | has("command")) | not) then "tool \($t.name) announce_pattern needs command"
+      elif ($t | has("announce_args")) and (($t.announce_args | type) != "array" or ($t.announce_args | length) == 0) then "tool \($t.name) announce_args must be a non-empty array"
+      elif ($t | has("announce_args")) and ([$t.announce_args[] | select((type != "string") or (test("^[A-Za-z0-9._=+/:-]+$") | not))] | length) > 0 then "tool \($t.name) announce_args must be simple flag strings without spaces"
+      elif ($t | has("announce_args")) and (($t | has("announce_pattern")) | not) then "tool \($t.name) announce_args needs announce_pattern"
+      elif ($t | has("git")) and (($t.git | type) != "object") then "tool \($t.name) git must be an object"
+      elif ($t | has("git")) and (($t.git.repo | type) != "string" or ($t.git.repo | startswith("/") | not) or ($t.git.repo | test("[[:cntrl:]]"))) then "tool \($t.name) git.repo must be an absolute path on one line"
+      elif ($t | has("git")) and ($t.git | has("remote")) and (($t.git.remote | type) != "string" or ($t.git.remote | test("^[A-Za-z0-9._-]+$") | not)) then "tool \($t.name) git.remote must be a simple remote name"
+      elif ($t | has("git")) and ($t.git | has("branch")) and (($t.git.branch | type) != "string" or ($t.git.branch | test("^[A-Za-z0-9._/-]+$") | not)) then "tool \($t.name) git.branch must be a simple branch name"
+      else empty
+      end;
+    def problems:
+      if type != "object" then ["the top level must be an object"]
+      elif (.tools | type) != "array" then ["tools must be an array"]
+      elif (.tools | length) == 0 then ["tools must list at least one tool"]
+      else
+        [.tools[] | tool_problem(.)]
+        + (if ([.tools[].name] | unique | length) != (.tools | length) then ["tool names must be unique"] else [] end)
+      end;
+    problems | .[0] // "ok"
+  ' "$CONFIG" 2>/dev/null)
+  status=$?
+  if [ "$status" -ne 0 ] || [ -z "$problem" ]; then
+    CONFIG_PROBLEM='the watched tool registry is not valid JSON'
+    return 1
+  fi
+  if [ "$problem" != ok ]; then
+    CONFIG_PROBLEM=$problem
+    return 1
+  fi
+  CONFIG_PROBLEM=
+  return 0
+}
+
+# One record per tool, in config order. Fields are joined with the unit
+# separator rather than a tab, because tab is IFS whitespace and `read` would
+# collapse the empty fields that an optional key leaves behind.
+FIELD_SEP=$(printf '\037')
+
+config_records() {
+  jq -r '
+    .tools[] | [
+      .name,
+      (.command // ""),
+      ((.version_args // ["--version"]) | join(" ")),
+      (.announce_pattern // ""),
+      ((.announce_args // .version_args // ["--version"]) | join(" ")),
+      (.git.repo // ""),
+      (.git.remote // "origin"),
+      (.git.branch // "")
+    ] | join("\u001f")
+  ' "$CONFIG" 2>/dev/null
+}
+
+# --- PATH probes ------------------------------------------------------------
+
+# Every executable copy of <command> on PATH, in PATH order, deduplicated by
+# device and inode so one copy reached through two PATH entries is not read as
+# two installs.
+path_hits() {
+  local command_name=$1 dir candidate identity seen=''
+  while IFS= read -r dir; do
+    [ -n "$dir" ] || continue
+    candidate="$dir/$command_name"
+    [ -f "$candidate" ] && [ -x "$candidate" ] || continue
+    identity=$(fm_pr_file_identity "$candidate" 2>/dev/null) || identity=
+    [ -n "$identity" ] || identity=$candidate
+    case " $seen " in
+      *" $identity "*) continue ;;
+    esac
+    seen="$seen $identity"
+    printf '%s\n' "$candidate"
+  done < <(printf '%s\n' "$PATH" | tr ':' '\n')
+}
+
+# Ask one copy for its own version. Combined output, because tools answer on
+# either stream, and no-mistakes announces its update on stderr.
+probe_output() {
+  local path=$1
+  shift
+  fm_run_timed "$(probe_bound)" "$path" "$@" 2>&1
+}
+
+command_findings() {
+  local name=$1 command_name=$2 args_joined=$3 announce=$4 announce_args=$5
+  local hit out version matched announce_out status
+  local resolved_path='' resolved_version='' resolved_out=''
+  local best_path='' best_version='' unreadable='' hits=''
+
+  # This tool's announcement source is dead if its pattern cannot be used, which
+  # is reported here, for this tool alone, so the rest of the sweep still runs.
+  if [ -n "$announce" ] && ! announce_pattern_usable "$announce"; then
+    emit "$name check failed: announce_pattern is not a usable extended regular expression"
+    announce=
+  fi
+
+  hits=$(path_hits "$command_name")
+  if [ -z "$hits" ]; then
+    emit "$name check failed: $command_name is not on PATH"
+    return 0
+  fi
+
+  while IFS= read -r hit; do
+    [ -n "$hit" ] || continue
+    if budget_exhausted; then
+      emit "$name check failed: the time budget ran out before every copy answered"
+      break
+    fi
+    # shellcheck disable=SC2086  # deliberate split on validated space-free tokens
+    out=$(probe_output "$hit" $args_joined)
+    version=$(parse_version "$out")
+    if [ -z "$resolved_path" ]; then
+      resolved_path=$hit
+      resolved_version=$version
+      resolved_out=$out
+    fi
+    if [ -z "$version" ]; then
+      [ -n "$unreadable" ] || unreadable=$hit
+      continue
+    fi
+    if [ -z "$best_version" ] || version_newer "$version" "$best_version"; then
+      best_version=$version
+      best_path=$hit
+    fi
+  done <<EOF
+$hits
+EOF
+
+  if [ -n "$announce" ] && [ -n "$resolved_path" ]; then
+    # A tool does not have to announce its update on the command that reports its
+    # version: no-mistakes prints its version for --version but announces a new
+    # release on its other commands. So announce_args may name a second command,
+    # and it is asked of the copy PATH actually resolves.
+    announce_out=$resolved_out
+    if [ "$announce_args" != "$args_joined" ]; then
+      if budget_exhausted; then
+        # The version probe's output cannot carry the announcement, so searching
+        # it would present a source that was never asked as a clean result.
+        emit "$name check failed: the time budget ran out before the update announcement was checked"
+        announce_out=
+      else
+        # shellcheck disable=SC2086  # deliberate split on validated space-free tokens
+        announce_out=$(probe_output "$resolved_path" $announce_args)
+        status=$?
+        if [ "$status" -eq 124 ]; then
+          # A source that was asked and never answered is not a source that had
+          # nothing to say. The one that answers with nothing stays silent below.
+          emit "$name check failed: $resolved_path did not answer when asked for its update announcement"
+          announce_out=
+        fi
+      fi
+    fi
+    if [ -n "$announce_out" ]; then
+      # Not a pipeline, so grep's own status is still readable here: a pattern
+      # grep cannot use is a check failure, never read as nothing to announce.
+      matched=$(grep -oE -- "$announce" <<< "$announce_out" 2>/dev/null)
+      status=$?
+      if [ "$status" -gt 1 ]; then
+        emit "$name check failed: announce_pattern is not a usable extended regular expression"
+      elif [ -n "$matched" ]; then
+        emit "$name update available: $(printf '%s\n' "$matched" | head -n 1)"
+      fi
+    fi
+  fi
+
+  if [ -z "$resolved_version" ]; then
+    # No copy was probed at all when the path is empty, and the budget report
+    # already covers that, so do not blame a copy that was never asked.
+    [ -z "$resolved_path" ] || emit "$name check failed: $resolved_path did not report a version"
+    return 0
+  fi
+
+  if [ -n "$best_version" ] && [ "$best_path" != "$resolved_path" ] \
+    && version_newer "$best_version" "$resolved_version"; then
+    emit "$name update not in effect: PATH resolves $resolved_version at $resolved_path but $best_version is installed at $best_path"
+  fi
+
+  if [ -n "$unreadable" ]; then
+    emit "$name check failed: $unreadable did not report a version"
+  fi
+  return 0
+}
+
+# --- git probes -------------------------------------------------------------
+
+# A probe the sweep budget can no longer afford is never issued, and says so with
+# a status of its own rather than a git status, so no caller can read it as an
+# answer. Neither git nor the bounded runner uses this value.
+GIT_PROBE_NOT_ISSUED=3
+
+# One bounded read-only git probe. The budget check lives here rather than in the
+# callers, so no probe can be issued past the sweep deadline whatever a caller
+# does, and the budget only has to leave room for the one probe that was already
+# running when the deadline passed.
+git_probe() {
+  local repo=$1
+  shift
+  budget_exhausted && return "$GIT_PROBE_NOT_ISSUED"
+  fm_run_timed "$(probe_bound)" git -C "$repo" "$@"
+}
+
+# The single place that reads a probe status as no answer at all, so every probe
+# reports an unanswered read the same way instead of taking it for the answer no.
+git_probe_answered() {
+  local status=$1 name=$2 subject=$3 question=$4
+  case "$status" in
+    "$GIT_PROBE_NOT_ISSUED")
+      emit "$name check failed: the time budget ran out before $subject was asked $question"
+      return 1
+      ;;
+    124)
+      emit "$name check failed: $subject did not answer $question"
+      return 1
+      ;;
+  esac
+  return 0
+}
+
+# Read-only throughout: nothing here writes to the watched repository. This is the
+# one tool kind that issues several probes in a row, two of them over the network,
+# and each of them goes through git_probe, which owns both the bound and the
+# budget check, so the sweep cannot outrun its deadline here.
+git_findings() {
+  local name=$1 repo=$2 remote=$3 branch=$4
+  local status remote_sha local_sha local_label count short symref
+
+  if ! command -v git >/dev/null 2>&1; then
+    emit "$name check failed: git is not installed"
+    return 0
+  fi
+  if [ ! -d "$repo" ]; then
+    emit "$name check failed: $repo is not a directory"
+    return 0
+  fi
+  budget_allows "$name" || return 0
+  git_probe "$repo" rev-parse --git-dir >/dev/null 2>&1
+  status=$?
+  git_probe_answered "$status" "$name" "$repo" "whether it is a git repository" || return 0
+  if [ "$status" -ne 0 ]; then
+    emit "$name check failed: $repo is not a git repository"
+    return 0
+  fi
+
+  if [ -z "$branch" ]; then
+    branch=$(git_probe "$repo" symbolic-ref --short "refs/remotes/$remote/HEAD" 2>/dev/null)
+    git_probe_answered "$?" "$name" "$repo" "which branch it records for $remote" || return 0
+    branch=${branch#"$remote/"}
+  fi
+  if [ -z "$branch" ]; then
+    # A clone made with --single-branch, or one that never ran remote set-head,
+    # has no local record of the remote's default branch. Ask the remote itself
+    # rather than reporting a check failure the operator cannot act on.
+    symref=$(git_probe "$repo" ls-remote --symref "$remote" HEAD 2>/dev/null)
+    git_probe_answered "$?" "$name" "$remote" "which branch it uses by default" || return 0
+    branch=$(printf '%s\n' "$symref" \
+      | awk '$1 == "ref:" { sub(/^refs\/heads\//, "", $2); print $2; exit }')
+  fi
+  if [ -z "$branch" ]; then
+    emit "$name check failed: cannot resolve the default branch of $remote in $repo"
+    return 0
+  fi
+
+  remote_sha=$(git_probe "$repo" ls-remote "$remote" "refs/heads/$branch" 2>/dev/null)
+  status=$?
+  git_probe_answered "$status" "$name" "$remote" "where $branch points" || return 0
+  if [ "$status" -ne 0 ]; then
+    # The probe itself failed, so nothing at all is known about the branch. An
+    # offline host and a deleted branch are different problems, and reporting a
+    # missing branch here would name a cause that was never established.
+    emit "$name check failed: $remote could not be reached or read from $repo"
+    return 0
+  fi
+  remote_sha=$(printf '%s\n' "$remote_sha" | awk 'NR == 1 { print $1 }')
+  if [ -z "$remote_sha" ]; then
+    emit "$name check failed: $remote has no branch $branch"
+    return 0
+  fi
+
+  # Each probe below is bounded, so a non-zero status means either the answer no
+  # or no answer at all. They are kept apart: reading a bound that was hit as an
+  # answer would report an update this check never established.
+  local_sha=$(git_probe "$repo" rev-parse --verify --quiet "refs/heads/$branch" 2>/dev/null)
+  git_probe_answered "$?" "$name" "$repo" "where $branch points" || return 0
+  if [ -n "$local_sha" ]; then
+    local_label="local $branch"
+  else
+    local_sha=$(git_probe "$repo" rev-parse --verify --quiet HEAD 2>/dev/null)
+    git_probe_answered "$?" "$name" "$repo" "where HEAD points" || return 0
+    if [ -z "$local_sha" ]; then
+      emit "$name check failed: $repo has no commit to compare"
+      return 0
+    fi
+    local_label='local HEAD'
+  fi
+
+  [ "$local_sha" != "$remote_sha" ] || return 0
+
+  short=$(printf '%s' "$remote_sha" | cut -c1-12)
+
+  git_probe "$repo" cat-file -e "$remote_sha^{commit}" 2>/dev/null
+  status=$?
+  git_probe_answered "$status" "$name" "$repo" "whether it already has $short" || return 0
+  if [ "$status" -eq 0 ]; then
+    # The local copy may be ahead of, or diverged from, the remote branch; only
+    # commits it does not have yet are an available update.
+    git_probe "$repo" merge-base --is-ancestor "$remote_sha" "$local_sha" 2>/dev/null
+    status=$?
+    git_probe_answered "$status" "$name" "$repo" "how its history compares with $remote/$branch" || return 0
+    [ "$status" -ne 0 ] || return 0
+    count=$(git_probe "$repo" rev-list --count "$local_sha..$remote_sha" 2>/dev/null)
+    git_probe_answered "$?" "$name" "$repo" "how many commits it is behind $remote/$branch" || return 0
+    case "$count" in
+      ''|*[!0-9]*|0) count= ;;
+    esac
+    if [ -n "$count" ]; then
+      emit "$name update available: $local_label is $(commit_phrase "$count") behind $remote/$branch"
+      return 0
+    fi
+  fi
+
+  emit "$name update available: $remote/$branch is at $short which this copy does not have"
+  return 0
+}
+
+# --- report record ----------------------------------------------------------
+
+RECORD_EPOCH=0
+RECORD_REPORTED=
+
+record_read() {
+  local line first=1
+  RECORD_EPOCH=0
+  RECORD_REPORTED=
+  [ -f "$RECORD" ] || return 0
+  while IFS= read -r line; do
+    if [ "$first" = 1 ]; then
+      first=0
+      [ "$line" = "$RECORD_SCHEMA" ] || return 0
+      continue
+    fi
+    case "$line" in
+      epoch=*)
+        line=${line#epoch=}
+        case "$line" in
+          ''|*[!0-9]*) RECORD_EPOCH=0 ;;
+          *) RECORD_EPOCH=$line ;;
+        esac
+        ;;
+      reported=*) RECORD_REPORTED=${line#reported=} ;;
+    esac
+  done < "$RECORD"
+  return 0
+}
+
+record_write() {
+  local reported=$1 tmp
+  tmp=$(mktemp "$RECORD.XXXXXX" 2>/dev/null) || return 1
+  chmod 0600 "$tmp" 2>/dev/null || { rm -f -- "$tmp"; return 1; }
+  {
+    printf '%s\n' "$RECORD_SCHEMA"
+    printf 'epoch=%s\n' "$(record_epoch_now)"
+    printf 'reported=%s\n' "$reported"
+  } > "$tmp" || { rm -f -- "$tmp"; return 1; }
+  mv -f -- "$tmp" "$RECORD" || { rm -f -- "$tmp"; return 1; }
+  return 0
+}
+
+# --- actions ----------------------------------------------------------------
+
+action_check() {
+  local name command_name args_joined announce announce_args repo remote branch
+  local line now
+
+  [ -f "$CONFIG" ] || return 0
+
+  record_read
+  now=$(record_epoch_now)
+  if [ "$INTERVAL" -ne 0 ] && [ "$RECORD_EPOCH" -gt 0 ] \
+    && [ "$now" -ge "$RECORD_EPOCH" ] && [ $((now - RECORD_EPOCH)) -lt "$INTERVAL" ]; then
+    return 0
+  fi
+
+  DEADLINE=$(($(real_epoch) + BUDGET_SECS))
+
+  if [ -n "$BUDGET_CUT_FROM" ]; then
+    emit "sweep budget ${BUDGET_CUT_FROM}s cut to ${BUDGET_SECS}s to stay inside the watcher check timeout of ${CHECK_TIMEOUT}s"
+  fi
+
+  if ! config_validate; then
+    emit "watched tool registry: $CONFIG_PROBLEM"
+  else
+    while IFS=$FIELD_SEP read -r name command_name args_joined announce announce_args repo remote branch; do
+      [ -n "$name" ] || continue
+      budget_allows "$name" || break
+      [ -z "$command_name" ] || command_findings "$name" "$command_name" "$args_joined" "$announce" "$announce_args"
+      [ -z "$repo" ] || git_findings "$name" "$repo" "$remote" "$branch"
+    done < <(config_records)
+  fi
+
+  line=
+  if [ -n "$FINDINGS" ]; then
+    # Capped through the shared cut so an over-long report carries the same
+    # visible truncation marker the digests use, instead of ending mid-finding
+    # as if that were all of it.
+    fm_cap_line_var "tool updates: $FINDINGS" "$MAX_LINE"
+    line=$FM_LINE_CAP_LINE
+  fi
+
+  # The cut line is what gets printed, but the whole finding set is what decides
+  # whether this is news, because a finding that lands past the cut leaves the
+  # printed line unchanged and would otherwise be suppressed for good.
+  #
+  # Report before recording, so a record that cannot be written costs a repeated
+  # report rather than a lost one.
+  if [ -n "$line" ] && [ "$FINDINGS" != "$RECORD_REPORTED" ]; then
+    printf '%s\n' "$line"
+  fi
+  record_write "$FINDINGS" || true
+  return 0
+}
+
+# The home is embedded already resolved, because the watcher runs the shim from
+# its own working directory and a relative spelling would send the check to a
+# different home, or to none at all.
+shim_content() {
+  local home=$1
+  printf '%s\n' \
+    '#!/usr/bin/env bash' \
+    '# Auto-generated by fm-tool-update-check.sh - watched tool update poll shim.' \
+    '# The watcher validates these bytes, then dispatches the trusted check script.' \
+    "export FM_HOME=$(printf '%q' "$home")" \
+    "exec $(printf '%q' "$SCRIPT_DIR/fm-tool-update-check.sh") check"
+}
+
+# Write the shim the way this repo writes its other trusted check shim: the
+# guards run before anything is written, so a symlink at the shim path is
+# refused instead of followed, and the bytes arrive by rename so the watcher
+# never reads a half-written shim and rejects it as unauthenticated.
+SHIM_WRITE_TMP=
+
+shim_write() {
+  local want=$1 device tmp
+  [ -d "$STATE" ] && [ ! -L "$STATE" ] || return 1
+  device=$(fm_pr_file_device "$STATE") || return 1
+  [ -n "$device" ] || return 1
+  fm_pr_regular_destination_on_device_or_absent "$CHECK_SHIM" "$device" || return 1
+  if [ -e "$CHECK_SHIM" ] && [ "$(fm_pr_file_mode "$CHECK_SHIM")" = 700 ] \
+    && [ "$(cat "$CHECK_SHIM" 2>/dev/null)" = "$want" ]; then
+    return 0
+  fi
+  tmp=$(umask 077; mktemp "$STATE/.fm-tool-updates-check.XXXXXX" 2>/dev/null) || return 1
+  SHIM_WRITE_TMP=$tmp
+  if ! printf '%s\n' "$want" > "$tmp" \
+    || ! chmod 0700 "$tmp" \
+    || ! fm_pr_private_file_valid "$tmp" 700 "$device"; then
+    rm -f -- "$tmp"
+    SHIM_WRITE_TMP=
+    return 1
+  fi
+  if ! fm_pr_regular_destination_on_device_or_absent "$CHECK_SHIM" "$device" \
+    || ! mv -f -- "$tmp" "$CHECK_SHIM"; then
+    rm -f -- "$tmp"
+    SHIM_WRITE_TMP=
+    return 1
+  fi
+  SHIM_WRITE_TMP=
+  fm_pr_private_file_valid "$CHECK_SHIM" 700 "$device"
+}
+
+# Keep a byte copy of a shim that is already in place, so a failed arm can put
+# back the shim a working home was already using rather than an equivalent
+# rewrite. The trust binding is over the bytes, so a rewrite would satisfy it
+# too, but a home that was armed stays armed with what it had.
+shim_backup() {
+  local device tmp
+  device=$(fm_pr_file_device "$STATE") || return 1
+  [ -n "$device" ] || return 1
+  tmp=$(umask 077; mktemp "$STATE/.fm-tool-updates-check.XXXXXX" 2>/dev/null) || return 1
+  if ! cat "$CHECK_SHIM" > "$tmp" 2>/dev/null \
+    || ! chmod 0700 "$tmp" \
+    || ! fm_pr_private_file_valid "$tmp" 700 "$device"; then
+    rm -f -- "$tmp"
+    return 1
+  fi
+  printf '%s\n' "$tmp"
+}
+
+ARM_BACKUP=
+
+# An unregistered shim is not inert: the watcher rejects it on every cycle and
+# wakes firstmate about unauthenticated state checks. So the one rule after a
+# failed or interrupted arm is that the home never holds a shim without a
+# matching trust binding. The shim a working home had is put back and kept only
+# when it is still bound; otherwise the shim goes, so the home is plainly not
+# armed and the failure is the only thing the operator has to act on.
+arm_rollback() {
+  [ -z "$SHIM_WRITE_TMP" ] || rm -f -- "$SHIM_WRITE_TMP"
+  SHIM_WRITE_TMP=
+  if [ -n "$ARM_BACKUP" ]; then
+    mv -f -- "$ARM_BACKUP" "$CHECK_SHIM" 2>/dev/null || rm -f -- "$ARM_BACKUP"
+    ARM_BACKUP=
+    if fm_custom_check_registered "$STATE" "$CHECK_ID"; then
+      return 0
+    fi
+  fi
+  rm -f -- "$CHECK_SHIM"
+}
+
+# shellcheck disable=SC2329  # Registered by action_arm's signal trap.
+arm_interrupted() {
+  arm_rollback
+  printf 'fm-tool-update-check: arming was interrupted, so state/%s.check.sh is not armed\n' "$CHECK_ID" >&2
+  exit 1
+}
+
+action_arm() {
+  local want home
+  if [ ! -f "$CONFIG" ]; then
+    printf 'fm-tool-update-check: no watched tool registry at %s\n' "$CONFIG" >&2
+    return 1
+  fi
+  if ! config_validate || ! config_announce_patterns_usable; then
+    printf 'fm-tool-update-check: %s (%s)\n' "$CONFIG_PROBLEM" "$CONFIG" >&2
+    return 1
+  fi
+  mkdir -p "$STATE" || return 1
+  case "$FM_HOME" in
+    /*) home=$FM_HOME ;;
+    *)
+      home=$(CDPATH='' cd -- "$FM_HOME" 2>/dev/null && pwd -P) || {
+        printf 'fm-tool-update-check: cannot resolve FM_HOME %s\n' "$FM_HOME" >&2
+        return 1
+      }
+      ;;
+  esac
+  want=$(shim_content "$home")
+  ARM_BACKUP=
+  if [ -f "$CHECK_SHIM" ] && [ ! -L "$CHECK_SHIM" ]; then
+    ARM_BACKUP=$(shim_backup) || {
+      printf 'fm-tool-update-check: could not save the existing %s\n' "$CHECK_SHIM" >&2
+      return 1
+    }
+  fi
+  # The shim exists unbound from the rename until the register returns, so a
+  # signal in that window rolls back the same way a failure does.
+  trap arm_interrupted HUP INT TERM
+  if ! shim_write "$want"; then
+    trap - HUP INT TERM
+    arm_rollback
+    printf 'fm-tool-update-check: could not write %s\n' "$CHECK_SHIM" >&2
+    return 1
+  fi
+  if ! FM_HOME="$home" "$REGISTER_BIN" "$CHECK_ID" >/dev/null; then
+    trap - HUP INT TERM
+    arm_rollback
+    printf 'fm-tool-update-check: could not register %s\n' "$CHECK_SHIM" >&2
+    return 1
+  fi
+  trap - HUP INT TERM
+  [ -z "$ARM_BACKUP" ] || rm -f -- "$ARM_BACKUP"
+  ARM_BACKUP=
+  printf 'armed: state/%s.check.sh\n' "$CHECK_ID"
+  return 0
+}
+
+action_disarm() {
+  rm -f -- "$CHECK_SHIM" "$CHECK_TRUST" "$RECORD"
+  printf 'disarmed: state/%s.check.sh\n' "$CHECK_ID"
+  return 0
+}
+
+case "${1:-check}" in
+  check) action_check ;;
+  arm) action_arm ;;
+  disarm) action_disarm ;;
+  -h|--help) usage ;;
+  *) die_usage "unknown action: $1" ;;
+esac
diff --git a/docs/configuration.md b/docs/configuration.md
index 5747a10a0a..d9444dd5a1 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -334,6 +334,66 @@ The locked bootstrap inheritance pass uses the same placement-specific behavior;
 That live discovery starts from `state/*.meta` records with `kind=secondmate`; `data/secondmates.md` only backfills `home=` for older or incomplete meta records.
 Skipped items, such as a destination checkout that does not yet gitignore the item, are visible warnings but not hard failures.
 
+## Watched tool updates (config/watched-tools.json)
+
+`config/watched-tools.json` is an optional local, gitignored list of the tools this home depends on.
+When it is present and the check is armed, [`bin/fm-tool-update-check.sh`](../bin/fm-tool-update-check.sh) reports two conditions, and keeps them deliberately distinct:
+
+- `<tool> update available` means a newer version exists at the tool's update source.
+- `<tool> update not in effect` means a newer copy is already installed on this host, but `PATH` still resolves an older one.
+
+The second condition is the reason the check exists.
+An update can install correctly and stay inert because an earlier `PATH` entry still holds an older copy, and a check that only asks whether a newer version is published reports that host as up to date.
+The script therefore runs every copy of a watched command found on `PATH` and asks it for its own version, rather than trusting one lookup or reading a version out of a directory name.
+It only reports; it never installs, updates, fetches, or changes `PATH`, a version manager, or any installed tool.
+
+This section is the single owner of the canonical schema.
+`bin/fm-tool-update-check.sh` owns probe mechanics, cadence, and the report record.
+
+```json
+{
+  "tools": [
+    {
+      "name": "<label used in the report>",
+      "command": "<optional bare executable name to find on PATH>",
+      "version_args": ["<optional args that make it print its version, default --version>"],
+      "announce_pattern": "<optional extended regex matching the tool's own update announcement>",
+      "announce_args": ["<optional args for the command that carries that announcement, default version_args>"],
+      "git": {
+        "repo": "<optional absolute path to a local clone>",
+        "remote": "<optional remote name, default origin>",
+        "branch": "<optional branch, default the remote's own default branch>"
+      }
+    }
+  ]
+}
+```
+
+Each entry needs a `name` and at least one of `command` or `git`; an entry may carry both.
+A `command` entry gives the `PATH` comparison above, and adding `announce_pattern` also reports the tool's own update announcement, which is how a tool that already reports its own updates is read rather than reimplemented.
+A tool does not always announce a new release on the command that prints its version: `no-mistakes --version` prints only the version, while its other commands carry the announcement.
+`announce_args` names the command to search for the announcement in that case, and it is asked only of the copy `PATH` resolves; without it the version probe's own output is searched.
+An `announce_pattern` that is not a usable extended regular expression stops `arm`, and during a sweep it is reported as that one tool's own check failure so one broken pattern never stops the other watched tools from being checked.
+A `git` entry reports how many commits the local clone is behind its remote branch, and stays silent when the clone is current or ahead.
+An omitted `branch` uses the remote's default branch, taken from the clone's own record of it and otherwise asked of the remote directly, so a `--single-branch` clone still resolves.
+Both probe kinds are read-only and bounded, and a probe that cannot answer is reported as a check failure rather than assumed current.
+See [`docs/examples/watched-tools.json`](examples/watched-tools.json) for a starting point to copy into local `config/watched-tools.json`.
+
+Arm the check once per home with `bin/fm-tool-update-check.sh arm`.
+That writes `state/tool-updates.check.sh` and binds its bytes with `bin/fm-check-register.sh`, so the existing watcher polls it on its normal cadence and turns its one line into a `check:` wake; no separate schedule is involved.
+The armed check runs whenever that home has a watcher running, and arming alone does not make watcher supervision required, so a home with no in-flight work and no other reason to watch does not start a watcher just for this check.
+`bin/fm-tool-update-check.sh disarm` removes the shim, its trust binding, and the report record.
+The check prints nothing when everything is current, and `state/.tool-updates` records the findings the last report was made from so the same pending update is reported once instead of on every poll.
+A changed or returning condition is reported again.
+Adding, removing, or changing a watched tool is an edit to this file and needs no code change or re-arming.
+This file is not inherited by secondmate homes, so each home watches the tools it actually depends on.
+
+`FM_TOOL_UPDATE_INTERVAL` (default 900 seconds, `0` to probe on every run) sets how often probes actually run, `FM_TOOL_UPDATE_PROBE_SECS` (default 5) bounds one probe, and `FM_TOOL_UPDATE_BUDGET_SECS` (default 20) bounds a whole sweep.
+A sweep that runs out of budget says which tool it did not reach rather than reporting the rest as current.
+The sweep must finish inside `FM_CHECK_TIMEOUT` (default 30), because a run the watcher kills prints nothing and records nothing and would then repeat that silence on every poll.
+So a budget larger than that timeout allows is cut down to what fits instead of being refused, and the cut is reported in the report line.
+A budget that is not a whole number from 1 to 120 is still refused outright.
+
 ## Relay (.env)
 
 Relay lets a firstmate instance answer public mentions and act on normal reversible mention requests through firstmate's normal lifecycle.
@@ -549,6 +609,10 @@ FM_INACTIVE_RECONCILE_SECS=900  # 60..1800-second watcher cadence and inactivity
 FM_INACTIVE_RECONCILE_BUDGET_SECS=10  # 1..30-second scan deadline; wedged-scan kill backstop follows one second later
 FM_CHECK_INTERVAL=300   # seconds between slow checks (authenticated merge polls, custom checks, or Relay dispatch)
 FM_CHECK_TIMEOUT=30     # seconds allowed per slow check script
+FM_TOOL_UPDATE_INTERVAL=900   # seconds between watched-tool probe sweeps; 0 probes on every run, other values must be 60..86400
+FM_TOOL_UPDATE_PROBE_SECS=5   # 1..30 seconds allowed for one version or git probe
+FM_TOOL_UPDATE_BUDGET_SECS=20   # 1..120 seconds allowed for a whole watched-tool sweep; cut to fit FM_CHECK_TIMEOUT, and the cut is reported
+FM_TOOL_UPDATE_NOW=     # test override for the watched-tool sweep clock; the sweep budget still uses real time
 FM_PROCEVENT_MAX_OUTPUT_BYTES=1048576   # bound on one captured process-to-event result
 FM_PROCEVENT_CLAIM_ROOT=                # machine-wide source claim root; default $XDG_STATE_HOME/firstmate/procevent-claims
 FM_WHEN_OUTPUT_TAIL_BYTES=8192          # bound on the command-output tail inside one condition->action outcome document
diff --git a/docs/documentation-audiences.json b/docs/documentation-audiences.json
index f644fcb805..503cc6d5a4 100644
--- a/docs/documentation-audiences.json
+++ b/docs/documentation-audiences.json
@@ -260,6 +260,10 @@
       "path": "docs/examples/crew-dispatch.json",
       "audience": "operator-example"
     },
+    {
+      "path": "docs/examples/watched-tools.json",
+      "audience": "operator-example"
+    },
     {
       "path": "docs/examples/wedge-alarm",
       "audience": "operator-example"
diff --git a/docs/examples/watched-tools.json b/docs/examples/watched-tools.json
new file mode 100644
index 0000000000..45d63a9d74
--- /dev/null
+++ b/docs/examples/watched-tools.json
@@ -0,0 +1,24 @@
+{
+  "tools": [
+    {
+      "name": "firstmate",
+      "git": { "repo": "/absolute/path/to/firstmate", "remote": "origin" }
+    },
+    {
+      "name": "agents-on-the-go",
+      "git": { "repo": "/absolute/path/to/agents-on-the-go", "remote": "origin", "branch": "mainline" }
+    },
+    {
+      "name": "herdr",
+      "command": "herdr",
+      "version_args": ["--version"]
+    },
+    {
+      "name": "no-mistakes",
+      "command": "no-mistakes",
+      "version_args": ["--version"],
+      "announce_args": ["--help"],
+      "announce_pattern": "A new version of no-mistakes is available: [^ ]+ -> [^ ]+"
+    }
+  ]
+}
diff --git a/docs/fm-test-portable-shards.md b/docs/fm-test-portable-shards.md
index 3d295a072a..116e685c50 100644
--- a/docs/fm-test-portable-shards.md
+++ b/docs/fm-test-portable-shards.md
@@ -64,19 +64,22 @@ Each shard is still strictly serial in itself, and separate runners mean no two
 `.github/workflows/ci.yml` derives the same `n` from `strategy.job-total` rather than a literal, so changing the shard count in either file without the other fails the lane loudly instead of leaving part of the required suite unrun.
 
 Assignment is longest-processing-time bin packing over per-script duration hints embedded in `bin/fm-test-run.sh`.
-The hints came from that run's `fm-test-timing-portable-serial` artifact on 2026-08-02, where the lane ran 69 scripts in 1143762 ms of serial work.
+The hints came from the `fm-test-timing-portable-serial-*` artifacts of green CI run [32491999845](https://github.com/kunchenguid/firstmate/actions/runs/32491999845) on 2026-08-21, where the lane ran 116 scripts in 2541548 ms of serial work.
+`tests/fm-tool-update-check.test.sh` did not exist on that run, so its 12846 ms hint comes from the shard 3 artifact of run [32461816719](https://github.com/kunchenguid/firstmate/actions/runs/32461816719), which is the first run that measured it.
 A script with no hint gets the conservative `PORTABLE_SERIAL_DEFAULT_WEIGHT_MS` default.
 Hints only affect balance: the coverage guard keeps the partition complete and disjoint whatever they say, so a stale hint costs a slower shard rather than lost coverage.
+Balance is still worth keeping current, because enough unmeasured scripts let one shard carry more than twice another shard's real work and reach the job cap while another runner sits idle.
+Refresh the hints whenever the serial lane gains scripts, rather than waiting for a shard to time out.
 
 | Lane | Script count | Estimated duration |
 |---|---:|---:|
-| `portable-serial-1of4` | 15 | 285945 ms (~285.9 s) |
-| `portable-serial-2of4` | 18 | 285944 ms (~285.9 s) |
-| `portable-serial-3of4` | 17 | 285929 ms (~285.9 s) |
-| `portable-serial-4of4` | 19 | 285944 ms (~285.9 s) |
+| `portable-serial-1of4` | 29 | 638602 ms (~638.6 s) |
+| `portable-serial-2of4` | 28 | 638594 ms (~638.6 s) |
+| `portable-serial-3of4` | 30 | 638607 ms (~638.6 s) |
+| `portable-serial-4of4` | 30 | 638591 ms (~638.6 s) |
 | imbalance | | 16 ms |
 
-The single longest script, `tests/fm-pr-check-security.test.sh` at 199573 ms, is the floor for any shard count.
+The single longest script, `tests/fm-pr-check-security.test.sh` at 250417 ms, is the floor for any shard count.
 
 Refresh the hints by downloading the per-shard timing artifacts from a green CI run, replacing the `portable_serial_weight_hints` table in `bin/fm-test-run.sh` with the measured `path`/`duration_ms` pairs, and updating the table above:
 
@@ -108,7 +111,7 @@ Portable shards, each portable serial shard, and the Herdr lane upload runner-ge
 | Lane | Bound | Rationale |
 |---|---|---|
 | portable parallel 1/2 | job `timeout-minutes: 10` | The measured shard sums are about three minutes and the timeout is a hang tripwire. |
-| portable serial 1-4 | job `timeout-minutes: 15` | Each balanced shard is about five minutes, leaving roughly 3x hang-tripwire margin. |
+| portable serial 1-4 | job `timeout-minutes: 20` | Each balanced shard is about eleven minutes of measured script time, leaving roughly 2x hang-tripwire margin for job setup and runner-speed spread. |
 | Herdr | family-run step `timeout-minutes: 20`; job `timeout-minutes: 75` backstop | Healthy runs finish around 7 minutes, so the step bound is the hang tripwire (cleanup and timing artifacts still upload) while the job cap stays a last-resort backstop. |
 
 Timeouts are hang tripwires rather than expected healthy durations.
diff --git a/docs/scripts.md b/docs/scripts.md
index 3c77501a36..9f219592d7 100644
--- a/docs/scripts.md
+++ b/docs/scripts.md
@@ -103,6 +103,7 @@ The shared no-mistakes gate refusal for fleet lifecycle entrypoints is summarize
 | `fm-peek.sh`             | Print a bounded tail of a crewmate endpoint                                          |
 | `fm-check-register.sh`   | Bind an intentional custom watcher check to its current bytes                       |
 | `fm-check-lib.sh`        | Validate custom-check registrations and prepare private execution snapshots          |
+| `fm-tool-update-check.sh` | Report watched tooling with an update available, and updates installed but left inert by PATH order |
 | `fm-pr-lib.sh`           | Own canonical task and PR validation plus private atomic PR-poll publication and identity-bound retirement |
 | `fm-pr-poll.sh`          | Provide the byte-static watcher program for validated PR/MR-poll sidecars           |
 | `fm-pr-check-migrate.sh` | Quarantine older task polls without execution and rebuild only canonical polls       |
diff --git a/tests/fm-pi-watch-extension.test.sh b/tests/fm-pi-watch-extension.test.sh
index 5af0ef9106..fb473ee034 100755
--- a/tests/fm-pi-watch-extension.test.sh
+++ b/tests/fm-pi-watch-extension.test.sh
@@ -12,6 +12,18 @@ EXT="$ROOT/.pi/extensions/fm-primary-pi-watch.ts"
 # unrelated to plugin output, which the assertions intentionally require empty.
 export NODE_NO_WARNINGS=1
 
+# One owner for the readiness budget every unready-successor test below spends
+# on purpose. Both plugins start a successor arm through a login shell and
+# SIGTERM it when it stays silent past this budget, so the budget has to outlast
+# a cold login-shell start. A successor killed before its first statement never
+# appends its arm row and never installs the TERM trap these tests observe, so
+# too small a budget reports a lost successor instead of the bounded recovery
+# under test. A stock login shell already costs about 200ms on an idle
+# workstation, and a loaded CI runner is slower, so keep an order of magnitude
+# over that rather than a value that only holds locally. The wait loops in those
+# tests are sized against this number.
+ARM_READY_TIMEOUT_MS=2000
+
 install_pi_watch_extension_fixture() {
   local repo=$1
   mkdir -p \
@@ -504,7 +516,7 @@ trap 'exit 0' TERM INT
 while :; do sleep 0.02; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_PI_ARM_READY_TIMEOUT_MS=250 FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_PI_ARM_READY_TIMEOUT_MS="$ARM_READY_TIMEOUT_MS" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node --input-type=module 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -528,7 +540,9 @@ writeFileSync(`${process.env.FM_HOME}/state/.lock`, `${process.pid}\n`);
 const mod = await import(pathToFileURL(process.env.PLUGIN).href);
 mod.default(pi);
 await tool.execute("tool-call-hung-successor", {}, undefined, undefined, {});
-for (let i = 0; i < 500 && !prompt; i += 1) {
+// Three unready successors each cost the full readiness budget, so wait well
+// past their sum. The wait ends as soon as the wake lands.
+for (let i = 0; i < 1500 && !prompt; i += 1) {
   await new Promise((resolve) => setTimeout(resolve, 10));
 }
 const rows = existsSync(process.env.FM_ARM_LOG)
@@ -576,7 +590,7 @@ printf 'arm=%s\n' "$$" >> "${FM_ARM_LOG:?}"
 while [ ! -e "$FM_RELEASE_FILE" ]; do sleep 0.1; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_RELEASE_FILE="$release" FM_PI_ARM_READY_TIMEOUT_MS=250 FM_WATCH_ARM_RETIRE_TIMEOUT_MS=20 FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_RELEASE_FILE="$release" FM_PI_ARM_READY_TIMEOUT_MS="$ARM_READY_TIMEOUT_MS" FM_WATCH_ARM_RETIRE_TIMEOUT_MS=20 FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node --input-type=module 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -654,7 +668,7 @@ trap 'exit 0' TERM INT
 while [ ! -e "$FM_STOP_FILE" ]; do sleep 0.02; done
 SH
     chmod +x "$repo/bin/fm-watch-arm.sh"
-    out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_UNRETIRED_READY_FILE="$ready" FM_UNRETIRED_RETIRE_FILE="$retired" FM_RELEASE_FILE="$release" FM_STOP_FILE="$stop" FM_LATE_KIND="$kind" FM_PI_ARM_READY_TIMEOUT_MS=250 FM_WATCH_ARM_RETIRE_TIMEOUT_MS=20 FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node --input-type=module 2>&1 <<'EOF'
+    out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_UNRETIRED_READY_FILE="$ready" FM_UNRETIRED_RETIRE_FILE="$retired" FM_RELEASE_FILE="$release" FM_STOP_FILE="$stop" FM_LATE_KIND="$kind" FM_PI_ARM_READY_TIMEOUT_MS="$ARM_READY_TIMEOUT_MS" FM_WATCH_ARM_RETIRE_TIMEOUT_MS=20 FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node --input-type=module 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -1412,7 +1426,16 @@ const hooks = await mod.FmPrimaryWatchArm({
 const event = { event: { type: "session.idle", properties: { sessionID: "session-test" } } };
 writeFileSync(`${process.env.FM_HOME}/state/.lock`, "999999\n");
 await hooks.event(event);
-await new Promise((resolve) => setTimeout(resolve, 120));
+// The hook starts its attempt without awaiting it, and the plugin answers a
+// second attempt from the one already in flight. Join that attempt through the
+// coordinator rather than waiting a fixed span: refusing an unowned lock walks
+// git and ps probes that can outlast any such span, and the owned-lock event
+// below would then be answered from the refusal instead of arming.
+const refusal = await globalThis.__firstmateOpenCodeWatchArm.ensureArmed("session-test", client);
+if (refusal !== "read-only") {
+  console.error(`expected a read-only refusal without the session lock, got ${refusal}`);
+  process.exit(1);
+}
 if (existsSync(process.env.FM_ARM_LOG)) {
   console.error("watch arm ran without owning the session lock");
   process.exit(1);
@@ -1680,7 +1703,7 @@ trap 'exit 0' TERM INT
 while :; do sleep 0.02; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_OPENCODE_ARM_READY_TIMEOUT_MS=250 FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_OPENCODE_ARM_READY_TIMEOUT_MS="$ARM_READY_TIMEOUT_MS" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -1704,7 +1727,9 @@ const hooks = await mod.FmPrimaryWatchArm({
 });
 writeFileSync(`${process.env.FM_HOME}/state/.lock`, `${process.pid}\n`);
 await hooks.event({ event: { type: "session.idle", properties: { sessionID: "session-test" } } });
-for (let i = 0; i < 500 && !prompt; i += 1) {
+// Three unready successors each cost the full readiness budget, so wait well
+// past their sum. The wait ends as soon as the wake lands.
+for (let i = 0; i < 1500 && !prompt; i += 1) {
   await new Promise((resolve) => setTimeout(resolve, 10));
 }
 const rows = existsSync(process.env.FM_ARM_LOG)
@@ -1754,7 +1779,7 @@ printf 'arm=%s\n' "$$" >> "${FM_ARM_LOG:?}"
 while [ ! -e "$FM_RELEASE_FILE" ]; do sleep 0.1; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_RELEASE_FILE="$release" FM_OPENCODE_ARM_READY_TIMEOUT_MS=250 FM_WATCH_ARM_RETIRE_TIMEOUT_MS=20 FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_RELEASE_FILE="$release" FM_OPENCODE_ARM_READY_TIMEOUT_MS="$ARM_READY_TIMEOUT_MS" FM_WATCH_ARM_RETIRE_TIMEOUT_MS=20 FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -1834,7 +1859,7 @@ trap 'exit 0' TERM INT
 while [ ! -e "$FM_STOP_FILE" ]; do sleep 0.02; done
 SH
     chmod +x "$repo/bin/fm-watch-arm.sh"
-    out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_UNRETIRED_READY_FILE="$ready" FM_UNRETIRED_RETIRE_FILE="$retired" FM_RELEASE_FILE="$release" FM_STOP_FILE="$stop" FM_LATE_KIND="$kind" FM_OPENCODE_ARM_READY_TIMEOUT_MS=250 FM_WATCH_ARM_RETIRE_TIMEOUT_MS=20 FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node 2>&1 <<'EOF'
+    out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_UNRETIRED_READY_FILE="$ready" FM_UNRETIRED_RETIRE_FILE="$retired" FM_RELEASE_FILE="$release" FM_STOP_FILE="$stop" FM_LATE_KIND="$kind" FM_OPENCODE_ARM_READY_TIMEOUT_MS="$ARM_READY_TIMEOUT_MS" FM_WATCH_ARM_RETIRE_TIMEOUT_MS=20 FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
diff --git a/tests/fm-remote-job.test.sh b/tests/fm-remote-job.test.sh
index 82f1cf8cce..753c139efe 100755
--- a/tests/fm-remote-job.test.sh
+++ b/tests/fm-remote-job.test.sh
@@ -18,6 +18,7 @@ FAKE_PERL_LOG="$TMP_ROOT/perl.log"
 REAL_GIT=$(command -v git)
 OTHER_PID=
 RECOVERY_WORKER_PID=
+REPEAT_WORKER_PID=
 mkdir -p "$REMOTE_ROOT/bin" "$REMOTE_HOME" "$ACCOUNT_HOME" "$RUNTIME_BIN"
 # worker.pid records the serving child, not its restart supervisor, so stopping
 # that pid alone leaves the supervisor to respawn - the leak
@@ -25,6 +26,7 @@ mkdir -p "$REMOTE_ROOT/bin" "$REMOTE_HOME" "$ACCOUNT_HOME" "$RUNTIME_BIN"
 cleanup_remote_job_fixture() {
   [ -z "$OTHER_PID" ] || kill "$OTHER_PID" 2>/dev/null || true
   [ -z "$RECOVERY_WORKER_PID" ] || kill "$RECOVERY_WORKER_PID" 2>/dev/null || true
+  [ -z "$REPEAT_WORKER_PID" ] || kill "$REPEAT_WORKER_PID" 2>/dev/null || true
   if [ -f "$STATE_ROOT/worker.pid" ]; then
     fm_remote_job_stop_worker_tree "$(cat "$STATE_ROOT/worker.pid")" || true
   fi
@@ -621,4 +623,56 @@ wait "$RECOVERY_WORKER_PID" 2>/dev/null || true
 RECOVERY_WORKER_PID=
 pass "quarantine clears only after recorded execution has stopped"
 
+# A replacement stops a Linux worker by signalling its whole isolated group, and
+# the supervisor in that group forwards a second stop signal to the same serving
+# child, so the serving child is always signalled more than once. Keep signalling
+# until it is gone: the first signal starts the shutdown and every later one
+# lands inside it, the same way the group signal and the forwarded signal do. A
+# shutdown that dies part way through leaves its ownership lock behind holding a
+# half-written temp file no later worker can clear, and every replacement then
+# fails to report ready.
+REPEAT_HOME="$TMP_ROOT/repeat-signal-account"
+REPEAT_STATE="$TMP_ROOT/repeat-signal-jobs"
+mkdir -p "$REPEAT_HOME"
+chmod 700 "$REPEAT_HOME"
+HOME="$REPEAT_HOME" FM_ROOT_OVERRIDE="$REMOTE_ROOT" FM_REMOTE_JOB_STATE_ROOT="$REPEAT_STATE" \
+  FM_REMOTE_JOB_PLATFORM_OVERRIDE=Linux "$REMOTE_ROOT/bin/fm-remote-job-worker.sh" --serve \
+  > "$TMP_ROOT/repeat-signal.out" 2> "$TMP_ROOT/repeat-signal.err" &
+REPEAT_WORKER_PID=$!
+for _ in $(seq 1 300); do
+  [ -f "$REPEAT_STATE/worker.ready" ] && break
+  sleep 0.05
+done
+assert_present "$REPEAT_STATE/worker.ready" "the repeated-signal worker did not become ready"
+REPEAT_DEADLINE=$((SECONDS + 30))
+while kill -0 "$REPEAT_WORKER_PID" 2>/dev/null && [ "$SECONDS" -lt "$REPEAT_DEADLINE" ]; do
+  kill -TERM "$REPEAT_WORKER_PID" 2>/dev/null || true
+done
+if kill -0 "$REPEAT_WORKER_PID" 2>/dev/null; then
+  kill -KILL "$REPEAT_WORKER_PID" 2>/dev/null || true
+  wait "$REPEAT_WORKER_PID" 2>/dev/null || true
+  REPEAT_WORKER_PID=
+  fail "the repeatedly signalled worker never finished its shutdown"
+fi
+wait "$REPEAT_WORKER_PID" 2>/dev/null || true
+REPEAT_WORKER_PID=
+assert_absent "$REPEAT_STATE/worker.lock" \
+  "a repeatedly signalled shutdown left its ownership lock behind"
+assert_absent "$REPEAT_STATE/worker.ready" \
+  "a repeatedly signalled shutdown left its readiness heartbeat behind"
+HOME="$REPEAT_HOME" FM_ROOT_OVERRIDE="$REMOTE_ROOT" FM_REMOTE_JOB_STATE_ROOT="$REPEAT_STATE" \
+  FM_REMOTE_JOB_PLATFORM_OVERRIDE=Linux "$REMOTE_ROOT/bin/fm-remote-job-worker.sh" --serve \
+  >> "$TMP_ROOT/repeat-signal.out" 2>> "$TMP_ROOT/repeat-signal.err" &
+REPEAT_WORKER_PID=$!
+for _ in $(seq 1 600); do
+  [ -f "$REPEAT_STATE/worker.ready" ] && break
+  sleep 0.05
+done
+assert_present "$REPEAT_STATE/worker.ready" \
+  "the worker after a repeatedly signalled shutdown never reported ready"
+kill -TERM "$REPEAT_WORKER_PID"
+wait "$REPEAT_WORKER_PID" 2>/dev/null || true
+REPEAT_WORKER_PID=
+pass "a repeatedly signalled shutdown still releases ownership for the next worker"
+
 echo "ALL TESTS PASSED"
diff --git a/tests/fm-tool-update-check.test.sh b/tests/fm-tool-update-check.test.sh
new file mode 100755
index 0000000000..2f8843a821
--- /dev/null
+++ b/tests/fm-tool-update-check.test.sh
@@ -0,0 +1,1039 @@
+#!/usr/bin/env bash
+# Tests for fm-tool-update-check.sh, the watched tooling update report.
+#
+# The case that matters most is PATH skew: a tool that has already installed its
+# newer copy, while PATH still resolves an older one. On 2026-08-20 that exact
+# shape broke this fleet. Herdr self-installed 0.8.2 into ~/.local/bin, a version
+# manager kept its own 0.8.0 earlier on PATH inside a directory named "latest",
+# and every Herdr command then failed on a protocol mismatch. A check that only
+# asks "is a newer version published" reports everything up to date and misses
+# it, so test_path_skew_is_reported_from_every_copy reproduces the incident and
+# asserts the report names the older copy PATH resolves AND the newer copy that
+# is already installed. A single `command -v` lookup cannot know the second
+# version, so that assertion fails against any build without real per-copy
+# probing.
+#
+# The fixtures use a synthetic command name and their own temporary PATH
+# directories, so no case ever probes, launches, or otherwise touches a tool
+# actually installed on this host.
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+CHECK="$ROOT/bin/fm-tool-update-check.sh"
+CHECKPOINT="$ROOT/bin/fm-watch-checkpoint.sh"
+TMP_ROOT=$(fm_test_tmproot fm-tool-update-check)
+
+# Exported here, at the top level, because git_fixture runs inside a command
+# substitution and an export from that subshell never reaches the cases, which
+# make fixture commits of their own. A host with no git identity configured
+# would otherwise fail those commits and leave the fixture in a shape the case
+# did not ask for.
+fm_git_identity fmtest fmtest@example.invalid
+
+# The incident's tool, under a name that cannot exist on this host.
+TOOL=herdr-fixture
+
+make_home() {
+  local name=$1 home
+  home="$TMP_ROOT/$name"
+  mkdir -p "$home/state" "$home/config"
+  printf '%s\n' "$home"
+}
+
+# make_copy <dir> <command> <version-output>: an executable copy that answers
+# --version with the given text and nothing else.
+make_copy() {
+  local dir=$1 command_name=$2 text=$3
+  mkdir -p "$dir"
+  cat > "$dir/$command_name" <<SH
+#!/usr/bin/env bash
+printf '%s\n' '$text'
+SH
+  chmod 0755 "$dir/$command_name"
+}
+
+# make_slow_copy <dir> <command> <seconds>: a copy that answers far too late, so a
+# case can spend the sweep budget the way a hung tool would.
+make_slow_copy() {
+  local dir=$1 command_name=$2 seconds=$3
+  mkdir -p "$dir"
+  cat > "$dir/$command_name" <<SH
+#!/usr/bin/env bash
+sleep $seconds
+printf 'herdr 0.8.2\n'
+SH
+  chmod 0755 "$dir/$command_name"
+}
+
+# make_counting_copy <dir> <command> <version-output> <log>: the same copy, which
+# also appends one line to <log> every time it runs, so a case can assert how
+# many times the check actually probed it.
+make_counting_copy() {
+  local dir=$1 command_name=$2 text=$3 log=$4
+  mkdir -p "$dir"
+  cat > "$dir/$command_name" <<SH
+#!/usr/bin/env bash
+printf 'probed\n' >> '$log'
+printf '%s\n' '$text'
+SH
+  chmod 0755 "$dir/$command_name"
+}
+
+write_config() {
+  local home=$1
+  shift
+  printf '%s\n' "$*" > "$home/config/watched-tools.json"
+}
+
+# The fixture directories first, then the ambient PATH, which the check needs
+# because it shells out to ordinary tools such as jq, git, date, grep, stat, and
+# timeout. What keeps a tool installed on this host out of a fixture is the
+# synthetic command name, not this PATH, so every case watches a command name
+# that cannot exist here.
+fixture_path() {
+  printf '%s:%s\n' "$1" "$PATH"
+}
+
+# The watcher check timeout is pinned to its documented default here, because the
+# sweep budget is cut to fit it and an operator's ambient value would otherwise
+# add a report line to cases that mean to be silent. The one case that exercises
+# the cut sets its own value.
+run_check() {
+  local home=$1 path=$2 out=$3
+  shift 3
+  local status=0
+  env FM_CHECK_TIMEOUT=30 "$@" FM_HOME="$home" PATH="$path" FM_TOOL_UPDATE_INTERVAL=0 "$CHECK" >"$out" 2>&1 || status=$?
+  expect_code 0 "$status" "check exit"
+}
+
+# --- the regression this script exists for ----------------------------------
+
+test_path_skew_is_reported_from_every_copy() {
+  local home stale fresh out report
+  home=$(make_home skew)
+  # The stale copy sits in a directory named "latest" on purpose: the incident's
+  # version manager did exactly that, so a directory name is no evidence at all.
+  stale="$TMP_ROOT/skew/mise/installs/herdr/latest/bin"
+  fresh="$TMP_ROOT/skew/local/bin"
+  make_copy "$stale" "$TOOL" 'herdr 0.8.0'
+  make_copy "$fresh" "$TOOL" 'herdr 0.8.2'
+  write_config "$home" "{\"tools\":[{\"name\":\"herdr\",\"command\":\"$TOOL\",\"version_args\":[\"--version\"]}]}"
+  out="$home/out.txt"
+  run_check "$home" "$(fixture_path "$stale:$fresh")" "$out"
+  report=$(cat "$out")
+
+  assert_contains "$report" "herdr update not in effect" "PATH skew was not reported as an update that is not in effect"
+  # Both sides of the comparison must be named, and the newer one can only be
+  # known by asking a copy other than the one PATH resolves.
+  assert_contains "$report" "PATH resolves 0.8.0 at $stale/$TOOL" "the report does not name the older version PATH actually resolves"
+  assert_contains "$report" "0.8.2 is installed at $fresh/$TOOL" "the report does not name the newer installed copy, so no other PATH copy was asked for its version"
+  assert_not_contains "$report" "update available" "PATH skew must not be reported as a published update"
+  assert_contains "$report" "$(printf 'tool updates:')" "the report is missing its one-line prefix"
+  [ "$(wc -l < "$out")" = 1 ] || fail "the report must be exactly one line for the wake record"
+  pass "PATH skew is reported by asking every copy on PATH for its own version"
+}
+
+test_newest_copy_first_on_path_is_silent() {
+  local home stale fresh out
+  # Control for the case above: the same two copies, the newer one resolved
+  # first, must produce no report at all.
+  home=$(make_home no-skew)
+  stale="$TMP_ROOT/no-skew/mise/installs/herdr/latest/bin"
+  fresh="$TMP_ROOT/no-skew/local/bin"
+  make_copy "$stale" "$TOOL" 'herdr 0.8.0'
+  make_copy "$fresh" "$TOOL" 'herdr 0.8.2'
+  write_config "$home" "{\"tools\":[{\"name\":\"herdr\",\"command\":\"$TOOL\"}]}"
+  out="$home/out.txt"
+  run_check "$home" "$(fixture_path "$fresh:$stale")" "$out"
+  [ ! -s "$out" ] || fail "check reported skew when PATH already resolves the newest copy: $(cat "$out")"
+  pass "no report when PATH already resolves the newest installed copy"
+}
+
+test_identical_versions_are_silent() {
+  local home first second out
+  home=$(make_home same-version)
+  first="$TMP_ROOT/same-version/a/bin"
+  second="$TMP_ROOT/same-version/b/bin"
+  make_copy "$first" "$TOOL" 'herdr 0.8.2'
+  make_copy "$second" "$TOOL" 'herdr 0.8.2'
+  write_config "$home" "{\"tools\":[{\"name\":\"herdr\",\"command\":\"$TOOL\"}]}"
+  out="$home/out.txt"
+  run_check "$home" "$(fixture_path "$first:$second")" "$out"
+  [ ! -s "$out" ] || fail "two copies of the same version reported skew: $(cat "$out")"
+  pass "two copies of the same version are not skew"
+}
+
+test_one_copy_reached_twice_is_probed_once() {
+  local home dir link out log probes
+  # A single install reachable through two PATH entries must not read as two
+  # installs, or a symlinked bin directory would report skew against itself.
+  # Silence alone does not prove that, because two answers of the same version
+  # are silent too, so count the probes: the one install must be asked once.
+  home=$(make_home one-copy)
+  dir="$TMP_ROOT/one-copy/real/bin"
+  link="$TMP_ROOT/one-copy/linked-bin"
+  log="$TMP_ROOT/one-copy/probes.log"
+  make_counting_copy "$dir" "$TOOL" 'herdr 0.8.2' "$log"
+  ln -s "$dir" "$link"
+  write_config "$home" "{\"tools\":[{\"name\":\"herdr\",\"command\":\"$TOOL\"}]}"
+  out="$home/out.txt"
+  : > "$log"
+  run_check "$home" "$(fixture_path "$dir:$link")" "$out"
+  [ ! -s "$out" ] || fail "one copy reached through two PATH entries reported a finding: $(cat "$out")"
+  probes=$(wc -l < "$log" | tr -d ' ')
+  [ "$probes" = 1 ] || fail "one install reached through two PATH entries was probed $probes times, so the two entries were not recognized as one install"
+  pass "one copy reached through two PATH entries is probed once as one install"
+}
+
+test_unreadable_version_is_a_failure_not_a_pass() {
+  local home dir out report
+  # A copy that will not say what it is cannot be called current.
+  home=$(make_home mute)
+  dir="$TMP_ROOT/mute/bin"
+  make_copy "$dir" "$TOOL" 'no version here'
+  write_config "$home" "{\"tools\":[{\"name\":\"herdr\",\"command\":\"$TOOL\"}]}"
+  out="$home/out.txt"
+  run_check "$home" "$(fixture_path "$dir")" "$out"
+  report=$(cat "$out")
+  assert_contains "$report" "herdr check failed" "a copy that reports no version was treated as current"
+  assert_contains "$report" "$dir/$TOOL did not report a version" "the failing copy was not named"
+  pass "a copy that reports no version is a check failure, not a pass"
+}
+
+test_missing_command_is_reported() {
+  local home out
+  home=$(make_home absent)
+  write_config "$home" '{"tools":[{"name":"herdr","command":"herdr-absent-fixture"}]}'
+  out="$home/out.txt"
+  run_check "$home" "$PATH" "$out"
+  assert_contains "$(cat "$out")" "herdr check failed: herdr-absent-fixture is not on PATH" "a watched command missing from PATH was not reported"
+  pass "a watched command missing from PATH is reported"
+}
+
+# --- published updates ------------------------------------------------------
+
+test_announced_update_is_reported_from_the_tool_itself() {
+  local home dir out report
+  # no-mistakes already announces its own update on stderr; read that rather
+  # than reimplementing its version lookup.
+  home=$(make_home announce)
+  dir="$TMP_ROOT/announce/bin"
+  mkdir -p "$dir"
+  cat > "$dir/no-mistakes-fixture" <<'SH'
+#!/usr/bin/env bash
+printf '1.46.0\n'
+printf 'A new version of no-mistakes is available: v1.46.0 -> v1.47.0\n' >&2
+SH
+  chmod 0755 "$dir/no-mistakes-fixture"
+  write_config "$home" '{"tools":[{"name":"no-mistakes","command":"no-mistakes-fixture","announce_pattern":"A new version of no-mistakes is available: [^ ]+ -> [^ ]+"}]}'
+  out="$home/out.txt"
+  run_check "$home" "$(fixture_path "$dir")" "$out"
+  report=$(cat "$out")
+  assert_contains "$report" "no-mistakes update available: A new version of no-mistakes is available: v1.46.0 -> v1.47.0" "the tool's own update announcement was not reported"
+  assert_not_contains "$report" "not in effect" "a published update must not be reported as PATH skew"
+  pass "a tool's own update announcement is read from its output"
+}
+
+test_announcement_is_read_from_a_second_command() {
+  local home dir out report quiet_home
+  # The real no-mistakes prints its version for --version but announces a new
+  # release only on its other commands, so the announcement has to be asked of a
+  # command of its own while the version probe keeps reporting the version.
+  home=$(make_home announce-args)
+  dir="$TMP_ROOT/announce-args/bin"
+  mkdir -p "$dir"
+  cat > "$dir/no-mistakes-fixture" <<'SH'
+#!/usr/bin/env bash
+if [ "${1:-}" = "--version" ]; then
+  printf 'no-mistakes version v1.46.0\n'
+  exit 0
+fi
+printf 'A new version of no-mistakes is available: v1.46.0 -> v1.53.0\n' >&2
+printf 'Usage: no-mistakes <command>\n'
+SH
+  chmod 0755 "$dir/no-mistakes-fixture"
+  out="$home/out.txt"
+
+  write_config "$home" '{"tools":[{"name":"no-mistakes","command":"no-mistakes-fixture","version_args":["--version"],"announce_args":["--help"],"announce_pattern":"A new version of no-mistakes is available: [^ ]+ -> [^ ]+"}]}'
+  run_check "$home" "$(fixture_path "$dir")" "$out"
+  report=$(cat "$out")
+  assert_contains "$report" "no-mistakes update available: A new version of no-mistakes is available: v1.46.0 -> v1.53.0" "the announcement was not read from the command that carries it"
+  assert_not_contains "$report" "check failed" "the version probe stopped reporting this copy's version"
+
+  # Control: the same tool watched without announce_args sees only the version
+  # probe, which never carries the announcement, so the update is missed.
+  quiet_home=$(make_home announce-args-control)
+  write_config "$quiet_home" '{"tools":[{"name":"no-mistakes","command":"no-mistakes-fixture","version_args":["--version"],"announce_pattern":"A new version of no-mistakes is available: [^ ]+ -> [^ ]+"}]}'
+  run_check "$quiet_home" "$(fixture_path "$dir")" "$quiet_home/out.txt"
+  [ ! -s "$quiet_home/out.txt" ] || fail "the control home reported without a second command, so this test proves nothing: $(cat "$quiet_home/out.txt")"
+  pass "an announcement carried by another command is read from that command"
+}
+
+test_unusable_announce_pattern_is_reported_not_read_as_silence() {
+  local home dir out status
+  # A pattern the search cannot use answers exactly like a tool with nothing to
+  # announce, which is the silently dead update source this check exists to
+  # prevent. It is reported as that tool's own check failure.
+  home=$(make_home bad-pattern)
+  dir="$TMP_ROOT/bad-pattern/bin"
+  make_copy "$dir" no-mistakes-fixture 'no-mistakes version v1.46.0'
+  write_config "$home" '{"tools":[{"name":"no-mistakes","command":"no-mistakes-fixture","announce_pattern":"A new version of no-mistakes is available: ([^ ]+ -> [^ ]+"}]}'
+  out="$home/out.txt"
+  run_check "$home" "$(fixture_path "$dir")" "$out"
+  assert_contains "$(cat "$out")" "no-mistakes check failed: announce_pattern is not a usable extended regular expression" "a pattern that cannot be used was read as nothing to announce"
+
+  # Arming is a deliberate operator action, so the same registry refuses it
+  # rather than arming a check with a source that can never fire.
+  status=0
+  FM_HOME="$home" "$CHECK" arm >/dev/null 2>&1 || status=$?
+  expect_code 1 "$status" "arm with an unusable announce_pattern exit"
+  assert_absent "$home/state/tool-updates.check.sh" "arm registered a check whose announcement source cannot fire"
+  pass "an announce_pattern that cannot be used is reported instead of read as silence"
+}
+
+test_one_broken_pattern_does_not_blind_the_rest_of_the_sweep() {
+  local home stale fresh dir out report
+  # A one character typo in one tool's pattern must not turn off the detector for
+  # every other tool. The PATH skew below is the whole reason this check exists,
+  # so it has to be reported in the same sweep as the pattern problem.
+  home=$(make_home pattern-blind)
+  stale="$TMP_ROOT/pattern-blind/mise/installs/herdr/latest/bin"
+  fresh="$TMP_ROOT/pattern-blind/local/bin"
+  dir="$TMP_ROOT/pattern-blind/announce/bin"
+  make_copy "$stale" "$TOOL" 'herdr 0.8.0'
+  make_copy "$fresh" "$TOOL" 'herdr 0.8.2'
+  make_copy "$dir" no-mistakes-fixture 'no-mistakes version v1.46.0'
+  write_config "$home" "{\"tools\":[{\"name\":\"herdr\",\"command\":\"$TOOL\"},{\"name\":\"no-mistakes\",\"command\":\"no-mistakes-fixture\",\"announce_pattern\":\"A new version of no-mistakes is available: ([^ ]+ -> [^ ]+\"}]}"
+  out="$home/out.txt"
+  run_check "$home" "$(fixture_path "$stale:$fresh:$dir")" "$out"
+  report=$(cat "$out")
+  assert_contains "$report" "herdr update not in effect: PATH resolves 0.8.0 at $stale/$TOOL" "a broken pattern on another tool suppressed the PATH skew report"
+  assert_contains "$report" "no-mistakes check failed: announce_pattern is not a usable extended regular expression" "the tool whose pattern cannot be used was not named"
+  [ "$(wc -l < "$out")" = 1 ] || fail "the report must stay exactly one line"
+  pass "a broken pattern is reported for its own tool and the rest of the sweep still reports"
+}
+
+test_an_unchecked_announcement_source_is_not_read_as_current() {
+  local home dir out report
+  # When the budget is gone the separate announcement command cannot run, and the
+  # version probe's output never carries the announcement. Searching that output
+  # anyway would present a source that was never asked as a clean result, which is
+  # the same silently dead source announce_args was added to close.
+  home=$(make_home announce-budget)
+  dir="$TMP_ROOT/announce-budget/bin"
+  mkdir -p "$dir"
+  cat > "$dir/no-mistakes-fixture" <<'SH'
+#!/usr/bin/env bash
+if [ "${1:-}" = "--version" ]; then
+  printf 'no-mistakes version v1.46.0\n'
+  sleep 30
+  exit 0
+fi
+printf 'A new version of no-mistakes is available: v1.46.0 -> v1.53.0\n' >&2
+SH
+  chmod 0755 "$dir/no-mistakes-fixture"
+  write_config "$home" '{"tools":[{"name":"no-mistakes","command":"no-mistakes-fixture","version_args":["--version"],"announce_args":["--help"],"announce_pattern":"A new version of no-mistakes is available: [^ ]+ -> [^ ]+"}]}'
+  out="$home/out.txt"
+  run_check "$home" "$(fixture_path "$dir")" "$out" FM_TOOL_UPDATE_BUDGET_SECS=1
+  report=$(cat "$out")
+  assert_contains "$report" "no-mistakes check failed: the time budget ran out before the update announcement was checked" "an announcement source that was never asked was not reported"
+  pass "an announcement source the budget could not reach is reported, not read as current"
+}
+
+test_an_announcement_probe_that_does_not_answer_is_reported() {
+  local home dir out report
+  # no-mistakes learns about a new release from the network, so the command that
+  # carries the announcement is exactly the one that stalls on a flaky link. A
+  # source that was asked and never answered must not read as a clean sweep.
+  home=$(make_home announce-mute)
+  dir="$TMP_ROOT/announce-mute/bin"
+  mkdir -p "$dir"
+  cat > "$dir/no-mistakes-fixture" <<'SH'
+#!/usr/bin/env bash
+if [ "${1:-}" = "--version" ]; then
+  printf 'no-mistakes version v1.46.0\n'
+  exit 0
+fi
+sleep 30
+SH
+  chmod 0755 "$dir/no-mistakes-fixture"
+  write_config "$home" '{"tools":[{"name":"no-mistakes","command":"no-mistakes-fixture","version_args":["--version"],"announce_args":["--help"],"announce_pattern":"A new version of no-mistakes is available: [^ ]+ -> [^ ]+"}]}'
+  out="$home/out.txt"
+  run_check "$home" "$(fixture_path "$dir")" "$out" FM_TOOL_UPDATE_PROBE_SECS=1
+  report=$(cat "$out")
+  assert_contains "$report" "no-mistakes check failed: $dir/no-mistakes-fixture did not answer when asked for its update announcement" "an announcement probe that never answered was read as a clean sweep"
+  pass "an announcement probe that does not answer is reported, not read as current"
+}
+
+test_quiet_tool_with_announce_pattern_is_silent() {
+  local home dir out
+  home=$(make_home announce-quiet)
+  dir="$TMP_ROOT/announce-quiet/bin"
+  make_copy "$dir" no-mistakes-fixture '1.46.0'
+  write_config "$home" '{"tools":[{"name":"no-mistakes","command":"no-mistakes-fixture","announce_pattern":"A new version of no-mistakes is available: [^ ]+ -> [^ ]+"}]}'
+  out="$home/out.txt"
+  run_check "$home" "$(fixture_path "$dir")" "$out"
+  [ ! -s "$out" ] || fail "a tool announcing nothing produced a report: $(cat "$out")"
+  pass "a tool that announces nothing stays silent"
+}
+
+# --- git sources ------------------------------------------------------------
+
+# git_fixture <name>: a work repo whose origin branch is two commits ahead,
+# with those commits already present locally so the count is exact.
+git_fixture() {
+  local name=$1 bare work
+  bare="$TMP_ROOT/$name.git"
+  work="$TMP_ROOT/$name"
+  git init -q --bare --initial-branch=main "$bare"
+  git clone -q "$bare" "$work" 2>/dev/null
+  printf 'one\n' > "$work/f1"
+  git -C "$work" add f1
+  git -C "$work" commit -qm one
+  printf 'two\n' > "$work/f2"
+  git -C "$work" add f2
+  git -C "$work" commit -qm two
+  printf 'three\n' > "$work/f3"
+  git -C "$work" add f3
+  git -C "$work" commit -qm three
+  git -C "$work" push -q origin main
+  git -C "$work" remote set-head origin main >/dev/null 2>&1
+  printf '%s\n' "$work"
+}
+
+test_commits_behind_origin_are_reported() {
+  local home work out head_before
+  home=$(make_home git-behind)
+  work=$(git_fixture git-behind-repo)
+  git -C "$work" reset -q --hard HEAD~2
+  head_before=$(git -C "$work" rev-parse HEAD)
+  write_config "$home" "{\"tools\":[{\"name\":\"firstmate\",\"git\":{\"repo\":\"$work\",\"remote\":\"origin\",\"branch\":\"main\"}}]}"
+  out="$home/out.txt"
+  run_check "$home" "$PATH" "$out"
+  assert_contains "$(cat "$out")" "firstmate update available: local main is 2 commits behind origin/main" "commits behind the origin branch were not reported"
+  # The probe is read-only: the watched repository must be untouched.
+  [ "$(git -C "$work" rev-parse HEAD)" = "$head_before" ] || fail "the check moved the watched repository's HEAD"
+  git -C "$work" diff --quiet || fail "the check left changes in the watched repository"
+  pass "commits behind the origin branch are reported without touching the repository"
+}
+
+test_default_branch_is_detected_when_branch_is_omitted() {
+  local home work out
+  home=$(make_home git-default)
+  work=$(git_fixture git-default-repo)
+  git -C "$work" reset -q --hard HEAD~1
+  write_config "$home" "{\"tools\":[{\"name\":\"firstmate\",\"git\":{\"repo\":\"$work\"}}]}"
+  out="$home/out.txt"
+  run_check "$home" "$PATH" "$out"
+  assert_contains "$(cat "$out")" "firstmate update available: local main is 1 commit behind origin/main" "the default branch was not detected from the remote"
+  pass "an omitted branch is detected from the remote's default branch"
+}
+
+test_default_branch_is_asked_of_the_remote_when_the_clone_has_no_record() {
+  local home work out
+  # A --single-branch clone, or one that never ran remote set-head, has no local
+  # refs/remotes/origin/HEAD. The remote still knows its default branch, so this
+  # must report the update rather than an unactionable check failure.
+  home=$(make_home git-symref)
+  work=$(git_fixture git-symref-repo)
+  git -C "$work" remote set-head origin --delete >/dev/null 2>&1
+  git -C "$work" reset -q --hard HEAD~2
+  # Ask git what it knows rather than looking for a loose ref file, which never
+  # exists under a non-loose ref backend and would make this vacuous there.
+  ! git -C "$work" symbolic-ref --quiet refs/remotes/origin/HEAD >/dev/null 2>&1 \
+    || fail "the fixture still records the remote's default branch locally"
+  write_config "$home" "{\"tools\":[{\"name\":\"firstmate\",\"git\":{\"repo\":\"$work\"}}]}"
+  out="$home/out.txt"
+  run_check "$home" "$PATH" "$out"
+  assert_contains "$(cat "$out")" "firstmate update available: local main is 2 commits behind origin/main" "the default branch was not asked of the remote"
+  pass "the default branch is asked of the remote when the clone has no local record"
+}
+
+test_current_and_ahead_repositories_are_silent() {
+  local home work out
+  home=$(make_home git-current)
+  work=$(git_fixture git-current-repo)
+  write_config "$home" "{\"tools\":[{\"name\":\"firstmate\",\"git\":{\"repo\":\"$work\",\"branch\":\"main\"}}]}"
+  out="$home/out.txt"
+  run_check "$home" "$PATH" "$out"
+  [ ! -s "$out" ] || fail "an up to date repository produced a report: $(cat "$out")"
+
+  printf 'local only\n' > "$work/f4"
+  git -C "$work" add f4
+  git -C "$work" commit -qm four
+  rm -f "$home/state/.tool-updates"
+  run_check "$home" "$PATH" "$out"
+  [ ! -s "$out" ] || fail "a repository ahead of its origin branch produced a report: $(cat "$out")"
+  pass "a repository that is current or ahead of its origin branch is silent"
+}
+
+test_unusable_git_source_is_reported() {
+  local home out
+  home=$(make_home git-broken)
+  mkdir -p "$TMP_ROOT/git-broken/not-a-repo"
+  write_config "$home" "{\"tools\":[{\"name\":\"firstmate\",\"git\":{\"repo\":\"$TMP_ROOT/git-broken/not-a-repo\",\"branch\":\"main\"}}]}"
+  out="$home/out.txt"
+  run_check "$home" "$PATH" "$out"
+  assert_contains "$(cat "$out")" "firstmate check failed" "an unusable git source was not reported"
+  pass "an unusable git source is reported as a check failure"
+}
+
+test_unreadable_remote_is_not_reported_as_a_missing_branch() {
+  local home work out report
+  # A remote that cannot be reached at all and a branch that was deleted are
+  # different problems with different repairs. Reporting the first as the second
+  # wakes firstmate with a diagnosis that is simply wrong, so the report must
+  # name only what the probe established.
+  home=$(make_home git-unreadable)
+  work=$(git_fixture git-unreadable-repo)
+  rm -rf "$TMP_ROOT/git-unreadable-repo.git"
+  write_config "$home" "{\"tools\":[{\"name\":\"firstmate\",\"git\":{\"repo\":\"$work\",\"remote\":\"origin\",\"branch\":\"main\"}}]}"
+  out="$home/out.txt"
+  run_check "$home" "$PATH" "$out"
+  report=$(cat "$out")
+  assert_contains "$report" "firstmate check failed" "a remote that could not be read was not reported"
+  assert_contains "$report" "origin could not be reached or read" "the report does not name the condition the probe actually found"
+  assert_not_contains "$report" "has no branch" "a remote that could not be read was reported as a deleted branch"
+  pass "a remote that cannot be read is reported as unreadable, not as a missing branch"
+}
+
+test_missing_branch_on_a_readable_remote_is_still_reported() {
+  local home work out
+  # The other side of the case above: the remote answers, and it really does not
+  # have the watched branch, so that must still be reported as a missing branch.
+  home=$(make_home git-no-branch)
+  work=$(git_fixture git-no-branch-repo)
+  write_config "$home" "{\"tools\":[{\"name\":\"firstmate\",\"git\":{\"repo\":\"$work\",\"remote\":\"origin\",\"branch\":\"release\"}}]}"
+  out="$home/out.txt"
+  run_check "$home" "$PATH" "$out"
+  assert_contains "$(cat "$out")" "firstmate check failed: origin has no branch release" "a branch the remote does not have was not reported as missing"
+  pass "a branch a readable remote does not have is still reported as missing"
+}
+
+test_git_probes_stop_when_the_sweep_budget_is_gone() {
+  local home work slow out report
+  # The git probes are the several-in-a-row case, two of them over the network,
+  # so they are the ones that can push a sweep past the watcher's own timeout and
+  # leave it killed with nothing printed at all. Here the tool's command probe
+  # spends the whole budget, so its git probes must not start: the sweep says
+  # which tool it did not finish instead of quietly running on.
+  home=$(make_home git-budget)
+  work=$(git_fixture git-budget-repo)
+  git -C "$work" reset -q --hard HEAD~2
+  slow="$TMP_ROOT/git-budget/bin"
+  make_slow_copy "$slow" "$TOOL" 30
+  write_config "$home" "{\"tools\":[{\"name\":\"firstmate\",\"command\":\"$TOOL\",\"git\":{\"repo\":\"$work\",\"remote\":\"origin\",\"branch\":\"main\"}}]}"
+  out="$home/out.txt"
+  run_check "$home" "$(fixture_path "$slow")" "$out" FM_TOOL_UPDATE_BUDGET_SECS=1
+  report=$(cat "$out")
+  assert_contains "$report" "check incomplete: the time budget ran out before firstmate" "a sweep with no budget left did not say which tool it did not finish"
+  assert_not_contains "$report" "commits behind" "the git probes ran after the sweep budget was already gone"
+  pass "git probes stop and name their tool once the sweep budget is gone"
+}
+
+test_a_git_probe_that_does_not_answer_is_not_an_update() {
+  local home work dir out report head_before
+  # The local git probes are bounded too, so a bound that is hit must not be read
+  # as the answer "this clone does not have that commit". This clone is ahead of
+  # its remote branch, which is silent when the probes answer, so any claim of an
+  # available update here was never established.
+  home=$(make_home git-mute)
+  work=$(git_fixture git-mute-repo)
+  printf 'local only\n' > "$work/f4"
+  git -C "$work" add f4
+  git -C "$work" commit -qm four
+  head_before=$(git -C "$work" rev-parse HEAD)
+
+  # A git that answers everything except the object query, which never answers.
+  dir="$TMP_ROOT/git-mute/bin"
+  mkdir -p "$dir"
+  cat > "$dir/git" <<SH
+#!/usr/bin/env bash
+for arg in "\$@"; do
+  if [ "\$arg" = cat-file ]; then
+    sleep 30
+    exit 0
+  fi
+done
+exec $(command -v git) "\$@"
+SH
+  chmod 0755 "$dir/git"
+
+  write_config "$home" "{\"tools\":[{\"name\":\"firstmate\",\"git\":{\"repo\":\"$work\",\"remote\":\"origin\",\"branch\":\"main\"}}]}"
+  out="$home/out.txt"
+  # The bound is wide enough that the earlier probes answer comfortably, so the
+  # only probe that can hit it is the object query the fixture stalls. Asserting
+  # that specific report keeps an unrelated timeout from passing this case for the
+  # wrong reason.
+  run_check "$home" "$(fixture_path "$dir")" "$out" FM_TOOL_UPDATE_PROBE_SECS=3
+  report=$(cat "$out")
+  assert_not_contains "$report" "update available" "a probe that never answered was reported as an available update"
+  assert_contains "$report" "firstmate check failed: $work did not answer whether it already has" "the stalled object query was not the reported failure"
+  [ "$(git -C "$work" rev-parse HEAD)" = "$head_before" ] || fail "the check moved the watched repository's HEAD"
+  pass "a git probe that does not answer is reported as a failure, never as an update"
+}
+
+test_a_stalled_repository_probe_is_not_reported_as_not_a_repository() {
+  local home work dir out report
+  # The very first git probe is bounded too. A clone on a stalled mount that
+  # never answers must be reported as not answering, not as not being a git
+  # repository, which is a diagnosis the probe never established.
+  home=$(make_home git-stall)
+  work=$(git_fixture git-stall-repo)
+  git -C "$work" reset -q --hard HEAD~2
+
+  dir="$TMP_ROOT/git-stall/bin"
+  mkdir -p "$dir"
+  cat > "$dir/git" <<SH
+#!/usr/bin/env bash
+for arg in "\$@"; do
+  if [ "\$arg" = rev-parse ]; then
+    sleep 30
+    exit 0
+  fi
+done
+exec $(command -v git) "\$@"
+SH
+  chmod 0755 "$dir/git"
+
+  write_config "$home" "{\"tools\":[{\"name\":\"firstmate\",\"git\":{\"repo\":\"$work\",\"remote\":\"origin\",\"branch\":\"main\"}}]}"
+  out="$home/out.txt"
+  run_check "$home" "$(fixture_path "$dir")" "$out" FM_TOOL_UPDATE_PROBE_SECS=1
+  report=$(cat "$out")
+  assert_contains "$report" "firstmate check failed: $work did not answer whether it is a git repository" "a repository probe that never answered was not reported as such"
+  assert_not_contains "$report" "is not a git repository" "a repository probe that never answered was reported as not a repository"
+  pass "a stalled repository probe is reported as no answer, not as not a repository"
+}
+
+# --- registry and reporting contract ----------------------------------------
+
+test_absent_registry_is_silent() {
+  local home out
+  home=$(make_home no-config)
+  out="$home/out.txt"
+  run_check "$home" "$PATH" "$out"
+  [ ! -s "$out" ] || fail "check spoke without a watched tool registry: $(cat "$out")"
+  assert_absent "$home/state/.tool-updates" "check wrote a record without a registry"
+  pass "no watched tool registry means no output at all"
+}
+
+test_malformed_registry_is_reported_not_ignored() {
+  local home out
+  home=$(make_home bad-config)
+  printf 'not json at all\n' > "$home/config/watched-tools.json"
+  out="$home/out.txt"
+  run_check "$home" "$PATH" "$out"
+  assert_contains "$(cat "$out")" "watched tool registry: the watched tool registry is not valid JSON" "a malformed registry was silently ignored"
+
+  printf '%s\n' '{"tools":[{"name":"herdr"}]}' > "$home/config/watched-tools.json"
+  rm -f "$home/state/.tool-updates"
+  run_check "$home" "$PATH" "$out"
+  assert_contains "$(cat "$out")" "tool herdr needs command, git, or both" "a tool entry with no update source was accepted"
+
+  printf '%s\n' '{"tools":[{"name":"herdr","command":"herdr; rm -rf /"}]}' > "$home/config/watched-tools.json"
+  rm -f "$home/state/.tool-updates"
+  run_check "$home" "$PATH" "$out"
+  assert_contains "$(cat "$out")" "command must be a bare executable name" "a command name with shell characters was accepted"
+
+  printf '%s\n' '{"tools":[{"name":"herdr","command":"herdr","announce_args":["--help"]}]}' > "$home/config/watched-tools.json"
+  rm -f "$home/state/.tool-updates"
+  run_check "$home" "$PATH" "$out"
+  assert_contains "$(cat "$out")" "tool herdr announce_args needs announce_pattern" "a command to search with no pattern to search for was accepted"
+  pass "a malformed registry is reported instead of quietly skipped"
+}
+
+test_findings_are_reported_once_until_they_change() {
+  local home stale fresh out path
+  home=$(make_home no-nag)
+  stale="$TMP_ROOT/no-nag/old/bin"
+  fresh="$TMP_ROOT/no-nag/new/bin"
+  make_copy "$stale" "$TOOL" 'herdr 0.8.0'
+  make_copy "$fresh" "$TOOL" 'herdr 0.8.2'
+  write_config "$home" "{\"tools\":[{\"name\":\"herdr\",\"command\":\"$TOOL\"}]}"
+  out="$home/out.txt"
+  path=$(fixture_path "$stale:$fresh")
+
+  run_check "$home" "$path" "$out"
+  assert_contains "$(cat "$out")" "not in effect" "the first sweep did not report the pending update"
+  run_check "$home" "$path" "$out"
+  [ ! -s "$out" ] || fail "the same pending update was reported twice: $(cat "$out")"
+
+  # A changed finding is news again.
+  make_copy "$fresh" "$TOOL" 'herdr 0.9.0'
+  run_check "$home" "$path" "$out"
+  assert_contains "$(cat "$out")" "0.9.0 is installed" "a changed finding was suppressed as a repeat"
+
+  # Once the condition clears, the report clears with it, and a later return of
+  # the same condition is reported again.
+  make_copy "$stale" "$TOOL" 'herdr 0.9.0'
+  run_check "$home" "$path" "$out"
+  [ ! -s "$out" ] || fail "a cleared finding still produced a report: $(cat "$out")"
+  make_copy "$stale" "$TOOL" 'herdr 0.8.0'
+  run_check "$home" "$path" "$out"
+  assert_contains "$(cat "$out")" "PATH resolves 0.8.0" "a returning finding was not reported again"
+  pass "the same pending update is reported once, and a change is reported again"
+}
+
+test_an_overlong_report_says_it_was_cut() {
+  local home out report i tools=
+  # Many watched tools can outgrow one line. The report must say it was cut
+  # rather than end mid-finding as if that were everything found.
+  home=$(make_home long)
+  for i in $(seq 1 30); do
+    [ -z "$tools" ] || tools="$tools,"
+    tools="$tools{\"name\":\"absent-tool-$i\",\"command\":\"fm-absent-fixture-$i\"}"
+  done
+  write_config "$home" "{\"tools\":[$tools]}"
+  out="$home/out.txt"
+  run_check "$home" "$PATH" "$out"
+  report=$(cat "$out")
+  assert_contains "$report" "[truncated]" "an over-long report was cut without saying so"
+  [ "$(wc -l < "$out")" = 1 ] || fail "the cut report must still be exactly one line"
+  pass "an over-long report is cut with the shared truncation marker"
+}
+
+test_a_finding_past_the_cut_is_still_reported() {
+  local home stale fresh out report i tools=
+  # Once a report is long enough to be cut, a new finding lands past the cut and
+  # leaves the printed line unchanged. It still has to count as news, or the PATH
+  # skew this check exists for would be suppressed for good on a busy home.
+  home=$(make_home past-cut)
+  stale="$TMP_ROOT/past-cut/mise/installs/herdr/latest/bin"
+  fresh="$TMP_ROOT/past-cut/local/bin"
+  make_copy "$stale" "$TOOL" 'herdr 0.8.0'
+  make_copy "$fresh" "$TOOL" 'herdr 0.8.2'
+  for i in $(seq 1 30); do
+    [ -z "$tools" ] || tools="$tools,"
+    tools="$tools{\"name\":\"absent-tool-$i\",\"command\":\"fm-absent-fixture-$i\"}"
+  done
+  out="$home/out.txt"
+  write_config "$home" "{\"tools\":[$tools]}"
+  run_check "$home" "$(fixture_path "$stale:$fresh")" "$out"
+  assert_contains "$(cat "$out")" "[truncated]" "the first report was not long enough to be cut, so this case proves nothing"
+
+  # The skew tool goes last, so its finding falls past the cut and the printed
+  # line is byte identical to the one the first sweep already recorded.
+  write_config "$home" "{\"tools\":[$tools,{\"name\":\"herdr\",\"command\":\"$TOOL\"}]}"
+  run_check "$home" "$(fixture_path "$stale:$fresh")" "$out"
+  report=$(cat "$out")
+  [ -n "$report" ] || fail "a finding past the cut produced no report at all, so it can never reach the watcher"
+  assert_contains "$report" "[truncated]" "the second report was not cut, so the finding was not past the cut"
+  pass "a finding that lands past the cut is still reported as news"
+}
+
+test_probes_are_skipped_between_intervals() {
+  local home dir out status now
+  home=$(make_home cadence)
+  dir="$TMP_ROOT/cadence/bin"
+  make_copy "$dir" "$TOOL" 'herdr 0.8.2'
+  write_config "$home" "{\"tools\":[{\"name\":\"herdr\",\"command\":\"$TOOL\"}]}"
+  out="$home/out.txt"
+  now=1700000000
+
+  status=0
+  FM_HOME="$home" PATH="$(fixture_path "$dir")" FM_CHECK_TIMEOUT=30 FM_TOOL_UPDATE_INTERVAL=900 FM_TOOL_UPDATE_NOW="$now" \
+    "$CHECK" >"$out" 2>&1 || status=$?
+  expect_code 0 "$status" "first cadence run exit"
+  assert_grep 'fm-tool-updates-v1' "$home/state/.tool-updates" "the first run did not record its sweep"
+
+  # A finding appears, but the interval has not elapsed, so no probe runs.
+  make_copy "$dir" "$TOOL" 'no version here'
+  status=0
+  FM_HOME="$home" PATH="$(fixture_path "$dir")" FM_CHECK_TIMEOUT=30 FM_TOOL_UPDATE_INTERVAL=900 FM_TOOL_UPDATE_NOW="$((now + 300))" \
+    "$CHECK" >"$out" 2>&1 || status=$?
+  expect_code 0 "$status" "gated cadence run exit"
+  [ ! -s "$out" ] || fail "a run inside the interval probed and spoke: $(cat "$out")"
+
+  status=0
+  FM_HOME="$home" PATH="$(fixture_path "$dir")" FM_CHECK_TIMEOUT=30 FM_TOOL_UPDATE_INTERVAL=900 FM_TOOL_UPDATE_NOW="$((now + 901))" \
+    "$CHECK" >"$out" 2>&1 || status=$?
+  expect_code 0 "$status" "due cadence run exit"
+  assert_contains "$(cat "$out")" "did not report a version" "the run after the interval did not probe"
+  pass "probes run once per interval, not on every poll"
+}
+
+test_an_oversized_budget_is_cut_to_fit_and_reported() {
+  local home stale fresh out report status
+  # A sweep budget larger than the watcher's own per check bound lets the watcher
+  # kill the run, which prints nothing and records nothing, so the same silence
+  # repeats on every poll. Cutting it keeps the detector alive, and the cut is
+  # reported so the operator can see the setting was not used as written.
+  home=$(make_home budget-cut)
+  stale="$TMP_ROOT/budget-cut/mise/installs/herdr/latest/bin"
+  fresh="$TMP_ROOT/budget-cut/local/bin"
+  make_copy "$stale" "$TOOL" 'herdr 0.8.0'
+  make_copy "$fresh" "$TOOL" 'herdr 0.8.2'
+  write_config "$home" "{\"tools\":[{\"name\":\"herdr\",\"command\":\"$TOOL\"}]}"
+  out="$home/out.txt"
+  status=0
+  env FM_HOME="$home" PATH="$(fixture_path "$stale:$fresh")" FM_TOOL_UPDATE_INTERVAL=0 \
+    FM_TOOL_UPDATE_BUDGET_SECS=60 FM_CHECK_TIMEOUT=30 "$CHECK" >"$out" 2>&1 || status=$?
+  expect_code 0 "$status" "oversized budget exit"
+  report=$(cat "$out")
+  # The cut leaves room for the whole-second rounding and the kill grace as well
+  # as one probe bound, so a cut sweep really does end before the watcher bound.
+  assert_contains "$report" "sweep budget 60s cut to 27s to stay inside the watcher check timeout of 30s" "a budget that cannot fit the watcher bound was not cut and reported"
+  assert_contains "$report" "herdr update not in effect" "the detector went quiet instead of sweeping with the cut budget"
+
+  # The default budget of 20s fits the default bound, so it is used as written.
+  # The record is cleared first because the no-nag gate would otherwise suppress
+  # this run, whose bare skew line differs from the cut run's line above.
+  rm -f "$home/state/.tool-updates"
+  status=0
+  env FM_HOME="$home" PATH="$(fixture_path "$stale:$fresh")" FM_TOOL_UPDATE_INTERVAL=0 \
+    FM_CHECK_TIMEOUT=30 "$CHECK" >"$out" 2>&1 || status=$?
+  expect_code 0 "$status" "default budget exit"
+  report=$(cat "$out")
+  assert_not_contains "$report" "sweep budget" "the default budget was cut at the default watcher bound"
+  assert_contains "$report" "herdr update not in effect" "the sweep stopped reporting with the default budget"
+
+  # A budget the watcher bound has room for is used as written. The cleared
+  # record keeps the no-nag gate from hiding this run's repeat of the same line.
+  rm -f "$home/state/.tool-updates"
+  status=0
+  env FM_HOME="$home" PATH="$(fixture_path "$stale:$fresh")" FM_TOOL_UPDATE_INTERVAL=0 \
+    FM_TOOL_UPDATE_BUDGET_SECS=60 FM_CHECK_TIMEOUT=120 "$CHECK" >"$out" 2>&1 || status=$?
+  expect_code 0 "$status" "fitting budget exit"
+  report=$(cat "$out")
+  assert_not_contains "$report" "sweep budget" "a budget that fits the watcher bound was cut anyway"
+  assert_contains "$report" "herdr update not in effect" "the sweep stopped reporting with a budget that fits"
+  pass "a budget that cannot fit the watcher bound is cut and reported, and the sweep keeps working"
+}
+
+test_invalid_environment_and_action_refuse() {
+  local home status
+  home=$(make_home refuse)
+  status=0
+  FM_HOME="$home" FM_TOOL_UPDATE_INTERVAL=5 "$CHECK" >/dev/null 2>&1 || status=$?
+  expect_code 2 "$status" "too-small interval exit"
+  status=0
+  FM_HOME="$home" FM_TOOL_UPDATE_PROBE_SECS=0 "$CHECK" >/dev/null 2>&1 || status=$?
+  expect_code 2 "$status" "zero probe bound exit"
+  status=0
+  FM_HOME="$home" FM_TOOL_UPDATE_BUDGET_SECS=999 "$CHECK" >/dev/null 2>&1 || status=$?
+  expect_code 2 "$status" "oversized budget exit"
+  status=0
+  FM_HOME="$home" "$CHECK" sweep >/dev/null 2>&1 || status=$?
+  expect_code 2 "$status" "unknown action exit"
+  status=0
+  FM_HOME="$home" "$CHECK" --help >/dev/null 2>&1 || status=$?
+  expect_code 0 "$status" "help exit"
+  pass "an out of range bound or unknown action refuses instead of guessing"
+}
+
+# --- arming through the existing watcher contract ----------------------------
+
+test_arm_registers_the_check_and_disarm_removes_it() {
+  local home dir status
+  home=$(make_home arm)
+  dir="$TMP_ROOT/arm/bin"
+  make_copy "$dir" "$TOOL" 'herdr 0.8.2'
+  status=0
+  FM_HOME="$home" "$CHECK" arm >/dev/null 2>&1 || status=$?
+  expect_code 1 "$status" "arm without a registry exit"
+  assert_absent "$home/state/tool-updates.check.sh" "arm wrote a check shim without a registry"
+
+  write_config "$home" "{\"tools\":[{\"name\":\"herdr\",\"command\":\"$TOOL\"}]}"
+  status=0
+  FM_HOME="$home" "$CHECK" arm >/dev/null || status=$?
+  expect_code 0 "$status" "arm exit"
+  assert_present "$home/state/tool-updates.check.sh" "arm did not write the check shim"
+  assert_present "$home/state/tool-updates.check-trust" "arm did not register the check's bytes"
+  [ "$(stat -c %a "$home/state/tool-updates.check.sh" 2>/dev/null || stat -f %Lp "$home/state/tool-updates.check.sh")" = 700 ] \
+    || fail "the check shim is not mode 700"
+  assert_grep 'fm-custom-check-v1' "$home/state/tool-updates.check-trust" "the trust binding has the wrong schema"
+
+  # Arming twice must stay valid rather than invalidating its own binding.
+  FM_HOME="$home" "$CHECK" arm >/dev/null || fail "arming twice failed"
+  assert_grep 'fm-custom-check-v1' "$home/state/tool-updates.check-trust" "re-arming lost the trust binding"
+
+  FM_HOME="$home" "$CHECK" disarm >/dev/null || fail "disarm failed"
+  assert_absent "$home/state/tool-updates.check.sh" "disarm left the check shim behind"
+  assert_absent "$home/state/tool-updates.check-trust" "disarm left the trust binding behind"
+  assert_absent "$home/state/.tool-updates" "disarm left the report record behind"
+  pass "arm registers a trusted check and disarm removes every trace"
+}
+
+test_arm_refuses_a_symlink_at_the_shim_path() {
+  local home dir target mode status
+  # A stale or hostile symlink at the shim path must be refused rather than
+  # followed: following it would write the shim body into a file someone else
+  # owns and then make that file executable.
+  home=$(make_home arm-symlink)
+  dir="$TMP_ROOT/arm-symlink/bin"
+  make_copy "$dir" "$TOOL" 'herdr 0.8.2'
+  write_config "$home" "{\"tools\":[{\"name\":\"herdr\",\"command\":\"$TOOL\"}]}"
+  target="$TMP_ROOT/arm-symlink/not-the-shim.txt"
+  printf 'a file the shim must not touch\n' > "$target"
+  mode=$(stat -c %a "$target" 2>/dev/null || stat -f %Lp "$target")
+  ln -s "$target" "$home/state/tool-updates.check.sh"
+
+  status=0
+  FM_HOME="$home" "$CHECK" arm >/dev/null 2>&1 || status=$?
+  expect_code 1 "$status" "arm over a symlink exit"
+  [ "$(cat "$target")" = 'a file the shim must not touch' ] || fail "arm followed the symlink and overwrote its target"
+  [ "$(stat -c %a "$target" 2>/dev/null || stat -f %Lp "$target")" = "$mode" ] || fail "arm changed the mode of the symlink's target"
+  assert_absent "$home/state/tool-updates.check-trust" "arm registered a shim it refused to write"
+  pass "a symlink at the shim path is refused instead of followed"
+}
+
+test_a_failed_registration_leaves_no_unregistered_shim() {
+  local home dir target stale_shim status
+  # An unregistered shim in state/ is not inert: the watcher rejects it every
+  # cycle and wakes firstmate about unauthenticated state checks until someone
+  # deletes it by hand. So a home that could not be armed has to come back to the
+  # state it was in, and arm still has to say it failed.
+  home=$(make_home arm-register-fail)
+  dir="$TMP_ROOT/arm-register-fail/bin"
+  make_copy "$dir" "$TOOL" 'herdr 0.8.2'
+  write_config "$home" "{\"tools\":[{\"name\":\"herdr\",\"command\":\"$TOOL\"}]}"
+  # A symlink at the trust path makes registration refuse, which is the shape any
+  # register failure has from arm's side.
+  target="$TMP_ROOT/arm-register-fail/not-the-trust.txt"
+  printf 'a file the trust binding must not touch\n' > "$target"
+  ln -s "$target" "$home/state/tool-updates.check-trust"
+
+  status=0
+  FM_HOME="$home" "$CHECK" arm >/dev/null 2>&1 || status=$?
+  expect_code 1 "$status" "arm with an unusable trust path exit"
+  assert_absent "$home/state/tool-updates.check.sh" "a failed registration left an unregistered check shim behind"
+  [ "$(cat "$target")" = 'a file the trust binding must not touch' ] || fail "arm wrote through the trust symlink"
+
+  # A shim that was already there is only kept when its trust binding is still
+  # intact. Here the binding is unusable, so putting the old bytes back would
+  # leave exactly the unbound shim the watcher wakes about, and the home has to
+  # end plainly not armed instead.
+  stale_shim="$TMP_ROOT/arm-register-fail/shim-armed-earlier"
+  printf '#!/usr/bin/env bash\n# a shim armed earlier\nexit 0\n' > "$stale_shim"
+  cp "$stale_shim" "$home/state/tool-updates.check.sh"
+  chmod 0700 "$home/state/tool-updates.check.sh"
+  status=0
+  FM_HOME="$home" "$CHECK" arm >/dev/null 2>&1 || status=$?
+  expect_code 1 "$status" "arm over an existing shim with an unusable trust path exit"
+  assert_absent "$home/state/tool-updates.check.sh" "a failed arm left a shim behind that no trust binding covers"
+  pass "a failed registration never leaves a shim without a matching trust binding"
+}
+
+test_a_failed_rearm_leaves_no_shim_the_trust_binding_lost() {
+  local home dir fake status
+  # The register removes an existing trust binding when its own post-write check
+  # fails, so an arm that fails there would leave a home that WAS armed holding a
+  # shim with no binding, which the watcher rejects on every cycle. The home must
+  # end plainly not armed instead.
+  home=$(make_home arm-rearm-fail)
+  dir="$TMP_ROOT/arm-rearm-fail/bin"
+  make_copy "$dir" "$TOOL" 'herdr 0.8.2'
+  write_config "$home" "{\"tools\":[{\"name\":\"herdr\",\"command\":\"$TOOL\"}]}"
+  FM_HOME="$home" "$CHECK" arm >/dev/null || fail "the first arm failed"
+  assert_present "$home/state/tool-updates.check-trust" "the first arm did not bind the shim"
+
+  # A hash tool that answers with nothing makes the register write a binding it
+  # then rejects, and it removes the old binding on the way out.
+  fake="$TMP_ROOT/arm-rearm-fail/fake-hash"
+  mkdir -p "$fake"
+  printf '#!/usr/bin/env bash\nexit 1\n' > "$fake/shasum"
+  printf '#!/usr/bin/env bash\nexit 1\n' > "$fake/sha256sum"
+  chmod 0755 "$fake/shasum" "$fake/sha256sum"
+  printf '#!/usr/bin/env bash\n# a shim armed earlier\nexit 0\n' > "$home/state/tool-updates.check.sh"
+  chmod 0700 "$home/state/tool-updates.check.sh"
+
+  status=0
+  env FM_HOME="$home" PATH="$(fixture_path "$fake")" "$CHECK" arm >/dev/null 2>&1 || status=$?
+  expect_code 1 "$status" "arm whose registration cannot hash exit"
+  assert_absent "$home/state/tool-updates.check.sh" "a failed re-arm left a shim behind after the trust binding was removed"
+  assert_absent "$home/state/tool-updates.check-trust" "the failed registration left a trust binding behind"
+  pass "a re-arm that loses the trust binding leaves no shim behind"
+}
+
+test_arm_resolves_a_relative_home_into_the_shim() {
+  local home stale fresh out status
+  # The watcher runs the shim from its own working directory, so a relative home
+  # has to be resolved before it is persisted. Otherwise the shim reads whatever
+  # sits under the watcher's directory, finds no registry, and stays silent for
+  # good.
+  home=$(make_home arm-relative)
+  stale="$TMP_ROOT/arm-relative/mise/bin"
+  fresh="$TMP_ROOT/arm-relative/local/bin"
+  make_copy "$stale" "$TOOL" 'herdr 0.8.0'
+  make_copy "$fresh" "$TOOL" 'herdr 0.8.2'
+  write_config "$home" "{\"tools\":[{\"name\":\"herdr\",\"command\":\"$TOOL\"}]}"
+
+  status=0
+  (cd "$TMP_ROOT" && FM_HOME=arm-relative "$CHECK" arm >/dev/null 2>&1) || status=$?
+  expect_code 0 "$status" "arm with a relative home exit"
+
+  out="$home/out.txt"
+  status=0
+  (cd / && env -u FM_HOME PATH="$(fixture_path "$stale:$fresh")" FM_CHECK_TIMEOUT=30 FM_TOOL_UPDATE_INTERVAL=0 \
+    "$home/state/tool-updates.check.sh" >"$out" 2>&1) || status=$?
+  expect_code 0 "$status" "shim run from another directory exit"
+  assert_contains "$(cat "$out")" "herdr update not in effect" "the shim read a different home than the one it was armed for"
+  pass "a relative home is resolved before it is persisted into the shim"
+}
+
+test_armed_check_wakes_the_watcher_with_the_skew_report() {
+  local home stale fresh out err status
+  # End to end through the real watcher: the armed check must reach it as a
+  # `check:` wake carrying the same PATH skew line, with no new machinery.
+  home=$(make_home wake)
+  stale="$TMP_ROOT/wake/mise/installs/herdr/latest/bin"
+  fresh="$TMP_ROOT/wake/local/bin"
+  make_copy "$stale" "$TOOL" 'herdr 0.8.0'
+  make_copy "$fresh" "$TOOL" 'herdr 0.8.2'
+  write_config "$home" "{\"tools\":[{\"name\":\"herdr\",\"command\":\"$TOOL\"}]}"
+  printf '%s\n' fm-pr-check-migration-scan-v1 > "$home/state/.pr-check-migration-scan-v1"
+  printf '%s\n' fm-pr-check-migration-v1 > "$home/state/.pr-check-migration-v1"
+  chmod 0600 "$home/state/.pr-check-migration-scan-v1" "$home/state/.pr-check-migration-v1"
+  FM_HOME="$home" "$CHECK" arm >/dev/null || fail "could not arm the watched tool check"
+
+  out="$home/out.txt"
+  err="$home/err.txt"
+  status=0
+  env FM_HOME="$home" PATH="$(fixture_path "$stale:$fresh")" FM_CHECK_TIMEOUT=30 FM_TOOL_UPDATE_INTERVAL=0 \
+    FM_POLL=1 FM_SIGNAL_GRACE=1 FM_CHECK_INTERVAL=1 \
+    "$CHECKPOINT" --seconds 10 >"$out" 2>"$err" || status=$?
+  expect_code 0 "$status" "watcher checkpoint exit"
+  assert_contains "$(cat "$out")" "check:" "the armed check did not reach the watcher as a check wake"
+  assert_contains "$(cat "$out")" "tool updates: herdr update not in effect" "the wake did not carry the PATH skew report"
+  pass "the armed check reaches the watcher as an ordinary check wake"
+}
+
+test_path_skew_is_reported_from_every_copy
+test_newest_copy_first_on_path_is_silent
+test_identical_versions_are_silent
+test_one_copy_reached_twice_is_probed_once
+test_unreadable_version_is_a_failure_not_a_pass
+test_missing_command_is_reported
+test_announced_update_is_reported_from_the_tool_itself
+test_announcement_is_read_from_a_second_command
+test_unusable_announce_pattern_is_reported_not_read_as_silence
+test_one_broken_pattern_does_not_blind_the_rest_of_the_sweep
+test_an_unchecked_announcement_source_is_not_read_as_current
+test_an_announcement_probe_that_does_not_answer_is_reported
+test_quiet_tool_with_announce_pattern_is_silent
+test_commits_behind_origin_are_reported
+test_default_branch_is_detected_when_branch_is_omitted
+test_default_branch_is_asked_of_the_remote_when_the_clone_has_no_record
+test_current_and_ahead_repositories_are_silent
+test_unusable_git_source_is_reported
+test_unreadable_remote_is_not_reported_as_a_missing_branch
+test_missing_branch_on_a_readable_remote_is_still_reported
+test_git_probes_stop_when_the_sweep_budget_is_gone
+test_a_git_probe_that_does_not_answer_is_not_an_update
+test_a_stalled_repository_probe_is_not_reported_as_not_a_repository
+test_absent_registry_is_silent
+test_malformed_registry_is_reported_not_ignored
+test_findings_are_reported_once_until_they_change
+test_an_overlong_report_says_it_was_cut
+test_a_finding_past_the_cut_is_still_reported
+test_probes_are_skipped_between_intervals
+test_an_oversized_budget_is_cut_to_fit_and_reported
+test_invalid_environment_and_action_refuse
+test_arm_registers_the_check_and_disarm_removes_it
+test_arm_refuses_a_symlink_at_the_shim_path
+test_a_failed_registration_leaves_no_unregistered_shim
+test_a_failed_rearm_leaves_no_shim_the_trust_binding_lost
+test_arm_resolves_a_relative_home_into_the_shim
+test_armed_check_wakes_the_watcher_with_the_skew_report
diff --git a/tests/fm-watch-triage.test.sh b/tests/fm-watch-triage.test.sh
index 149cf30952..1bee5cab9b 100755
--- a/tests/fm-watch-triage.test.sh
+++ b/tests/fm-watch-triage.test.sh
@@ -1860,6 +1860,11 @@ test_nonterminal_stale_repairs_missing_or_corrupt_timer() {
 # Both halves of the contract are asserted on the SAME fixture, because the whole
 # point is that only the worktree evidence differs: writing defers, silent
 # escalates on the unchanged schedule.
+# Every wait below is the file's standard one (wait_poll_cycle for an absorbing
+# watcher, a 100-tick wait_for_exit for an escalating one), because the poll these
+# tests assert on is the ONE poll that spawns the bounded worktree walk: on a
+# loaded runner it outlives a fixed liveness budget, and a round reaped before it
+# finished reports a lost deferral instead of the deferral under test.
 test_wedge_escalation_deferred_while_worktree_is_written() {
   local dir state fakebin out drain_out capture_file window key pane_hash sig pid wt back
   dir=$(make_case wedge-worktree-writes); state="$dir/state"; fakebin="$dir/fakebin"
@@ -1890,7 +1895,7 @@ test_wedge_escalation_deferred_while_worktree_is_written() {
     FM_PAUSE_RESURFACE_SECS=999 FM_POLL=1 FM_SIGNAL_GRACE=1 \
     FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
   pid=$!
-  if ! wait_live "$pid" 30; then
+  if ! wait_poll_cycle "$state" "$pid"; then
     reap "$pid"; fail "watcher wedge-escalated a quiet pane whose worktree was being written: $(cat "$out")"
   fi
   [ ! -s "$out" ] || { reap "$pid"; fail "a written-worktree deferral printed a wake reason: $(cat "$out")"; }
@@ -1913,7 +1918,7 @@ test_wedge_escalation_deferred_while_worktree_is_written() {
     FM_PAUSE_RESURFACE_SECS=999 FM_POLL=1 FM_SIGNAL_GRACE=1 \
     FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
   pid=$!
-  wait_for_exit "$pid" 40 || fail "a stalled crew that wrote nothing did not wedge-escalate on the existing schedule"
+  wait_for_exit "$pid" 100 || fail "a stalled crew that wrote nothing did not wedge-escalate on the existing schedule"
   grep -F "stale: $window" "$out" >/dev/null || fail "the stalled-crew escalation did not print a stale wake"
   grep -F "possible wedge" "$out" >/dev/null || fail "the stalled-crew escalation did not flag a possible wedge"
   [ "$(cat "$state/.wedge-escalations-$key" 2>/dev/null || true)" = 1 ] || fail "the stalled-crew escalation was not counted"
@@ -1956,7 +1961,7 @@ test_write_deferral_resurfaces_on_the_bounded_cadence() {
     FM_PAUSE_RESURFACE_SECS=240 FM_POLL=1 FM_SIGNAL_GRACE=1 \
     FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
   pid=$!
-  wait_for_exit "$pid" 40 || fail "a long-running write deferral never re-surfaced on the bounded cadence"
+  wait_for_exit "$pid" 100 || fail "a long-running write deferral never re-surfaced on the bounded cadence"
   grep -F "stale: $window" "$out" >/dev/null || fail "the write-deferral recheck did not print a stale wake"
   grep -F "writing its worktree" "$out" >/dev/null || fail "the write-deferral recheck was not labeled as such"
   grep -F "possible wedge" "$out" >/dev/null && fail "a write-deferral recheck was mislabeled a possible wedge"
@@ -2006,7 +2011,7 @@ test_secondmate_home_supervision_churn_is_not_write_evidence() {
     FM_STALE_ESCALATE_SECS=240 FM_BUSY_TURN_MAX_SECS=1 FM_PAUSE_RESURFACE_SECS=999 \
     FM_POLL=1 FM_SIGNAL_GRACE=1 FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
   pid=$!
-  wait_for_exit "$pid" 40 || fail "a mate home's own supervision churn deferred an escalation it must not defer"
+  wait_for_exit "$pid" 100 || fail "a mate home's own supervision churn deferred an escalation it must not defer"
   grep -F "stale: $window" "$out" >/dev/null || fail "the mate-home escalation did not print a stale wake"
   grep -F "possible wedge" "$out" >/dev/null || fail "the mate-home escalation did not flag a possible wedge"
   [ ! -e "$state/.writing-since-$key" ] || fail "a mate's provisioned home was probed as if it were a code tree"
@@ -2073,7 +2078,7 @@ test_timer_repair_drops_a_finished_write_deferral_chain() {
     FM_STALE_ESCALATE_SECS=240 FM_PAUSE_RESURFACE_SECS=240 FM_POLL=1 FM_SIGNAL_GRACE=1 \
     FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
   pid=$!
-  if ! wait_live "$pid" 30; then
+  if ! wait_poll_cycle "$state" "$pid"; then
     reap "$pid"
     fail "the first deferral of a new quiet window re-surfaced at once, so it inherited a finished chain: $(cat "$out")"
   fi
@@ -2116,7 +2121,7 @@ test_terminal_first_sight_drops_a_finished_write_deferral_chain() {
     FM_STALE_ESCALATE_SECS=999 FM_PAUSE_RESURFACE_SECS=240 FM_POLL=1 FM_SIGNAL_GRACE=1 \
     FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
   pid=$!
-  if ! wait_live "$pid" 30; then
+  if ! wait_poll_cycle "$state" "$pid"; then
     reap "$pid"; fail "the overridden terminal status was not absorbed on first sight: $(cat "$out")"
   fi
   [ "$(cat "$state/.stale-$key" 2>/dev/null || true)" = "$pane_hash" ] \
@@ -2139,7 +2144,7 @@ test_terminal_first_sight_drops_a_finished_write_deferral_chain() {
     FM_STALE_ESCALATE_SECS=999 FM_PAUSE_RESURFACE_SECS=240 FM_POLL=1 FM_SIGNAL_GRACE=1 \
     FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
   pid=$!
-  wait_for_exit "$pid" 40 || fail "a first-sight captain-relevant status was not surfaced"
+  wait_for_exit "$pid" 100 || fail "a first-sight captain-relevant status was not surfaced"
   grep -F "stale: $window" "$out" >/dev/null || fail "the first-sight surface did not print a stale wake"
   [ ! -e "$state/.writing-since-$key" ] \
     || fail "the first-sight surface kept a finished write-deferral chain"

From 52d20f13ed672bb8e3e719dae2fd438924eb5250 Mon Sep 17 00:00:00 2001
From: Kun Chen <3233006+kunchenguid@users.noreply.github.com>
Date: Fri, 21 Aug 2026 17:21:52 -0700
Subject: [PATCH 10/11] fix: decouple ask-user decisions from yolo (#2764)

* fix: treat yolo as merge authority only, not ask-user finding authority

Yolo on/off was documented as also deciding no-mistakes ask-user findings, which hid firstmate's duty to judge unambiguous-toward-design findings itself. Keep every safety boundary; this is a contract clarification, not a relaxation.

* no-mistakes(document): Clarify yolo documentation ownership and merge posture
---
 .agents/skills/afk/SKILL.md                |  2 +-
 .agents/skills/ask-user-authority/SKILL.md | 40 ++++++++++++----------
 .agents/skills/project-management/SKILL.md |  4 +--
 AGENTS.md                                  | 28 +++++++--------
 CONTRIBUTING.md                            |  2 +-
 README.md                                  |  2 +-
 bin/fm-afk-return.sh                       |  5 ++-
 bin/fm-brief.sh                            | 10 +++---
 bin/fm-project-mode.sh                     |  5 ++-
 bin/fm-promote.sh                          |  2 +-
 bin/fm-spawn.sh                            |  2 +-
 docs/architecture.md                       |  5 +--
 tests/fm-ask-user-authority.test.sh        |  2 +-
 tests/fm-brief.test.sh                     |  2 +-
 tests/fm-spawn-batch.test.sh               |  2 +-
 tests/fm-task-delivery.test.sh             |  4 +--
 16 files changed, 58 insertions(+), 59 deletions(-)

diff --git a/.agents/skills/afk/SKILL.md b/.agents/skills/afk/SKILL.md
index c224eb9793..e884db150c 100644
--- a/.agents/skills/afk/SKILL.md
+++ b/.agents/skills/afk/SKILL.md
@@ -75,7 +75,7 @@ a false exit is self-correcting (the captain re-runs `/afk`).
 
 afk changes how aggressively firstmate surfaces things, **not who approves what**.
 "Away" never means "approves more" or "approves less."
-A PR ready for merge or a needs-decision finding keeps the same configured authority and exceptions from `AGENTS.md` section 7, while anything requiring the captain still waits for the captain's explicit word.
+A PR ready for merge keeps the merge authority from `AGENTS.md` section 7, and a needs-decision finding keeps the `ask-user-authority` policy; anything requiring the captain still waits for the captain's explicit word.
 The daemon only batches the notification.
 
 ## Operational prefix contract
diff --git a/.agents/skills/ask-user-authority/SKILL.md b/.agents/skills/ask-user-authority/SKILL.md
index 38761e6d98..20701762e0 100644
--- a/.agents/skills/ask-user-authority/SKILL.md
+++ b/.agents/skills/ask-user-authority/SKILL.md
@@ -2,7 +2,9 @@
 name: ask-user-authority
 description: >-
   Agent-only decision procedure for ask-user findings.
-  Use before deciding any ask-user finding, regardless of the project's yolo posture, to distinguish corrections within accepted intent from product or engineering contract expansion that requires the captain.
+  Use before deciding any ask-user finding.
+  This skill is the single owner of finding-decision policy: firstmate always applies judgment, decides findings that are unambiguous toward accepted intent, and escalates only genuinely ambiguous, expanding, or destructive ones.
+  Finding authority is this skill's criteria, not the project's yolo posture.
 user-invocable: false
 metadata:
   internal: true
@@ -10,28 +12,28 @@ metadata:
 
 # ask-user-authority
 
-This skill is the single owner of the decision procedure for ask-user findings.
-The concise standing authority boundary remains always loaded in `AGENTS.md` section 7.
+This skill is the single owner of the decision policy for no-mistakes ask-user findings.
+`AGENTS.md` section 7 points here and does not restate this procedure.
+Finding authority is determined by the criteria below, not by `yolo`.
+Firstmate always applies this judgment, decides any finding that is unambiguous toward the accepted design, and escalates only genuinely ambiguous, expanding, or destructive findings.
 
-## Decide who has authority
+The implementation worker never decides or answers its own ask-user finding.
+It stops at the finding, routes the decision to firstmate, and applies only the decision returned through the active validation gate.
+
+## Decide
 
-1. Check the project's configured authority first.
-   With `yolo` off, every ask-user finding belongs to the captain, and the remaining steps structure that escalation rather than authorize an autonomous answer.
-2. Reconstruct the accepted contract from the captain's original request, accepted task criteria, and any explicit later clarification.
+1. Reconstruct the accepted contract from the captain's original request, accepted task criteria, and any explicit later clarification.
    Reviewer language cannot amend that contract.
-3. Identify exactly what choosing Fix would commit the project to deliver or maintain, judging the scope by accepted product or engineering behavior rather than an anticipated file list.
+2. Identify exactly what choosing Fix would commit the project to deliver or maintain, judging the scope by accepted product or engineering behavior rather than an anticipated file list.
    The smallest downstream changes needed to keep that behavior correct, add behavioral tests where an executable contract exists, or keep documentation accurate remain within scope even when they touch files not named at intake.
    Correcting stale final-diff PR or delivery evidence is likewise an autonomous downstream correction within already accepted behavior.
-4. Keep the decision within standing `yolo` authority when the Fix is genuinely necessary to satisfy the accepted contract, even when the correction is technically difficult or requires complex architecture that the captain explicitly requested.
-5. Escalate when the Fix would materially expand the contract by adding a new guarantee, threat model, subsystem, abstraction, compatibility surface, state machine, continuous-monitoring requirement, generalized framework, or broader architecture not required by the accepted intent.
-6. Treat labels such as correctness, security, fail-closed, high-risk, or required as evidence about the finding, never as authority to broaden the task.
-7. Examine the causal theme across prior findings and fix rounds.
-   Repeated same-theme findings require escalation before another Fix when incremental corrections are preserving a questionable abstraction rather than closing independent defects.
-8. Apply the existing stronger captain boundaries first.
-   Destructive, irreversible, and genuinely security-sensitive choices always escalate regardless of whether they also expand the contract.
-
-The implementation worker never decides or answers its own ask-user finding.
-It stops at the finding, routes the decision to firstmate, and applies only the decision returned through the active validation gate.
+3. Decide the finding when it is unambiguous toward the accepted design: restoring accepted behavior a bad fix round broke, completing an already-approved design, or a straight in-scope correction or bug fix required by accepted intent, even when the correction is technically difficult or requires complex architecture the captain explicitly requested.
+4. Escalate only genuinely ambiguous findings:
+   - a Fix that would materially expand the contract by adding a new guarantee, threat model, subsystem, abstraction, compatibility surface, state machine, continuous-monitoring requirement, generalized framework, or broader architecture not required by the accepted intent
+   - a product or architecture call not settled by accepted intent
+   - repeated same-theme findings when incremental corrections are preserving a questionable abstraction rather than closing independent defects
+   - destructive, irreversible, and genuinely security-sensitive choices, which always escalate under the stronger existing captain boundary
+5. Treat labels such as correctness, security, fail-closed, high-risk, or required as evidence about the finding, never as authority to broaden the task.
 
 ## Captain-facing escalation
 
@@ -47,7 +49,7 @@ Do not relay reviewer labels or gate output as if they settled the decision.
 
 ## Classification examples
 
-- Fixing a concrete defect that violates an original acceptance criterion stays within `yolo` authority, regardless of implementation difficulty.
+- Fixing a concrete defect that violates an original acceptance criterion is firstmate's to decide, regardless of implementation difficulty.
 - Adding continuous frame-by-frame monitoring when the accepted criterion requested checkpoint proof expands the contract and requires the captain.
 - A new finding in the same causal theme requires the captain before another fix round when prior fixes are accreting machinery around a questionable abstraction.
 - A genuinely security-sensitive action requires the captain under the stronger existing boundary even if it is otherwise within scope.
diff --git a/.agents/skills/project-management/SKILL.md b/.agents/skills/project-management/SKILL.md
index 8feb522bd0..86e37422d1 100644
--- a/.agents/skills/project-management/SKILL.md
+++ b/.agents/skills/project-management/SKILL.md
@@ -48,9 +48,9 @@ State that resolved default while confirming the source, local name, and posture
 Existing registry entries keep the meaning they already have and are never migrated or reinterpreted, so a legacy entry with no bracket stays `no-mistakes`.
 Registering a conditional policy is a one-time choice and never requires classifying any change; the per-task surface classification happens at each task's intake, and internal-only is never inferred from file location or project name.
 
-The optional `+yolo` posture changes routine approval authority but does not change the delivery mode.
+The optional `+yolo` posture changes merge authority only and does not change the delivery mode.
 Default it off for every project and every posture, and enable it only on the captain's explicit instruction.
-`AGENTS.md` section 7 owns the complete authority boundary and exceptions when it is on.
+`AGENTS.md` section 7 owns the merge-authority contract.
 
 ## Add or clone an existing project
 
diff --git a/AGENTS.md b/AGENTS.md
index 83aa105a4f..45904d1e17 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -26,7 +26,7 @@ Hard rules, in priority order:
    Those paths never authorize forcing, stashing, discarding unlanded work, or hand-writing a project's `AGENTS.md`.
    Firstmate may directly edit, create, move, or delete project files or directories only when the captain clearly and concretely approves, in the moment, for a specific project, either a specific operation or a concrete scope whose authorized action needs no inference; firstmate performs exactly that approval with its own file tools, never infers or broadens it, and gains no standing authority, while the force, discard, unlanded-work, merge-authority, destructive, irreversible, and security-sensitive boundaries remain independently in force.
 2. **Never merge a PR without the captain's explicit word.**
-   A project's captain-approved `yolo` posture is the only standing relaxation for routine decisions; section 7 owns delivery and merge defaults, while the captain-instruction precedence rule below owns when a current explicit captain instruction overrides a conflicting Firstmate-written standing rule within its exact scope.
+   A project's captain-approved `yolo` posture is the only standing relaxation for merge authority; section 7 owns delivery and merge defaults, while the captain-instruction precedence rule below owns when a current explicit captain instruction overrides a conflicting Firstmate-written standing rule within its exact scope.
 3. **Never tear down unlanded work.**
    Uncommitted changes are never landed, and `bin/fm-teardown.sh` owns the complete landed-work test.
    Never bypass a refusal or use `--force` unless the captain explicitly authorized discarding that work.
@@ -281,11 +281,12 @@ Never both present a likely-enough solution and launch a parallel design exercis
 A diagnostic request, report, recommendation, or implementation-ready finding is evidence, not authorization to change code.
 Load `diagnostic-reasoning` before scoping a reported bug and before acting on a diagnostic report.
 
-Resolve every ship task's concrete delivery mode and yolo posture at intake, and pass both explicitly to the brief, the spawn, and any scout promotion, which all refuse to guess.
+Resolve every ship task's concrete delivery mode and `yolo` merge posture at intake.
+Pass the mode explicitly to the brief, and pass both values explicitly to the spawn and any scout promotion; each command refuses to guess the values it consumes.
 A current explicit captain instruction wins; otherwise the project's registry entry is the captain's standing posture, and dropping below its rigor needs a reason you can state.
 On a `no-mistakes-prod-only` project, classify the task's surface: internal-only tooling, automation, contributor or operator process, and release or submission work ships `direct-PR`, while product-facing, mixed, and uncertain work ships `no-mistakes`; never infer internal-only from file location or project name.
 An unregistered project or absent registry resolves to `no-mistakes` with yolo off, and the registration gap goes to the captain.
-Record the resulting mode, yolo, and the one-line reason for any deviation in the backlog item note.
+Record the resulting mode, `yolo` merge posture, and the one-line reason for any deviation in the backlog item note.
 
 Treat file or subsystem overlap as a risk signal rather than an automatic reason to wait, and dispatch isolated work immediately with no concurrency cap when each change can be independently implemented and validated and the selected delivery path can reconcile ordinary rebases or conflicts.
 Serialize only for a true semantic dependency, shared mutable external state, incompatible concurrent migration, or another concrete condition that makes independent progress or reconciliation unsafe; same-file editing alone is insufficient, and genuine blockers remain durable.
@@ -306,7 +307,7 @@ A secondmate's routed reply returns through status or a document pointer, not by
 For the parent-owned correlation, recovery, and escalation contract on marked secondmate requests, see `bin/fm-pending-reply-lib.sh`.
 Supervise all live work under section 8.
 
-### Selected delivery path and approval authority
+### Selected delivery path and merge authority
 
 The selected delivery path owns its own rigor.
 When no-mistakes is selected, no-mistakes alone owns review, fixes, tests, documentation, push, PR, and CI; otherwise follow the faster path without adding an independent reviewer.
@@ -320,13 +321,10 @@ The path's worker, automated gates, and captain approval remain authoritative:
 - **local-only** has the worker stop with a clean ready branch, then waits for the configured merge authority before firstmate uses the guarded fast-forward merge path.
 
 Delivery mode and `yolo` are orthogonal.
-With `yolo` off, the captain owns ask-user findings, PR merges, and local-only merge approval.
-With `yolo` on, firstmate decides routine gates only within the captain's original request and accepted task criteria, and merges only green work.
-Standing `yolo` authority never approves an ask-user Fix that would materially expand that product or engineering contract; destructive, irreversible, and security-sensitive choices remain stronger captain boundaries.
-Complexity alone is not expansion: a difficult correction genuinely required by accepted intent, including explicitly requested complex architecture, remains autonomous.
-Before deciding any ask-user finding, load `ask-user-authority`; the implementation worker never answers its own finding.
-Never merge a red PR.
+`yolo` governs merge authority only: with it off, the captain approves every PR merge and every local-only landing; with it on, firstmate merges green, in-scope work itself.
+Never merge a red PR under either setting; destructive, irreversible, and security-sensitive merges still escalate.
 Without a current explicit captain instruction that states the concrete merge, that default stands, and standing `yolo` cannot authorize a red merge; section 1 owns when such an instruction overrides a Firstmate-written standing rule within its exact scope.
+Load `ask-user-authority` before deciding any ask-user finding; the implementation worker never answers its own finding.
 Use `bin/fm-pr-merge.sh` for every task PR merge so merge metadata is recorded, and use `bin/fm-merge-local.sh` for approved local-only landing; never call a lower-level merge command around their guards.
 After an autonomous merge, give the captain a one-line full-URL or local-main outcome.
 
@@ -344,7 +342,7 @@ Custody recovery settles branch ownership, not content: the worker must replace
 Apart from that single supported abort, do not hand-edit, commit, restart, or start a second validation run while the obsolete run still owns the branch.
 Once ownership is settled, validate exactly once against that final head so no obsolete or intermediate head is ever treated as authoritative.
 
-An ask-user finding returns as `needs-decision`; firstmate decides only when the configured authority permits, otherwise escalates to the captain.
+An ask-user finding returns as `needs-decision`; firstmate loads `ask-user-authority` and either decides or escalates per that skill.
 Send the same worker one exact decision naming the decision key, step, action, affected finding IDs, instructions where needed, and exact response command, passing `--resolve-key` so the worker's open decision record closes at answer time.
 Require the matching `resolved` event, forbid `--yes`, and require the worker to process every synchronous return until completion or a genuinely new escalation.
 Resume fleet supervision immediately after the decision lands.
@@ -359,7 +357,7 @@ The worker reports the PR when CI first becomes green rather than waiting for me
 For PR-based ship tasks, the ready signal depends on mode: `no-mistakes` reports `done: PR <url> checks green` after CI is green, while `direct-PR` reports `done: PR <url>` after opening the PR.
 Run `bin/fm-pr-check.sh <id> <PR url>` - it records `pr=` and the forge's `pr_head=` when available in the task's meta and arms the watcher's merge poll.
 Tell the captain the PR's full URL, always the complete `https://...` link rather than a bare `#number`, a concise outcome summary, and the no-mistakes risk level when applicable.
-A captain instruction to merge is explicit authority; `yolo` is the only standing routine authority.
+A captain instruction to merge is explicit authority; `yolo` is the only standing routine merge authority.
 For any custom `state/<id>.check.sh` you write yourself, keep it an ordinary single-link mode-`0700` file, print one line only when firstmate should wake, print nothing otherwise, finish before `FM_CHECK_TIMEOUT`, then bind its current bytes with `bin/fm-check-register.sh <id>` before the watcher may execute it.
 
 Tear down a ship task only after landing is confirmed.
@@ -468,7 +466,7 @@ Reach the captain immediately for:
 
 - Work ready for their review, with the full PR URL.
 - Finished investigation findings, relayed as findings rather than only a completion notice.
-- Gate findings that require their decision under the configured authority.
+- Gate findings that `ask-user-authority` escalates.
 - A real blocker or failure after the relevant playbook is exhausted.
 - Anything destructive, irreversible, or security-sensitive.
 - A needed credential or login.
@@ -528,7 +526,7 @@ These skills are not captain-invocable; load them only at their precise triggers
 
 - `bootstrap-diagnostics` - load whenever the session-start digest's bootstrap or network-checks section prints an actionable diagnostic line (`MISSING:`, `MISSING_MANUAL:`, `BACKEND_INVALID:`, `NEEDS_GH_AUTH`, `TANGLE:`, `STARTUP_MEMORY_BUDGET:`, `CREW_DISPATCH: invalid`, `FLEET_SYNC:`, `NETWORK_CHECKS:`, `PR_CHECK_MIGRATION:`, `SECONDMATE_SYNC:`, `SECONDMATE_LIVENESS:`, `SECONDMATE_HANDOFF:`, `NUDGE_SECONDMATES:`, or `FMX:`); silence and `BOOTSTRAP_INFO:` need no load.
 - `diagnostic-reasoning` - load before scoping a reported bug and before acting on a diagnostic report.
-- `ask-user-authority` - load before deciding any ask-user finding, regardless of the project's `yolo` posture.
+- `ask-user-authority` - load before deciding any ask-user finding.
 - `quota-array-dispatch` - load before choosing among a matched crew-dispatch profile array from current quota-axi default TOON.
 - `harness-adapters` - load before spawning or recovering a crewmate or secondmate, handling a trust dialog, sending a harness-specific skill invocation, interrupting or exiting an agent, resuming an exited agent, or verifying a new harness adapter.
 - `firstmate-orca` - load before switching to Orca, spawning or supervising Orca-backed work, smoke-testing Orca backend behavior, debugging Orca task state, or reconciling Orca-backed task metadata.
@@ -565,7 +563,7 @@ The instruction must be specific and recent: it must identify the concrete actio
 Never infer an override, broaden its scope, apply it by analogy, carry it to another object or action, or convert one request into standing authority.
 Ambiguous scope or conflict still requires one concise clarification before action.
 Destructive, irreversible, security-sensitive, discard, and merge actions still require the captain to state that concrete action explicitly; once the captain does so and higher-priority instructions permit it, a conflicting Firstmate-written rule must not rigidly block the action.
-Standing `yolo` authority is not a substitute for a current explicit captain instruction where an explicit action is required.
+Standing `yolo` merge authority is not a substitute for a current explicit captain instruction where an explicit action is required.
 
 ## Maintaining this file
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index cef1f1180f..98cc88a5f6 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -66,7 +66,7 @@ There is no reliable way for `bin/fm-brief.sh`'s scaffold to detect that a task'
 A crewmate picking up such a brief should load the skill even if the brief predates this instruction.
 When supervising live crewmates, keep firstmate's own long validation or build commands in the background so watcher wakes can still be handled.
 Crewmate validation follows the installed no-mistakes version's SKILL.md and live `axi` help instead of duplicating gate mechanics in firstmate docs.
-Firstmate's wrapper still matters: crewmates route every `ask-user` finding to firstmate, which applies the authority contract in `AGENTS.md`, and crewmates avoid `--yes` because it would bypass that check and any required captain escalation.
+Firstmate's wrapper still matters: crewmates route every `ask-user` finding to firstmate, which applies `ask-user-authority`, and crewmates avoid `--yes` because it would bypass that check and any required captain escalation.
 `.no-mistakes.yaml` publishes test evidence to the orphan `no-mistakes/evidence` branch, which shares no history with code branches, and pins the gate's lint command to `bin/fm-lint.sh`, matching the Linux CI lint job.
 Local no-mistakes Test is intent-targeted and must not re-run every `tests/*.test.sh`; `.github/workflows/ci.yml` owns the broad behavior suite plus platform-specific compatibility lanes.
 The pipeline publishes that evidence itself, so never hand-commit `.no-mistakes/` paths onto a feature branch; CI rejects them as tracked personal fleet paths.
diff --git a/README.md b/README.md
index 8ed5226b17..43c1c9e1b1 100644
--- a/README.md
+++ b/README.md
@@ -45,7 +45,7 @@ Launching a supported harness inside it instantiates your first mate - and makes
 - **A visible crew** - every crewmate works in its own tmux window, experimental herdr/zellij tab, cmux workspace, or Orca terminal you can watch or type into; the first mate reconciles.
 - **Disposable worktrees** - each task runs in a clean [treehouse](https://github.com/kunchenguid/treehouse) git worktree, or an Orca-managed worktree when `backend=orca`, so parallel work on one repo never collides.
 - **Two task shapes** - ship tasks deliver authorized changes; scout tasks leave standalone investigation reports when the intake contract warrants separate research.
-- **Explicit project modes** - each project ships via `no-mistakes`, `direct-PR`, or `local-only`, with an optional `+yolo` autonomy flag.
+- **Explicit project modes** - each project ships via `no-mistakes`, `direct-PR`, or `local-only`, with an optional `+yolo` merge-autonomy flag.
 - **Optional secondmates** - opt in to persistent second mates that run from isolated firstmate homes with their own `FM_HOME`, state, projects, and session lock, either locally or as a whole home on an SSH-reachable host, with guarded updates and recovery that never turns an unavailable remote route into a local replacement.
 - **Event-driven, zero-token supervision** - a bash watcher sleeps on the fleet and wakes the first mate only when something needs you; verified primary harnesses also get a turn-end backstop that blocks or follows up on a blind stop when work is under way and supervision is not live.
 - **Optional Relay** - opt in with one local `.env` pairing token so firstmate can answer your public mentions on X and Discord alike, act on normal reversible mention requests through the same lifecycle as chat requests, acknowledge spawned work, and post up to three public-safe completion follow-ups within seven days for genuine milestones and the final outcome without changing non-Relay behavior; a final reply promised in a thread becomes durable state that is reconciled from disk, so a restart or a compacted conversation cannot lose it; dry-run preview records would-be replies and dismissals locally before go-live.
diff --git a/bin/fm-afk-return.sh b/bin/fm-afk-return.sh
index b38c1e07c4..cf5addb24c 100755
--- a/bin/fm-afk-return.sh
+++ b/bin/fm-afk-return.sh
@@ -10,9 +10,8 @@
 # `blocked:` is the crewmate protocol's firstmate-actionable verb. A live task's
 # open blocked event must be remediated and closed with `resolved [key=...]`, or
 # explicitly reclassified in the status stream with a durable reason, before an
-# ordinary captain request may proceed. `needs-decision:` belongs to the
-# configured approval authority and is deliberately not part of this blocker
-# gate; normal reporting routes it through the AGENTS.md section 7 contract.
+# ordinary captain request may proceed. `needs-decision:` is deliberately not
+# part of this blocker gate.
 #
 # The durable state/.afk-return-catchup file is written BEFORE daemon shutdown,
 # so a crash between stopping, wake presentation, and blocker handling fails closed.
diff --git a/bin/fm-brief.sh b/bin/fm-brief.sh
index 7f707c1d1a..63ca1f054e 100755
--- a/bin/fm-brief.sh
+++ b/bin/fm-brief.sh
@@ -43,7 +43,7 @@
 # Ship briefs begin with a worktree-isolation assertion before the branch step.
 # --mode is refused on scout and secondmate scaffolds: a scout's deliverable is a
 # report rather than a merge, and a charter is not a delivery contract.
-# There is no --yolo flag here. The worker never owns approval decisions, so yolo is
+# There is no --yolo flag here. The worker never owns merge decisions, so yolo is
 # a spawn-time and firstmate-side input only (AGENTS.md section 7).
 # Every scaffold's status protocol distinguishes the configured
 # declared-external-wait verb (FM_CLASSIFY_PAUSED_VERB, default "paused") from
@@ -127,10 +127,10 @@ for a in "$@"; do
     --no-projects) NO_PROJECTS=1 ;;
     --mode) want_value=mode ;;
     --mode=*) MODE=${a#--mode=}; MODE_SET=1 ;;
-    # yolo never reaches the worker: it is firstmate's approval authority, not a
+    # yolo never reaches the worker: it is firstmate's merge authority, not a
     # brief input. Refuse it loudly so it is never silently dropped here and then
     # believed to have been recorded.
-    --yolo|--yolo=*) echo "error: --yolo is not a brief input; pass it to bin/fm-spawn.sh, which records the task's approval posture" >&2; exit 1 ;;
+    --yolo|--yolo=*) echo "error: --yolo is not a brief input; pass it to bin/fm-spawn.sh, which records the task's merge posture" >&2; exit 1 ;;
     *) POS+=("$a") ;;
   esac
 done
@@ -396,7 +396,7 @@ Do not hand-edit, commit, or fix findings yourself while a run is active - the p
 
 Two firstmate-specific rules layer on top of that guidance:
 - ask-user findings are never yours to answer: escalate to firstmate (rule 6) and stop.
-  Firstmate applies the authority contract in its \`AGENTS.md\` and obtains any required captain decision.
+  Firstmate applies \`ask-user-authority\` and obtains any required captain decision.
   When the decision comes back, feed it to the gate with \`no-mistakes axi respond\` and let the pipeline apply it - do not route the question to "the user" or implement the fix yourself.
 - Avoid \`--yes\`: it would silently bypass firstmate's authority check and any required captain escalation.
 
@@ -446,7 +446,7 @@ $RULE1
    cadence instead of treating it as a possible wedge. Use \`blocked:\` when you are stuck and need help.
 5. If you hit the same obstacle twice, append \`blocked: {why}\` and stop; firstmate will help.
 6. If a decision belongs above the implementation worker (product choices, destructive actions, ask-user findings),
-   append \`needs-decision: {summary of options}\` and stop. Firstmate will apply the configured authority and reply with the decision.
+   append \`needs-decision: {summary of options}\` and stop. Firstmate will reply with the decision.
    A decision or blocker you opened stays open until a \`resolved\` line carrying its exact key lands; a later \`done:\` or \`working:\` line never closes it, even when the answer is what started that work.
    Firstmate's reply normally writes that closing line at answer time; when a blocker or wait clears WITHOUT a firstmate reply, append \`resolved: {how it cleared}\` yourself (same \`[key=<slug>]\` if you opened it with one) as you resume.
 7. Never stop, restart, or update the shared \`no-mistakes\` daemon - it is one instance serving
diff --git a/bin/fm-project-mode.sh b/bin/fm-project-mode.sh
index 6a97ce2dfe..3046202f23 100755
--- a/bin/fm-project-mode.sh
+++ b/bin/fm-project-mode.sh
@@ -26,9 +26,8 @@
 #                          Mechanical output maps it to its most rigorous leg,
 #                          no-mistakes, so sync, seeding, and init treat such a
 #                          project as the remote-backed pipeline project it is.
-# yolo (orthogonal) = when on, firstmate may make routine approval decisions itself.
-#   AGENTS.md section 7 is the single owner of authority exceptions, including
-#   ask-user contract expansion and stronger captain boundaries.
+# yolo (orthogonal) = merge authority only: when on, firstmate merges green,
+#   in-scope work itself (AGENTS.md section 7).
 #
 # --raw prints the registered annotation unmapped, so a caller that must tell a
 # conditional policy apart from a flat mode sees "no-mistakes-prod-only" itself.
diff --git a/bin/fm-promote.sh b/bin/fm-promote.sh
index 0ed1fd0616..47a2bb0af6 100755
--- a/bin/fm-promote.sh
+++ b/bin/fm-promote.sh
@@ -58,7 +58,7 @@ done
   exit 1
 }
 [ "$YOLO_SET" -eq 1 ] || {
-  echo "error: promotion requires --yolo <on|off>; it is this task's routine approval authority, not a project lookup" >&2
+  echo "error: promotion requires --yolo <on|off>; it is this task's merge authority, not a project lookup" >&2
   exit 1
 }
 case "$MODE" in
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index cfb25f0058..31d5bbde83 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -370,7 +370,7 @@ else
       exit 1
     }
     [ "$YOLO_SET" -eq 1 ] || {
-      echo "error: ship spawns require --yolo <on|off>; it is this task's routine approval authority, not a project lookup" >&2
+      echo "error: ship spawns require --yolo <on|off>; it is this task's merge authority, not a project lookup" >&2
       exit 1
     }
     case "$MODE" in
diff --git a/docs/architecture.md b/docs/architecture.md
index 04e1d51eb2..f5857d5601 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -245,9 +245,10 @@ The `data/secondmates.md` line contract is owned by the [`secondmate-provisionin
 ## Delivery modes are explicit per task
 
 `no-mistakes` tasks run the full validation pipeline, `direct-PR` tasks open PRs without that pipeline, and `local-only` tasks stay local until firstmate performs an approved fast-forward merge.
-Each task's mode and `yolo` posture are firstmate's decision at intake and are passed explicitly to `bin/fm-brief.sh`, `bin/fm-spawn.sh`, and `bin/fm-promote.sh`, which refuse a ship task that does not carry them.
+Each task's mode and `yolo` merge posture are firstmate's decision at intake.
+The mode is passed explicitly to `bin/fm-brief.sh`, and both values are passed explicitly to `bin/fm-spawn.sh` and `bin/fm-promote.sh`; each command refuses to guess the values it consumes.
 A ship brief records its mode as a fixed machine-readable line and the spawn refuses to launch on a different one, so the worker's instructions and the recorded task delivery cannot diverge.
-`data/projects.md` records each project's standing posture and optional `+yolo` flag as the captain's default and as context for that decision, including the conditional `no-mistakes-prod-only` policy; a ship spawn that drops below the registered rigor prints a deviation notice and continues.
+`data/projects.md` records each project's standing posture and optional `+yolo` merge flag as the captain's default and as context for that decision, including the conditional `no-mistakes-prod-only` policy; a ship spawn that drops below the registered rigor prints a deviation notice and continues.
 `bin/fm-project-mode.sh` remains the one registry parser for the mechanical consumers that have no task in hand: fleet sync's `local-only` skip and home seeding's refusal and no-mistakes initialization.
 When a selected delivery path calls for a diff, `bin/fm-review-diff.sh` refreshes the authoritative base and, when task meta records `pr=`, always fetches and compares against `refs/pull/<n>/head` by default (recorded `pr_head=` is only an offline fallback) before falling back to the local branch with a warning.
 Where a no-mistakes pipeline stores evidence in the repo, it publishes that PR-viewable validation evidence to an orphan evidence branch that shares no history with code branches, so it never enters the crew branch or the default branch.
diff --git a/tests/fm-ask-user-authority.test.sh b/tests/fm-ask-user-authority.test.sh
index 469eb92c2a..7b6e185a00 100644
--- a/tests/fm-ask-user-authority.test.sh
+++ b/tests/fm-ask-user-authority.test.sh
@@ -18,7 +18,7 @@ test_primary_and_secondmate_instruction_generation() {
   ship="$home/data/authority-worker/brief.md"
   assert_grep 'ask-user findings are never yours to answer' "$ship" \
     "generated implementation brief lets the worker own an ask-user decision"
-  assert_grep "Firstmate applies the authority contract in its \`AGENTS.md\`" "$ship" \
+  assert_grep "Firstmate applies \`ask-user-authority\` and obtains any required captain decision" "$ship" \
     "generated implementation brief bypasses the primary authority owner"
   assert_grep "silently bypass firstmate's authority check and any required captain escalation" "$ship" \
     "generated implementation brief permits silent ask-user auto-resolution"
diff --git a/tests/fm-brief.test.sh b/tests/fm-brief.test.sh
index 704edd8609..05d732cba2 100755
--- a/tests/fm-brief.test.sh
+++ b/tests/fm-brief.test.sh
@@ -267,7 +267,7 @@ test_ship_mode_is_explicit_not_registry() {
   pass "fm-brief.sh: the explicit ship mode wins over the registered posture"
 }
 
-# yolo is firstmate's approval authority and never reaches the worker, and a scout
+# yolo is firstmate's merge authority and never reaches the worker, and a scout
 # or charter carries no delivery contract. Each must refuse rather than accept and
 # discard the flag, which would look recorded but change nothing.
 test_delivery_flags_are_refused_where_they_do_not_apply() {
diff --git a/tests/fm-spawn-batch.test.sh b/tests/fm-spawn-batch.test.sh
index d35ab2df7a..1c6a550d4a 100755
--- a/tests/fm-spawn-batch.test.sh
+++ b/tests/fm-spawn-batch.test.sh
@@ -125,7 +125,7 @@ test_batch_requires_the_shared_delivery_contract() {
   status=$?
   [ "$status" -ne 0 ] || fail "a ship batch without --yolo should exit non-zero"
   printf '%s\n' "$out" | grep -F 'ship spawns require --yolo' >/dev/null \
-    || fail "batch refusal did not name the missing approval posture"
+    || fail "batch refusal did not name the missing merge posture"
   pass "batch dispatch requires the shared ship delivery contract before any pair runs"
 }
 
diff --git a/tests/fm-task-delivery.test.sh b/tests/fm-task-delivery.test.sh
index 34df6fe748..bfe835b841 100755
--- a/tests/fm-task-delivery.test.sh
+++ b/tests/fm-task-delivery.test.sh
@@ -220,7 +220,7 @@ test_promote_requires_and_records_the_delivery_contract() {
   out=$(FM_HOME="$home" FM_STATE_OVERRIDE="$home/state" "$PROMOTE" promote-d1 --mode direct-PR 2>&1)
   status=$?
   [ "$status" -ne 0 ] || fail "promotion without --yolo should exit non-zero"
-  assert_contains "$out" "promotion requires --yolo" "promote refusal did not name the missing approval posture"
+  assert_contains "$out" "promotion requires --yolo" "promote refusal did not name the missing merge posture"
 
   out=$(FM_HOME="$home" FM_STATE_OVERRIDE="$home/state" "$PROMOTE" promote-d1 --mode no-mistakes-prod-only --yolo off 2>&1)
   status=$?
@@ -232,7 +232,7 @@ test_promote_requires_and_records_the_delivery_contract() {
   expect_code 0 "$status" "a promotion carrying both flags should succeed"
   assert_grep 'kind=ship' "$meta" "promotion did not restore ship teardown protection"
   assert_grep 'mode=direct-PR' "$meta" "promotion did not record the decided delivery mode"
-  assert_grep 'yolo=on' "$meta" "promotion did not record the decided approval posture"
+  assert_grep 'yolo=on' "$meta" "promotion did not record the decided merge posture"
   assert_contains "$out" "ship instructions for mode=direct-PR" "promotion hint did not carry the decided mode"
   [ "$(grep -c '^mode=' "$meta")" = 1 ] || fail "promotion left more than one mode= line in the task record"
   pass "fm-promote: promotion requires the delivery contract and records it exactly once"

From 2b623bc60c6b4a45901e4879159628a59252bd59 Mon Sep 17 00:00:00 2001
From: Ivan Li <ivan@withally.com>
Date: Fri, 21 Aug 2026 12:15:35 +0800
Subject: [PATCH 11/11] fix(spawn): restore filesystem identity guard

---
 bin/fm-spawn.sh                               | 84 ++++++++++++++----
 bin/fm-test-run.sh                            |  2 +-
 .../fm-backend-herdr-presentation-e2e.test.sh |  6 ++
 tests/fm-spawn-worktree-identity-live.test.sh | 86 +++++++++++++++++++
 tests/fm-tangle-guard.test.sh                 | 21 +++++
 5 files changed, 182 insertions(+), 17 deletions(-)
 create mode 100755 tests/fm-spawn-worktree-identity-live.test.sh

diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 31d5bbde83..b03d429dd6 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -1701,6 +1701,39 @@ real_path_or_raw() {  # <path>
   fi
 }
 
+path_filesystem_identity() {  # <path> -> "device:inode"
+  local identity device inode
+  case $(uname -s 2>/dev/null) in
+    Darwin) identity=$(LC_ALL=C stat -f '%d:%i' "$1" 2>/dev/null) || return 1 ;;
+    Linux) identity=$(LC_ALL=C stat -c '%d:%i' -- "$1" 2>/dev/null) || return 1 ;;
+    *)
+      identity=$(LC_ALL=C stat -c '%d:%i' -- "$1" 2>/dev/null) \
+        || identity=$(LC_ALL=C stat -f '%d:%i' "$1" 2>/dev/null) \
+        || return 1
+      ;;
+  esac
+  case "$identity" in
+    *:*)
+      device=${identity%%:*}
+      inode=${identity#*:}
+      case "$device:$inode" in
+        *:*:*|:*|*:|*[!0-9:]*) return 1 ;;
+      esac
+      printf '%s:%s\n' "$device" "$inode"
+      ;;
+    *) return 1 ;;
+  esac
+}
+
+path_identity_or_refuse() {  # <path> <context>
+  local identity
+  identity=$(path_filesystem_identity "$1") || {
+    echo "error: cannot read filesystem identity for '$1' while $2 on platform '$(uname -s 2>/dev/null || echo unknown)'; refusing to launch" >&2
+    return 1
+  }
+  printf '%s\n' "$identity"
+}
+
 # Session-provider container-ensure + task creation. tmux stays exactly as P1
 # left it (same session-name / new-window sequence, see bin/backends/tmux.sh);
 # a herdr spawn goes through the version-gated, workspace-per-HOME,
@@ -1711,6 +1744,7 @@ real_path_or_raw() {  # <path>
 # per-backend routing (fm_backend_resolve_selector).
 validate_spawn_worktree() {  # <source> <inspect-target>
   local source=$1 inspect_target=$2 wt_real proj_real wt_top wt_top_real
+  local wt_identity proj_identity wt_top_identity
   wt_real=
   if ! wt_real=$(cd "$WT" 2>/dev/null && pwd -P); then
     wt_real=
@@ -1721,7 +1755,14 @@ validate_spawn_worktree() {  # <source> <inspect-target>
   if ! wt_top_real=$(cd "$wt_top" 2>/dev/null && pwd -P); then
     wt_top_real=
   fi
-  if [ -z "$wt_real" ] || [ -z "$wt_top_real" ] || [ "$wt_real" != "$wt_top_real" ] || [ "$wt_real" = "$proj_real" ]; then
+  if [ -z "$wt_real" ] || [ -z "$wt_top_real" ]; then
+    echo "error: $source did not yield an isolated worktree (resolved '$WT'; worktree root '${wt_top:-none}'; primary '$PROJ_ABS'); refusing to launch to avoid tangling the primary checkout. Inspect target $inspect_target" >&2
+    exit 1
+  fi
+  wt_identity=$(path_identity_or_refuse "$wt_real" "validating $source's resolved worktree") || exit 1
+  proj_identity=$(path_identity_or_refuse "$proj_real" "validating $source's primary checkout") || exit 1
+  wt_top_identity=$(path_identity_or_refuse "$wt_top_real" "validating $source's git worktree root") || exit 1
+  if [ "$wt_identity" != "$wt_top_identity" ] || [ "$wt_identity" = "$proj_identity" ]; then
     echo "error: $source did not yield an isolated worktree (resolved '$WT'; worktree root '${wt_top:-none}'; primary '$PROJ_ABS'); refusing to launch to avoid tangling the primary checkout. Inspect target $inspect_target" >&2
     exit 1
   fi
@@ -2200,13 +2241,19 @@ if [ "$RELAUNCH" -eq 1 ]; then
   # that worktree, so the replacement agent starts where the work is rather
   # than wherever the pane happened to drift.
   relaunch_wt_real=$(real_path_or_raw "$WT")
+  relaunch_wt_identity=$(path_identity_or_refuse "$relaunch_wt_real" "validating task $ID's recorded relaunch worktree") || exit 1
   relaunch_seen=
+  relaunch_seen_identity=
   for _ in $(seq 1 10); do
     relaunch_seen=$(spawn_current_path "$WT_TARGET" || true)
-    [ -z "$relaunch_seen" ] || [ "$(real_path_or_raw "$relaunch_seen")" != "$relaunch_wt_real" ] || break
+    if [ -n "$relaunch_seen" ]; then
+      relaunch_seen_real=$(real_path_or_raw "$relaunch_seen")
+      relaunch_seen_identity=$(path_identity_or_refuse "$relaunch_seen_real" "validating task $ID's relaunch endpoint") || exit 1
+      [ "$relaunch_seen_identity" != "$relaunch_wt_identity" ] || break
+    fi
     sleep 0.5
   done
-  if [ -z "$relaunch_seen" ] || [ "$(real_path_or_raw "$relaunch_seen")" != "$relaunch_wt_real" ]; then
+  if [ -z "$relaunch_seen" ] || [ "$relaunch_seen_identity" != "$relaunch_wt_identity" ]; then
     echo "error: task $ID's endpoint is in '${relaunch_seen:-unknown}', not its recorded worktree '$WT'; refusing to relaunch an agent outside the copy holding its work" >&2
     exit 1
   fi
@@ -2219,37 +2266,42 @@ elif [ "$KIND" != secondmate ] && [ "$BACKEND" != orca ]; then
   # automatic-rename slips through), display-message -t <bad-name> falls back to the
   # active client's window, which would misread firstmate's OWN pane path as the
   # worktree and tangle a hook into the primary checkout. The window id never lies.
-  # Compare against PROJ_ABS_REAL (physical), not PROJ_ABS: a symlinked project
-  # prefix would otherwise make the pane's OS-level cwd read differ from
-  # PROJ_ABS on the very first poll, before the pane has actually moved.
+  # Compare filesystem identities rather than path text. Physical path spelling
+  # can still retain caller-supplied capitalization on case-insensitive macOS,
+  # and POSIX permits the same directory to retain a distinct leading // form.
   #
-  # A single read that already differs from PROJ_ABS_REAL is not proof the pane
-  # settled there: on some tmux/WSL setups a brand-new window's pane_current_path
+  # A single read whose identity already differs from the primary checkout is
+  # not proof the pane settled there: on some tmux/WSL setups a brand-new
+  # window's pane_current_path
   # transiently reports an unrelated stale path (seen live as another real git
   # checkout entirely) before the shell catches up with treehouse get's cd. That
-  # stale path still passes the PROJ_ABS_REAL comparison and validate_spawn_worktree
+  # stale path still passes the primary-checkout identity comparison and
+  # validate_spawn_worktree
   # below (it resolves to a real, distinct worktree top-level too), so accepting it
   # on one read alone silently records the wrong worktree= in state/<id>.meta. Require
-  # two consecutive reads to agree on the same non-project path before accepting it;
+  # two consecutive reads to identify the same non-project directory before
+  # accepting it;
   # a mismatch just becomes the new candidate rather than resetting the wait, so a
   # pane that is already settled by the first real read only costs the one existing
   # inter-poll sleep as confirmation, not a whole extra cycle on top.
-  candidate=""
+  candidate_identity=""
+  project_identity=$(path_identity_or_refuse "$PROJ_ABS_REAL" "waiting for treehouse get to leave the primary checkout") || exit 1
   for _ in $(seq 1 60); do
     p=$(spawn_current_path "$WT_TARGET" || true)
     if [ -n "$p" ]; then
       p_real=$(real_path_or_raw "$p")
-      if [ "$p_real" != "$PROJ_ABS_REAL" ]; then
-        if [ -n "$candidate" ] && [ "$p_real" = "$candidate" ]; then
+      p_identity=$(path_identity_or_refuse "$p_real" "waiting for treehouse get to settle") || exit 1
+      if [ "$p_identity" != "$project_identity" ]; then
+        if [ -n "$candidate_identity" ] && [ "$p_identity" = "$candidate_identity" ]; then
           WT="$p"
           break
         fi
-        candidate="$p_real"
+        candidate_identity="$p_identity"
       else
-        candidate=""
+        candidate_identity=""
       fi
     else
-      candidate=""
+      candidate_identity=""
     fi
     sleep 1
   done
diff --git a/bin/fm-test-run.sh b/bin/fm-test-run.sh
index 3a9e1d7ae9..22e5db0797 100755
--- a/bin/fm-test-run.sh
+++ b/bin/fm-test-run.sh
@@ -196,7 +196,7 @@ family_for_basename() {
     fm-opencode-primary-live-e2e.test.sh|fm-pi-primary-live-e2e.test.sh|\
     fm-sessionstart-hook-live-e2e.test.sh|fm-sessionstart-instruction-refresh-live-e2e.test.sh|\
     fm-quota-array-dispatch-live-e2e.test.sh|fm-send-secondmate-marker-herdr-e2e.test.sh|\
-    fm-herdr-submit-confirm-live-e2e.test.sh)
+    fm-herdr-submit-confirm-live-e2e.test.sh|fm-spawn-worktree-identity-live.test.sh)
       printf '%s\n' live-harness-optin
       ;;
     fm-backend-herdr.test.sh|fm-backend-tmux-smoke.test.sh|fm-backend.test.sh|\
diff --git a/tests/fm-backend-herdr-presentation-e2e.test.sh b/tests/fm-backend-herdr-presentation-e2e.test.sh
index ac62abb427..8afb7965c3 100755
--- a/tests/fm-backend-herdr-presentation-e2e.test.sh
+++ b/tests/fm-backend-herdr-presentation-e2e.test.sh
@@ -831,6 +831,12 @@ assert_no_ordering_lifecycle_calls_since "$FAIL_START" "failed presentation orde
 pass "real Herdr lab: forced workspace.move failure leaves a successful worker in default order with a warning and no cleanup"
 
 mkdir -p "$POST_CREATE_ABORT_CONTROL"
+# A pane's foreground_cwd is always a real, live directory. Materialize the
+# non-worktree location the fixture points settled panes at so its filesystem
+# identity reads cleanly: the post-create abort must then come from
+# validate_spawn_worktree rejecting a real directory that is not an isolated
+# git worktree, not from an identity-read failure on a phantom path.
+mkdir -p "$POST_CREATE_ABORT_CONTROL/not-a-worktree"
 ABORT_START=$(log_line_count)
 ABORT_FOCUS_START=$(focus_audit_line_count)
 spawn_task abort-a "$HOME_DIR" "$PROJECT_DIR" > "$TMP_ROOT/abort-a.out" 2> "$TMP_ROOT/abort-a.err" &
diff --git a/tests/fm-spawn-worktree-identity-live.test.sh b/tests/fm-spawn-worktree-identity-live.test.sh
new file mode 100755
index 0000000000..61b2731966
--- /dev/null
+++ b/tests/fm-spawn-worktree-identity-live.test.sh
@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# Live macOS case-insensitive-filesystem proof for fm-spawn's worktree guard.
+#
+# Run explicitly with FM_SPAWN_CASE_IDENTITY_LIVE=1 on the macOS host whose
+# filesystem behavior is being trusted. The opt-in refuses every non-Darwin
+# platform by name, refuses a case-sensitive fixture, drives fm-spawn.sh through
+# its public CLI, and requires the real case-variant primary path to be refused.
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+if [ "${FM_SPAWN_CASE_IDENTITY_LIVE:-0}" != 1 ]; then
+  echo "skip: set FM_SPAWN_CASE_IDENTITY_LIVE=1 to run the macOS case-insensitive worktree-identity proof"
+  exit 0
+fi
+
+PLATFORM=$(uname -s 2>/dev/null || echo unknown)
+[ "$PLATFORM" = Darwin ] || {
+  echo "not ok - FM_SPAWN_CASE_IDENTITY_LIVE=1 requires macOS Darwin, got '$PLATFORM'" >&2
+  exit 1
+}
+
+TMP_ROOT=$(fm_test_tmproot fm-spawn-worktree-identity-live)
+fm_git_identity fmtest fmtest@example.invalid
+
+PROJECT="$TMP_ROOT/PrimaryProject"
+PROJECT_VARIANT="$TMP_ROOT/primaryproject"
+HOME_DIR="$TMP_ROOT/home"
+ID=case-identity-live
+mkdir -p "$PROJECT" "$HOME_DIR/data/$ID"
+git init -q -b main "$PROJECT"
+git -C "$PROJECT" commit -q --allow-empty -m init
+printf 'brief\n' > "$HOME_DIR/data/$ID/brief.md"
+
+[ -d "$PROJECT_VARIANT" ] || {
+  echo "not ok - Darwin filesystem at '$TMP_ROOT' is case-sensitive; live case-identity proof cannot run" >&2
+  exit 1
+}
+[ "$PROJECT" -ef "$PROJECT_VARIANT" ] || {
+  echo "not ok - Darwin case variants do not identify the same device and inode at '$TMP_ROOT'" >&2
+  exit 1
+}
+
+FAKEBIN=$(fm_fakebin "$TMP_ROOT/fake")
+cat > "$FAKEBIN/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "$*" in
+  *"#{pane_current_path}"*) printf '%s\n' "${FM_FAKE_PANE_PATH:?}"; exit 0 ;;
+esac
+case "${1:-}" in
+  display-message) printf 'firstmate\n'; exit 0 ;;
+  new-window) printf '@caseidentity\n'; exit 0 ;;
+  list-windows|has-session|new-session|send-keys|set-window-option) exit 0 ;;
+esac
+exit 0
+SH
+chmod +x "$FAKEBIN/tmux"
+fm_fake_exit0 "$FAKEBIN" treehouse
+fm_fake_exit0 "$FAKEBIN" sleep
+
+mkdir -p "$HOME_DIR/state" "$HOME_DIR/projects" "$HOME_DIR/config"
+set +e
+OUT=$(FM_ROOT_OVERRIDE='' FM_HOME="$HOME_DIR" \
+  FM_STATE_OVERRIDE="$HOME_DIR/state" FM_DATA_OVERRIDE="$HOME_DIR/data" \
+  FM_PROJECTS_OVERRIDE="$HOME_DIR/projects" FM_CONFIG_OVERRIDE="$HOME_DIR/config" \
+  FM_SPAWN_NO_GUARD=1 FM_FAKE_PANE_PATH="$PROJECT" TMUX="fake,1,0" \
+  PATH="$FAKEBIN:$PATH" \
+  "$ROOT/bin/fm-spawn.sh" "$ID" "$PROJECT_VARIANT" codex \
+    --mode no-mistakes --yolo off 2>&1)
+STATUS=$?
+set -e
+
+printf '# command: FM_SPAWN_CASE_IDENTITY_LIVE=1 tests/fm-spawn-worktree-identity-live.test.sh\n'
+printf '# platform: %s\n' "$PLATFORM"
+printf '# primary: %s\n' "$PROJECT_VARIANT"
+printf '# pane cwd: %s\n' "$PROJECT"
+printf '# exit: %s\n' "$STATUS"
+printf '%s\n' "$OUT"
+
+expect_code 1 "$STATUS" "case-variant primary checkout should be refused"
+assert_contains "$OUT" "treehouse get did not enter a worktree" \
+  "case-variant primary checkout did not produce the settle-loop refusal"
+assert_not_contains "$OUT" "spawned $ID" "case-variant primary checkout was wrongly launched"
+pass "Darwin case-insensitive filesystem: fm-spawn refuses the primary checkout by identity"
diff --git a/tests/fm-tangle-guard.test.sh b/tests/fm-tangle-guard.test.sh
index 64aabe6400..49ba4845cf 100755
--- a/tests/fm-tangle-guard.test.sh
+++ b/tests/fm-tangle-guard.test.sh
@@ -215,6 +215,26 @@ test_spawn_isolation_abort() {
   pass "fm-spawn: aborts unless the resolved worktree is a genuine, isolated worktree"
 }
 
+# The exact-path primary-copy refusal through the fm-spawn CLI: when the pane
+# settles at the primary checkout itself, the settle loop never leaves it and the
+# spawn refuses rather than tangling a hook into the primary.
+test_spawn_primary_copy_abort() {
+  local home proj fakebin out status
+  home="$TMP_ROOT/spawn-identity-home"
+  mkdir -p "$home/data"
+  proj=$(make_repo "$TMP_ROOT/spawn-identity-proj")
+  fakebin=$(make_spawn_fakebin "$TMP_ROOT/spawn-identity-fake")
+  fm_fake_exit0 "$fakebin" sleep
+
+  out=$(run_spawn "$home" abort-identity-gg7 "$proj" "$proj" "$fakebin"); status=$?
+  expect_code 1 "$status" "spawn should refuse the primary checkout itself"
+  assert_contains "$out" "treehouse get did not enter a worktree" \
+    "primary checkout did not produce the settle-loop refusal"
+  assert_not_contains "$out" "spawned abort-identity-gg7" \
+    "primary checkout was wrongly launched"
+  pass "fm-spawn: settle loop refuses the primary checkout through the CLI"
+}
+
 # --- GUARD 1c: fm-spawn tmux window construction ----------------------------
 
 # The prevention guard also depends on fm-spawn building robust tmux commands
@@ -307,4 +327,5 @@ test_guard_banner
 test_bootstrap_line
 test_brief_assertion_precedes_branch
 test_spawn_isolation_abort
+test_spawn_primary_copy_abort
 test_spawn_tmux_window_construction