diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a9fff23c2b4..39d32d0859a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -45,6 +45,7 @@ jobs:
         run: |
           set -eu
           bash tests/fm-worker-isolation.test.sh
+          bash tests/fm-inactive-outcome.test.sh
           bash tests/fm-watch-session.test.sh
           bash tests/fm-slot-occupant-proof.test.sh
           FM_TEARDOWN_TEST_FOCUS=s1 bash tests/fm-teardown.test.sh
diff --git a/AGENTS.md b/AGENTS.md
index e9cc9c72ed4..5c8273ff6df 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -81,11 +81,13 @@ data/                personal fleet records; LOCAL, gitignored as a whole
   <id>/brief.md      per-task crewmate brief, or per-secondmate charter brief when kind=secondmate
   <id>/report.md     scout task deliverable, written by the crewmate; survives teardown
 projects/            cloned repos; gitignored; READ-ONLY for you
-state/               volatile runtime signals; gitignored
+state/               gitignored operational state: volatile runtime signals plus durable local inactive-outcome receipts
   <id>.status        appended by crewmates: "<state>: <note>" wake-event lines, not current-state truth
   <id>.turn-ended    touched by turn-end hooks
-  <id>.meta          written by fm-spawn: window=, worktree=, project=, harness=, kind=, mode=, yolo=; kind=secondmate also records home= and projects= (fm-pr-check appends pr= and verified pr_head= when available)
+  <id>.meta          written by fm-spawn: window=, worktree=, project=, harness=, kind=, mode=, yolo=, and spawn_incarnation=; no-mistakes ship tasks also carry the run-binding handoff/state and, after binding, run_id=; kind=secondmate also records home= and projects= (fm-pr-check appends pr= and verified pr_head= when available)
   <id>.check.sh      optional slow poll you write per task (e.g. merged-PR check)
+  terminal-outcomes/ fingerprinted local inactive terminal-outcome receipts; the locked wake drain is the only path that presents and acknowledges them
+  .inactive-outcome-* bounded scan, claim, cursor, and retry state; never touch
   x-watch.check.sh   generated X-mode relay poll shim; present only when opted in (section 14)
   x-inbox/           generated X-mode pending mention payloads; fmx-respond drains it (section 14)
   x-outbox/          generated X-mode dry-run reply previews; inspect it when FMX_DRY_RUN is set (section 14)
@@ -393,7 +395,7 @@ If one pair fails, the rest still run and the batch exits non-zero.
 The script resolves the harness (`fm-harness.sh crew`), owns the verified launch templates, resolves the project's delivery mode (`fm-project-mode.sh`) for ship/scout tasks, and records `harness=`, `kind=`, `mode=`, and `yolo=` in the task's meta; a non-flag third argument containing whitespace is treated as a raw launch command (only for verifying new adapters).
 For `kind=secondmate`, the same script launches in the registered or explicit firstmate home instead of running `treehouse get` for a project, records `home=` and `projects=`, and uses the charter brief as the launch prompt.
 
-For ship and scout tasks, the script creates the window (in your current tmux session, or a dedicated `firstmate` session when you are outside tmux), runs `treehouse get`, waits for the worktree subshell, asserts the resolved worktree is a genuine isolated worktree distinct from the primary checkout (aborting the spawn otherwise, to prevent the worktree tangle of section 8), installs the turn-end hook, records `state/<id>.meta`, and launches the agent with the brief.
+For ship and scout tasks, the script creates the window (in your current tmux session, or a dedicated `firstmate` session when you are outside tmux), runs `treehouse get`, waits for the worktree subshell, asserts the resolved worktree is a genuine isolated worktree distinct from the primary checkout (aborting the spawn otherwise, to prevent the worktree tangle of section 8), installs the turn-end hook, records `state/<id>.meta`, and launches the agent with the brief. No-mistakes ship spawns install a task-local command bridge in the child PATH; when the child invokes `no-mistakes axi run`, the bridge captures the actual returned run ID and publishes its binding under the existing task lock before the command can continue. Ship spawns never fabricate or infer a run ID, and refuse to launch if this handoff cannot be installed.
 For `kind=secondmate`, the script creates the same kind of window but starts directly in the persistent home.
 Before launching a secondmate, the script fast-forwards its home worktree to firstmate's own current default-branch commit, so a freshly spawned or recovery-respawned secondmate always starts on firstmate's current version.
 This is a purely local fast-forward of tracked files - never a fetch from origin, and never touching the gitignored operational dirs - so the secondmate's backlog, projects, and any prior in-flight work are untouched; a dirty, diverged, or in-flight home is left as-is and launches unchanged.
diff --git a/bin/backends/herdr.sh b/bin/backends/herdr.sh
index bb5b85cd1c7..5b30ac85c7f 100755
--- a/bin/backends/herdr.sh
+++ b/bin/backends/herdr.sh
@@ -358,6 +358,7 @@ fm_backend_herdr_server_ensure() {  # <session>
   local session=$1 running out i
   running=$(fm_backend_herdr_cli "$session" status --json 2>/dev/null | jq -r '.server.running // false' 2>/dev/null)
   [ "$running" = "true" ] && return 0
+  [ "${FM_BACKEND_HERDR_NO_SERVER_START:-0}" = 1 ] && return 1
   ( fm_backend_herdr_cli "$session" server >/dev/null 2>&1 & ) || return 1
   for i in $(seq 1 20); do
     running=$(fm_backend_herdr_cli "$session" status --json 2>/dev/null | jq -r '.server.running // false' 2>/dev/null)
diff --git a/bin/fm-crew-state.sh b/bin/fm-crew-state.sh
index a46a16cd02d..e8d535c47d4 100755
--- a/bin/fm-crew-state.sh
+++ b/bin/fm-crew-state.sh
@@ -59,6 +59,14 @@ STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 . "$SCRIPT_DIR/fm-backend.sh"
 # shellcheck source=bin/fm-numeric-lib.sh
 . "$SCRIPT_DIR/fm-numeric-lib.sh"
+# shellcheck source=bin/fm-wake-lib.sh
+FM_SESSION_LOCK_BOOTSTRAP=1
+FM_WAKE_LIB_NO_INIT=1
+. "$SCRIPT_DIR/fm-wake-lib.sh"
+# shellcheck source=bin/fm-run-step-lib.sh
+FM_RUN_STEP_READ_ONLY=1
+. "$SCRIPT_DIR/fm-run-step-lib.sh"
+trap 'fm_run_step_binding_release_held >/dev/null 2>&1 || true' EXIT
 
 ID=${1:-}
 [ -n "$ID" ] || { echo "usage: fm-crew-state.sh <id>" >&2; exit 2; }
@@ -368,6 +376,62 @@ nm_run_ids_for_branch() {  # <branch> <list-output>
 # CREW_BRANCH is empty at detached HEAD (a just-spawned crew, or a scout's
 # scratch worktree); with no branch there is no run to attribute to this crew.
 CREW_BRANCH=$(git -C "$WT" symbolic-ref --quiet --short HEAD 2>/dev/null || true)
+META_INCARNATION=$(awk -F= '$1 == "spawn_incarnation" { print substr($0, index($0, "=") + 1); n++ } END { exit(n == 1 ? 0 : 1) }' "$META" 2>/dev/null || true)
+META_SPAWN_STATE=absent
+META_SPAWN_STATE_COUNT=0
+META_BINDING_STATE=absent
+META_BINDING_STATE_COUNT=0
+while IFS= read -r META_BINDING_LINE; do
+  case "$META_BINDING_LINE" in
+    spawn_state=*)
+      META_SPAWN_STATE_COUNT=$((META_SPAWN_STATE_COUNT + 1))
+      META_SPAWN_STATE=${META_BINDING_LINE#*=}
+      ;;
+    run_binding_state=*)
+      META_BINDING_STATE_COUNT=$((META_BINDING_STATE_COUNT + 1))
+      META_BINDING_STATE=${META_BINDING_LINE#*=}
+      ;;
+  esac
+done < "$META"
+if [ "$META_SPAWN_STATE_COUNT" -ne 0 ]; then
+  [ "$META_SPAWN_STATE_COUNT" = 1 ] || META_SPAWN_STATE=invalid
+  case "$META_SPAWN_STATE" in
+    starting|aborted) ;;
+    *) META_SPAWN_STATE=invalid ;;
+  esac
+fi
+if [ "$META_BINDING_STATE_COUNT" -ne 0 ]; then
+  [ "$META_BINDING_STATE_COUNT" = 1 ] || META_BINDING_STATE=invalid
+  case "$META_BINDING_STATE" in
+    pending|staged|bound) ;;
+    *) META_BINDING_STATE=invalid ;;
+  esac
+fi
+BOUND_RUN_ID=
+BOUND_RUN_STATUS=75
+BOUND_RUN_REQUIRED=0
+BOUND_RUN_EVIDENCE=$(fm_run_step_binding_path "$ID") || exit 1
+if [ -e "$BOUND_RUN_EVIDENCE" ] || [ -L "$BOUND_RUN_EVIDENCE" ]; then
+  BOUND_RUN_REQUIRED=1
+fi
+case "$META_BINDING_STATE" in
+  pending|bound|staged|invalid) BOUND_RUN_REQUIRED=1 ;;
+esac
+case "$META_SPAWN_STATE" in
+  starting|aborted|invalid) BOUND_RUN_REQUIRED=1 ;;
+esac
+if [ "$KIND" = ship ] && [ -n "$CREW_BRANCH" ] && [ -n "$META_INCARNATION" ]; then
+  if fm_run_step_binding_read_held "$ID" "$META_INCARNATION"; then
+    BOUND_RUN_ID=$FM_RUN_STEP_HELD_VALUE
+    BOUND_RUN_STATUS=0
+  else
+    BOUND_RUN_STATUS=$?
+  fi
+  [ "$BOUND_RUN_STATUS" = 1 ] && {
+    printf '%s\n' 'state: unknown · source: run-step · incarnation binding could not be read' >&2
+    exit 1
+  }
+fi
 
 # A branch match is not enough when branch names are reused. Accept a run only
 # when its recorded head is the local worktree HEAD, or a descendant of that
@@ -387,30 +451,49 @@ HAVE_RUN=0
 # Scouts and secondmates never drive a no-mistakes validation of their own
 # worktree, so skip the lookup for them and read state from pane/log directly.
 if [ "$KIND" = ship ] && [ -n "$CREW_BRANCH" ] && command -v no-mistakes >/dev/null 2>&1; then
-  RUN_OUT=$(nm_run axi status)
-  if [ -n "$RUN_OUT" ]; then
-    run_branch=$(strip_quotes "$(nm_field branch)")
-    if [ -n "$run_branch" ] && [ "$run_branch" = "$CREW_BRANCH" ] && nm_run_head_matches_worktree; then
-      HAVE_RUN=1
+  if [ "$BOUND_RUN_STATUS" = 0 ] || [ "$BOUND_RUN_REQUIRED" = 1 ]; then
+    BOUND_RUN_REQUIRED=1
+    if [ "$BOUND_RUN_STATUS" = 0 ]; then
+      RUN_OUT=$(nm_run axi status --run "$BOUND_RUN_ID")
+      run_id=$(strip_quotes "$(nm_field id)")
+      run_branch=$(strip_quotes "$(nm_field branch)")
+      if [ "$run_id" = "$BOUND_RUN_ID" ] && [ "$run_branch" = "$CREW_BRANCH" ] \
+        && nm_run_head_matches_worktree; then
+        HAVE_RUN=1
+      else
+        RUN_OUT=
+      fi
     else
-      # The active-or-most-recent run is for another branch, or its branch name
-      # matches but its code identity does not. Inspect bounded recent runs for
-      # this branch until one is compatible with the worktree.
-      list_out=$(nm_run axi)
-      candidate_ids=$(nm_run_ids_for_branch "$CREW_BRANCH" "$list_out")
-      while IFS= read -r rid; do
-        [ -n "$rid" ] || continue
-        RUN_OUT=$(nm_run axi status --run "$rid")
-        run_branch=$(strip_quotes "$(nm_field branch)")
-        if [ "$run_branch" = "$CREW_BRANCH" ] && nm_run_head_matches_worktree; then
-          HAVE_RUN=1
-          break
-        fi
-      done <<< "$candidate_ids"
+      RUN_OUT=
+    fi
+  else
+    RUN_OUT=$(nm_run axi status)
+    if [ -n "$RUN_OUT" ]; then
+      run_branch=$(strip_quotes "$(nm_field branch)")
+      if [ -n "$run_branch" ] && [ "$run_branch" = "$CREW_BRANCH" ] && nm_run_head_matches_worktree; then
+        HAVE_RUN=1
+      else
+        # The active-or-most-recent run is for another branch, or its branch name
+        # matches but its code identity does not. Inspect bounded recent runs for
+        # this branch until one is compatible with the worktree.
+        list_out=$(nm_run axi)
+        candidate_ids=$(nm_run_ids_for_branch "$CREW_BRANCH" "$list_out")
+        while IFS= read -r rid; do
+          [ -n "$rid" ] || continue
+          RUN_OUT=$(nm_run axi status --run "$rid")
+          run_branch=$(strip_quotes "$(nm_field branch)")
+          if [ "$run_branch" = "$CREW_BRANCH" ] && nm_run_head_matches_worktree; then
+            HAVE_RUN=1
+            break
+          fi
+        done <<< "$candidate_ids"
+      fi
     fi
   fi
 fi
 
+[ "$HAVE_RUN" = 1 ] || [ "$BOUND_RUN_REQUIRED" = 0 ] || emit unknown run-step "bound run unavailable"
+
 # --- run-step authoritative path -------------------------------------------
 
 if [ "$HAVE_RUN" = 1 ]; then
@@ -530,6 +613,38 @@ if [ "$HAVE_RUN" = 1 ]; then
     RUN_DETAIL="$RUN_DETAIL${SEP}convergence-round=$convergence_round${SEP}convergence-fingerprint=unavailable"
   fi
 
+  run_id=$(strip_quotes "$(nm_field id)")
+  run_step_id_count=$(grep -c '^run_step_id=' "$META" 2>/dev/null || true)
+  run_step_id=
+  if [ "$run_step_id_count" = 1 ]; then
+    run_step_id=$(grep '^run_step_id=' "$META" 2>/dev/null | cut -d= -f2- || true)
+  fi
+  incarnation=$(awk -F= '$1 == "spawn_incarnation" { print substr($0, index($0, "=") + 1); n++ } END { exit(n == 1 ? 0 : 1) }' "$META" 2>/dev/null || true)
+  case "$RUN_STATE" in
+    done|failed)
+      case "$run_step_id_count" in
+        0) run_step_id_matches_meta=1 ;;
+        1) [ "$run_step_id" = "$run_id" ] && run_step_id_matches_meta=1 || run_step_id_matches_meta=0 ;;
+        *) run_step_id_matches_meta=0 ;;
+      esac
+      if [ "$run_step_id_matches_meta" != 1 ] || [ -z "$run_id" ] || [ -z "$incarnation" ]; then
+        printf '%s\n' 'state: unknown · source: run-step · incarnation binding unavailable' >&2
+        exit 75
+      fi
+      fm_run_step_binding_validate "$ID" "$run_id" "$incarnation" || {
+        status=$?
+        printf '%s\n' 'state: unknown · source: run-step · incarnation binding unavailable' >&2
+        [ "$status" = 75 ] && exit 75
+        exit 1
+      }
+      ;;
+  esac
+  case "$RUN_STATE" in
+    working|parked|paused|done|failed)
+      [ -n "$run_id" ] && RUN_DETAIL="$RUN_DETAIL${SEP}run-id=$run_id"
+      ;;
+  esac
+
   emit "$RUN_STATE" run-step "$RUN_DETAIL"
 fi
 
diff --git a/bin/fm-inactive-reconcile.sh b/bin/fm-inactive-reconcile.sh
new file mode 100755
index 00000000000..5fff9ce5259
--- /dev/null
+++ b/bin/fm-inactive-reconcile.sh
@@ -0,0 +1,4480 @@
+#!/usr/bin/env bash
+# Replay an authoritative terminal crew state that stayed quiet long enough to
+# be missed by the normal watcher. This is a reporting layer only: it never
+# closes an endpoint, returns a slot, removes a worktree, or changes a PR.
+set -u
+set -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=bin/fm-worker-isolation-lib.sh
+. "$SCRIPT_DIR/fm-worker-isolation-lib.sh"
+fm_worker_refuse_primary_operation "inactive outcome reconciliation" || exit 1
+# shellcheck source=bin/fm-pane-idle-lib.sh
+. "$SCRIPT_DIR/fm-pane-idle-lib.sh"
+
+FM_ROOT="${FM_ROOT_OVERRIDE:-${FM_ROOT:-$(cd "$SCRIPT_DIR/.." && pwd)}}"
+FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+STATE="${FM_STATE_OVERRIDE:-${STATE:-$FM_HOME/state}}"
+OUTCOME_DIR="$STATE/terminal-outcomes"
+SCAN_MARKER="$STATE/.inactive-outcome-reconcile"
+SCAN_CURSOR="$STATE/.inactive-outcome-reconcile.cursor"
+SCAN_CURSOR_IDENTITY="$STATE/.inactive-outcome-reconcile.cursor.identity"
+REPORTED_ROUTE_CURSOR="$STATE/.reported-secondmate-route-repair.cursor"
+PENDING_RECEIPT_CURSOR="$STATE/.pending-receipt-republish.cursor"
+MAINTENANCE_PHASE_CURSOR="$STATE/.inactive-outcome-maintenance.cursor"
+MAINTENANCE_ORDER_CURSOR="$STATE/.inactive-outcome-maintenance-order.cursor"
+DIRECT_FIND_PENDING="$STATE/.inactive-outcome-find.pending"
+DIRECT_FIND_OFFSET="$STATE/.inactive-outcome-find.pending.offset"
+DIRECT_FIND_RETRY="$STATE/.inactive-outcome-find.pending.retry"
+DIRECT_FIND_INCOMPLETE="$STATE/.inactive-outcome-find.incomplete"
+DIRECT_FIND_ENUM_CURSOR="$STATE/.inactive-outcome-find.enum.cursor"
+ENUM_PROGRESS_DIR="$STATE/.inactive-outcome-enum"
+REPORTED_ROUTE_PENDING="$STATE/.reported-secondmate-route-repair.pending"
+REPORTED_ROUTE_OFFSET="$STATE/.reported-secondmate-route-repair.pending.offset"
+REPORTED_ROUTE_RETRY="$STATE/.reported-secondmate-route-repair.pending.retry"
+REPORTED_ROUTE_ENUM_CURSOR="$STATE/.reported-secondmate-route-repair.enum.cursor"
+PENDING_RECEIPT_PENDING="$STATE/.pending-receipt-republish.pending"
+PENDING_RECEIPT_OFFSET="$STATE/.pending-receipt-republish.pending.offset"
+PENDING_RECEIPT_RETRY="$STATE/.pending-receipt-republish.pending.retry"
+PENDING_RECEIPT_ENUM_CURSOR="$STATE/.pending-receipt-republish.enum.cursor"
+MERGE_TXN="$STATE/.inactive-outcome-merge.txn"
+FM_WAKE_QUEUE="${FM_WAKE_QUEUE:-$STATE/.wake-queue}"
+PANE_IDLE_DIR="$STATE/.pane-idle"
+PANE_IDLE_INDEX_DIR="$STATE/.inactive-outcome-pane-idle-index"
+
+inactive_state_path_is_safe() {
+  local path=$1 kind=$2
+  [ ! -L "$path" ] || return 1
+  if [ -e "$path" ]; then
+    case "$kind" in
+      dir) [ -d "$path" ] || return 1 ;;
+      file) [ -f "$path" ] || return 1 ;;
+      *) return 1 ;;
+    esac
+  fi
+}
+
+inactive_state_preflight() {
+  if [ -L "$STATE" ] || { [ -e "$STATE" ] && [ ! -d "$STATE" ]; }; then
+    return 1
+  fi
+  if [ ! -e "$STATE" ] && ! mkdir -p "$STATE"; then
+    return 1
+  fi
+  inactive_state_path_is_safe "$STATE" dir || return 1
+  inactive_state_path_is_safe "$OUTCOME_DIR" dir || return 1
+  inactive_state_path_is_safe "$SCAN_MARKER" file || return 1
+  inactive_state_path_is_safe "$SCAN_CURSOR" file || return 1
+  inactive_state_path_is_safe "$SCAN_CURSOR_IDENTITY" file || return 1
+  inactive_state_path_is_safe "$REPORTED_ROUTE_CURSOR" file || return 1
+  inactive_state_path_is_safe "$PENDING_RECEIPT_CURSOR" file || return 1
+  inactive_state_path_is_safe "$MAINTENANCE_PHASE_CURSOR" file || return 1
+  inactive_state_path_is_safe "$MAINTENANCE_ORDER_CURSOR" file || return 1
+  inactive_state_path_is_safe "$DIRECT_FIND_PENDING" file || return 1
+  inactive_state_path_is_safe "$DIRECT_FIND_OFFSET" file || return 1
+  inactive_state_path_is_safe "$DIRECT_FIND_RETRY" file || return 1
+  inactive_state_path_is_safe "$DIRECT_FIND_INCOMPLETE" file || return 1
+  inactive_state_path_is_safe "$DIRECT_FIND_ENUM_CURSOR" file || return 1
+  inactive_state_path_is_safe "$ENUM_PROGRESS_DIR" dir || return 1
+  inactive_state_path_is_safe "$REPORTED_ROUTE_PENDING" file || return 1
+  inactive_state_path_is_safe "$REPORTED_ROUTE_OFFSET" file || return 1
+  inactive_state_path_is_safe "$REPORTED_ROUTE_RETRY" file || return 1
+  inactive_state_path_is_safe "$REPORTED_ROUTE_ENUM_CURSOR" file || return 1
+  inactive_state_path_is_safe "$PENDING_RECEIPT_PENDING" file || return 1
+  inactive_state_path_is_safe "$PENDING_RECEIPT_OFFSET" file || return 1
+  inactive_state_path_is_safe "$PENDING_RECEIPT_RETRY" file || return 1
+  inactive_state_path_is_safe "$PENDING_RECEIPT_ENUM_CURSOR" file || return 1
+  inactive_state_path_is_safe "$MERGE_TXN" file || return 1
+  inactive_state_path_is_safe "$PANE_IDLE_DIR" dir || return 1
+  inactive_state_path_is_safe "$PANE_IDLE_INDEX_DIR" dir || return 1
+  inactive_state_path_is_safe "$FM_WAKE_QUEUE" file || return 1
+}
+
+inactive_state_preflight || {
+  echo "error: inactive reconciliation state must be local regular state under $FM_HOME" >&2
+  exit 1
+}
+
+# shellcheck source=bin/fm-wake-lib.sh
+. "$SCRIPT_DIR/fm-wake-lib.sh"
+# shellcheck source=bin/fm-backend.sh
+. "$SCRIPT_DIR/fm-backend.sh"
+# shellcheck source=bin/fm-pending-reply-lib.sh
+. "$SCRIPT_DIR/fm-pending-reply-lib.sh"
+
+FM_CREW_STATE_BIN="${FM_CREW_STATE_BIN:-$SCRIPT_DIR/fm-crew-state.sh}"
+SCAN_LOCK="$STATE/.inactive-outcome-reconcile.lock"
+ROUTE_MARKER="$FM_HOME/.fm-secondmate-home"
+CHILD_LOCK_HELD=0
+CHILD_LOCK=
+CHILD_LOCK_OWNER=
+WAKE_QUEUE_LOCK_HELD=0
+MAINTENANCE_ITEMS_PROCESSED=0
+
+wake_queue_lock_acquire() {
+  [ "$WAKE_QUEUE_LOCK_HELD" = 1 ] && return 0
+  fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK" || return 1
+  WAKE_QUEUE_LOCK_HELD=1
+}
+
+wake_queue_lock_release() {
+  [ "$WAKE_QUEUE_LOCK_HELD" = 1 ] || return 0
+  WAKE_QUEUE_LOCK_HELD=0
+  fm_lock_release "$FM_WAKE_QUEUE_LOCK"
+}
+
+bounded_secs() {
+  local value=$1 fallback=$2 minimum=$3 maximum=$4 value_len minimum_len maximum_len LC_ALL=C
+  case "$value" in ''|*[!0-9]*) value=$fallback ;; esac
+  while [ "${value#0}" != "$value" ]; do value=${value#0}; done
+  [ -n "$value" ] || value=0
+  value_len=${#value}
+  minimum_len=${#minimum}
+  maximum_len=${#maximum}
+  if [ "$value_len" -lt "$minimum_len" ] \
+    || { [ "$value_len" -eq "$minimum_len" ] && [ "$value" -lt "$minimum" ]; }; then
+    value=$minimum
+  elif [ "$value_len" -gt "$maximum_len" ] \
+    || { [ "$value_len" -eq "$maximum_len" ] && [ "$value" -gt "$maximum" ]; }; then
+    value=$maximum
+  fi
+  printf '%s' "$value"
+}
+
+clock_millis() {
+  local stamp
+  stamp=$(date +%s%N 2>/dev/null || true)
+  case "$stamp" in
+    ''|*[!0-9]*) printf '%s000' "$(date +%s)" ;;
+    *)
+      if [ "${#stamp}" -gt 10 ]; then
+        printf '%s' "${stamp:0:${#stamp}-6}"
+      else
+        printf '%s000' "$stamp"
+      fi
+      ;;
+  esac
+}
+
+budget_remaining_secs() {
+  local deadline_ms=$1 now_ms remaining_ms
+  now_ms=$(clock_millis)
+  remaining_ms=$((deadline_ms - now_ms))
+  if [ "$remaining_ms" -le 0 ]; then
+    printf '0'
+  else
+    printf '%s' "$(((remaining_ms + 999) / 1000))"
+  fi
+}
+
+inactive_copy_nul_prefix() {
+  local source=$1 target=$2 deadline_ms=${3:-}
+  [ -f "$source" ] && [ ! -L "$source" ] || return 1
+  [ ! -L "$target" ] || return 1
+  case "$deadline_ms" in ''|*[!0-9]*) deadline_ms=;; esac
+  command -v perl >/dev/null 2>&1 || return 125
+  perl -e '
+    use Fcntl qw(:DEFAULT);
+    my ($source, $target, $deadline) = @ARGV;
+    my $nofollow = eval { O_NOFOLLOW() };
+    defined($nofollow) or exit 1;
+    my $in;
+    sysopen($in, $source, O_RDONLY | $nofollow) or exit 1;
+    my $out;
+    sysopen($out, $target, O_WRONLY | O_CREAT | O_TRUNC | $nofollow, 0600) or exit 1;
+    binmode($in);
+    binmode($out);
+    local $/ = "\0";
+    while (defined(my $value = <$in>)) {
+      if (defined($deadline) && $deadline ne q{} && int(time() * 1000) >= $deadline) {
+        exit 124;
+      }
+      print($out $value) or exit 1;
+    }
+    close($in) or exit 1;
+    close($out) or exit 1;
+  ' "$source" "$target" "$deadline_ms"
+}
+
+inactive_append_nul_records() {
+  local source=$1 target=$2 deadline_ms=${3:-}
+  [ -f "$source" ] && [ ! -L "$source" ] || return 1
+  [ -f "$target" ] && [ ! -L "$target" ] || return 1
+  case "$deadline_ms" in ''|*[!0-9]*) deadline_ms=;; esac
+  command -v perl >/dev/null 2>&1 || return 125
+  perl -e '
+    use Fcntl qw(:DEFAULT);
+    my ($source, $target, $deadline) = @ARGV;
+    my $nofollow = eval { O_NOFOLLOW() };
+    defined($nofollow) or exit 1;
+    my $in;
+    sysopen($in, $source, O_RDONLY | $nofollow) or exit 1;
+    my $out;
+    sysopen($out, $target, O_WRONLY | O_APPEND | $nofollow) or exit 1;
+    binmode($in);
+    binmode($out);
+    local $/ = "\0";
+    while (defined(my $value = <$in>)) {
+      if (defined($deadline) && $deadline ne q{} && int(time() * 1000) >= $deadline) {
+        exit 124;
+      }
+      print($out $value) or exit 1;
+    }
+    close($in) or exit 1;
+    close($out) or exit 1;
+  ' "$source" "$target" "$deadline_ms"
+}
+
+inactive_merge_path_is_safe() {
+  local path=$1
+  [ -n "$path" ] || return 1
+  [ "$path" != "$STATE" ] || return 1
+  case "$path" in
+    "$STATE"/*) ;;
+    *) return 1 ;;
+  esac
+  case "$path" in
+    *$'\n'*|*$'\r'*|*$'\t'*) return 1 ;;
+  esac
+}
+
+inactive_merge_txn_write() {
+  local source=$1 target=$2 stage=$3 tmp
+  inactive_merge_path_is_safe "$source" || return 1
+  inactive_merge_path_is_safe "$target" || return 1
+  inactive_merge_path_is_safe "$stage" || return 1
+  [ "$source" != "$target" ] || return 1
+  [ "$source" != "$stage" ] || return 1
+  [ "$target" != "$stage" ] || return 1
+  [ "$source" != "$MERGE_TXN" ] || return 1
+  [ "$target" != "$MERGE_TXN" ] || return 1
+  [ "$stage" != "$MERGE_TXN" ] || return 1
+  [ ! -e "$MERGE_TXN" ] && [ ! -L "$MERGE_TXN" ] || return 1
+  tmp=$(mktemp "$MERGE_TXN.XXXXXX") || return 1
+  [ -f "$tmp" ] && [ ! -L "$tmp" ] || { rm -f "$tmp"; return 1; }
+  if ! printf 'schema=fm-jt-inactive-merge.v1\nsource=%s\ntarget=%s\nstage=%s\n' \
+    "$source" "$target" "$stage" | fm_nofollow_write "$tmp"; then
+    rm -f "$tmp"
+    return 1
+  fi
+  [ ! -L "$MERGE_TXN" ] || { rm -f "$tmp"; return 1; }
+  mv -f "$tmp" "$MERGE_TXN" || { rm -f "$tmp"; return 1; }
+}
+
+inactive_merge_txn_recover() {
+  local schema source target stage
+  if [ ! -e "$MERGE_TXN" ] && [ ! -L "$MERGE_TXN" ]; then
+    return 0
+  fi
+  [ -f "$MERGE_TXN" ] && [ ! -L "$MERGE_TXN" ] || return 1
+  schema=$(meta_value_unique "$MERGE_TXN" schema) || return 1
+  source=$(meta_value_unique "$MERGE_TXN" source) || return 1
+  target=$(meta_value_unique "$MERGE_TXN" target) || return 1
+  stage=$(meta_value_unique "$MERGE_TXN" stage) || return 1
+  [ "$schema" = fm-jt-inactive-merge.v1 ] || return 1
+  inactive_merge_path_is_safe "$source" || return 1
+  inactive_merge_path_is_safe "$target" || return 1
+  inactive_merge_path_is_safe "$stage" || return 1
+  [ "$source" != "$target" ] || return 1
+  [ "$source" != "$stage" ] || return 1
+  [ "$target" != "$stage" ] || return 1
+  [ "$source" != "$MERGE_TXN" ] || return 1
+  [ "$target" != "$MERGE_TXN" ] || return 1
+  [ "$stage" != "$MERGE_TXN" ] || return 1
+  if [ -e "$stage" ] || [ -L "$stage" ]; then
+    [ -f "$stage" ] && [ ! -L "$stage" ] || return 1
+    [ ! -L "$target" ] || return 1
+    if [ -e "$target" ]; then
+      [ -f "$target" ] || return 1
+    fi
+    mv -f "$stage" "$target" || return 1
+  else
+    [ -f "$target" ] && [ ! -L "$target" ] || return 1
+  fi
+  if [ -e "$source" ] || [ -L "$source" ]; then
+    [ -f "$source" ] && [ ! -L "$source" ] || return 1
+    rm -f "$source" || return 1
+  fi
+  rm -f "$MERGE_TXN" || return 1
+}
+
+inactive_append_nul_records_atomic() {
+  local source=$1 target=$2 deadline_ms=${3:-} tmp rc
+  inactive_merge_txn_recover || return 1
+  [ -f "$source" ] && [ ! -L "$source" ] || return 1
+  [ -f "$target" ] && [ ! -L "$target" ] || return 1
+  [ "$source" != "$target" ] || return 1
+  [ ! -L "$target" ] || return 1
+  tmp=$(mktemp "$target.XXXXXX") || return 1
+  [ -f "$tmp" ] && [ ! -L "$tmp" ] || { rm -f "$tmp"; return 1; }
+  inactive_append_nul_records "$target" "$tmp" "$deadline_ms"
+  rc=$?
+  if [ "$rc" -ne 0 ]; then
+    rm -f "$tmp"
+    return "$rc"
+  fi
+  inactive_append_nul_records "$source" "$tmp" "$deadline_ms"
+  rc=$?
+  if [ "$rc" -ne 0 ]; then
+    rm -f "$tmp"
+    return "$rc"
+  fi
+  inactive_merge_txn_write "$source" "$target" "$tmp" || {
+    rm -f "$tmp"
+    return 1
+  }
+  [ ! -L "$target" ] || return 1
+  mv -f "$tmp" "$target" || return 1
+  rm -f "$source" || return 1
+  rm -f "$MERGE_TXN" || return 1
+}
+
+inactive_retry_file_prepare() {
+  local path=$1
+  if [ -e "$path" ] || [ -L "$path" ]; then
+    [ -f "$path" ] && [ ! -L "$path" ] || return 1
+    return 0
+  fi
+  [ ! -L "$path" ] || return 1
+  command -v perl >/dev/null 2>&1 || return 125
+  perl -e '
+    use Fcntl qw(:DEFAULT);
+    my ($path) = @ARGV;
+    my $nofollow = eval { O_NOFOLLOW() };
+    defined($nofollow) or exit 1;
+    my $fh;
+    sysopen($fh, $path, O_WRONLY | O_CREAT | O_EXCL | $nofollow, 0600) or exit 1;
+    close($fh) or exit 1;
+  ' "$path"
+}
+
+inactive_append_nul_value() {
+  local target=$1 value=$2 deadline_ms=${3-} now
+  [ -f "$target" ] && [ ! -L "$target" ] || return 1
+  case "$deadline_ms" in ''|*[!0-9]*) deadline_ms=;; esac
+  if [ -n "$deadline_ms" ]; then
+    now=$(clock_millis)
+    [ "$now" -lt "$deadline_ms" ] || return 124
+  fi
+  [ ! -L "$target" ] || return 1
+  command -v perl >/dev/null 2>&1 || return 125
+  printf '%s\0' "$value" | perl -e '
+    use Fcntl qw(:DEFAULT);
+    my ($target) = @ARGV;
+    my $nofollow = eval { O_NOFOLLOW() };
+    defined($nofollow) or exit 1;
+    my $fh;
+    sysopen($fh, $target, O_WRONLY | O_APPEND | $nofollow) or exit 1;
+    binmode($fh);
+    local $/;
+    my $value = <STDIN> // "";
+    print($fh $value) or exit 1;
+    close($fh) or exit 1;
+  ' "$target"
+  if [ -n "$deadline_ms" ]; then
+    now=$(clock_millis)
+    [ "$now" -lt "$deadline_ms" ] || return 124
+  fi
+}
+
+inactive_nul_last_value() {
+  local source=$1 deadline_ms=${2:-} value last=''
+  [ -f "$source" ] && [ ! -L "$source" ] || return 1
+  case "$deadline_ms" in ''|*[!0-9]*) deadline_ms=;; esac
+  while IFS= read -r -d '' value; do
+    if [ -n "$deadline_ms" ] && [ "$(clock_millis)" -ge "$deadline_ms" ]; then
+      return 124
+    fi
+    last=$value
+  done < "$source"
+  printf '%s' "$last"
+}
+
+inactive_pending_offset() {
+  local path=$1 value
+  [ -e "$path" ] || { printf '0'; return 0; }
+  [ -f "$path" ] && [ ! -L "$path" ] || return 1
+  value=$(cat "$path" 2>/dev/null || true)
+  case "$value" in ''|*[!0-9]*) return 1 ;; esac
+  printf '%s' "$value"
+}
+
+inactive_pending_offset_write() {
+  local path=$1 value=$2 tmp
+  case "$value" in ''|*[!0-9]*) return 1 ;; esac
+  [ ! -L "$path" ] || return 1
+  tmp=$(mktemp "$path.XXXXXX") || return 1
+  [ -f "$tmp" ] && [ ! -L "$tmp" ] || { rm -f "$tmp"; return 1; }
+  if ! printf '%s\n' "$value" | fm_nofollow_write "$tmp" || [ -L "$path" ] || ! mv -f "$tmp" "$path"; then
+    rm -f "$tmp"
+    return 1
+  fi
+}
+
+inactive_text_cursor_read() {
+  local path=$1 value
+  [ -e "$path" ] || { printf ''; return 0; }
+  [ -f "$path" ] && [ ! -L "$path" ] || return 1
+  value=$(cat "$path" 2>/dev/null) || return 1
+  case "$value" in *$'\r'*|*$'\n'*|*$'\t'*) return 1 ;; esac
+  printf '%s' "$value"
+}
+
+inactive_text_cursor_write() {
+  local path=$1 value=$2 tmp
+  case "$value" in *$'\r'*|*$'\n'*|*$'\t'*) return 1 ;; esac
+  [ ! -L "$path" ] || return 1
+  tmp=$(mktemp "$path.XXXXXX") || return 1
+  [ -f "$tmp" ] && [ ! -L "$tmp" ] || { rm -f "$tmp"; return 1; }
+  if ! printf '%s\n' "$value" | fm_nofollow_write "$tmp" || [ -L "$path" ] || ! mv -f "$tmp" "$path"; then
+    rm -f "$tmp"
+    return 1
+  fi
+}
+
+inactive_pending_clear() {
+  local pending=$1 offset=$2
+  rm -f "$pending" "$offset"
+}
+
+inactive_pending_retry_defer() {
+  local retry_source=$1 retry_target=$2 deadline_ms=${3:-} force=${4:-} incoming
+  [ -f "$retry_source" ] && [ ! -L "$retry_source" ] || return 1
+  if [ -e "$retry_target" ] || [ -L "$retry_target" ]; then
+    [ -f "$retry_target" ] && [ ! -L "$retry_target" ] || return 1
+    incoming="${retry_target}.incoming.$$.$RANDOM"
+    [ ! -e "$incoming" ] && [ ! -L "$incoming" ] || return 1
+    mv -f "$retry_source" "$incoming" || return 1
+    return 124
+  fi
+  if [ "$force" = 1 ] || { [ -n "$deadline_ms" ] && [ "$(clock_millis)" -ge "$deadline_ms" ]; }; then
+    mv -f "$retry_source" "$retry_target" || return 1
+    return 124
+  fi
+  return 1
+}
+
+inactive_pending_retry_exists() {
+  local retry=$1 path
+  if [ -e "$retry" ] || [ -L "$retry" ]; then
+    return 0
+  fi
+  for path in "${retry}.incoming."*; do
+    [ -e "$path" ] || [ -L "$path" ] || continue
+    return 0
+  done
+  return 1
+}
+
+inactive_pending_retry_restore() {
+  local retry=$1 pending=$2 path source=
+  [ ! -e "$pending" ] && [ ! -L "$pending" ] || return 1
+  if [ -e "$retry" ] || [ -L "$retry" ]; then
+    source=$retry
+  else
+    for path in "${retry}.incoming."*; do
+      [ -e "$path" ] || [ -L "$path" ] || continue
+      source=$path
+      break
+    done
+  fi
+  [ -n "$source" ] || return 1
+  [ -f "$source" ] && [ ! -L "$source" ] || return 1
+  mv -f "$source" "$pending"
+}
+
+inactive_nul_contains_from_offset() {
+  local pending=$1 offset=$2 needle=$3 deadline_ms=${4:-} value
+  [ -f "$pending" ] && [ ! -L "$pending" ] || return 1
+  case "$offset" in ''|*[!0-9]*) return 1 ;; esac
+  while IFS= read -r -d '' value; do
+    if [ -n "$deadline_ms" ] && [ "$(clock_millis)" -ge "$deadline_ms" ]; then
+      return 124
+    fi
+    if [ "$offset" -gt 0 ]; then
+      offset=$((offset - 1))
+      continue
+    fi
+    [ "$value" = "$needle" ] && return 0
+  done < "$pending"
+  return 1
+}
+
+inactive_pending_retry_filter_duplicates() {
+  local pending=$1 retry=$2 deadline_ms='' offset tags sorted tmp rc remaining tab
+  [ "$#" -ge 3 ] && deadline_ms=$3
+  [ -f "$pending" ] && [ ! -L "$pending" ] || return 1
+  [ -f "$retry" ] && [ ! -L "$retry" ] || return 1
+  offset=$(inactive_pending_offset "$pending.offset") || return 1
+  tags=$(mktemp "$retry.tags.XXXXXX") || return 1
+  sorted=$(mktemp "$retry.sorted.XXXXXX") || { rm -f "$tags"; return 1; }
+  tmp=$(mktemp "$retry.filtered.XXXXXX") || {
+    rm -f "$tags" "$sorted"
+    return 1
+  }
+  [ -f "$tags" ] && [ ! -L "$tags" ] || { rm -f "$tags" "$sorted" "$tmp"; return 1; }
+  [ -f "$sorted" ] && [ ! -L "$sorted" ] || { rm -f "$tags" "$sorted" "$tmp"; return 1; }
+  [ -f "$tmp" ] && [ ! -L "$tmp" ] || { rm -f "$tags" "$sorted" "$tmp"; return 1; }
+  remaining=$(budget_remaining_secs "$deadline_ms")
+  [ "$remaining" -gt 0 ] || { rm -f "$tags" "$sorted" "$tmp"; return 124; }
+  if run_bounded_child "$remaining" perl - "$pending" "$offset" "$retry" <<'PERL' | fm_nofollow_write "$tags"
+use strict;
+use warnings;
+
+my ($pending, $offset, $retry) = @ARGV;
+sub emit_file {
+  my ($path, $skip) = @_;
+  open(my $fh, '<', $path) or exit 1;
+  binmode($fh);
+  local $/ = "\0";
+  while (defined(my $value = <$fh>)) {
+    if ($skip > 0) {
+      $skip--;
+      next;
+    }
+    $value =~ s/\0\z// or exit 1;
+    print unpack('H*', $value), "\tP\n" or exit 1;
+  }
+  close($fh) or exit 1;
+}
+emit_file($pending, $offset + 0);
+open(my $rfh, '<', $retry) or exit 1;
+binmode($rfh);
+local $/ = "\0";
+while (defined(my $value = <$rfh>)) {
+  $value =~ s/\0\z// or exit 1;
+  print unpack('H*', $value), "\tR\n" or exit 1;
+}
+close($rfh) or exit 1;
+PERL
+  then :
+  else
+    rc=$?
+    [ "$rc" -ne 0 ] || rc=124
+    rm -f "$tags" "$sorted" "$tmp"
+    return "$rc"
+  fi
+  remaining=$(budget_remaining_secs "$deadline_ms")
+  [ "$remaining" -gt 0 ] || { rm -f "$tags" "$sorted" "$tmp"; return 124; }
+  tab=$(printf '\t')
+  if run_bounded_child "$remaining" env LC_ALL=C sort -t "$tab" -k1,1 -k2,2 "$tags" | fm_nofollow_write "$sorted"; then :; else
+    rc=$?
+    [ "$rc" -ne 0 ] || rc=124
+    rm -f "$tags" "$sorted" "$tmp"
+    return "$rc"
+  fi
+  remaining=$(budget_remaining_secs "$deadline_ms")
+  [ "$remaining" -gt 0 ] || { rm -f "$tags" "$sorted" "$tmp"; return 124; }
+  if run_bounded_child "$remaining" perl - "$sorted" <<'PERL' | fm_nofollow_write "$tmp"
+use strict;
+use warnings;
+
+my $path = shift @ARGV;
+open(my $fh, '<', $path) or exit 1;
+my ($last, $has_pending, $has_retry, $value) = ('', 0, 0, '');
+sub flush_group {
+  return unless $last ne '' && $has_retry && !$has_pending;
+  print $value, "\0" or exit 1;
+}
+while (defined(my $line = <$fh>)) {
+  chomp $line;
+  my ($key, $kind) = split(/\t/, $line, 2);
+  exit 1 unless defined($key) && defined($kind) && $key =~ /\A(?:[0-9A-Fa-f]{2})*\z/ && $kind =~ /\A[PR]\z/;
+  if ($key ne $last) {
+    flush_group();
+    $last = $key;
+    $has_pending = 0;
+    $has_retry = 0;
+    $value = pack('H*', $key);
+  }
+  $has_pending = 1 if $kind eq 'P';
+  $has_retry = 1 if $kind eq 'R';
+}
+close($fh) or exit 1;
+flush_group();
+PERL
+  then :
+  else
+    rc=$?
+    [ "$rc" -ne 0 ] || rc=124
+    rm -f "$tags" "$sorted" "$tmp"
+    return "$rc"
+  fi
+  [ ! -L "$retry" ] || { rm -f "$tags" "$sorted" "$tmp"; return 1; }
+  mv -f "$tmp" "$retry" || { rm -f "$tmp"; return 1; }
+  rm -f "$tags" "$sorted" || return 1
+}
+
+inactive_pending_merge_retry() {
+  local pending=$1 retry=$2 deadline_ms=${3:-} rc path
+  inactive_pending_retry_exists "$retry" || return 0
+  [ -f "$pending" ] && [ ! -L "$pending" ] || return 1
+  for path in "$retry" "${retry}.incoming."*; do
+    [ -e "$path" ] || [ -L "$path" ] || continue
+    [ -f "$path" ] && [ ! -L "$path" ] || return 1
+    inactive_pending_retry_filter_duplicates "$pending" "$path" "$deadline_ms"
+    rc=$?
+    [ "$rc" = 0 ] || return "$rc"
+    inactive_append_nul_records_atomic "$path" "$pending" "$deadline_ms"
+    rc=$?
+    [ "$rc" = 0 ] || return "$rc"
+  done
+}
+
+inactive_persist_nul_suffix() {
+  local source=$1 target=$2 skip=$3 retry_source=${4:-} deadline_ms=${5:-}
+  [ -f "$source" ] && [ ! -L "$source" ] || return 1
+  [ ! -L "$target" ] || return 1
+  case "$skip" in ''|*[!0-9]*) return 1 ;; esac
+  case "$deadline_ms" in ''|*[!0-9]*) deadline_ms=;; esac
+  if [ "$source" != "$target" ]; then
+    [ ! -e "$target" ] || return 1
+    [ ! -L "$target" ] || return 1
+    mv -f "$source" "$target" || return 1
+  fi
+  if [ -n "$retry_source" ]; then
+    inactive_append_nul_records_atomic "$retry_source" "$target" "$deadline_ms"
+    local retry_rc=$?
+    if [ "$retry_rc" -ne 0 ]; then
+      if [ ! -e "$MERGE_TXN" ] && [ ! -L "$MERGE_TXN" ] \
+        && inactive_pending_retry_defer "$retry_source" "${target}.retry" "$deadline_ms" 1; then
+        return 124
+      fi
+      return "$retry_rc"
+    fi
+  fi
+  inactive_pending_offset_write "${target}.offset" "$skip" || return 1
+}
+
+inactive_persist_nul_prefix() {
+  local source=$1 target=$2 deadline_ms=${3:-} tmp
+  [ ! -L "$target" ] || return 1
+  tmp=$(mktemp "$target.XXXXXX") || return 1
+  [ -f "$tmp" ] && [ ! -L "$tmp" ] || { rm -f "$tmp"; return 1; }
+  if ! inactive_copy_nul_prefix "$source" "$tmp" "$deadline_ms"; then
+    rm -f "$tmp"
+    return 1
+  fi
+  [ ! -L "$target" ] || { rm -f "$tmp"; return 1; }
+  mv -f "$tmp" "$target" || { rm -f "$tmp"; return 1; }
+}
+
+RECONCILE_SECS=$(bounded_secs "${FM_INACTIVE_OUTCOME_SECS:-900}" 900 60 1800)
+SCAN_BUDGET_SECS=$(bounded_secs "${FM_INACTIVE_OUTCOME_BUDGET_SECS:-10}" 10 1 300)
+REPORTED_ROUTE_REPAIR_LIMIT=$(bounded_secs "${FM_REPORTED_ROUTE_REPAIR_LIMIT:-32}" 32 1 256)
+PENDING_RECEIPT_REPUBLISH_LIMIT=$(bounded_secs "${FM_PENDING_RECEIPT_REPUBLISH_LIMIT:-32}" 32 1 256)
+MAINTENANCE_TURN_SECS=$(bounded_secs "${FM_INACTIVE_OUTCOME_MAINTENANCE_RESERVE_SECS:-1}" 1 1 60)
+DIRECT_SCAN_BUDGET_SECS=$SCAN_BUDGET_SECS
+
+meta_value() {  # <meta> <key>
+  awk -F= -v wanted="$2" '$1 == wanted { print substr($0, index($0, "=") + 1); exit }' "$1" 2>/dev/null
+}
+
+meta_value_unique() {  # <meta> <key>
+  awk -F= -v wanted="$2" '
+    $1 == wanted { count++; value=substr($0, index($0, "=") + 1) }
+    END {
+      if (count == 1) { print value; exit 0 }
+      if (count == 0) exit 1
+      exit 2
+    }
+  ' "$1" 2>/dev/null
+}
+
+file_mtime() {
+  if [ "$(uname -s 2>/dev/null)" = Darwin ]; then
+    stat -f '%m' "$1" 2>/dev/null
+  else
+    stat -c '%Y' "$1" 2>/dev/null
+  fi
+}
+
+latest_activity() {
+  local id=$1 meta="$STATE/$1.meta" path m latest=0
+  for path in "$meta" "$STATE/$id.status" "$STATE/$id.turn-ended"; do
+    if [ ! -e "$path" ] || [ -L "$path" ]; then
+      continue
+    fi
+    m=$(file_mtime "$path") || continue
+    [ "$m" -gt "$latest" ] && latest=$m
+  done
+  printf '%s' "$latest"
+}
+
+hash_text() {
+  if command -v shasum >/dev/null 2>&1; then
+    printf '%s' "$1" | shasum -a 256 | awk '{print $1}'
+  elif command -v sha256sum >/dev/null 2>&1; then
+    printf '%s' "$1" | sha256sum | awk '{print $1}'
+  else
+    return 1
+  fi
+}
+
+replay_parent_corr() {
+  local corr=${FM_PENDING_ROUTE_CORR:-}
+  case "${KIND:-}" in
+    secondmate)
+      fm_pending_reply_parent_corr_valid "$corr" || return 1
+      [ -n "$corr" ] || return 1
+      printf '%s' "$corr"
+      ;;
+    ship|scout|'') [ -z "$corr" ] || return 1; printf '%s' '' ;;
+    *) return 1 ;;
+  esac
+}
+
+terminal_outcome_fingerprint() {
+  local id=$1 incarnation=$2 outcome=$3 snapshot=$4 kind=$5 parent_corr=${6:-} source=${7:-}
+  case "$source" in
+    run-step|pane) ;;
+    *) return 1 ;;
+  esac
+  case "$kind" in
+    secondmate)
+      printf '%s' "$parent_corr" | grep -Eq '^[A-Fa-f0-9]{16}$' || return 1
+      hash_text "$id|$incarnation|$outcome|$snapshot|$kind|$source|$parent_corr"
+      ;;
+    ship|scout)
+      [ -z "$parent_corr" ] || return 1
+      hash_text "$id|$incarnation|$outcome|$snapshot|$kind|$source"
+      ;;
+    *) return 1 ;;
+  esac
+}
+
+metadata_fingerprint() {
+  local meta=$1 contents
+  [ -f "$meta" ] && [ ! -L "$meta" ] || return 1
+  contents=$(LC_ALL=C cat "$meta") || return 1
+  hash_text "$contents"
+}
+
+scan_cursor_write() {
+  local id=$1 identity=$2 cursor_tmp identity_tmp
+  case "$id" in ''|*[!A-Za-z0-9._-]*) return 1 ;; esac
+  case "$identity" in ''|*[!0123456789abcdefABCDEF]*) return 1 ;; esac
+  [ "${#identity}" = 64 ] || return 1
+  [ ! -L "$SCAN_CURSOR" ] && [ ! -L "$SCAN_CURSOR_IDENTITY" ] || return 1
+  identity_tmp=$(mktemp "$SCAN_CURSOR_IDENTITY.XXXXXX") || return 1
+  cursor_tmp=$(mktemp "$SCAN_CURSOR.XXXXXX") || { rm -f "$identity_tmp"; return 1; }
+  [ -f "$identity_tmp" ] && [ ! -L "$identity_tmp" ] || { rm -f "$identity_tmp" "$cursor_tmp"; return 1; }
+  [ -f "$cursor_tmp" ] && [ ! -L "$cursor_tmp" ] || { rm -f "$identity_tmp" "$cursor_tmp"; return 1; }
+  if ! printf '%s\n' "$identity" | fm_nofollow_write "$identity_tmp" \
+    || ! fm_nofollow_rename "$identity_tmp" "$SCAN_CURSOR_IDENTITY"; then
+    rm -f "$identity_tmp" "$cursor_tmp"
+    return 1
+  fi
+  if ! printf '%s\n' "$id" | fm_nofollow_write "$cursor_tmp" \
+    || ! fm_nofollow_rename "$cursor_tmp" "$SCAN_CURSOR"; then
+    rm -f "$cursor_tmp"
+    return 1
+  fi
+}
+
+single_line() {
+  printf '%s' "$1" | tr '\t\r\n' '   '
+}
+
+valid_task_id() {
+  printf '%s' "$1" | grep -Eq '^[A-Za-z0-9][A-Za-z0-9._-]*$'
+}
+
+is_secondmate_home() {
+  local marker=$ROUTE_MARKER value
+  [ ! -L "$marker" ] || return 2
+  if [ ! -e "$marker" ]; then
+    return 1
+  fi
+  [ -f "$marker" ] || return 2
+  value=$(cat "$marker" 2>/dev/null || true)
+  case "$value" in
+    ''|*[!A-Za-z0-9._-]*) return 2 ;;
+  esac
+  return 0
+}
+
+herdr_identity_allowed() {  # <meta>
+  local meta=$1 backend session window rc
+  if backend=$(meta_value_unique "$meta" backend); then
+    :
+  else
+    rc=$?
+    [ "$rc" = 1 ] || return 1
+    backend=tmux
+  fi
+  case "$backend" in
+    tmux) return 0 ;;
+    herdr) ;;
+    *) return 1 ;;
+  esac
+  session=$(meta_value_unique "$meta" herdr_session) || return 1
+  window=$(meta_value_unique "$meta" window) || return 1
+  case "$session" in
+    firstmate) : ;;
+    default|DEFAULT|CAPTAIN|captain) return 1 ;;
+    *) return 1 ;;
+  esac
+  case "$window" in firstmate:*) return 0 ;; esac
+  return 1
+}
+
+run_bounded_child() {  # <seconds> <command> [args...]
+  local seconds=$1
+  shift
+  if [ "${FM_INACTIVE_OUTCOME_FORCE_PORTABLE_TIMEOUT:-0}" != 1 ] \
+    && command -v timeout >/dev/null 2>&1; then
+    timeout "$seconds" "$@"
+  elif [ "${FM_INACTIVE_OUTCOME_FORCE_PORTABLE_TIMEOUT:-0}" != 1 ] \
+    && command -v gtimeout >/dev/null 2>&1; then
+    gtimeout "$seconds" "$@"
+  elif command -v perl >/dev/null 2>&1; then
+    perl -e 'my $t = shift; my $pid = fork; die "fork failed" unless defined $pid; if (!$pid) { setpgrp(0, 0); exec @ARGV or exit 127 } local $SIG{ALRM} = sub { kill "TERM", -$pid; select undef, undef, undef, 0.2; kill "KILL", -$pid; exit 124 }; alarm $t; waitpid $pid, 0; my $status = $?; exit(($status & 127) ? 128 + ($status & 127) : ($status >> 8))' "$seconds" "$@"
+  else
+    return 125
+  fi
+}
+
+receipt_path() {  # <fingerprint> <suffix>
+  printf '%s/%s.%s' "$OUTCOME_DIR" "$1" "$2"
+}
+
+receipt_field() {  # <receipt> <key>
+  meta_value_unique "$1" "$2"
+}
+
+claim_path() {  # <fingerprint>
+  printf '%s/.%s.claim' "$OUTCOME_DIR" "$1"
+}
+
+claim_publish() {
+  fm_nofollow_rename "$1" "$2" "${3:-0}"
+}
+
+claim_field() {  # <claim> <key>
+  meta_value_unique "$1" "$2"
+}
+
+claim_binary_field() {  # <claim> <key>
+  local value
+  value=$(claim_field "$1" "$2") || return 1
+  case "$value" in
+    0|1) printf '%s' "$value" ;;
+    *) return 1 ;;
+  esac
+}
+
+claim_binary_fields_valid() {
+  local claim=$1 field value rc
+  for field in output_started output_emitted output_complete output_confirmed caller_confirmed; do
+    value=$(awk -F= -v wanted="$field" '
+      $1 == wanted { count++; value=substr($0, index($0, "=") + 1) }
+      END {
+        if (count == 0) exit 1
+        if (count != 1) exit 2
+        print value
+      }
+    ' "$claim" 2>/dev/null)
+    rc=$?
+    case "$rc" in
+      1) continue ;;
+      0)
+        case "$value" in 0|1) ;; *) return 1 ;; esac
+        ;;
+      *) return 1 ;;
+    esac
+  done
+}
+
+claim_receipt_state() {
+  local fp=$1 suffix path found=
+  for suffix in pending presented reported; do
+    path=$(receipt_path "$fp" "$suffix")
+    [ ! -L "$path" ] || return 2
+    [ -e "$path" ] || continue
+    [ -f "$path" ] || return 2
+    prepare_pending_receipt "$path" || return 2
+    [ -z "$found" ] || return 2
+    found=$suffix
+  done
+  [ -n "$found" ] || return 1
+  printf '%s' "$found"
+}
+
+claim_defer_generation_live() {
+  local generation=$1 stored_start=${2:-}
+  case "$generation" in ''|*[!0-9]*) return 1 ;; esac
+  [ "$generation" != 0 ] || return 1
+  [ -n "$stored_start" ] || return 1
+  kill -0 "$generation" 2>/dev/null || return 1
+  fm_pid_start_matches_stored "$generation" "$stored_start"
+}
+
+drain_claim_owner() {
+  local row=$1 owner parent_pid parent_start drain_file drain_dir state_dir drain_base
+  owner=$(fm_lock_link_owner "$FM_WAKE_QUEUE_LOCK" 2>/dev/null || true)
+  if [ "${FM_WAKE_DRAIN_DELEGATED:-0}" = 1 ]; then
+    parent_pid=${FM_WAKE_DRAIN_PARENT_PID:-}
+  else
+    parent_pid=${PPID:-}
+  fi
+  parent_start=${FM_WAKE_DRAIN_PARENT_START:-}
+  drain_file=${FM_WAKE_DRAIN_FILE:-}
+  [ -n "$owner" ] && [ -n "$parent_pid" ] && [ -n "$parent_start" ] && [ -n "$row" ] && [ -n "$drain_file" ] || return 1
+  fm_pid_start_matches_stored "$parent_pid" "$parent_start" || return 1
+  [ "$(cat "$owner/pid" 2>/dev/null || true)" = "$parent_pid" ] || return 1
+  fm_lock_points_to_owner "$FM_WAKE_QUEUE_LOCK" "$owner" || return 1
+  [ -f "$drain_file" ] && [ ! -L "$drain_file" ] || return 1
+  drain_dir=$(cd "$(dirname "$drain_file")" 2>/dev/null && pwd -P) || return 1
+  state_dir=$(cd "$STATE" 2>/dev/null && pwd -P) || return 1
+  [ "$drain_dir" = "$state_dir" ] || return 1
+  if [ "${FM_WAKE_DRAIN_RESUMED_SOURCE:-0}" = 1 ]; then
+    drain_base=$(basename "$drain_file") || return 1
+    case "$drain_base" in
+      .wake-queue) ;;
+      .wake-queue.deduped.*|.wake-queue.drain.*)
+        case "${drain_base##*.}" in ''|*[!0-9]*) return 1 ;; esac
+        ;;
+      *) return 1 ;;
+    esac
+  else
+    [ "$(basename "$drain_file")" = ".wake-queue.deduped.$parent_pid" ] || return 1
+  fi
+  awk -v wanted="$row" '$0 == wanted { found=1; exit } END { exit !found }' "$drain_file"
+}
+
+claim_validate() {  # <claim> <fingerprint> <row>
+  local claim=$1 fp=$2 row=$3 state
+  [ -f "$claim" ] && [ ! -L "$claim" ] || return 1
+  [ "$(claim_field "$claim" schema)" = fm-inactive-outcome-claim.v1 ] || return 1
+  [ "$(claim_field "$claim" fingerprint)" = "$fp" ] || return 1
+  [ "$(claim_field "$claim" row)" = "$row" ] || return 1
+  state=$(claim_field "$claim" state)
+  case "$state" in reserved|presenting|presented) printf '%s' "$state" ;; *) return 1 ;; esac
+}
+
+claim_validate_caller_owner() {  # <claim> <caller-pid>
+  local claim=$1 caller_pid=$2 caller_start
+  [ -f "$claim" ] && [ ! -L "$claim" ] || return 1
+  case "$caller_pid" in ''|*[!0-9]*|0) return 1 ;; esac
+  [ "$(claim_field "$claim" defer_ack 2>/dev/null || true)" = 1 ] || return 1
+  [ "$(claim_field "$claim" defer_generation 2>/dev/null || true)" = "$caller_pid" ] || return 1
+  caller_start=$(claim_field "$claim" defer_generation_start 2>/dev/null || true)
+  fm_pid_start_matches_stored "$caller_pid" "$caller_start"
+}
+
+claim_rewrite_row() {
+  local claim=$1 row=$2 tmp line
+  tmp=$(mktemp "$OUTCOME_DIR/.claim-row.XXXXXX") || return 1
+  chmod 600 "$tmp" 2>/dev/null || true
+  while IFS= read -r line || [ -n "$line" ]; do
+    case "$line" in row=*) printf 'row=%s\n' "$row" ;; *) printf '%s\n' "$line" ;; esac
+  done < "$claim" | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 1; }
+  [ ! -L "$claim" ] || { rm -f "$tmp"; return 1; }
+  claim_publish "$tmp" "$claim" || { rm -f "$tmp"; return 1; }
+}
+
+claim_recover_deferred_handoff() {
+  local key=$1 row=$2 generation=${FM_WAKE_DRAIN_GENERATION:-} generation_start
+  local fp claim state tmp line seen_generation=0 seen_generation_start=0 seen_caller_confirmed=0
+  [ "${FM_WAKE_DRAIN_DEFER_ACK:-0}" = 1 ] || return 2
+  case "$generation" in ''|*[!0-9]*|0) return 2 ;; esac
+  generation_start=$(fm_pid_start "$generation") || return 2
+  case "$key" in inactive-outcome:*) fp=${key#inactive-outcome:} ;; *) return 2 ;; esac
+  case "$fp" in ''|*[!A-Fa-f0-9]*) return 2 ;; esac
+  claim=$(claim_path "$fp")
+  [ ! -L "$claim" ] || return 2
+  state=$(claim_validate "$claim" "$fp" "$row") || return 2
+  [ "$state" = presenting ] || return 2
+  claim_binary_fields_valid "$claim" || return 2
+  [ "$(claim_binary_field "$claim" output_started 2>/dev/null || true)" = 1 ] || return 2
+  [ "$(claim_binary_field "$claim" output_emitted 2>/dev/null || true)" = 1 ] || return 2
+  [ "$(claim_binary_field "$claim" output_complete 2>/dev/null || true)" = 1 ] || return 2
+  [ "$(claim_binary_field "$claim" output_confirmed 2>/dev/null || true)" = 1 ] || return 2
+  [ "$(claim_binary_field "$claim" caller_confirmed 2>/dev/null || true)" = 0 ] || return 2
+  [ "$(claim_field "$claim" defer_ack 2>/dev/null || true)" = 1 ] || return 2
+  tmp=$(mktemp "$OUTCOME_DIR/.claim-state.XXXXXX") || return 2
+  chmod 600 "$tmp" 2>/dev/null || true
+  {
+    while IFS= read -r line || [ -n "$line" ]; do
+      case "$line" in
+        state=*) printf 'state=presented\n' ;;
+        defer_generation=*) printf 'defer_generation=%s\n' "$generation"; seen_generation=1 ;;
+        defer_generation_start=*) printf 'defer_generation_start=%s\n' "$generation_start"; seen_generation_start=1 ;;
+        caller_confirmed=*) printf 'caller_confirmed=1\n'; seen_caller_confirmed=1 ;;
+        *) printf '%s\n' "$line" ;;
+      esac
+    done < "$claim"
+    [ "$seen_generation" = 1 ] || printf 'defer_generation=%s\n' "$generation"
+    [ "$seen_generation_start" = 1 ] || printf 'defer_generation_start=%s\n' "$generation_start"
+    [ "$seen_caller_confirmed" = 1 ] || printf 'caller_confirmed=1\n'
+  } | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 2; }
+  [ ! -L "$claim" ] || { rm -f "$tmp"; return 2; }
+  claim_publish "$tmp" "$claim" || { rm -f "$tmp"; return 2; }
+}
+
+claim_rebind_deferred_generation() {
+  local key=$1 row=$2 generation=${FM_WAKE_DRAIN_GENERATION:-} generation_start
+  local fp claim state tmp line seen_generation=0 seen_generation_start=0
+  case "$generation" in ''|*[!0-9]*|0) return 2 ;; esac
+  generation_start=$(fm_pid_start "$generation") || return 2
+  case "$key" in inactive-outcome:*) fp=${key#inactive-outcome:} ;; *) return 2 ;; esac
+  case "$fp" in ''|*[!A-Fa-f0-9]*) return 2 ;; esac
+  claim=$(claim_path "$fp")
+  [ ! -L "$claim" ] || return 2
+  state=$(claim_validate "$claim" "$fp" "$row") || return 2
+  case "$state" in presenting|presented) ;; *) return 2 ;; esac
+  [ "$(claim_field "$claim" defer_ack 2>/dev/null || true)" = 1 ] || return 2
+  claim_binary_fields_valid "$claim" || return 2
+  [ "$(claim_binary_field "$claim" caller_confirmed 2>/dev/null || true)" = 1 ] || return 2
+  tmp=$(mktemp "$OUTCOME_DIR/.claim-state.XXXXXX") || return 2
+  chmod 600 "$tmp" 2>/dev/null || true
+  {
+    while IFS= read -r line || [ -n "$line" ]; do
+      case "$line" in
+        defer_generation=*) printf 'defer_generation=%s\n' "$generation"; seen_generation=1 ;;
+        defer_generation_start=*) printf 'defer_generation_start=%s\n' "$generation_start"; seen_generation_start=1 ;;
+        *) printf '%s\n' "$line" ;;
+      esac
+    done < "$claim"
+    [ "$seen_generation" = 1 ] || printf 'defer_generation=%s\n' "$generation"
+    [ "$seen_generation_start" = 1 ] || printf 'defer_generation_start=%s\n' "$generation_start"
+  } | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 2; }
+  [ ! -L "$claim" ] || { rm -f "$tmp"; return 2; }
+  claim_publish "$tmp" "$claim" || { rm -f "$tmp"; return 2; }
+}
+
+claim_mark_recorded_presented() {  # <inactive-outcome:fingerprint> <wake-row>
+  local key=$1 row=$2 fp claim state tmp line field value
+  drain_claim_owner "$row" || return 2
+  case "$key" in inactive-outcome:*) fp=${key#inactive-outcome:} ;; *) return 2 ;; esac
+  case "$fp" in ''|*[!A-Fa-f0-9]*) return 2 ;; esac
+  claim=$(claim_path "$fp")
+  [ ! -L "$claim" ] || return 2
+  state=$(claim_validate "$claim" "$fp" "$row") || return 2
+  case "$state" in reserved|presenting) ;; *) return 2 ;; esac
+  claim_binary_fields_valid "$claim" || return 2
+  for field in output_started output_emitted output_complete output_confirmed caller_confirmed; do
+    value=$(claim_binary_field "$claim" "$field" 2>/dev/null || true)
+    case "$value" in ''|0) ;; *) return 2 ;; esac
+  done
+  tmp=$(mktemp "$OUTCOME_DIR/.claim-state.XXXXXX") || return 2
+  chmod 600 "$tmp" 2>/dev/null || true
+  {
+    while IFS= read -r line || [ -n "$line" ]; do
+      case "$line" in
+        state=*) printf 'state=presented\n' ;;
+        output_started=*) printf 'output_started=1\n' ;;
+        output_emitted=*) printf 'output_emitted=1\n' ;;
+        output_complete=*) printf 'output_complete=1\n' ;;
+        output_confirmed=*) printf 'output_confirmed=1\n' ;;
+        caller_confirmed=*) printf 'caller_confirmed=1\n' ;;
+        *) printf '%s\n' "$line" ;;
+      esac
+    done < "$claim"
+    for field in output_started output_emitted output_complete output_confirmed caller_confirmed; do
+      grep -Fq "$field=" "$claim" || printf '%s=1\n' "$field"
+    done
+  } | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 2; }
+  [ ! -L "$claim" ] || { rm -f "$tmp"; return 2; }
+  claim_publish "$tmp" "$claim" || { rm -f "$tmp"; return 2; }
+}
+
+claim_reserve() {  # <inactive-outcome:fingerprint> <wake-row>
+  local key=$1 row=$2 fp claim tmp state existing old_row line output_started output_emitted output_complete output_confirmed caller_confirmed defer_ack
+  local defer_generation defer_generation_start receipt_state receipt_rc=0 recorded_report=0 report_rc=1 recorded_ready=1 value
+  drain_claim_owner "$row" || return 2
+  case "$key" in inactive-outcome:*) fp=${key#inactive-outcome:} ;; *) return 2 ;; esac
+  case "$fp" in ''|*[!A-Fa-f0-9]*) return 2 ;; esac
+  inactive_state_preflight || return 2
+  receipt_state=$(claim_receipt_state "$fp" 2>/dev/null) || receipt_rc=$?
+  [ "$receipt_rc" = 0 ] || return 2
+  case "$receipt_state" in
+    presented|reported)
+      claim=$(claim_path "$fp")
+      [ ! -L "$claim" ] || return 2
+      if [ -e "$claim" ]; then
+        [ -f "$claim" ] || return 2
+        [ "$(claim_field "$claim" schema)" = fm-inactive-outcome-claim.v1 ] || return 2
+        [ "$(claim_field "$claim" fingerprint)" = "$fp" ] || return 2
+        [ -n "$(claim_field "$claim" row)" ] || return 2
+        case "$(claim_field "$claim" state)" in reserved|presenting|presented) ;; *) return 2 ;; esac
+        rm -f "$claim" || return 2
+      fi
+      return 3
+      ;;
+    pending) ;;
+    *) return 2 ;;
+  esac
+  prepare_pending_receipt "$(receipt_path "$fp" pending)" || return 2
+  report_rc=0
+  pending_secondmate_report_recorded "$fp" >/dev/null || report_rc=$?
+  case "$report_rc" in
+    0) recorded_report=1 ;;
+    1) ;;
+    *) return 2 ;;
+  esac
+  claim=$(claim_path "$fp")
+  [ ! -L "$claim" ] || return 2
+  if [ -e "$claim" ]; then
+    [ -f "$claim" ] || return 2
+    [ "$(claim_field "$claim" schema)" = fm-inactive-outcome-claim.v1 ] || return 2
+    [ "$(claim_field "$claim" fingerprint)" = "$fp" ] || return 2
+    state=$(claim_field "$claim" state)
+    case "$state" in presented|presenting|reserved) ;; *) return 2 ;; esac
+    old_row=$(claim_field "$claim" row)
+    [ -n "$old_row" ] || return 2
+    claim_binary_fields_valid "$claim" || return 2
+    if [ "$state" = presented ]; then
+      defer_ack=$(claim_field "$claim" defer_ack 2>/dev/null || true)
+      if [ "$defer_ack" = 1 ]; then
+        defer_generation=$(claim_field "$claim" defer_generation 2>/dev/null || true)
+        defer_generation_start=$(claim_field "$claim" defer_generation_start 2>/dev/null || true)
+        [ "$(claim_binary_field "$claim" output_complete 2>/dev/null || true)" = 1 ] || return 2
+      fi
+    fi
+    if [ "$state" = presenting ]; then
+      output_started=$(claim_field "$claim" output_started 2>/dev/null || true)
+      output_emitted=$(claim_field "$claim" output_emitted 2>/dev/null || true)
+      output_complete=$(claim_field "$claim" output_complete 2>/dev/null || true)
+      output_confirmed=$(claim_field "$claim" output_confirmed 2>/dev/null || true)
+      caller_confirmed=$(claim_field "$claim" caller_confirmed 2>/dev/null || true)
+      defer_ack=$(claim_field "$claim" defer_ack 2>/dev/null || true)
+      if [ "$defer_ack" = 1 ]; then
+        defer_generation=$(claim_field "$claim" defer_generation 2>/dev/null || true)
+        defer_generation_start=$(claim_field "$claim" defer_generation_start 2>/dev/null || true)
+        if [ "${FM_WAKE_DRAIN_DIRECT:-0}" != 1 ] \
+          && claim_defer_generation_live "$defer_generation" "$defer_generation_start"; then
+          return 4
+        fi
+      fi
+    fi
+    if [ "$old_row" != "$row" ]; then
+      claim_rewrite_row "$claim" "$row" || return 2
+    fi
+    if [ "$state" = presented ] && [ "$(claim_field "$claim" defer_ack 2>/dev/null || true)" = 1 ]; then
+      [ "$(claim_binary_field "$claim" output_started 2>/dev/null || true)" = 1 ] || return 2
+      [ "$(claim_binary_field "$claim" output_emitted 2>/dev/null || true)" = 1 ] || return 2
+      [ "$(claim_binary_field "$claim" output_complete 2>/dev/null || true)" = 1 ] || return 2
+      [ "$(claim_binary_field "$claim" output_confirmed 2>/dev/null || true)" = 1 ] || return 2
+      [ "$(claim_binary_field "$claim" caller_confirmed 2>/dev/null || true)" = 1 ] || return 2
+      if [ -n "${FM_WAKE_DRAIN_GENERATION:-}" ] \
+        && { [ "${FM_WAKE_DRAIN_DIRECT:-0}" = 1 ] \
+          || ! claim_defer_generation_live "$defer_generation" "$defer_generation_start"; }; then
+        claim_rebind_deferred_generation "$key" "$row" || return 2
+      fi
+      return 5
+    fi
+    if [ "$state" = presenting ] && [ "$defer_ack" = 1 ]; then
+      if [ "$recorded_report" = 1 ]; then
+        recorded_ready=1
+        for value in "$output_started" "$output_emitted" "$output_complete" "$output_confirmed" "$caller_confirmed"; do
+          case "$value" in ''|0) ;; *) recorded_ready=0 ;; esac
+        done
+        if [ "$recorded_ready" = 1 ]; then
+          claim_mark_presenting "$key" "$row" || return 2
+          claim_mark_recorded_presented "$key" "$row" || return 2
+          return 5
+        fi
+      fi
+      if [ "$caller_confirmed" = 0 ] \
+        && [ "$output_started" = 1 ] \
+        && [ "$output_emitted" = 1 ] \
+        && [ "$output_complete" = 1 ] \
+        && [ "$output_confirmed" = 1 ] \
+        && [ "${FM_WAKE_DRAIN_DEFER_ACK:-0}" = 1 ] \
+        && [ "${FM_WAKE_DRAIN_DIRECT:-0}" != 1 ] \
+        && ! claim_defer_generation_live "$defer_generation" "$defer_generation_start"; then
+        claim_recover_deferred_handoff "$key" "$row" || return 2
+        return 5
+      fi
+      case "$caller_confirmed" in
+        1)
+          [ "$output_started" = 1 ] || return 2
+          [ "$output_emitted" = 1 ] || return 2
+          [ "$output_complete" = 1 ] || return 2
+          [ "$output_confirmed" = 1 ] || return 2
+          if [ -n "${FM_WAKE_DRAIN_GENERATION:-}" ]; then
+            claim_rebind_deferred_generation "$key" "$row" || return 2
+          fi
+          claim_mark_presented_recovered "$key" "$row" || return 2
+          return 5
+          ;;
+        ''|0) ;;
+        *) return 2 ;;
+      esac
+      case "$output_emitted" in
+        ''|0) ;;
+        1) [ "$output_confirmed" = 1 ] || return 2 ;;
+        *) return 2 ;;
+      esac
+      case "$output_complete" in
+        ''|0) ;;
+        1) return 4 ;;
+        *) return 2 ;;
+      esac
+      [ "${FM_WAKE_DRAIN_DEFER_ACK:-0}" = 1 ] || return 4
+      return 0
+    fi
+    if [ "$recorded_report" = 1 ]; then
+      if [ "$state" = presented ]; then
+        return 5
+      fi
+      if [ "$state" = reserved ]; then
+        claim_mark_presenting "$key" "$row" || return 2
+        state=presenting
+        output_started=0
+        output_emitted=0
+        output_complete=0
+        output_confirmed=0
+        caller_confirmed=0
+      fi
+      for value in "$output_started" "$output_emitted" "$output_complete" "$output_confirmed" "$caller_confirmed"; do
+        case "$value" in ''|0) ;; *) recorded_ready=0 ;; esac
+      done
+      if [ "$state" = presenting ] && [ "$recorded_ready" = 1 ]; then
+        claim_mark_presenting "$key" "$row" || return 2
+        claim_mark_recorded_presented "$key" "$row" || return 2
+        return 5
+      fi
+    fi
+    if [ "$recorded_report" = 1 ]; then
+      case "$state" in
+        presented) return 5 ;;
+        presenting|reserved)
+          claim_mark_presenting "$key" "$row" || return 2
+          claim_mark_output_complete "$key" "$row" || return 2
+          claim_mark_output_confirmed "$key" "$row" || return 2
+          claim_mark_presented "$key" "$row" || return 2
+          return 5
+          ;;
+      esac
+    fi
+    if [ "$state" = presenting ]; then
+      output_complete=$(claim_binary_field "$claim" output_complete 2>/dev/null || true)
+      defer_ack=$(claim_field "$claim" defer_ack 2>/dev/null || true)
+      if [ "$defer_ack" = 1 ]; then
+        defer_generation=$(claim_field "$claim" defer_generation 2>/dev/null || true)
+        defer_generation_start=$(claim_field "$claim" defer_generation_start 2>/dev/null || true)
+        if [ "${FM_WAKE_DRAIN_DIRECT:-0}" != 1 ] \
+          && claim_defer_generation_live "$defer_generation" "$defer_generation_start"; then
+          return 4
+        fi
+      fi
+      if [ "$output_complete" = 1 ]; then
+        [ "$output_confirmed" = 1 ] || return 4
+        claim_mark_presented "$key" "$row" || return 2
+        return 5
+      fi
+      if [ "$output_emitted" = 1 ]; then
+        [ "$output_confirmed" = 1 ] || return 4
+        if claim_mark_output_complete "$key" "$row"; then
+          claim_mark_presented "$key" "$row" || return 2
+          return 5
+        fi
+        return 6
+      fi
+      if [ "$defer_ack" = 1 ]; then
+        return 0
+      fi
+    fi
+    if [ "$state" = presented ]; then
+      defer_ack=$(claim_field "$claim" defer_ack 2>/dev/null || true)
+      if [ "$defer_ack" = 1 ]; then
+        tmp=$(mktemp "$OUTCOME_DIR/.claim-state.XXXXXX") || return 2
+        chmod 600 "$tmp" 2>/dev/null || true
+        while IFS= read -r line || [ -n "$line" ]; do
+          case "$line" in
+            state=*) printf 'state=reserved\n' ;;
+            defer_ack=*) printf 'defer_ack=0\n' ;;
+            defer_generation=*) printf 'defer_generation=\n' ;;
+            defer_generation_start=*) printf 'defer_generation_start=\n' ;;
+            *) printf '%s\n' "$line" ;;
+          esac
+        done < "$claim" | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 2; }
+        [ ! -L "$claim" ] || { rm -f "$tmp"; return 2; }
+        claim_publish "$tmp" "$claim" || { rm -f "$tmp"; return 2; }
+        return 0
+      fi
+      return 5
+    fi
+    return 0
+  fi
+  mkdir -p "$OUTCOME_DIR" || return 2
+  tmp=$(mktemp "$OUTCOME_DIR/.claim.XXXXXX") || return 2
+  chmod 600 "$tmp" 2>/dev/null || true
+  {
+    printf 'schema=fm-inactive-outcome-claim.v1\n'
+    printf 'fingerprint=%s\n' "$fp"
+    printf 'row=%s\n' "$row"
+    printf 'state=reserved\n'
+    printf 'created_epoch=%s\n' "$(date +%s)"
+  } | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 2; }
+  if claim_publish "$tmp" "$claim" 1; then
+    rm -f "$tmp"
+    if [ "$recorded_report" = 1 ]; then
+      claim_mark_presenting "$key" "$row" || return 2
+      claim_mark_recorded_presented "$key" "$row" || return 2
+      return 5
+    fi
+    return 0
+  fi
+  rm -f "$tmp"
+  [ -e "$claim" ] || return 2
+  state=$(claim_validate "$claim" "$fp" "$row") || return 2
+  [ "$state" = presented ] && return 1
+  return 0
+}
+
+claim_mark_presenting() {  # <inactive-outcome:fingerprint> <wake-row>
+  local key=$1 row=$2 fp claim state tmp line defer_ack=0 defer_generation='' defer_generation_start=''
+  local preserve_output=0 seen_pid=0 seen_output=0 seen_emitted=0 seen_complete=0 seen_caller_confirmed=0
+  local seen_defer_ack=0 seen_defer_generation=0 seen_defer_generation_start=0
+  if [ "${FM_WAKE_DRAIN_DEFER_ACK:-0}" = 1 ] || [ -n "${FM_WAKE_DRAIN_GENERATION:-}" ]; then
+    defer_ack=1
+  fi
+  if [ "$defer_ack" = 1 ]; then
+    defer_generation=${FM_WAKE_DRAIN_GENERATION:-}
+    case "$defer_generation" in ''|*[!0-9]*|0) return 2 ;; esac
+    defer_generation_start=$(fm_pid_start "$defer_generation") || return 2
+  fi
+  drain_claim_owner "$row" || return 2
+  case "$key" in inactive-outcome:*) fp=${key#inactive-outcome:} ;; *) return 2 ;; esac
+  case "$fp" in ''|*[!A-Fa-f0-9]*) return 2 ;; esac
+  claim=$(claim_path "$fp")
+  [ ! -L "$claim" ] || return 2
+  state=$(claim_validate "$claim" "$fp" "$row") || return 2
+  case "$state" in
+    presenting|reserved) ;;
+    *) return 2 ;;
+  esac
+  claim_binary_fields_valid "$claim" || return 2
+  if [ "$state" = presenting ] \
+    && [ "$(claim_binary_field "$claim" output_emitted 2>/dev/null || true)" = 1 ]; then
+    preserve_output=1
+  fi
+  tmp=$(mktemp "$OUTCOME_DIR/.claim-state.XXXXXX") || return 2
+  chmod 600 "$tmp" 2>/dev/null || true
+  {
+    while IFS= read -r line || [ -n "$line" ]; do
+      case "$line" in
+        state=*) printf 'state=presenting\n' ;;
+        presentation_pid=*) printf 'presentation_pid=%s\n' "${BASHPID:-$$}"; seen_pid=1 ;;
+        output_started=*)
+          if [ "$preserve_output" = 1 ]; then printf '%s\n' "$line"; else printf 'output_started=0\n'; fi
+          seen_output=1
+          ;;
+        output_emitted=*)
+          if [ "$preserve_output" = 1 ]; then printf '%s\n' "$line"; else printf 'output_emitted=0\n'; fi
+          seen_emitted=1
+          ;;
+        output_complete=*)
+          if [ "$preserve_output" = 1 ]; then printf '%s\n' "$line"; else printf 'output_complete=0\n'; fi
+          seen_complete=1
+          ;;
+        caller_confirmed=*)
+          if [ "$preserve_output" = 1 ]; then printf '%s\n' "$line"; else printf 'caller_confirmed=0\n'; fi
+          seen_caller_confirmed=1
+          ;;
+        defer_ack=*) printf 'defer_ack=%s\n' "$defer_ack"; seen_defer_ack=1 ;;
+        defer_generation=*) printf 'defer_generation=%s\n' "$defer_generation"; seen_defer_generation=1 ;;
+        defer_generation_start=*) printf 'defer_generation_start=%s\n' "$defer_generation_start"; seen_defer_generation_start=1 ;;
+        *) printf '%s\n' "$line" ;;
+      esac
+    done < "$claim"
+    [ "$seen_pid" = 1 ] || printf 'presentation_pid=%s\n' "${BASHPID:-$$}"
+    [ "$seen_output" = 1 ] || printf 'output_started=0\n'
+    [ "$seen_emitted" = 1 ] || printf 'output_emitted=0\n'
+    [ "$seen_complete" = 1 ] || printf 'output_complete=0\n'
+    [ "$seen_caller_confirmed" = 1 ] || printf 'caller_confirmed=0\n'
+    [ "$seen_defer_ack" = 1 ] || printf 'defer_ack=%s\n' "$defer_ack"
+    [ "$seen_defer_generation" = 1 ] || printf 'defer_generation=%s\n' "$defer_generation"
+    [ "$seen_defer_generation_start" = 1 ] || printf 'defer_generation_start=%s\n' "$defer_generation_start"
+  } | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 2; }
+  [ ! -L "$claim" ] || { rm -f "$tmp"; return 2; }
+  claim_publish "$tmp" "$claim" || { rm -f "$tmp"; return 2; }
+}
+
+claim_mark_output_complete() {  # <inactive-outcome:fingerprint> <wake-row>
+  local key=$1 row=$2 owner_required=${3:-1} expected_generation=${4:-}
+  local fp claim state tmp line seen_output=0 seen_complete=0
+  local seen_emitted=0 seen_confirmed=0 seen_caller_confirmed=0 confirmed_value caller_confirmed_value
+  case "$owner_required" in
+    1) drain_claim_owner "$row" || return 2 ;;
+    0)
+      case "$expected_generation" in ''|*[!0-9]*|0) return 2 ;; esac
+      ;;
+    *) return 2 ;;
+  esac
+  case "$key" in inactive-outcome:*) fp=${key#inactive-outcome:} ;; *) return 2 ;; esac
+  case "$fp" in ''|*[!A-Fa-f0-9]*) return 2 ;; esac
+  claim=$(claim_path "$fp")
+  [ ! -L "$claim" ] || return 2
+  state=$(claim_validate "$claim" "$fp" "$row") || return 2
+  [ "$state" = presenting ] || return 2
+  claim_binary_fields_valid "$claim" || return 2
+  if [ "$owner_required" = 0 ]; then
+    claim_validate_caller_owner "$claim" "$expected_generation" || return 2
+    [ "$(claim_binary_field "$claim" output_started 2>/dev/null || true)" = 1 ] || return 2
+    [ "$(claim_binary_field "$claim" output_emitted 2>/dev/null || true)" = 1 ] || return 2
+  fi
+  tmp=$(mktemp "$OUTCOME_DIR/.claim-state.XXXXXX") || return 2
+  chmod 600 "$tmp" 2>/dev/null || true
+  {
+    while IFS= read -r line || [ -n "$line" ]; do
+      case "$line" in
+        output_started=*) printf 'output_started=1\n'; seen_output=1 ;;
+        output_emitted=*) printf 'output_emitted=1\n'; seen_emitted=1 ;;
+        output_complete=*) printf 'output_complete=1\n'; seen_complete=1 ;;
+        output_confirmed=*)
+          [ "$seen_confirmed" = 0 ] || { rm -f "$tmp"; return 2; }
+          confirmed_value=${line#output_confirmed=}
+          case "$confirmed_value" in 0|1) ;; *) rm -f "$tmp"; return 2 ;; esac
+          [ "$owner_required" = 0 ] && confirmed_value=1
+          printf 'output_confirmed=%s\n' "$confirmed_value"
+          seen_confirmed=1
+          ;;
+        caller_confirmed=*)
+          [ "$seen_caller_confirmed" = 0 ] || { rm -f "$tmp"; return 2; }
+          caller_confirmed_value=${line#caller_confirmed=}
+          case "$caller_confirmed_value" in 0|1) ;; *) rm -f "$tmp"; return 2 ;; esac
+          [ "$owner_required" = 0 ] && caller_confirmed_value=1
+          printf 'caller_confirmed=%s\n' "$caller_confirmed_value"
+          seen_caller_confirmed=1
+          ;;
+        *) printf '%s\n' "$line" ;;
+      esac
+    done < "$claim"
+    [ "$seen_output" = 1 ] || printf 'output_started=1\n'
+    [ "$seen_emitted" = 1 ] || printf 'output_emitted=1\n'
+    [ "$seen_complete" = 1 ] || printf 'output_complete=1\n'
+    [ "$seen_confirmed" = 1 ] || \
+      printf 'output_confirmed=%s\n' "$([ "$owner_required" = 0 ] && printf 1 || printf 0)"
+    [ "$seen_caller_confirmed" = 1 ] || \
+      printf 'caller_confirmed=%s\n' "$([ "$owner_required" = 0 ] && printf 1 || printf 0)"
+  } | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 2; }
+  [ ! -L "$claim" ] || { rm -f "$tmp"; return 2; }
+  claim_publish "$tmp" "$claim" || { rm -f "$tmp"; return 2; }
+}
+
+claim_mark_output_started() {  # <inactive-outcome:fingerprint> <wake-row>
+  local key=$1 row=$2 fp claim state tmp line seen_output=0 seen_complete=0
+  local seen_emitted=0 seen_confirmed=0 seen_caller_confirmed=0
+  drain_claim_owner "$row" || return 2
+  case "$key" in inactive-outcome:*) fp=${key#inactive-outcome:} ;; *) return 2 ;; esac
+  case "$fp" in ''|*[!A-Fa-f0-9]*) return 2 ;; esac
+  claim=$(claim_path "$fp")
+  [ ! -L "$claim" ] || return 2
+  state=$(claim_validate "$claim" "$fp" "$row") || return 2
+  [ "$state" = presenting ] || return 2
+  claim_binary_fields_valid "$claim" || return 2
+  tmp=$(mktemp "$OUTCOME_DIR/.claim-state.XXXXXX") || return 2
+  chmod 600 "$tmp" 2>/dev/null || true
+  {
+    while IFS= read -r line || [ -n "$line" ]; do
+      case "$line" in
+        output_started=*) printf 'output_started=1\n'; seen_output=1 ;;
+        output_emitted=*) printf 'output_emitted=0\n'; seen_emitted=1 ;;
+        output_complete=*) printf 'output_complete=0\n'; seen_complete=1 ;;
+        output_confirmed=*)
+          [ "$seen_confirmed" = 0 ] || { rm -f "$tmp"; return 2; }
+          printf 'output_confirmed=0\n'
+          seen_confirmed=1
+          ;;
+        caller_confirmed=*)
+          [ "$seen_caller_confirmed" = 0 ] || { rm -f "$tmp"; return 2; }
+          printf 'caller_confirmed=0\n'
+          seen_caller_confirmed=1
+          ;;
+        *) printf '%s\n' "$line" ;;
+      esac
+    done < "$claim"
+    [ "$seen_output" = 1 ] || printf 'output_started=1\n'
+    [ "$seen_emitted" = 1 ] || printf 'output_emitted=0\n'
+    [ "$seen_complete" = 1 ] || printf 'output_complete=0\n'
+    [ "$seen_confirmed" = 1 ] || printf 'output_confirmed=0\n'
+    [ "$seen_caller_confirmed" = 1 ] || printf 'caller_confirmed=0\n'
+  } | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 2; }
+  [ ! -L "$claim" ] || { rm -f "$tmp"; return 2; }
+  claim_publish "$tmp" "$claim" || { rm -f "$tmp"; return 2; }
+}
+
+claim_mark_output_emitted() {  # <inactive-outcome:fingerprint> <wake-row>
+  local key=$1 row=$2 fp claim state tmp line seen_output=0 seen_emitted=0 seen_complete=0
+  local seen_confirmed=0 seen_caller_confirmed=0
+  drain_claim_owner "$row" || return 2
+  case "$key" in inactive-outcome:*) fp=${key#inactive-outcome:} ;; *) return 2 ;; esac
+  case "$fp" in ''|*[!A-Fa-f0-9]*) return 2 ;; esac
+  claim=$(claim_path "$fp")
+  [ ! -L "$claim" ] || return 2
+  state=$(claim_validate "$claim" "$fp" "$row") || return 2
+  [ "$state" = presenting ] || return 2
+  claim_binary_fields_valid "$claim" || return 2
+  [ "$(claim_binary_field "$claim" output_started 2>/dev/null || true)" = 1 ] || return 2
+  tmp=$(mktemp "$OUTCOME_DIR/.claim-state.XXXXXX") || return 2
+  chmod 600 "$tmp" 2>/dev/null || true
+  {
+    while IFS= read -r line || [ -n "$line" ]; do
+      case "$line" in
+        output_started=*) printf 'output_started=1\n'; seen_output=1 ;;
+        output_emitted=*) printf 'output_emitted=1\n'; seen_emitted=1 ;;
+        output_complete=*) printf 'output_complete=0\n'; seen_complete=1 ;;
+        output_confirmed=*)
+          [ "$seen_confirmed" = 0 ] || { rm -f "$tmp"; return 2; }
+          printf 'output_confirmed=0\n'
+          seen_confirmed=1
+          ;;
+        caller_confirmed=*)
+          [ "$seen_caller_confirmed" = 0 ] || { rm -f "$tmp"; return 2; }
+          printf 'caller_confirmed=0\n'
+          seen_caller_confirmed=1
+          ;;
+        *) printf '%s\n' "$line" ;;
+      esac
+    done < "$claim"
+    [ "$seen_output" = 1 ] || printf 'output_started=1\n'
+    [ "$seen_emitted" = 1 ] || printf 'output_emitted=1\n'
+    [ "$seen_complete" = 1 ] || printf 'output_complete=0\n'
+    [ "$seen_confirmed" = 1 ] || printf 'output_confirmed=0\n'
+    [ "$seen_caller_confirmed" = 1 ] || printf 'caller_confirmed=0\n'
+  } | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 2; }
+  [ ! -L "$claim" ] || { rm -f "$tmp"; return 2; }
+  claim_publish "$tmp" "$claim" || { rm -f "$tmp"; return 2; }
+}
+
+claim_output_emitted() {
+  local key=$1 row=$2 fp claim state emitted
+  drain_claim_owner "$row" || return 2
+  case "$key" in inactive-outcome:*) fp=${key#inactive-outcome:} ;; *) return 2 ;; esac
+  case "$fp" in ''|*[!A-Fa-f0-9]*) return 2 ;; esac
+  claim=$(claim_path "$fp")
+  state=$(claim_validate "$claim" "$fp" "$row") || return 2
+  [ "$state" = presenting ] || return 2
+  emitted=$(claim_binary_field "$claim" output_emitted 2>/dev/null || true)
+  case "$emitted" in
+    1) return 0 ;;
+    0|'') return 1 ;;
+    *) return 2 ;;
+  esac
+}
+
+claim_mark_output_confirmed() {  # <inactive-outcome:fingerprint> <wake-row>
+  local key=$1 row=$2 fp claim state tmp line seen_confirmed=0 seen_caller_confirmed=0
+  drain_claim_owner "$row" || return 2
+  case "$key" in inactive-outcome:*) fp=${key#inactive-outcome:} ;; *) return 2 ;; esac
+  case "$fp" in ''|*[!A-Fa-f0-9]*) return 2 ;; esac
+  claim=$(claim_path "$fp")
+  [ ! -L "$claim" ] || return 2
+  state=$(claim_validate "$claim" "$fp" "$row") || return 2
+  [ "$state" = presenting ] || return 2
+  claim_binary_fields_valid "$claim" || return 2
+  [ "$(claim_binary_field "$claim" output_started 2>/dev/null || true)" = 1 ] || return 2
+  [ "$(claim_binary_field "$claim" output_emitted 2>/dev/null || true)" = 1 ] || return 2
+  tmp=$(mktemp "$OUTCOME_DIR/.claim-state.XXXXXX") || return 2
+  chmod 600 "$tmp" 2>/dev/null || true
+  {
+    while IFS= read -r line || [ -n "$line" ]; do
+      case "$line" in
+        output_confirmed=*)
+          [ "$seen_confirmed" = 0 ] || { rm -f "$tmp"; return 2; }
+          printf 'output_confirmed=1\n'
+          seen_confirmed=1
+          ;;
+        caller_confirmed=*)
+          [ "$seen_caller_confirmed" = 0 ] || { rm -f "$tmp"; return 2; }
+          printf 'caller_confirmed=0\n'
+          seen_caller_confirmed=1
+          ;;
+        *) printf '%s\n' "$line" ;;
+      esac
+    done < "$claim"
+    [ "$seen_confirmed" = 1 ] || printf 'output_confirmed=1\n'
+    [ "$seen_caller_confirmed" = 1 ] || printf 'caller_confirmed=0\n'
+  } | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 2; }
+  [ ! -L "$claim" ] || { rm -f "$tmp"; return 2; }
+  claim_publish "$tmp" "$claim" || { rm -f "$tmp"; return 2; }
+}
+
+claim_mark_presented() {  # <inactive-outcome:fingerprint> <wake-row>
+  local key=$1 row=$2 fp claim state tmp line defer_ack defer_generation defer_generation_start
+  drain_claim_owner "$row" || return 2
+  case "$key" in inactive-outcome:*) fp=${key#inactive-outcome:} ;; *) return 2 ;; esac
+  case "$fp" in ''|*[!A-Fa-f0-9]*) return 2 ;; esac
+  claim=$(claim_path "$fp")
+  [ ! -L "$claim" ] || return 2
+  state=$(claim_validate "$claim" "$fp" "$row") || return 2
+  [ "$state" = presenting ] || return 2
+  claim_binary_fields_valid "$claim" || return 2
+  [ "$(claim_binary_field "$claim" output_started 2>/dev/null || true)" = 1 ] || return 2
+  [ "$(claim_binary_field "$claim" output_emitted 2>/dev/null || true)" = 1 ] || return 2
+  [ "$(claim_binary_field "$claim" output_complete 2>/dev/null || true)" = 1 ] || return 2
+  [ "$(claim_binary_field "$claim" output_confirmed 2>/dev/null || true)" = 1 ] || return 2
+  defer_ack=$(claim_field "$claim" defer_ack 2>/dev/null) || return 2
+  case "$defer_ack" in 0) ;; 1)
+    defer_generation=$(claim_field "$claim" defer_generation 2>/dev/null) || return 2
+    defer_generation_start=$(claim_field "$claim" defer_generation_start 2>/dev/null) || return 2
+    case "$defer_generation" in ''|*[!0-9]*|0) return 2 ;; esac
+    [ -n "$defer_generation_start" ] || return 2
+    [ "$(claim_binary_field "$claim" caller_confirmed 2>/dev/null || true)" = 1 ] || return 2
+    ;;
+    *) return 2 ;;
+  esac
+  tmp=$(mktemp "$OUTCOME_DIR/.claim-state.XXXXXX") || return 2
+  chmod 600 "$tmp" 2>/dev/null || true
+  while IFS= read -r line || [ -n "$line" ]; do
+    case "$line" in
+      state=*) printf 'state=presented\n' ;;
+      *) printf '%s\n' "$line" ;;
+    esac
+  done < "$claim" | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 2; }
+  [ ! -L "$claim" ] || { rm -f "$tmp"; return 2; }
+  claim_publish "$tmp" "$claim" || { rm -f "$tmp"; return 2; }
+}
+
+claim_mark_presented_recovered() {  # <inactive-outcome:fingerprint> <wake-row>
+  local key=$1 row=$2 fp claim state tmp line
+  drain_claim_owner "$row" || return 2
+  case "$key" in inactive-outcome:*) fp=${key#inactive-outcome:} ;; *) return 2 ;; esac
+  case "$fp" in ''|*[!A-Fa-f0-9]*) return 2 ;; esac
+  claim=$(claim_path "$fp")
+  [ ! -L "$claim" ] || return 2
+  state=$(claim_validate "$claim" "$fp" "$row") || return 2
+  [ "$state" = presenting ] || return 2
+  claim_binary_fields_valid "$claim" || return 2
+  [ "$(claim_binary_field "$claim" output_started 2>/dev/null || true)" = 1 ] || return 2
+  [ "$(claim_binary_field "$claim" output_emitted 2>/dev/null || true)" = 1 ] || return 2
+  [ "$(claim_binary_field "$claim" output_complete 2>/dev/null || true)" = 1 ] || return 2
+  [ "$(claim_binary_field "$claim" output_confirmed 2>/dev/null || true)" = 1 ] || return 2
+  [ "$(claim_binary_field "$claim" caller_confirmed 2>/dev/null || true)" = 1 ] || return 2
+  tmp=$(mktemp "$OUTCOME_DIR/.claim-state.XXXXXX") || return 2
+  chmod 600 "$tmp" 2>/dev/null || true
+  while IFS= read -r line || [ -n "$line" ]; do
+    case "$line" in state=*) printf 'state=presented\n' ;; *) printf '%s\n' "$line" ;; esac
+  done < "$claim" | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 2; }
+  [ ! -L "$claim" ] || { rm -f "$tmp"; return 2; }
+  claim_publish "$tmp" "$claim" || { rm -f "$tmp"; return 2; }
+}
+
+claim_mark_confirmed() {  # <inactive-outcome:fingerprint> <wake-row>
+  local key=$1 row=$2 owner_required=${3:-1} expected_generation=${4:-}
+  local fp claim state tmp line seen_output=0 seen_emitted=0 seen_complete=0 seen_confirmed=0 seen_caller_confirmed=0
+  case "$owner_required" in
+    1) drain_claim_owner "$row" || return 2 ;;
+    0) ;; 
+    *) return 2 ;;
+  esac
+  case "$key" in inactive-outcome:*) fp=${key#inactive-outcome:} ;; *) return 2 ;; esac
+  case "$fp" in ''|*[!A-Fa-f0-9]*) return 2 ;; esac
+  claim=$(claim_path "$fp")
+  [ ! -L "$claim" ] || return 2
+  state=$(claim_validate "$claim" "$fp" "$row") || return 2
+  claim_binary_fields_valid "$claim" || return 2
+  if [ "$owner_required" = 0 ]; then
+    claim_validate_caller_owner "$claim" "$expected_generation" || return 2
+    [ "$(claim_binary_field "$claim" output_started 2>/dev/null || true)" = 1 ] || return 2
+    [ "$(claim_binary_field "$claim" output_emitted 2>/dev/null || true)" = 1 ] || return 2
+    [ "$(claim_binary_field "$claim" output_complete 2>/dev/null || true)" = 1 ] || return 2
+    [ "$(claim_binary_field "$claim" output_confirmed 2>/dev/null || true)" = 1 ] || return 2
+    [ "$(claim_binary_field "$claim" caller_confirmed 2>/dev/null || true)" = 1 ] || return 2
+  fi
+  case "$state" in
+    presented)
+      [ "$(claim_binary_field "$claim" output_complete 2>/dev/null || true)" = 1 ] || return 2
+      [ "$(claim_binary_field "$claim" output_confirmed 2>/dev/null || true)" = 1 ] || return 2
+      if [ "$(claim_field "$claim" defer_ack 2>/dev/null || true)" = 1 ]; then
+        [ "$(claim_binary_field "$claim" caller_confirmed 2>/dev/null || true)" = 1 ] || return 2
+      fi
+      return 0
+      ;;
+    presenting) ;;
+    *) return 2 ;;
+  esac
+  [ "$(claim_field "$claim" defer_ack 2>/dev/null || true)" = 1 ] || return 2
+  tmp=$(mktemp "$OUTCOME_DIR/.claim-state.XXXXXX") || return 2
+  chmod 600 "$tmp" 2>/dev/null || true
+  {
+    while IFS= read -r line || [ -n "$line" ]; do
+      case "$line" in
+        state=*) printf 'state=presented\n' ;;
+        output_started=*) printf 'output_started=1\n'; seen_output=1 ;;
+        output_emitted=*) printf 'output_emitted=1\n'; seen_emitted=1 ;;
+        output_complete=*) printf 'output_complete=1\n'; seen_complete=1 ;;
+        output_confirmed=*)
+          [ "$seen_confirmed" = 0 ] || { rm -f "$tmp"; return 2; }
+          printf 'output_confirmed=1\n'
+          seen_confirmed=1
+          ;;
+        caller_confirmed=*)
+          [ "$seen_caller_confirmed" = 0 ] || { rm -f "$tmp"; return 2; }
+          [ "$owner_required" = 0 ] || { rm -f "$tmp"; return 2; }
+          printf 'caller_confirmed=1\n'
+          seen_caller_confirmed=1
+          ;;
+        *) printf '%s\n' "$line" ;;
+      esac
+    done < "$claim"
+    [ "$seen_output" = 1 ] || printf 'output_started=1\n'
+    [ "$seen_emitted" = 1 ] || printf 'output_emitted=1\n'
+    [ "$seen_complete" = 1 ] || printf 'output_complete=1\n'
+    [ "$seen_confirmed" = 1 ] || printf 'output_confirmed=1\n'
+    [ "$owner_required" = 0 ] && [ "$seen_caller_confirmed" = 1 ] || { rm -f "$tmp"; return 2; }
+  } | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 2; }
+  [ ! -L "$claim" ] || { rm -f "$tmp"; return 2; }
+  claim_publish "$tmp" "$claim" || { rm -f "$tmp"; return 2; }
+}
+
+claim_remove() {  # <inactive-outcome:fingerprint> <wake-row>
+  local key=$1 row=$2 owner_required=${3:-1} expected_generation=${4:-} fp claim
+  case "$key" in inactive-outcome:*) fp=${key#inactive-outcome:} ;; *) return 2 ;; esac
+  case "$fp" in ''|*[!A-Fa-f0-9]*) return 2 ;; esac
+  claim=$(claim_path "$fp")
+  case "$owner_required" in
+    0) claim_validate_caller_owner "$claim" "$expected_generation" || return 2 ;;
+    1) drain_claim_owner "$row" || return 2 ;;
+    *) return 2 ;;
+  esac
+  [ ! -L "$claim" ] || return 2
+  [ -e "$claim" ] || return 0
+  claim_validate "$claim" "$fp" "$row" >/dev/null || return 2
+  rm -f "$claim"
+}
+
+receipt_matches_expected() {
+  local existing=$1
+  [ ! -L "$existing" ] || return 1
+  [ -f "$existing" ] || return 1
+  [ "$(receipt_field "$existing" schema)" = fm-jt-terminal-outcome.v1 ] || return 1
+  [ "$(receipt_field "$existing" fingerprint)" = "$FP" ] || return 1
+  [ "$(receipt_field "$existing" task_id)" = "$ID" ] || return 1
+  [ "$(receipt_field "$existing" incarnation)" = "$INC" ] || return 1
+  [ "$(receipt_field "$existing" outcome)" = "$OUTCOME" ] || return 1
+  [ "$(receipt_field "$existing" terminal_source)" = "$SOURCE" ] || return 1
+  [ "$(receipt_field "$existing" terminal_snapshot)" = "$SNAPSHOT" ] || return 1
+  [ "$(receipt_field "$existing" kind)" = "$KIND" ] || return 1
+  if [ "$KIND" = secondmate ]; then
+    [ "$(receipt_field "$existing" parent_task_id)" = "${FM_PENDING_ROUTE_SECOND_MATE_ID:-}" ] || return 1
+    [ "$(receipt_field "$existing" parent_home)" = "${FM_PENDING_ROUTE_PARENT_HOME:-}" ] || return 1
+    [ "$(receipt_field "$existing" parent_status)" = "${FM_PENDING_ROUTE_PARENT_STATUS:-}" ] || return 1
+    [ "$(receipt_field "$existing" parent_corr)" = "${FM_PENDING_ROUTE_CORR:-}" ] || return 1
+  else
+    [ -z "$(receipt_field "$existing" parent_task_id)" ] || return 1
+    [ -z "$(receipt_field "$existing" parent_home)" ] || return 1
+    [ -z "$(receipt_field "$existing" parent_status)" ] || return 1
+    [ -z "$(receipt_field "$existing" parent_corr)" ] || return 1
+  fi
+}
+
+receipt_write() {  # globals: FP ID INC OUTCOME SNAPSHOT KIND SOURCE
+  local pending tmp existing
+  inactive_state_preflight || return 1
+  pending=$(receipt_path "$FP" pending)
+  for suffix in pending presented reported; do
+    existing=$(receipt_path "$FP" "$suffix")
+    [ ! -L "$existing" ] || return 1
+    [ -e "$existing" ] || continue
+    receipt_matches_expected "$existing" || return 1
+    return 0
+  done
+  mkdir -p "$OUTCOME_DIR" || return 1
+  tmp=$(mktemp "$OUTCOME_DIR/.receipt.XXXXXX") || return 1
+  chmod 600 "$tmp" 2>/dev/null || true
+  {
+    printf 'schema=fm-jt-terminal-outcome.v1\n'
+    printf 'fingerprint=%s\n' "$FP"
+    printf 'task_id=%s\n' "$ID"
+    printf 'incarnation=%s\n' "$INC"
+    printf 'outcome=%s\n' "$OUTCOME"
+    printf 'terminal_source=%s\n' "$SOURCE"
+    printf 'terminal_snapshot=%s\n' "$SNAPSHOT"
+    printf 'kind=%s\n' "$KIND"
+    printf 'parent_task_id=%s\n' "${FM_PENDING_ROUTE_SECOND_MATE_ID:-}"
+    printf 'parent_home=%s\n' "${FM_PENDING_ROUTE_PARENT_HOME:-}"
+    printf 'parent_status=%s\n' "${FM_PENDING_ROUTE_PARENT_STATUS:-}"
+    printf 'parent_corr=%s\n' "${FM_PENDING_ROUTE_CORR:-}"
+    printf 'created_epoch=%s\n' "$(date +%s)"
+  } | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 1; }
+  if fm_nofollow_rename "$tmp" "$pending" 1; then
+    rm -f "$tmp"
+  else
+    rm -f "$tmp"
+    receipt_matches_expected "$pending" || return 1
+  fi
+  return 0
+}
+
+replay_pane_idle_publication_valid() {
+  local meta=$1 id=$2 window=$3 backend=$4 incarnation=$5 source=${6:-}
+  local deadline_ms=${FM_INACTIVE_OUTCOME_SCAN_DEADLINE_MS:-} now_ms remaining_ms capture_secs
+  if [ "$source" = run-step ]; then
+    [ "${SOURCE:-}" = run-step ] || return 1
+    run_step_incarnation_evidence_valid "$id" "$incarnation" "${OUTCOME:-}" "${SNAPSHOT:-}"
+    return $?
+  fi
+  if [ "${FM_INACTIVE_OUTCOME_CHILD_BOUND:-0}" = 1 ]; then
+    fm_pane_idle_proof_valid "$STATE" "$meta" "$id" "$window" "$backend" "$incarnation" "$RECONCILE_SECS"
+    return $?
+  fi
+  case "$deadline_ms" in ''|*[!0-9]*) deadline_ms=;; esac
+  if [ -n "$deadline_ms" ]; then
+    now_ms=$(clock_millis)
+    remaining_ms=$((deadline_ms - now_ms))
+    [ "$remaining_ms" -gt 0 ] || return 1
+    capture_secs=$(((remaining_ms + 999) / 1000))
+  else
+    capture_secs=${FM_INACTIVE_OUTCOME_SCAN_REMAINING_SECS:-${FM_LOCK_WAIT_SECS:-1}}
+  fi
+  capture_secs=$(bounded_secs "$capture_secs" 1 1 300)
+  run_bounded_child "$capture_secs" "$SCRIPT_DIR/fm-inactive-reconcile.sh" _pane-idle \
+    "$STATE" "$meta" "$id" "$window" "$backend" "$incarnation" "$RECONCILE_SECS"
+}
+
+publish_receipt_and_wake() {
+  local status=0 release_lock=0
+  local pane_meta=${1:-} pane_id=${2:-} pane_window=${3:-} pane_backend=${4:-} pane_incarnation=${5:-} source=${6:-}
+  FM_WAKE_APPEND_CREATED=0
+  if [ "$WAKE_QUEUE_LOCK_HELD" != 1 ]; then
+    wake_queue_lock_acquire || return 75
+    release_lock=1
+  fi
+  if [ -n "$pane_meta" ] \
+    && ! replay_pane_idle_publication_valid "$pane_meta" "$pane_id" "$pane_window" "$pane_backend" "$pane_incarnation" "$source"; then
+    [ "$release_lock" = 1 ] && wake_queue_lock_release || true
+    return 75
+  fi
+  if receipt_write; then
+    if [ -f "$(receipt_path "$FP" pending)" ]; then
+      fm_wake_append_if_absent_locked FM_WAKE_APPEND_CREATED check "inactive-outcome:$FP" \
+        "inactive terminal outcome: task=$ID state=$OUTCOME fingerprint=$FP" || status=$?
+    fi
+  else
+    status=$?
+  fi
+  if [ "$release_lock" = 1 ]; then
+    wake_queue_lock_release || status=1
+  fi
+  return "$status"
+}
+
+receipt_existing_core() {
+  local suffix existing expected_fp existing_kind existing_fingerprint existing_task_id existing_incarnation
+  local existing_outcome existing_snapshot existing_source parent_id parent_home parent_status parent_corr current_corr
+  RECEIPT_EXISTING_SUFFIX=
+  current_corr=$(replay_parent_corr) || return 1
+  expected_fp=$(terminal_outcome_fingerprint "$ID" "$INC" "$OUTCOME" "$SNAPSHOT" "$KIND" "$current_corr" "$SOURCE") || return 1
+  [ "$expected_fp" = "$FP" ] || return 1
+  for suffix in pending presented reported; do
+    existing=$(receipt_path "$FP" "$suffix")
+    [ ! -L "$existing" ] || return 2
+    [ -e "$existing" ] || continue
+    [ -f "$existing" ] || return 2
+    [ "$(receipt_field "$existing" schema)" = fm-jt-terminal-outcome.v1 ] || return 2
+    existing_fingerprint=$(receipt_field "$existing" fingerprint) || return 2
+    existing_task_id=$(receipt_field "$existing" task_id) || return 2
+    existing_incarnation=$(receipt_field "$existing" incarnation) || return 2
+    existing_outcome=$(receipt_field "$existing" outcome) || return 2
+    existing_source=$(receipt_field "$existing" terminal_source) || return 2
+    existing_snapshot=$(receipt_field "$existing" terminal_snapshot) || return 2
+    existing_kind=$(receipt_field "$existing" kind) || return 2
+    [ "$existing_fingerprint" = "$FP" ] || return 2
+    [ "$existing_task_id" = "$ID" ] || return 2
+    [ "$existing_incarnation" = "$INC" ] || return 2
+    [ "$existing_outcome" = "$OUTCOME" ] || return 2
+    [ "$existing_source" = "$SOURCE" ] || return 2
+    [ "$existing_snapshot" = "$SNAPSHOT" ] || return 2
+    [ "$existing_kind" = "$KIND" ] || return 2
+    case "$existing_kind" in
+      ship|scout)
+        parent_id=$(receipt_field "$existing" parent_task_id) || return 2
+        parent_home=$(receipt_field "$existing" parent_home) || return 2
+        parent_status=$(receipt_field "$existing" parent_status) || return 2
+        parent_corr=$(receipt_field "$existing" parent_corr) || return 2
+        [ -z "$parent_id" ] && [ -z "$parent_home" ] && [ -z "$parent_status" ] && [ -z "$parent_corr" ] || return 2
+        ;;
+      secondmate)
+        parent_id=$(receipt_field "$existing" parent_task_id) || return 2
+        parent_home=$(receipt_field "$existing" parent_home) || return 2
+        parent_status=$(receipt_field "$existing" parent_status) || return 2
+        parent_corr=$(receipt_field "$existing" parent_corr) || return 2
+        [ "$parent_id" = "${FM_PENDING_ROUTE_SECOND_MATE_ID:-}" ] || return 2
+        [ "$parent_home" = "${FM_PENDING_ROUTE_PARENT_HOME:-}" ] || return 2
+        [ "$parent_status" = "${FM_PENDING_ROUTE_PARENT_STATUS:-}" ] || return 2
+        [ "$parent_corr" = "${FM_PENDING_ROUTE_CORR:-}" ] || return 2
+        case "$parent_home" in /*) ;; *) return 2 ;; esac
+        case "$parent_status" in /*) ;; *) return 2 ;; esac
+        printf '%s' "$parent_corr" | grep -Eq '^[A-Fa-f0-9]{16}$' || return 2
+        ;;
+      *) return 2 ;;
+    esac
+    expected_fp=$(terminal_outcome_fingerprint "$existing_task_id" "$existing_incarnation" \
+      "$existing_outcome" "$existing_snapshot" "$existing_kind" "$parent_corr" "$existing_source") || return 2
+    [ "$expected_fp" = "$existing_fingerprint" ] || return 2
+    RECEIPT_EXISTING_SUFFIX=$suffix
+    return 0
+  done
+  return 1
+}
+
+republish_existing_receipt_wake() {
+  local existing task outcome status=0 existing_rc release_lock=0
+  local pane_meta=${1:-} pane_id=${2:-} pane_window=${3:-} pane_backend=${4:-} pane_incarnation=${5:-} source=${6:-}
+  FM_WAKE_APPEND_CREATED=0
+  if [ "$WAKE_QUEUE_LOCK_HELD" != 1 ]; then
+    wake_queue_lock_acquire || return 75
+    release_lock=1
+  fi
+  if receipt_existing_core; then
+    if [ "$RECEIPT_EXISTING_SUFFIX" = pending ]; then
+      existing=$(receipt_path "$FP" pending)
+      task=$(receipt_field "$existing" task_id)
+      outcome=$(receipt_field "$existing" outcome)
+      if [ -n "$pane_meta" ] \
+        && ! replay_pane_idle_publication_valid "$pane_meta" "$pane_id" "$pane_window" "$pane_backend" "$pane_incarnation" "$source"; then
+        status=75
+      else
+        fm_wake_append_if_absent_locked FM_WAKE_APPEND_CREATED check "inactive-outcome:$FP" \
+          "inactive terminal outcome: task=$task state=$outcome fingerprint=$FP" || status=$?
+      fi
+    fi
+  else
+    existing_rc=$?
+    [ "$existing_rc" = 1 ] || status=1
+  fi
+  if [ "$release_lock" = 1 ]; then
+    wake_queue_lock_release || status=1
+  fi
+  return "$status"
+}
+
+publish_secondmate_receipt_and_wake() {
+  local route_lock status=0 route_invalid=0 existing_rc pending pending_corr pending_parent_id pending_parent_home pending_parent_status
+  local release_lock=0
+  local pane_meta=${1:-} pane_id=${2:-} pane_window=${3:-} pane_backend=${4:-} pane_incarnation=${5:-} source=${6:-}
+  FM_WAKE_APPEND_CREATED=0
+  if [ "$WAKE_QUEUE_LOCK_HELD" != 1 ]; then
+    wake_queue_lock_acquire || return 75
+    release_lock=1
+  fi
+  if [ -L "$FM_HOME" ] || [ ! -d "$FM_HOME" ] || [ -L "$STATE" ] || [ ! -d "$STATE" ]; then
+    [ "$release_lock" = 1 ] && wake_queue_lock_release || true
+    return 75
+  fi
+  route_lock=$(fm_pending_reply_secondmate_route_lock_path "$FM_HOME")
+  if ! fm_lock_acquire_wait "$route_lock"; then
+    [ "$release_lock" = 1 ] && wake_queue_lock_release || true
+    return 75
+  fi
+  KIND=secondmate
+  pending=$(receipt_path "$FP" pending)
+  if [ -e "$pending" ] || [ -L "$pending" ]; then
+    [ -f "$pending" ] && [ ! -L "$pending" ] || route_invalid=1
+    if [ "$route_invalid" = 0 ]; then
+      pending_corr=$(receipt_field "$pending" parent_corr)
+      printf '%s' "$pending_corr" | grep -Eq '^[A-Fa-f0-9]{16}$' || route_invalid=1
+    fi
+    if [ "$route_invalid" = 0 ] && ! fm_pending_reply_secondmate_route_validate "$FM_HOME" "$pending_corr"; then
+      route_invalid=1
+    fi
+    if [ "$route_invalid" = 0 ]; then
+      pending_parent_id=$(receipt_field "$pending" parent_task_id)
+      pending_parent_home=$(receipt_field "$pending" parent_home)
+      pending_parent_status=$(receipt_field "$pending" parent_status)
+      [ "$pending_parent_id" = "$FM_PENDING_ROUTE_SECOND_MATE_ID" ] || route_invalid=1
+      [ "$pending_parent_home" = "$FM_PENDING_ROUTE_PARENT_HOME" ] || route_invalid=1
+      [ "$pending_parent_status" = "$FM_PENDING_ROUTE_PARENT_STATUS" ] || route_invalid=1
+    fi
+  elif ! fm_pending_reply_secondmate_route_validate "$FM_HOME"; then
+    route_invalid=1
+  fi
+  if [ "$route_invalid" = 1 ]; then
+    fm_lock_release "$route_lock" || true
+    [ "$release_lock" = 1 ] && wake_queue_lock_release || true
+    return 75
+  fi
+  if [ -n "$pane_meta" ] \
+    && ! replay_pane_idle_publication_valid "$pane_meta" "$pane_id" "$pane_window" "$pane_backend" "$pane_incarnation" "$source"; then
+    fm_lock_release "$route_lock" || true
+    [ "$release_lock" = 1 ] && wake_queue_lock_release || true
+    return 75
+  fi
+  if receipt_existing_core; then
+    if [ "$RECEIPT_EXISTING_SUFFIX" = pending ]; then
+      fm_wake_append_if_absent_locked FM_WAKE_APPEND_CREATED check "inactive-outcome:$FP" \
+        "inactive terminal outcome: task=$ID state=$OUTCOME fingerprint=$FP" || status=$?
+    fi
+  else
+    existing_rc=$?
+    if [ "$existing_rc" = 1 ]; then
+      if receipt_write; then
+        if [ -f "$(receipt_path "$FP" pending)" ]; then
+          fm_wake_append_if_absent_locked FM_WAKE_APPEND_CREATED check "inactive-outcome:$FP" \
+            "inactive terminal outcome: task=$ID state=$OUTCOME fingerprint=$FP" || status=$?
+        fi
+      else
+        status=$?
+      fi
+    else
+      status=1
+    fi
+  fi
+  fm_lock_release "$route_lock" || status=1
+  if [ "$release_lock" = 1 ]; then
+    wake_queue_lock_release || status=1
+  fi
+  return "$status"
+}
+
+prepare_pending_receipt() {
+  local pending=$1 expected_fp serialized_fp schema task_id incarnation outcome terminal_source terminal_snapshot kind key
+  local parent_task_id parent_home parent_status parent_corr
+  [ -f "$pending" ] && [ ! -L "$pending" ] || return 1
+  FP=${pending##*/}
+  case "$FP" in
+    *.pending) FP=${FP%.pending} ;;
+    *.presented) FP=${FP%.presented} ;;
+    *.reported) FP=${FP%.reported} ;;
+    *) return 1 ;;
+  esac
+  case "$FP" in ''|*[!A-Fa-f0-9]*) return 1 ;; esac
+  awk -F= '
+    BEGIN {
+      allowed["schema"]=1; allowed["fingerprint"]=1; allowed["task_id"]=1
+      allowed["incarnation"]=1; allowed["outcome"]=1; allowed["terminal_source"]=1
+      allowed["terminal_snapshot"]=1; allowed["kind"]=1; allowed["parent_task_id"]=1
+      allowed["parent_home"]=1; allowed["parent_status"]=1; allowed["parent_corr"]=1
+      allowed["created_epoch"]=1; valid=1
+    }
+    /^[^=]+=/ {
+      key=$1
+      if (!(key in allowed) || (key in seen)) valid=0
+      seen[key]=1
+      next
+    }
+    { valid=0 }
+    END {
+      for (key in allowed) {
+        if (key == "schema" || key == "fingerprint" || key == "task_id" ||
+            key == "incarnation" || key == "outcome" || key == "terminal_source" ||
+            key == "terminal_snapshot" || key == "kind") {
+          if (!(key in seen)) valid=0
+        }
+      }
+      exit !valid
+    }
+  ' "$pending" 2>/dev/null || return 1
+  schema=$(receipt_field "$pending" schema) || return 1
+  task_id=$(receipt_field "$pending" task_id) || return 1
+  incarnation=$(receipt_field "$pending" incarnation) || return 1
+  outcome=$(receipt_field "$pending" outcome) || return 1
+  terminal_source=$(receipt_field "$pending" terminal_source) || return 1
+  terminal_snapshot=$(receipt_field "$pending" terminal_snapshot) || return 1
+  kind=$(receipt_field "$pending" kind) || return 1
+  serialized_fp=$(receipt_field "$pending" fingerprint) || return 1
+  parent_task_id=$(receipt_field "$pending" parent_task_id 2>/dev/null || true)
+  parent_home=$(receipt_field "$pending" parent_home 2>/dev/null || true)
+  parent_status=$(receipt_field "$pending" parent_status 2>/dev/null || true)
+  parent_corr=$(receipt_field "$pending" parent_corr 2>/dev/null || true)
+  [ "$schema" = fm-jt-terminal-outcome.v1 ] || return 1
+  [ -n "$task_id" ] && [ -n "$incarnation" ] && [ -n "$terminal_source" ] \
+    && [ -n "$terminal_snapshot" ] || return 1
+  case "$incarnation" in ''|*[!A-Za-z0-9._:-]*) return 1 ;; esac
+  case "$terminal_source" in
+    run-step|pane) ;;
+    *) return 1 ;;
+  esac
+  valid_task_id "$task_id" || return 1
+  case "$outcome" in done|failed) ;; *) return 1 ;; esac
+  case "$kind" in ship|scout)
+    [ -z "$parent_task_id" ] && [ -z "$parent_home" ] \
+      && [ -z "$parent_status" ] && [ -z "$parent_corr" ] || return 1
+    ;;
+    secondmate)
+      [ -n "$parent_task_id" ] && [ -n "$parent_home" ] && [ -n "$parent_status" ] || return 1
+      printf '%s' "$parent_corr" | grep -Eq '^[A-Fa-f0-9]{16}$' || return 1
+      ;;
+    *) return 1 ;;
+  esac
+  expected_fp=$(terminal_outcome_fingerprint "$task_id" "$incarnation" "$outcome" \
+    "$terminal_snapshot" "$kind" "$parent_corr" "$terminal_source") || return 1
+  [ "$serialized_fp" = "$FP" ] || return 1
+  [ "$expected_fp" = "$FP" ] || return 1
+  if [ "$terminal_source" = run-step ] \
+    && ! run_step_incarnation_evidence_valid "$task_id" "$incarnation" "$outcome" "$terminal_snapshot"; then
+    return 1
+  fi
+  ID=$task_id
+  INC=$incarnation
+  OUTCOME=$outcome
+  SOURCE=$terminal_source
+  SNAPSHOT=$terminal_snapshot
+  KIND=$kind
+  return 0
+}
+
+parent_status_line_status() {
+  local parent_status=$1 wanted=$2 scan_secs now_ms deadline_ms status
+  [ -f "$parent_status" ] && [ ! -L "$parent_status" ] || return 2
+  scan_secs=$(bounded_secs "${FM_INACTIVE_OUTCOME_PARENT_STATUS_SCAN_SECS:-1}" 1 1 60)
+  deadline_ms=${FM_INACTIVE_OUTCOME_SCAN_DEADLINE_MS:-}
+  case "$deadline_ms" in
+    ''|*[!0-9]*) ;;
+    *)
+      now_ms=$(clock_millis)
+      [ "$deadline_ms" -gt "$now_ms" ] || return 124
+      [ "$((deadline_ms - now_ms))" -ge 1000 ] || return 124
+      scan_secs=$(((deadline_ms - now_ms) / 1000))
+      scan_secs=$(bounded_secs "$scan_secs" 1 1 60)
+      ;;
+  esac
+  run_bounded_child "$scan_secs" grep -Fqx -- "$wanted" "$parent_status"
+  status=$?
+  case "$status" in
+    0|1|124) return "$status" ;;
+    *) return 2 ;;
+  esac
+}
+
+parent_status_append_line() {
+  local parent_status=$1 line=$2
+  command -v perl >/dev/null 2>&1 || return 1
+  printf '%s\n' "$line" | perl -e '
+    use Fcntl qw(:DEFAULT);
+    my ($parent_status) = @ARGV;
+    my $nofollow = eval { O_NOFOLLOW() };
+    defined($nofollow) or exit 1;
+    my $fh;
+    sysopen($fh, $parent_status, O_WRONLY | O_APPEND | O_CREAT | $nofollow, 0600) or exit 1;
+    binmode($fh);
+    local $/;
+    my $line = <STDIN> // "";
+    print($fh $line) or exit 1;
+    close($fh) or exit 1;
+  ' "$parent_status"
+}
+
+pending_secondmate_report_recorded() {
+  local fp=$1 pending kind task_id outcome parent_task_id parent_home parent_status parent_corr line status
+  local route_lock route_status=0
+  pending=$(receipt_path "$fp" pending)
+  kind=$(receipt_field "$pending" kind) || return 2
+  case "$kind" in
+    ship|scout) return 1 ;;
+    secondmate) ;;
+    *) return 2 ;;
+  esac
+  prepare_pending_receipt "$pending" || return 2
+  task_id=$(receipt_field "$pending" task_id) || return 2
+  outcome=$(receipt_field "$pending" outcome) || return 2
+  parent_task_id=$(receipt_field "$pending" parent_task_id) || return 2
+  parent_home=$(receipt_field "$pending" parent_home) || return 2
+  parent_status=$(receipt_field "$pending" parent_status) || return 2
+  parent_corr=$(receipt_field "$pending" parent_corr) || return 2
+  route_lock=$(fm_pending_reply_secondmate_route_lock_path "$FM_HOME")
+  fm_lock_acquire_wait "$route_lock" || return 2
+  if ! fm_pending_reply_secondmate_route_validate "$FM_HOME" "$parent_corr" 2 \
+    || [ "$FM_PENDING_ROUTE_SECOND_MATE_ID" != "$parent_task_id" ] \
+    || [ "$FM_PENDING_ROUTE_PARENT_HOME" != "$parent_home" ] \
+    || [ "$FM_PENDING_ROUTE_PARENT_STATUS" != "$parent_status" ] \
+    || [ "$FM_PENDING_ROUTE_CORR" != "$parent_corr" ]; then
+    route_status=2
+  fi
+  fm_lock_release "$route_lock" || route_status=2
+  [ "$route_status" = 0 ] || return "$route_status"
+  [ -f "$parent_status" ] && [ ! -L "$parent_status" ] || return 1
+  line="$outcome [corr=$parent_corr]: inactive terminal outcome replayed: task=$task_id fingerprint=$fp"
+  parent_status_line_status "$parent_status" "$line"
+  status=$?
+  case "$status" in
+    0) return 0 ;;
+    1) return 1 ;;
+    *) return 2 ;;
+  esac
+}
+
+reported_secondmate_receipt_valid() {
+  local reported=$1 parent_task_id parent_home parent_status parent_corr
+  prepare_pending_receipt "$reported" || return 1
+  [ "$KIND" = secondmate ] || return 1
+  parent_task_id=$(receipt_field "$reported" parent_task_id) || return 1
+  parent_home=$(receipt_field "$reported" parent_home) || return 1
+  parent_status=$(receipt_field "$reported" parent_status) || return 1
+  parent_corr=$(receipt_field "$reported" parent_corr) || return 1
+  [ -n "$parent_task_id" ] && [ -n "$parent_home" ] && [ -n "$parent_status" ] || return 1
+  printf '%s' "$parent_corr" | grep -Eq '^[A-Fa-f0-9]{16}$'
+}
+
+inactive_directory_candidates() {
+  local directory=$1 suffix=$2 seconds=${3:-1} cursor=${4:-} cursor_path=${5:-}
+  local stage_path='' source_dir='' source_key='' source_path='' source_partial='' source_cookie=''
+  local source_complete='' source_stamp='' metadata_boundary='' legacy_stage='' path
+  [ -d "$directory" ] && [ ! -L "$directory" ] || return 0
+  case "$seconds" in ''|*[!0-9]*|0) return 0 ;; esac
+  case "$cursor" in ''|0) cursor=;; *[!0-9]*) return 1 ;; esac
+  [ -z "$cursor_path" ] || { [ ! -L "$cursor_path" ] || return 1; }
+  if [ -n "$cursor_path" ]; then
+    source_dir="$(dirname "$cursor_path")/.inactive-outcome-enum"
+    if [ -e "$source_dir" ] || [ -L "$source_dir" ]; then
+      [ -d "$source_dir" ] && [ ! -L "$source_dir" ] || return 1
+    else
+      mkdir "$source_dir" || return 1
+    fi
+    source_key=$(basename "$cursor_path")
+    case "$source_key" in ''|*[!A-Za-z0-9._-]*) return 1 ;; esac
+    stage_path="$source_dir/$source_key.stage"
+    legacy_stage="$cursor_path.stage"
+    [ ! -L "$stage_path" ] && [ ! -L "$legacy_stage" ] || return 1
+    if [ -e "$legacy_stage" ]; then
+      [ -f "$legacy_stage" ] && [ ! -e "$stage_path" ] || return 1
+      mv "$legacy_stage" "$stage_path" || return 1
+    fi
+    source_path="$source_dir/$source_key.source"
+    source_partial="$source_path.partial"
+    source_cookie="$source_path.cookie"
+    source_complete="$source_path.complete"
+    source_stamp="$source_path.stamp"
+    for path in "$source_path" "$source_partial" "$source_cookie" \
+      "$source_complete" "$source_stamp"; do
+      [ ! -L "$path" ] || return 1
+    done
+    if [ "$directory" = "$STATE" ]; then
+      metadata_boundary=$(fm_pane_idle_meta_freshness_path "$STATE")
+      boundary_dir=$(dirname "$metadata_boundary")
+      if [ -e "$boundary_dir" ] || [ -L "$boundary_dir" ]; then
+        [ -d "$boundary_dir" ] && [ ! -L "$boundary_dir" ] || return 1
+      else
+        mkdir "$boundary_dir" || return 1
+      fi
+      [ ! -L "$metadata_boundary" ] || return 1
+    fi
+  fi
+  if command -v perl >/dev/null 2>&1; then
+    run_bounded_child "$seconds" perl - "$directory" "$suffix" "$cursor" "$stage_path" \
+      "$source_path" "$source_partial" "$source_cookie" "$source_complete" \
+      "$source_stamp" "$metadata_boundary" <<'PERL'
+use strict;
+use warnings;
+use Fcntl qw(:DEFAULT);
+use Digest::SHA qw(sha256_hex);
+use Time::HiRes qw(stat);
+my ($dir, $suffix, $cursor, $stage_path) = @ARGV[0..3];
+my ($source_path, $source_partial, $source_cookie, $source_complete, $source_stamp) = @ARGV[4..8];
+my $metadata_boundary = $ARGV[9] // '';
+my $nofollow = eval { Fcntl::O_NOFOLLOW() };
+defined($nofollow) or exit 1;
+sub atomic_write {
+  my ($path, $value) = @_;
+  return 0 if $path eq '' || -l $path;
+  my $tmp = "$path.tmp.$$";
+  my $fh;
+  sysopen($fh, $tmp, O_WRONLY | O_CREAT | O_EXCL | $nofollow, 0600) or return 0;
+  binmode($fh);
+  if (!print($fh $value) || !close($fh)) {
+    unlink($tmp);
+    return 0;
+  }
+  if (!rename($tmp, $path)) {
+    unlink($tmp);
+    return 0;
+  }
+  return 1;
+}
+sub open_append {
+  my ($path) = @_;
+  return undef if -l $path;
+  my $flags = O_WRONLY | O_APPEND;
+  if (-e $path) {
+    return undef unless -f $path;
+    $flags |= $nofollow;
+  } else {
+    $flags |= O_CREAT | O_EXCL;
+  }
+  my $fh;
+  sysopen($fh, $path, $flags, 0600) or return undef;
+  return $fh;
+}
+sub directory_stamp {
+  if ($metadata_boundary ne '' && -f $metadata_boundary && !-l $metadata_boundary) {
+    open(my $bfh, '<', $metadata_boundary) or return undef;
+    local $/;
+    my $value = <$bfh> // '';
+    close($bfh) or return undef;
+    chomp $value;
+    return $value if $value =~ /\A[A-Za-z0-9._-]+\z/;
+  }
+  my @info = stat($dir) or return undef;
+  return sha256_hex(join("\0", @info[0, 1, 2, 7, 9, 10, 11]));
+}
+sub read_text {
+  my ($path) = @_;
+  return '' unless $path ne '' && -e $path;
+  return undef if -l $path || !-f $path;
+  open(my $fh, '<', $path) or return undef;
+  local $/;
+  my $value = <$fh> // '';
+  close($fh) or return undef;
+  chomp $value;
+  return $value;
+}
+my $start = directory_stamp();
+defined($start) or exit 1;
+if ($source_path ne '') {
+  my $saved = read_text($source_stamp);
+  defined($saved) or exit 1 if -e $source_stamp;
+  if (!defined($saved) || $saved ne $start) {
+    unlink($source_path, $source_partial, $source_cookie, $source_complete);
+    atomic_write($source_stamp, "$start\n") or exit 1;
+  }
+  my $done = -e $source_complete;
+  if (!$done) {
+    my $cookie = read_text($source_cookie);
+    defined($cookie) or exit 1 if -e $source_cookie;
+    $cookie = '' unless defined($cookie) && ($cookie eq 'EOF' || $cookie =~ /^\d+\z/);
+    if ($cookie ne 'EOF') {
+      my $pfh = open_append($source_partial) or exit 1;
+      select((select($pfh), $| = 1)[0]);
+      opendir(my $dh, $dir) or exit 1;
+      seekdir($dh, 0 + $cookie) or exit 1 if $cookie ne '';
+      while (defined(my $entry = readdir($dh))) {
+        my $next = telldir($dh);
+        defined($next) or exit 1;
+        if ($entry =~ /\.\Q$suffix\E\z/ && $entry !~ /[\r\n\t]/) {
+          my $path = "$dir/$entry";
+          if (-f $path && !-l $path) {
+            print($pfh $path, "\n") or exit 1;
+          }
+        }
+        atomic_write($source_cookie, "$next\n") or exit 1;
+      }
+      closedir($dh) or exit 1;
+      close($pfh) or exit 1;
+      atomic_write($source_cookie, "EOF\n") or exit 1;
+    }
+    my $finish = directory_stamp();
+    defined($finish) or exit 1;
+    if ($finish ne $start) {
+      unlink($source_path, $source_partial, $source_cookie, $source_complete);
+      atomic_write($source_stamp, "$finish\n") or exit 1;
+      exit 75;
+    }
+    if ($metadata_boundary ne '' && !-e $metadata_boundary) {
+      atomic_write($metadata_boundary, "$finish\n") or exit 1;
+    }
+    open(my $pfh, '<', $source_partial) or exit 1;
+    my %seen;
+    my @paths;
+    while (defined(my $path = <$pfh>)) {
+      chomp $path;
+      next unless $path =~ /\A\Q$dir\E\/[^\/\r\n]+\.\Q$suffix\E\z/;
+      next unless -f $path && !-l $path;
+      next if $seen{$path}++;
+      push @paths, $path;
+    }
+    close($pfh) or exit 1;
+    @paths = sort @paths;
+    atomic_write($source_path, join('', map { "$_\n" } @paths)) or exit 1;
+    atomic_write($source_complete, "complete\n") or exit 1;
+    unlink($source_partial, $source_cookie) or exit 1;
+  }
+  open(my $sfh, '<', $source_path) or exit 1;
+  my @paths;
+  while (defined(my $path = <$sfh>)) {
+    chomp $path;
+    push @paths, $path if $path =~ /\A\Q$dir\E\/[^\/\r\n]+\.\Q$suffix\E\z/;
+  }
+  close($sfh) or exit 1;
+  my $index = $cursor eq '' ? 0 : 0 + $cursor;
+  while ($index < @paths) {
+    my $path = $paths[$index];
+    print "$path\0" if -f $path && !-l $path;
+    $index++;
+    atomic_write($stage_path, "$index\n") or exit 1 if $stage_path ne '';
+  }
+  atomic_write($stage_path, "EOF\n") or exit 1 if $stage_path ne '';
+} else {
+  opendir(my $dh, $dir) or exit 1;
+  while (defined(my $entry = readdir($dh))) {
+    next unless $entry =~ /\.\Q$suffix\E\z/ && $entry !~ /[\r\n\t]/;
+    my $path = "$dir/$entry";
+    print "$path\0" if -f $path && !-l $path;
+  }
+  closedir($dh) or exit 1;
+}
+PERL
+    rc=$?
+    [ "$rc" = 75 ] && return 124
+    return "$rc"
+  else
+    return 124
+  fi
+}
+
+inactive_enum_cursor_promote() {
+  local path=$1 stage value progress_dir
+  progress_dir="$(dirname "$path")/.inactive-outcome-enum"
+  stage="$progress_dir/$(basename "$path").stage"
+  [ ! -L "$path" ] && [ ! -L "$stage" ] || return 1
+  [ -e "$stage" ] || return 0
+  value=$(inactive_text_cursor_read "$stage") || return 1
+  inactive_text_cursor_write "$path" "$value" || return 1
+  rm -f "$stage" || return 1
+}
+
+inactive_enum_cursor_discard() {
+  local path=$1 stage legacy_stage progress_dir
+  progress_dir="$(dirname "$path")/.inactive-outcome-enum"
+  stage="$progress_dir/$(basename "$path").stage"
+  legacy_stage="$path.stage"
+  [ ! -L "$stage" ] && [ ! -L "$legacy_stage" ] || return 1
+  rm -f "$stage" "$legacy_stage"
+}
+
+receipt_candidates() {
+  local suffix=$1 seconds=${2:-1} cursor=${3:-} cursor_path=${4:-}
+  inactive_directory_candidates "$OUTCOME_DIR" "$suffix" "$seconds" "$cursor" "$cursor_path"
+}
+
+inactive_find_candidates() {
+  local seconds=$1 cursor=${2:-} cursor_path=${3:-}
+  inactive_directory_candidates "$STATE" "meta" "$seconds" "$cursor" "$cursor_path"
+}
+
+repair_reported_secondmate_routes() {
+  local scan_deadline=$1 reported kind corr parent_task_id parent_home parent_status remaining status=0
+  local cursor='' cursor_found=0 started=1 pass base last processed=0 cursor_tmp candidate_tmp enum_rc enum_deferred=0
+  local enum_cursor='' enum_incomplete=0 enum_source_drained=0 enum_complete=0 enum_persisted=0
+  local candidate_pending=0 candidate_retain=0 item_status batch_consumed=0 batch_complete=1 retry_path=
+  local candidate_pending_offset=0 pending_skip=0 candidate_tmp_owned=0
+  MAINTENANCE_ENUM_DEFERRED=0
+  MAINTENANCE_ENUM_FAILED=0
+  MAINTENANCE_DEADLINE_EXPIRED=0
+  MAINTENANCE_RETRYABLE=0
+  MAINTENANCE_ITEMS_PROCESSED=0
+  [ -d "$OUTCOME_DIR" ] && [ ! -L "$OUTCOME_DIR" ] || return 0
+  if [ -e "$REPORTED_ROUTE_ENUM_CURSOR" ] || [ -L "$REPORTED_ROUTE_ENUM_CURSOR" ]; then
+    [ -f "$REPORTED_ROUTE_ENUM_CURSOR" ] && [ ! -L "$REPORTED_ROUTE_ENUM_CURSOR" ] || return 1
+    enum_incomplete=1
+    enum_cursor=$(inactive_text_cursor_read "$REPORTED_ROUTE_ENUM_CURSOR") || return 1
+    case "$enum_cursor" in
+      ''|0) enum_cursor=;;
+      *[!0-9]*) enum_cursor=;;
+    esac
+  fi
+  remaining=$(budget_remaining_secs "$scan_deadline")
+  if [ "$remaining" -le 0 ]; then
+    MAINTENANCE_DEADLINE_EXPIRED=1
+    return 1
+  fi
+  if [ ! -e "$REPORTED_ROUTE_PENDING" ] && [ ! -L "$REPORTED_ROUTE_PENDING" ] \
+    && inactive_pending_retry_exists "$REPORTED_ROUTE_RETRY"; then
+    inactive_pending_retry_restore "$REPORTED_ROUTE_RETRY" "$REPORTED_ROUTE_PENDING" || return 1
+    inactive_pending_offset_write "$REPORTED_ROUTE_OFFSET" 0 || return 1
+  fi
+  if [ -e "$REPORTED_ROUTE_PENDING" ] || [ -L "$REPORTED_ROUTE_PENDING" ]; then
+    [ -f "$REPORTED_ROUTE_PENDING" ] && [ ! -L "$REPORTED_ROUTE_PENDING" ] || {
+      return 1
+    }
+    if [ -s "$REPORTED_ROUTE_PENDING" ]; then
+      inactive_pending_merge_retry "$REPORTED_ROUTE_PENDING" "$REPORTED_ROUTE_RETRY" "$scan_deadline"
+      enum_rc=$?
+      case "$enum_rc" in
+        0) ;;
+        124)
+          MAINTENANCE_DEADLINE_EXPIRED=1
+          status=1
+          enum_deferred=1
+          batch_complete=0
+          candidate_retain=1
+          ;;
+        *) return 1 ;;
+      esac
+      candidate_tmp="$REPORTED_ROUTE_PENDING"
+      candidate_pending_offset=$(inactive_pending_offset "$REPORTED_ROUTE_OFFSET") || {
+        return 1
+      }
+      pending_skip=$candidate_pending_offset
+      candidate_pending=1
+      candidate_retain=1
+    else
+      inactive_pending_clear "$REPORTED_ROUTE_PENDING" "$REPORTED_ROUTE_OFFSET" || return 1
+    fi
+  fi
+  if [ "$candidate_pending" = 0 ]; then
+    candidate_tmp=$(mktemp "$STATE/.inactive-outcome-candidates.XXXXXX") || return 1
+    [ -f "$candidate_tmp" ] && [ ! -L "$candidate_tmp" ] || {
+      rm -f "$candidate_tmp"
+      return 1
+    }
+    candidate_tmp_owned=1
+  fi
+  cursor=$(cat "$REPORTED_ROUTE_CURSOR" 2>/dev/null || true)
+  case "$cursor" in
+    '') ;;
+    *.reported) case "$cursor" in *[!A-Za-z0-9._-]*) cursor=;; esac ;;
+    *) cursor=;;
+  esac
+  if [ -n "$cursor" ] && { [ ! -f "$OUTCOME_DIR/$cursor" ] || [ -L "$OUTCOME_DIR/$cursor" ]; }; then
+    cursor=
+  fi
+  if [ "$candidate_pending" = 1 ]; then
+    cursor=
+    cursor_found=1
+    started=1
+  else
+    [ -n "$cursor" ] && started=0
+  fi
+  for pass in 1 2; do
+    [ "$candidate_pending" = 0 ] || [ "$pass" = 1 ] || break
+    if [ "$pass" = 2 ]; then
+      [ -n "$cursor" ] || break
+      started=1
+    fi
+    remaining=$(budget_remaining_secs "$scan_deadline")
+    if [ "$remaining" -le 0 ]; then
+      MAINTENANCE_DEADLINE_EXPIRED=1
+      status=1
+      break
+    fi
+    batch_consumed=0
+    [ "$candidate_pending" = 1 ] && batch_consumed=$candidate_pending_offset
+    batch_complete=1
+    [ "$enum_deferred" = 0 ] || batch_complete=0
+    enum_rc=0
+    if [ "$candidate_pending" = 1 ]; then
+      :
+    else
+      receipt_candidates reported "$remaining" "$enum_cursor" "$REPORTED_ROUTE_ENUM_CURSOR" \
+        | fm_nofollow_write "$candidate_tmp" || enum_rc=$?
+      if [ "$enum_rc" = 0 ]; then
+        enum_complete=1
+        enum_incomplete=0
+      elif [ "$enum_rc" = 124 ]; then
+        enum_incomplete=1
+      fi
+    fi
+    if [ "$enum_rc" -ne 0 ]; then
+      if [ "$enum_rc" != 124 ]; then
+        inactive_enum_cursor_discard "$REPORTED_ROUTE_ENUM_CURSOR" || return 1
+      fi
+      status=1
+      if [ "$enum_rc" = 124 ]; then
+        MAINTENANCE_ENUM_DEFERRED=1
+        enum_deferred=1
+        batch_complete=0
+      else
+        MAINTENANCE_ENUM_FAILED=1
+      fi
+    fi
+    while [ "$MAINTENANCE_ENUM_FAILED" = 0 ] && IFS= read -r -d '' reported; do
+      if [ "$pending_skip" -gt 0 ]; then
+        remaining=$(budget_remaining_secs "$scan_deadline")
+        if [ "$remaining" -le 0 ]; then
+          MAINTENANCE_DEADLINE_EXPIRED=1
+          status=1
+          batch_complete=0
+          break 2
+        fi
+        pending_skip=$((pending_skip - 1))
+        continue
+      fi
+      case "$reported" in
+        "$OUTCOME_DIR"/*/*)
+          batch_consumed=$((batch_consumed + 1))
+          continue
+          ;;
+      esac
+      base=${reported##*/}
+      if [ "$pass" = 1 ] && [ -n "$cursor" ] && [ "$started" = 0 ]; then
+        batch_consumed=$((batch_consumed + 1))
+        if [ "$base" = "$cursor" ]; then
+          started=1
+          cursor_found=1
+        fi
+        continue
+      fi
+      if [ "$pass" = 2 ] && [ "$processed" -gt 0 ] && [ -n "$cursor" ] \
+        && [ "$cursor_found" = 1 ] && [ "$base" = "$cursor" ]; then
+        break
+      fi
+      remaining=$(budget_remaining_secs "$scan_deadline")
+      if [ "$remaining" -le 0 ]; then
+        MAINTENANCE_DEADLINE_EXPIRED=1
+        status=1
+        batch_complete=0
+        break 2
+      fi
+      batch_consumed=$((batch_consumed + 1))
+      if [ ! -e "$reported" ] && [ ! -L "$reported" ]; then
+        last=$base
+        processed=$((processed + 1))
+        if [ "$processed" -ge "$REPORTED_ROUTE_REPAIR_LIMIT" ]; then
+          batch_complete=0
+          break 2
+        fi
+        continue
+      fi
+      if [ ! -e "$reported" ] && [ ! -L "$reported" ]; then
+        last=$base
+        processed=$((processed + 1))
+        if [ "$processed" -ge "$REPORTED_ROUTE_REPAIR_LIMIT" ]; then
+          batch_complete=0
+          break 2
+        fi
+        continue
+      fi
+      [ -f "$reported" ] && [ ! -L "$reported" ] || {
+        status=1
+        candidate_retain=1
+        batch_consumed=$((batch_consumed - 1))
+        batch_complete=0
+        MAINTENANCE_ENUM_FAILED=1
+        break 2
+      }
+      kind=$(receipt_field "$reported" kind 2>/dev/null || true)
+      if [ ! -e "$reported" ] && [ ! -L "$reported" ]; then
+        last=$base
+        processed=$((processed + 1))
+        if [ "$processed" -ge "$REPORTED_ROUTE_REPAIR_LIMIT" ]; then
+          batch_complete=0
+          break 2
+        fi
+        continue
+      fi
+      item_status=0
+      case "$kind" in
+        ship|scout) : ;;
+        secondmate)
+          if ! reported_secondmate_receipt_valid "$reported"; then
+            if [ ! -e "$reported" ] && [ ! -L "$reported" ]; then
+              item_status=0
+            else
+              item_status=1
+            fi
+          else
+            corr=$(receipt_field "$reported" parent_corr)
+            parent_task_id=$(receipt_field "$reported" parent_task_id)
+            parent_home=$(receipt_field "$reported" parent_home)
+            parent_status=$(receipt_field "$reported" parent_status)
+            if [ ! -e "$reported" ] && [ ! -L "$reported" ]; then
+              item_status=0
+            else
+              FM_LOCK_WAIT_SECS="$remaining" fm_pending_reply_secondmate_route_clear_reported \
+                "$FM_HOME" "$corr" "$parent_task_id" "$parent_home" "$parent_status" || item_status=$?
+            fi
+          fi
+          ;;
+        *) item_status=1 ;;
+      esac
+      if [ "$item_status" != 0 ]; then
+        status=1
+        [ "$item_status" = 75 ] && MAINTENANCE_RETRYABLE=1
+        candidate_retain=1
+        if [ -z "$retry_path" ]; then
+          retry_path=$REPORTED_ROUTE_RETRY
+          if ! inactive_retry_file_prepare "$retry_path"; then
+            batch_consumed=$((batch_consumed - 1))
+            batch_complete=0
+            MAINTENANCE_ENUM_FAILED=1
+            break 2
+          fi
+        fi
+        inactive_append_nul_value "$retry_path" "$reported" "$maintenance_deadline"
+        append_rc=$?
+        if [ "$append_rc" -ne 0 ]; then
+          batch_consumed=$((batch_consumed - 1))
+          batch_complete=0
+          if [ "$append_rc" = 124 ]; then
+            MAINTENANCE_DEADLINE_EXPIRED=1
+          else
+            MAINTENANCE_ENUM_FAILED=1
+          fi
+          break 2
+        fi
+        continue
+      fi
+      last=$base
+      processed=$((processed + 1))
+      if [ "$processed" -ge "$REPORTED_ROUTE_REPAIR_LIMIT" ]; then
+        batch_complete=0
+        break 2
+      fi
+    done < "$candidate_tmp"
+    [ "$enum_deferred" = 0 ] || break
+  done
+  if [ "$candidate_pending" = 1 ] && [ "$batch_complete" = 1 ] \
+    && [ "$MAINTENANCE_ENUM_FAILED" = 0 ] && [ "$enum_deferred" = 0 ] \
+    && [ "$enum_incomplete" = 1 ]; then
+    inactive_pending_clear "$REPORTED_ROUTE_PENDING" "$REPORTED_ROUTE_OFFSET" || status=1
+    MAINTENANCE_ENUM_DEFERRED=1
+    enum_deferred=1
+    enum_source_drained=1
+    status=1
+  fi
+  if [ "$enum_source_drained" = 1 ]; then
+    :
+  elif [ "$candidate_pending" = 1 ] && [ "$batch_complete" = 1 ] \
+    && [ "$MAINTENANCE_ENUM_FAILED" = 0 ] && [ "$enum_deferred" = 0 ]; then
+    inactive_pending_clear "$REPORTED_ROUTE_PENDING" "$REPORTED_ROUTE_OFFSET" || status=1
+  elif [ "$enum_deferred" = 1 ] || [ "$candidate_retain" = 1 ] || [ "$candidate_pending" = 1 ]; then
+    if inactive_persist_nul_suffix "$candidate_tmp" "$REPORTED_ROUTE_PENDING" "$batch_consumed" "" "$scan_deadline"; then
+      enum_persisted=1
+    else
+      enum_rc=$?
+      if [ "$enum_rc" = 124 ]; then
+        MAINTENANCE_DEADLINE_EXPIRED=1
+      else
+        status=1
+      fi
+    fi
+  fi
+  if [ "$MAINTENANCE_ENUM_FAILED" = 0 ] && {
+    [ "$enum_persisted" = 1 ] || {
+      [ "$enum_complete" = 1 ] && [ "$candidate_retain" = 0 ]
+    }
+  }; then
+    inactive_enum_cursor_promote "$REPORTED_ROUTE_ENUM_CURSOR" || status=1
+    [ "$status" = 0 ] && rm -f "$REPORTED_ROUTE_ENUM_CURSOR" || true
+  else
+    inactive_enum_cursor_discard "$REPORTED_ROUTE_ENUM_CURSOR" || status=1
+  fi
+  if [ "$candidate_tmp_owned" = 1 ]; then
+    rm -f "$candidate_tmp" || status=1
+  fi
+  if [ "$processed" -gt 0 ]; then
+    if cursor_tmp=$(mktemp "$STATE/.reported-route-repair.cursor.XXXXXX"); then
+      if [ ! -f "$cursor_tmp" ] || [ -L "$cursor_tmp" ] \
+        || ! printf '%s\n' "$last" | fm_nofollow_write "$cursor_tmp" \
+        || ! fm_nofollow_rename "$cursor_tmp" "$REPORTED_ROUTE_CURSOR"; then
+        status=1
+        rm -f "$cursor_tmp"
+      fi
+    else
+      status=1
+    fi
+  fi
+  MAINTENANCE_ITEMS_PROCESSED=$processed
+  return "$status"
+}
+
+republish_pending_receipt() {
+  local pending=$1 task_lock meta window backend current_incarnation current_kind status=0 rc
+  local deadline_ms=${FM_INACTIVE_OUTCOME_SCAN_DEADLINE_MS:-} now_ms remaining_ms wait_secs
+  FM_WAKE_APPEND_CREATED=0
+  case "$deadline_ms" in ''|*[!0-9]*) deadline_ms=;; esac
+  if ! prepare_pending_receipt "$pending"; then
+    [ ! -e "$pending" ] && [ ! -L "$pending" ] && return 0
+    return 1
+  fi
+  case "$KIND" in ship|scout|secondmate) ;; *) return 1 ;; esac
+  meta="$STATE/$ID.meta"
+  [ -f "$meta" ] && [ ! -L "$meta" ] || return 75
+  herdr_identity_allowed "$meta" || return 75
+  task_lock="$STATE/.spawn-$ID.lock"
+  FM_LOCK_WAIT_SECS="${FM_LOCK_WAIT_SECS:-30}" fm_lock_acquire_wait "$task_lock" || return 75
+  if [ ! -f "$meta" ] || [ -L "$meta" ] \
+    || ! herdr_identity_allowed "$meta"; then
+    status=75
+  else
+    if current_kind=$(meta_value_unique "$meta" kind 2>/dev/null); then
+      :
+    else
+      rc=$?
+      [ "$rc" = 1 ] || status=75
+      current_kind=ship
+    fi
+    if [ "$status" = 0 ]; then
+      case "$KIND:$current_kind" in
+        ship:ship|scout:scout|secondmate:ship|secondmate:scout) : ;;
+        *) status=75 ;;
+      esac
+    fi
+  fi
+  if [ "$status" = 0 ] && current_incarnation=$(read_incarnation "$meta" "$ID" 2>/dev/null); then
+    [ "$current_incarnation" = "$INC" ] || status=75
+    if [ "$status" = 0 ]; then
+      window=$(meta_value_unique "$meta" window 2>/dev/null) || status=75
+      if backend=$(meta_value_unique "$meta" backend 2>/dev/null); then
+        case "$backend" in tmux|herdr) ;; *) status=75 ;; esac
+      else
+        rc=$?
+        [ "$rc" = 1 ] && backend=tmux || status=75
+      fi
+    fi
+    if [ "$status" = 0 ]; then
+      if [ -n "$deadline_ms" ]; then
+        now_ms=$(clock_millis)
+        remaining_ms=$((deadline_ms - now_ms))
+        [ "$remaining_ms" -gt 0 ] || status=75
+        wait_secs=$((remaining_ms / 1000))
+      else
+        wait_secs=${FM_LOCK_WAIT_SECS:-30}
+      fi
+      if [ "$status" = 0 ]; then
+        if [ "$KIND" = secondmate ]; then
+          FM_LOCK_WAIT_SECS="$wait_secs" publish_secondmate_receipt_and_wake \
+            "$meta" "$ID" "$window" "$backend" "$current_incarnation" "$SOURCE" || status=$?
+        else
+          FM_LOCK_WAIT_SECS="$wait_secs" republish_existing_receipt_wake \
+            "$meta" "$ID" "$window" "$backend" "$current_incarnation" "$SOURCE" || status=$?
+        fi
+      fi
+    fi
+  else
+    status=75
+  fi
+  fm_lock_release "$task_lock" || status=1
+  return "$status"
+}
+
+republish_pending_receipts() {
+  local scan_deadline=$1 pending remaining status=0
+  local cursor='' cursor_found=0 pass started=1
+  local base last='' processed=0 cursor_tmp candidate_tmp enum_rc enum_deferred=0
+  local enum_cursor='' enum_incomplete=0 enum_source_drained=0 enum_complete=0 enum_persisted=0
+  local candidate_pending=0 candidate_retain=0 batch_consumed=0 batch_complete=1 retry_path=
+  local candidate_pending_offset=0 pending_skip=0 candidate_tmp_owned=0
+  local LC_ALL=C
+  MAINTENANCE_ENUM_DEFERRED=0
+  MAINTENANCE_ENUM_FAILED=0
+  MAINTENANCE_RETRYABLE=0
+  MAINTENANCE_DEADLINE_EXPIRED=0
+  MAINTENANCE_ITEMS_PROCESSED=0
+  [ -d "$OUTCOME_DIR" ] && [ ! -L "$OUTCOME_DIR" ] || return 0
+  if [ -e "$PENDING_RECEIPT_ENUM_CURSOR" ] || [ -L "$PENDING_RECEIPT_ENUM_CURSOR" ]; then
+    [ -f "$PENDING_RECEIPT_ENUM_CURSOR" ] && [ ! -L "$PENDING_RECEIPT_ENUM_CURSOR" ] || return 1
+    enum_incomplete=1
+    enum_cursor=$(inactive_text_cursor_read "$PENDING_RECEIPT_ENUM_CURSOR") || return 1
+    case "$enum_cursor" in
+      ''|0) enum_cursor=;;
+      *[!0-9]*) enum_cursor=;;
+    esac
+  fi
+  if [ ! -e "$PENDING_RECEIPT_PENDING" ] && [ ! -L "$PENDING_RECEIPT_PENDING" ] \
+    && inactive_pending_retry_exists "$PENDING_RECEIPT_RETRY"; then
+    inactive_pending_retry_restore "$PENDING_RECEIPT_RETRY" "$PENDING_RECEIPT_PENDING" || return 1
+    inactive_pending_offset_write "$PENDING_RECEIPT_OFFSET" 0 || return 1
+  fi
+  if [ -e "$PENDING_RECEIPT_PENDING" ] || [ -L "$PENDING_RECEIPT_PENDING" ]; then
+    [ -f "$PENDING_RECEIPT_PENDING" ] && [ ! -L "$PENDING_RECEIPT_PENDING" ] || {
+      return 1
+    }
+    if [ -s "$PENDING_RECEIPT_PENDING" ]; then
+      inactive_pending_merge_retry "$PENDING_RECEIPT_PENDING" "$PENDING_RECEIPT_RETRY" "$scan_deadline"
+      enum_rc=$?
+      case "$enum_rc" in
+        0) ;;
+        124)
+          MAINTENANCE_DEADLINE_EXPIRED=1
+          status=1
+          enum_deferred=1
+          batch_complete=0
+          candidate_retain=1
+          ;;
+        *) return 1 ;;
+      esac
+      candidate_tmp="$PENDING_RECEIPT_PENDING"
+      candidate_pending_offset=$(inactive_pending_offset "$PENDING_RECEIPT_OFFSET") || {
+        return 1
+      }
+      pending_skip=$candidate_pending_offset
+      candidate_pending=1
+      candidate_retain=1
+    else
+      inactive_pending_clear "$PENDING_RECEIPT_PENDING" "$PENDING_RECEIPT_OFFSET" || return 1
+    fi
+  fi
+  if [ "$candidate_pending" = 0 ]; then
+    candidate_tmp=$(mktemp "$STATE/.inactive-outcome-candidates.XXXXXX") || return 1
+    [ -f "$candidate_tmp" ] && [ ! -L "$candidate_tmp" ] || {
+      rm -f "$candidate_tmp"
+      return 1
+    }
+    candidate_tmp_owned=1
+  fi
+  cursor=$(cat "$PENDING_RECEIPT_CURSOR" 2>/dev/null || true)
+  case "$cursor" in
+    '') ;;
+    *.pending)
+      base=${cursor%.pending}
+      case "$base" in ''|*[!A-Fa-f0-9]*) cursor=;; esac
+      ;;
+    *) cursor=;;
+  esac
+  if [ "$candidate_pending" = 1 ]; then
+    cursor=
+    cursor_found=1
+    started=1
+  else
+    [ -n "$cursor" ] && started=0
+  fi
+  for pass in 1 2; do
+    [ "$candidate_pending" = 0 ] || [ "$pass" = 1 ] || break
+    if [ "$pass" = 2 ]; then
+      [ -n "$cursor" ] || break
+      started=1
+    fi
+    remaining=$(budget_remaining_secs "$scan_deadline")
+    if [ "$remaining" -le 0 ]; then
+      MAINTENANCE_DEADLINE_EXPIRED=1
+      status=1
+      break
+    fi
+    batch_consumed=0
+    [ "$candidate_pending" = 1 ] && batch_consumed=$candidate_pending_offset
+    batch_complete=1
+    [ "$enum_deferred" = 0 ] || batch_complete=0
+    enum_rc=0
+    if [ "$candidate_pending" = 1 ]; then
+      :
+    else
+      receipt_candidates pending "$remaining" "$enum_cursor" "$PENDING_RECEIPT_ENUM_CURSOR" \
+        | fm_nofollow_write "$candidate_tmp" || enum_rc=$?
+      if [ "$enum_rc" = 0 ]; then
+        enum_complete=1
+        enum_incomplete=0
+      elif [ "$enum_rc" = 124 ]; then
+        enum_incomplete=1
+      fi
+    fi
+    if [ "$enum_rc" -ne 0 ]; then
+      if [ "$enum_rc" != 124 ]; then
+        inactive_enum_cursor_discard "$PENDING_RECEIPT_ENUM_CURSOR" || return 1
+      fi
+      status=1
+      if [ "$enum_rc" = 124 ]; then
+        MAINTENANCE_ENUM_DEFERRED=1
+        enum_deferred=1
+        batch_complete=0
+      else
+        MAINTENANCE_ENUM_FAILED=1
+      fi
+    fi
+    while [ "$MAINTENANCE_ENUM_FAILED" = 0 ] && IFS= read -r -d '' pending; do
+      if [ "$pending_skip" -gt 0 ]; then
+        remaining=$(budget_remaining_secs "$scan_deadline")
+        if [ "$remaining" -le 0 ]; then
+          MAINTENANCE_DEADLINE_EXPIRED=1
+          status=1
+          batch_complete=0
+          break 2
+        fi
+        pending_skip=$((pending_skip - 1))
+        continue
+      fi
+      case "$pending" in
+        "$OUTCOME_DIR"/*/*)
+          batch_consumed=$((batch_consumed + 1))
+          continue
+          ;;
+      esac
+      base=${pending##*/}
+      if [ "$pass" = 1 ] && [ -n "$cursor" ] && [ "$started" = 0 ]; then
+        batch_consumed=$((batch_consumed + 1))
+        if [ "$base" = "$cursor" ]; then
+          started=1
+          cursor_found=1
+          continue
+        fi
+        continue
+      fi
+      if [ "$pass" = 2 ] && [ "$processed" -gt 0 ] && [ -n "$cursor" ] \
+        && [ "$cursor_found" = 1 ] && [ "$base" = "$cursor" ]; then
+        break
+      fi
+      remaining=$(budget_remaining_secs "$scan_deadline")
+      if [ "$remaining" -le 0 ]; then
+        MAINTENANCE_DEADLINE_EXPIRED=1
+        status=1
+        batch_complete=0
+        break 2
+      fi
+      batch_consumed=$((batch_consumed + 1))
+      if FM_LOCK_WAIT_SECS="$remaining" FM_INACTIVE_OUTCOME_SCAN_DEADLINE_MS="$scan_deadline" \
+        republish_pending_receipt "$pending"; then
+        if [ "$FM_WAKE_APPEND_CREATED" = 1 ]; then
+          printf 'queued inactive outcome: task=%s state=%s fingerprint=%s\n' "$ID" "$OUTCOME" "$FP"
+        fi
+      else
+        enum_rc=$?
+        status=1
+        if [ "$enum_rc" = 75 ]; then
+          MAINTENANCE_RETRYABLE=1
+          candidate_retain=1
+          if [ -z "$retry_path" ]; then
+            retry_path=$PENDING_RECEIPT_RETRY
+            if ! inactive_retry_file_prepare "$retry_path"; then
+              batch_consumed=$((batch_consumed - 1))
+              batch_complete=0
+              MAINTENANCE_ENUM_FAILED=1
+              break 2
+            fi
+          fi
+          inactive_append_nul_value "$retry_path" "$pending" "$maintenance_deadline"
+          append_rc=$?
+          if [ "$append_rc" -ne 0 ]; then
+            batch_consumed=$((batch_consumed - 1))
+            batch_complete=0
+            if [ "$append_rc" = 124 ]; then
+              MAINTENANCE_DEADLINE_EXPIRED=1
+            else
+              MAINTENANCE_ENUM_FAILED=1
+            fi
+            break 2
+          fi
+          continue
+        fi
+        candidate_retain=1
+        batch_consumed=$((batch_consumed - 1))
+        batch_complete=0
+        MAINTENANCE_ENUM_FAILED=1
+        break 2
+      fi
+      last=$base
+      processed=$((processed + 1))
+      if [ "$processed" -ge "$PENDING_RECEIPT_REPUBLISH_LIMIT" ]; then
+        batch_complete=0
+        break 2
+      fi
+    done < "$candidate_tmp"
+    [ "$enum_deferred" = 0 ] || break
+  done
+  if [ "$candidate_pending" = 1 ] && [ "$batch_complete" = 1 ] \
+    && [ "$MAINTENANCE_ENUM_FAILED" = 0 ] && [ "$enum_deferred" = 0 ] \
+    && [ "$enum_incomplete" = 1 ]; then
+    inactive_pending_clear "$PENDING_RECEIPT_PENDING" "$PENDING_RECEIPT_OFFSET" || status=1
+    MAINTENANCE_ENUM_DEFERRED=1
+    enum_deferred=1
+    enum_source_drained=1
+    status=1
+  fi
+  if [ "$enum_source_drained" = 1 ]; then
+    :
+  elif [ "$candidate_pending" = 1 ] && [ "$batch_complete" = 1 ] \
+    && [ "$MAINTENANCE_ENUM_FAILED" = 0 ] && [ "$enum_deferred" = 0 ]; then
+    inactive_pending_clear "$PENDING_RECEIPT_PENDING" "$PENDING_RECEIPT_OFFSET" || status=1
+  elif [ "$enum_deferred" = 1 ] || [ "$candidate_retain" = 1 ] || [ "$candidate_pending" = 1 ]; then
+    if inactive_persist_nul_suffix "$candidate_tmp" "$PENDING_RECEIPT_PENDING" "$batch_consumed" "" "$scan_deadline"; then
+      enum_persisted=1
+    else
+      enum_rc=$?
+      if [ "$enum_rc" = 124 ]; then
+        MAINTENANCE_DEADLINE_EXPIRED=1
+      else
+        status=1
+      fi
+    fi
+  fi
+  if [ "$MAINTENANCE_ENUM_FAILED" = 0 ] && {
+    [ "$enum_persisted" = 1 ] || {
+      [ "$enum_complete" = 1 ] && [ "$candidate_retain" = 0 ]
+    }
+  }; then
+    inactive_enum_cursor_promote "$PENDING_RECEIPT_ENUM_CURSOR" || status=1
+    [ "$status" = 0 ] && rm -f "$PENDING_RECEIPT_ENUM_CURSOR" || true
+  else
+    inactive_enum_cursor_discard "$PENDING_RECEIPT_ENUM_CURSOR" || status=1
+  fi
+  if [ "$candidate_tmp_owned" = 1 ]; then
+    rm -f "$candidate_tmp" || status=1
+  fi
+  if [ "$processed" -gt 0 ]; then
+    if cursor_tmp=$(mktemp "$STATE/.pending-receipt-republish.cursor.XXXXXX"); then
+      if [ ! -f "$cursor_tmp" ] || [ -L "$cursor_tmp" ] \
+        || ! printf '%s\n' "$last" | fm_nofollow_write "$cursor_tmp" \
+        || ! fm_nofollow_rename "$cursor_tmp" "$PENDING_RECEIPT_CURSOR"; then
+        status=1
+        rm -f "$cursor_tmp"
+      fi
+    else
+      status=1
+    fi
+  fi
+  MAINTENANCE_ITEMS_PROCESSED=$processed
+  return "$status"
+}
+
+read_incarnation() { fm_pane_idle_read_incarnation "$@"; }
+
+run_step_incarnation_evidence_path() {
+  if [ "$#" = 1 ]; then
+    printf '%s/.run-step-incarnation-%s' "$STATE" "$1"
+  else
+    printf '%s/.run-step-incarnation-%s.%s' "$STATE" "$1" "$2"
+  fi
+}
+
+run_step_incarnation_evidence_valid() {
+  local id=$1 incarnation=$2 outcome=$3 snapshot=$4 evidence run_id
+  valid_task_id "$id" || return 1
+  case "$outcome" in done|failed) ;; *) return 1 ;; esac
+  case "$incarnation" in ''|*[!A-Za-z0-9._:-]*) return 1 ;; esac
+  [ -n "$snapshot" ] || return 1
+  evidence=$(run_step_incarnation_evidence_path "$id") || return 1
+  if [ ! -f "$evidence" ] || [ -L "$evidence" ] \
+    || [ "$(meta_value_unique "$evidence" spawn_incarnation 2>/dev/null || true)" != "$incarnation" ]; then
+    evidence=$(run_step_incarnation_evidence_path "$id" "$incarnation") || return 1
+  fi
+  [ -f "$evidence" ] && [ ! -L "$evidence" ] || return 1
+  fm_nofollow_read "$evidence" | awk -F= '
+    BEGIN {
+      allowed["schema"]=1; allowed["task_id"]=1; allowed["run_id"]=1
+      allowed["spawn_incarnation"]=1; allowed["state"]=1
+      valid=1
+    }
+    /^[^=]+=/ {
+      key=$1
+      if (!(key in allowed) || (key in seen)) valid=0
+      seen[key]=1
+      values[key]=substr($0, index($0, "=") + 1)
+      next
+    }
+    { valid=0 }
+    END {
+      if (!("schema" in seen) || !("task_id" in seen) || !("run_id" in seen) \
+        || !("spawn_incarnation" in seen) || !("state" in seen)) valid=0
+      exit !(valid && values["schema"] == "fm-jt-run-step-incarnation.v1" \
+        && values["state"] == "active")
+    }
+  ' 2>/dev/null || return 1
+  [ "$(meta_value_unique "$evidence" schema 2>/dev/null)" = fm-jt-run-step-incarnation.v1 ] || return 1
+  [ "$(meta_value_unique "$evidence" task_id 2>/dev/null)" = "$id" ] || return 1
+  run_id=$(meta_value_unique "$evidence" run_id 2>/dev/null) || return 1
+  case "$run_id" in ''|*[!A-Za-z0-9._:-]*) return 1 ;; esac
+  [ -n "$(printf '%s' "$snapshot" | sed -n 's/.* · run-id=\([^ ·]*\)$/\1/p')" ] || return 1
+  [ "$run_id" = "$(printf '%s' "$snapshot" | sed -n 's/.* · run-id=\([^ ·]*\)$/\1/p')" ] || return 1
+  [ "$(meta_value_unique "$evidence" spawn_incarnation 2>/dev/null)" = "$incarnation" ] || return 1
+}
+
+terminal_snapshot_matches_current() {
+  local id=$1 expected=$2 status_snapshot=$3 state_timeout state_tmp state_rc current
+  local lock_path=${CHILD_LOCK:-${FM_TASK_LOCK_PATH:-}} lock_owner=${CHILD_LOCK_OWNER:-${FM_TASK_LOCK_OWNER:-}}
+  case "$expected" in
+    done:*|failed:*) [ "$expected" = "$status_snapshot" ]; return $? ;;
+    state:\ done\ *|state:\ failed\ *) ;;
+    *) return 1 ;;
+  esac
+  state_timeout=$(bounded_secs "${FM_INACTIVE_OUTCOME_STATE_TIMEOUT_SECS:-10}" 10 1 300)
+  state_tmp=$(mktemp "$STATE/.inactive-terminal-snapshot.XXXXXX") || return 1
+  state_rc=0
+  if [ "${CHILD_LOCK_HELD:-0}" = 1 ]; then
+    [ -n "$lock_path" ] && [ -n "$lock_owner" ] || {
+      rm -f "$state_tmp"
+      return 1
+    }
+    run_bounded_child "$state_timeout" env \
+      FM_CREW_STATE_NM_TIMEOUT="$state_timeout" \
+      FM_TASK_LOCK_PATH="$lock_path" FM_TASK_LOCK_OWNER="$lock_owner" \
+      "$FM_CREW_STATE_BIN" "$id" 2>/dev/null | fm_nofollow_write "$state_tmp" || state_rc=$?
+  else
+    run_bounded_child "$state_timeout" env FM_CREW_STATE_NM_TIMEOUT="$state_timeout" \
+      "$FM_CREW_STATE_BIN" "$id" 2>/dev/null | fm_nofollow_write "$state_tmp" || state_rc=$?
+  fi
+  current=
+  if [ "$state_rc" -eq 0 ]; then
+    current=$(cat "$state_tmp" 2>/dev/null) || state_rc=$?
+  fi
+  rm -f "$state_tmp" || [ "$state_rc" -ne 0 ] || state_rc=1
+  [ "$state_rc" -eq 0 ] || return 1
+  case "$current" in *$'\n'*) return 1 ;; esac
+  [ "$current" = "$expected" ]
+}
+
+surface_retry_valid() {
+  awk -F= '
+    BEGIN {
+      allowed["schema"]=1; allowed["task"]=1; allowed["snapshot"]=1
+      allowed["spawn_incarnation"]=1; allowed["tasktmp"]=1
+      allowed["window"]=1; allowed["worktree"]=1; allowed["wake_key"]=1
+      allowed["parent_corr"]=1
+      allowed["wake_published"]=1
+      required["schema"]=1; required["task"]=1; required["snapshot"]=1
+      required["spawn_incarnation"]=1; required["tasktmp"]=1
+      required["window"]=1; required["worktree"]=1; required["wake_key"]=1
+      required["parent_corr"]=1
+      required["wake_published"]=1
+      valid=1
+    }
+    /^[^=]+=/ {
+      key=$1
+      if (!(key in allowed) || (key in seen)) valid=0
+      seen[key]=1
+      values[key]=substr($0, index($0, "=") + 1)
+      next
+    }
+    { valid=0 }
+    END {
+      for (key in required) if (!(key in seen)) valid=0
+      exit !(valid && values["schema"] == "fm-hb-surface-retry.v1" && values["task"] != "" && values["snapshot"] != "" && values["wake_key"] != "" && values["wake_published"] ~ /^[012]$/)
+    }
+  ' "$1" 2>/dev/null
+}
+
+surface_retry_matches_current() {
+  local retry=$1 id=$2 meta=$3 status_file current_snapshot saved_snapshot saved_spawn
+  local current_spawn current_tasktmp current_window current_worktree current_parent_corr saved_parent_corr rc
+  [ -f "$retry" ] && [ ! -L "$retry" ] || return 1
+  surface_retry_valid "$retry" || return 1
+  [ "$(meta_value_unique "$retry" task 2>/dev/null)" = "$id" ] || return 1
+  status_file="$STATE/$id.status"
+  [ -f "$status_file" ] && [ ! -L "$status_file" ] || return 1
+  current_snapshot=$(awk 'NF { line=$0 } END { if (line == "") exit 1; print line }' "$status_file" 2>/dev/null) || return 1
+  saved_snapshot=$(meta_value_unique "$retry" snapshot 2>/dev/null) || return 1
+  terminal_snapshot_matches_current "$id" "$saved_snapshot" "$current_snapshot" || return 1
+  saved_parent_corr=$(meta_value_unique "$retry" parent_corr 2>/dev/null || true)
+  current_parent_corr=$(replay_parent_corr) || return 1
+  [ "$saved_parent_corr" = "$current_parent_corr" ] || return 1
+  saved_spawn=$(meta_value_unique "$retry" spawn_incarnation 2>/dev/null) || return 1
+  if current_spawn=$(meta_value_unique "$meta" spawn_incarnation 2>/dev/null); then
+    [ "$saved_spawn" = "$current_spawn" ] || return 1
+    return 0
+  fi
+  rc=$?
+  [ "$rc" = 1 ] || return 1
+  [ -z "$saved_spawn" ] || return 1
+  current_tasktmp=$(meta_value "$meta" tasktmp)
+  current_window=$(meta_value "$meta" window)
+  current_worktree=$(meta_value "$meta" worktree)
+  [ "$(meta_value_unique "$retry" tasktmp 2>/dev/null)" = "$current_tasktmp" ] || return 1
+  [ "$(meta_value_unique "$retry" window 2>/dev/null)" = "$current_window" ] || return 1
+  [ "$(meta_value_unique "$retry" worktree 2>/dev/null)" = "$current_worktree" ] || return 1
+}
+
+surface_retry_mark_published() {
+  local retry=$1 tmp line seen=0
+  tmp=$(mktemp "$STATE/.hb-surface-retry.XXXXXX") || return 1
+  {
+    while IFS= read -r line || [ -n "$line" ]; do
+      case "$line" in
+        wake_published=*) printf 'wake_published=1\n'; seen=1 ;;
+        *) printf '%s\n' "$line" ;;
+      esac
+    done < "$retry"
+    [ "$seen" = 1 ] || printf 'wake_published=1\n'
+  } | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 1; }
+  [ ! -L "$retry" ] || { rm -f "$tmp"; return 1; }
+  mv -f "$tmp" "$retry" || { rm -f "$tmp"; return 1; }
+}
+
+surface_retry_wake_present() {
+  local wake_key=$1
+  [ -f "$FM_WAKE_QUEUE" ] && [ ! -L "$FM_WAKE_QUEUE" ] || return 1
+  command -v perl >/dev/null 2>&1 || return 1
+  perl -e '
+    use Fcntl qw(:DEFAULT);
+    my ($path, $wanted) = @ARGV;
+    my $nofollow = eval { O_NOFOLLOW() };
+    defined($nofollow) or exit 2;
+    sysopen(my $fh, $path, O_RDONLY | $nofollow) or exit 2;
+    while (defined(my $line = <$fh>)) {
+      chomp $line;
+      my @fields = split(/\t/, $line, -1);
+      next unless @fields == 5;
+      next unless $fields[0] =~ /\A[0-9]+\z/ && $fields[1] =~ /\A[0-9]+\z/;
+      next unless $fields[2] =~ /\A(?:signal|stale|check|heartbeat)\z/;
+      next unless defined($fields[4]) && $fields[4] ne '';
+      exit 0 if $fields[3] eq $wanted;
+    }
+    close($fh) or exit 2;
+    exit 1;
+  ' "$FM_WAKE_QUEUE" "$wake_key"
+}
+
+surface_retry_remove() {
+  local retry=$1
+  [ ! -L "$retry" ] || return 1
+  rm -f "$retry"
+}
+
+surface_retry_published_current() {
+  local id=$1 meta=$2 retry=$3 wake_key=$4 published fp suffix receipt_state=
+  if [ -L "$retry" ] || [ -e "$retry" ]; then
+    [ -f "$retry" ] && [ ! -L "$retry" ] && surface_retry_valid "$retry" || return 2
+  else
+    return 1
+  fi
+  surface_retry_matches_current "$retry" "$id" "$meta" || return 1
+  [ "$(meta_value_unique "$retry" wake_key 2>/dev/null)" = "$wake_key" ] || return 2
+  published=$(meta_value_unique "$retry" wake_published 2>/dev/null) || return 2
+  fp=${wake_key#inactive-outcome:}
+  case "$fp" in ''|*[!A-Fa-f0-9]*) return 2 ;; esac
+  for suffix in pending presented reported; do
+    receipt_state=
+    [ ! -L "$(receipt_path "$fp" "$suffix")" ] || return 2
+    if [ -f "$(receipt_path "$fp" "$suffix")" ]; then
+      receipt_state=$suffix
+      break
+    fi
+  done
+  case "$published" in
+    1)
+      [ -n "$receipt_state" ] || return 1
+      case "$receipt_state" in
+        presented|reported)
+          if ! surface_retry_wake_present "$wake_key"; then
+            surface_retry_remove "$retry" || return 2
+          fi
+          ;;
+        pending) surface_retry_wake_present "$wake_key" || return 1 ;;
+        *) return 2 ;;
+      esac
+      return 0
+      ;;
+    2)
+      [ -n "$receipt_state" ] || return 1
+      case "$receipt_state" in
+        presented|reported)
+          if surface_retry_wake_present "$wake_key"; then
+            surface_retry_mark_published "$retry" || return 2
+          else
+            surface_retry_remove "$retry" || return 2
+          fi
+          return 0
+          ;;
+        pending)
+          surface_retry_wake_present "$wake_key" || return 1
+          surface_retry_mark_published "$retry" || return 2
+          return 0
+          ;;
+        *) return 2 ;;
+      esac
+      ;;
+    0) ;;
+    *) return 2 ;;
+  esac
+  surface_retry_wake_present "$wake_key" || return 1
+  surface_retry_mark_published "$retry" || return 2
+}
+
+terminal_outcome_surfaced() {
+  local id=$1 meta=$2 outcome=$3 wake_key=${4:-}
+  local key raw raw_outcome marker retry marker_snapshot marker_spawn marker_parent_corr current_parent_corr current_snapshot retry_status
+  local current_spawn current_tasktmp current_window current_worktree status_file
+  key=$(printf '%s' "$id" | tr ':/.' '___')
+  current_parent_corr=$(replay_parent_corr) || return 2
+  raw="$STATE/.hb-surfaced-$key"
+  marker="$STATE/.hb-terminal-surfaced-$key"
+  retry="$STATE/.hb-surface-retry-$key"
+  if [ -n "$wake_key" ]; then
+    surface_retry_published_current "$id" "$meta" "$retry" "$wake_key" || retry_status=$?
+    case "${retry_status:-0}" in
+      0) return 0 ;;
+      1) ;;
+      *) return 2 ;;
+    esac
+  fi
+  [ -f "$raw" ] && [ ! -L "$raw" ] || return 1
+  raw=$(cat "$raw" 2>/dev/null || true)
+  [ -n "$raw" ] || return 1
+  case "$raw" in
+    done:*|failed:*) raw_outcome=${raw%%:*} ;;
+    state:\ 'done'\ *) raw_outcome='done' ;;
+    state:\ failed\ *) raw_outcome=failed ;;
+    *) return 1 ;;
+  esac
+  [ "$raw_outcome" = "$outcome" ] || return 1
+  status_file="$STATE/$id.status"
+  [ -f "$status_file" ] && [ ! -L "$status_file" ] || return 1
+  current_snapshot=$(awk 'NF { line=$0 } END { if (line == "") exit 1; print line }' "$status_file" 2>/dev/null) || return 1
+  terminal_snapshot_matches_current "$id" "$raw" "$current_snapshot" || return 1
+  [ -f "$marker" ] && [ ! -L "$marker" ] || return 1
+  awk -F= '
+    BEGIN {
+      allowed["schema"]=1; allowed["snapshot"]=1; allowed["spawn_incarnation"]=1
+      allowed["tasktmp"]=1; allowed["window"]=1; allowed["worktree"]=1
+      allowed["parent_corr"]=1
+      required["schema"]=1; required["snapshot"]=1; required["spawn_incarnation"]=1
+      required["tasktmp"]=1; required["window"]=1; required["worktree"]=1
+      required["parent_corr"]=1
+      valid=1
+    }
+    /^[^=]+=/{
+      key=$1
+      if (!(key in allowed) || (key in seen)) valid=0
+      seen[key]=1
+      values[key]=substr($0, index($0, "=") + 1)
+      next
+    }
+    { valid=0 }
+    END {
+      for (key in required) if (!(key in seen)) valid=0
+      exit !(valid && values["schema"] == "fm-hb-terminal-surfaced.v1")
+    }
+  ' "$marker" 2>/dev/null || return 1
+  marker_parent_corr=$(meta_value_unique "$marker" parent_corr 2>/dev/null || true)
+  [ "$marker_parent_corr" = "$current_parent_corr" ] || return 1
+  marker_snapshot=$(meta_value_unique "$marker" snapshot 2>/dev/null) || return 1
+  [ "$marker_snapshot" = "$raw" ] || return 1
+  marker_spawn=$(meta_value_unique "$marker" spawn_incarnation 2>/dev/null) || return 1
+  current_spawn=
+  if current_spawn=$(meta_value_unique "$meta" spawn_incarnation 2>/dev/null); then
+    [ "$marker_spawn" = "$current_spawn" ] || return 1
+  else
+    [ -z "$marker_spawn" ] || return 1
+    current_tasktmp=$(meta_value "$meta" tasktmp)
+    current_window=$(meta_value "$meta" window)
+    current_worktree=$(meta_value "$meta" worktree)
+    [ "$(meta_value_unique "$marker" tasktmp 2>/dev/null)" = "$current_tasktmp" ] || return 1
+    [ "$(meta_value_unique "$marker" window 2>/dev/null)" = "$current_window" ] || return 1
+    [ "$(meta_value_unique "$marker" worktree 2>/dev/null)" = "$current_worktree" ] || return 1
+  fi
+  return 0
+}
+
+replay_surface_retry_write() {
+  local id=$1 meta=$2 snapshot=$3 incarnation=$4 key=$5 published=$6
+  local retry tmp tasktmp window worktree marker_incarnation parent_corr rc
+  case "$published" in 0|1|2) ;; *) return 1 ;; esac
+  parent_corr=$(replay_parent_corr) || return 1
+  tasktmp=$(meta_value "$meta" tasktmp)
+  window=$(meta_value "$meta" window)
+  worktree=$(meta_value "$meta" worktree)
+  if meta_value_unique "$meta" spawn_incarnation >/dev/null; then
+    marker_incarnation=$incarnation
+  else
+    rc=$?
+    [ "$rc" = 1 ] || return 1
+    marker_incarnation=
+  fi
+  retry="$STATE/.hb-surface-retry-$(printf '%s' "$id" | tr ':/.' '___')"
+  if [ -e "$retry" ]; then
+    [ -f "$retry" ] && [ ! -L "$retry" ] && surface_retry_valid "$retry" || return 1
+    if surface_retry_matches_current "$retry" "$id" "$meta"; then
+      [ "$(meta_value_unique "$retry" wake_key 2>/dev/null)" = "$key" ] || return 2
+    fi
+  fi
+  tmp=$(mktemp "$STATE/.hb-surface-retry.XXXXXX") || return 1
+  if ! printf 'schema=fm-hb-surface-retry.v1\ntask=%s\nsnapshot=%s\nspawn_incarnation=%s\ntasktmp=%s\nwindow=%s\nworktree=%s\nparent_corr=%s\nwake_key=%s\nwake_published=%s\n' \
+    "$id" "$snapshot" "$marker_incarnation" "$tasktmp" "$window" "$worktree" "$parent_corr" "$key" "$published" | fm_nofollow_write "$tmp" \
+    || ! fm_nofollow_rename "$tmp" "$retry"; then
+    rm -f "$tmp"
+    return 1
+  fi
+}
+
+replay_surface_marker() {
+  local id=$1 meta=$2 snapshot=$3 incarnation=$4 wake_key=$5 key raw marker retry tmp tasktmp window worktree
+  local marker_incarnation parent_corr rc
+  key=$(printf '%s' "$id" | tr ':/.' '___')
+  parent_corr=$(replay_parent_corr) || return 1
+  raw="$STATE/.hb-surfaced-$key"
+  marker="$STATE/.hb-terminal-surfaced-$key"
+  retry="$STATE/.hb-surface-retry-$key"
+  tasktmp=$(meta_value "$meta" tasktmp)
+  window=$(meta_value "$meta" window)
+  worktree=$(meta_value "$meta" worktree)
+  if meta_value_unique "$meta" spawn_incarnation >/dev/null; then
+    marker_incarnation=$incarnation
+  else
+    rc=$?
+    [ "$rc" = 1 ] || return 1
+    marker_incarnation=
+  fi
+  replay_surface_retry_write "$id" "$meta" "$snapshot" "$incarnation" "$wake_key" 1 || return 1
+  tmp=$(mktemp "$STATE/.hb-terminal-surfaced.XXXXXX") || return 1
+  if ! printf 'schema=fm-hb-terminal-surfaced.v1\nsnapshot=%s\nspawn_incarnation=%s\ntasktmp=%s\nwindow=%s\nworktree=%s\nparent_corr=%s\n' \
+    "$snapshot" "$marker_incarnation" "$tasktmp" "$window" "$worktree" "$parent_corr" | fm_nofollow_write "$tmp" \
+    || ! fm_nofollow_rename "$tmp" "$marker"; then
+    rm -f "$tmp"
+    return 1
+  fi
+  tmp=$(mktemp "$STATE/.hb-surfaced.XXXXXX") || return 1
+  if ! printf '%s' "$snapshot" | fm_nofollow_write "$tmp" || ! fm_nofollow_rename "$tmp" "$raw"; then
+    rm -f "$tmp"
+    return 1
+  fi
+  rm -f "$retry" || return 1
+}
+
+replay_receipt_exists() {
+  local suffix path
+  for suffix in pending presented reported; do
+    path=$(receipt_path "$FP" "$suffix")
+    [ -f "$path" ] && [ ! -L "$path" ] && return 0
+  done
+  return 1
+}
+
+child_cleanup() {
+  local status=$?
+  if [ "$WAKE_QUEUE_LOCK_HELD" = 1 ]; then
+    wake_queue_lock_release || true
+  fi
+  if [ "$CHILD_LOCK_HELD" = 1 ]; then
+    fm_lock_release "$CHILD_LOCK" || true
+  fi
+  exit "$status"
+}
+
+reconcile_child() {
+  local id=$1 meta="$STATE/$1.meta" kind kind_status backend window now activity age line outcome source
+  local snapshot token key route_rc parent_corr state_tmp state_rc existing_rc surface_status publication_status state_timeout scan_remaining child_lock_owner
+  valid_task_id "$id" || return 0
+  [ -f "$meta" ] && [ ! -L "$meta" ] || return 0
+  if kind=$(meta_value_unique "$meta" kind 2>/dev/null); then
+    :
+  else
+    kind_status=$?
+    [ "$kind_status" = 1 ] || return 0
+    kind=ship
+  fi
+  case "$kind" in ship|scout) ;; *) return 0 ;; esac
+  herdr_identity_allowed "$meta" || return 0
+  CHILD_LOCK="$STATE/.spawn-$id.lock"
+  FM_LOCK_WAIT_SECS=$(bounded_secs "${FM_INACTIVE_OUTCOME_LOCK_WAIT_SECS:-30}" 30 0 300)
+  fm_lock_acquire_wait "$CHILD_LOCK" || return 75
+  CHILD_LOCK_HELD=1
+  child_lock_owner=$(fm_lock_link_owner "$CHILD_LOCK") || return 75
+  CHILD_LOCK_OWNER=$child_lock_owner
+  trap child_cleanup EXIT INT TERM
+  # Teardown/relaunch can replace or remove metadata only after the same lock is
+  # released. Re-read it after acquiring the lock so the snapshot belongs to the
+  # current incarnation.
+  [ -f "$meta" ] && [ ! -L "$meta" ] || return 0
+  if kind=$(meta_value_unique "$meta" kind 2>/dev/null); then
+    :
+  else
+    kind_status=$?
+    [ "$kind_status" = 1 ] || return 0
+    kind=ship
+  fi
+  case "$kind" in ship|scout) ;; *) return 0 ;; esac
+  herdr_identity_allowed "$meta" || return 0
+  now=$(date +%s)
+  activity=$(latest_activity "$id")
+  [ "$activity" -gt 0 ] || return 0
+  age=$((now - activity))
+  [ "$age" -ge "$RECONCILE_SECS" ] || return 0
+  state_tmp=$(mktemp "$STATE/.$id.inactive-state.XXXXXX") || return 1
+  [ -f "$state_tmp" ] && [ ! -L "$state_tmp" ] || { rm -f "$state_tmp"; return 1; }
+  state_timeout=$(bounded_secs "${FM_INACTIVE_OUTCOME_STATE_TIMEOUT_SECS:-10}" 10 1 300)
+  scan_remaining=${FM_INACTIVE_OUTCOME_SCAN_REMAINING_SECS:-}
+  case "$scan_remaining" in
+    ''|*[!0-9]*) scan_remaining=;;
+    *)
+      while [ "${scan_remaining#0}" != "$scan_remaining" ]; do scan_remaining=${scan_remaining#0}; done
+      [ -n "$scan_remaining" ] || scan_remaining=0
+      [ "$scan_remaining" -gt 0 ] && [ "$scan_remaining" -lt "$state_timeout" ] \
+        && state_timeout=$scan_remaining
+      ;;
+  esac
+  state_rc=0
+  export FM_CREW_STATE_NM_TIMEOUT="$state_timeout"
+  run_bounded_child "$state_timeout" env \
+    FM_TASK_LOCK_PATH="$CHILD_LOCK" FM_TASK_LOCK_OWNER="$child_lock_owner" \
+    "$FM_CREW_STATE_BIN" "$id" \
+    2>/dev/null | fm_nofollow_write "$state_tmp" || state_rc=$?
+  line=
+  if [ "$state_rc" -eq 0 ]; then
+    line=$(cat "$state_tmp" 2>/dev/null) || state_rc=$?
+  fi
+  rm -f "$state_tmp" || [ "$state_rc" -ne 0 ] || state_rc=1
+  [ "$state_rc" -eq 0 ] || return "$state_rc"
+  case "$line" in *$'\n'*) return 0 ;; esac
+  case "$line" in
+    state:\ done\ *|state:\ failed\ *) ;;
+    *) return 0 ;;
+  esac
+  case "$line" in
+    *'source: none'*|*'source: status-log'*|*'state: unknown'*|*'occupancy unknown'*) return 0 ;;
+  esac
+  outcome=${line#state: }
+  outcome=${outcome%% *}
+  case "$outcome" in done|failed) ;; *) return 0 ;; esac
+  source=$(printf '%s\n' "$line" | sed -n 's/.*source: \([^ ·]*\).*/\1/p')
+  [ -n "$source" ] && [ "$source" != none ] || return 0
+  snapshot=$(single_line "$line")
+  INC=$(read_incarnation "$meta" "$id") || return 0
+  window=$(meta_value_unique "$meta" window) || return 0
+  if backend=$(meta_value_unique "$meta" backend 2>/dev/null); then
+    :
+  else
+    state_rc=$?
+    [ "$state_rc" = 1 ] && backend=tmux || return 0
+  fi
+  case "$backend" in tmux|herdr) ;; *) return 0 ;; esac
+  if [ "$source" = run-step ]; then
+    run_step_incarnation_evidence_valid "$id" "$INC" "$outcome" "$snapshot" || return 0
+  elif ! fm_pane_idle_proof_valid "$STATE" "$meta" "$id" "$window" "$backend" "$INC" "$RECONCILE_SECS"; then
+    return 0
+  fi
+  ID=$id
+  OUTCOME=$outcome
+  SNAPSHOT=$snapshot
+  SOURCE=$source
+  KIND=${kind:-ship}
+  is_secondmate_home
+  route_rc=$?
+  case "$route_rc" in
+    0|1) ;;
+    *) return 0 ;;
+  esac
+  if [ "$route_rc" = 0 ]; then
+    KIND=secondmate
+    fm_pending_reply_secondmate_route_validate "$FM_HOME" || return 75
+    parent_corr=$FM_PENDING_ROUTE_CORR
+  else
+    FM_PENDING_ROUTE_CORR=
+    parent_corr=
+  fi
+  FP=$(terminal_outcome_fingerprint "$id" "$INC" "$outcome" "$snapshot" "$KIND" "$parent_corr" "$source") || return 1
+  surface_status=0
+  terminal_outcome_surfaced "$id" "$meta" "$outcome" "inactive-outcome:$FP" \
+    || surface_status=$?
+  case "$surface_status" in
+    0) return 0 ;;
+    1) ;;
+    *) return 2 ;;
+  esac
+  if [ "$route_rc" = 0 ]; then
+    key="inactive-outcome:$FP"
+    replay_surface_retry_write "$id" "$meta" "$snapshot" "$INC" "$key" 2 || return 1
+    publish_secondmate_receipt_and_wake "$meta" "$id" "$window" "$backend" "$INC" "$source" \
+      || { publication_status=$?; return "$publication_status"; }
+    if replay_receipt_exists; then
+      replay_surface_marker "$id" "$meta" "$snapshot" "$INC" "$key" || return 1
+    fi
+    if [ "$FM_WAKE_APPEND_CREATED" = 1 ]; then
+      printf 'queued inactive outcome: task=%s state=%s fingerprint=%s\n' "$id" "$outcome" "$FP"
+    fi
+    return 0
+  fi
+  if receipt_existing_core; then
+    key="inactive-outcome:$FP"
+    replay_surface_retry_write "$id" "$meta" "$snapshot" "$INC" "$key" 2 || return 1
+    if [ "$RECEIPT_EXISTING_SUFFIX" = pending ]; then
+      republish_existing_receipt_wake "$meta" "$id" "$window" "$backend" "$INC" "$source" \
+        || { publication_status=$?; return "$publication_status"; }
+      if [ "$FM_WAKE_APPEND_CREATED" = 1 ]; then
+        printf 'queued inactive outcome: task=%s state=%s fingerprint=%s\n' "$id" "$outcome" "$FP"
+      fi
+    fi
+    replay_surface_marker "$id" "$meta" "$snapshot" "$INC" "$key" || return 1
+    return 0
+  else
+    existing_rc=$?
+    [ "$existing_rc" = 1 ] || return 1
+  fi
+  key="inactive-outcome:$FP"
+  replay_surface_retry_write "$id" "$meta" "$snapshot" "$INC" "$key" 2 || return 1
+  publish_receipt_and_wake "$meta" "$id" "$window" "$backend" "$INC" "$source" \
+    || { publication_status=$?; return "$publication_status"; }
+  replay_surface_marker "$id" "$meta" "$snapshot" "$INC" "$key" || return 1
+  if [ "$FM_WAKE_APPEND_CREATED" = 1 ]; then
+    printf 'queued inactive outcome: task=%s state=%s fingerprint=%s\n' "$id" "$outcome" "$FP"
+  fi
+  return 0
+}
+
+ack_receipt() {  # <inactive-outcome:fingerprint>
+  local key=$1 row=${2:-} owner_required=${3:-1} expected_generation=${4:-}
+  local fp rec id kind incarnation outcome snapshot expected_fp parent_task_id parent_home parent_status corr line target existing existing_kind existing_corr claim_state
+  [ -n "$row" ] || return 2
+  case "$owner_required" in 0|1) ;; *) return 2 ;; esac
+  [ "$owner_required" = 0 ] || drain_claim_owner "$row" || return 2
+  case "$key" in inactive-outcome:*) fp=${key#inactive-outcome:} ;; *) return 0 ;; esac
+  case "$fp" in ''|*[!A-Fa-f0-9]*) return 1 ;; esac
+  claim_state=$(claim_validate "$(claim_path "$fp")" "$fp" "$row") || return 2
+  [ "$claim_state" = presented ] || return 2
+  [ "$(claim_binary_field "$(claim_path "$fp")" output_started 2>/dev/null || true)" = 1 ] || return 2
+  [ "$(claim_binary_field "$(claim_path "$fp")" output_emitted 2>/dev/null || true)" = 1 ] || return 2
+  [ "$(claim_binary_field "$(claim_path "$fp")" output_complete 2>/dev/null || true)" = 1 ] || return 2
+  [ "$(claim_binary_field "$(claim_path "$fp")" output_confirmed 2>/dev/null || true)" = 1 ] || return 2
+  if [ "$(claim_field "$(claim_path "$fp")" defer_ack 2>/dev/null || true)" = 1 ]; then
+    [ "$(claim_binary_field "$(claim_path "$fp")" caller_confirmed 2>/dev/null || true)" = 1 ] || return 2
+  fi
+  if [ "$owner_required" = 0 ]; then
+    claim_validate_caller_owner "$(claim_path "$fp")" "$expected_generation" || return 2
+  fi
+  rec=$(receipt_path "$fp" pending)
+  [ ! -L "$rec" ] || return 2
+  if [ ! -e "$rec" ]; then
+    for existing in "$(receipt_path "$fp" presented)" "$(receipt_path "$fp" reported)"; do
+      [ ! -L "$existing" ] || return 2
+      if [ -e "$existing" ]; then
+        [ -f "$existing" ] || return 2
+        prepare_pending_receipt "$existing" || return 2
+        existing_kind=$KIND
+        if [ "$existing_kind" = secondmate ]; then
+          reported_secondmate_receipt_valid "$existing" || return 2
+          existing_corr=$(receipt_field "$existing" parent_corr)
+          fm_pending_reply_secondmate_route_clear_reported "$FM_HOME" "$existing_corr" \
+            "$(receipt_field "$existing" parent_task_id)" \
+            "$(receipt_field "$existing" parent_home)" \
+            "$(receipt_field "$existing" parent_status)" || return 2
+        fi
+        claim_remove "$key" "$row" "$owner_required" "$expected_generation" || return 2
+        fm_wake_remove_key_locked "$key" || return 2
+        return 1
+      fi
+    done
+    return 2
+  fi
+  [ -f "$rec" ] || return 2
+  prepare_pending_receipt "$rec" || return 2
+  id=$(receipt_field "$rec" task_id)
+  kind=$(receipt_field "$rec" kind)
+  incarnation=$(receipt_field "$rec" incarnation)
+  parent_task_id=$(receipt_field "$rec" parent_task_id)
+  corr=$(receipt_field "$rec" parent_corr)
+  outcome=$(receipt_field "$rec" outcome)
+  snapshot=$(receipt_field "$rec" terminal_snapshot)
+  expected_fp=$(terminal_outcome_fingerprint "$id" "$incarnation" "$outcome" "$snapshot" "$kind" "$corr" "$SOURCE") || return 2
+  [ "$expected_fp" = "$fp" ] || return 2
+  case "$kind" in ship|scout|secondmate) ;; *) return 2 ;; esac
+  if [ "$kind" = secondmate ]; then
+    parent_home=$(receipt_field "$rec" parent_home)
+    parent_status=$(receipt_field "$rec" parent_status)
+    corr=$(receipt_field "$rec" parent_corr)
+    [ -n "$parent_task_id" ] || return 2
+    secondmate_ack_report "$FM_HOME" "$parent_task_id" "$parent_home" \
+      "$parent_status" "$corr" "$outcome" "$id" "$fp" || return 2
+    target=$(receipt_path "$fp" reported)
+  else
+    target=$(receipt_path "$fp" presented)
+  fi
+  [ ! -L "$target" ] || return 2
+  if [ -e "$target" ]; then
+    [ -f "$target" ] || return 2
+    [ "$(receipt_field "$target" fingerprint)" = "$fp" ] || return 2
+    if [ "$kind" = secondmate ]; then
+      reported_secondmate_receipt_valid "$target" || return 2
+      fm_pending_reply_secondmate_route_clear_reported "$FM_HOME" "$corr" \
+        "$parent_task_id" "$parent_home" "$parent_status" || return 2
+    fi
+    rm -f "$rec" || return 2
+    claim_remove "$key" "$row" "$owner_required" "$expected_generation" || return 2
+    fm_wake_remove_key_locked "$key" || return 2
+    return 1
+  fi
+  fm_nofollow_rename "$rec" "$target" 1 || return 2
+  if [ "$kind" = secondmate ]; then
+    fm_pending_reply_secondmate_route_clear_reported "$FM_HOME" "$corr" \
+      "$parent_task_id" "$parent_home" "$parent_status" || return 2
+  fi
+  claim_remove "$key" "$row" "$owner_required" "$expected_generation" || return 2
+  fm_wake_remove_key_locked "$key" || return 2
+  return 0
+}
+
+confirm_receipt() {
+  local status=0 caller_pid=${PPID:-}
+  fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK" || return 2
+  claim_mark_confirmed "$1" "$2" 0 "$caller_pid" || status=$?
+  if [ "$status" = 0 ]; then
+    ack_receipt "$1" "$2" 0 "$caller_pid" || status=$?
+  fi
+  fm_lock_release "$FM_WAKE_QUEUE_LOCK" || status=2
+  return "$status"
+}
+
+caller_output_complete() {
+  local status=0 caller_pid=${3:-${PPID:-}}
+  fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK" || return 2
+  claim_mark_output_complete "$1" "$2" 0 "$caller_pid" || status=$?
+  fm_lock_release "$FM_WAKE_QUEUE_LOCK" || status=2
+  return "$status"
+}
+
+secondmate_ack_report() {  # <secondmate-home> <parent-id> <parent-home> <parent-status> <corr> <outcome> <task-id> <fingerprint>
+  local secondmate_home=$1 parent_task_id=$2 parent_home=$3 parent_status=$4 corr=$5 outcome=$6 task_id=$7 fp=$8
+  local parent_state token route_lock route_marker route_history line phase rc=0 route_lock_held=0 marker_present=0 report_recorded=0 report_probe_status
+  fm_pending_reply_secondmate_receipt_validate \
+    "$secondmate_home" "$parent_task_id" "$parent_home" "$parent_status" "$corr" || return 2
+  parent_state=${FM_PENDING_ROUTE_STATE:-}
+  [ -n "$parent_state" ] || return 2
+  fm_pending_reply_txn_lock_acquire "$parent_state" "$corr" token || return 2
+  if ! fm_pending_reply_secondmate_receipt_validate \
+    "$secondmate_home" "$parent_task_id" "$parent_home" "$parent_status" "$corr"; then
+    rc=2
+  else
+    phase=$FM_PENDING_ROUTE_PHASE
+    line="$outcome [corr=$corr]: inactive terminal outcome replayed: task=$task_id fingerprint=$fp"
+    [ ! -L "$parent_status" ] || rc=2
+    if [ "$rc" = 0 ] && [ -e "$parent_status" ]; then
+      [ -f "$parent_status" ] || rc=2
+    fi
+    if [ "$rc" = 0 ] && [ -f "$parent_status" ]; then
+      parent_status_line_status "$parent_status" "$line"
+      report_probe_status=$?
+      case "$report_probe_status" in
+        0) report_recorded=1 ;;
+        1) ;;
+        *) rc=2 ;;
+      esac
+    fi
+    route_lock=$(fm_pending_reply_secondmate_route_lock_path "$secondmate_home")
+    if [ "$rc" = 0 ] && fm_lock_acquire_wait "$route_lock"; then
+      route_lock_held=1
+    elif [ "$rc" = 0 ]; then
+      rc=2
+    fi
+    if [ "$route_lock_held" = 1 ]; then
+      route_marker=$(fm_pending_reply_secondmate_route_path "$secondmate_home")
+      route_history=$(fm_pending_reply_secondmate_route_history_path "$secondmate_home" "$corr")
+      if [ -e "$route_marker" ] || [ -L "$route_marker" ] \
+        || [ -e "$route_history" ] || [ -L "$route_history" ]; then
+        marker_present=1
+      fi
+      if [ "$marker_present" = 1 ]; then
+        fm_pending_reply_secondmate_route_validate "$secondmate_home" "$corr" || rc=2
+      elif [ "$phase" != resolved ] \
+        && [ "$phase" != retired ] \
+        && [ "$report_recorded" != 1 ]; then
+        rc=2
+      fi
+      if [ "$rc" = 0 ] \
+        && [ "$phase" != resolved ] \
+        && [ "$phase" != retired ] \
+        && [ "$report_recorded" != 1 ]; then
+        if [ ! -e "$parent_status" ] && [ ! -L "$parent_status" ]; then
+          parent_status_append_line "$parent_status" "$line" || rc=2
+          [ "$rc" = 0 ] && report_recorded=1
+        elif [ "$rc" = 0 ]; then
+          parent_status_line_status "$parent_status" "$line"
+          report_probe_status=$?
+          case "$report_probe_status" in
+            0) report_recorded=1 ;;
+            1) parent_status_append_line "$parent_status" "$line" || rc=2
+               [ "$rc" = 0 ] && report_recorded=1 ;;
+            *) rc=2 ;;
+          esac
+        fi
+      fi
+      fm_lock_release "$route_lock" || rc=2
+      route_lock_held=0
+    fi
+  fi
+  if [ "$route_lock_held" = 1 ]; then
+    fm_lock_release "$route_lock" || rc=2
+  fi
+  fm_pending_reply_txn_lock_release "$parent_state" "$corr" "$token" || rc=2
+  return "$rc"
+}
+
+scan_locked() {
+  local startup=${1:-0} marker_mtime now age cursor meta id started=1 cursor_seen=1
+  local cursor_identity current_cursor_identity
+  local scan_started scan_deadline maintenance_deadline remaining rc complete=1 scan_failed=0 find_tmp maintenance_status=0
+  local maintenance_started maintenance_phase maintenance_next_phase maintenance_phase_tmp
+  local maintenance_order next_order maintenance_order_tmp maintenance_ran=0 maintenance_deferred=0 direct_deferred=0
+  local find_pending_source=0 find_retain=0 find_ordered=1 batch_consumed=0 batch_complete=1 retry_path=
+  local find_source_drained=0
+  local find_pending_offset=0 find_tmp_owned=0 pending_skip=0 find_enum_cursor=
+  local find_enum_complete=0 find_enum_persisted=0 child_remaining child_scan_deadline
+  local pane_idle_index_dir=''
+  inactive_state_preflight || return 1
+  inactive_merge_txn_recover || return 1
+  marker_mtime=$(file_mtime "$SCAN_MARKER" 2>/dev/null || true)
+  now=$(date +%s)
+  if [ "$startup" != 1 ] && [ -n "$marker_mtime" ]; then
+    age=$((now - marker_mtime))
+    [ "$age" -ge "$RECONCILE_SECS" ] || return 0
+  fi
+  run_maintenance() {
+    maintenance_phase=$(cat "$MAINTENANCE_PHASE_CURSOR" 2>/dev/null || true)
+    case "$maintenance_phase" in pending|reported) ;; *) maintenance_phase=pending ;; esac
+    maintenance_next_phase=$maintenance_phase
+    MAINTENANCE_ENUM_DEFERRED=0
+    MAINTENANCE_ENUM_FAILED=0
+    MAINTENANCE_RETRYABLE=0
+    maintenance_started=$(clock_millis)
+    if [ "$maintenance_started" -ge "$scan_deadline" ]; then
+      maintenance_deferred=1
+      return 0
+    fi
+    maintenance_deadline=$((maintenance_started + MAINTENANCE_TURN_SECS * 1000))
+    [ "$maintenance_deadline" -gt "$scan_deadline" ] && maintenance_deadline=$scan_deadline
+    if [ "$maintenance_phase" = pending ]; then
+      if ! republish_pending_receipts "$maintenance_deadline"; then
+        if [ "$MAINTENANCE_RETRYABLE" = 1 ]; then
+          maintenance_deferred=1
+        elif [ "$MAINTENANCE_ENUM_DEFERRED" = 1 ]; then
+          maintenance_deferred=1
+        elif [ "$MAINTENANCE_DEADLINE_EXPIRED" = 1 ]; then
+          maintenance_deferred=1
+        elif [ "$MAINTENANCE_ENUM_FAILED" = 1 ]; then
+          maintenance_status=1
+        elif [ "$(clock_millis)" -ge "$scan_deadline" ]; then
+          maintenance_deferred=1
+        else
+          maintenance_status=1
+        fi
+      fi
+      if [ "$maintenance_status" = 0 ] && [ "$maintenance_deferred" = 0 ] \
+        && [ "$MAINTENANCE_ITEMS_PROCESSED" = 0 ]; then
+        if ! repair_reported_secondmate_routes "$maintenance_deadline"; then
+          if [ "$MAINTENANCE_ENUM_DEFERRED" = 1 ]; then
+            maintenance_deferred=1
+          elif [ "$MAINTENANCE_RETRYABLE" = 1 ]; then
+            maintenance_deferred=1
+          elif [ "$MAINTENANCE_DEADLINE_EXPIRED" = 1 ]; then
+            maintenance_deferred=1
+          elif [ "$MAINTENANCE_ENUM_FAILED" = 1 ]; then
+            maintenance_status=1
+          elif [ "$(clock_millis)" -ge "$scan_deadline" ]; then
+            maintenance_deferred=1
+          else
+            maintenance_status=1
+          fi
+        fi
+        if [ "$maintenance_status" = 0 ] && [ "$maintenance_deferred" = 0 ]; then
+          maintenance_next_phase=pending
+        fi
+      elif [ "$maintenance_status" = 0 ] && [ "$maintenance_deferred" = 0 ]; then
+        maintenance_next_phase=reported
+      fi
+    else
+      if ! repair_reported_secondmate_routes "$maintenance_deadline"; then
+        if [ "$MAINTENANCE_ENUM_DEFERRED" = 1 ]; then
+          maintenance_deferred=1
+        elif [ "$MAINTENANCE_RETRYABLE" = 1 ]; then
+          maintenance_deferred=1
+        elif [ "$MAINTENANCE_DEADLINE_EXPIRED" = 1 ]; then
+          maintenance_deferred=1
+        elif [ "$MAINTENANCE_ENUM_FAILED" = 1 ]; then
+          maintenance_status=1
+        elif [ "$(clock_millis)" -ge "$scan_deadline" ]; then
+          maintenance_deferred=1
+        else
+          maintenance_status=1
+        fi
+      fi
+      if [ "$maintenance_status" = 0 ] && [ "$maintenance_deferred" = 0 ] \
+        && [ "$MAINTENANCE_ITEMS_PROCESSED" = 0 ]; then
+        if ! republish_pending_receipts "$maintenance_deadline"; then
+          if [ "$MAINTENANCE_RETRYABLE" = 1 ]; then
+            maintenance_deferred=1
+          elif [ "$MAINTENANCE_ENUM_DEFERRED" = 1 ]; then
+            maintenance_deferred=1
+          elif [ "$MAINTENANCE_DEADLINE_EXPIRED" = 1 ]; then
+            maintenance_deferred=1
+          elif [ "$MAINTENANCE_ENUM_FAILED" = 1 ]; then
+            maintenance_status=1
+          elif [ "$(clock_millis)" -ge "$scan_deadline" ]; then
+            maintenance_deferred=1
+          else
+            maintenance_status=1
+          fi
+        fi
+        if [ "$maintenance_status" = 0 ] && [ "$maintenance_deferred" = 0 ]; then
+          maintenance_next_phase=reported
+        fi
+      elif [ "$maintenance_status" = 0 ] && [ "$maintenance_deferred" = 0 ]; then
+        maintenance_next_phase=pending
+      fi
+    fi
+    maintenance_phase_tmp=$(mktemp "$STATE/.inactive-outcome-maintenance.cursor.XXXXXX") || {
+      maintenance_status=1
+      return 0
+    }
+    if [ ! -f "$maintenance_phase_tmp" ] || [ -L "$maintenance_phase_tmp" ] \
+      || ! printf '%s\n' "$maintenance_next_phase" | fm_nofollow_write "$maintenance_phase_tmp" \
+      || ! fm_nofollow_rename "$maintenance_phase_tmp" "$MAINTENANCE_PHASE_CURSOR"; then
+      maintenance_status=1
+      rm -f "$maintenance_phase_tmp"
+    fi
+  }
+  maintenance_order=$(cat "$MAINTENANCE_ORDER_CURSOR" 2>/dev/null || true)
+  case "$maintenance_order" in direct|maintenance) ;; *) maintenance_order=direct ;; esac
+  if [ "$maintenance_order" = direct ]; then
+    next_order=maintenance
+  else
+    next_order=direct
+  fi
+  maintenance_order_tmp=$(mktemp "$STATE/.inactive-outcome-maintenance-order.XXXXXX") || return 1
+  if [ ! -f "$maintenance_order_tmp" ] || [ -L "$maintenance_order_tmp" ] \
+    || ! printf '%s\n' "$next_order" | fm_nofollow_write "$maintenance_order_tmp" \
+    || ! fm_nofollow_rename "$maintenance_order_tmp" "$MAINTENANCE_ORDER_CURSOR"; then
+    rm -f "$maintenance_order_tmp"
+    return 1
+  fi
+  scan_started=$(clock_millis)
+  scan_deadline=$((scan_started + DIRECT_SCAN_BUDGET_SECS * 1000))
+  if [ "$maintenance_order" = maintenance ]; then
+    maintenance_ran=1
+    run_maintenance
+  fi
+  cursor=$(cat "$SCAN_CURSOR" 2>/dev/null || true)
+  cursor_identity=$(cat "$SCAN_CURSOR_IDENTITY" 2>/dev/null || true)
+  case "$cursor" in
+    '') cursor_identity=;;
+    *[!A-Za-z0-9._-]*) cursor=; cursor_identity=;;
+  esac
+  case "$cursor_identity" in
+    ''|*[!0123456789abcdefABCDEF]*) cursor=; cursor_identity=;;
+  esac
+  if [ -n "$cursor_identity" ] && [ "${#cursor_identity}" != 64 ]; then
+    cursor=
+    cursor_identity=
+  fi
+  if [ -n "$cursor" ] && { [ ! -f "$STATE/$cursor.meta" ] || [ -L "$STATE/$cursor.meta" ]; }; then
+    cursor=
+    cursor_identity=
+  fi
+  if [ -n "$cursor" ]; then
+    current_cursor_identity=$(metadata_fingerprint "$STATE/$cursor.meta" 2>/dev/null || true)
+    if [ -z "$current_cursor_identity" ] || [ "$current_cursor_identity" != "$cursor_identity" ]; then
+      cursor=
+      cursor_identity=
+    fi
+  fi
+  if [ -e "$DIRECT_FIND_INCOMPLETE" ] || [ -L "$DIRECT_FIND_INCOMPLETE" ]; then
+    [ -f "$DIRECT_FIND_INCOMPLETE" ] && [ ! -L "$DIRECT_FIND_INCOMPLETE" ] || return 1
+  fi
+  if [ -e "$DIRECT_FIND_ENUM_CURSOR" ] || [ -L "$DIRECT_FIND_ENUM_CURSOR" ]; then
+    [ -f "$DIRECT_FIND_ENUM_CURSOR" ] && [ ! -L "$DIRECT_FIND_ENUM_CURSOR" ] || return 1
+    find_enum_cursor=$(inactive_text_cursor_read "$DIRECT_FIND_ENUM_CURSOR") || return 1
+    case "$find_enum_cursor" in
+      ''|0) find_enum_cursor=;;
+      *[!0-9]*) find_enum_cursor=;;
+    esac
+  fi
+  if [ -n "$cursor" ]; then started=0; fi
+  [ -n "$cursor" ] && cursor_seen=0
+  if [ ! -e "$DIRECT_FIND_PENDING" ] && [ ! -L "$DIRECT_FIND_PENDING" ] \
+    && inactive_pending_retry_exists "$DIRECT_FIND_RETRY"; then
+    inactive_pending_retry_restore "$DIRECT_FIND_RETRY" "$DIRECT_FIND_PENDING" || {
+      [ "$maintenance_ran" = 1 ] || run_maintenance
+      return 1
+    }
+    inactive_pending_offset_write "$DIRECT_FIND_OFFSET" 0 || {
+      [ "$maintenance_ran" = 1 ] || run_maintenance
+      return 1
+    }
+  fi
+  if [ -e "$DIRECT_FIND_PENDING" ] || [ -L "$DIRECT_FIND_PENDING" ]; then
+    [ -f "$DIRECT_FIND_PENDING" ] && [ ! -L "$DIRECT_FIND_PENDING" ] || {
+      [ "$maintenance_ran" = 1 ] || run_maintenance
+      return 1
+    }
+    if [ -s "$DIRECT_FIND_PENDING" ]; then
+      inactive_pending_merge_retry "$DIRECT_FIND_PENDING" "$DIRECT_FIND_RETRY" "$scan_deadline"
+      rc=$?
+      case "$rc" in
+        0) ;;
+        124) direct_deferred=1 ;;
+        *)
+          [ "$maintenance_ran" = 1 ] || run_maintenance
+          return 1
+          ;;
+      esac
+      find_tmp="$DIRECT_FIND_PENDING"
+      find_pending_source=1
+      find_retain=1
+      find_pending_offset=$(inactive_pending_offset "$DIRECT_FIND_OFFSET") || {
+        [ "$maintenance_ran" = 1 ] || run_maintenance
+        return 1
+      }
+      pending_skip=$find_pending_offset
+    else
+      inactive_pending_clear "$DIRECT_FIND_PENDING" "$DIRECT_FIND_OFFSET" || {
+        [ "$maintenance_ran" = 1 ] || run_maintenance
+        return 1
+      }
+    fi
+  elif [ -e "$DIRECT_FIND_OFFSET" ] || [ -L "$DIRECT_FIND_OFFSET" ]; then
+    inactive_pending_clear "$DIRECT_FIND_PENDING" "$DIRECT_FIND_OFFSET" || {
+      [ "$maintenance_ran" = 1 ] || run_maintenance
+      return 1
+    }
+  fi
+  if [ "$find_pending_source" = 0 ]; then
+    find_tmp=$(mktemp "$STATE/.inactive-outcome-find.XXXXXX") || {
+      [ "$maintenance_ran" = 1 ] || run_maintenance
+      return 1
+    }
+    [ -f "$find_tmp" ] && [ ! -L "$find_tmp" ] || {
+      rm -f "$find_tmp"
+      [ "$maintenance_ran" = 1 ] || run_maintenance
+      return 1
+    }
+    find_tmp_owned=1
+    remaining=$(budget_remaining_secs "$scan_deadline")
+    if [ "$remaining" -le 0 ]; then
+      direct_deferred=1
+      find_retain=1
+    else
+      if inactive_find_candidates "$remaining" "$find_enum_cursor" \
+        "$DIRECT_FIND_ENUM_CURSOR" | fm_nofollow_write "$find_tmp"; then
+        rm -f "$DIRECT_FIND_INCOMPLETE" || {
+          [ "$maintenance_ran" = 1 ] || run_maintenance
+          return 1
+        }
+        find_enum_complete=1
+        if inactive_persist_nul_suffix "$find_tmp" "$DIRECT_FIND_PENDING" 0 "" "$scan_deadline"; then
+          find_enum_persisted=1
+          find_tmp="$DIRECT_FIND_PENDING"
+          find_tmp_owned=0
+          find_pending_source=1
+          find_pending_offset=0
+          pending_skip=0
+          find_retain=1
+          remaining=$(budget_remaining_secs "$scan_deadline")
+        else
+          rc=$?
+          [ "$rc" -ne 0 ] || rc=1
+          scan_failed=1
+          remaining=0
+        fi
+        if [ "$scan_failed" = 0 ] && [ "$remaining" -le 0 ]; then
+          direct_deferred=1
+          find_retain=1
+        fi
+      else
+        rc=$?
+        [ "$rc" -ne 0 ] || rc=1
+        complete=0
+        find_retain=1
+        if inactive_persist_nul_suffix "$find_tmp" "$DIRECT_FIND_PENDING" 0 "" "$scan_deadline"; then
+          find_enum_persisted=1
+          find_tmp="$DIRECT_FIND_PENDING"
+          find_tmp_owned=0
+          find_pending_source=1
+        elif [ -f "$find_tmp" ] && [ ! -L "$find_tmp" ]; then
+          inactive_pending_retry_defer "$find_tmp" "${DIRECT_FIND_PENDING}.retry" "" 1 || true
+          [ -e "$find_tmp" ] || find_tmp_owned=0
+        fi
+        if [ "$rc" = 124 ]; then
+          direct_deferred=1
+          inactive_text_cursor_write "$DIRECT_FIND_INCOMPLETE" "" || {
+            [ "$maintenance_ran" = 1 ] || run_maintenance
+            return 1
+          }
+        else
+          scan_failed=1
+          inactive_enum_cursor_discard "$DIRECT_FIND_ENUM_CURSOR" || {
+            [ "$maintenance_ran" = 1 ] || run_maintenance
+            return 1
+          }
+        fi
+      fi
+    fi
+  fi
+  if [ "$find_pending_source" = 1 ]; then
+    cursor=
+    started=1
+    cursor_seen=1
+    batch_consumed=$find_pending_offset
+  fi
+  remaining=$(budget_remaining_secs "$scan_deadline")
+  # At the minimum one-second budget, spend the available time on the direct
+  # child scan. The indexed metadata pass is an optimization; running it first
+  # can consume the entire minimum budget before the authoritative state read.
+  if [ "$remaining" -gt 0 ] && [ "$DIRECT_SCAN_BUDGET_SECS" -gt 1 ]; then
+    pane_idle_index_dir=$PANE_IDLE_INDEX_DIR
+    if { [ -d "$pane_idle_index_dir" ] && [ ! -L "$pane_idle_index_dir" ]; } \
+      || { [ ! -e "$pane_idle_index_dir" ] && mkdir -p "$pane_idle_index_dir"; }; then
+      :
+    else
+      pane_idle_index_dir=
+    fi
+    if [ -n "$pane_idle_index_dir" ] \
+      && fm_pane_idle_meta_index_persist "$STATE" "$pane_idle_index_dir" "$scan_deadline"; then
+      :
+    else
+      pane_idle_index_dir=
+      complete=0
+      direct_deferred=1
+      find_retain=1
+    fi
+  else
+    complete=0
+    direct_deferred=1
+    find_retain=1
+  fi
+  while [ "$scan_failed" = 0 ] && [ "$find_ordered" = 1 ] && IFS= read -r -d '' meta; do
+    if [ "$pending_skip" -gt 0 ]; then
+      remaining=$(budget_remaining_secs "$scan_deadline")
+      if [ "$remaining" -le 0 ]; then
+        complete=0
+        direct_deferred=1
+        find_retain=1
+        batch_complete=0
+        break
+      fi
+      pending_skip=$((pending_skip - 1))
+      continue
+    fi
+    remaining=$(budget_remaining_secs "$scan_deadline")
+    if [ "$remaining" -le 0 ]; then
+      complete=0
+      direct_deferred=1
+      find_retain=1
+      batch_complete=0
+      break
+    fi
+    batch_consumed=$((batch_consumed + 1))
+    if [ ! -f "$meta" ] || [ -L "$meta" ]; then
+      if [ "$started" = 0 ] && [ "$meta" = "$STATE/$cursor.meta" ]; then
+        cursor=
+        started=1
+        cursor_seen=1
+        complete=0
+        direct_deferred=1
+        find_retain=1
+      fi
+      continue
+    fi
+    id=$(basename "$meta" .meta)
+    valid_task_id "$id" || continue
+    if [ "$started" = 0 ]; then
+      if [ ! -f "$STATE/$cursor.meta" ] || [ -L "$STATE/$cursor.meta" ]; then
+        cursor=
+        started=1
+        cursor_seen=1
+        complete=0
+        direct_deferred=1
+        find_retain=1
+      else
+        [ "$id" = "$cursor" ] || continue
+        current_cursor_identity=$(metadata_fingerprint "$STATE/$cursor.meta" 2>/dev/null || true)
+        if [ -n "$cursor_identity" ] && [ "$current_cursor_identity" != "$cursor_identity" ]; then
+          cursor=
+          cursor_identity=
+          started=1
+          cursor_seen=1
+          complete=0
+          direct_deferred=1
+          find_retain=1
+        else
+          started=1
+          cursor_seen=1
+          continue
+        fi
+      fi
+    fi
+    rc=0
+    child_remaining=$remaining
+    child_scan_deadline=$scan_deadline
+    if [ "$DIRECT_SCAN_BUDGET_SECS" -eq 1 ]; then
+      # A one-second minimum must still cover the child shell, lock proof, and
+      # durable receipt write. Keep this grace bounded and local to the child;
+      # the parent scan deadline still controls progress and cursor advancement.
+      child_remaining=$((child_remaining + 1))
+      child_scan_deadline=$((child_scan_deadline + 1000))
+    fi
+    (
+      export FM_LOCK_WAIT_SECS="$child_remaining"
+      export FM_INACTIVE_OUTCOME_SCAN_REMAINING_SECS="$child_remaining"
+      export FM_INACTIVE_OUTCOME_SCAN_DEADLINE_MS="$child_scan_deadline"
+      export FM_INACTIVE_OUTCOME_CHILD_BOUND=1
+      export FM_PANE_IDLE_META_INDEX_DIR="${pane_idle_index_dir:-}"
+      run_bounded_child "$child_remaining" "$SCRIPT_DIR/fm-inactive-reconcile.sh" _child "$id"
+    ) || rc=$?
+    if [ "$rc" -ne 0 ]; then
+      complete=0
+      case "$rc" in
+        75|124)
+          direct_deferred=1
+          find_retain=1
+          if [ -z "$retry_path" ]; then
+            retry_path=$DIRECT_FIND_RETRY
+            inactive_retry_file_prepare "$retry_path" || {
+              scan_failed=1
+              break
+            }
+          fi
+          inactive_append_nul_value "$retry_path" "$meta" "$scan_deadline"
+          append_rc=$?
+          if [ "$append_rc" = 124 ]; then
+            direct_deferred=1
+            batch_complete=0
+            break
+          elif [ "$append_rc" -ne 0 ]; then
+            scan_failed=1
+            batch_complete=0
+            break
+          fi
+          continue
+          ;;
+        *)
+          scan_failed=1
+          batch_complete=0
+          ;;
+      esac
+      [ "$scan_failed" = 0 ] || break
+      continue
+    fi
+    current_cursor_identity=$(metadata_fingerprint "$meta" 2>/dev/null || true)
+    if [ -n "$current_cursor_identity" ] \
+      && scan_cursor_write "$id" "$current_cursor_identity"; then
+      cursor_identity=$current_cursor_identity
+      :
+    else
+      rc=$?
+      complete=0
+      scan_failed=1
+      break
+    fi
+  done < "$find_tmp"
+  if [ "$find_pending_source" = 1 ] && [ "$batch_complete" = 1 ] \
+    && [ "$scan_failed" = 0 ] && [ -e "$DIRECT_FIND_INCOMPLETE" ]; then
+    inactive_pending_clear "$DIRECT_FIND_PENDING" "$DIRECT_FIND_OFFSET" || {
+      complete=0
+      scan_failed=1
+    }
+    find_source_drained=1
+    direct_deferred=1
+  fi
+  if [ "$find_pending_source" = 1 ] && [ "$batch_complete" = 1 ] \
+    && [ "$scan_failed" = 0 ]; then
+    find_retain=0
+  fi
+  if [ "$direct_deferred" = 1 ] && [ "$scan_failed" = 0 ]; then
+    find_retain=1
+  fi
+  if [ "$find_source_drained" = 1 ]; then
+    :
+  elif [ "$find_retain" = 1 ] && [ "$scan_failed" = 0 ]; then
+    inactive_persist_nul_suffix "$find_tmp" "$DIRECT_FIND_PENDING" "$batch_consumed" "" "$scan_deadline" || {
+      rc=$?
+      [ "$rc" -ne 0 ] || rc=1
+      complete=0
+      if [ "$rc" = 124 ]; then
+        direct_deferred=1
+      else
+        scan_failed=1
+      fi
+    }
+  elif [ "$find_pending_source" = 1 ] && [ "$scan_failed" = 0 ] \
+    && [ "$batch_complete" = 1 ]; then
+    inactive_pending_clear "$DIRECT_FIND_PENDING" "$DIRECT_FIND_OFFSET" || {
+      rc=$?
+      [ "$rc" -ne 0 ] || rc=1
+      complete=0
+      scan_failed=1
+    }
+  fi
+  if [ "$scan_failed" = 0 ] && [ "$find_enum_persisted" = 1 ]; then
+    inactive_enum_cursor_promote "$DIRECT_FIND_ENUM_CURSOR" || scan_failed=1
+    if [ "$scan_failed" = 0 ] && [ "$find_enum_complete" = 1 ]; then
+      rm -f "$DIRECT_FIND_ENUM_CURSOR" || scan_failed=1
+    fi
+  elif [ "$scan_failed" != 0 ]; then
+    inactive_enum_cursor_discard "$DIRECT_FIND_ENUM_CURSOR" || scan_failed=1
+  fi
+  if [ "$find_tmp_owned" = 1 ]; then
+    if ! rm -f "$find_tmp"; then
+      rc=$?
+      [ "$rc" -ne 0 ] || rc=1
+      complete=0
+      scan_failed=1
+    fi
+  fi
+  if [ "$maintenance_ran" = 0 ]; then
+    run_maintenance
+  fi
+  if [ "$scan_failed" = 1 ]; then
+    [ "$rc" -ne 0 ] || rc=1
+    return "$rc"
+  fi
+  [ "$maintenance_status" = 0 ] || return 1
+  if [ "$maintenance_deferred" = 1 ] || [ "$direct_deferred" = 1 ]; then
+    return 0
+  fi
+  [ "$complete" = 1 ] || return 1
+  if [ "$cursor_seen" = 0 ]; then
+    if [ -n "$cursor" ] && { [ ! -f "$STATE/$cursor.meta" ] || [ -L "$STATE/$cursor.meta" ]; }; then
+      return 0
+    fi
+    if [ -n "$cursor" ] && [ -n "$cursor_identity" ]; then
+      current_cursor_identity=$(metadata_fingerprint "$STATE/$cursor.meta" 2>/dev/null || true)
+      [ "$current_cursor_identity" != "$cursor_identity" ] && return 0
+    fi
+    return 1
+  fi
+  if [ "$complete" = 1 ]; then
+    rm -f "$SCAN_CURSOR" "$SCAN_CURSOR_IDENTITY" || return 1
+  fi
+  date +%s | fm_nofollow_write "$SCAN_MARKER" || return 1
+  return 0
+}
+
+scan() {
+  local startup=${1:-0} rc
+  scan_abort() {
+    local status=$1
+    fm_lock_release "$SCAN_LOCK" || true
+    trap - EXIT INT TERM
+    exit "$status"
+  }
+  inactive_state_preflight || return 1
+  fm_lock_acquire_wait "$SCAN_LOCK" || return 1
+  trap 'fm_lock_release "$SCAN_LOCK" || true' EXIT
+  trap 'scan_abort 130' INT
+  trap 'scan_abort 143' TERM
+  scan_locked "$startup"
+  rc=$?
+  fm_lock_release "$SCAN_LOCK" || true
+  trap - EXIT INT TERM
+  return "$rc"
+}
+
+case "${1:-}" in
+  scan)
+    if [ "${2:-}" = --startup ]; then
+      scan 1
+    else
+      scan 0
+    fi
+    ;;
+  ack)
+    [ -n "${2:-}" ] && [ -n "${3:-}" ] || exit 2
+    ack_receipt "$2" "$3" "${4:-1}" "${5:-}"
+    ;;
+  confirm)
+    [ -n "${2:-}" ] && [ -n "${3:-}" ] || exit 2
+    confirm_receipt "$2" "$3"
+    ;;
+  claim)
+    [ -n "${2:-}" ] && [ -n "${3:-}" ] || exit 2
+    claim_reserve "$2" "$3"
+    ;;
+  presenting)
+    [ -n "${2:-}" ] && [ -n "${3:-}" ] || exit 2
+    claim_mark_presenting "$2" "$3"
+    ;;
+  output-started)
+    [ -n "${2:-}" ] && [ -n "${3:-}" ] || exit 2
+    claim_mark_output_started "$2" "$3"
+    ;;
+  output-emitted)
+    [ -n "${2:-}" ] && [ -n "${3:-}" ] || exit 2
+    claim_mark_output_emitted "$2" "$3"
+    ;;
+  output-emitted-state)
+    [ -n "${2:-}" ] && [ -n "${3:-}" ] || exit 2
+    claim_output_emitted "$2" "$3"
+    ;;
+  output-confirmed)
+    [ -n "${2:-}" ] && [ -n "${3:-}" ] || exit 2
+    claim_mark_output_confirmed "$2" "$3"
+    ;;
+  output-complete)
+    [ -n "${2:-}" ] && [ -n "${3:-}" ] || exit 2
+    claim_mark_output_complete "$2" "$3"
+    ;;
+  caller-output-complete)
+    [ -n "${2:-}" ] && [ -n "${3:-}" ] || exit 2
+    caller_output_complete "$2" "$3" "${4:-}"
+    ;;
+  caller-output-complete-locked)
+    [ -n "${2:-}" ] && [ -n "${3:-}" ] || exit 2
+    claim_mark_output_complete "$2" "$3" 0 "${4:-}"
+    ;;
+  presented)
+    [ -n "${2:-}" ] && [ -n "${3:-}" ] || exit 2
+    claim_mark_presented "$2" "$3"
+    ;;
+  _child)
+    [ -n "${2:-}" ] || exit 2
+    reconcile_child "$2"
+    ;;
+  _pane-idle)
+    [ -n "${8:-}" ] || exit 2
+    unset FM_PANE_IDLE_META_INDEX_DIR
+    fm_pane_idle_proof_valid "$2" "$3" "$4" "$5" "$6" "$7" "$8"
+    ;;
+  *)
+    echo "usage: fm-inactive-reconcile.sh scan [--startup] | ack <inactive-outcome:key> <wake-row>" >&2
+    exit 2
+    ;;
+esac
diff --git a/bin/fm-pane-idle-lib.sh b/bin/fm-pane-idle-lib.sh
new file mode 100644
index 00000000000..3ed6a82ac1a
--- /dev/null
+++ b/bin/fm-pane-idle-lib.sh
@@ -0,0 +1,1944 @@
+#!/usr/bin/env bash
+
+_FM_PANE_IDLE_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=bin/fm-safe-io-lib.sh
+. "$_FM_PANE_IDLE_LIB_DIR/fm-safe-io-lib.sh"
+
+FM_PANE_IDLE_BUSY_REGEX_DEFAULT='esc (to )?interrupt|Working\.\.\.|Ctrl\+c:cancel'
+FM_PANE_IDLE_META_INDEX_STATE=
+FM_PANE_IDLE_META_INDEX_STATE_STAMP=
+FM_PANE_IDLE_META_INDEX_SNAPSHOT=
+FM_PANE_IDLE_META_INDEX_BUILT=0
+
+fm_pane_idle_meta_value_unique() {  # <meta> <key>
+  awk -F= -v wanted="$2" '
+    $1 == wanted { count++; value=substr($0, index($0, "=") + 1) }
+    END {
+      if (count == 1) { print value; exit 0 }
+      if (count == 0) exit 1
+      exit 2
+    }
+  ' "$1" 2>/dev/null
+}
+
+fm_pane_idle_now_ms() {
+  if command -v clock_millis >/dev/null 2>&1; then
+    clock_millis
+  else
+    printf '%s000' "$(date +%s)"
+  fi
+}
+
+fm_pane_idle_budget_secs() {
+  local deadline_ms=$1 now
+  case "$deadline_ms" in ''|*[!0-9]*) printf '300'; return 0 ;; esac
+  now=$(fm_pane_idle_now_ms)
+  [ "$deadline_ms" -gt "$now" ] || return 1
+  printf '%s' "$(((deadline_ms - now + 999) / 1000))"
+}
+
+fm_pane_idle_run_bounded_child() {
+  local seconds=$1
+  shift
+  if command -v timeout >/dev/null 2>&1; then
+    timeout "$seconds" "$@"
+  elif command -v gtimeout >/dev/null 2>&1; then
+    gtimeout "$seconds" "$@"
+  elif command -v perl >/dev/null 2>&1; then
+    perl -e 'my $t = shift; my $pid = fork; die "fork failed" unless defined $pid; if (!$pid) { setpgrp(0, 0); exec @ARGV or exit 127 } local $SIG{ALRM} = sub { kill "TERM", -$pid; select undef, undef, undef, 0.2; kill "KILL", -$pid; exit 124 }; alarm $t; waitpid $pid, 0; my $status = $?; exit(($status & 127) ? 128 + ($status & 127) : ($status >> 8))' "$seconds" "$@"
+  else
+    return 125
+  fi
+}
+
+fm_pane_idle_run_bounded_perl() {
+  local deadline_ms=$1 remaining
+  shift
+  if [ -n "$deadline_ms" ]; then
+    remaining=$(fm_pane_idle_budget_secs "$deadline_ms") || return 124
+    fm_pane_idle_run_bounded_child "$remaining" perl - "$@"
+  else
+    perl - "$@"
+  fi
+}
+
+fm_pane_idle_compare_files() {
+  local left=$1 right=$2 deadline_ms=${3:-} remaining
+  [ -f "$left" ] && [ ! -L "$left" ] || return 1
+  [ -f "$right" ] && [ ! -L "$right" ] || return 1
+  if [ -n "$deadline_ms" ]; then
+    remaining=$(fm_pane_idle_budget_secs "$deadline_ms") || return 124
+    fm_pane_idle_run_bounded_child "$remaining" cmp -s "$left" "$right"
+  else
+    cmp -s "$left" "$right"
+  fi
+}
+
+fm_pane_idle_meta_freshness_path() {
+  printf '%s/.pane-idle-meta-index/.metadata-freshness' "$1"
+}
+
+fm_pane_idle_meta_freshness_bump() {
+  local state=$1 boundary_dir boundary_path tmp value
+  [ -d "$state" ] && [ ! -L "$state" ] || return 1
+  boundary_dir="$state/.pane-idle-meta-index"
+  if [ -e "$boundary_dir" ] || [ -L "$boundary_dir" ]; then
+    [ -d "$boundary_dir" ] && [ ! -L "$boundary_dir" ] || return 1
+  else
+    mkdir "$boundary_dir" || return 1
+  fi
+  boundary_path="$boundary_dir/.metadata-freshness"
+  [ ! -L "$boundary_path" ] || return 1
+  value="$(fm_pane_idle_now_ms).$$.${RANDOM:-0}"
+  tmp=$(mktemp "$boundary_path.XXXXXX") || return 1
+  [ -f "$tmp" ] && [ ! -L "$tmp" ] || { rm -f "$tmp"; return 1; }
+  printf '%s\n' "$value" | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 1; }
+  [ ! -L "$boundary_path" ] && fm_nofollow_rename "$tmp" "$boundary_path" || {
+    rm -f "$tmp"
+    return 1
+  }
+}
+
+fm_pane_idle_path_stamp() {
+  local path=$1 deadline_ms=${2:-} boundary boundary_value
+  [ -d "$path" ] && [ ! -L "$path" ] || return 1
+  boundary=$(fm_pane_idle_meta_freshness_path "$path")
+  if [ -f "$boundary" ] && [ ! -L "$boundary" ]; then
+    boundary_value=$(head -n 1 "$boundary" 2>/dev/null || true)
+    case "$boundary_value" in
+      ''|*[!A-Za-z0-9._-]*) ;;
+      *) printf '%s' "$boundary_value"; return 0 ;;
+    esac
+  fi
+  fm_pane_idle_run_bounded_perl "$deadline_ms" "$path" <<'PERL'
+use strict;
+use warnings;
+use Digest::SHA qw(sha256_hex);
+use Time::HiRes qw(stat);
+
+my $state = shift @ARGV;
+my @info = stat($state) or exit 1;
+print sha256_hex(join("\0", @info[0, 1, 2, 7, 9, 10, 11]));
+PERL
+}
+
+fm_pane_idle_meta_index_entries_build() {
+  local state=$1 entries_path=$2 complete_path=$3 entries_stamp_path=$4 deadline_ms=${5:-}
+  local partial_path="$entries_path.partial" cookie_path="$entries_path.cookie"
+  local source_stamp_path="$entries_path.source-stamp" remaining rc
+  [ -d "$state" ] && [ ! -L "$state" ] || return 1
+  [ ! -L "$entries_path" ] && [ ! -L "$complete_path" ] || return 1
+  [ ! -L "$entries_stamp_path" ] && [ ! -L "$partial_path" ] || return 1
+  [ ! -L "$cookie_path" ] && [ ! -L "$source_stamp_path" ] || return 1
+  remaining=$(fm_pane_idle_budget_secs "$deadline_ms") || return 124
+  fm_pane_idle_run_bounded_child "$remaining" perl - "$state" "$entries_path" \
+    "$complete_path" "$entries_stamp_path" "$partial_path" "$cookie_path" \
+    "$source_stamp_path" <<'PERL'
+use strict;
+use warnings;
+use Fcntl qw(:DEFAULT);
+use Digest::SHA qw(sha256_hex);
+use Time::HiRes qw(stat);
+
+my ($state, $entries, $complete, $stamp_path, $partial, $cookie_path, $source_stamp) = @ARGV;
+my $nofollow = eval { Fcntl::O_NOFOLLOW() };
+defined($nofollow) or exit 1;
+my $boundary = "$state/.pane-idle-meta-index/.metadata-freshness";
+sub atomic_write {
+  my ($path, $value) = @_;
+  return 0 if -l $path;
+  my $tmp = "$path.tmp.$$";
+  my $fh;
+  sysopen($fh, $tmp, O_WRONLY | O_CREAT | O_EXCL | $nofollow, 0600) or return 0;
+  binmode($fh);
+  return 0 unless print($fh $value) && close($fh);
+  return 0 if -l $path;
+  rename($tmp, $path) or return 0;
+  return 1;
+}
+sub open_append {
+  my ($path) = @_;
+  return undef if -l $path;
+  my $flags = O_WRONLY | O_APPEND;
+  if (-e $path) {
+    return undef unless -f $path;
+    $flags |= $nofollow;
+  } else {
+    $flags |= O_CREAT | O_EXCL;
+  }
+  my $fh;
+  sysopen($fh, $path, $flags, 0600) or return undef;
+  return $fh;
+}
+sub dir_stamp {
+  if (-f $boundary && !-l $boundary) {
+    open(my $bfh, '<', $boundary) or return undef;
+    local $/;
+    my $value = <$bfh> // '';
+    close($bfh) or return undef;
+    chomp $value;
+    return $value if $value =~ /\A[A-Za-z0-9._-]+\z/;
+  }
+  my @info = stat($state) or return undef;
+  return sha256_hex(join("\0", @info[0, 1, 2, 7, 9, 10, 11]));
+}
+sub read_text {
+  my ($path) = @_;
+  return '' unless -e $path;
+  return undef if -l $path || !-f $path;
+  open(my $fh, '<', $path) or return undef;
+  local $/;
+  my $value = <$fh> // '';
+  close($fh) or return undef;
+  chomp $value;
+  return $value;
+}
+my $start = dir_stamp();
+defined($start) or exit 1;
+my $old = read_text($source_stamp);
+defined($old) or exit 1 if -e $source_stamp;
+if (!defined($old) || $old ne $start) {
+  unlink($partial, $cookie_path, $entries, $complete, $stamp_path);
+  atomic_write($source_stamp, "$start\n") or exit 1;
+}
+my $cookie = read_text($cookie_path);
+defined($cookie) or exit 1 if -e $cookie_path;
+$cookie = '' unless defined($cookie) && ($cookie eq 'EOF' || $cookie =~ /^\d+\z/);
+if ($cookie ne 'EOF') {
+  my $pfh = open_append($partial) or exit 1;
+  select((select($pfh), $| = 1)[0]);
+  opendir(my $dh, $state) or exit 1;
+  seekdir($dh, 0 + $cookie) or exit 1 if $cookie ne '';
+  while (defined(my $entry = readdir($dh))) {
+    my $next = telldir($dh);
+    defined($next) or exit 1;
+    if ($entry =~ /\.meta\z/ && $entry !~ /[\r\n]/) {
+      my $path = "$state/$entry";
+      if (-f $path && !-l $path) {
+        print($pfh $path, "\n") or exit 1;
+      }
+    }
+    atomic_write($cookie_path, "$next\n") or exit 1;
+  }
+  closedir($dh) or exit 1;
+  close($pfh) or exit 1;
+  atomic_write($cookie_path, "EOF\n") or exit 1;
+  $cookie = 'EOF';
+}
+my $finish = dir_stamp();
+defined($finish) or exit 1;
+if ($finish ne $start) {
+  unlink($partial, $cookie_path, $entries, $complete, $stamp_path);
+  atomic_write($source_stamp, "$finish\n") or exit 1;
+  exit 75;
+}
+open(my $pfh, '<', $partial) or exit 1;
+my %seen;
+my @paths;
+while (defined(my $path = <$pfh>)) {
+  chomp $path;
+  next unless $path =~ /\A\Q$state\E\/[^\/\r\n]+\.meta\z/;
+  next unless -f $path && !-l $path;
+  next if $seen{$path}++;
+  push @paths, $path;
+}
+close($pfh) or exit 1;
+@paths = sort @paths;
+atomic_write($entries, join('', map { "$_\n" } @paths)) or exit 1;
+atomic_write($stamp_path, "$finish\n") or exit 1;
+atomic_write($complete, "complete\n") or exit 1;
+unlink($partial, $cookie_path, $source_stamp) or exit 1;
+PERL
+  rc=$?
+  [ "$rc" = 75 ] && return 124
+  [ "$rc" -ne 0 ] || return 0
+  return "$rc"
+}
+
+fm_pane_idle_meta_index_collect() {
+  local state=$1 output=$2 deadline_ms=${3:-} worker rc remaining sorted_tmp state_stamp entries_stamp post_state_stamp
+  local progress_dir cursor_path records_path complete_path seen_path aggregate_path aggregate_cursor_path
+  local aggregate_complete_path sorted_path sorted_complete_path entries_path entries_complete_path entries_stamp_path
+  case "$deadline_ms" in ''|*[!0-9]*) deadline_ms=;; esac
+  [ -d "$state" ] && [ ! -L "$state" ] || return 1
+  [ ! -L "$output" ] || return 1
+  case "$output" in "$state"/*) ;; *) return 1 ;; esac
+  progress_dir="$state/.pane-idle-meta-index"
+  if [ -e "$progress_dir" ] || [ -L "$progress_dir" ]; then
+    [ -d "$progress_dir" ] && [ ! -L "$progress_dir" ] || return 1
+  else
+    mkdir "$progress_dir" || return 1
+  fi
+  cursor_path="$progress_dir/.scan.cursor"
+  records_path="$progress_dir/.scan.records"
+  complete_path="$progress_dir/.scan.complete"
+  seen_path="$progress_dir/.scan.seen"
+  aggregate_path="$progress_dir/.scan.aggregate"
+  aggregate_cursor_path="$progress_dir/.scan.aggregate.cursor"
+  aggregate_complete_path="$progress_dir/.scan.aggregate.complete"
+  sorted_path="$progress_dir/.scan.sorted"
+  sorted_complete_path="$progress_dir/.scan.sorted.complete"
+  entries_path="$progress_dir/.scan.entries"
+  entries_complete_path="$progress_dir/.scan.entries.complete"
+  entries_stamp_path="$progress_dir/.scan.entries.stamp"
+  for path in "$cursor_path" "$records_path" "$complete_path" "$seen_path" \
+    "$aggregate_path" "$aggregate_cursor_path" "$aggregate_complete_path" \
+    "$sorted_path" "$sorted_complete_path" "$entries_path" \
+    "$entries_complete_path" "$entries_stamp_path"; do
+    if [ -e "$path" ] || [ -L "$path" ]; then
+      [ -f "$path" ] && [ ! -L "$path" ] || return 1
+    fi
+  done
+  if [ -e "$complete_path" ]; then
+    rm -f "$cursor_path" "$records_path" "$seen_path" "$aggregate_path" \
+      "$aggregate_cursor_path" "$aggregate_complete_path" "$sorted_path" \
+      "$sorted_complete_path" "$complete_path" || return 1
+  fi
+  while :; do
+    if [ -n "$deadline_ms" ] && [ "$(fm_pane_idle_now_ms)" -ge "$deadline_ms" ]; then
+      return 124
+    fi
+    state_stamp=$(fm_pane_idle_path_stamp "$state" "$deadline_ms") || return $?
+    entries_stamp=
+    source_stamp=$(cat "$entries_path.source-stamp" 2>/dev/null || true)
+    if [ -f "$entries_path" ] && [ ! -L "$entries_path" ] \
+      && [ -f "$entries_complete_path" ] && [ ! -L "$entries_complete_path" ] \
+      && [ -f "$entries_stamp_path" ] && [ ! -L "$entries_stamp_path" ]; then
+      entries_stamp=$(cat "$entries_stamp_path" 2>/dev/null || true)
+    fi
+    if [ "$entries_stamp" != "$state_stamp" ]; then
+      if [ "$source_stamp" != "$state_stamp" ]; then
+        rm -f "$entries_path" "$entries_complete_path" "$entries_stamp_path" \
+          "$entries_path.partial" "$entries_path.cookie" "$entries_path.source-stamp" \
+          || return 1
+      else
+        rm -f "$entries_path" "$entries_complete_path" "$entries_stamp_path" || return 1
+      fi
+      rm -f \
+        "$cursor_path" "$records_path" "$seen_path" "$aggregate_path" \
+        "$aggregate_cursor_path" "$aggregate_complete_path" "$sorted_path" \
+        "$sorted_complete_path" || return 1
+      fm_pane_idle_meta_index_entries_build "$state" "$entries_path" \
+        "$entries_complete_path" "$entries_stamp_path" "$deadline_ms"
+      rc=$?
+      if [ "$rc" -ne 0 ]; then
+        return "$rc"
+      fi
+    fi
+    break
+  done
+  command -v perl >/dev/null 2>&1 || return 125
+  perl - "$state" "$entries_path" "$cursor_path" "$records_path" "$complete_path" "$seen_path" "$deadline_ms" <<'PERL' &
+use strict;
+use warnings;
+use Fcntl qw(:DEFAULT);
+
+my ($state, $entries_path, $cursor_path, $records_path, $complete_path, $seen_path, $deadline, $output) = @ARGV;
+$deadline = undef unless defined($deadline) && $deadline =~ /^\d+\z/ && $deadline ne '';
+my $nofollow = eval { Fcntl::O_NOFOLLOW() };
+
+sub open_read {
+  my ($path) = @_;
+  return undef if -l $path || !defined($nofollow);
+  my $fh;
+  sysopen($fh, $path, O_RDONLY | $nofollow) or return undef;
+  return $fh;
+}
+
+sub open_append {
+  my ($path) = @_;
+  return undef if -l $path;
+  my $flags = O_WRONLY | O_APPEND;
+  if (-e $path) {
+    return undef unless -f $path && defined($nofollow);
+    $flags |= $nofollow;
+  } else {
+    $flags |= O_CREAT | O_EXCL;
+  }
+  my $fh;
+  sysopen($fh, $path, $flags, 0600) or return undef;
+  return $fh;
+}
+
+sub write_atomic {
+  my ($path, $value) = @_;
+  return 0 if -l $path;
+  my $tmp = "$path.tmp.$$";
+  my $fh;
+  sysopen($fh, $tmp, O_WRONLY | O_CREAT | O_EXCL, 0600) or return 0;
+  binmode($fh);
+  if (!print($fh $value) || !close($fh)) {
+    close($fh);
+    return 0;
+  }
+  return 0 if -l $path;
+  rename($tmp, $path) or return 0;
+  return 1;
+}
+
+sub open_output {
+  my ($path) = @_;
+  return undef if -l $path || !-f $path || !defined($nofollow);
+  my $fh;
+  sysopen($fh, $path, O_WRONLY | O_TRUNC | $nofollow) or return undef;
+  return $fh;
+}
+
+sub repair_records_tail {
+  my ($path) = @_;
+  return 1 if -l $path || !-f $path;
+  my $fh = open_read($path) or return 0;
+  binmode($fh);
+  local $/ = "\0";
+  my $tail_start = 0;
+  my $partial = 0;
+  while (1) {
+    $tail_start = tell($fh);
+    defined($tail_start) or return 0;
+    my $meta = <$fh>;
+    last unless defined($meta);
+    my $window = <$fh>;
+    my $count = <$fh>;
+    if (!defined($window) || !defined($count)
+        || $meta !~ /\0\z/ || $window !~ /\0\z/ || $count !~ /\0\z/) {
+      $partial = 1;
+      last;
+    }
+  }
+  close($fh) or return 0;
+  return 1 unless $partial;
+  my $wfh;
+  sysopen($wfh, $path, O_RDWR | $nofollow) or return 0;
+  my $ok = truncate($wfh, $tail_start);
+  $ok = 0 unless close($wfh);
+  return $ok ? 1 : 0;
+}
+
+sub expired {
+  return defined($deadline) && int(time() * 1000) >= $deadline;
+}
+
+my $cursor = '';
+if (-e $cursor_path) {
+  my $cfh = open_read($cursor_path) or exit 1;
+  local $/;
+  my $raw_cursor = <$cfh> // '';
+  $raw_cursor =~ /\A(.*)\n\z/s or exit 1;
+  $cursor = $1;
+  close($cfh) or exit 1;
+  $cursor ne '' or exit 1;
+}
+if ($cursor ne '' && $cursor ne 'EOF') {
+  $cursor =~ /\A\Q$state\E\/[^\/\r\n\x00]+\.meta\z/ or exit 1;
+  if (-e $cursor || -l $cursor) {
+    (-f $cursor && !-l $cursor) or exit 1;
+  }
+}
+
+my %record_keys;
+my %seen_paths;
+my $state_loaded = 0;
+while (1) {
+  exit 124 if expired();
+  exit 1 unless -d $state && !-l $state;
+  if (!-e $records_path) {
+    my $rfh = open_append($records_path) or exit 1;
+    close($rfh) or exit 1;
+  }
+  if (!-e $seen_path) {
+    my $sfh = open_append($seen_path) or exit 1;
+    close($sfh) or exit 1;
+  }
+  exit 0 if $cursor eq 'EOF';
+  if (!$state_loaded) {
+    repair_records_tail($records_path) or exit 1;
+    my $rfh = open_read($records_path) or exit 1;
+    binmode($rfh);
+    {
+      local $/ = "\0";
+      while (defined(my $record_path = <$rfh>)) {
+        exit 124 if expired();
+        my $record_window = <$rfh>;
+        my $record_count = <$rfh>;
+        defined($record_window) && defined($record_count) or exit 1;
+        $record_path =~ s/\0\z// or exit 1;
+        $record_window =~ s/\0\z// or exit 1;
+        $record_count =~ s/\0\z// or exit 1;
+        $record_keys{$record_path . "\0" . $record_window . "\0" . $record_count} = 1;
+      }
+    }
+    close($rfh) or exit 1;
+    my $sfh = open_read($seen_path) or exit 1;
+    while (defined(my $seen_path_value = <$sfh>)) {
+      exit 124 if expired();
+      chomp $seen_path_value;
+      $seen_paths{$seen_path_value} = 1;
+    }
+    close($sfh) or exit 1;
+    $state_loaded = 1;
+  }
+  my $efh = open_read($entries_path) or exit 1;
+  binmode($efh);
+  while (defined(my $path = <$efh>)) {
+    exit 124 if expired();
+    chomp $path;
+    next if $path !~ /\.meta\z/ || $path =~ /[\r\n]/;
+    next if $cursor ne '' && $path le $cursor;
+    $path =~ /\A\Q$state\E\/[^\/]+\.meta\z/ or exit 1;
+    if (-f $path && !-l $path) {
+      my $fh = open_read($path) or exit 1;
+      my ($window, $window_count) = ('', 0);
+      while (defined(my $line = <$fh>)) {
+        exit 124 if expired();
+        chomp $line;
+        next unless $line =~ /^window=(.*)\z/;
+        $window = $1;
+        $window_count++;
+      }
+      close($fh) or exit 1;
+      if ($window_count == 1 && $window ne '') {
+        my $record_key = $path . "\0" . $window . "\0" . "1";
+        if (!$record_keys{$record_key}) {
+          my $rfh = open_append($records_path) or exit 1;
+          binmode($rfh);
+          print $rfh $path, "\0", $window, "\0", "1", "\0" or exit 1;
+          close($rfh) or exit 1;
+          $record_keys{$record_key} = 1;
+        }
+      }
+    }
+    if (!$seen_paths{$path}) {
+      my $sfh = open_append($seen_path) or exit 1;
+      print $sfh $path, "\n" or exit 1;
+      close($sfh) or exit 1;
+      $seen_paths{$path} = 1;
+    }
+    write_atomic($cursor_path, "$path\n") or exit 1;
+    $cursor = $path;
+  }
+  close($efh) or exit 1;
+  write_atomic($cursor_path, "EOF\n") or exit 1;
+  $cursor = 'EOF';
+}
+PERL
+  worker=$!
+  while kill -0 "$worker" 2>/dev/null; do
+    if [ -n "$deadline_ms" ] && [ "$(fm_pane_idle_now_ms)" -ge "$deadline_ms" ]; then
+      kill -TERM "$worker" 2>/dev/null || true
+      kill -KILL "$worker" 2>/dev/null || true
+      wait "$worker" 2>/dev/null || true
+      rm -f "$output"
+      return 124
+    fi
+    sleep 0.01
+  done
+  wait "$worker"
+  rc=$?
+  rm -f "$cursor_path.tmp.$worker" "$complete_path.tmp.$worker"
+  if [ "$rc" -ne 0 ]; then
+    rm -f "$output"
+    return "$rc"
+  fi
+  if [ ! -e "$aggregate_complete_path" ]; then
+    remaining=$(fm_pane_idle_budget_secs "$deadline_ms") || {
+      rm -f "$output"
+      return 124
+    }
+    if fm_pane_idle_run_bounded_child "$remaining" perl - "$records_path" \
+      "$aggregate_path" "$aggregate_cursor_path" "$aggregate_complete_path" <<'PERL'
+use strict;
+use warnings;
+use Fcntl qw(:DEFAULT);
+
+my ($records_path, $aggregate_path, $cursor_path, $complete_path) = @ARGV;
+my $nofollow = eval { Fcntl::O_NOFOLLOW() };
+defined($nofollow) or exit 1;
+sub open_read {
+  my ($path) = @_;
+  return undef if -l $path || !-f $path;
+  my $fh;
+  sysopen($fh, $path, O_RDONLY | $nofollow) or return undef;
+  return $fh;
+}
+sub open_append {
+  my ($path) = @_;
+  return undef if -l $path;
+  my $flags = O_WRONLY | O_APPEND;
+  if (-e $path) {
+    return undef unless -f $path;
+    $flags |= $nofollow;
+  } else {
+    $flags |= O_CREAT | O_EXCL;
+  }
+  my $fh;
+  sysopen($fh, $path, $flags, 0600) or return undef;
+  return $fh;
+}
+sub write_atomic {
+  my ($path, $value) = @_;
+  return 0 if -l $path;
+  my $tmp = "$path.tmp.$$";
+  my $fh;
+  sysopen($fh, $tmp, O_WRONLY | O_CREAT | O_EXCL, 0600) or return 0;
+  binmode($fh);
+  return 0 unless print($fh $value) && close($fh);
+  return 0 if -l $path;
+  rename($tmp, $path) or return 0;
+  return 1;
+}
+sub repair_records_tail {
+  my ($path) = @_;
+  return 1 if -l $path || !-f $path;
+  my $fh = open_read($path) or return 0;
+  binmode($fh);
+  local $/ = "\0";
+  my $tail_start = 0;
+  my $partial = 0;
+  while (1) {
+    $tail_start = tell($fh);
+    defined($tail_start) or return 0;
+    my $meta = <$fh>;
+    last unless defined($meta);
+    my $window = <$fh>;
+    my $count = <$fh>;
+    if (!defined($window) || !defined($count)
+        || $meta !~ /\0\z/ || $window !~ /\0\z/ || $count !~ /\0\z/) {
+      $partial = 1;
+      last;
+    }
+  }
+  close($fh) or return 0;
+  return 1 unless $partial;
+  my $wfh;
+  sysopen($wfh, $path, O_RDWR | $nofollow) or return 0;
+  my $ok = truncate($wfh, $tail_start);
+  $ok = 0 unless close($wfh);
+  return $ok ? 1 : 0;
+}
+sub repair_newline_tail {
+  my ($path) = @_;
+  return 1 if !-e $path;
+  return 0 if -l $path || !-f $path;
+  my $fh;
+  sysopen($fh, $path, O_RDWR | $nofollow) or return 0;
+  binmode($fh);
+  seek($fh, 0, 2) or return 0;
+  my $size = tell($fh);
+  defined($size) or return 0;
+  if ($size > 0) {
+    seek($fh, $size - 1, 0) or return 0;
+    my $last = getc($fh);
+    return 0 unless defined($last);
+    if ($last ne "\n") {
+      my $position = $size;
+      my $boundary = 0;
+      while ($position > 0) {
+        my $start = $position > 4096 ? $position - 4096 : 0;
+        my $length = $position - $start;
+        seek($fh, $start, 0) or return 0;
+        my $buffer = '';
+        read($fh, $buffer, $length) == $length or return 0;
+        for (my $index = length($buffer) - 1; $index >= 0; $index--) {
+          if (substr($buffer, $index, 1) eq "\n") {
+            $boundary = $start + $index + 1;
+            last;
+          }
+        }
+        last if $boundary;
+        $position = $start;
+      }
+      truncate($fh, $boundary) or return 0;
+    }
+  }
+  close($fh) or return 0;
+  return 1;
+}
+repair_records_tail($records_path) or exit 1;
+repair_newline_tail($aggregate_path) or exit 1;
+my $offset = 0;
+if (-e $cursor_path) {
+  my $cfh = open_read($cursor_path) or exit 1;
+  my $value = <$cfh> // '';
+  close($cfh) or exit 1;
+  chomp $value;
+  $value =~ /^\d+\z/ or exit 1;
+  $offset = 0 + $value;
+}
+my $rfh = open_read($records_path) or exit 1;
+seek($rfh, $offset, 0) or exit 1;
+my %aggregate_lines;
+if (-e $aggregate_path) {
+  my $existing_afh = open_read($aggregate_path) or exit 1;
+  while (defined(my $line = <$existing_afh>)) {
+    chomp $line;
+    $aggregate_lines{$line} = 1;
+  }
+  close($existing_afh) or exit 1;
+}
+my $afh = open_append($aggregate_path) or exit 1;
+binmode($rfh);
+binmode($afh);
+local $/ = "\0";
+while (defined(my $meta = <$rfh>)) {
+  my $window = <$rfh>;
+  my $count = <$rfh>;
+  last unless defined($window) && defined($count);
+  $meta =~ s/\0\z// or exit 1;
+  $window =~ s/\0\z// or exit 1;
+  $count =~ s/\0\z// or exit 1;
+  $window =~ /^\S+\z/ or exit 1;
+  $count =~ /^\d+\z/ or exit 1;
+  my $line = unpack('H*', $window) . "\t" . unpack('H*', $meta);
+  if (!$aggregate_lines{$line}) {
+    print $afh $line, "\n" or exit 1;
+    $aggregate_lines{$line} = 1;
+  }
+  my $position = tell($rfh);
+  defined($position) or exit 1;
+  write_atomic($cursor_path, "$position\n") or exit 1;
+}
+close($rfh) or exit 1;
+close($afh) or exit 1;
+write_atomic($complete_path, "complete\n") or exit 1;
+PERL
+    then :
+    else
+      rc=$?
+      [ "$rc" -ne 0 ] || rc=124
+      rm -f "$output"
+      return "$rc"
+    fi
+  fi
+  if [ ! -e "$sorted_complete_path" ]; then
+    remaining=$(fm_pane_idle_budget_secs "$deadline_ms") || {
+      rm -f "$output"
+      return 124
+    }
+    sorted_tmp=$(mktemp "$sorted_path.XXXXXX") || {
+      rm -f "$output"
+      return 1
+    }
+    [ -f "$sorted_tmp" ] && [ ! -L "$sorted_tmp" ] || {
+      rm -f "$sorted_tmp" "$output"
+      return 1
+    }
+    if fm_pane_idle_run_bounded_child "$remaining" env LC_ALL=C sort -u \
+      "$aggregate_path" | fm_nofollow_write "$sorted_tmp" \
+      && fm_nofollow_rename "$sorted_tmp" "$sorted_path" \
+      && fm_pane_idle_meta_index_cursor_write "$sorted_complete_path" complete; then
+      :
+    else
+      rc=$?
+      [ "$rc" -ne 0 ] || rc=124
+      rm -f "$sorted_tmp" "$output"
+      return "$rc"
+    fi
+  fi
+  remaining=$(fm_pane_idle_budget_secs "$deadline_ms") || {
+    rm -f "$output"
+    return 124
+  }
+  if fm_pane_idle_run_bounded_child "$remaining" perl - "$sorted_path" "$output" <<'PERL'
+use strict;
+use warnings;
+use Fcntl qw(:DEFAULT);
+
+my ($sorted_path, $output) = @ARGV;
+my $nofollow = eval { Fcntl::O_NOFOLLOW() };
+defined($nofollow) or exit 1;
+open(my $sfh, '<', $sorted_path) or exit 1;
+binmode($sfh);
+my $ofh;
+sysopen($ofh, $output, O_WRONLY | O_TRUNC | $nofollow) or exit 1;
+binmode($ofh);
+my ($window, $first_meta, $count) = ('', '', 0);
+sub flush_window {
+  return unless $count;
+  print $ofh $first_meta, "\0", $window, "\0", $count, "\0" or exit 1;
+}
+while (defined(my $line = <$sfh>)) {
+  chomp $line;
+  my ($window_hex, $meta_hex) = split(/\t/, $line, 2);
+  exit 1 unless defined($window_hex) && defined($meta_hex)
+    && $window_hex =~ /\A(?:[0-9A-Fa-f]{2})*\z/
+    && $meta_hex =~ /\A(?:[0-9A-Fa-f]{2})*\z/;
+  my $current_window = pack('H*', $window_hex);
+  my $current_meta = pack('H*', $meta_hex);
+  if ($current_window ne $window) {
+    flush_window();
+    $window = $current_window;
+    $first_meta = $current_meta;
+    $count = 1;
+  } else {
+    $count++;
+  }
+}
+close($sfh) or exit 1;
+flush_window();
+close($ofh) or exit 1;
+PERL
+  then :
+  else
+    rc=$?
+    [ "$rc" -ne 0 ] || rc=124
+    rm -f "$output"
+    return "$rc"
+  fi
+  post_state_stamp=$(fm_pane_idle_path_stamp "$state" "$deadline_ms") || {
+    rc=$?
+    rm -f "$output"
+    return "$rc"
+  }
+  if [ "$post_state_stamp" != "$state_stamp" ]; then
+    rm -f "$output" "$entries_path" "$entries_complete_path" "$entries_stamp_path" \
+      "$cursor_path" "$records_path" "$seen_path" "$aggregate_path" \
+      "$aggregate_cursor_path" "$aggregate_complete_path" "$sorted_path" \
+      "$sorted_complete_path" "$complete_path"
+    return 124
+  fi
+  fm_pane_idle_meta_index_cursor_write "$complete_path" complete || {
+    rm -f "$output"
+    return 1
+  }
+  for path in "$output" "$records_path" "$complete_path" "$seen_path" \
+    "$aggregate_path" "$aggregate_complete_path" "$sorted_path" \
+    "$sorted_complete_path"; do
+    [ -f "$path" ] && [ ! -L "$path" ] || {
+      rm -f "$output"
+      return 1
+    }
+  done
+  if [ -e "$cursor_path" ] || [ -L "$cursor_path" ]; then
+    [ -f "$cursor_path" ] && [ ! -L "$cursor_path" ] || {
+      rm -f "$output"
+      return 1
+    }
+  fi
+}
+
+fm_pane_idle_meta_index_build() {  # <state> [deadline-ms] [force]
+  local state=$1 deadline_ms=${2:-} force=${3:-} rc tmp stamp post_stamp snapshot progress_dir
+  case "$deadline_ms" in ''|*[!0-9]*) deadline_ms=;; esac
+  [ -d "$state" ] && [ ! -L "$state" ] || return 1
+  progress_dir="$state/.pane-idle-meta-index"
+  if [ -e "$progress_dir" ] || [ -L "$progress_dir" ]; then
+    [ -d "$progress_dir" ] && [ ! -L "$progress_dir" ] || return 1
+  else
+    mkdir "$progress_dir" || return 1
+  fi
+  stamp=$(fm_pane_idle_path_stamp "$state" "$deadline_ms") || return $?
+  snapshot="$progress_dir/snapshot"
+  if [ -e "$snapshot" ] || [ -L "$snapshot" ]; then
+    [ -f "$snapshot" ] && [ ! -L "$snapshot" ] || return 1
+  fi
+  if [ "$FM_PANE_IDLE_META_INDEX_STATE" = "$state" ] \
+    && [ "$force" != force ] \
+    && [ "$FM_PANE_IDLE_META_INDEX_BUILT" = 1 ] \
+    && [ "$FM_PANE_IDLE_META_INDEX_STATE_STAMP" = "$stamp" ] \
+    && [ -f "$snapshot" ]; then
+    return 0
+  fi
+  FM_PANE_IDLE_META_INDEX_BUILT=0
+  FM_PANE_IDLE_META_INDEX_SNAPSHOT=
+  while :; do
+    if [ -n "$deadline_ms" ] && [ "$(fm_pane_idle_now_ms)" -ge "$deadline_ms" ]; then
+      return 124
+    fi
+    stamp=$(fm_pane_idle_path_stamp "$state" "$deadline_ms") || return $?
+    tmp=$(mktemp "$snapshot.XXXXXX") || return 1
+    [ -f "$tmp" ] && [ ! -L "$tmp" ] || { rm -f "$tmp"; return 1; }
+    fm_pane_idle_meta_index_collect "$state" "$tmp" "$deadline_ms"
+    rc=$?
+    if [ "$rc" -ne 0 ]; then
+      rm -f "$tmp"
+      return "$rc"
+    fi
+    post_stamp=$(fm_pane_idle_path_stamp "$state" "$deadline_ms") || {
+      rc=$?
+      rm -f "$tmp"
+      return "$rc"
+    }
+    if [ "$post_stamp" != "$stamp" ]; then
+      rm -f "$tmp"
+      continue
+    fi
+    fm_nofollow_rename "$tmp" "$snapshot" || {
+      rm -f "$tmp"
+      return 1
+    }
+    FM_PANE_IDLE_META_INDEX_STATE=$state
+    FM_PANE_IDLE_META_INDEX_STATE_STAMP=$post_stamp
+    FM_PANE_IDLE_META_INDEX_SNAPSHOT=$snapshot
+    FM_PANE_IDLE_META_INDEX_BUILT=1
+    return 0
+  done
+}
+
+fm_pane_idle_meta_index_lookup_snapshot() {
+  local state=$1 snapshot=$2 window=$3 deadline_ms=${4:-} candidate rc
+  [ -d "$state" ] && [ ! -L "$state" ] || return 1
+  [ -f "$snapshot" ] && [ ! -L "$snapshot" ] || return 1
+  candidate=$(fm_pane_idle_run_bounded_perl "$deadline_ms" "$snapshot" "$window" <<'PERL'
+use strict;
+use warnings;
+my ($snapshot, $wanted) = @ARGV;
+open(my $fh, '<', $snapshot) or exit 2;
+binmode($fh);
+local $/ = "\0";
+my ($candidate, $matches) = ('', 0);
+while (1) {
+  my $meta = <$fh>;
+  last unless defined $meta;
+  my $window = <$fh>;
+  my $count = <$fh>;
+  defined($window) && defined($count) or exit 2;
+  chomp($meta, $window, $count);
+  if ($window eq $wanted) {
+    $count eq '1' or exit 1;
+    $matches++;
+    $matches == 1 or exit 1;
+    $candidate = $meta;
+  }
+}
+close($fh) or exit 2;
+$matches == 1 or exit 1;
+print $candidate or exit 2;
+PERL
+  )
+  rc=$?
+  [ "$rc" = 0 ] || return "$rc"
+  case "$candidate" in "$state"/*) ;; *) return 1 ;; esac
+  [ -f "$candidate" ] && [ ! -L "$candidate" ] || return 1
+  printf '%s' "$candidate"
+}
+
+fm_pane_idle_meta_index_windows_from_snapshot() {
+  local snapshot=$1 deadline_ms=${2:-}
+  [ -f "$snapshot" ] && [ ! -L "$snapshot" ] || return 1
+  fm_pane_idle_run_bounded_perl "$deadline_ms" "$snapshot" <<'PERL'
+use strict;
+use warnings;
+my $snapshot = shift @ARGV;
+open(my $fh, '<', $snapshot) or exit 2;
+binmode($fh);
+local $/ = "\0";
+my %seen;
+while (1) {
+  my $meta = <$fh>;
+  last unless defined $meta;
+  my $window = <$fh>;
+  my $count = <$fh>;
+  defined($window) && defined($count) or exit 2;
+  chomp($meta, $window, $count);
+  next if $window =~ /[\r\n]/;
+  next if exists $seen{$window};
+  $seen{$window} = 1;
+  print $window, "\n" or exit 2;
+}
+close($fh) or exit 2;
+PERL
+}
+
+fm_pane_idle_meta_index_windows_from_snapshot_resumable() {
+  local snapshot=$1 cursor=${2:-0} deadline_ms=${3:-}
+  [ -f "$snapshot" ] && [ ! -L "$snapshot" ] || return 1
+  case "$cursor" in ''|*[!0-9]*) return 1 ;; esac
+  fm_pane_idle_run_bounded_perl "$deadline_ms" "$snapshot" "$cursor" <<'PERL'
+use strict;
+use warnings;
+my ($snapshot, $cursor) = @ARGV;
+open(my $fh, '<', $snapshot) or exit 2;
+binmode($fh);
+seek($fh, $cursor, 0) or exit 2;
+local $/ = "\0";
+my %seen;
+while (1) {
+  my $meta = <$fh>;
+  last unless defined $meta;
+  my $window = <$fh>;
+  my $count = <$fh>;
+  defined($window) && defined($count) or exit 2;
+  $meta =~ s/\0\z// or exit 2;
+  $window =~ s/\0\z// or exit 2;
+  $count =~ s/\0\z// or exit 2;
+  my $next = tell($fh);
+  defined($next) or exit 2;
+  if ($count ne '1' || $window =~ /[\r\n\t]/ || exists $seen{$window}) {
+    print $next, "\0\0\0" or exit 2;
+    next;
+  }
+  $seen{$window} = 1;
+  print $next, "\0", $window, "\0", $meta, "\0" or exit 2;
+}
+close($fh) or exit 2;
+PERL
+}
+
+fm_pane_idle_meta_index_windows_direct() {
+  local state=$1 deadline_ms=${2:-}
+  local entries_path="$state/.pane-idle-meta-index/.scan.entries"
+  local complete_path="$state/.pane-idle-meta-index/.scan.entries.complete"
+  [ -f "$entries_path" ] && [ ! -L "$entries_path" ] || return 124
+  [ -f "$complete_path" ] && [ ! -L "$complete_path" ] || return 124
+  fm_pane_idle_run_bounded_perl "$deadline_ms" "$state" "$entries_path" <<'PERL'
+use strict;
+use warnings;
+my ($state, $entries_path) = @ARGV;
+open(my $entries_fh, '<', $entries_path) or exit 2;
+my %seen;
+while (defined(my $path = <$entries_fh>)) {
+  chomp $path;
+  $path =~ /\A\Q$state\E\/[^\/\r\n]+\.meta\z/ or exit 2;
+  next unless -f $path && !-l $path;
+  open(my $fh, '<', $path) or exit 2;
+  my ($window, $count) = ('', 0);
+  while (defined(my $line = <$fh>)) {
+    if ($line =~ /\Awindow=(.*)\n\z/) {
+      $window = $1;
+      $count++;
+    }
+  }
+  close($fh) or exit 2;
+  next unless $count == 1 && $window !~ /[\r\n]/;
+  next if exists $seen{$window};
+  $seen{$window} = 1;
+  print $window, "\n" or exit 2;
+}
+close($entries_fh) or exit 2;
+PERL
+}
+
+fm_pane_idle_meta_index_windows_direct_resumable() {
+  local state=$1 cursor=${2:-} deadline_ms=${3:-}
+  local entries_path="$state/.pane-idle-meta-index/.scan.entries"
+  local complete_path="$state/.pane-idle-meta-index/.scan.entries.complete"
+  local windows_path="$state/.pane-idle-meta-index/.scan.windows"
+  local windows_complete_path="$state/.pane-idle-meta-index/.scan.windows.complete"
+  local windows_partial_path="$state/.pane-idle-meta-index/.scan.windows.partial"
+  local windows_cursor_path="$state/.pane-idle-meta-index/.scan.windows.cursor"
+  local windows_stamp_path="$state/.pane-idle-meta-index/.scan.windows.stamp"
+  local entries_stamp_path="$state/.pane-idle-meta-index/.scan.entries.stamp"
+  local source_stamp
+  [ -f "$entries_path" ] && [ ! -L "$entries_path" ] || return 124
+  [ -f "$complete_path" ] && [ ! -L "$complete_path" ] || return 124
+  if [ -e "$entries_stamp_path" ] || [ -L "$entries_stamp_path" ]; then
+    [ -f "$entries_stamp_path" ] && [ ! -L "$entries_stamp_path" ] || return 124
+  fi
+  local sidecar
+  for sidecar in "$windows_path" "$windows_complete_path" "$windows_partial_path" \
+    "$windows_cursor_path" "$windows_stamp_path"; do
+    if [ -e "$sidecar" ] || [ -L "$sidecar" ]; then
+      [ -f "$sidecar" ] && [ ! -L "$sidecar" ] || return 124
+    fi
+  done
+  case "$cursor" in ''|0) cursor=0;; *[!0-9]*) return 1 ;; esac
+  source_stamp=$(cat "$entries_stamp_path" 2>/dev/null || true)
+  [ -n "$source_stamp" ] || source_stamp=$(fm_pane_idle_path_stamp "$state") || return 1
+  fm_pane_idle_run_bounded_perl "$deadline_ms" "$state" "$entries_path" "$cursor" "$windows_path" \
+    "$windows_complete_path" "$windows_partial_path" "$windows_cursor_path" \
+    "$windows_stamp_path" "$source_stamp" <<'PERL'
+use strict;
+use warnings;
+use Fcntl qw(:DEFAULT);
+my ($state, $entries_path, $cursor, $windows_path, $windows_complete_path,
+    $windows_partial_path, $windows_cursor_path, $windows_stamp_path, $source_stamp) = @ARGV;
+my $nofollow = eval { Fcntl::O_NOFOLLOW() };
+defined($nofollow) or exit 2;
+sub atomic_write {
+  my ($path, $value) = @_;
+  return 0 if -l $path;
+  my $tmp = "$path.tmp.$$";
+  my $nofollow = eval { Fcntl::O_NOFOLLOW() };
+  defined($nofollow) or return 0;
+  sysopen(my $fh, $tmp, O_WRONLY | O_CREAT | O_EXCL | $nofollow, 0600) or return 0;
+  binmode($fh);
+  if (!print($fh $value) || !close($fh)) {
+    close($fh);
+    unlink($tmp);
+    return 0;
+  }
+  return 0 if -l $path;
+  if (!rename($tmp, $path)) {
+    unlink($tmp);
+    return 0;
+  }
+  return 1;
+}
+sub open_append {
+  my ($path) = @_;
+  return undef if -l $path;
+  my $flags = O_WRONLY | O_APPEND;
+  if (-e $path) {
+    return undef unless -f $path;
+    $flags |= $nofollow;
+  } else {
+    $flags |= O_CREAT | O_EXCL;
+  }
+  my $fh;
+  sysopen($fh, $path, $flags, 0600) or return undef;
+  return $fh;
+}
+sub read_text {
+  my ($path) = @_;
+  return '' unless -e $path;
+  return undef if -l $path || !-f $path;
+  open(my $fh, '<', $path) or return undef;
+  local $/;
+  my $value = <$fh> // '';
+  close($fh) or return undef;
+  chomp $value;
+  return $value;
+}
+my $stored_stamp = read_text($windows_stamp_path);
+defined($stored_stamp) or exit 2 if -e $windows_stamp_path;
+if (!defined($stored_stamp) || $stored_stamp ne $source_stamp) {
+  unlink($windows_path, $windows_complete_path, $windows_partial_path, $windows_cursor_path);
+  atomic_write($windows_stamp_path, "$source_stamp\n") or exit 2;
+}
+if (!-e $windows_complete_path) {
+  my $raw_cursor = read_text($windows_cursor_path);
+  defined($raw_cursor) or exit 2 if -e $windows_cursor_path;
+  $raw_cursor = '0' unless defined($raw_cursor) && $raw_cursor =~ /^\d+\z/;
+  my $efh;
+  open($efh, '<', $entries_path) or exit 2;
+  seek($efh, 0 + $raw_cursor, 0) or exit 2;
+  my $pfh = open_append($windows_partial_path) or exit 2;
+  while (defined(my $path = <$efh>)) {
+    my $next = tell($efh);
+    defined($next) or exit 2;
+    chomp $path;
+    if ($path =~ /\A\Q$state\E\/[^\/\r\n]+\.meta\z/) {
+      -l $path and exit 2;
+      if (-f $path) {
+        open(my $mfh, '<', $path) or exit 2;
+        my ($window, $count) = ('', 0);
+        while (defined(my $line = <$mfh>)) {
+          if ($line =~ /\Awindow=(.*)\n\z/) {
+            $window = $1;
+            $count++;
+          }
+        }
+        close($mfh) or exit 2;
+        if ($count == 1 && $window !~ /[\r\n\t]/) {
+          print($pfh $window, "\n") or exit 2;
+        }
+      }
+    }
+    atomic_write($windows_cursor_path, "$next\n") or exit 2;
+  }
+  close($efh) or exit 2;
+  close($pfh) or exit 2;
+  my %counts;
+  open(my $rfh, '<', $windows_partial_path) or exit 2;
+  while (defined(my $window = <$rfh>)) {
+    chomp $window;
+    $counts{$window}++ if $window ne '';
+  }
+  close($rfh) or exit 2;
+  my $content = '';
+  for my $window (sort keys %counts) {
+    $content .= $window . "\t" . $counts{$window} . "\n";
+  }
+  atomic_write($windows_path, $content) or exit 2;
+  atomic_write($windows_complete_path, "complete\n") or exit 2;
+  unlink($windows_partial_path, $windows_cursor_path) or exit 2;
+}
+my %counts;
+open(my $wfh, '<', $windows_path) or exit 2;
+while (defined(my $line = <$wfh>)) {
+  chomp $line;
+  my ($window, $count) = split(/\t/, $line, 2);
+  defined($count) && $count =~ /^\d+\z/ or exit 2;
+  $counts{$window} = $count;
+}
+close($wfh) or exit 2;
+open(my $efh, '<', $entries_path) or exit 2;
+seek($efh, 0 + $cursor, 0) or exit 2;
+while (defined(my $path = <$efh>)) {
+  my $next = tell($efh);
+  defined($next) or exit 2;
+  chomp $path;
+  if ($path !~ /\A\Q$state\E\/[^\/\r\n]+\.meta\z/) {
+    print $next, "\0\0\0" or exit 2;
+    next;
+  }
+  -l $path and exit 2;
+  if (!-f $path) {
+    print $next, "\0\0\0" or exit 2;
+    next;
+  }
+  open(my $mfh, '<', $path) or exit 2;
+  my ($window, $count) = ('', 0);
+  while (defined(my $line = <$mfh>)) {
+    if ($line =~ /\Awindow=(.*)\n\z/) {
+      $window = $1;
+      $count++;
+    }
+  }
+  close($mfh) or exit 2;
+  if ($count != 1 || $window =~ /[\r\n\t]/ || ($counts{$window} // 0) != 1) {
+    print $next, "\0\0\0" or exit 2;
+    next;
+  }
+  print $next, "\0", $window, "\0", $path, "\0" or exit 2;
+}
+close($efh) or exit 2;
+PERL
+}
+
+fm_pane_idle_meta_for_window() {  # <state> <window> [deadline-ms]
+  local state=$1 window=$2 deadline_ms=${3:-} rc
+  [ -d "$state" ] && [ ! -L "$state" ] || return 1
+  fm_pane_idle_meta_index_build "$state" "$deadline_ms"
+  rc=$?
+  [ "$rc" = 0 ] || return "$rc"
+  fm_pane_idle_meta_index_lookup_snapshot "$state" \
+    "$FM_PANE_IDLE_META_INDEX_SNAPSHOT" "$window" "$deadline_ms"
+}
+
+fm_pane_idle_meta_for_window_bounded() {  # <state> <window> <deadline-ms>
+  local state=$1 window=$2 deadline_ms=$3 meta rc
+  meta=$(fm_pane_idle_meta_for_window "$state" "$window" "$deadline_ms")
+  rc=$?
+  if [ "$rc" = 0 ]; then
+    printf '%s' "$meta"
+    return 0
+  fi
+  [ "$rc" = 124 ] || return "$rc"
+  fm_pane_idle_meta_for_window_direct "$state" "$window" "$deadline_ms"
+}
+
+fm_pane_idle_meta_index_lookup_entries() {
+  local state=$1 entries_path=$2 window=$3 deadline_ms=${4:-} candidate rc
+  [ -f "$entries_path" ] && [ ! -L "$entries_path" ] || return 1
+  candidate=$(fm_pane_idle_run_bounded_perl "$deadline_ms" "$state" \
+    "$entries_path" "$window" <<'PERL'
+use strict;
+use warnings;
+my ($state, $entries_path, $wanted) = @ARGV;
+open(my $entries_fh, '<', $entries_path) or exit 2;
+my ($candidate, $matches) = ('', 0);
+while (defined(my $path = <$entries_fh>)) {
+  chomp $path;
+  $path =~ /\A\Q$state\E\/[^\/\r\n]+\.meta\z/ or exit 2;
+  next unless -f $path && !-l $path;
+  open(my $fh, '<', $path) or exit 2;
+  my ($current, $count) = ('', 0);
+  while (defined(my $line = <$fh>)) {
+    chomp $line;
+    next unless $line =~ /\Awindow=(.*)\z/;
+    $current = $1;
+    $count++;
+  }
+  close($fh) or exit 2;
+  next unless $count == 1 && $current eq $wanted;
+  $matches++;
+  $matches == 1 or exit 1;
+  $candidate = $path;
+}
+close($entries_fh) or exit 2;
+$matches == 1 or exit 1;
+print $candidate or exit 2;
+PERL
+  )
+  rc=$?
+  [ "$rc" = 0 ] || return "$rc"
+  case "$candidate" in "$state"/*) ;; *) return 1 ;; esac
+  [ -f "$candidate" ] && [ ! -L "$candidate" ] || return 1
+  printf '%s' "$candidate"
+}
+
+fm_pane_idle_meta_for_window_direct() {  # <state> <window>
+  local state=$1 window=$2 deadline_ms=${3:-${FM_INACTIVE_OUTCOME_SCAN_DEADLINE_MS:-}}
+  local candidate rc tmp
+  [ -d "$state" ] && [ ! -L "$state" ] || return 1
+  if [ -f "$state/.pane-idle-meta-index/.scan.entries" ] \
+    && [ -f "$state/.pane-idle-meta-index/.scan.entries.complete" ]; then
+    fm_pane_idle_meta_index_lookup_entries "$state" \
+      "$state/.pane-idle-meta-index/.scan.entries" "$window" "$deadline_ms"
+    return $?
+  fi
+  tmp=$(mktemp "$state/.pane-idle-meta-direct.XXXXXX") || return 1
+  [ -f "$tmp" ] && [ ! -L "$tmp" ] || { rm -f "$tmp"; return 1; }
+  fm_pane_idle_meta_index_collect "$state" "$tmp" "$deadline_ms"
+  rc=$?
+  if [ "$rc" -ne 0 ]; then
+    rm -f "$tmp"
+    return "$rc"
+  fi
+  candidate=$(fm_pane_idle_meta_index_lookup_snapshot "$state" "$tmp" "$window" "$deadline_ms")
+  rc=$?
+  rm -f "$tmp"
+  [ "$rc" = 0 ] || return "$rc"
+  printf '%s' "$candidate"
+}
+
+fm_pane_idle_meta_index_cursor_write() {
+  local path=$1 value=$2 tmp
+  [ -n "$value" ] || return 1
+  case "$value" in *$'\n'*|*$'\r'*|*$'\t'*) return 1 ;; esac
+  [ ! -L "$path" ] || return 1
+  tmp=$(mktemp "$path.XXXXXX") || return 1
+  [ -f "$tmp" ] && [ ! -L "$tmp" ] || { rm -f "$tmp"; return 1; }
+  if ! printf '%s\n' "$value" | fm_nofollow_write "$tmp" || ! fm_nofollow_rename "$tmp" "$path"; then
+    rm -f "$tmp"
+    return 1
+  fi
+}
+
+fm_pane_idle_meta_index_persist() {
+  local state=$1 directory=$2 deadline_ms=${3:-} window meta count key path
+  local cursor_path ready_path snapshot_path reclaim_cursor_path cursor='' cursor_found=0 started=1
+  local reclaim_entries_path reclaim_entries_complete_path snapshot_source
+  local snapshot_tmp snapshot_changed=1 tmp rc compare_rc source_stamp publish_stamp final_stamp
+  [ -d "$state" ] && [ ! -L "$state" ] || return 1
+  [ -d "$directory" ] && [ ! -L "$directory" ] || return 1
+  case "$deadline_ms" in ''|*[!0-9]*) deadline_ms=;; esac
+  fm_pane_idle_meta_index_build "$state" "$deadline_ms"
+  rc=$?
+  [ "$rc" = 0 ] || return "$rc"
+  snapshot_source=$FM_PANE_IDLE_META_INDEX_SNAPSHOT
+  source_stamp=$FM_PANE_IDLE_META_INDEX_STATE_STAMP
+  [ -n "$source_stamp" ] || return 1
+  [ -f "$snapshot_source" ] && [ ! -L "$snapshot_source" ] || return 1
+  cursor_path="$directory/.cursor"
+  ready_path="$directory/.ready"
+  snapshot_path="$directory/.snapshot"
+  reclaim_cursor_path="$directory/.reclaim.cursor"
+  reclaim_entries_path="$directory/.reclaim.entries"
+  reclaim_entries_complete_path="$directory/.reclaim.entries.complete"
+  for path in "$cursor_path" "$ready_path" "$snapshot_path" "$reclaim_cursor_path" \
+    "$reclaim_entries_path" "$reclaim_entries_complete_path" \
+    "$reclaim_entries_path.partial" "$reclaim_entries_path.cookie"; do
+    if [ -e "$path" ] || [ -L "$path" ]; then
+      [ -f "$path" ] && [ ! -L "$path" ] || return 1
+    fi
+  done
+  if [ -e "$ready_path" ]; then
+    rm -f "$ready_path" || return 1
+  fi
+  snapshot_tmp=$(mktemp "$snapshot_path.XXXXXX") || return 1
+  [ -f "$snapshot_tmp" ] && [ ! -L "$snapshot_tmp" ] || { rm -f "$snapshot_tmp"; return 1; }
+  if [ -e "$cursor_path" ]; then
+    [ -f "$cursor_path" ] && [ ! -L "$cursor_path" ] || {
+      rm -f "$snapshot_tmp"
+      return 1
+    }
+    cursor=$(cat "$cursor_path" 2>/dev/null || true)
+    case "$cursor" in *$'\n'*|*$'\r'*|*$'\t'*)
+      rm -f "$snapshot_tmp"
+      return 1
+      ;;
+    esac
+  fi
+  while :; do
+    if [ -n "$deadline_ms" ] && [ "$(fm_pane_idle_now_ms)" -ge "$deadline_ms" ]; then
+      rm -f "$snapshot_tmp"
+      return 124
+    fi
+    IFS= read -r -d '' meta || break
+    IFS= read -r -d '' window || { rm -f "$snapshot_tmp"; return 1; }
+    IFS= read -r -d '' count || { rm -f "$snapshot_tmp"; return 1; }
+    case "$meta" in "$state"/*) ;; *) rm -f "$snapshot_tmp"; return 1 ;; esac
+    [ -f "$meta" ] && [ ! -L "$meta" ] || { rm -f "$snapshot_tmp"; return 1; }
+    printf '%s\0%s\0%s\0' "$meta" "$window" "$count" | fm_nofollow_append "$snapshot_tmp" || {
+      rm -f "$snapshot_tmp"
+      return 1
+    }
+    [ -n "$cursor" ] && [ "$meta" = "$cursor" ] && cursor_found=1
+  done < "$snapshot_source"
+  if [ -f "$snapshot_path" ] && [ ! -L "$snapshot_path" ]; then
+    fm_pane_idle_compare_files "$snapshot_tmp" "$snapshot_path" "$deadline_ms"
+    compare_rc=$?
+    case "$compare_rc" in
+      0) snapshot_changed=0 ;;
+      1) ;;
+      124) rm -f "$snapshot_tmp"; return 124 ;;
+      *) rm -f "$snapshot_tmp"; return 1 ;;
+    esac
+  fi
+  if [ "$snapshot_changed" = 1 ]; then
+    rm -f "$reclaim_cursor_path" "$reclaim_entries_path" \
+      "$reclaim_entries_complete_path" "$reclaim_entries_path.partial" \
+      "$reclaim_entries_path.cookie" || {
+      rm -f "$snapshot_tmp"
+      return 1
+    }
+    [ ! -L "$snapshot_path" ] || { rm -f "$snapshot_tmp"; return 1; }
+    fm_nofollow_rename "$snapshot_tmp" "$snapshot_path" || { rm -f "$snapshot_tmp"; return 1; }
+    snapshot_changed=0
+    cursor=
+    started=1
+  fi
+  if [ "$snapshot_changed" != 1 ] && [ -n "$cursor" ] \
+    && [ "$cursor_found" = 0 ]; then
+    cursor=
+    started=1
+  elif [ "$snapshot_changed" != 1 ] && [ -n "$cursor" ]; then
+    started=0
+  fi
+  publish_stamp=$(fm_pane_idle_path_stamp "$state" "$deadline_ms") || {
+    rc=$?
+    rm -f "$snapshot_tmp"
+    return "$rc"
+  }
+  [ "$publish_stamp" = "$source_stamp" ] || {
+    rm -f "$snapshot_tmp"
+    return 124
+  }
+  while :; do
+    if [ -n "$deadline_ms" ] && [ "$(fm_pane_idle_now_ms)" -ge "$deadline_ms" ]; then
+      rm -f "$snapshot_tmp"
+      return 124
+    fi
+    IFS= read -r -d '' meta || break
+    IFS= read -r -d '' window || { rm -f "$snapshot_tmp"; return 1; }
+    IFS= read -r -d '' count || { rm -f "$snapshot_tmp"; return 1; }
+    if [ "$started" = 0 ]; then
+      if [ "$meta" = "$cursor" ]; then
+        started=1
+      fi
+      continue
+    fi
+    key=$(fm_pane_idle_sha256 "$window") || { rm -f "$snapshot_tmp"; return 1; }
+    path="$directory/$key"
+    [ ! -L "$path" ] || { rm -f "$snapshot_tmp"; return 1; }
+    if [ -e "$path" ]; then
+      [ -f "$path" ] || { rm -f "$snapshot_tmp"; return 1; }
+    fi
+    tmp=$(mktemp "$path.XXXXXX") || { rm -f "$snapshot_tmp"; return 1; }
+    [ -f "$tmp" ] && [ ! -L "$tmp" ] || { rm -f "$tmp" "$snapshot_tmp"; return 1; }
+    if ! printf '%s\n%s\n' "$count" "$meta" | fm_nofollow_write "$tmp" \
+      || ! fm_nofollow_rename "$tmp" "$path"; then
+      rm -f "$tmp" "$snapshot_tmp"
+      return 1
+    fi
+    fm_pane_idle_meta_index_cursor_write "$cursor_path" "$meta" || {
+      rm -f "$snapshot_tmp"
+      return 1
+    }
+  done < "$snapshot_source"
+  rm -f "$cursor_path" || { rm -f "$snapshot_tmp"; return 1; }
+  rm -f "$snapshot_tmp" || return 1
+  if [ -n "$deadline_ms" ] && [ "$(fm_pane_idle_now_ms)" -ge "$deadline_ms" ]; then
+    return 124
+  fi
+  fm_pane_idle_meta_index_reclaim "$directory" "$deadline_ms" "$snapshot_source" || return $?
+  final_stamp=$(fm_pane_idle_path_stamp "$state" "$deadline_ms") || return $?
+  if [ "$final_stamp" != "$source_stamp" ]; then
+    rm -f "$ready_path"
+    return 124
+  fi
+  fm_pane_idle_meta_index_cursor_write "$ready_path" ready || return 1
+}
+
+fm_pane_idle_meta_index_reclaim() {
+  local directory=$1 deadline_ms=${2:-} snapshot_source=${3:-} current_tmp cursor_path worker rc path key meta window count
+  local entries_path entries_complete_path remaining
+  case "$deadline_ms" in ''|*[!0-9]*) deadline_ms=;; esac
+  [ -d "$directory" ] && [ ! -L "$directory" ] || return 1
+  [ -f "$snapshot_source" ] && [ ! -L "$snapshot_source" ] || return 1
+  cursor_path="$directory/.reclaim.cursor"
+  if [ -e "$cursor_path" ] || [ -L "$cursor_path" ]; then
+    [ -f "$cursor_path" ] && [ ! -L "$cursor_path" ] || return 1
+  fi
+  entries_path="$directory/.reclaim.entries"
+  entries_complete_path="$directory/.reclaim.entries.complete"
+  for path in "$entries_path" "$entries_complete_path"; do
+    if [ -e "$path" ] || [ -L "$path" ]; then
+      [ -f "$path" ] && [ ! -L "$path" ] || {
+        return 1
+      }
+    fi
+  done
+  command -v perl >/dev/null 2>&1 || return 125
+  current_tmp=$(mktemp "$directory/.reclaim-current.XXXXXX") || return 1
+  [ -f "$current_tmp" ] && [ ! -L "$current_tmp" ] || {
+    rm -f "$current_tmp"
+    return 1
+  }
+  while :; do
+    if [ -n "$deadline_ms" ] && [ "$(fm_pane_idle_now_ms)" -ge "$deadline_ms" ]; then
+      rm -f "$current_tmp"
+      return 124
+    fi
+    IFS= read -r -d '' meta || break
+    IFS= read -r -d '' window || { rm -f "$current_tmp"; return 1; }
+    IFS= read -r -d '' count || { rm -f "$current_tmp"; return 1; }
+    key=$(fm_pane_idle_sha256 "$window") || {
+      rm -f "$current_tmp"
+      return 1
+    }
+    [ "${#key}" = 64 ] || { rm -f "$current_tmp"; return 1; }
+    case "$key" in *[!0123456789abcdefABCDEF]*) rm -f "$current_tmp"; return 1 ;; esac
+    printf '%s\n' "$key" | fm_nofollow_append "$current_tmp" || {
+      rm -f "$current_tmp"
+      return 1
+    }
+  done < "$snapshot_source"
+  if [ ! -f "$entries_path" ] || [ ! -f "$entries_complete_path" ]; then
+    fm_pane_idle_meta_index_reclaim_entries_build \
+      "$directory" "$entries_path" "$entries_complete_path" "$deadline_ms"
+    rc=$?
+    if [ "$rc" -ne 0 ]; then
+      rm -f "$current_tmp"
+      return "$rc"
+    fi
+  fi
+  perl - "$directory" "$current_tmp" "$entries_path" "$cursor_path" "$deadline_ms" <<'PERL' &
+use strict;
+use warnings;
+use Fcntl qw(:DEFAULT);
+
+my ($directory, $current_path, $entries_path, $cursor_path, $deadline) = @ARGV;
+$deadline = undef unless defined($deadline) && $deadline =~ /^\d+\z/ && $deadline ne '';
+my $nofollow = eval { Fcntl::O_NOFOLLOW() };
+defined($nofollow) or exit 1;
+sub expired {
+  return defined($deadline) && int(time() * 1000) >= $deadline;
+}
+sub write_progress {
+  my ($path, $value) = @_;
+  return 0 if -l $path || !defined($nofollow);
+  my $fh;
+  sysopen($fh, $path, O_WRONLY | O_CREAT | O_TRUNC | $nofollow, 0600) or return 0;
+  binmode($fh);
+  return 0 unless print($fh $value, "\n") && close($fh);
+  return 1;
+}
+open(my $cfh, '<', $current_path) or exit 1;
+my %current;
+while (defined(my $key = <$cfh>)) {
+  exit 124 if expired();
+  chomp $key;
+  $current{$key} = 1 if $key =~ /^[0-9A-Fa-f]{64}\z/;
+}
+close($cfh) or exit 1;
+my $cursor = '';
+if (-e $cursor_path) {
+  exit 1 if -l $cursor_path;
+  open(my $rfh, '<', $cursor_path) or exit 1;
+  my $value = <$rfh> // '';
+  close($rfh) or exit 1;
+  chomp $value;
+  exit 1 if $value ne '' && $value !~ /^(?:\d+|[0-9A-Fa-f]{64}|legacy:\d+:[0-9A-Fa-f]{64})\z/;
+  $cursor = $value;
+}
+my $cursor_line = $cursor =~ /^\d+\z/ ? 0 + $cursor : 0;
+my $legacy_cursor = '';
+if ($cursor =~ /^legacy:(\d+):([0-9A-Fa-f]{64})\z/) {
+  $cursor_line = 0 + $1;
+  $legacy_cursor = $2;
+} elsif ($cursor =~ /^[0-9A-Fa-f]{64}\z/) {
+  $legacy_cursor = $cursor;
+}
+sub write_cursor {
+  my ($path, $line, $legacy) = @_;
+  return write_progress($path, $legacy ne '' ? "legacy:$line:$legacy" : $line);
+}
+my $efh;
+sysopen($efh, $entries_path, O_RDONLY | $nofollow) or exit 1;
+my $line_no = 0;
+while (defined(my $entry = <$efh>)) {
+  exit 124 if expired();
+  $line_no++;
+  chomp $entry;
+  next if $cursor_line > 0 && $line_no <= $cursor_line;
+  if ($legacy_cursor ne '' && $entry !~ /^[0-9A-Fa-f]{64}\z/) {
+    write_cursor($cursor_path, $line_no, $legacy_cursor) or exit 1;
+    next;
+  }
+  if ($legacy_cursor ne '' && $entry =~ /^[0-9A-Fa-f]{64}\z/ && $entry le $legacy_cursor) {
+    write_cursor($cursor_path, $line_no, $legacy_cursor) or exit 1;
+    next;
+  }
+  $legacy_cursor = '' if $legacy_cursor ne '' && $entry =~ /^[0-9A-Fa-f]{64}\z/ && $entry gt $legacy_cursor;
+  if ($entry =~ /^[0-9A-Fa-f]{64}\z/) {
+    my $path = "$directory/$entry";
+    exit 1 if -l $path;
+    if (-e $path) {
+      exit 1 unless -f $path;
+      if (!exists $current{$entry}) {
+        unlink($path) or exit 1;
+      }
+    }
+  }
+  write_cursor($cursor_path, $line_no, '') or exit 1;
+}
+close($efh) or exit 1;
+PERL
+  worker=$!
+  while kill -0 "$worker" 2>/dev/null; do
+    if [ -n "$deadline_ms" ] && [ "$(fm_pane_idle_now_ms)" -ge "$deadline_ms" ]; then
+      kill -TERM "$worker" 2>/dev/null || true
+      kill -KILL "$worker" 2>/dev/null || true
+      wait "$worker" 2>/dev/null || true
+      rm -f "$current_tmp"
+      return 124
+    fi
+    sleep 0.01
+  done
+  wait "$worker"
+  rc=$?
+  rm -f "$current_tmp" || return 1
+  if [ "$rc" -ne 0 ]; then
+    return "$rc"
+  fi
+  rm -f "$cursor_path" || return 1
+}
+
+fm_pane_idle_meta_index_reclaim_entries_build() {
+  local directory=$1 entries_path=$2 complete_path=$3 deadline_ms=${4:-}
+  local partial_path="$entries_path.partial" cookie_path="$entries_path.cookie" remaining rc
+  [ -d "$directory" ] && [ ! -L "$directory" ] || return 1
+  [ ! -L "$entries_path" ] && [ ! -L "$complete_path" ] || return 1
+  [ ! -L "$partial_path" ] && [ ! -L "$cookie_path" ] || return 1
+  remaining=$(fm_pane_idle_budget_secs "$deadline_ms") || return 124
+  fm_pane_idle_run_bounded_child "$remaining" perl - "$directory" "$entries_path" \
+    "$complete_path" "$partial_path" "$cookie_path" <<'PERL'
+use strict;
+use warnings;
+use Fcntl qw(:DEFAULT);
+
+my ($directory, $entries, $complete, $partial, $cookie_path) = @ARGV;
+my $nofollow = eval { Fcntl::O_NOFOLLOW() };
+defined($nofollow) or exit 1;
+sub atomic_write {
+  my ($path, $value) = @_;
+  return 0 if -l $path;
+  my $tmp = "$path.tmp.$$";
+  my $fh;
+  sysopen($fh, $tmp, O_WRONLY | O_CREAT | O_EXCL | $nofollow, 0600) or return 0;
+  binmode($fh);
+  return 0 unless print($fh $value) && close($fh);
+  return 0 if -l $path;
+  rename($tmp, $path) or return 0;
+}
+sub open_append {
+  my ($path) = @_;
+  return undef if -l $path;
+  my $flags = O_WRONLY | O_APPEND;
+  if (-e $path) {
+    return undef unless -f $path;
+    $flags |= $nofollow;
+  } else {
+    $flags |= O_CREAT | O_EXCL;
+  }
+  my $fh;
+  sysopen($fh, $path, $flags, 0600) or return undef;
+  return $fh;
+}
+sub read_text {
+  my ($path) = @_;
+  return '' unless -e $path;
+  return undef if -l $path || !-f $path;
+  open(my $fh, '<', $path) or return undef;
+  local $/;
+  my $value = <$fh> // '';
+  close($fh) or return undef;
+  chomp $value;
+  return $value;
+}
+my $cookie = read_text($cookie_path);
+defined($cookie) or exit 1 if -e $cookie_path;
+$cookie = '' unless defined($cookie) && ($cookie eq 'EOF' || $cookie =~ /^\d+\z/);
+if ($cookie ne 'EOF') {
+  my $pfh = open_append($partial) or exit 1;
+  select((select($pfh), $| = 1)[0]);
+  opendir(my $dh, $directory) or exit 1;
+  seekdir($dh, 0 + $cookie) or exit 1 if $cookie ne '';
+  while (defined(my $entry = readdir($dh))) {
+    my $next = telldir($dh);
+    defined($next) or exit 1;
+    if ($entry =~ /^[0-9A-Fa-f]{64}\z/) {
+      print($pfh $entry, "\n") or exit 1;
+    }
+    atomic_write($cookie_path, "$next\n") or exit 1;
+  }
+  closedir($dh) or exit 1;
+  close($pfh) or exit 1;
+  atomic_write($cookie_path, "EOF\n") or exit 1;
+  $cookie = 'EOF';
+}
+open(my $pfh, '<', $partial) or exit 1;
+my %seen;
+my @entries;
+while (defined(my $entry = <$pfh>)) {
+  chomp $entry;
+  next unless $entry =~ /^[0-9A-Fa-f]{64}\z/;
+  next if $seen{$entry}++;
+  push @entries, $entry;
+}
+close($pfh) or exit 1;
+@entries = sort @entries;
+atomic_write($entries, join('', map { "$_\n" } @entries)) or exit 1;
+atomic_write($complete, "complete\n") or exit 1;
+unlink($partial, $cookie_path) or exit 1;
+PERL
+  rc=$?
+  [ "$rc" -ne 0 ] || return 0
+  return "$rc"
+}
+
+fm_pane_idle_meta_for_window_indexed() {
+  local directory=$1 window=$2 key path count meta current
+  [ -d "$directory" ] && [ ! -L "$directory" ] || return 1
+  key=$(fm_pane_idle_sha256 "$window") || return 1
+  path="$directory/$key"
+  [ -f "$path" ] && [ ! -L "$path" ] || return 1
+  {
+    IFS= read -r count
+    IFS= read -r meta
+  } < "$path" || return 1
+  [ "$count" = 1 ] || return 1
+  [ -f "$meta" ] && [ ! -L "$meta" ] || return 1
+  current=$(fm_pane_idle_meta_value_unique "$meta" window) || return 1
+  [ "$current" = "$window" ] || return 1
+  printf '%s' "$meta"
+}
+
+fm_pane_idle_sha256() {
+  if command -v shasum >/dev/null 2>&1; then
+    printf '%s' "$1" | shasum -a 256 | awk '{print $1}'
+  elif command -v sha256sum >/dev/null 2>&1; then
+    printf '%s' "$1" | sha256sum | awk '{print $1}'
+  else
+    return 1
+  fi
+}
+
+fm_pane_idle_hash() {
+  if command -v md5 >/dev/null 2>&1; then
+    md5 -q
+  elif command -v md5sum >/dev/null 2>&1; then
+    md5sum | awk '{print $1}'
+  else
+    return 1
+  fi
+}
+
+fm_pane_idle_current_hash() {  # <backend> <target> <lines>
+  local backend=$1 target=$2 lines=${3:-40} tail native=unknown
+  command -v fm_backend_capture >/dev/null 2>&1 || return 1
+  if [ "$backend" = herdr ] && command -v fm_backend_busy_state >/dev/null 2>&1; then
+    native=$(FM_BACKEND_HERDR_NO_SERVER_START=1 fm_backend_busy_state "$backend" "$target" 2>/dev/null || printf 'unknown')
+    case "$native" in
+      busy) return 1 ;;
+      idle|unknown) ;;
+      *) return 1 ;;
+    esac
+  fi
+  if [ "$backend" = herdr ]; then
+    tail=$(FM_BACKEND_HERDR_NO_SERVER_START=1 fm_backend_capture "$backend" "$target" "$lines" 2>/dev/null) || return 1
+  else
+    tail=$(fm_backend_capture "$backend" "$target" "$lines" 2>/dev/null) || return 1
+  fi
+  if printf '%s' "$tail" | grep -v '^[[:space:]]*$' | tail -6 \
+    | grep -qiE "${FM_BUSY_REGEX:-$FM_PANE_IDLE_BUSY_REGEX_DEFAULT}"; then
+    return 1
+  fi
+  printf '%s' "$tail" | fm_pane_idle_hash
+}
+
+fm_pane_idle_current_matches() {  # <backend> <target> <expected-hash>
+  local current
+  current=$(fm_pane_idle_current_hash "$1" "$2" 40) || return 1
+  [ "$current" = "$3" ]
+}
+
+fm_pane_idle_read_incarnation() {  # <meta> <id>
+  local meta=$1 token tasktmp window worktree seed digest rc
+  if token=$(fm_pane_idle_meta_value_unique "$meta" spawn_incarnation); then
+    case "$token" in
+      ''|legacy-unknown|*[!A-Za-z0-9._:-]*) return 1 ;;
+    esac
+    printf '%s' "$token"
+    return 0
+  else
+    rc=$?
+    [ "$rc" = 1 ] || return 1
+  fi
+  if tasktmp=$(fm_pane_idle_meta_value_unique "$meta" tasktmp 2>/dev/null); then
+    :
+  else
+    rc=$?
+    [ "$rc" = 1 ] || return 1
+    tasktmp=
+  fi
+  if window=$(fm_pane_idle_meta_value_unique "$meta" window 2>/dev/null); then
+    :
+  else
+    rc=$?
+    [ "$rc" = 1 ] || return 1
+    window=
+  fi
+  if worktree=$(fm_pane_idle_meta_value_unique "$meta" worktree 2>/dev/null); then
+    :
+  else
+    rc=$?
+    [ "$rc" = 1 ] || return 1
+    worktree=
+  fi
+  if [ -n "$tasktmp" ]; then
+    seed="legacy|tasktmp=$tasktmp"
+  else
+    seed="legacy|window=$window|worktree=$worktree"
+  fi
+  digest=$(fm_pane_idle_sha256 "$seed") || return 1
+  printf 'legacy-%s' "${digest:0:32}"
+}
+
+fm_pane_idle_task_is_ordinary() {  # <meta>
+  local kind rc
+  if kind=$(fm_pane_idle_meta_value_unique "$1" kind); then
+    :
+  else
+    rc=$?
+    [ "$rc" = 1 ] && kind=ship || return 1
+  fi
+  case "$kind" in ship|scout) return 0 ;; esac
+  return 1
+}
+
+fm_pane_idle_field_safe() {
+  case "$1" in
+    ''|*$'\n'*|*$'\r'*|*$'\t'*|*=*) return 1 ;;
+  esac
+}
+
+fm_pane_idle_path() {  # <state> <task>
+  printf '%s/.pane-idle/%s' "$1" "$2"
+}
+
+fm_pane_idle_key() {  # <window>
+  printf '%s' "$1" | tr ':/.' '___'
+}
+
+fm_pane_idle_clear() {  # <state> <task>
+  local state=$1 task=$2 dir path
+  dir="$state/.pane-idle"
+  if [ -e "$dir" ] || [ -L "$dir" ]; then
+    [ -d "$dir" ] && [ ! -L "$dir" ] || return 1
+  fi
+  path=$(fm_pane_idle_path "$state" "$task")
+  [ ! -e "$path" ] && return 0
+  [ ! -L "$path" ] && [ -f "$path" ] || return 1
+  rm -f "$path"
+}
+
+fm_pane_idle_clear_for_window() {  # <state> <window> [deadline-ms]
+  local state=$1 window=$2 deadline_ms=${3:-} meta task
+  meta=$(fm_pane_idle_meta_for_window "$state" "$window" "$deadline_ms" 2>/dev/null || true)
+  [ -n "$meta" ] || return 0
+  task=${meta##*/}
+  task=${task%.meta}
+  fm_pane_idle_clear "$state" "$task"
+}
+
+fm_pane_idle_write() {  # <state> <meta> <task> <window> <backend> <hash> <samples>
+  local state=$1 meta=$2 task=$3 window=$4 backend=$5 pane_hash=$6 samples=$7
+  local path dir tmp token meta_window current_backend value rc
+  [ -f "$meta" ] && [ ! -L "$meta" ] || return 1
+  fm_pane_idle_task_is_ordinary "$meta" || return 1
+  case "$task" in ''|*[!A-Za-z0-9._-]*) return 1 ;; esac
+  for value in "$window" "$backend" "$pane_hash"; do
+    fm_pane_idle_field_safe "$value" || return 1
+  done
+  case "$backend" in tmux|herdr) ;; *) return 1 ;; esac
+  case "$pane_hash" in ''|*[!A-Fa-f0-9]*) return 1 ;; esac
+  case "$samples" in ''|*[!0-9]*) return 1 ;; esac
+  [ "$samples" -ge 2 ] || return 1
+  meta_window=$(fm_pane_idle_meta_value_unique "$meta" window) || return 1
+  [ "$meta_window" = "$window" ] || return 1
+  if current_backend=$(fm_pane_idle_meta_value_unique "$meta" backend 2>/dev/null); then
+    :
+  else
+    rc=$?
+    [ "$rc" = 1 ] || return 1
+    current_backend=tmux
+  fi
+  [ "$current_backend" = "$backend" ] || return 1
+  token=$(fm_pane_idle_read_incarnation "$meta" "$task") || return 1
+  dir="$state/.pane-idle"
+  [ ! -L "$state" ] && [ -d "$state" ] || return 1
+  if [ -e "$dir" ]; then
+    [ -d "$dir" ] && [ ! -L "$dir" ] || return 1
+  else
+    mkdir "$dir" || return 1
+  fi
+  path=$(fm_pane_idle_path "$state" "$task")
+  [ ! -L "$path" ] || return 1
+  tmp=$(mktemp "$dir/.tmp.XXXXXX") || return 1
+  if printf 'schema=fm-jt-pane-idle.v1\ntask=%s\nwindow=%s\nbackend=%s\nspawn_incarnation=%s\npane_hash=%s\nsample_count=%s\nobserved_epoch=%s\n' "$task" "$window" "$backend" "$token" "$pane_hash" "$samples" "$(date +%s)" | fm_nofollow_write "$tmp" && fm_nofollow_rename "$tmp" "$path"; then
+    return 0
+  fi
+  rm -f "$tmp"
+  return 1
+}
+
+fm_pane_idle_proof_valid() {  # <state> <meta> <task> <window> <backend> <incarnation> <max-age>
+  local state=$1 meta=$2 task=$3 window=$4 backend=$5 incarnation=$6 max_age=$7
+  local path proof_task proof_window proof_backend proof_incarnation pane_hash samples observed now age
+  local key hash_file count_file current_hash current_count unique_meta
+  [ -f "$meta" ] && [ ! -L "$meta" ] || return 1
+  fm_pane_idle_task_is_ordinary "$meta" || return 1
+  if [ -n "${FM_PANE_IDLE_META_INDEX_DIR:-}" ]; then
+    unique_meta=$(fm_pane_idle_meta_for_window_indexed "$FM_PANE_IDLE_META_INDEX_DIR" "$window" 2>/dev/null || true)
+  else
+    unique_meta=$(fm_pane_idle_meta_for_window_direct "$state" "$window" 2>/dev/null || true)
+  fi
+  [ "$unique_meta" = "$meta" ] || return 1
+  path=$(fm_pane_idle_path "$state" "$task")
+  [ -f "$path" ] && [ ! -L "$path" ] || return 1
+  awk -F= '
+    BEGIN {
+      allowed["schema"]=1; allowed["task"]=1; allowed["window"]=1
+      allowed["backend"]=1; allowed["spawn_incarnation"]=1; allowed["pane_hash"]=1
+      allowed["sample_count"]=1; allowed["observed_epoch"]=1
+      required["schema"]=1; required["task"]=1; required["window"]=1
+      required["backend"]=1; required["spawn_incarnation"]=1; required["pane_hash"]=1
+      required["sample_count"]=1; required["observed_epoch"]=1
+      valid=1
+    }
+    /^[^=]+=/ {
+      key=$1
+      if (!(key in allowed) || (key in seen)) valid=0
+      seen[key]=1
+      values[key]=substr($0, index($0, "=") + 1)
+      next
+    }
+    { valid=0 }
+    END {
+      for (key in required) if (!(key in seen)) valid=0
+      exit !(valid && values["schema"] == "fm-jt-pane-idle.v1")
+    }
+  ' "$path" 2>/dev/null || return 1
+  proof_task=$(fm_pane_idle_meta_value_unique "$path" task) || return 1
+  proof_window=$(fm_pane_idle_meta_value_unique "$path" window) || return 1
+  proof_backend=$(fm_pane_idle_meta_value_unique "$path" backend) || return 1
+  proof_incarnation=$(fm_pane_idle_meta_value_unique "$path" spawn_incarnation) || return 1
+  pane_hash=$(fm_pane_idle_meta_value_unique "$path" pane_hash) || return 1
+  samples=$(fm_pane_idle_meta_value_unique "$path" sample_count) || return 1
+  observed=$(fm_pane_idle_meta_value_unique "$path" observed_epoch) || return 1
+  [ "$proof_task" = "$task" ] && [ "$proof_window" = "$window" ] || return 1
+  [ "$proof_backend" = "$backend" ] && [ "$proof_incarnation" = "$incarnation" ] || return 1
+  case "$pane_hash" in ''|*[!A-Fa-f0-9]*) return 1 ;; esac
+  case "$samples" in ''|*[!0-9]*) return 1 ;; esac
+  [ "$samples" -ge 2 ] || return 1
+  case "$observed" in ''|*[!0-9]*) return 1 ;; esac
+  case "$max_age" in ''|*[!0-9]*) return 1 ;; esac
+  now=$(date +%s)
+  age=$((now - observed))
+  [ "$age" -ge 0 ] && [ "$age" -le "$max_age" ] || return 1
+  key=$(fm_pane_idle_key "$window")
+  hash_file="$state/.hash-$key"
+  count_file="$state/.count-$key"
+  [ -f "$hash_file" ] && [ ! -L "$hash_file" ] || return 1
+  [ -f "$count_file" ] && [ ! -L "$count_file" ] || return 1
+  current_hash=$(cat "$hash_file" 2>/dev/null || true)
+  current_count=$(cat "$count_file" 2>/dev/null || true)
+  [ "$current_hash" = "$pane_hash" ] || return 1
+  case "$current_count" in ''|*[!0-9]*) return 1 ;; esac
+  [ "$current_count" -ge "$samples" ] || return 1
+  fm_pane_idle_current_matches "$backend" "$window" "$pane_hash"
+}
diff --git a/bin/fm-pending-reply-lib.sh b/bin/fm-pending-reply-lib.sh
index 230cbd279a6..43db16063e5 100755
--- a/bin/fm-pending-reply-lib.sh
+++ b/bin/fm-pending-reply-lib.sh
@@ -69,6 +69,8 @@
 
 # shellcheck source=bin/fm-marker-lib.sh
 _FM_PENDING_REPLY_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd 2>/dev/null)" || _FM_PENDING_REPLY_LIB_DIR="."
+# shellcheck source=bin/fm-safe-io-lib.sh
+. "$_FM_PENDING_REPLY_LIB_DIR/fm-safe-io-lib.sh"
 # shellcheck source=bin/fm-marker-lib.sh
 . "$_FM_PENDING_REPLY_LIB_DIR/fm-marker-lib.sh"
 # shellcheck source=bin/fm-backend.sh
@@ -81,6 +83,7 @@ _FM_PENDING_REPLY_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd 2>/dev/n
 FM_PENDING_REPLY_SCHEMA='fm-pending-reply.v1'
 FM_PENDING_REPLY_CORR_RE='(^|[^[:alnum:]_])corr=([A-Fa-f0-9]{16})($|[^[:alnum:]_])'
 FM_PENDING_REPLY_GRACE_DEFAULT=120
+FM_PENDING_REPLY_ROUTE_COMMITTED=0
 
 fm_pending_reply_now() {
   if [ -n "${FM_PENDING_REPLY_NOW:-}" ]; then
@@ -131,6 +134,22 @@ fm_pending_reply_source_identity() {  # <state-dir>
   (cd "$1" 2>/dev/null && pwd -P)
 }
 
+fm_pending_reply_expected_parent_home() {  # <state-dir>
+  local state=$1 state_identity override_identity
+  [ -d "$state" ] && [ ! -L "$state" ] || return 1
+  state_identity=$(fm_pending_reply_source_identity "$state") || return 1
+  if [ -n "${FM_STATE_OVERRIDE:-}" ]; then
+    override_identity=$(fm_pending_reply_source_identity "$FM_STATE_OVERRIDE") || override_identity=
+    if [ "$override_identity" = "$state_identity" ]; then
+      [ -n "${FM_HOME:-}" ] || return 1
+      fm_pending_reply_source_identity "$FM_HOME"
+      return
+    fi
+  fi
+  [ "$(basename "$state_identity")" = state ] || return 1
+  dirname "$state_identity"
+}
+
 fm_pending_reply_source_key() {  # <source-state>
   printf '%s' "$1" | cksum 2>/dev/null | awk '{printf "%s-%s", $1, $2}'
 }
@@ -163,7 +182,7 @@ fm_pending_reply_txn_owner_write() {  # <owner-path> <pid> <identity> <token> <c
     "identity=$identity" \
     "token=$token" \
     "phase=$phase" \
-    "ticket=$ticket" > "$tmp"; then
+    "ticket=$ticket" | fm_nofollow_write "$tmp"; then
     rm -f "$tmp" || true
     return 1
   fi
@@ -175,25 +194,18 @@ fm_pending_reply_txn_owner_write() {  # <owner-path> <pid> <identity> <token> <c
 }
 
 fm_pending_reply_protocol_scope() {  # <state-dir> <corr_id> <home-var> <watch-var>
-  local state=$1 corr=$2 home_var=$3 watch_var=$4 rec home state_identity home_state_identity
+  local state=$1 corr=$2 home_var=$3 watch_var=$4 rec home expected_home
   local lock_home lock_watch
   rec=$(fm_pending_reply_path "$state" "$corr")
   home=
   [ -f "$rec" ] && home=$(fm_pending_reply_get "$rec" parent_home)
-  state_identity=$(fm_pending_reply_source_identity "$state") || return 1
+  expected_home=$(fm_pending_reply_expected_parent_home "$state") || return 1
   if [ -n "$home" ]; then
-    home_state_identity=$(fm_pending_reply_source_identity "$home/state") || home_state_identity=
-    [ "$home_state_identity" = "$state_identity" ] || home=
-  fi
-  if [ -z "$home" ] && [ -n "${FM_HOME:-}" ]; then
-    home_state_identity=$(fm_pending_reply_source_identity "$FM_HOME/state") || home_state_identity=
-    [ "$home_state_identity" = "$state_identity" ] && home=$FM_HOME
-  fi
-  if [ -z "$home" ] && [ "$(basename "$state_identity")" = state ]; then
-    home=$(dirname "$state_identity")
+    home=$(cd "$home" 2>/dev/null && pwd -P) || home=
+    [ "$home" = "$expected_home" ] || return 1
   fi
+  [ -n "$home" ] || home=$expected_home
   [ -n "$home" ] || return 1
-  home=$(cd "$home" 2>/dev/null && pwd -P) || return 1
   lock_home=$(cat "$state/.watch.lock/fm-home" 2>/dev/null || true)
   lock_watch=$(cat "$state/.watch.lock/watcher-path" 2>/dev/null || true)
   if [ "$lock_home" != "$home" ] || [ -z "$lock_watch" ]; then
@@ -203,12 +215,17 @@ fm_pending_reply_protocol_scope() {  # <state-dir> <corr_id> <home-var> <watch-v
   printf -v "$watch_var" '%s' "$lock_watch"
 }
 
-fm_pending_reply_txn_lock_acquire() {  # <state-dir> <corr_id> <result-var>
+fm_pending_reply_txn_lock_acquire() {  # <state-dir> <corr_id> <result-var> [deadline-ms]
   local state=$1 corr=$2 result_var=$3 lock owner pid identity lock_token phase ticket
   local existing_pid existing_identity existing_token actual attempt=0 generation
   local incomplete_signature='' incomplete_seen=0 current_signature
   local winner winner_ticket winner_token live_owner live_choosing max_ticket
-  local legacy_present protocol_home protocol_watch
+  local legacy_present protocol_home protocol_watch max_attempts deadline_ms=${4:-}
+  max_attempts=${FM_PENDING_REPLY_TXN_ATTEMPTS:-200}
+  case "$max_attempts" in ''|*[!0-9]*) max_attempts=200 ;; esac
+  [ "$max_attempts" -ge 1 ] || max_attempts=1
+  [ "$max_attempts" -le 200 ] || max_attempts=200
+  case "$deadline_ms" in ''|*[!0-9]*) deadline_ms=;; esac
   fm_pending_reply_protocol_scope "$state" "$corr" protocol_home protocol_watch || return 1
   fm_watcher_protocol_gate "$state" "$protocol_home" "$protocol_watch" || return 1
   lock=$(fm_pending_reply_txn_lock_path "$state" "$corr")
@@ -217,7 +234,11 @@ fm_pending_reply_txn_lock_acquire() {  # <state-dir> <corr_id> <result-var>
   identity=$(fm_pending_reply_pid_identity "$pid") || return 1
   lock_token="$pid-$RANDOM-$(fm_pending_reply_now)"
   owner="$lock/owner-$lock_token"
-  while [ "$attempt" -lt 200 ]; do
+  while [ "$attempt" -lt "$max_attempts" ]; do
+    if ! fm_pending_reply_cleanup_deadline_check "$deadline_ms"; then
+      rm -f "$owner" 2>/dev/null || true
+      return 75
+    fi
     if [ -f "$lock" ] && [ ! -d "$lock" ]; then
       existing_pid=$(fm_pending_reply_txn_lock_value "$lock" pid)
       existing_identity=$(fm_pending_reply_txn_lock_value "$lock" identity)
@@ -229,7 +250,10 @@ fm_pending_reply_txn_lock_acquire() {  # <state-dir> <corr_id> <result-var>
         rm -f "$lock" 2>/dev/null || true
         continue
       fi
-      sleep 0.05
+      fm_pending_reply_cleanup_deadline_sleep "$deadline_ms" || {
+        rm -f "$owner" 2>/dev/null || true
+        return 75
+      }
       attempt=$((attempt + 1))
       continue
     fi
@@ -262,7 +286,10 @@ fm_pending_reply_txn_lock_acquire() {  # <state-dir> <corr_id> <result-var>
           continue
         fi
       fi
-      sleep 0.05
+      fm_pending_reply_cleanup_deadline_sleep "$deadline_ms" || {
+        rm -f "$owner" 2>/dev/null || true
+        return 75
+      }
       attempt=$((attempt + 1))
       continue
     fi
@@ -404,7 +431,10 @@ fm_pending_reply_txn_lock_acquire() {  # <state-dir> <corr_id> <result-var>
       printf -v "$result_var" '%s' "$lock_token"
       return 0
     fi
-    sleep 0.05
+    fm_pending_reply_cleanup_deadline_sleep "$deadline_ms" || {
+      rm -f "$owner" 2>/dev/null || true
+      return 75
+    }
     attempt=$((attempt + 1))
   done
   rm -f "$owner" 2>/dev/null || true
@@ -481,15 +511,612 @@ fm_pending_reply_get() {  # <record-path> <key>
   grep "^${key}=" "$rec" 2>/dev/null | tail -1 | cut -d= -f2- || true
 }
 
+fm_pending_reply_record_validate() {  # <record-path> <state-dir> <corr-id> <task-id>
+  local rec=$1 state=$2 wanted_corr=$3 wanted_task=$4
+  local record_corr record_task parent_home parent_status parent_abs expected_home state_abs pending_dir expected_status delivered phase
+  [ -f "$rec" ] && [ ! -L "$rec" ] || return 1
+  awk -F= '
+    BEGIN {
+      allowed["schema"]=1; allowed["corr_id"]=1; allowed["task_id"]=1
+      allowed["parent_home"]=1; allowed["parent_status"]=1
+      allowed["parent_status_scan_signature"]=1; allowed["request_summary"]=1
+      allowed["created_epoch"]=1; allowed["delivered_epoch"]=1; allowed["phase"]=1
+      allowed["turn_seen_busy"]=1; allowed["request_turn_completed_epoch"]=1
+      allowed["recovery_attempted_epoch"]=1; allowed["recovery_sender_pid"]=1
+      allowed["recovery_sender_identity"]=1; allowed["recovery_sent_epoch"]=1
+      allowed["recovery_delivery_outcome"]=1; allowed["recovery_turn_seen_busy"]=1
+      allowed["recovery_turn_completed_epoch"]=1; allowed["escalated_epoch"]=1
+      allowed["resolved_epoch"]=1; allowed["resolved_via"]=1; allowed["retired_epoch"]=1
+      allowed["retired_via"]=1; allowed["retired_from"]=1
+      allowed["retirement_staged_epoch"]=1; allowed["retirement_history_state"]=1
+      allowed["retirement_staged_from"]=1; allowed["retirement_source_state"]=1
+      allowed["wrong_home_hits"]=1; allowed["wrong_home_sightings"]=1
+      allowed["wrong_home_scan_signature"]=1; allowed["grace_secs"]=1
+      required["schema"]=1; required["corr_id"]=1; required["task_id"]=1
+      required["parent_home"]=1; required["parent_status"]=1
+      required["delivered_epoch"]=1; required["phase"]=1
+      valid=1
+    }
+    /^[^=]+=/{
+      key=$1
+      if (!(key in allowed) || (key in seen)) valid=0
+      seen[key]=1
+      next
+    }
+    { valid=0 }
+    END {
+      for (key in required) if (!(key in seen)) valid=0
+      exit !valid
+    }
+  ' "$rec" 2>/dev/null || return 1
+  [ "$(fm_pending_reply_get "$rec" schema)" = fm-pending-reply.v1 ] || return 1
+  printf '%s' "$wanted_corr" | grep -Eq '^[A-Fa-f0-9]{16}$' || return 1
+  [ -d "$state" ] && [ ! -L "$state" ] || return 1
+  state_abs=$(cd "$state" 2>/dev/null && pwd -P) || return 1
+  record_corr=$(fm_pending_reply_get "$rec" corr_id)
+  record_task=$(fm_pending_reply_get "$rec" task_id)
+  [ "$record_corr" = "$wanted_corr" ] || return 1
+  [ "$record_task" = "$wanted_task" ] || return 1
+  parent_home=$(fm_pending_reply_get "$rec" parent_home)
+  parent_status=$(fm_pending_reply_get "$rec" parent_status)
+  case "$parent_home:$parent_status" in /*:/*) ;; *) return 1 ;; esac
+  [ -d "$parent_home" ] && [ ! -L "$parent_home" ] || return 1
+  parent_abs=$(cd "$parent_home" 2>/dev/null && pwd -P) || return 1
+  expected_home=$(fm_pending_reply_expected_parent_home "$state_abs") || return 1
+  [ "$parent_abs" = "$expected_home" ] || return 1
+  pending_dir=$(fm_pending_reply_dir "$state_abs")
+  [ -d "$pending_dir" ] && [ ! -L "$pending_dir" ] || return 1
+  expected_status="$state_abs/$wanted_task.status"
+  [ "$parent_status" = "$expected_status" ] || return 1
+  [ ! -L "$expected_status" ] || return 1
+  if [ -e "$expected_status" ]; then
+    [ -f "$expected_status" ] || return 1
+  fi
+  delivered=$(fm_pending_reply_get "$rec" delivered_epoch)
+  case "$delivered" in *[!0-9]*) return 1 ;; esac
+  phase=$(fm_pending_reply_get "$rec" phase)
+  case "$phase" in
+    awaiting_report|delivery_unknown|recovery_sending|recovery_sent|recovery_failed|recovery_unknown|escalated|resolved|retired) ;;
+    *) return 1 ;;
+  esac
+  return 0
+}
+
+# JT secondmate outcome routing uses the existing parent-owned pending-reply
+# record and its corr= acknowledgement grammar. This small marker only binds a
+# secondmate home to that already-owned record; it is not a second parent
+# protocol. The marker is intentionally fail-closed when any field is missing,
+# malformed, or no longer matches the live parent record.
+fm_pending_reply_secondmate_route_path() {  # <secondmate-home>
+  printf '%s/state/.fm-jt-parent-route' "$1"
+}
+
+fm_pending_reply_secondmate_route_history_path() {  # <secondmate-home> <corr-id>
+  printf '%s/state/.fm-jt-parent-route-history.%s' "$1" "$2"
+}
+
+fm_pending_reply_parent_corr_valid() {  # <correlation-or-empty>
+  [ -z "$1" ] || printf '%s' "$1" | grep -Eq '^[A-Fa-f0-9]{16}$'
+}
+
+fm_pending_reply_secondmate_route_lock_path() {  # <secondmate-home>
+  printf '%s/state/.fm-jt-parent-route.lock' "$1"
+}
+
+fm_pending_reply_secondmate_route_shape() {  # <marker-path>
+  awk -F= '
+    BEGIN { schema=secondmate_id=parent_home=parent_status=corr_id=0; valid=1 }
+    NF < 2 { valid=0; next }
+    $1 == "schema" { schema++; next }
+    $1 == "secondmate_id" { secondmate_id++; next }
+    $1 == "parent_home" { parent_home++; next }
+    $1 == "parent_status" { parent_status++; next }
+    $1 == "corr_id" { corr_id++; next }
+    { valid=0 }
+    END {
+      if (schema != 1 || secondmate_id != 1 || parent_home != 1 || parent_status != 1 || corr_id != 1) valid=0
+      exit !valid
+    }
+  ' "$1" 2>/dev/null
+}
+
+fm_pending_reply_secondmate_route_write() {  # <secondmate-home> <parent-home> <parent-state> <secondmate-id> <corr-id>
+  local secondmate_home=$1 parent_home=$2 parent_state=$3 secondmate_id=$4 corr=$5
+  local marker home_marker route_lock tmp parent_abs state_abs expected_home status_path marker_id route_status=0
+  local existing_schema existing_id existing_home existing_status existing_corr existing_rec existing_delivered route_mode
+  local history_marker
+  FM_PENDING_REPLY_ROUTE_COMMITTED=0
+  marker=$(fm_pending_reply_secondmate_route_path "$secondmate_home")
+  [ -d "$secondmate_home" ] && [ ! -L "$secondmate_home" ] || return 1
+  [ -d "$secondmate_home/state" ] && [ ! -L "$secondmate_home/state" ] || return 1
+  home_marker="$secondmate_home/.fm-secondmate-home"
+  [ -f "$home_marker" ] && [ ! -L "$home_marker" ] || return 1
+  case "$secondmate_id" in ''|*[!A-Za-z0-9._-]*) return 1 ;; esac
+  marker_id=$(cat "$home_marker" 2>/dev/null || true)
+  [ "$marker_id" = "$secondmate_id" ] || return 1
+  [ -d "$parent_home" ] && [ ! -L "$parent_home" ] || return 1
+  parent_abs=$(cd "$parent_home" 2>/dev/null && pwd -P) || return 1
+  [ -d "$parent_state" ] && [ ! -L "$parent_state" ] || return 1
+  state_abs=$(cd "$parent_state" 2>/dev/null && pwd -P) || return 1
+  expected_home=$(fm_pending_reply_expected_parent_home "$state_abs") || return 1
+  [ "$parent_abs" = "$expected_home" ] || return 1
+  status_path="$state_abs/$secondmate_id.status"
+  [ ! -L "$status_path" ] || return 1
+  if [ -e "$status_path" ]; then
+    [ -f "$status_path" ] || return 1
+  fi
+  fm_pending_reply_parent_corr_valid "$corr" || return 1
+  [ -n "$corr" ] || return 1
+  route_lock=$(fm_pending_reply_secondmate_route_lock_path "$secondmate_home")
+  if ! fm_lock_acquire_wait "$route_lock"; then
+    return 1
+  fi
+  tmp=$(mktemp "$secondmate_home/state/.fm-jt-parent-route.XXXXXX") || {
+    fm_lock_release "$route_lock" || true
+    return 1
+  }
+  [ -f "$tmp" ] && [ ! -L "$tmp" ] || {
+    rm -f "$tmp"
+    fm_lock_release "$route_lock" || true
+    return 1
+  }
+  {
+    printf 'schema=fm-jt-parent-route.v1\n'
+    printf 'secondmate_id=%s\n' "$secondmate_id"
+    printf 'parent_home=%s\n' "$parent_abs"
+    printf 'parent_status=%s\n' "$status_path"
+    printf 'corr_id=%s\n' "$corr"
+  } | fm_nofollow_write "$tmp" || { rm -f "$tmp"; fm_lock_release "$route_lock" || true; return 1; }
+  chmod 600 "$tmp" 2>/dev/null || true
+  if [ -e "$marker" ] || [ -L "$marker" ]; then
+    if [ -f "$marker" ] && [ ! -L "$marker" ] \
+      && [ "$(awk 'END { print NR + 0 }' "$marker" 2>/dev/null || true)" = 5 ]; then
+      existing_schema=$(fm_pending_reply_get "$marker" schema)
+      existing_id=$(fm_pending_reply_get "$marker" secondmate_id)
+      existing_home=$(fm_pending_reply_get "$marker" parent_home)
+      existing_status=$(fm_pending_reply_get "$marker" parent_status)
+      existing_corr=$(fm_pending_reply_get "$marker" corr_id)
+      if [ "$existing_schema" = fm-jt-parent-route.v1 ] \
+        && [ "$existing_id" = "$secondmate_id" ] \
+        && [ "$existing_home" = "$parent_abs" ] \
+        && [ "$existing_status" = "$status_path" ] \
+        && [ "$existing_corr" = "$corr" ]; then
+        existing_rec=$(fm_pending_reply_active_path "$state_abs" "$existing_corr")
+        if ! fm_pending_reply_record_validate "$existing_rec" "$state_abs" "$existing_corr" "$secondmate_id"; then
+          route_status=1
+        else
+          existing_delivered=$(fm_pending_reply_get "$existing_rec" delivered_epoch)
+          route_mode=2
+          [ -n "$existing_delivered" ] && route_mode=4
+          fm_pending_reply_secondmate_route_validate "$secondmate_home" "$existing_corr" "$route_mode" \
+            || route_status=1
+        fi
+        if [ "$route_status" = 0 ]; then
+          FM_PENDING_REPLY_ROUTE_COMMITTED=1
+          rm -f "$tmp"
+          fm_lock_release "$route_lock" || return 1
+          return 0
+        fi
+      fi
+      if [ "$existing_schema" != fm-jt-parent-route.v1 ] \
+        || [ "$existing_id" != "$secondmate_id" ]; then
+        route_status=1
+      fi
+      if [ "$route_status" = 0 ]; then
+        fm_pending_reply_secondmate_route_validate "$secondmate_home" "$existing_corr" \
+          || route_status=1
+        if [ "$route_status" = 0 ]; then
+          case "$FM_PENDING_ROUTE_PHASE" in
+            resolved|retired) ;;
+            *) route_status=1 ;;
+          esac
+        fi
+      fi
+      if [ "$route_status" = 0 ] && [ "$existing_corr" != "$corr" ]; then
+        history_marker=$(fm_pending_reply_secondmate_route_history_path "$secondmate_home" "$existing_corr")
+        [ ! -L "$history_marker" ] || route_status=1
+        if [ "$route_status" = 0 ] && [ -e "$history_marker" ]; then
+          [ -f "$history_marker" ] || route_status=1
+          [ "$route_status" = 0 ] && cmp -s "$marker" "$history_marker" || route_status=1
+        elif [ "$route_status" = 0 ]; then
+          ln "$marker" "$history_marker" || route_status=1
+        fi
+      fi
+    else
+      route_status=1
+    fi
+  fi
+  if [ "$route_status" = 0 ]; then
+    if fm_nofollow_rename "$tmp" "$marker"; then
+      # shellcheck disable=SC2034 # consumed by fm-send.sh after sourcing this library
+      FM_PENDING_REPLY_ROUTE_COMMITTED=1
+    else
+      route_status=1
+    fi
+  fi
+  [ "$route_status" = 0 ] || rm -f "$tmp"
+  fm_lock_release "$route_lock" || route_status=1
+  return "$route_status"
+}
+
+fm_pending_reply_secondmate_route_clear_with_mode() {  # <secondmate-home> <corr-id> <allow-undelivered> [<secondmate-id> <parent-home> <parent-status>]
+  local secondmate_home=$1 corr=$2 allow_undelivered=${3:-0} expected_id=${4:-} expected_home=${5:-} expected_status=${6:-}
+  local marker route_lock current_corr history_marker status=0
+  FM_PENDING_REPLY_ROUTE_LOCK_CONTENDED=0
+  [ -d "$secondmate_home" ] && [ ! -L "$secondmate_home" ] || return 1
+  [ -d "$secondmate_home/state" ] && [ ! -L "$secondmate_home/state" ] || return 1
+  printf '%s' "$corr" | grep -Eq '^[A-Fa-f0-9]{16}$' || return 1
+  marker=$(fm_pending_reply_secondmate_route_path "$secondmate_home")
+  route_lock=$(fm_pending_reply_secondmate_route_lock_path "$secondmate_home")
+  if ! fm_lock_acquire_wait "$route_lock"; then
+    FM_PENDING_REPLY_ROUTE_LOCK_CONTENDED=1
+    return 1
+  fi
+  if [ -e "$marker" ] || [ -L "$marker" ]; then
+    if [ ! -f "$marker" ] || [ -L "$marker" ] \
+      || [ "$(awk 'END { print NR + 0 }' "$marker" 2>/dev/null || true)" != 5 ] \
+      || ! fm_pending_reply_secondmate_route_shape "$marker"; then
+      status=1
+    else
+      current_corr=$(fm_pending_reply_get "$marker" corr_id)
+      if [ "$current_corr" != "$corr" ]; then
+        if ! fm_pending_reply_secondmate_route_validate "$secondmate_home" "" 2; then
+          status=1
+        else
+          history_marker=$(fm_pending_reply_secondmate_route_history_path "$secondmate_home" "$corr")
+          if [ ! -e "$history_marker" ] && [ ! -L "$history_marker" ]; then
+            fm_lock_release "$route_lock" || true
+            return 0
+          fi
+          marker=$history_marker
+        fi
+      fi
+    fi
+  else
+    marker=$(fm_pending_reply_secondmate_route_history_path "$secondmate_home" "$corr")
+    if [ ! -e "$marker" ] && [ ! -L "$marker" ]; then
+      fm_lock_release "$route_lock" || true
+      return 0
+    fi
+  fi
+  if [ "$status" = 0 ] && fm_pending_reply_secondmate_route_validate "$secondmate_home" "$corr" "$allow_undelivered"; then
+    [ -z "$expected_id" ] || [ "$FM_PENDING_ROUTE_SECOND_MATE_ID" = "$expected_id" ] || status=1
+    [ -z "$expected_home" ] || [ "$FM_PENDING_ROUTE_PARENT_HOME" = "$expected_home" ] || status=1
+    [ -z "$expected_status" ] || [ "$FM_PENDING_ROUTE_PARENT_STATUS" = "$expected_status" ] || status=1
+    if [ "$status" = 0 ]; then
+      pending_status=1
+      if [ "$allow_undelivered" = 4 ]; then
+        pending_status=0
+        fm_pending_reply_secondmate_route_has_pending_receipt "$secondmate_home" "$corr" \
+          || pending_status=$?
+      fi
+      case "$pending_status" in
+        0)
+          # Keep one shared route for all receipts bound to this parent
+          # correlation. The final reported receipt removes it.
+          ;;
+        1) rm -f "$FM_PENDING_ROUTE_MARKER" || status=1 ;;
+        *) status=1 ;;
+      esac
+    fi
+  elif [ "$status" = 0 ]; then
+    status=1
+  fi
+  fm_lock_release "$route_lock" || status=1
+  return "$status"
+}
+
+fm_pending_reply_secondmate_route_clear() {  # <secondmate-home> <corr-id>
+  fm_pending_reply_secondmate_route_clear_with_mode "$1" "$2" 0
+}
+
+fm_pending_reply_secondmate_route_clear_reported() {  # <secondmate-home> <corr-id> [<secondmate-id> <parent-home> <parent-status>]
+  fm_pending_reply_secondmate_route_clear_with_mode "$1" "$2" 4 "${3:-}" "${4:-}" "${5:-}"
+  local status=$?
+  [ "$status" = 1 ] && [ "${FM_PENDING_REPLY_ROUTE_LOCK_CONTENDED:-0}" = 1 ] && return 75
+  return "$status"
+}
+
+fm_pending_reply_secondmate_route_clear_undelivered() {  # <secondmate-home> <corr-id> [deadline-ms]
+  local secondmate_home=$1 corr=$2 deadline_ms=${3:-} marker route_lock current_corr status=0 marker_removed=0
+  local wait_secs remaining_ms now_ms
+  [ -d "$secondmate_home" ] && [ ! -L "$secondmate_home" ] || return 1
+  [ -d "$secondmate_home/state" ] && [ ! -L "$secondmate_home/state" ] || return 1
+  printf '%s' "$corr" | grep -Eq '^[A-Fa-f0-9]{16}$' || return 1
+  route_lock=$(fm_pending_reply_secondmate_route_lock_path "$secondmate_home")
+  if [ -n "$deadline_ms" ]; then
+    case "$deadline_ms" in ''|*[!0-9]*) return 1 ;; esac
+    now_ms=$(fm_pending_reply_cleanup_retry_now_ms)
+    remaining_ms=$((deadline_ms - now_ms))
+    [ "$remaining_ms" -gt 0 ] || return 75
+    wait_secs=$((remaining_ms / 1000))
+  else
+    wait_secs=${FM_LOCK_WAIT_SECS:-30}
+  fi
+  if ! FM_LOCK_WAIT_SECS="$wait_secs" fm_lock_acquire_wait "$route_lock"; then
+    [ -n "$deadline_ms" ] && return 75
+    return 1
+  fi
+  marker=$(fm_pending_reply_secondmate_route_path "$secondmate_home")
+  if [ -e "$marker" ] || [ -L "$marker" ]; then
+    if [ ! -f "$marker" ] || [ -L "$marker" ] \
+      || [ "$(awk 'END { print NR + 0 }' "$marker" 2>/dev/null || true)" != 5 ] \
+      || ! fm_pending_reply_secondmate_route_shape "$marker"; then
+      fm_lock_release "$route_lock" || true
+      return 1
+    fi
+    current_corr=$(fm_pending_reply_get "$marker" corr_id)
+    if [ "$current_corr" != "$corr" ]; then
+      fm_lock_release "$route_lock" || true
+      return 0
+    fi
+  else
+    marker=$(fm_pending_reply_secondmate_route_history_path "$secondmate_home" "$corr")
+    if [ ! -e "$marker" ] && [ ! -L "$marker" ]; then
+      fm_lock_release "$route_lock" || true
+      return 0
+    fi
+    if [ ! -f "$marker" ] || [ -L "$marker" ]; then
+      fm_lock_release "$route_lock" || true
+      return 1
+    fi
+  fi
+  if fm_pending_reply_secondmate_route_validate "$secondmate_home" "$corr" 3; then
+    if rm -f "$FM_PENDING_ROUTE_MARKER"; then
+      marker_removed=1
+    else
+      status=1
+    fi
+  else
+    status=1
+  fi
+  fm_lock_release "$route_lock" || [ "$marker_removed" = 1 ] || status=1
+  return "$status"
+}
+
+fm_pending_reply_secondmate_route_validate() {  # <secondmate-home> [<corr-id>] [<allow-undelivered>]
+  local secondmate_home=$1 wanted_corr=${2:-} allow_undelivered=${3:-0} marker line key value schema marker_id secondmate_id current_corr history_marker
+  local parent_home parent_status corr parent_abs state_abs expected_home parent_status_dir pending_dir expected_status rec active_rec history_rec history_dir
+  local phase delivered record_home record_home_abs record_task record_corr home_marker
+  local seen_schema=0 seen_secondmate_id=0 seen_parent_home=0 seen_parent_status=0 seen_corr=0
+  FM_PENDING_ROUTE_PARENT_STATUS=
+  FM_PENDING_ROUTE_PARENT_HOME=
+  FM_PENDING_ROUTE_CORR=
+  FM_PENDING_ROUTE_SECOND_MATE_ID=
+  FM_PENDING_ROUTE_STATE=
+  FM_PENDING_ROUTE_PHASE=
+  FM_PENDING_ROUTE_MARKER=
+  marker=$(fm_pending_reply_secondmate_route_path "$secondmate_home")
+  if [ -n "$wanted_corr" ]; then
+    printf '%s' "$wanted_corr" | grep -Eq '^[A-Fa-f0-9]{16}$' || return 1
+    if [ -e "$marker" ] || [ -L "$marker" ]; then
+      [ -f "$marker" ] && [ ! -L "$marker" ] || return 1
+      [ "$(awk 'END { print NR + 0 }' "$marker" 2>/dev/null || true)" = 5 ] || return 1
+      fm_pending_reply_secondmate_route_shape "$marker" || return 1
+      if [ "$allow_undelivered" = 3 ] || [ "$allow_undelivered" = 4 ]; then
+        fm_pending_reply_secondmate_route_validate "$secondmate_home" "" "$allow_undelivered" || return 1
+      else
+        fm_pending_reply_secondmate_route_validate "$secondmate_home" "" 2 || return 1
+      fi
+      current_corr=$FM_PENDING_ROUTE_CORR
+      if [ "$current_corr" != "$wanted_corr" ]; then
+        history_marker=$(fm_pending_reply_secondmate_route_history_path "$secondmate_home" "$wanted_corr")
+        [ -f "$history_marker" ] && [ ! -L "$history_marker" ] || return 1
+        marker=$history_marker
+      fi
+    else
+      history_marker=$(fm_pending_reply_secondmate_route_history_path "$secondmate_home" "$wanted_corr")
+      [ -f "$history_marker" ] && [ ! -L "$history_marker" ] || return 1
+      marker=$history_marker
+    fi
+  fi
+  [ -f "$marker" ] && [ ! -L "$marker" ] || return 1
+  schema='' secondmate_id='' parent_home='' parent_status='' corr=''
+  while IFS= read -r line || [ -n "$line" ]; do
+    case "$line" in
+      *=*) key=${line%%=*}; value=${line#*=} ;;
+      *) return 1 ;;
+    esac
+    case "$key" in
+      schema) [ "$seen_schema" = 0 ] || return 1; seen_schema=1; schema=$value ;;
+      secondmate_id) [ "$seen_secondmate_id" = 0 ] || return 1; seen_secondmate_id=1; secondmate_id=$value ;;
+      parent_home) [ "$seen_parent_home" = 0 ] || return 1; seen_parent_home=1; parent_home=$value ;;
+      parent_status) [ "$seen_parent_status" = 0 ] || return 1; seen_parent_status=1; parent_status=$value ;;
+      corr_id) [ "$seen_corr" = 0 ] || return 1; seen_corr=1; corr=$value ;;
+      *) return 1 ;;
+    esac
+  done < "$marker"
+  [ "$seen_schema" = 1 ] && [ "$seen_secondmate_id" = 1 ] \
+    && [ "$seen_parent_home" = 1 ] && [ "$seen_parent_status" = 1 ] \
+    && [ "$seen_corr" = 1 ] || return 1
+  [ "$schema" = fm-jt-parent-route.v1 ] || return 1
+  [ -z "$wanted_corr" ] || [ "$corr" = "$wanted_corr" ] || return 1
+  [ -d "$secondmate_home" ] && [ ! -L "$secondmate_home" ] || return 1
+  [ -d "$secondmate_home/state" ] && [ ! -L "$secondmate_home/state" ] || return 1
+  home_marker="$secondmate_home/.fm-secondmate-home"
+  [ -f "$home_marker" ] && [ ! -L "$home_marker" ] || return 1
+  marker_id=$(cat "$home_marker" 2>/dev/null || true)
+  case "$marker_id" in ''|*[!A-Za-z0-9._-]*) return 1 ;; esac
+  [ "$secondmate_id" = "$marker_id" ] || return 1
+  case "$parent_home" in /*) ;; *) return 1 ;; esac
+  case "$parent_status" in /*) ;; *) return 1 ;; esac
+  printf '%s' "$corr" | grep -Eq '^[A-Fa-f0-9]{16}$' || return 1
+  [ -d "$parent_home" ] && [ ! -L "$parent_home" ] || return 1
+  parent_abs=$(cd "$parent_home" 2>/dev/null && pwd -P) || return 1
+  parent_status_dir=${parent_status%/*}
+  [ -n "$parent_status_dir" ] && [ -d "$parent_status_dir" ] && [ ! -L "$parent_status_dir" ] || return 1
+  state_abs=$(cd "$parent_status_dir" 2>/dev/null && pwd -P) || return 1
+  expected_home=$(fm_pending_reply_expected_parent_home "$state_abs") || return 1
+  [ "$parent_abs" = "$expected_home" ] || return 1
+  pending_dir=$(fm_pending_reply_dir "$state_abs")
+  [ -d "$pending_dir" ] && [ ! -L "$pending_dir" ] || return 1
+  history_dir=$(fm_pending_reply_history_dir "$state_abs")
+  if [ -e "$history_dir" ] || [ -L "$history_dir" ]; then
+    [ -d "$history_dir" ] && [ ! -L "$history_dir" ] || return 1
+  fi
+  expected_status="$state_abs/$secondmate_id.status"
+  [ "$parent_status" = "$expected_status" ] || return 1
+  [ ! -L "$expected_status" ] || return 1
+  if [ -e "$expected_status" ]; then
+    [ -f "$expected_status" ] || return 1
+  fi
+  active_rec=$(fm_pending_reply_active_path "$state_abs" "$corr")
+  history_rec="$history_dir/$corr"
+  rec=
+  if [ -e "$active_rec" ] || [ -L "$active_rec" ]; then
+    [ -f "$active_rec" ] && [ ! -L "$active_rec" ] || return 1
+    rec=$active_rec
+  elif [ -e "$history_rec" ] || [ -L "$history_rec" ]; then
+    [ -f "$history_rec" ] && [ ! -L "$history_rec" ] || return 1
+    rec=$history_rec
+  elif [ "$allow_undelivered" != 3 ] && [ "$allow_undelivered" != 4 ]; then
+    return 1
+  fi
+  if [ -n "$rec" ]; then
+    fm_pending_reply_record_validate "$rec" "$state_abs" "$corr" "$secondmate_id" || return 1
+    record_home=$(fm_pending_reply_get "$rec" parent_home)
+    [ -d "$record_home" ] && [ ! -L "$record_home" ] || return 1
+    record_home_abs=$(cd "$record_home" 2>/dev/null && pwd -P) || return 1
+    [ "$record_home_abs" = "$parent_abs" ] || return 1
+    delivered=$(fm_pending_reply_get "$rec" delivered_epoch)
+    phase=$(fm_pending_reply_get "$rec" phase)
+    case "$phase" in
+      awaiting_report|recovery_sending|recovery_sent|recovery_failed|recovery_unknown|escalated|resolved|retired) ;;
+      delivery_unknown)
+        [ "$allow_undelivered" = 2 ] \
+          || { [ "$allow_undelivered" = 4 ] && [ -z "$wanted_corr" ]; } \
+          || return 1
+        ;;
+      *) return 1 ;;
+    esac
+    case "$allow_undelivered" in
+      1)
+        [ -z "$delivered" ] || return 1
+        [ "$phase" = awaiting_report ] || return 1
+        ;;
+      2)
+        if [ -z "$delivered" ]; then
+          case "$phase" in awaiting_report|delivery_unknown) ;; *) return 1 ;; esac
+        fi
+        ;;
+      3)
+        [ -z "$delivered" ] || return 1
+        [ "$phase" = awaiting_report ] || return 1
+        ;;
+      4)
+        if [ -n "$wanted_corr" ]; then
+          [ -n "$delivered" ] || return 1
+        fi
+        ;;
+      *)
+        [ -n "$delivered" ] || return 1
+        ;;
+    esac
+  elif [ "$allow_undelivered" != 3 ] && [ "$allow_undelivered" != 4 ]; then
+    return 1
+  fi
+  # shellcheck disable=SC2034 # consumed by fm-inactive-reconcile.sh
+  FM_PENDING_ROUTE_PARENT_HOME=$parent_abs
+  # shellcheck disable=SC2034 # consumed by fm-inactive-reconcile.sh
+  FM_PENDING_ROUTE_PARENT_STATUS=$expected_status
+  # shellcheck disable=SC2034 # consumed by fm-inactive-reconcile.sh
+  FM_PENDING_ROUTE_CORR=$corr
+  # shellcheck disable=SC2034 # consumed by fm-inactive-reconcile.sh
+  FM_PENDING_ROUTE_SECOND_MATE_ID=$secondmate_id
+  # shellcheck disable=SC2034 # consumed by fm-inactive-reconcile.sh
+  FM_PENDING_ROUTE_STATE=$state_abs
+  FM_PENDING_ROUTE_PHASE=${phase:-}
+  FM_PENDING_ROUTE_MARKER=$marker
+  return 0
+}
+
+fm_pending_reply_secondmate_receipt_validate() {  # <secondmate-home> <secondmate-id> <parent-home> <parent-status> <corr>
+  local secondmate_home=$1 secondmate_id=$2 parent_home=$3 parent_status=$4 corr=$5
+  local home_marker marker_id parent_abs state_abs expected_home parent_status_dir pending_dir expected_status rec active_rec history_rec history_dir
+  local delivered phase
+  FM_PENDING_ROUTE_STATE=
+  [ -d "$secondmate_home" ] && [ ! -L "$secondmate_home" ] || return 1
+  [ -d "$secondmate_home/state" ] && [ ! -L "$secondmate_home/state" ] || return 1
+  home_marker="$secondmate_home/.fm-secondmate-home"
+  [ -f "$home_marker" ] && [ ! -L "$home_marker" ] || return 1
+  marker_id=$(cat "$home_marker" 2>/dev/null || true)
+  case "$secondmate_id" in ''|*[!A-Za-z0-9._-]*) return 1 ;; esac
+  [ "$marker_id" = "$secondmate_id" ] || return 1
+  case "$parent_home" in /*) ;; *) return 1 ;; esac
+  case "$parent_status" in /*) ;; *) return 1 ;; esac
+  printf '%s' "$corr" | grep -Eq '^[A-Fa-f0-9]{16}$' || return 1
+  [ -d "$parent_home" ] && [ ! -L "$parent_home" ] || return 1
+  parent_abs=$(cd "$parent_home" 2>/dev/null && pwd -P) || return 1
+  parent_status_dir=${parent_status%/*}
+  [ -n "$parent_status_dir" ] && [ -d "$parent_status_dir" ] && [ ! -L "$parent_status_dir" ] || return 1
+  state_abs=$(cd "$parent_status_dir" 2>/dev/null && pwd -P) || return 1
+  expected_home=$(fm_pending_reply_expected_parent_home "$state_abs") || return 1
+  [ "$parent_abs" = "$expected_home" ] || return 1
+  pending_dir=$(fm_pending_reply_dir "$state_abs")
+  [ -d "$pending_dir" ] && [ ! -L "$pending_dir" ] || return 1
+  history_dir=$(fm_pending_reply_history_dir "$state_abs")
+  if [ -e "$history_dir" ] || [ -L "$history_dir" ]; then
+    [ -d "$history_dir" ] && [ ! -L "$history_dir" ] || return 1
+  fi
+  expected_status="$state_abs/$secondmate_id.status"
+  [ "$parent_status" = "$expected_status" ] || return 1
+  [ ! -L "$parent_status" ] || return 1
+  if [ -e "$parent_status" ]; then
+    [ -f "$parent_status" ] || return 1
+  fi
+  active_rec=$(fm_pending_reply_active_path "$state_abs" "$corr")
+  history_rec="$history_dir/$corr"
+  if [ -e "$active_rec" ] || [ -L "$active_rec" ]; then
+    [ -f "$active_rec" ] && [ ! -L "$active_rec" ] || return 1
+    rec=$active_rec
+  elif [ -e "$history_rec" ] || [ -L "$history_rec" ]; then
+    [ -f "$history_rec" ] && [ ! -L "$history_rec" ] || return 1
+    rec=$history_rec
+  else
+    return 1
+  fi
+  fm_pending_reply_record_validate "$rec" "$state_abs" "$corr" "$secondmate_id" || return 1
+  delivered=$(fm_pending_reply_get "$rec" delivered_epoch)
+  [ -n "$delivered" ] || return 1
+  phase=$(fm_pending_reply_get "$rec" phase)
+  case "$phase" in
+    awaiting_report|recovery_sending|recovery_sent|recovery_failed|recovery_unknown|escalated|resolved|retired) ;;
+    *) return 1 ;;
+  esac
+  # shellcheck disable=SC2034 # consumed by fm-inactive-reconcile.sh
+  FM_PENDING_ROUTE_STATE=$state_abs
+  FM_PENDING_ROUTE_PHASE=$phase
+  return 0
+}
+
+fm_pending_reply_secondmate_route_has_pending_receipt() {  # <secondmate-home> <corr-id>
+  local secondmate_home=$1 corr=$2 outcome_dir rec kind rec_corr
+  outcome_dir="$secondmate_home/state/terminal-outcomes"
+  [ -d "$outcome_dir" ] && [ ! -L "$outcome_dir" ] || return 1
+  for rec in "$outcome_dir"/*.pending; do
+    if [ ! -e "$rec" ]; then
+      [ -L "$rec" ] && return 2
+      continue
+    fi
+    [ -f "$rec" ] && [ ! -L "$rec" ] || return 2
+    kind=$(fm_pending_reply_get "$rec" kind)
+    [ "$kind" = secondmate ] || continue
+    rec_corr=$(fm_pending_reply_get "$rec" parent_corr)
+    [ "$rec_corr" = "$corr" ] && return 0
+  done
+  return 1
+}
+
 fm_pending_reply_corr_reusable() {  # <state-dir> <corr_id> <task_id>
-  local state=$1 corr=$2 task_id=$3 rec phase
+  local state=$1 corr=$2 task_id=$3 rec phase delivered
   printf '%s' "$corr" | grep -Eq '^[A-Fa-f0-9]{16}$' || return 1
   rec=$(fm_pending_reply_active_path "$state" "$corr")
-  [ -f "$rec" ] || return 1
-  [ "$(fm_pending_reply_get "$rec" task_id)" = "$task_id" ] || return 1
+  fm_pending_reply_record_validate "$rec" "$state" "$corr" "$task_id" || return 1
+  delivered=$(fm_pending_reply_get "$rec" delivered_epoch)
   phase=$(fm_pending_reply_get "$rec" phase)
   case "$phase" in
-    awaiting_report|recovery_sending|recovery_sent) return 0 ;;
+    awaiting_report|delivery_unknown) return 0 ;;
+    recovery_sending|recovery_sent) [ -n "$delivered" ] || return 1; return 0 ;;
   esac
   return 1
 }
@@ -501,14 +1128,15 @@ fm_pending_reply_set() {  # <record-path> <key> <value>
   dir=$(dirname "$rec")
   base=$(basename "$rec")
   tmp="$dir/.${base}.tmp.$$"
-  : > "$tmp" || return 1
-  while IFS= read -r line || [ -n "$line" ]; do
-    case "$line" in
-      "${key}="*) continue ;;
-    esac
-    printf '%s\n' "$line" >> "$tmp" || return 1
-  done < "$rec"
-  printf '%s=%s\n' "$key" "$value" >> "$tmp" || return 1
+  {
+    while IFS= read -r line || [ -n "$line" ]; do
+      case "$line" in
+        "${key}="*) continue ;;
+      esac
+      printf '%s\n' "$line"
+    done < "$rec"
+    printf '%s=%s\n' "$key" "$value"
+  } | fm_nofollow_write "$tmp" || return 1
   mv -f "$tmp" "$rec"
 }
 
@@ -518,18 +1146,19 @@ fm_pending_reply_set_retirement_stage() {  # <record-path> <epoch> <history-stat
   dir=$(dirname "$rec")
   base=$(basename "$rec")
   tmp="$dir/.${base}.stage.$$"
-  : > "$tmp" || return 1
-  while IFS= read -r line || [ -n "$line" ]; do
-    case "$line" in
-      retirement_staged_epoch=*|retirement_history_state=*|retirement_staged_from=*|retirement_source_state=*) continue ;;
-    esac
-    printf '%s\n' "$line" >> "$tmp" || return 1
-  done < "$rec"
-  printf '%s\n' \
-    "retirement_staged_epoch=$epoch" \
-    "retirement_history_state=$history_state" \
-    "retirement_staged_from=$source_phase" \
-    "retirement_source_state=$source_state" >> "$tmp" || return 1
+  {
+    while IFS= read -r line || [ -n "$line" ]; do
+      case "$line" in
+        retirement_staged_epoch=*|retirement_history_state=*|retirement_staged_from=*|retirement_source_state=*) continue ;;
+      esac
+      printf '%s\n' "$line"
+    done < "$rec"
+    printf '%s\n' \
+      "retirement_staged_epoch=$epoch" \
+      "retirement_history_state=$history_state" \
+      "retirement_staged_from=$source_phase" \
+      "retirement_source_state=$source_state"
+  } | fm_nofollow_write "$tmp" || return 1
   chmod 600 "$tmp" 2>/dev/null || true
   mv -f "$tmp" "$rec"
 }
@@ -540,13 +1169,14 @@ fm_pending_reply_clear_retirement_stage() {  # <record-path>
   dir=$(dirname "$rec")
   base=$(basename "$rec")
   tmp="$dir/.${base}.unstage.$$"
-  : > "$tmp" || return 1
-  while IFS= read -r line || [ -n "$line" ]; do
-    case "$line" in
-      retirement_staged_epoch=*|retirement_history_state=*|retirement_staged_from=*) continue ;;
-    esac
-    printf '%s\n' "$line" >> "$tmp" || return 1
-  done < "$rec"
+  {
+    while IFS= read -r line || [ -n "$line" ]; do
+      case "$line" in
+        retirement_staged_epoch=*|retirement_history_state=*|retirement_staged_from=*) continue ;;
+      esac
+      printf '%s\n' "$line"
+    done < "$rec"
+  } | fm_nofollow_write "$tmp" || return 1
   chmod 600 "$tmp" 2>/dev/null || true
   mv -f "$tmp" "$rec"
 }
@@ -605,7 +1235,7 @@ fm_pending_reply_create() {  # <parent-home> <state-dir> <task_id> <request-text
     *) parent_home=$(cd "$parent_home" 2>/dev/null && pwd) || parent_home=$1 ;;
   esac
   tmp="$dir/.${corr}.tmp.$$"
-  cat > "$tmp" <<EOF
+  cat <<EOF | fm_nofollow_write "$tmp"
 schema=$FM_PENDING_REPLY_SCHEMA
 corr_id=$corr
 task_id=$task_id
@@ -676,7 +1306,7 @@ fm_pending_reply_write_delivery_confirmation() {  # <state-dir> <corr_id> <state
   dir=$(dirname "$marker")
   mkdir -p "$dir" || return 1
   tmp="$marker.tmp.$$"
-  printf '%s=%s\n' "$delivery_state" "$value" > "$tmp" || return 1
+  printf '%s=%s\n' "$delivery_state" "$value" | fm_nofollow_write "$tmp" || return 1
   chmod 600 "$tmp" 2>/dev/null || true
   mv -f "$tmp" "$marker"
 }
@@ -748,17 +1378,248 @@ fm_pending_reply_reconcile_delivery() {  # <state-dir> <corr_id>
   return 1
 }
 
+fm_pending_reply_undelivered_cleanup_meta_path() {  # <state-dir> <corr_id>
+  printf '%s.cleanup-meta' "$(fm_pending_reply_active_path "$1" "$2")"
+}
+
+fm_pending_reply_undelivered_cleanup_meta_valid() {  # <meta-path> <corr-id> <secondmate-home>
+  local meta=$1 corr=$2 secondmate_home=$3
+  [ -f "$meta" ] && [ ! -L "$meta" ] || return 1
+  awk -F= '
+    BEGIN { schema=corr=home=0; valid=1 }
+    NF != 2 { valid=0; next }
+    $1 == "schema" { schema++; next }
+    $1 == "corr_id" { corr++; next }
+    $1 == "secondmate_home" { home++; next }
+    { valid=0 }
+    END { if (schema != 1 || corr != 1 || home != 1) valid=0; exit !valid }
+  ' "$meta" 2>/dev/null || return 1
+  [ "$(fm_pending_reply_get "$meta" schema)" = fm-undelivered-cleanup.v1 ] || return 1
+  [ "$(fm_pending_reply_get "$meta" corr_id)" = "$corr" ] || return 1
+  [ "$(fm_pending_reply_get "$meta" secondmate_home)" = "$secondmate_home" ] || return 1
+}
+
+fm_pending_reply_schedule_undelivered_cleanup() {  # <state-dir> <corr-id> <secondmate-home>
+  local state=$1 corr=$2 secondmate_home=$3 dir meta tmp
+  printf '%s' "$corr" | grep -Eq '^[A-Fa-f0-9]{16}$' || return 1
+  case "$secondmate_home" in
+    /*)
+      case "$secondmate_home" in *$'\n'*|*'='*) return 1 ;; esac
+      ;;
+    *) return 1 ;;
+  esac
+  [ -d "$state" ] && [ ! -L "$state" ] || return 1
+  dir=$(fm_pending_reply_dir "$state")
+  [ -d "$dir" ] && [ ! -L "$dir" ] || return 1
+  meta=$(fm_pending_reply_undelivered_cleanup_meta_path "$state" "$corr")
+  if [ -e "$meta" ] || [ -L "$meta" ]; then
+    fm_pending_reply_undelivered_cleanup_meta_valid "$meta" "$corr" "$secondmate_home"
+    return $?
+  fi
+  tmp=$(mktemp "$dir/.cleanup-meta.XXXXXX") || return 1
+  [ -f "$tmp" ] && [ ! -L "$tmp" ] || { rm -f "$tmp"; return 1; }
+  {
+    printf 'schema=fm-undelivered-cleanup.v1\n'
+    printf 'corr_id=%s\n' "$corr"
+    printf 'secondmate_home=%s\n' "$secondmate_home"
+  } | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 1; }
+  chmod 600 "$tmp" 2>/dev/null || true
+  if ln "$tmp" "$meta" 2>/dev/null; then
+    rm -f "$tmp"
+    return 0
+  fi
+  rm -f "$tmp"
+  fm_pending_reply_undelivered_cleanup_meta_valid "$meta" "$corr" "$secondmate_home"
+}
+
+fm_pending_reply_retry_undelivered_cleanup() {  # <state-dir> <meta-path> [deadline-ms]
+  local state=$1 meta=$2 deadline_ms=${3:-} corr secondmate_home token rc=0 lock_rc
+  corr=$(fm_pending_reply_get "$meta" corr_id)
+  secondmate_home=$(fm_pending_reply_get "$meta" secondmate_home)
+  fm_pending_reply_undelivered_cleanup_meta_valid "$meta" "$corr" "$secondmate_home" || return 1
+  fm_pending_reply_txn_lock_acquire "$state" "$corr" token "$deadline_ms" || {
+    lock_rc=$?
+    [ "$lock_rc" = 75 ] && return 75
+    return "$lock_rc"
+  }
+  if ! fm_pending_reply_discard_undelivered "$state" "$corr" 1; then
+    fm_pending_reply_restore_undelivered "$state" "$corr" || true
+    rc=1
+  elif ! fm_pending_reply_secondmate_route_clear_undelivered "$secondmate_home" "$corr" "$deadline_ms"; then
+    fm_pending_reply_restore_undelivered "$state" "$corr" || true
+    rc=1
+  elif ! fm_pending_reply_finish_undelivered "$state" "$corr"; then
+    rc=1
+  fi
+  fm_pending_reply_txn_lock_release "$state" "$corr" "$token" || rc=1
+  if [ "$rc" = 0 ]; then
+    rm -f "$meta" || rc=1
+  fi
+  return "$rc"
+}
+
+fm_pending_reply_cleanup_retry_limit() {
+  local limit=${FM_PENDING_REPLY_CLEANUP_LIMIT:-8}
+  case "$limit" in ''|*[!0-9]*) limit=8 ;; esac
+  [ "$limit" -ge 1 ] || limit=1
+  [ "$limit" -le 64 ] || limit=64
+  printf '%s' "$limit"
+}
+
+fm_pending_reply_cleanup_retry_budget_secs() {
+  local budget=${FM_PENDING_REPLY_CLEANUP_BUDGET_SECS:-2}
+  case "$budget" in ''|*[!0-9]*) budget=2 ;; esac
+  [ "$budget" -ge 1 ] || budget=1
+  [ "$budget" -le 30 ] || budget=30
+  printf '%s' "$budget"
+}
+
+fm_pending_reply_cleanup_retry_now_ms() {
+  local stamp seconds
+  stamp=$(date +%s%N 2>/dev/null || true)
+  case "$stamp" in
+    ''|*[!0-9]*)
+      seconds=$(date +%s 2>/dev/null || printf '0')
+      printf '%s000' "$seconds"
+      ;;
+    *) printf '%s' "${stamp:0:13}" ;;
+  esac
+}
+
+fm_pending_reply_cleanup_deadline_check() {
+  local deadline_ms=$1 now_ms
+  [ -n "$deadline_ms" ] || return 0
+  now_ms=$(fm_pending_reply_cleanup_retry_now_ms)
+  [ "$now_ms" -lt "$deadline_ms" ]
+}
+
+fm_pending_reply_cleanup_deadline_sleep() {
+  local deadline_ms=$1 now_ms remaining_ms
+  if [ -z "$deadline_ms" ]; then
+    sleep 0.05
+    return $?
+  fi
+  now_ms=$(fm_pending_reply_cleanup_retry_now_ms)
+  remaining_ms=$((deadline_ms - now_ms))
+  [ "$remaining_ms" -ge 50 ] || return 75
+  sleep 0.05
+}
+
+fm_pending_reply_cleanup_retry_batch() {  # <state-dir> <pending-reply-dir>
+  local state=$1 dir=$2 cursor_path cursor cleanup_meta base pass started=0
+  local processed=0 last='' limit budget start deadline now lock_attempts tmp cleanup_rc
+  cursor_path="$state/.cleanup-retry.cursor"
+  limit=$(fm_pending_reply_cleanup_retry_limit)
+  budget=$(fm_pending_reply_cleanup_retry_budget_secs)
+  lock_attempts=${FM_PENDING_REPLY_CLEANUP_LOCK_ATTEMPTS:-20}
+  case "$lock_attempts" in ''|*[!0-9]*) lock_attempts=20 ;; esac
+  [ "$lock_attempts" -ge 1 ] || lock_attempts=1
+  [ "$lock_attempts" -le 200 ] || lock_attempts=200
+  cursor=$(cat "$cursor_path" 2>/dev/null || true)
+  case "$cursor" in
+    ''|*/*|*[!A-Za-z0-9._-]*) cursor= ;;
+    *.cleanup-meta) ;;
+    *) cursor= ;;
+  esac
+  if [ -n "$cursor" ] && [ ! -e "$dir/$cursor" ] && [ ! -L "$dir/$cursor" ]; then
+    cursor=
+  fi
+  start=$(fm_pending_reply_cleanup_retry_now_ms)
+  deadline=$((start + budget * 1000))
+  for pass in 1 2; do
+    if [ "$pass" = 2 ] && [ -z "$cursor" ]; then
+      break
+    fi
+    for cleanup_meta in "$dir"/*.cleanup-meta; do
+      [ -e "$cleanup_meta" ] || [ -L "$cleanup_meta" ] || continue
+      base=${cleanup_meta##*/}
+      if [ "$pass" = 1 ] && [ -n "$cursor" ] && [ "$started" = 0 ]; then
+        if [ "$base" = "$cursor" ]; then
+          started=1
+        fi
+        continue
+      fi
+      if [ "$pass" = 2 ] && [ "$base" = "$cursor" ]; then
+        break
+      fi
+      now=$(fm_pending_reply_cleanup_retry_now_ms)
+      [ "$now" -lt "$deadline" ] || break 2
+      cleanup_rc=0
+      FM_PENDING_REPLY_TXN_ATTEMPTS="$lock_attempts" \
+        fm_pending_reply_retry_undelivered_cleanup "$state" "$cleanup_meta" "$deadline" || cleanup_rc=$?
+      [ "$cleanup_rc" = 0 ] || break 2
+      last=$base
+      processed=$((processed + 1))
+      [ "$processed" -lt "$limit" ] || break 2
+    done
+  done
+  if [ "$processed" -gt 0 ]; then
+    tmp=$(mktemp "$state/.cleanup-retry.cursor.XXXXXX") || return 1
+    [ -f "$tmp" ] && [ ! -L "$tmp" ] || { rm -f "$tmp"; return 1; }
+    printf '%s\n' "$last" | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 1; }
+    mv -f "$tmp" "$cursor_path" || { rm -f "$tmp"; return 1; }
+  fi
+  return 0
+}
+
 # Drop an undelivered expectation after a failed send so transport failure does
 # not masquerade as a missed report later.
 fm_pending_reply_discard_undelivered() {  # <state-dir> <corr_id>
-  local state=$1 corr=$2 rec delivered marker
+  local state=$1 corr=$2 keep_backup=${3:-0} rec delivered marker backup
+  case "$keep_backup" in 0|1) ;; *) return 1 ;; esac
   rec=$(fm_pending_reply_path "$state" "$corr")
-  [ -f "$rec" ] || return 0
+  backup="${rec}.cleanup"
+  [ ! -L "$rec" ] && [ ! -L "$backup" ] || return 1
+  if [ ! -e "$rec" ]; then
+    if [ "$keep_backup" = 0 ] && [ -e "$backup" ]; then
+      rm -f "$backup" || return 1
+    fi
+    return 0
+  fi
+  [ -f "$rec" ] || return 1
+  if [ -e "$backup" ]; then
+    [ -f "$backup" ] || return 1
+    cmp -s "$rec" "$backup" || return 1
+    rm -f "$backup" || return 1
+  fi
   delivered=$(fm_pending_reply_get "$rec" delivered_epoch)
   [ -z "$delivered" ] || return 1
   marker=$(fm_pending_reply_delivery_confirmation_path "$state" "$corr")
   rm -f "$marker" 2>/dev/null || true
-  rm -f "$rec"
+  if [ "$keep_backup" = 1 ]; then
+    ln "$rec" "$backup" || return 1
+  fi
+  rm -f "$rec" || return 1
+  [ "$keep_backup" = 1 ] || rm -f "$backup"
+}
+
+fm_pending_reply_restore_undelivered() {  # <state-dir> <corr_id>
+  local state=$1 corr=$2 rec backup
+  rec=$(fm_pending_reply_path "$state" "$corr")
+  backup="${rec}.cleanup"
+  [ ! -L "$rec" ] && [ ! -L "$backup" ] || return 1
+  if [ -e "$rec" ]; then
+    [ -f "$rec" ] && [ -f "$backup" ] || return 1
+    cmp -s "$rec" "$backup" || return 1
+    rm -f "$backup"
+    return $?
+  fi
+  [ -f "$backup" ] || return 1
+  mv "$backup" "$rec"
+}
+
+fm_pending_reply_finish_undelivered() {  # <state-dir> <corr_id>
+  local state=$1 corr=$2 rec backup meta
+  rec=$(fm_pending_reply_path "$state" "$corr")
+  backup="${rec}.cleanup"
+  meta=$(fm_pending_reply_undelivered_cleanup_meta_path "$state" "$corr")
+  [ ! -L "$backup" ] || return 1
+  [ ! -L "$meta" ] || return 1
+  if [ -e "$backup" ]; then
+    [ -f "$backup" ] || return 1
+    rm -f "$backup" || return 1
+  fi
+  [ ! -e "$meta" ] || rm -f "$meta"
 }
 
 # 0 if a status line is a correlated acknowledgement for <corr_id>.
@@ -868,14 +1729,15 @@ fm_pending_reply_prepare_resolved_handoff() {  # <history-path> <history-state-d
     [ "$(fm_pending_reply_get "$receipt" retired_via)" = forced-teardown ] || return 1
   fi
   tmp="${receipt}.tmp.$$"
-  : > "$tmp" || return 1
-  while IFS= read -r line || [ -n "$line" ]; do
-    case "$line" in retirement_source_state=*|retirement_history_state=*) continue ;; esac
-    printf '%s\n' "$line" >> "$tmp" || return 1
-  done < "$history"
-  printf '%s\n' \
-    "retirement_history_state=$history_state" \
-    "retirement_source_state=$source_state" >> "$tmp" || return 1
+  {
+    while IFS= read -r line || [ -n "$line" ]; do
+      case "$line" in retirement_source_state=*|retirement_history_state=*) continue ;; esac
+      printf '%s\n' "$line"
+    done < "$history"
+    printf '%s\n' \
+      "retirement_history_state=$history_state" \
+      "retirement_source_state=$source_state"
+  } | fm_nofollow_write "$tmp" || return 1
   chmod 600 "$tmp" 2>/dev/null || true
   mv -f "$tmp" "$receipt"
 }
@@ -899,14 +1761,15 @@ fm_pending_reply_promote_resolved_record() {  # <record-path> <history-state-dir
       [ "$(fm_pending_reply_get "$history" retirement_source_state)" = "$source_state" ] || return 1
     else
       tmp="$history_dir/.${corr}.resolved.$$"
-      : > "$tmp" || return 1
-      while IFS= read -r line || [ -n "$line" ]; do
-        case "$line" in retirement_source_state=*|retirement_history_state=*) continue ;; esac
-        printf '%s\n' "$line" >> "$tmp" || return 1
-      done < "$record"
-      printf '%s\n' \
-        "retirement_history_state=$history_state" \
-        "retirement_source_state=$source_state" >> "$tmp" || return 1
+      {
+        while IFS= read -r line || [ -n "$line" ]; do
+          case "$line" in retirement_source_state=*|retirement_history_state=*) continue ;; esac
+          printf '%s\n' "$line"
+        done < "$record"
+        printf '%s\n' \
+          "retirement_history_state=$history_state" \
+          "retirement_source_state=$source_state"
+      } | fm_nofollow_write "$tmp" || return 1
       chmod 600 "$tmp" 2>/dev/null || true
       mv "$tmp" "$history" || return 1
     fi
@@ -1326,7 +2189,7 @@ fm_pending_reply_maybe_escalate_locked() {  # <state-dir> <corr_id>
   [ -n "$parent_status" ] || return 1
   mkdir -p "$(dirname "$parent_status")" 2>/dev/null || return 1
   if ! grep -Fqx "blocked: $payload" "$parent_status" 2>/dev/null; then
-    printf 'blocked: %s\n' "$payload" >> "$parent_status" 2>/dev/null || return 1
+    printf 'blocked: %s\n' "$payload" | fm_nofollow_append "$parent_status" 2>/dev/null || return 1
   fi
   now=$(fm_pending_reply_now)
   fm_pending_reply_set "$rec" escalated_epoch "$now" || return 1
@@ -1476,15 +2339,16 @@ fm_pending_reply_tick_one() {  # <state-dir> <corr_id> <busy_state> [secondmate-
 # Never scrapes secondmate conversation; uses only parent status, backend busy
 # state, and optional secondmate-home wrong-home path checks.
 fm_pending_reply_tick() {  # <state-dir>
-  local state=$1 dir rec corr task_id phase delivered meta backend target label busy sm_home
+  local state=$1 dir rec corr task_id phase delivered meta cleanup_meta backend target label busy sm_home
   local observation observation_task found i
   local -a observation_tasks=() observation_values=()
   dir=$(fm_pending_reply_dir "$state")
   [ -d "$dir" ] || return 0
+  fm_pending_reply_cleanup_retry_batch "$state" "$dir" || true
   for rec in "$dir"/*; do
     [ -f "$rec" ] || continue
     case "$(basename "$rec")" in
-      .*) continue ;;
+      .*|*.cleanup|*.cleanup-meta) continue ;;
     esac
     corr=$(fm_pending_reply_get "$rec" corr_id)
     [ -n "$corr" ] || corr=$(basename "$rec")
@@ -1786,19 +2650,20 @@ fm_pending_reply_prepare_forced_retirement() {  # <record-path> <history-state-d
     return 0
   fi
   tmp="$history_dir/.${corr}.retire.$$"
-  : > "$tmp" || return 1
-  while IFS= read -r line || [ -n "$line" ]; do
-    case "$line" in
-      phase=*|retired_epoch=*|retired_via=*|retired_from=*) continue ;;
-    esac
-    printf '%s\n' "$line" >> "$tmp" || return 1
-  done < "$rec"
   now=$(fm_pending_reply_now)
-  printf '%s\n' \
-    "retired_epoch=$now" \
-    "retired_via=forced-teardown" \
-    "retired_from=$staged_from" \
-    "phase=retired" >> "$tmp" || return 1
+  {
+    while IFS= read -r line || [ -n "$line" ]; do
+      case "$line" in
+        phase=*|retired_epoch=*|retired_via=*|retired_from=*) continue ;;
+      esac
+      printf '%s\n' "$line"
+    done < "$rec"
+    printf '%s\n' \
+      "retired_epoch=$now" \
+      "retired_via=forced-teardown" \
+      "retired_from=$staged_from" \
+      "phase=retired"
+  } | fm_nofollow_write "$tmp" || return 1
   chmod 600 "$tmp" 2>/dev/null || true
   [ ! -e "$staged" ] || return 1
   mv "$tmp" "$staged"
diff --git a/bin/fm-run-step-bridge.sh b/bin/fm-run-step-bridge.sh
new file mode 100755
index 00000000000..4d03b780058
--- /dev/null
+++ b/bin/fm-run-step-bridge.sh
@@ -0,0 +1,471 @@
+#!/usr/bin/env bash
+set -u
+set -o pipefail
+
+run_id_from_output() {
+  awk '
+    function normalize(value) {
+      gsub(/^[[:space:]]+|[[:space:]]+$/, "", value)
+      gsub(/^"|"$/, "", value)
+      if (value ~ /^[A-Za-z0-9._:-]+$/) {
+        parsed=value
+      } else {
+        invalid=1
+      }
+    }
+    /^run:[[:space:]]*$/ {
+      if (run_seen) invalid=1
+      run_seen=1
+      in_run=1
+      next
+    }
+    /^[^[:space:]]/ { in_run=0 }
+    in_run && /^[[:space:]]+id:[[:space:]]*/ {
+      id_count++
+      value=$0
+      sub(/^[[:space:]]+id:[[:space:]]*/, "", value)
+      normalize(value)
+    }
+    END {
+      if (!run_seen || invalid || id_count != 1 || parsed == "") exit 1
+      print parsed
+    }
+  ' "$1"
+}
+
+handoff_value() {
+  local key=$1
+  fm_nofollow_read "$FM_RUN_BINDING_HANDOFF" | awk -F= -v wanted="$key" \
+    '$1 == wanted { print substr($0, index($0, "=") + 1); n++ } END { exit(n == 1 ? 0 : 1) }' \
+    2>/dev/null
+}
+
+handoff_valid() {
+  local schema task incarnation state run_id
+  [ -f "$FM_RUN_BINDING_HANDOFF" ] && [ ! -L "$FM_RUN_BINDING_HANDOFF" ] || return 1
+  schema=$(handoff_value schema) || return 1
+  task=$(handoff_value task_id) || return 1
+  incarnation=$(handoff_value spawn_incarnation) || return 1
+  state=$(handoff_value state) || return 1
+  [ "$schema" = fm-jt-run-step-handoff.v1 ] || return 1
+  [ "$task" = "$FM_RUN_BINDING_TASK" ] || return 1
+  [ "$incarnation" = "$FM_RUN_BINDING_INCARNATION" ] || return 1
+  case "$state" in pending) ;; bound)
+    run_id=$(handoff_value run_id) || return 1
+    case "$run_id" in ''|*[!A-Za-z0-9._:-]*) return 1 ;; esac
+    ;;
+    *) return 1 ;;
+  esac
+}
+
+metadata_generation_valid() {
+  local meta=$STATE/$FM_RUN_BINDING_TASK.meta incarnation state handoff contents
+  FM_RUN_BINDING_METADATA_STATE=
+  contents=$(fm_nofollow_read "$meta") || return 1
+  incarnation=$(printf '%s\n' "$contents" | awk -F= '$1 == "spawn_incarnation" { print substr($0, index($0, "=") + 1); n++ } END { exit(n == 1 ? 0 : 1) }') || return 1
+  state=$(printf '%s\n' "$contents" | awk -F= '$1 == "run_binding_state" { print substr($0, index($0, "=") + 1); n++ } END { exit(n == 1 ? 0 : 1) }') || return 1
+  handoff=$(printf '%s\n' "$contents" | awk -F= '$1 == "run_binding_handoff" { print substr($0, index($0, "=") + 1); n++ } END { exit(n == 1 ? 0 : 1) }') || return 1
+  [ "$incarnation" = "$FM_RUN_BINDING_INCARNATION" ] || return 1
+  case "$state" in pending|staged|bound) ;; *) return 1 ;; esac
+  [ "$handoff" = "${FM_RUN_BINDING_HANDOFF##*/}" ] || return 1
+  FM_RUN_BINDING_METADATA_STATE=$state
+}
+
+metadata_staged_run_id() {
+  local meta=$STATE/$FM_RUN_BINDING_TASK.meta result status contents
+  contents=$(fm_nofollow_read "$meta") || return 75
+  result=$(printf '%s\n' "$contents" | awk -F= -v inc="$FM_RUN_BINDING_INCARNATION" '
+    BEGIN { valid=1 }
+    /^[^=]+=/ {
+      key=$1
+      if (key in seen) valid=0
+      seen[key]=1
+      value=substr($0, index($0, "=") + 1)
+      if (key == "run_binding_state") { state=value; state_n++ }
+      if (key == "run_id") { run_id=value; run_n++ }
+      if (key == "spawn_incarnation") { stored_inc=value; inc_n++ }
+      next
+    }
+    { valid=0 }
+    END {
+      if (!valid || state_n != 1 || run_n != 1 || inc_n != 1 \
+        || state != "staged" || stored_inc != inc || run_id == "") exit 75
+      print run_id
+    }
+  ' 2>/dev/null)
+  status=$?
+  case "$status" in
+    0)
+      case "$result" in ''|*[!A-Za-z0-9._:-]*) return 75 ;; esac
+      printf '%s\n' "$result"
+      ;;
+    75) return 75 ;;
+    *) return 1 ;;
+  esac
+}
+
+meta_set_run_binding_state() {
+  local desired_state=$1 run_id=$2 meta tmp status=0 owner acquired=0
+  case "$desired_state" in staged|bound) ;; *) return 1 ;; esac
+  meta="$STATE/$FM_RUN_BINDING_TASK.meta"
+  owner=${FM_TASK_LOCK_OWNER:-}
+  if [ -n "$owner" ] && fm_lock_points_to_owner "$FM_TASK_LOCK_PATH" "$owner"; then
+    :
+  else
+    fm_lock_acquire_wait "$FM_TASK_LOCK_PATH" || return 1
+    acquired=1
+  fi
+  if [ ! -f "$meta" ] || [ -L "$meta" ]; then
+    status=1
+  elif ! metadata_generation_valid; then
+    status=1
+  else
+    tmp=$(mktemp "$STATE/.${FM_RUN_BINDING_TASK}.meta-run-binding.XXXXXX") || status=1
+    if [ "$status" = 0 ]; then
+      if ! awk -v run_id="$run_id" -v desired_state="$desired_state" '
+        /^run_binding_state=/ { print "run_binding_state=" desired_state; print "run_id=" run_id; found=1; next }
+        /^run_id=/ { next }
+        { print }
+        END { exit(found ? 0 : 1) }
+      ' "$meta" | fm_nofollow_write "$tmp" \
+        || ! fm_nofollow_rename "$tmp" "$meta"; then
+        rm -f "$tmp"
+        status=1
+      fi
+    fi
+  fi
+  if [ "$acquired" = 1 ]; then
+    fm_lock_release "$FM_TASK_LOCK_PATH" || status=1
+  fi
+  return "$status"
+}
+
+meta_stage_run_id() {
+  meta_set_run_binding_state staged "$1"
+}
+
+meta_bind_run_id() {
+  meta_set_run_binding_state bound "$1"
+}
+
+publish_run_id() {
+  local run_id=$1 existing staged_existing status=0 existing_status staged_status owner old_owner acquired=0 \
+    evidence existing_active=0 existing_staged=0
+  case "$run_id" in ''|*[!A-Za-z0-9._:-]*) return 1 ;; esac
+  old_owner=${FM_TASK_LOCK_OWNER:-}
+  if [ -n "$old_owner" ] && fm_lock_points_to_owner "$FM_TASK_LOCK_PATH" "$old_owner"; then
+    owner=$old_owner
+  else
+    fm_lock_acquire_wait "$FM_TASK_LOCK_PATH" || return 1
+    acquired=1
+    owner=$(fm_lock_link_owner "$FM_TASK_LOCK_PATH" 2>/dev/null) || status=1
+  fi
+  if [ "$status" = 0 ]; then
+    FM_TASK_LOCK_OWNER=$owner
+    export FM_TASK_LOCK_OWNER
+    handoff_valid || status=1
+    metadata_generation_valid || status=1
+  fi
+  if [ "$status" = 0 ]; then
+    if existing=$(fm_run_step_binding_read "$FM_RUN_BINDING_TASK" "$FM_RUN_BINDING_INCARNATION" 2>/dev/null); then
+      if [ "$existing" = "$run_id" ]; then
+        existing_active=1
+      else
+        status=1
+      fi
+    else
+      existing_status=$?
+      if [ "$existing_status" = 75 ]; then
+        evidence=$(fm_run_step_binding_path "$FM_RUN_BINDING_TASK") || status=1
+        if [ "$status" = 0 ] && { [ -e "$evidence" ] || [ -L "$evidence" ]; }; then
+          if staged_existing=$(fm_run_step_binding_staged_read \
+            "$FM_RUN_BINDING_TASK" "$FM_RUN_BINDING_INCARNATION" 2>/dev/null); then
+            if [ "$staged_existing" = "$run_id" ]; then
+              existing_staged=1
+            else
+              status=1
+            fi
+          else
+            status=1
+          fi
+        elif [ "$status" = 0 ]; then
+          if [ "${FM_RUN_BINDING_METADATA_STATE:-}" = bound ]; then
+            status=1
+          elif staged_existing=$(metadata_staged_run_id 2>/dev/null); then
+            [ "$staged_existing" = "$run_id" ] || status=1
+          else
+            staged_status=$?
+            [ "${FM_RUN_BINDING_METADATA_STATE:-}" = pending ] && [ "$staged_status" = 75 ] || status=1
+          fi
+        fi
+      else
+        status=1
+      fi
+    fi
+  fi
+  if [ "$status" = 0 ]; then
+    if [ "$existing_active" = 1 ]; then
+      meta_bind_run_id "$run_id" || status=1
+    else
+      if [ "$existing_staged" = 0 ]; then
+        if ! meta_stage_run_id "$run_id"; then
+          status=1
+        elif ! fm_run_step_binding_publish "$FM_RUN_BINDING_TASK" "$run_id" "$FM_RUN_BINDING_INCARNATION"; then
+          status=1
+        fi
+      fi
+      if [ "$status" = 0 ] && ! fm_run_step_binding_activate \
+        "$FM_RUN_BINDING_TASK" "$run_id" "$FM_RUN_BINDING_INCARNATION"; then
+        status=1
+      fi
+      if [ "$status" = 0 ] && ! meta_bind_run_id "$run_id"; then
+        status=1
+        fm_run_step_binding_deactivate \
+          "$FM_RUN_BINDING_TASK" "$run_id" "$FM_RUN_BINDING_INCARNATION" || true
+      fi
+    fi
+  fi
+  if [ "$acquired" = 1 ]; then
+    fm_lock_release "$FM_TASK_LOCK_PATH" || status=1
+  fi
+  if [ -n "$old_owner" ]; then
+    FM_TASK_LOCK_OWNER=$old_owner
+    export FM_TASK_LOCK_OWNER
+  else
+    unset FM_TASK_LOCK_OWNER
+  fi
+  return "$status"
+}
+
+recover_staged_binding() {
+  local staged old_owner owner acquired=0 status=0
+  old_owner=${FM_TASK_LOCK_OWNER:-}
+  if [ -n "$old_owner" ] && fm_lock_points_to_owner "$FM_TASK_LOCK_PATH" "$old_owner"; then
+    owner=$old_owner
+  else
+    fm_lock_acquire_wait "$FM_TASK_LOCK_PATH" || return 1
+    acquired=1
+    owner=$(fm_lock_link_owner "$FM_TASK_LOCK_PATH" 2>/dev/null) || status=1
+  fi
+  if [ "$status" = 0 ]; then
+    FM_TASK_LOCK_OWNER=$owner
+    export FM_TASK_LOCK_OWNER
+    if ! metadata_generation_valid; then
+      status=1
+    elif [ "${FM_RUN_BINDING_METADATA_STATE:-}" = staged ]; then
+      staged=$(metadata_staged_run_id 2>/dev/null) || status=1
+      [ "$status" -ne 0 ] || publish_run_id "$staged" || status=1
+    fi
+  fi
+  if [ "$acquired" = 1 ]; then
+    fm_lock_release "$FM_TASK_LOCK_PATH" || status=1
+  fi
+  if [ -n "$old_owner" ]; then
+    FM_TASK_LOCK_OWNER=$old_owner
+    export FM_TASK_LOCK_OWNER
+  else
+    unset FM_TASK_LOCK_OWNER
+  fi
+  return "$status"
+}
+
+run_axi_proc_group_id() {
+  local pid=$1 stat rest
+  case "$pid" in ''|*[!0-9]*) return 1 ;; esac
+  [ -r "/proc/$pid/stat" ] || return 1
+  stat=$(cat "/proc/$pid/stat" 2>/dev/null) || return 1
+  rest=${stat##*) }
+  set -- $rest
+  [ "$#" -ge 3 ] || return 1
+  printf '%s\n' "$3"
+}
+
+run_axi_child_group_is_current() {
+  local child=$1 expected_start=$2 actual_start pgid
+  actual_start=$(fm_pid_start "$child" 2>/dev/null) || return 1
+  [ "$actual_start" = "$expected_start" ] || return 1
+  pgid=$(run_axi_proc_group_id "$child") || return 1
+  [ "$pgid" = "$child" ]
+}
+
+run_axi_group_member_identity() {
+  local child=$1 entry pid stat rest start
+  for entry in /proc/[0-9]*; do
+    pid=${entry#/proc/}
+    case "$pid" in ''|*[!0-9]*) continue ;; esac
+    [ "$pid" = "$child" ] && continue
+    [ -r "$entry/stat" ] || continue
+    stat=$(cat "$entry/stat" 2>/dev/null) || continue
+    rest=${stat##*) }
+    set -- $rest
+    [ "$#" -ge 20 ] || continue
+    [ "$3" = "$child" ] || continue
+    start="proc:${20}"
+    printf '%s|%s\n' "$pid" "$start"
+    return 0
+  done
+  return 1
+}
+
+run_axi_group_member_is_current() {
+  local child=$1 pid=$2 expected_start=$3 actual_start pgid
+  actual_start=$(fm_pid_start "$pid" 2>/dev/null) || return 1
+  [ "$actual_start" = "$expected_start" ] || return 1
+  pgid=$(run_axi_proc_group_id "$pid") || return 1
+  [ "$pgid" = "$child" ]
+}
+
+run_axi_stop_group() {
+  local child=$1 expected_start=$2 member_pid=${3:-} member_start=${4:-} attempts=0
+  case "$child" in ''|*[!0-9]*) return 1 ;; esac
+  [ -n "$expected_start" ] || return 1
+  if ! run_axi_child_group_is_current "$child" "$expected_start"; then
+    if ! kill -0 -- "-$child" 2>/dev/null; then
+      return 0
+    fi
+    run_axi_group_member_is_current "$child" "$member_pid" "$member_start" || return 1
+  fi
+  kill -TERM -- "-$child" 2>/dev/null || true
+  while kill -0 -- "-$child" 2>/dev/null && [ "$attempts" -lt 100 ]; do
+    sleep 0.01
+    attempts=$((attempts + 1))
+  done
+  if kill -0 -- "-$child" 2>/dev/null; then
+    if ! run_axi_child_group_is_current "$child" "$expected_start"; then
+      run_axi_group_member_is_current "$child" "$member_pid" "$member_start" || return 1
+    fi
+    kill -KILL -- "-$child" 2>/dev/null || true
+    attempts=0
+    while kill -0 -- "-$child" 2>/dev/null && [ "$attempts" -lt 100 ]; do
+      sleep 0.01
+      attempts=$((attempts + 1))
+    done
+  fi
+  ! kill -0 -- "-$child" 2>/dev/null
+}
+
+run_axi_abort_child() {
+  local child=$1 expected_start=$2 member_pid=${3:-} member_start=${4:-} actual_start
+  run_axi_stop_group "$child" "$expected_start" "$member_pid" "$member_start" || true
+  if actual_start=$(fm_pid_start "$child" 2>/dev/null) \
+    && [ "$actual_start" = "$expected_start" ]; then
+    kill -TERM "$child" 2>/dev/null || true
+    kill -KILL "$child" 2>/dev/null || true
+  fi
+  wait "$child" 2>/dev/null || true
+}
+
+run_axi() {
+  local child child_start child_status=0 run_id published=0 startup_seen=0 tmpdir output_file
+  local group_member group_member_pid='' group_member_start=''
+  local startup_wait_secs startup_deadline total_wait_secs total_deadline now
+  tmpdir=${FM_RUN_BINDING_TMP:-${TMPDIR:-/tmp}}
+  output_file=$(mktemp "$tmpdir/.fm-run-step-output.XXXXXX") || return 1
+  fm_nofollow_spawn_capture "$output_file" "$FM_RUN_BINDING_REAL" "$@" &
+  child=$!
+  case "$child" in ''|*[!0-9]*) rm -f "$output_file"; return 1 ;; esac
+  child_start=$(fm_pid_start "$child" 2>/dev/null) || {
+    wait "$child" 2>/dev/null || true
+    cat "$output_file"
+    rm -f "$output_file"
+    return 1
+  }
+  startup_wait_secs=${FM_RUN_BINDING_STARTUP_WAIT_SECS:-30}
+  case "$startup_wait_secs" in ''|*[!0-9]*|0) startup_wait_secs=30 ;; esac
+  while [ "${startup_wait_secs#0}" != "$startup_wait_secs" ]; do
+    startup_wait_secs=${startup_wait_secs#0}
+  done
+  [ -n "$startup_wait_secs" ] || startup_wait_secs=30
+  case "${#startup_wait_secs}" in
+    1|2) ;;
+    3) [ "$startup_wait_secs" -le 300 ] || startup_wait_secs=300 ;;
+    *) startup_wait_secs=300 ;;
+  esac
+  startup_deadline=$(( $(date +%s) + startup_wait_secs ))
+  total_wait_secs=${FM_RUN_BINDING_TOTAL_WAIT_SECS:-3600}
+  case "$total_wait_secs" in ''|*[!0-9]*|0) total_wait_secs=3600 ;; esac
+  while [ "${total_wait_secs#0}" != "$total_wait_secs" ]; do
+    total_wait_secs=${total_wait_secs#0}
+  done
+  [ -n "$total_wait_secs" ] || total_wait_secs=3600
+  case "${#total_wait_secs}" in
+    1|2|3) [ "$total_wait_secs" -le 3600 ] || total_wait_secs=3600 ;;
+    4) [ "$total_wait_secs" -le 3600 ] || total_wait_secs=3600 ;;
+    *) total_wait_secs=3600 ;;
+  esac
+  total_deadline=$(( $(date +%s) + total_wait_secs ))
+  while kill -0 "$child" 2>/dev/null; do
+    if [ -z "$group_member_pid" ] && group_member=$(run_axi_group_member_identity "$child"); then
+      IFS='|' read -r group_member_pid group_member_start <<< "$group_member"
+    fi
+    if run_id=$(run_id_from_output "$output_file") && [ -n "$run_id" ]; then
+      startup_seen=1
+    fi
+    now=$(date +%s)
+    if [ "$now" -ge "$total_deadline" ]; then
+      run_axi_abort_child "$child" "$child_start" "$group_member_pid" "$group_member_start"
+      cat "$output_file"
+      rm -f "$output_file"
+      return 1
+    fi
+    if [ "$startup_seen" = 0 ] && [ "$now" -ge "$startup_deadline" ]; then
+      run_axi_abort_child "$child" "$child_start" "$group_member_pid" "$group_member_start"
+      cat "$output_file"
+      rm -f "$output_file"
+      return 1
+    fi
+    sleep 0.05
+  done
+  if ! run_axi_stop_group "$child" "$child_start" "$group_member_pid" "$group_member_start"; then
+    cat "$output_file"
+    rm -f "$output_file"
+    return 1
+  fi
+  wait "$child" || child_status=$?
+  run_id=
+  if ! run_id=$(run_id_from_output "$output_file") || [ -z "$run_id" ]; then
+    cat "$output_file"
+    rm -f "$output_file"
+    return 1
+  fi
+  if ! publish_run_id "$run_id"; then
+    cat "$output_file"
+    rm -f "$output_file"
+    return 1
+  fi
+  published=1
+  cat "$output_file"
+  rm -f "$output_file"
+  [ "$published" = 1 ] || return 1
+  return "$child_status"
+}
+
+main() {
+  local command_name=${1:-}
+  shift || true
+  [ "$command_name" = wrap ] || return 2
+  [ -n "${FM_RUN_BINDING_ROOT:-}" ] || return 1
+  [ -n "${FM_RUN_BINDING_STATE:-}" ] || return 1
+  [ -n "${FM_RUN_BINDING_TASK:-}" ] || return 1
+  [ -n "${FM_RUN_BINDING_INCARNATION:-}" ] || return 1
+  [ -n "${FM_RUN_BINDING_HANDOFF:-}" ] || return 1
+  FM_ROOT=$FM_RUN_BINDING_ROOT
+  FM_HOME=${FM_RUN_BINDING_HOME:-$FM_ROOT}
+  STATE=$FM_RUN_BINDING_STATE
+  FM_TASK_LOCK_PATH=$STATE/.spawn-$FM_RUN_BINDING_TASK.lock
+  FM_SESSION_LOCK_BOOTSTRAP=1
+  export FM_ROOT FM_HOME STATE FM_TASK_LOCK_PATH FM_SESSION_LOCK_BOOTSTRAP
+  . "$FM_ROOT/bin/fm-wake-lib.sh"
+  . "$FM_ROOT/bin/fm-run-step-lib.sh"
+  FM_RUN_BINDING_REAL=${1:-}
+  shift || true
+  [ -x "$FM_RUN_BINDING_REAL" ] || return 1
+  if [ "${1:-}" = axi ] && [ "${2:-}" = run ]; then
+    recover_staged_binding || return 1
+    run_axi "$@"
+  else
+    "$FM_RUN_BINDING_REAL" "$@"
+  fi
+}
+
+main "$@"
diff --git a/bin/fm-run-step-lib.sh b/bin/fm-run-step-lib.sh
new file mode 100644
index 00000000000..3bbda80c68c
--- /dev/null
+++ b/bin/fm-run-step-lib.sh
@@ -0,0 +1,325 @@
+#!/usr/bin/env bash
+
+set -o pipefail
+
+_FM_RUN_STEP_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=bin/fm-safe-io-lib.sh
+. "$_FM_RUN_STEP_LIB_DIR/fm-safe-io-lib.sh"
+
+fm_run_step_binding_path() {
+  printf '%s/.run-step-incarnation-%s' "$STATE" "$1"
+}
+
+fm_run_step_binding_archive_path() {
+  printf '%s/.run-step-incarnation-%s.%s' "$STATE" "$1" "$2"
+}
+
+fm_run_step_binding_lock_release() {
+  local lock=$1 acquired=$2
+  if [ "$acquired" = 1 ]; then
+    fm_lock_release "$lock"
+  fi
+}
+
+fm_run_step_binding_read_state() {
+  local evidence=$1 id=$2 incarnation=$3 expected_state=$4 stored_run status
+  case "$expected_state" in active|staged) ;; *) return 75 ;; esac
+  stored_run=$(fm_nofollow_read "$evidence" | awk -F= -v task="$id" -v inc="$incarnation" -v expected_state="$expected_state" '
+    BEGIN {
+      allowed["schema"]=1; allowed["task_id"]=1; allowed["run_id"]=1
+      allowed["spawn_incarnation"]=1; allowed["state"]=1
+      valid=1
+    }
+    /^[^=]+=/ {
+      key=$1
+      if (!(key in allowed) || (key in seen)) valid=0
+      seen[key]=1
+      value=substr($0, index($0, "=") + 1)
+      values[key]=value
+      if (key == "schema" && value != "fm-jt-run-step-incarnation.v1") valid=0
+      if (key == "task_id" && value != task) valid=0
+      if (key == "run_id" && value == "") valid=0
+      if (key == "spawn_incarnation" && value != inc) valid=0
+      if (key == "state" && value != expected_state) valid=0
+      next
+    }
+    { valid=0 }
+    END {
+      if (!("schema" in seen) || !("task_id" in seen) || !("run_id" in seen) \
+        || !("spawn_incarnation" in seen) || !("state" in seen)) valid=0
+      if (valid) print values["run_id"]
+      else exit 75
+    }
+  ' 2>/dev/null)
+  status=$?
+  [ "$status" = 0 ] || return "$status"
+  case "$stored_run" in ''|*[!A-Za-z0-9._:-]*) return 75 ;; esac
+  printf '%s\n' "$stored_run"
+}
+
+fm_run_step_binding_read_variant() {
+  local id=$1 incarnation=$2 expected_state=$3 evidence lock owner acquired=0 stored_run status
+  case "$id" in ''|*[!A-Za-z0-9._-]*) return 75 ;; esac
+  case "$incarnation" in ''|*[!A-Za-z0-9._:-]*) return 75 ;; esac
+  evidence=$(fm_run_step_binding_path "$id") || return 1
+  lock=${FM_TASK_LOCK_PATH:-$STATE/.spawn-$id.lock}
+  owner=${FM_TASK_LOCK_OWNER:-}
+  if [ -n "$owner" ] && fm_lock_points_to_owner "$lock" "$owner"; then
+    :
+  else
+    fm_lock_acquire_wait "$lock" || return 1
+    acquired=1
+  fi
+  stored_run=$(fm_run_step_binding_read_state "$evidence" "$id" "$incarnation" "$expected_state")
+  status=$?
+  fm_run_step_binding_lock_release "$lock" "$acquired" || return 1
+  [ "$status" = 0 ] || return "$status"
+  printf '%s\n' "$stored_run"
+}
+
+fm_run_step_binding_read_held() {
+  local id=$1 incarnation=$2 expected_state=${3:-active} evidence lock owner acquired=0 stored_run status
+  case "$id" in ''|*[!A-Za-z0-9._-]*) return 75 ;; esac
+  case "$incarnation" in ''|*[!A-Za-z0-9._:-]*) return 75 ;; esac
+  evidence=$(fm_run_step_binding_path "$id") || return 1
+  lock=${FM_TASK_LOCK_PATH:-$STATE/.spawn-$id.lock}
+  owner=${FM_TASK_LOCK_OWNER:-}
+  if [ -n "$owner" ] && fm_lock_points_to_owner "$lock" "$owner"; then
+    :
+  elif [ "${FM_RUN_STEP_READ_ONLY:-0}" = 1 ]; then
+    stored_run=$(fm_run_step_binding_read_state "$evidence" "$id" "$incarnation" "$expected_state")
+    status=$?
+    [ "$status" = 0 ] || return "$status"
+    FM_RUN_STEP_HELD_LOCK=
+    FM_RUN_STEP_HELD_LOCK_RELEASE=0
+    FM_RUN_STEP_HELD_PREVIOUS_OWNER=
+    FM_RUN_STEP_HELD_VALUE=$stored_run
+    return 0
+  else
+    fm_lock_acquire_wait "$lock" || return 1
+    acquired=1
+    owner=${FM_LOCK_OWNER_DIR:-}
+  fi
+  stored_run=$(fm_run_step_binding_read_state "$evidence" "$id" "$incarnation" "$expected_state")
+  status=$?
+  if [ "$status" -ne 0 ]; then
+    [ "$acquired" = 1 ] && fm_lock_release "$lock" >/dev/null 2>&1 || true
+    return "$status"
+  fi
+  FM_RUN_STEP_HELD_LOCK=$lock
+  FM_RUN_STEP_HELD_LOCK_RELEASE=$acquired
+  FM_RUN_STEP_HELD_PREVIOUS_OWNER=${FM_TASK_LOCK_OWNER:-}
+  # shellcheck disable=SC2034 # consumed by fm-crew-state.sh after this helper returns
+  FM_RUN_STEP_HELD_VALUE=$stored_run
+  if [ "$acquired" = 1 ]; then
+    FM_TASK_LOCK_OWNER=$owner
+    export FM_TASK_LOCK_OWNER
+  fi
+  return 0
+}
+
+fm_run_step_binding_release_held() {
+  local lock=${FM_RUN_STEP_HELD_LOCK:-} release=${FM_RUN_STEP_HELD_LOCK_RELEASE:-0} status=0
+  [ -n "$lock" ] || return 0
+  if [ "$release" = 1 ]; then
+    fm_lock_release "$lock" || status=1
+  fi
+  if [ -n "${FM_RUN_STEP_HELD_PREVIOUS_OWNER:-}" ]; then
+    FM_TASK_LOCK_OWNER=$FM_RUN_STEP_HELD_PREVIOUS_OWNER
+    export FM_TASK_LOCK_OWNER
+  else
+    unset FM_TASK_LOCK_OWNER
+  fi
+  unset FM_RUN_STEP_HELD_LOCK FM_RUN_STEP_HELD_LOCK_RELEASE FM_RUN_STEP_HELD_PREVIOUS_OWNER FM_RUN_STEP_HELD_VALUE
+  return "$status"
+}
+
+fm_run_step_binding_read() {
+  fm_run_step_binding_read_variant "$1" "$2" active
+}
+
+fm_run_step_binding_staged_read() {
+  fm_run_step_binding_read_variant "$1" "$2" staged
+}
+
+fm_run_step_binding_metadata_validate() {
+  local id=$1 run_id=$2 incarnation=$3 meta result
+  meta="$STATE/$id.meta"
+  result=$(fm_nofollow_read "$meta" | awk -F= -v run_id="$run_id" -v inc="$incarnation" '
+    BEGIN { invalid=0 }
+    /^[^=]+=/ {
+      key=$1
+      value=substr($0, index($0, "=") + 1)
+      if (key == "run_binding_state") { state=value; state_n++ }
+      if (key == "run_id") { stored_run=value; run_n++ }
+      if (key == "spawn_incarnation") { stored_inc=value; inc_n++ }
+      next
+    }
+    { invalid=1 }
+    END {
+      if (state_n == 0 && !invalid) { print "legacy"; exit 0 }
+      if (!invalid && state_n == 1 && run_n == 1 && inc_n == 1 \
+        && state == "bound" && stored_run == run_id && stored_inc == inc) {
+        print "bound"
+        exit 0
+      }
+      print "invalid"
+    }
+  ' 2>/dev/null) || return 1
+  case "$result" in
+    legacy|bound) return 0 ;;
+    *) return 75 ;;
+  esac
+}
+
+fm_run_step_binding_validate() {
+  local id=$1 run_id=$2 incarnation=$3 stored_run
+  case "$id" in ''|*[!A-Za-z0-9._-]*) return 75 ;; esac
+  case "$run_id" in ''|*[!A-Za-z0-9._:-]*) return 75 ;; esac
+  case "$incarnation" in ''|*[!A-Za-z0-9._:-]*) return 75 ;; esac
+  stored_run=$(fm_run_step_binding_read "$id" "$incarnation") || return $?
+  [ "$stored_run" = "$run_id" ] || return 75
+  fm_run_step_binding_metadata_validate "$id" "$run_id" "$incarnation"
+}
+
+fm_run_step_binding_publish() {
+  local id=$1 run_id=$2 incarnation=$3 evidence lock owner acquired=0 tmp status=0
+  case "$id" in ''|*[!A-Za-z0-9._-]*) return 1 ;; esac
+  case "$run_id" in ''|*[!A-Za-z0-9._:-]*) return 1 ;; esac
+  case "$incarnation" in ''|*[!A-Za-z0-9._:-]*) return 1 ;; esac
+  evidence=$(fm_run_step_binding_path "$id") || return 1
+  lock=${FM_TASK_LOCK_PATH:-$STATE/.spawn-$id.lock}
+  owner=${FM_TASK_LOCK_OWNER:-}
+  if [ -n "$owner" ] && fm_lock_points_to_owner "$lock" "$owner"; then
+    :
+  else
+    fm_lock_acquire_wait "$lock" || return 1
+    acquired=1
+  fi
+  if [ -e "$evidence" ] || [ -L "$evidence" ]; then
+    status=1
+  fi
+  if [ "$status" = 0 ]; then
+    tmp=$(mktemp "$STATE/.run-step-incarnation.$id.XXXXXX") || status=1
+  fi
+  if [ "$status" = 0 ]; then
+    if ! printf 'schema=fm-jt-run-step-incarnation.v1\ntask_id=%s\nrun_id=%s\nspawn_incarnation=%s\nstate=staged\n' \
+      "$id" "$run_id" "$incarnation" | fm_nofollow_write "$tmp" \
+      || ! fm_nofollow_rename "$tmp" "$evidence" 1; then
+      rm -f "$tmp"
+      status=1
+    fi
+  fi
+  fm_run_step_binding_lock_release "$lock" "$acquired" || status=1
+  return "$status"
+}
+
+fm_run_step_binding_activate() {
+  local id=$1 run_id=$2 incarnation=$3 evidence lock owner acquired=0 tmp status=0
+  case "$id" in ''|*[!A-Za-z0-9._-]*) return 1 ;; esac
+  case "$run_id" in ''|*[!A-Za-z0-9._:-]*) return 1 ;; esac
+  case "$incarnation" in ''|*[!A-Za-z0-9._:-]*) return 1 ;; esac
+  evidence=$(fm_run_step_binding_path "$id") || return 1
+  lock=${FM_TASK_LOCK_PATH:-$STATE/.spawn-$id.lock}
+  owner=${FM_TASK_LOCK_OWNER:-}
+  if [ -n "$owner" ] && fm_lock_points_to_owner "$lock" "$owner"; then
+    :
+  else
+    fm_lock_acquire_wait "$lock" || return 1
+    acquired=1
+  fi
+  if [ ! -f "$evidence" ] || [ -L "$evidence" ]; then
+    status=1
+  else
+    tmp=$(mktemp "$STATE/.run-step-incarnation.$id.XXXXXX") || status=1
+    if [ "$status" = 0 ]; then
+      if ! fm_nofollow_read "$evidence" | awk -F= -v task="$id" -v run_id="$run_id" -v inc="$incarnation" '
+        BEGIN { valid=1 }
+        /^[^=]+=/ {
+          key=$1
+          if (key in seen) valid=0
+          seen[key]=1
+          value=substr($0, index($0, "=") + 1)
+          if (key == "schema" && value != "fm-jt-run-step-incarnation.v1") valid=0
+          if (key == "task_id" && value != task) valid=0
+          if (key == "run_id" && value != run_id) valid=0
+          if (key == "spawn_incarnation" && value != inc) valid=0
+          if (key == "state") {
+            if (value != "staged") valid=0
+            print "state=active"
+            next
+          }
+          print
+          next
+        }
+        { valid=0 }
+        END {
+          if (!("schema" in seen) || !("task_id" in seen) || !("run_id" in seen) \
+            || !("spawn_incarnation" in seen) || !("state" in seen)) valid=0
+          exit(valid ? 0 : 1)
+        }
+      ' | fm_nofollow_write "$tmp" \
+        || ! fm_nofollow_rename "$tmp" "$evidence"; then
+        rm -f "$tmp"
+        status=1
+      fi
+    fi
+  fi
+  fm_run_step_binding_lock_release "$lock" "$acquired" || status=1
+  return "$status"
+}
+
+fm_run_step_binding_deactivate() {
+  local id=$1 run_id=$2 incarnation=$3 evidence lock owner acquired=0 tmp status=0
+  case "$id" in ''|*[!A-Za-z0-9._-]*) return 1 ;; esac
+  case "$run_id" in ''|*[!A-Za-z0-9._:-]*) return 1 ;; esac
+  case "$incarnation" in ''|*[!A-Za-z0-9._:-]*) return 1 ;; esac
+  evidence=$(fm_run_step_binding_path "$id") || return 1
+  lock=${FM_TASK_LOCK_PATH:-$STATE/.spawn-$id.lock}
+  owner=${FM_TASK_LOCK_OWNER:-}
+  if [ -n "$owner" ] && fm_lock_points_to_owner "$lock" "$owner"; then
+    :
+  else
+    fm_lock_acquire_wait "$lock" || return 1
+    acquired=1
+  fi
+  if [ ! -f "$evidence" ] || [ -L "$evidence" ]; then
+    status=1
+  else
+    tmp=$(mktemp "$STATE/.run-step-incarnation.$id.XXXXXX") || status=1
+    if [ "$status" = 0 ]; then
+      if ! fm_nofollow_read "$evidence" | awk -F= -v task="$id" -v run_id="$run_id" -v inc="$incarnation" '
+        BEGIN { valid=1 }
+        /^[^=]+=/ {
+          key=$1
+          if (key in seen) valid=0
+          seen[key]=1
+          value=substr($0, index($0, "=") + 1)
+          if (key == "schema" && value != "fm-jt-run-step-incarnation.v1") valid=0
+          if (key == "task_id" && value != task) valid=0
+          if (key == "run_id" && value != run_id) valid=0
+          if (key == "spawn_incarnation" && value != inc) valid=0
+          if (key == "state") {
+            if (value != "active") valid=0
+            print "state=staged"
+            next
+          }
+          print
+          next
+        }
+        { valid=0 }
+        END {
+          if (!("schema" in seen) || !("task_id" in seen) || !("run_id" in seen) \
+            || !("spawn_incarnation" in seen) || !("state" in seen)) valid=0
+          exit(valid ? 0 : 1)
+        }
+      ' | fm_nofollow_write "$tmp" \
+        || ! fm_nofollow_rename "$tmp" "$evidence"; then
+        rm -f "$tmp"
+        status=1
+      fi
+    fi
+  fi
+  fm_run_step_binding_lock_release "$lock" "$acquired" || status=1
+  return "$status"
+}
diff --git a/bin/fm-safe-io-lib.sh b/bin/fm-safe-io-lib.sh
new file mode 100644
index 00000000000..8e21e7b5e3d
--- /dev/null
+++ b/bin/fm-safe-io-lib.sh
@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+
+fm_nofollow_write() {
+  local path=$1
+  command -v perl >/dev/null 2>&1 || return 1
+  perl -e '
+    use Fcntl qw(:DEFAULT);
+    my ($path) = @ARGV;
+    my $nofollow = eval { O_NOFOLLOW() };
+    defined($nofollow) or exit 1;
+    sysopen(my $fh, $path, O_WRONLY | O_CREAT | O_TRUNC | $nofollow, 0600) or exit 1;
+    binmode($fh);
+    local $/;
+    my $content = <STDIN> // "";
+    print $fh $content or exit 1;
+    close($fh) or exit 1;
+  ' "$path"
+}
+
+fm_nofollow_append() {
+  local path=$1
+  command -v perl >/dev/null 2>&1 || return 1
+  perl -e '
+    use Fcntl qw(:DEFAULT);
+    my ($path) = @ARGV;
+    my $nofollow = eval { O_NOFOLLOW() };
+    defined($nofollow) or exit 1;
+    sysopen(my $fh, $path, O_WRONLY | O_CREAT | O_APPEND | $nofollow, 0600) or exit 1;
+    binmode($fh);
+    local $/;
+    my $content = <STDIN> // "";
+    print $fh $content or exit 1;
+    close($fh) or exit 1;
+  ' "$path"
+}
+
+fm_nofollow_read() {
+  local path=$1
+  command -v perl >/dev/null 2>&1 || return 1
+  perl -e '
+    use Fcntl qw(:DEFAULT);
+    my ($path) = @ARGV;
+    my $nofollow = eval { O_NOFOLLOW() };
+    defined($nofollow) or exit 1;
+    sysopen(my $fh, $path, O_RDONLY | $nofollow) or exit 1;
+    binmode($fh);
+    local $/;
+    my $content = <$fh> // "";
+    print STDOUT $content or exit 1;
+    close($fh) or exit 1;
+  ' "$path"
+}
+
+fm_nofollow_rename() {
+  local source=$1 target=$2 exclusive=${3:-0}
+  command -v perl >/dev/null 2>&1 || return 1
+  case "$exclusive" in 0|1) ;; *) return 1 ;; esac
+  perl -e '
+    use Errno qw(ENOENT);
+    my ($source, $target, $exclusive) = @ARGV;
+    lstat($source) && !-l($source) && -f($source) or exit 1;
+    if (lstat($target)) {
+      (-l($target) || -d($target) || !-f($target)) and exit 1;
+      $exclusive and exit 1;
+    } elsif ($! != ENOENT) {
+      exit 1;
+    }
+    rename($source, $target) or exit 1;
+  ' "$source" "$target" "$exclusive"
+}
+
+fm_nofollow_chmod() {
+  local path=$1 mode=$2
+  command -v perl >/dev/null 2>&1 || return 1
+  perl -e '
+    use Fcntl qw(:DEFAULT);
+    my ($path, $mode) = @ARGV;
+    my $nofollow = eval { O_NOFOLLOW() };
+    defined($nofollow) or exit 1;
+    $mode =~ /\A[0-7]{3,4}\z/ or exit 1;
+    sysopen(my $fh, $path, O_RDONLY | $nofollow) or exit 1;
+    my $fd_dir = -d "/dev/fd" ? "/dev/fd" : "/proc/self/fd";
+    chmod(oct($mode), "$fd_dir/" . fileno($fh)) == 1 or exit 1;
+    close($fh) or exit 1;
+  ' "$path" "$mode"
+}
+
+fm_nofollow_spawn_capture() {
+  local path=$1
+  shift
+  [ "$#" -gt 0 ] || return 1
+  command -v perl >/dev/null 2>&1 || return 1
+  exec perl -e '
+    use Fcntl qw(:DEFAULT);
+    use POSIX ();
+    my ($path, @command) = @ARGV;
+    my $nofollow = eval { O_NOFOLLOW() };
+    defined($nofollow) or exit 1;
+    POSIX::setpgid(0, 0) == 0 or exit 125;
+    sysopen(my $fh, $path, O_WRONLY | O_CREAT | O_TRUNC | $nofollow, 0600) or exit 1;
+    open(STDOUT, ">&", $fh) or exit 1;
+    open(STDERR, ">&", $fh) or exit 1;
+    exec @command;
+    exit 127;
+  ' "$path" "$@"
+}
diff --git a/bin/fm-send.sh b/bin/fm-send.sh
index 5e885f9937e..75044b1426b 100755
--- a/bin/fm-send.sh
+++ b/bin/fm-send.sh
@@ -87,7 +87,50 @@ shift
 MARK_FROM_FIRSTMATE=0
 PENDING_REPLY_CORR=
 PENDING_REPLY_CREATED=0
+PENDING_ROUTE_COMMITTED=0
 TARGET_TASK_ID=
+TARGET_HOME=
+
+clear_new_pending_route() {
+  [ "$PENDING_ROUTE_COMMITTED" = 1 ] || return 0
+  if [ "$PENDING_REPLY_CREATED" = 1 ] && [ -n "$PENDING_REPLY_CORR" ] \
+    && [ -n "$TARGET_HOME" ]; then
+    fm_pending_reply_secondmate_route_clear_undelivered "$TARGET_HOME" "$PENDING_REPLY_CORR"
+  fi
+}
+
+discard_new_pending_reply() {
+  local route_status=0 discard_status=0
+  if [ "$PENDING_REPLY_CREATED" = 1 ] \
+    && [ -n "$PENDING_REPLY_CORR" ] \
+    && [ -n "$TARGET_HOME" ] \
+    && ! fm_pending_reply_schedule_undelivered_cleanup \
+      "$STATE" "$PENDING_REPLY_CORR" "$TARGET_HOME"; then
+    discard_status=1
+  fi
+  if [ "$PENDING_REPLY_CREATED" = 1 ] && [ -n "$PENDING_REPLY_CORR" ] \
+    && ! fm_pending_reply_discard_undelivered "$STATE" "$PENDING_REPLY_CORR" 1; then
+    discard_status=1
+  fi
+  if [ "$discard_status" = 0 ]; then
+    if clear_new_pending_route; then
+      fm_pending_reply_finish_undelivered "$STATE" "$PENDING_REPLY_CORR" || route_status=1
+    else
+      route_status=1
+      fm_pending_reply_restore_undelivered "$STATE" "$PENDING_REPLY_CORR" || discard_status=1
+    fi
+  elif [ "$PENDING_REPLY_CREATED" = 1 ] && [ -n "$PENDING_REPLY_CORR" ]; then
+    fm_pending_reply_restore_undelivered "$STATE" "$PENDING_REPLY_CORR" || true
+  fi
+  if [ "$route_status" = 1 ]; then
+    echo "error: failed to clear the secondmate pending-reply route; undelivered record cleanup continued" >&2
+  fi
+  if [ "$discard_status" = 1 ]; then
+    echo "error: failed to discard the undelivered pending-reply record" >&2
+  fi
+  [ "$route_status" = 0 ] && [ "$discard_status" = 0 ]
+}
+
 case "$RAW_TARGET" in
   fm-*)
     meta="$STATE/${RAW_TARGET#fm-}.meta"
@@ -136,10 +179,20 @@ else
     fm_pending_reply_embed_corr "$MESSAGE" "$PENDING_REPLY_CORR" MESSAGE
     if [ "$PENDING_REPLY_CREATED" = 1 ] \
       && ! fm_pending_reply_prepare_delivery "$STATE" "$PENDING_REPLY_CORR"; then
-      fm_pending_reply_discard_undelivered "$STATE" "$PENDING_REPLY_CORR" || true
+      discard_new_pending_reply || exit 1
       echo "error: failed to durably prepare pending-reply delivery for $TARGET_TASK_ID" >&2
       exit 1
     fi
+    TARGET_HOME=$(fm_meta_get "$meta" home)
+    if fm_pending_reply_secondmate_route_write \
+      "$TARGET_HOME" "$FM_HOME" "$STATE" "$TARGET_TASK_ID" "$PENDING_REPLY_CORR"; then
+      PENDING_ROUTE_COMMITTED=${FM_PENDING_REPLY_ROUTE_COMMITTED:-0}
+    else
+      PENDING_ROUTE_COMMITTED=${FM_PENDING_REPLY_ROUTE_COMMITTED:-0}
+      discard_new_pending_reply || exit 1
+      echo "error: failed to bind the secondmate pending-reply route for $TARGET_TASK_ID" >&2
+      exit 1
+    fi
   fi
   # Slash commands open a completion popup in some TUIs (verified on codex);
   # submitting too fast selects nothing, so give the popup time to settle before
@@ -171,9 +224,7 @@ else
   # Type once, submit, verify. Lenient: only a positively-confirmed swallow
   # (text still in the composer) is an error; an unreadable pane is assumed sent.
   if ! verdict=$(fm_backend_send_text_submit "$TARGET_BACKEND" "$T" "$MESSAGE" "$retries" "$sleep_s" "$settle"); then
-    if [ "$PENDING_REPLY_CREATED" = 1 ] && [ -n "$PENDING_REPLY_CORR" ]; then
-      fm_pending_reply_discard_undelivered "$STATE" "$PENDING_REPLY_CORR" || true
-    fi
+    discard_new_pending_reply || exit 1
     echo "error: text not sent to $T ($TARGET_BACKEND send failed)" >&2
     exit 1
   fi
@@ -184,33 +235,25 @@ else
     sleep "$settle"
     final_after_pending=1
     if ! verdict=$(fm_backend_submit_enter "$TARGET_BACKEND" "$T" 1 "$sleep_s" "$MESSAGE"); then
-      if [ "$PENDING_REPLY_CREATED" = 1 ] && [ -n "$PENDING_REPLY_CORR" ]; then
-        fm_pending_reply_discard_undelivered "$STATE" "$PENDING_REPLY_CORR" || true
-      fi
+      discard_new_pending_reply || exit 1
       echo "error: final Enter submission to $T failed" >&2
       exit 1
     fi
   fi
   case "$verdict" in
     pending)
-      if [ "$PENDING_REPLY_CREATED" = 1 ] && [ -n "$PENDING_REPLY_CORR" ]; then
-        fm_pending_reply_discard_undelivered "$STATE" "$PENDING_REPLY_CORR" || true
-      fi
+      discard_new_pending_reply || exit 1
       echo "error: text not submitted to $T (Enter swallowed; text left in composer)" >&2
       exit 1
       ;;
     send-failed)
-      if [ "$PENDING_REPLY_CREATED" = 1 ] && [ -n "$PENDING_REPLY_CORR" ]; then
-        fm_pending_reply_discard_undelivered "$STATE" "$PENDING_REPLY_CORR" || true
-      fi
+      discard_new_pending_reply || exit 1
       echo "error: text not sent to $T (tmux send-keys failed)" >&2
       exit 1
       ;;
     unknown)
       if [ "$final_after_pending" = 1 ]; then
-        if [ "$PENDING_REPLY_CREATED" = 1 ] && [ -n "$PENDING_REPLY_CORR" ]; then
-          fm_pending_reply_discard_undelivered "$STATE" "$PENDING_REPLY_CORR" || true
-        fi
+        discard_new_pending_reply || exit 1
         echo "error: final Enter submission to $T could not be confirmed" >&2
         exit 1
       fi
diff --git a/bin/fm-session-start.sh b/bin/fm-session-start.sh
index b381c5c1c8d..963a8db0c30 100755
--- a/bin/fm-session-start.sh
+++ b/bin/fm-session-start.sh
@@ -126,6 +126,24 @@ SUBRULE='-----------------------------------------------------------------------
 section() { printf '\n%s\n%s\n%s\n' "$RULE" "$1" "$RULE"; }
 subsection() { printf '\n%s\n%s\n' "$1" "$SUBRULE"; }
 
+session_start_confirm_inactive_rows() {
+  local wake_output=$1 row _epoch _seq _kind _key _payload confirm_status
+  while IFS= read -r row || [ -n "$row" ]; do
+    IFS=$(printf '\t') read -r _epoch _seq _kind _key _payload <<< "$row"
+    case "$_key" in
+      inactive-outcome:*)
+        "$SCRIPT_DIR/fm-inactive-reconcile.sh" caller-output-complete \
+          "$_key" "$row" >/dev/null 2>&1 || return 1
+        confirm_status=0
+        "$SCRIPT_DIR/fm-inactive-reconcile.sh" confirm "$_key" "$row" >/dev/null 2>&1 \
+          || confirm_status=$?
+        [ "$confirm_status" = 0 ] || [ "$confirm_status" = 1 ] \
+          || return "$confirm_status"
+        ;;
+    esac
+  done <<< "$wake_output"
+}
+
 # print_file_or_absent <path> <label>: full contents under a labeled
 # subsection, or an explicit ABSENT marker. Absence is semantically
 # meaningful for every one of these files (captain.md absent = firstmate
@@ -362,11 +380,43 @@ if [ "$READ_ONLY" -eq 1 ]; then
   GUARD_OUT=$(FM_GUARD_READ_ONLY=1 "$SCRIPT_DIR/fm-guard.sh" 2>&1)
   [ -n "$GUARD_OUT" ] && printf '%s\n' "$GUARD_OUT"
 else
-  DRAIN_OUT=$("$SCRIPT_DIR/fm-wake-drain.sh" 2>&1)
-  if [ -n "$DRAIN_OUT" ]; then
-    printf '%s\n' "$DRAIN_OUT"
+  DRAIN_OUTPUT=
+  DRAIN_STATUS=0
+  DRAIN_OUTPUT=$(FM_WAKE_DRAIN_DIRECT=0 FM_WAKE_DRAIN_DEFER_ACK=1 \
+    FM_WAKE_DRAIN_GENERATION="$$" "$SCRIPT_DIR/fm-wake-drain.sh" 2>&1) \
+    || DRAIN_STATUS=$?
+  if [ "$DRAIN_STATUS" -ne 0 ] && [ "$DRAIN_STATUS" -ne 3 ]; then
+    printf 'error: wake drain failed (status %s); inactive reconciliation skipped\n' \
+      "$DRAIN_STATUS" >&2
   else
-    printf '(no queued wakes)\n'
+    if [ -n "$DRAIN_OUTPUT" ]; then
+      printf '%s\n' "$DRAIN_OUTPUT" || DRAIN_STATUS=1
+      if printf '%s\n' "$DRAIN_OUTPUT" | grep -q "$(printf '\t')"; then
+        if [ "$DRAIN_STATUS" = 0 ] || [ "$DRAIN_STATUS" = 3 ]; then
+          if session_start_confirm_inactive_rows "$DRAIN_OUTPUT"; then
+            DRAIN_STATUS=0
+          else
+            DRAIN_STATUS=$?
+            printf 'error: wake drain confirmation failed (status %s); inactive reconciliation skipped\n' \
+              "$DRAIN_STATUS" >&2
+          fi
+        fi
+      else
+        printf '(no queued wakes)\n'
+      fi
+    else
+      printf '(no queued wakes)\n'
+    fi
+  fi
+  if [ "$DRAIN_STATUS" = 0 ]; then
+    INACTIVE_STATUS=0
+    INACTIVE_OUT=$("$SCRIPT_DIR/fm-inactive-reconcile.sh" scan --startup 2>&1) || INACTIVE_STATUS=$?
+    if [ "$INACTIVE_STATUS" -ne 0 ]; then
+      printf 'error: inactive outcome reconciliation failed (status %s)\n%s\n' \
+        "$INACTIVE_STATUS" "$INACTIVE_OUT" >&2
+    elif [ -n "$INACTIVE_OUT" ]; then
+      printf '%s\n' "$INACTIVE_OUT"
+    fi
   fi
 fi
 
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index a7eab45715c..1050f268263 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -41,6 +41,7 @@
 #   --scout records kind=scout in the task's meta (report deliverable, scratch worktree;
 #   see AGENTS.md task lifecycle); --secondmate records kind=secondmate and launches in a
 #   provisioned firstmate home; the default is kind=ship.
+#   No-mistakes ship launches bind the actual run id through the child command bridge.
 #   Matching JT Control Room ship spawns for .openclaw or jt-control-room append a
 #   JT PR Intake Governor block to direct-PR/no-mistakes briefs before launch.
 #   Before a secondmate launch, the home is locally fast-forwarded to the primary
@@ -77,6 +78,8 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=bin/fm-worker-isolation-lib.sh
 . "$SCRIPT_DIR/fm-worker-isolation-lib.sh"
 fm_worker_refuse_primary_operation "spawn" || exit 1
+# shellcheck source=bin/fm-pane-idle-lib.sh
+. "$SCRIPT_DIR/fm-pane-idle-lib.sh"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
 # shellcheck source=bin/fm-gate-refuse-lib.sh
 . "$SCRIPT_DIR/fm-gate-refuse-lib.sh"
@@ -94,6 +97,8 @@ fm_normalize_tool_path
 . "$SCRIPT_DIR/fm-ff-lib.sh"
 # shellcheck source=bin/fm-wake-lib.sh
 . "$SCRIPT_DIR/fm-wake-lib.sh"
+# shellcheck source=bin/fm-run-step-lib.sh
+. "$SCRIPT_DIR/fm-run-step-lib.sh"
 # shellcheck source=bin/fm-config-inherit-lib.sh
 . "$SCRIPT_DIR/fm-config-inherit-lib.sh"
 # shellcheck source=bin/fm-backend.sh
@@ -197,6 +202,7 @@ HERDR_FLAT_ABORT_LABEL=
 HERDR_FLAT_ABORT_UNCERTAINTY_FILE=
 SPAWN_TASK_LOCK=
 SPAWN_TASK_LOCK_HELD=0
+SPAWN_INCARNATION=
 SPAWN_ENDPOINT_CREATED=0
 SPAWN_WORKTREE_LEASED=0
 SPAWN_WORKTREE_PROVEN=0
@@ -234,6 +240,8 @@ SPAWN_GROK_AUTH_FILE=
 SPAWN_GROK_AUTH_TMP=
 SPAWN_GROK_HOOK_FILE=
 SPAWN_GROK_CONFIG_FILE=
+SPAWN_RUN_BINDING_HANDOFF=
+SPAWN_RUN_BINDING_HANDOFF_CREATED=0
 SPAWN_CLAUDE_HOOK_INODE=
 SPAWN_CLAUDE_HOOK_DIGEST=
 SPAWN_OPENCODE_HOOK_INODE=
@@ -279,7 +287,7 @@ spawn_herdr_flat_uncertainty_record() {
     printf 'target=%s\n' "$target"
     printf 'scope=%s\n' "$scope"
     printf 'label=%s\n' "$label"
-  } > "$tmp" || { rm -f "$tmp"; return 1; }
+  } | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 1; }
   mv "$tmp" "$file"
 }
 
@@ -306,9 +314,11 @@ spawn_abort_recovery_meta() {
       echo "worktree=$record_worktree"
     else
       echo "worktree="
-      echo "slot_lease_state=unresolved"
-      echo "slot_lease_holder=$ID"
-      [ -z "${WT_CANDIDATE:-}" ] || echo "slot_worktree_candidate=$WT_CANDIDATE"
+      if [ "${SPAWN_WORKTREE_LEASED:-0}" = 1 ]; then
+        echo "slot_lease_state=unresolved"
+        echo "slot_lease_holder=$ID"
+        [ -z "${WT_CANDIDATE:-}" ] || echo "slot_worktree_candidate=$WT_CANDIDATE"
+      fi
     fi
     echo "project=$PROJ_ABS"
     [ -z "${SPAWN_WORKTREE_LEASE_GENERATION:-}" ] || echo "slot_lease_generation=$SPAWN_WORKTREE_LEASE_GENERATION"
@@ -316,6 +326,7 @@ spawn_abort_recovery_meta() {
     echo "kind=${KIND:-ship}"
     echo "mode=${MODE:-no-mistakes}"
     echo "yolo=${YOLO:-off}"
+    echo "spawn_incarnation=${SPAWN_INCARNATION:-legacy-unknown}"
     echo "tasktmp=${TASK_TMP:-}"
     echo "model=${MODEL:-default}"
     echo "effort=${EFFORT:-default}"
@@ -351,7 +362,7 @@ spawn_abort_recovery_meta() {
       fi
     fi
     echo "spawn_state=aborted"
-  } > "$tmp" || { rm -f "$tmp"; return 1; }
+  } | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 1; }
   mv "$tmp" "$meta" || { rm -f "$tmp"; return 1; }
   SPAWN_RECOVERY_META_PUBLISHED=1
 }
@@ -376,10 +387,11 @@ spawn_endpoint_recovery_meta() {
     printf 'kind=%s\n' "${KIND:-ship}"
     printf 'mode=%s\n' "${MODE:-no-mistakes}"
     printf 'yolo=%s\n' "${YOLO:-off}"
+    printf 'spawn_incarnation=%s\n' "${SPAWN_INCARNATION:-legacy-unknown}"
     printf 'backend=tmux\n'
     printf 'endpoint_recovery=1\n'
     printf 'spawn_state=aborted\n'
-  } > "$tmp" || { rm -f "$tmp"; return 1; }
+  } | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 1; }
   mv "$tmp" "$meta" || { rm -f "$tmp"; return 1; }
   SPAWN_ENDPOINT_RECOVERY_META_PUBLISHED=1
   SPAWN_ENDPOINT_RECOVERY_RESERVATION=0
@@ -403,11 +415,12 @@ spawn_endpoint_recovery_reservation() {
     printf 'kind=%s\n' "${KIND:-ship}"
     printf 'mode=%s\n' "${MODE:-no-mistakes}"
     printf 'yolo=%s\n' "${YOLO:-off}"
+    printf 'spawn_incarnation=%s\n' "${SPAWN_INCARNATION:-legacy-unknown}"
     printf 'backend=tmux\n'
     printf 'endpoint_recovery=1\n'
     printf 'endpoint_recovery_pending=1\n'
     printf 'spawn_state=starting\n'
-  } > "$tmp" || { rm -f "$tmp"; return 1; }
+  } | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 1; }
   mv "$tmp" "$meta" || { rm -f "$tmp"; return 1; }
   SPAWN_ENDPOINT_RECOVERY_META_PUBLISHED=1
   SPAWN_ENDPOINT_RECOVERY_RESERVATION=1
@@ -491,6 +504,16 @@ spawn_release_task_lock() {
   return 1
 }
 
+spawn_task_lock_incarnation_valid() {
+  local owner recorded
+  [ "${SPAWN_TASK_LOCK_HELD:-0}" = 1 ] || return 1
+  owner=$(fm_lock_link_owner "$SPAWN_TASK_LOCK" 2>/dev/null) || return 1
+  [ -n "$owner" ] && [ -d "$owner" ] && [ ! -L "$owner" ] || return 1
+  fm_lock_points_to_owner "$SPAWN_TASK_LOCK" "$owner" || return 1
+  recorded=$(cat "$owner/incarnation" 2>/dev/null || true)
+  [ "$recorded" = "${SPAWN_INCARNATION:-}" ] && [ -n "$recorded" ]
+}
+
 spawn_require_new_artifact() {
   local path=$1
   [ ! -e "$path" ] && [ ! -L "$path" ] || {
@@ -828,6 +851,14 @@ spawn_abort_artifacts_cleanup() {
       fi
     fi
   done
+  if [ "${SPAWN_RUN_BINDING_HANDOFF_CREATED:-0}" = 1 ] \
+    && [ -n "${SPAWN_RUN_BINDING_HANDOFF:-}" ]; then
+    if [ -f "$SPAWN_RUN_BINDING_HANDOFF" ] && [ ! -L "$SPAWN_RUN_BINDING_HANDOFF" ]; then
+      rm -f "$SPAWN_RUN_BINDING_HANDOFF" || rc=1
+    else
+      rc=1
+    fi
+  fi
   [ -z "${HERDR_LABEL_JOURNAL:-}" ] || rm -f "$HERDR_LABEL_JOURNAL" || rc=1
   if [ -n "${TASK_TMP:-}" ] && [ -d "$TASK_TMP" ]; then
     owner_file="$TASK_TMP/.fm-tasktmp-owner"
@@ -877,6 +908,7 @@ spawn_abort_cleanup() {
             echo "kind=$KIND"
             echo "mode=${MODE:-no-mistakes}"
             echo "yolo=${YOLO:-off}"
+            echo "spawn_incarnation=${SPAWN_INCARNATION:-legacy-unknown}"
             echo "tasktmp=${TASK_TMP:-}"
             echo "model=${MODEL:-default}"
             echo "effort=${EFFORT:-default}"
@@ -902,6 +934,17 @@ spawn_abort_cleanup() {
   if [ "$status" -ne 0 ] && [ "$endpoint_cleanup_status" -eq 0 ]; then
     if spawn_abort_artifacts_cleanup; then
       SPAWN_ARTIFACTS_CLEAN=1
+      if [ "${KIND:-}" = secondmate ] \
+         && [ "${SPAWN_META_PUBLISHED:-0}" = 1 ] \
+         && [ -e "$STATE/$ID.meta" ]; then
+        if [ ! -L "$STATE/$ID.meta" ] && rm -f "$STATE/$ID.meta" \
+          && [ ! -e "$STATE/$ID.meta" ] && [ ! -L "$STATE/$ID.meta" ]; then
+          SPAWN_META_PUBLISHED=0
+        else
+          echo "warning: spawn abort removed the secondmate endpoint but could not remove its task record" >&2
+          SPAWN_ARTIFACTS_CLEAN=0
+        fi
+      fi
       if [ "${SPAWN_ENDPOINT_RECOVERY_META_PUBLISHED:-0}" = 1 ] \
          && [ "${SPAWN_META_PUBLISHED:-0}" != 1 ] \
          && [ "${SPAWN_WORKTREE_LEASED:-0}" != 1 ] \
@@ -916,6 +959,17 @@ spawn_abort_cleanup() {
       echo "warning: spawn abort could not remove every task artifact; preserving recovery metadata" >&2
     fi
   fi
+  if [ "$status" -ne 0 ] \
+     && [ "${KIND:-}" = secondmate ] \
+     && [ "${SPAWN_META_PUBLISHED:-0}" = 1 ] \
+     && { [ "$endpoint_cleanup_status" -ne 0 ] || [ "$SPAWN_ARTIFACTS_CLEAN" != 1 ]; }; then
+    SPAWN_RECOVERY_META_REPLACE_ALLOWED=1
+    if spawn_abort_recovery_meta; then
+      SPAWN_META_PUBLISHED=0
+    else
+      echo "error: spawn abort could not publish recoverable metadata for secondmate $ID" >&2
+    fi
+  fi
   if [ "$status" -ne 0 ] \
      && [ "${SPAWN_WORKTREE_LEASED:-0}" = 1 ] \
      && [ "${SPAWN_WORKTREE_PROVEN:-0}" = 1 ] \
@@ -1039,11 +1093,21 @@ if [ "$DISPLAY_TITLE_SET" -eq 0 ] && [ -e "$DATA/$ID/display-title" ]; then
   DISPLAY_TITLE=$(cat "$DATA/$ID/display-title")
 fi
 SPAWN_TASK_LOCK="$STATE/.spawn-$ID.lock"
+SPAWN_INCARNATION="s$(date +%s)-${BASHPID:-$$}-$RANDOM"
+FM_LOCK_OWNER_INCARNATION=$SPAWN_INCARNATION
+export FM_LOCK_OWNER_INCARNATION
 if ! fm_lock_try_acquire "$SPAWN_TASK_LOCK"; then
+  unset FM_LOCK_OWNER_INCARNATION
   echo "error: another spawn is already creating task $ID" >&2
   exit 1
 fi
+unset FM_LOCK_OWNER_INCARNATION
 SPAWN_TASK_LOCK_HELD=1
+spawn_task_lock_incarnation_valid || {
+  echo "error: task lock incarnation could not be verified for $ID" >&2
+  exit 1
+}
+unset FM_RUN_STEP_ID
 HERDR_FLAT_ABORT_UNCERTAINTY_FILE="$STATE/$ID.herdr-cleanup-uncertain"
 if [ -e "$HERDR_FLAT_ABORT_UNCERTAINTY_FILE" ] || [ -L "$HERDR_FLAT_ABORT_UNCERTAINTY_FILE" ]; then
   echo "error: unresolved Herdr cleanup uncertainty for $ID at $HERDR_FLAT_ABORT_UNCERTAINTY_FILE; refusing another spawn" >&2
@@ -2110,8 +2174,39 @@ elif [ "$KIND" != secondmate ]; then
   echo "error: docs/worker-isolation.md owns the reclaim procedure for a pooled slot that cannot be stamped" >&2
   exit 1
 fi
+RUN_STEP_EVIDENCE=$(fm_run_step_binding_path "$ID")
+if [ -e "$RUN_STEP_EVIDENCE" ] || [ -L "$RUN_STEP_EVIDENCE" ]; then
+  [ -f "$RUN_STEP_EVIDENCE" ] && [ ! -L "$RUN_STEP_EVIDENCE" ] || exit 1
+  RUN_STEP_OLD_INCARNATION=$(fm_nofollow_read "$RUN_STEP_EVIDENCE" | awk -F= '$1 == "spawn_incarnation" { print substr($0, index($0, "=") + 1); n++ } END { exit(n == 1 ? 0 : 1) }') || exit 1
+  case "$RUN_STEP_OLD_INCARNATION" in ''|*[!A-Za-z0-9._:-]*) exit 1 ;; esac
+  RUN_STEP_ARCHIVE=$(fm_run_step_binding_archive_path "$ID" "$RUN_STEP_OLD_INCARNATION")
+  if [ -e "$RUN_STEP_ARCHIVE" ] || [ -L "$RUN_STEP_ARCHIVE" ]; then
+    [ -f "$RUN_STEP_ARCHIVE" ] && [ ! -L "$RUN_STEP_ARCHIVE" ] || exit 1
+    cmp -s "$RUN_STEP_EVIDENCE" "$RUN_STEP_ARCHIVE" || exit 1
+    rm -f "$RUN_STEP_EVIDENCE" || exit 1
+  else
+    fm_nofollow_rename "$RUN_STEP_EVIDENCE" "$RUN_STEP_ARCHIVE" 1 || exit 1
+  fi
+fi
+if [ "$KIND" = ship ] && [ "$MODE" = no-mistakes ]; then
+  SPAWN_RUN_BINDING_HANDOFF="$STATE/.run-step-handoff-$ID"
+  if [ -e "$SPAWN_RUN_BINDING_HANDOFF" ] || [ -L "$SPAWN_RUN_BINDING_HANDOFF" ]; then
+    [ -f "$SPAWN_RUN_BINDING_HANDOFF" ] && [ ! -L "$SPAWN_RUN_BINDING_HANDOFF" ] || exit 1
+    rm -f "$SPAWN_RUN_BINDING_HANDOFF" || exit 1
+  fi
+  HANDOFF_TMP=$(mktemp "$STATE/.$ID.run-step-handoff.XXXXXX") || exit 1
+  chmod 600 "$HANDOFF_TMP" || { rm -f "$HANDOFF_TMP"; exit 1; }
+  if ! printf 'schema=fm-jt-run-step-handoff.v1\ntask_id=%s\nspawn_incarnation=%s\nstate=pending\n' \
+    "$ID" "$SPAWN_INCARNATION" | fm_nofollow_write "$HANDOFF_TMP" \
+    || ! fm_nofollow_rename "$HANDOFF_TMP" "$SPAWN_RUN_BINDING_HANDOFF" 1; then
+    rm -f "$HANDOFF_TMP"
+    exit 1
+  fi
+  SPAWN_RUN_BINDING_HANDOFF_CREATED=1
+fi
 META_TMP=$(mktemp "$STATE/.$ID.meta.XXXXXX") || exit 1
 chmod 600 "$META_TMP" || { rm -f "$META_TMP"; exit 1; }
+spawn_task_lock_incarnation_valid || { rm -f "$META_TMP"; exit 1; }
 {
   echo "window=$T"
   echo "worktree=$WT"
@@ -2120,9 +2215,14 @@ chmod 600 "$META_TMP" || { rm -f "$META_TMP"; exit 1; }
   echo "kind=$KIND"
   echo "mode=$MODE"
   echo "yolo=$YOLO"
+  echo "spawn_incarnation=$SPAWN_INCARNATION"
   echo "tasktmp=$TASK_TMP"
   echo "model=${MODEL:-default}"
   echo "effort=${EFFORT:-default}"
+  if [ -n "$SPAWN_RUN_BINDING_HANDOFF" ]; then
+    echo "run_binding_state=pending"
+    echo "run_binding_handoff=${SPAWN_RUN_BINDING_HANDOFF##*/}"
+  fi
   # Missing backend= is the compatibility spelling for tmux. Record only
   # non-default backends so existing and new tmux metadata stay unchanged.
   [ "$BACKEND" = tmux ] || echo "backend=$BACKEND"
@@ -2149,9 +2249,11 @@ chmod 600 "$META_TMP" || { rm -f "$META_TMP"; exit 1; }
     echo "home=$PROJ_ABS"
     echo "projects=$SECONDMATE_PROJECTS"
   fi
-} > "$META_TMP" || { rm -f "$META_TMP"; exit 1; }
-mv "$META_TMP" "$STATE/$ID.meta" || { rm -f "$META_TMP"; exit 1; }
+} | fm_nofollow_write "$META_TMP" || { rm -f "$META_TMP"; exit 1; }
+spawn_task_lock_incarnation_valid || { rm -f "$META_TMP"; exit 1; }
+fm_nofollow_rename "$META_TMP" "$STATE/$ID.meta" || { rm -f "$META_TMP"; exit 1; }
 SPAWN_META_PUBLISHED=1
+fm_pane_idle_meta_freshness_bump "$STATE" || exit 1
 if [ "$BACKEND" = herdr ]; then
   rm -f "$HERDR_LABEL_JOURNAL"
   if [ "$HERDR_LABEL_LOCK_HELD" = 1 ]; then
@@ -2180,6 +2282,36 @@ WORKER_ENV_PREFIX=$(fm_worker_launch_env_prefix "$WORKER_ROLE" "$ID" "$WORKER_HO
   echo "error: could not build the home declaration for $ID; refusing to launch a task child that would inherit this home" >&2
   exit 1
 }
+if [ -n "$SPAWN_RUN_BINDING_HANDOFF" ]; then
+  SPAWN_RUN_BINDING_REAL=$(command -v no-mistakes 2>/dev/null || true)
+  [ -n "$SPAWN_RUN_BINDING_REAL" ] && [ -x "$SPAWN_RUN_BINDING_REAL" ] || {
+    echo "error: no-mistakes is required to publish the real run binding for ship task $ID; refusing to launch" >&2
+    exit 1
+  }
+  [ -x "$FM_ROOT/bin/fm-run-step-bridge.sh" ] || {
+    echo "error: run-step bridge is unavailable for ship task $ID; refusing to launch" >&2
+    exit 1
+  }
+  mkdir -p "$TASK_TMP/bin" || exit 1
+  [ ! -e "$TASK_TMP/bin/no-mistakes" ] && [ ! -L "$TASK_TMP/bin/no-mistakes" ] || exit 1
+  bridge_wrapper="$TASK_TMP/bin/no-mistakes"
+  {
+    printf '#!/usr/bin/env bash\n'
+    printf 'export FM_RUN_BINDING_ROOT=%s\n' "$(shell_quote "$FM_ROOT")"
+    printf 'export FM_RUN_BINDING_HOME=%s\n' "$(shell_quote "$FM_HOME")"
+    printf 'export FM_RUN_BINDING_STATE=%s\n' "$(shell_quote "$STATE")"
+    printf 'export FM_RUN_BINDING_TASK=%s\n' "$(shell_quote "$ID")"
+    printf 'export FM_RUN_BINDING_INCARNATION=%s\n' "$(shell_quote "$SPAWN_INCARNATION")"
+    printf 'export FM_RUN_BINDING_HANDOFF=%s\n' "$(shell_quote "$SPAWN_RUN_BINDING_HANDOFF")"
+    printf 'export FM_RUN_BINDING_TMP=%s\n' "$(shell_quote "$TASK_TMP")"
+    printf 'exec %s wrap %s "$@"\n' \
+      "$(shell_quote "$FM_ROOT/bin/fm-run-step-bridge.sh")" \
+      "$(shell_quote "$SPAWN_RUN_BINDING_REAL")"
+  } | fm_nofollow_write "$bridge_wrapper" || exit 1
+  fm_nofollow_chmod "$bridge_wrapper" 0700 || exit 1
+  sq_run_binding_path=$(shell_quote "$TASK_TMP/bin:$PATH")
+  LAUNCH="PATH=$sq_run_binding_path $LAUNCH"
+fi
 LAUNCH="$WORKER_ENV_PREFIX$LAUNCH"
 # Export GOTMPDIR into the crewmate's pane shell so the agent and every child
 # process (go build, go test, ...) inherit it. Sent before the launch command so
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index 156e56a0020..e242b054383 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -66,6 +66,8 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=bin/fm-worker-isolation-lib.sh
 . "$SCRIPT_DIR/fm-worker-isolation-lib.sh"
 fm_worker_refuse_primary_operation "teardown" || exit 1
+# shellcheck source=bin/fm-pane-idle-lib.sh
+. "$SCRIPT_DIR/fm-pane-idle-lib.sh"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
 # shellcheck source=bin/fm-gate-refuse-lib.sh
 . "$SCRIPT_DIR/fm-gate-refuse-lib.sh"
@@ -128,7 +130,7 @@ trap 'teardown_release_task_lock || true' EXIT
 
 META="$STATE/$ID.meta"
 [ -f "$META" ] || { echo "error: no meta for task $ID at $META" >&2; exit 1; }
-WT=$(grep '^worktree=' "$META" | cut -d= -f2-)
+WT=$(grep '^worktree=' "$META" | cut -d= -f2- || true)
 T=$(grep '^window=' "$META" | cut -d= -f2-)
 PROJ=$(grep '^project=' "$META" | cut -d= -f2-)
 BACKEND=$(fm_backend_of_meta "$META")
@@ -2821,6 +2823,10 @@ cleanup_direct_pr_refs || {
   echo "REFUSED: transactional direct-PR private ref cleanup failed for $ID; preserving task state" >&2
   exit 1
 }
+fm_pane_idle_meta_freshness_bump "$STATE" || {
+  echo "error: could not advance metadata freshness boundary for $ID" >&2
+  exit 1
+}
 if [ "$TOP_SLOT_UNRESOLVED_LEASE" != 1 ] && [ -n "$TOP_SLOT_RETAIN_VERDICT" ]; then
   teardown_meta_identity_matches || {
     echo "error: task metadata changed during teardown for $ID; preserving task state" >&2
diff --git a/bin/fm-wake-drain.sh b/bin/fm-wake-drain.sh
index c5a51cfa8d2..da46c87609a 100755
--- a/bin/fm-wake-drain.sh
+++ b/bin/fm-wake-drain.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Atomically drain durable watcher wake records, then assert watcher liveness.
-set -u
+set -u -o pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=bin/fm-worker-isolation-lib.sh
@@ -8,9 +8,294 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 fm_worker_refuse_primary_operation "wake drain" || exit 1
 # shellcheck source=bin/fm-wake-lib.sh
 . "$SCRIPT_DIR/fm-wake-lib.sh"
+# shellcheck source=bin/fm-pane-idle-lib.sh
+. "$SCRIPT_DIR/fm-pane-idle-lib.sh"
 
 DRAIN_TMP=
+DRAIN_DEDUPED=
+DRAIN_RESTORE=
+DRAIN_PID=${BASHPID:-$$}
+DRAIN_PID_START=
 DRAIN_LOCK_HELD=false
+DRAIN_ACTIONABLE=0
+DRAIN_RESUMING=false
+DRAIN_OFFSET=0
+DRAIN_BATCH_COUNT=0
+DRAIN_CURSOR=
+DRAIN_CURRENT_RETAINED=0
+DRAIN_CURRENT_OFFSET=0
+DRAIN_NEXT_OFFSET=0
+DRAIN_RETAINED_ANY=0
+DRAIN_RETAINED_OFFSET=0
+DRAIN_BATCH_ROWS=${FM_WAKE_DRAIN_BATCH_ROWS:-16}
+DRAIN_RESTORE_MANIFEST="$STATE/.wake-queue.restore"
+DRAIN_RESTORE_PENDING=false
+DRAIN_RESTORE_OFFSET=0
+DRAIN_RESTORE_SOURCE=
+DRAIN_RESTORE_SOURCE_RETIRED=0
+DRAIN_RESTORE_RAW_SOURCE=
+DRAIN_RESTORE_RAW_SOURCE_RETIRED=1
+DRAIN_DEDUPED_READY=0
+DRAIN_FINALIZED_KEYS=()
+FM_WAKE_DRAIN_RESUMED_SOURCE=0
+export FM_WAKE_DRAIN_RESUMED_SOURCE
+DRAIN_PID_START=$(fm_pid_start "$DRAIN_PID" 2>/dev/null || true)
+export FM_WAKE_DRAIN_PARENT_START="$DRAIN_PID_START"
+case "$DRAIN_BATCH_ROWS" in
+  ''|*[!0-9]*|0) DRAIN_BATCH_ROWS=16 ;;
+esac
+PRESENTATION_TIMEOUT_SECS=${FM_WAKE_DRAIN_PRESENTATION_TIMEOUT_SECS:-30}
+case "$PRESENTATION_TIMEOUT_SECS" in
+  ''|*[!0-9]*|0) PRESENTATION_TIMEOUT_SECS=30 ;;
+esac
+while [ "${PRESENTATION_TIMEOUT_SECS#0}" != "$PRESENTATION_TIMEOUT_SECS" ]; do
+  PRESENTATION_TIMEOUT_SECS=${PRESENTATION_TIMEOUT_SECS#0}
+done
+[ -n "$PRESENTATION_TIMEOUT_SECS" ] || PRESENTATION_TIMEOUT_SECS=30
+case "${#PRESENTATION_TIMEOUT_SECS}" in
+  1|2) ;;
+  3) [ "$PRESENTATION_TIMEOUT_SECS" -le 300 ] || PRESENTATION_TIMEOUT_SECS=300 ;;
+  *) PRESENTATION_TIMEOUT_SECS=300 ;;
+esac
+
+presentation_reconcile() {
+  local timeout=$1
+  shift
+  fm_pane_idle_run_bounded_child "$timeout" env "$@"
+}
+
+presentation_parent_alive() {
+  local pid=$1 start=${2:-}
+  kill -0 "$pid" 2>/dev/null || return 1
+  [ -n "$start" ] || return 1
+  fm_pid_start_matches_stored "$pid" "$start"
+}
+
+wake_marker_write() {
+  local path=$1 value=$2
+  command -v perl >/dev/null 2>&1 || return 1
+  perl -e '
+    use Fcntl qw(:DEFAULT);
+    my ($path, $value) = @ARGV;
+    my $nofollow = eval { O_NOFOLLOW() };
+    defined($nofollow) or exit 1;
+    my $fh;
+    sysopen($fh, $path, O_WRONLY | O_TRUNC | $nofollow) or exit 1;
+    binmode($fh);
+    print($fh $value) or exit 1;
+    close($fh) or exit 1;
+  ' "$path" "$value"
+}
+
+present_inactive_worker() {
+  local key=$1 row=$2 deduped=$3 parent_pid=$4 parent_start=$5 go=$6 emitted=$7 script_dir=$8 timeout=$9
+  while [ ! -s "$go" ]; do
+    presentation_parent_alive "$parent_pid" "$parent_start" || exit 125
+    sleep 0.01
+  done
+  presentation_parent_alive "$parent_pid" "$parent_start" || exit 125
+  presentation_reconcile "$timeout" FM_WAKE_DRAIN_FILE="$deduped" FM_WAKE_DRAIN_DELEGATED=1 \
+    FM_WAKE_DRAIN_PARENT_PID="$parent_pid" FM_WAKE_DRAIN_PARENT_START="$parent_start" \
+    "$script_dir/fm-inactive-reconcile.sh" \
+    output-started "$key" "$row" || exit 1
+  presentation_parent_alive "$parent_pid" "$parent_start" || exit 125
+  presentation_reconcile "$timeout" FM_WAKE_DRAIN_FILE="$deduped" FM_WAKE_DRAIN_DELEGATED=1 \
+    FM_WAKE_DRAIN_PARENT_PID="$parent_pid" FM_WAKE_DRAIN_PARENT_START="$parent_start" \
+    "$script_dir/fm-inactive-reconcile.sh" \
+    output-emitted "$key" "$row" || exit 1
+  presentation_parent_alive "$parent_pid" "$parent_start" || exit 125
+  printf '%s\n' "$row" || exit 1
+  presentation_parent_alive "$parent_pid" "$parent_start" || exit 125
+  presentation_reconcile "$timeout" FM_WAKE_DRAIN_FILE="$deduped" FM_WAKE_DRAIN_DELEGATED=1 \
+    FM_WAKE_DRAIN_PARENT_PID="$parent_pid" FM_WAKE_DRAIN_PARENT_START="$parent_start" \
+    "$script_dir/fm-inactive-reconcile.sh" \
+    output-confirmed "$key" "$row" || exit 1
+  presentation_parent_alive "$parent_pid" "$parent_start" || exit 125
+  wake_marker_write "$emitted" emitted || exit 1
+  presentation_parent_alive "$parent_pid" "$parent_start" || exit 125
+  presentation_reconcile "$timeout" FM_WAKE_DRAIN_FILE="$deduped" FM_WAKE_DRAIN_DELEGATED=1 \
+    FM_WAKE_DRAIN_PARENT_PID="$parent_pid" FM_WAKE_DRAIN_PARENT_START="$parent_start" \
+    "$script_dir/fm-inactive-reconcile.sh" \
+    output-complete "$key" "$row" || exit 1
+}
+
+presentation_worker_stop() {
+  local worker=$1 pgid=$2 attempts=0
+  case "$pgid" in ''|*[!0-9]*|0) return 1 ;; esac
+  kill -TERM -- "-$pgid" 2>/dev/null || true
+  while kill -0 -- "-$pgid" 2>/dev/null && [ "$attempts" -lt 100 ]; do
+    sleep 0.01
+    attempts=$((attempts + 1))
+  done
+  if kill -0 -- "-$pgid" 2>/dev/null; then
+    kill -KILL -- "-$pgid" 2>/dev/null || true
+    attempts=0
+    while kill -0 -- "-$pgid" 2>/dev/null && [ "$attempts" -lt 200 ]; do
+      sleep 0.01
+      attempts=$((attempts + 1))
+    done
+  fi
+  wait "$worker" 2>/dev/null || true
+  ! kill -0 -- "-$pgid" 2>/dev/null
+}
+
+inactive_generation_valid() {
+  local generation=${FM_WAKE_DRAIN_GENERATION:-}
+  case "${FM_WAKE_DRAIN_DEFER_ACK:-0}" in 0|1) ;; *) return 1 ;; esac
+  case "$generation" in ''|*[!0-9]*|0) return 1 ;; esac
+  kill -0 "$generation" 2>/dev/null || return 1
+  fm_pid_start "$generation" >/dev/null 2>&1
+}
+
+present_inactive_row() {
+  local key=$1 row=$2 status=0 go emitted worker worker_status=0 generation
+  local defer_pending=0 defer_payload=
+  local worker_timed_out=0 worker_stopped=1 worker_pgid presentation_deadline
+  local _epoch _seq _kind _queued_key payload
+  generation=${FM_WAKE_DRAIN_GENERATION:-}
+  if [ "${FM_WAKE_DRAIN_DIRECT:-0}" = 1 ]; then
+    emitted=0
+    if FM_WAKE_DRAIN_DIRECT=0 FM_WAKE_DRAIN_DEFER_ACK=1 FM_WAKE_DRAIN_GENERATION="$generation" \
+      FM_WAKE_DRAIN_FILE="$DRAIN_DEDUPED" "$SCRIPT_DIR/fm-inactive-reconcile.sh" \
+      output-emitted-state "$key" "$row" >/dev/null 2>&1; then
+      emitted=1
+    else
+      worker_status=$?
+      [ "$worker_status" = 1 ] || return 1
+    fi
+    if [ "$emitted" = 0 ]; then
+      FM_WAKE_DRAIN_DIRECT=0 FM_WAKE_DRAIN_DEFER_ACK=1 FM_WAKE_DRAIN_GENERATION="$generation" \
+        FM_WAKE_DRAIN_FILE="$DRAIN_DEDUPED" "$SCRIPT_DIR/fm-inactive-reconcile.sh" \
+        output-started "$key" "$row" >/dev/null 2>&1 || return 1
+      FM_WAKE_DRAIN_DIRECT=0 FM_WAKE_DRAIN_DEFER_ACK=1 FM_WAKE_DRAIN_GENERATION="$generation" \
+        FM_WAKE_DRAIN_FILE="$DRAIN_DEDUPED" "$SCRIPT_DIR/fm-inactive-reconcile.sh" \
+        output-emitted "$key" "$row" >/dev/null 2>&1 || return 1
+      printf '%s\n' "$row" || return 1
+    fi
+    FM_WAKE_DRAIN_DIRECT=0 FM_WAKE_DRAIN_DEFER_ACK=1 FM_WAKE_DRAIN_GENERATION="$generation" \
+      FM_WAKE_DRAIN_FILE="$DRAIN_DEDUPED" "$SCRIPT_DIR/fm-inactive-reconcile.sh" \
+      output-confirmed "$key" "$row" >/dev/null 2>&1 || return 1
+    if FM_WAKE_DRAIN_DIRECT=0 FM_WAKE_DRAIN_DEFER_ACK=1 FM_WAKE_DRAIN_GENERATION="$generation" \
+      FM_WAKE_DRAIN_FILE="$DRAIN_DEDUPED" "$SCRIPT_DIR/fm-inactive-reconcile.sh" \
+      output-complete "$key" "$row"; then
+      FM_WAKE_DRAIN_DIRECT=0 FM_WAKE_DRAIN_DEFER_ACK=1 FM_WAKE_DRAIN_GENERATION="$generation" \
+        FM_WAKE_DRAIN_FILE="$DRAIN_DEDUPED" "$SCRIPT_DIR/fm-inactive-reconcile.sh" \
+        caller-output-complete-locked "$key" "$row" "$generation" >/dev/null 2>&1 || return 3
+      FM_WAKE_DRAIN_DIRECT=0 FM_WAKE_DRAIN_DEFER_ACK=1 FM_WAKE_DRAIN_GENERATION="$generation" \
+        FM_WAKE_DRAIN_FILE="$DRAIN_DEDUPED" "$SCRIPT_DIR/fm-inactive-reconcile.sh" \
+        presented "$key" "$row" >/dev/null 2>&1 || return 3
+      FM_WAKE_DRAIN_DIRECT=0 FM_WAKE_DRAIN_DEFER_ACK=1 FM_WAKE_DRAIN_GENERATION="$generation" \
+        FM_WAKE_DRAIN_FILE="$DRAIN_DEDUPED" "$SCRIPT_DIR/fm-inactive-reconcile.sh" \
+        ack "$key" "$row" 0 "$generation" >/dev/null 2>&1 || return 3
+      return 0
+    fi
+    return 3
+  fi
+  if [ "${FM_WAKE_DRAIN_DEFER_ACK:-0}" = 1 ]; then
+    IFS=$(printf '\t') read -r _epoch _seq _kind _queued_key payload <<< "$row"
+    [ "$_queued_key" = "$key" ] || return 3
+    defer_pending=1
+    defer_payload=$payload
+    if [ "$DRAIN_RESUMING" = true ]; then
+      if [ "$DRAIN_RETAINED_ANY" = 0 ]; then
+        DRAIN_RETAINED_OFFSET=$DRAIN_CURRENT_OFFSET
+        DRAIN_RETAINED_ANY=1
+      fi
+    fi
+  fi
+  trap - INT TERM HUP
+  go=$(mktemp "$STATE/.wake-presentation.XXXXXX") || return 1
+  [ -f "$go" ] && [ ! -L "$go" ] || { rm -f "$go"; return 1; }
+  emitted=$(mktemp "$STATE/.wake-emitted.XXXXXX") || { rm -f "$go"; return 1; }
+  [ -f "$emitted" ] && [ ! -L "$emitted" ] || { rm -f "$go" "$emitted"; return 1; }
+  export -f fm_pane_idle_run_bounded_child presentation_reconcile presentation_parent_alive wake_marker_write \
+    present_inactive_worker fm_pid_start_ps_token fm_pid_start fm_pid_start_matches_stored
+  if command -v perl >/dev/null 2>&1; then
+    perl -e 'use POSIX (); POSIX::setpgid(0, 0) == 0 or exit 125; exec @ARGV or exit 127' \
+      "$BASH" -c 'present_inactive_worker "$@"' present-inactive-worker \
+      "$key" "$row" "$DRAIN_DEDUPED" "$DRAIN_PID" "$DRAIN_PID_START" "$go" "$emitted" "$SCRIPT_DIR" \
+      "$PRESENTATION_TIMEOUT_SECS" &
+    worker=$!
+  else
+    rm -f "$go" "$emitted"
+    return 1
+  fi
+  worker_pgid=$worker
+  wake_marker_write "$go" go || {
+    status=1
+    worker_stopped=0
+    presentation_worker_stop "$worker" "$worker_pgid" && worker_stopped=1
+  }
+  if [ "$status" = 0 ]; then
+    presentation_deadline=$(( $(date +%s) + PRESENTATION_TIMEOUT_SECS ))
+    while kill -0 "$worker" 2>/dev/null; do
+      if [ "$(date +%s)" -ge "$presentation_deadline" ] && kill -0 "$worker" 2>/dev/null; then
+        worker_timed_out=1
+        worker_status=124
+        worker_stopped=0
+        presentation_worker_stop "$worker" "$worker_pgid" && worker_stopped=1
+        break
+      fi
+      sleep 0.01
+    done
+    if [ "$worker_timed_out" = 0 ]; then
+      wait "$worker" || worker_status=$?
+      worker_stopped=0
+      presentation_worker_stop "$worker" "$worker_pgid" && worker_stopped=1
+    fi
+    [ "$worker_status" = 0 ] || status=1
+  fi
+  [ "$worker_stopped" = 1 ] || return 1
+  rm -f "$go"
+  if [ "$status" -ne 0 ]; then
+    if [ -s "$emitted" ]; then
+      if FM_WAKE_DRAIN_DELEGATED=0 FM_WAKE_DRAIN_PARENT_PID='' \
+          presentation_reconcile "$PRESENTATION_TIMEOUT_SECS" FM_WAKE_DRAIN_FILE="$DRAIN_DEDUPED" \
+          "$SCRIPT_DIR/fm-inactive-reconcile.sh" output-complete "$key" "$row" \
+          >/dev/null 2>&1; then
+        status=0
+      else
+        status=3
+      fi
+    else
+      :
+    fi
+  fi
+  if [ "$status" = 0 ] && [ "${FM_WAKE_DRAIN_DEFER_ACK:-0}" != 1 ]; then
+    if [ -n "$generation" ]; then
+      FM_WAKE_DRAIN_DELEGATED=0 FM_WAKE_DRAIN_PARENT_PID='' \
+        FM_WAKE_DRAIN_FILE="$DRAIN_DEDUPED" "$SCRIPT_DIR/fm-inactive-reconcile.sh" \
+        caller-output-complete-locked "$key" "$row" "$generation" >/dev/null 2>&1 || status=3
+    fi
+  fi
+  if [ "$status" = 0 ] && [ "${FM_WAKE_DRAIN_DEFER_ACK:-0}" != 1 ]; then
+    if ! FM_WAKE_DRAIN_DELEGATED=0 FM_WAKE_DRAIN_PARENT_PID='' \
+        FM_WAKE_DRAIN_FILE="$DRAIN_DEDUPED" "$SCRIPT_DIR/fm-inactive-reconcile.sh" presented "$key" "$row"; then
+      status=1
+      if [ -s "$emitted" ] \
+        && FM_WAKE_DRAIN_DELEGATED=0 FM_WAKE_DRAIN_PARENT_PID='' \
+          FM_WAKE_DRAIN_FILE="$DRAIN_DEDUPED" "$SCRIPT_DIR/fm-inactive-reconcile.sh" \
+          presented "$key" "$row" >/dev/null 2>&1; then
+        status=0
+      fi
+    fi
+  fi
+  if [ "$status" = 0 ] && [ "$defer_pending" = 1 ]; then
+    if [ "$DRAIN_RESUMING" = true ]; then
+      DRAIN_CURRENT_RETAINED=1
+    else
+      if fm_wake_append_if_absent_locked retained check "$key" "$defer_payload"; then
+        DRAIN_CURRENT_RETAINED=1
+      else
+        status=1
+      fi
+    fi
+  fi
+  rm -f "$emitted"
+  trap 'exit 130' INT
+  trap 'exit 143' TERM
+  return "$status"
+}
 
 # Defense in depth for the watcher re-arm chain: this script runs at the top of
 # every wake-handling and recovery turn, so assert watcher liveness here too. A
@@ -27,11 +312,325 @@ assert_watcher_liveness() {
   "$SCRIPT_DIR/fm-guard.sh" || true
 }
 
+restore_unprocessed_rows() {
+  local _start=${1:-0} offset
+  case "$_start" in ''|*[!0-9]*) return 1 ;; esac
+  if [ "$DRAIN_CURRENT_RETAINED" = 1 ]; then
+    offset=$DRAIN_NEXT_OFFSET
+  else
+    offset=$DRAIN_CURRENT_OFFSET
+  fi
+  case "$offset" in ''|*[!0-9]*) return 1 ;; esac
+  DRAIN_RESTORE_OFFSET=$offset
+  DRAIN_RESTORE_SOURCE=$DRAIN_DEDUPED
+  restore_pending_write "$DRAIN_DEDUPED" "$offset" "$DRAIN_TMP" || {
+    DRAIN_RESTORE_SOURCE=
+    return 1
+  }
+  DRAIN_RESTORE_PENDING=true
+  restore_pending_retire_raw_source || return 1
+  rm -f "$DRAIN_TMP" || return 1
+  DRAIN_TMP=
+}
+
+restore_source_path_valid() {
+  local source=$1 base
+  base=${source##*/}
+  [ "$source" = "$STATE/$base" ] || return 1
+  case "$base" in
+    .wake-queue.deduped.*|.wake-queue.drain.*) ;;
+    *) return 1 ;;
+  esac
+  case "${base##*.}" in ''|*[!0-9]*) return 1 ;; esac
+}
+
+restore_pending_manifest_write() {
+  local source=$1 offset=$2 source_retired=$3 raw_source=${4:-} raw_source_retired=${5:-1}
+  local source_base raw_base tmp
+  source_base=${source##*/}
+  restore_source_path_valid "$source" || return 1
+  case "$offset" in ''|*[!0-9]*) return 1 ;; esac
+  case "$source_retired" in 0|1) ;; *) return 1 ;; esac
+  if [ -n "$raw_source" ]; then
+    raw_base=${raw_source##*/}
+    restore_source_path_valid "$raw_source" || return 1
+    [ "$raw_source" != "$source" ] || return 1
+    case "$raw_source_retired" in 0|1) ;; *) return 1 ;; esac
+  else
+    raw_base=
+    raw_source_retired=1
+  fi
+  [ ! -L "$DRAIN_RESTORE_MANIFEST" ] || return 1
+  tmp=$(mktemp "$DRAIN_RESTORE_MANIFEST.XXXXXX") || return 1
+  if ! printf 'schema=fm-wake-queue-restore.v1\nsource=%s\noffset=%s\nsource_retired=%s\nraw_source=%s\nraw_source_retired=%s\n' \
+    "$source_base" "$offset" "$source_retired" "$raw_base" "$raw_source_retired" | fm_nofollow_write "$tmp" \
+    || ! fm_nofollow_rename "$tmp" "$DRAIN_RESTORE_MANIFEST"; then
+    rm -f "$tmp"
+    return 1
+  fi
+}
+
+restore_pending_write() {
+  local source=$1 offset=$2 raw_source=${3:-} raw_source_retired=1
+  [ -z "$raw_source" ] || raw_source_retired=0
+  restore_pending_manifest_write "$source" "$offset" 0 "$raw_source" "$raw_source_retired" || return 1
+  DRAIN_RESTORE_SOURCE=$source
+  DRAIN_RESTORE_OFFSET=$offset
+  DRAIN_RESTORE_SOURCE_RETIRED=0
+  DRAIN_RESTORE_RAW_SOURCE=${raw_source:+$STATE/${raw_source##*/}}
+  DRAIN_RESTORE_RAW_SOURCE_RETIRED=$raw_source_retired
+}
+
+restore_pending_read() {
+  local schema source offset source_retired raw_source raw_source_retired base raw_base
+  [ -f "$DRAIN_RESTORE_MANIFEST" ] && [ ! -L "$DRAIN_RESTORE_MANIFEST" ] || return 1
+  schema=$(awk -F= '$1 == "schema" { print $2; n++ } END { exit(n == 1 ? 0 : 1) }' \
+    "$DRAIN_RESTORE_MANIFEST" 2>/dev/null) || return 1
+  [ "$schema" = fm-wake-queue-restore.v1 ] || return 1
+  source=$(awk -F= '$1 == "source" { print $2; n++ } END { exit(n == 1 ? 0 : 1) }' \
+    "$DRAIN_RESTORE_MANIFEST" 2>/dev/null) || return 1
+  offset=$(awk -F= '$1 == "offset" { print $2; n++ } END { exit(n == 1 ? 0 : 1) }' \
+    "$DRAIN_RESTORE_MANIFEST" 2>/dev/null) || return 1
+  if ! source_retired=$(awk -F= '$1 == "source_retired" { print $2; n++ } END { exit(n == 0 || n == 1 ? 0 : 1) }' \
+    "$DRAIN_RESTORE_MANIFEST" 2>/dev/null); then
+    return 1
+  fi
+  case "$source_retired" in ''|0) source_retired=0 ;; 1) ;; *) return 1 ;; esac
+  if ! raw_source=$(awk -F= '$1 == "raw_source" { print $2; n++ } END { exit(n == 0 || n == 1 ? 0 : 1) }' \
+    "$DRAIN_RESTORE_MANIFEST" 2>/dev/null); then
+    return 1
+  fi
+  if ! raw_source_retired=$(awk -F= '$1 == "raw_source_retired" { print $2; n++ } END { if (n == 0) print 1; exit(n == 0 || n == 1 ? 0 : 1) }' \
+    "$DRAIN_RESTORE_MANIFEST" 2>/dev/null); then
+    return 1
+  fi
+  case "$raw_source_retired" in 0|1) ;; *) return 1 ;; esac
+  restore_source_path_valid "$STATE/$source" || return 1
+  case "$offset" in ''|*[!0-9]*) return 1 ;; esac
+  base="$STATE/$source"
+  if [ "$source_retired" = 1 ]; then
+    if [ -e "$base" ] || [ -L "$base" ]; then
+      [ -f "$base" ] && [ ! -L "$base" ] || return 1
+      fm_wake_queue_offset_valid "$base" "$offset" || return 1
+    fi
+  else
+    [ -f "$base" ] && [ ! -L "$base" ] || return 1
+    fm_wake_queue_offset_valid "$base" "$offset" || return 1
+  fi
+  if [ -n "$raw_source" ]; then
+    raw_base=${raw_source##*/}
+    restore_source_path_valid "$STATE/$raw_source" || return 1
+    [ "$raw_source" != "$source" ] || return 1
+    raw_base="$STATE/$raw_source"
+    if [ "$raw_source_retired" = 1 ]; then
+      if [ -e "$raw_base" ] || [ -L "$raw_base" ]; then
+        [ -f "$raw_base" ] && [ ! -L "$raw_base" ] || return 1
+        fm_wake_queue_offset_valid "$raw_base" "$offset" || return 1
+      fi
+    else
+      [ -f "$raw_base" ] && [ ! -L "$raw_base" ] || return 1
+      fm_wake_queue_offset_valid "$raw_base" "$offset" || return 1
+    fi
+  else
+    [ "$raw_source_retired" = 1 ] || return 1
+  fi
+  DRAIN_RESTORE_SOURCE=$base
+  DRAIN_RESTORE_OFFSET=$offset
+  DRAIN_RESTORE_SOURCE_RETIRED=$source_retired
+  DRAIN_RESTORE_RAW_SOURCE=${raw_source:+$STATE/$raw_source}
+  DRAIN_RESTORE_RAW_SOURCE_RETIRED=$raw_source_retired
+}
+
+restore_pending_mark_source_retired() {
+  local source=$1 offset=$2
+  restore_pending_manifest_write "$source" "$offset" 1 \
+    "$DRAIN_RESTORE_RAW_SOURCE" "$DRAIN_RESTORE_RAW_SOURCE_RETIRED" || return 1
+  DRAIN_RESTORE_SOURCE_RETIRED=1
+}
+
+restore_pending_mark_raw_source_retired() {
+  [ -n "$DRAIN_RESTORE_RAW_SOURCE" ] || return 0
+  restore_pending_manifest_write "$DRAIN_RESTORE_SOURCE" "$DRAIN_RESTORE_OFFSET" \
+    "$DRAIN_RESTORE_SOURCE_RETIRED" "$DRAIN_RESTORE_RAW_SOURCE" 1 || return 1
+  DRAIN_RESTORE_RAW_SOURCE_RETIRED=1
+}
+
+restore_pending_retire_raw_source() {
+  [ -n "$DRAIN_RESTORE_RAW_SOURCE" ] || return 0
+  if [ "$DRAIN_RESTORE_RAW_SOURCE_RETIRED" != 1 ]; then
+    restore_pending_mark_raw_source_retired || return 1
+  fi
+  rm -f "$DRAIN_RESTORE_RAW_SOURCE"
+}
+
+restore_queue_fallback() {
+  local source=$1
+  [ -f "$source" ] && [ ! -L "$source" ] || return 1
+  if [ "$DRAIN_LOCK_HELD" = true ]; then
+    fm_lock_release "$FM_WAKE_QUEUE_LOCK" || return 1
+    DRAIN_LOCK_HELD=false
+  fi
+  fm_wake_restore_queue_atomic "$source"
+}
+
+drain_recover_orphaned_sources_locked() {
+  local orphan base tmp
+  [ ! -L "$FM_WAKE_QUEUE" ] || return 1
+  [ ! -e "$DRAIN_RESTORE_MANIFEST" ] && [ ! -L "$DRAIN_RESTORE_MANIFEST" ] || return 0
+  for orphan in "$STATE"/.wake-queue.drain.*; do
+    [ -e "$orphan" ] || continue
+    [ -f "$orphan" ] && [ ! -L "$orphan" ] || return 1
+    base=${orphan##*/}
+    case "$base" in .wake-queue.drain.*) ;; *) return 1 ;; esac
+    case "${base##*.}" in ''|*[!0-9]*) return 1 ;; esac
+    if [ -e "$FM_WAKE_QUEUE" ]; then
+      [ -f "$FM_WAKE_QUEUE" ] && [ ! -L "$FM_WAKE_QUEUE" ] || return 1
+      tmp=$(mktemp "$STATE/.wake-queue.recover.XXXXXX") || return 1
+      if ! cat "$orphan" "$FM_WAKE_QUEUE" | fm_nofollow_write "$tmp" \
+        || ! fm_nofollow_rename "$tmp" "$FM_WAKE_QUEUE"; then
+        rm -f "$tmp"
+        return 1
+      fi
+      rm -f "$orphan" || return 1
+    else
+      fm_nofollow_rename "$orphan" "$FM_WAKE_QUEUE" 1 || return 1
+    fi
+  done
+}
+
+drain_restore_remaining() {
+  [ "$DRAIN_RESUMING" = true ] && return 0
+  restore_unprocessed_rows "$1"
+}
+
+drain_resume_advance() {
+  local removed=${1:-0}
+  [ "$DRAIN_RESUMING" = true ] && [ "$DRAIN_RESTORE_PENDING" != true ] || return 0
+  [ "$DRAIN_CURRENT_RETAINED" = 1 ] && return 0
+  [ "$DRAIN_RETAINED_ANY" = 1 ] && return 0
+  if [ "$removed" = 0 ]; then
+    fm_wake_queue_cursor_write "$DRAIN_NEXT_OFFSET" || return 1
+  fi
+  fm_wake_queue_cursor_read || return 1
+  DRAIN_OFFSET=$FM_WAKE_QUEUE_CURSOR_OFFSET
+}
+
+drain_batch_stop() {
+  local next_offset
+  if [ "$DRAIN_LOCK_HELD" = true ]; then
+    if [ "$DRAIN_RESTORE_PENDING" = true ]; then
+      if [ "$DRAIN_RETAINED_ANY" = 1 ]; then
+        next_offset=$DRAIN_RETAINED_OFFSET
+      else
+        next_offset=$(fm_wake_queue_offset_after_rows "$DRAIN_DEDUPED" \
+          "$DRAIN_OFFSET" "$DRAIN_BATCH_COUNT") || return 1
+      fi
+      restore_pending_write "$DRAIN_DEDUPED" "$next_offset" || return 1
+      DRAIN_OFFSET=$next_offset
+      fm_lock_release "$FM_WAKE_QUEUE_LOCK" || return 1
+      DRAIN_LOCK_HELD=false
+    elif [ "$DRAIN_RESUMING" = true ]; then
+      if [ "$DRAIN_RETAINED_ANY" = 1 ]; then
+        next_offset=$DRAIN_RETAINED_OFFSET
+        fm_wake_queue_cursor_write "$next_offset" || return 1
+        DRAIN_OFFSET=$next_offset
+      else
+        fm_wake_queue_cursor_read || return 1
+        DRAIN_OFFSET=$FM_WAKE_QUEUE_CURSOR_OFFSET
+      fi
+      fm_lock_release "$FM_WAKE_QUEUE_LOCK" || return 1
+      DRAIN_LOCK_HELD=false
+    else
+      fm_lock_release "$FM_WAKE_QUEUE_LOCK" || return 1
+      DRAIN_LOCK_HELD=false
+      next_offset=$(fm_wake_queue_offset_after_rows "$DRAIN_DEDUPED" 0 \
+        "$DRAIN_BATCH_COUNT") || return 1
+      fm_wake_install_queue_cursor_atomic "$DRAIN_DEDUPED" "$next_offset" || return 1
+      if [ "${#DRAIN_FINALIZED_KEYS[@]}" -gt 0 ]; then
+        fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK" || return 1
+        DRAIN_LOCK_HELD=true
+        finalized_status=0
+        for finalized_key in "${DRAIN_FINALIZED_KEYS[@]}"; do
+          fm_wake_remove_key_locked "$finalized_key" || { finalized_status=1; break; }
+        done
+        if [ "$finalized_status" -ne 0 ]; then
+          fm_lock_release "$FM_WAKE_QUEUE_LOCK" || true
+          DRAIN_LOCK_HELD=false
+          return 1
+        fi
+        fm_lock_release "$FM_WAKE_QUEUE_LOCK" || return 1
+        DRAIN_LOCK_HELD=false
+        DRAIN_FINALIZED_KEYS=()
+      fi
+      rm -f "$DRAIN_RESTORE" "$DRAIN_TMP" "$DRAIN_DEDUPED"
+      DRAIN_RESTORE=
+      DRAIN_TMP=
+      DRAIN_DEDUPED=
+      DRAIN_CURSOR=$(fm_wake_queue_cursor_path)
+    fi
+  fi
+  assert_watcher_liveness
+  if [ "${FM_WAKE_DRAIN_DIRECT:-0}" = 1 ] && [ "$DRAIN_ACTIONABLE" = 1 ]; then
+    return 3
+  fi
+  return 0
+}
+
 # shellcheck disable=SC2317,SC2329 # Invoked by trap handlers below.
 cleanup() {
-  local status=$?
-  if [ "$status" -ne 0 ] && [ "$DRAIN_LOCK_HELD" = true ] && [ -n "$DRAIN_TMP" ] && [ -e "$DRAIN_TMP" ]; then
-    fm_wake_restore_queue "$DRAIN_TMP" || true
+  local status=$? restore_status=0
+  if [ "$status" -ne 0 ] && [ "$status" -ne 3 ] \
+    && [ "$DRAIN_LOCK_HELD" = false ] \
+    && { [ -n "$DRAIN_TMP" ] || [ -n "$DRAIN_RESTORE" ] || [ -n "$DRAIN_DEDUPED" ]; }; then
+    if fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK"; then
+      DRAIN_LOCK_HELD=true
+    else
+      restore_status=1
+    fi
+  fi
+  if [ "$status" -ne 0 ] && [ "$status" -ne 3 ] && [ "$DRAIN_LOCK_HELD" = true ]; then
+    if [ "$DRAIN_RESTORE_PENDING" = true ]; then
+      :
+    elif [ "$DRAIN_DEDUPED_READY" = 1 ] && [ -n "$DRAIN_DEDUPED" ] \
+      && [ -e "$DRAIN_DEDUPED" ]; then
+      if restore_pending_write "$DRAIN_DEDUPED" "$DRAIN_CURRENT_OFFSET" "$DRAIN_TMP"; then
+        DRAIN_RESTORE_PENDING=true
+        if restore_pending_retire_raw_source && rm -f "$DRAIN_TMP"; then
+          DRAIN_TMP=
+        else
+          restore_status=1
+        fi
+      else
+        if [ -n "$DRAIN_TMP" ] && [ -e "$DRAIN_TMP" ] \
+          && restore_queue_fallback "$DRAIN_TMP"; then
+          rm -f "$DRAIN_TMP" || restore_status=1
+          [ "$restore_status" = 0 ] && DRAIN_TMP=
+        else
+          restore_status=1
+        fi
+      fi
+    elif [ -n "$DRAIN_TMP" ] && [ -e "$DRAIN_TMP" ]; then
+      if restore_pending_write "$DRAIN_TMP" 0; then
+        DRAIN_RESTORE_PENDING=true
+      else
+        if restore_queue_fallback "$DRAIN_TMP"; then
+          rm -f "$DRAIN_TMP" || restore_status=1
+          [ "$restore_status" = 0 ] && DRAIN_TMP=
+        else
+          restore_status=1
+        fi
+      fi
+    fi
+  fi
+  if [ "$restore_status" = 0 ]; then
+    if [ "$DRAIN_RESTORE_PENDING" != true ]; then
+      [ -z "$DRAIN_TMP" ] || rm -f "$DRAIN_TMP" || true
+      [ -z "$DRAIN_RESTORE" ] || rm -f "$DRAIN_RESTORE" || true
+    fi
+  fi
+  if [ "$restore_status" = 0 ] && [ "$DRAIN_RESTORE_PENDING" != true ] && [ -n "$DRAIN_DEDUPED" ] \
+    && [ "$DRAIN_DEDUPED" != "$FM_WAKE_QUEUE" ]; then
+    rm -f "$DRAIN_DEDUPED" || true
   fi
   if [ "$DRAIN_LOCK_HELD" = true ]; then
     fm_lock_release "$FM_WAKE_QUEUE_LOCK"
@@ -48,20 +647,235 @@ fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK" || {
   exit 1
 }
 DRAIN_LOCK_HELD=true
+fm_wake_queue_txn_recover_transactions_locked || {
+  echo "error: wake queue transaction recovery failed; refusing to drain" >&2
+  exit 1
+}
+drain_recover_orphaned_sources_locked || {
+  echo "error: orphaned wake drain source recovery failed; refusing to drain" >&2
+  exit 1
+}
 
-if [ ! -s "$FM_WAKE_QUEUE" ]; then
-  : > "$FM_WAKE_QUEUE"
+DRAIN_CURSOR=$(fm_wake_queue_cursor_path)
+if [ -e "$DRAIN_RESTORE_MANIFEST" ] || [ -L "$DRAIN_RESTORE_MANIFEST" ]; then
+  restore_pending_read || {
+    echo "error: wake restoration manifest is invalid; refusing to drain" >&2
+    exit 1
+  }
+  DRAIN_RESTORE_PENDING=true
+  DRAIN_RESUMING=true
+  FM_WAKE_DRAIN_RESUMED_SOURCE=1
+  DRAIN_DEDUPED=$DRAIN_RESTORE_SOURCE
+  DRAIN_OFFSET=$DRAIN_RESTORE_OFFSET
+  restore_pending_retire_raw_source || {
+    echo "error: wake restoration raw source retirement failed; refusing to drain" >&2
+    exit 1
+  }
+  if [ "$DRAIN_RESTORE_SOURCE_RETIRED" = 1 ]; then
+    rm -f "$DRAIN_RESTORE_SOURCE" || exit 1
+    rm -f "$DRAIN_RESTORE_MANIFEST" || exit 1
+    DRAIN_RESTORE_SOURCE=
+    DRAIN_RESTORE_SOURCE_RETIRED=0
+    DRAIN_RESTORE_RAW_SOURCE=
+    DRAIN_RESTORE_RAW_SOURCE_RETIRED=1
+    DRAIN_RESTORE_PENDING=false
+    DRAIN_RESUMING=false
+    DRAIN_DEDUPED=
+  fi
+elif [ -e "$DRAIN_CURSOR" ] || [ -L "$DRAIN_CURSOR" ]; then
+  fm_wake_queue_cursor_read || {
+    echo "error: wake queue cursor is invalid; refusing to drain" >&2
+    exit 1
+  }
+  DRAIN_RESUMING=true
+  FM_WAKE_DRAIN_RESUMED_SOURCE=1
+  DRAIN_OFFSET=$FM_WAKE_QUEUE_CURSOR_OFFSET
+  DRAIN_DEDUPED=$FM_WAKE_QUEUE
+fi
+
+if [ "$DRAIN_RESTORE_PENDING" != true ] && [ ! -s "$FM_WAKE_QUEUE" ]; then
+  rm -f "$DRAIN_CURSOR" || exit 1
+  : | fm_nofollow_write "$FM_WAKE_QUEUE" || exit 1
   assert_watcher_liveness
   exit 0
 fi
 
-DRAIN_TMP="$STATE/.wake-queue.drain.$(fm_current_pid)"
-rm -f "$DRAIN_TMP"
-mv "$FM_WAKE_QUEUE" "$DRAIN_TMP" || exit 1
-: > "$FM_WAKE_QUEUE" || exit 1
+if [ "$DRAIN_RESUMING" != true ]; then
+  DRAIN_TMP="$STATE/.wake-queue.drain.$DRAIN_PID"
+  DRAIN_DEDUPED="$STATE/.wake-queue.deduped.$DRAIN_PID"
+  [ ! -L "$DRAIN_TMP" ] || exit 1
+  if [ -e "$DRAIN_TMP" ]; then
+    [ -f "$DRAIN_TMP" ] || exit 1
+    rm -f "$DRAIN_TMP" || exit 1
+  fi
+  [ ! -L "$DRAIN_DEDUPED" ] || exit 1
+  if [ -e "$DRAIN_DEDUPED" ]; then
+    [ -f "$DRAIN_DEDUPED" ] || exit 1
+    rm -f "$DRAIN_DEDUPED" || exit 1
+  fi
+  fm_nofollow_rename "$FM_WAKE_QUEUE" "$DRAIN_TMP" 1 || exit 1
+  : | fm_nofollow_write "$FM_WAKE_QUEUE" || exit 1
 
-fm_wake_print_deduped "$DRAIN_TMP" || exit "$?"
-rm -f "$DRAIN_TMP"
-DRAIN_TMP=
+  fm_lock_release "$FM_WAKE_QUEUE_LOCK" || exit 1
+  DRAIN_LOCK_HELD=false
+  if ! fm_wake_print_deduped "$DRAIN_TMP" | fm_nofollow_write "$DRAIN_DEDUPED"; then
+    exit 1
+  fi
+  DRAIN_DEDUPED_READY=1
+  fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK" || exit 1
+  DRAIN_LOCK_HELD=true
+fi
+# Inactive-outcome rows are acknowledged only after their matching durable
+# receipt is presented. A one-time claim binds the receipt to this locked drain.
+drain_line=0
+DRAIN_BATCH_COUNT=0
+if [ "$DRAIN_RESUMING" = true ]; then
+  exec 7< <(fm_wake_queue_stream_from_offset "$DRAIN_DEDUPED" "$DRAIN_OFFSET")
+else
+  exec 7< "$DRAIN_DEDUPED"
+fi
+while IFS= read -r drain_row || [ -n "$drain_row" ]; do
+  drain_line=$((drain_line + 1))
+  DRAIN_BATCH_COUNT=$((DRAIN_BATCH_COUNT + 1))
+  if [ "$DRAIN_RESUMING" = true ] && [ "$DRAIN_RESTORE_PENDING" != true ]; then
+    fm_wake_queue_cursor_read || exit 1
+    DRAIN_OFFSET=$FM_WAKE_QUEUE_CURSOR_OFFSET
+    DRAIN_CURRENT_OFFSET=$DRAIN_OFFSET
+    DRAIN_NEXT_OFFSET=$(fm_wake_queue_offset_after_rows "$DRAIN_DEDUPED" \
+      "$DRAIN_CURRENT_OFFSET" 1) || exit 1
+  else
+    DRAIN_CURRENT_OFFSET=$(fm_wake_queue_offset_after_rows "$DRAIN_DEDUPED" \
+      "$DRAIN_OFFSET" "$((DRAIN_BATCH_COUNT - 1))") || exit 1
+    DRAIN_NEXT_OFFSET=$(fm_wake_queue_offset_after_rows "$DRAIN_DEDUPED" \
+      "$DRAIN_OFFSET" "$DRAIN_BATCH_COUNT") || exit 1
+  fi
+  DRAIN_CURRENT_REMOVED=0
+  IFS=$(printf '\t') read -r _epoch _seq _kind _key _payload <<< "$drain_row"
+  case "$_key" in
+    inactive-outcome:*)
+      if ! inactive_generation_valid; then
+        drain_restore_remaining "$drain_line" || exit 1
+        exit 2
+      fi
+      claim_status=0
+      FM_WAKE_DRAIN_DELEGATED=0 FM_WAKE_DRAIN_PARENT_PID='' \
+        FM_WAKE_DRAIN_FILE="$DRAIN_DEDUPED" "$SCRIPT_DIR/fm-inactive-reconcile.sh" \
+        claim "$_key" "$drain_row" || claim_status=$?
+      case "$claim_status" in
+        0)
+          DRAIN_ACTIONABLE=1
+          if ! FM_WAKE_DRAIN_DELEGATED=0 FM_WAKE_DRAIN_PARENT_PID='' \
+            FM_WAKE_DRAIN_DIRECT=0 FM_WAKE_DRAIN_DEFER_ACK="${FM_WAKE_DRAIN_DEFER_ACK:-0}" \
+            FM_WAKE_DRAIN_GENERATION="${FM_WAKE_DRAIN_GENERATION:-}" \
+            FM_WAKE_DRAIN_FILE="$DRAIN_DEDUPED" "$SCRIPT_DIR/fm-inactive-reconcile.sh" presenting "$_key" "$drain_row"; then
+            drain_restore_remaining "$drain_line" || exit 1
+            exit 1
+          fi
+          present_status=0
+          DRAIN_CURRENT_RETAINED=0
+          present_inactive_row "$_key" "$drain_row" || present_status=$?
+          if [ "$present_status" -ne 0 ]; then
+            restore_start=$drain_line
+            [ "$DRAIN_CURRENT_RETAINED" = 1 ] && restore_start=$((drain_line + 1))
+            drain_restore_remaining "$restore_start" || exit 1
+            exit 1
+          fi
+          ;;
+        1|5) ;;
+        3)
+          if [ "$DRAIN_RESUMING" = true ] && [ "$DRAIN_RESTORE_PENDING" != true ]; then
+            fm_wake_remove_key_locked "$_key" || {
+              drain_restore_remaining "$drain_line" || exit 1
+              exit 1
+            }
+            DRAIN_CURRENT_REMOVED=1
+          else
+            DRAIN_FINALIZED_KEYS+=("$_key")
+          fi
+          ;;
+        4)
+          if [ "$DRAIN_RESUMING" != true ]; then
+            drain_restore_remaining "$drain_line" || exit 1
+          fi
+          exit 0
+          ;;
+        6)
+          drain_restore_remaining "$drain_line" || exit 1
+          exit 1
+          ;;
+        *)
+          drain_restore_remaining "$drain_line" || exit 1
+          exit "$claim_status"
+          ;;
+      esac
+      if [ "$claim_status" != 3 ] && [ "$claim_status" != 4 ] \
+        && { [ "${FM_WAKE_DRAIN_DEFER_ACK:-0}" != 1 ] || [ "$claim_status" = 5 ]; }; then
+        ack_status=0
+      FM_WAKE_DRAIN_DELEGATED=0 FM_WAKE_DRAIN_PARENT_PID='' \
+        FM_WAKE_DRAIN_FILE="$DRAIN_DEDUPED" "$SCRIPT_DIR/fm-inactive-reconcile.sh" \
+        ack "$_key" "$drain_row" 0 "${FM_WAKE_DRAIN_GENERATION:-}" || ack_status=$?
+        if [ "$ack_status" != 0 ] && [ "$ack_status" != 1 ]; then
+          drain_restore_remaining "$drain_line" || exit 1
+          exit "$ack_status"
+        fi
+        DRAIN_CURRENT_REMOVED=1
+      fi
+      ;;
+    *)
+      if ! printf '%s\n' "$drain_row"; then
+        drain_restore_remaining "$drain_line" || exit 1
+        exit 1
+      fi
+      if [ "$_kind" = signal ] && ! fm_wake_mark_surface_consumed "$_key"; then
+        drain_restore_remaining "$drain_line" || exit 1
+        exit 1
+      fi
+      DRAIN_ACTIONABLE=1
+      ;;
+  esac
+  drain_resume_advance "$DRAIN_CURRENT_REMOVED" || exit 1
+  if [ "$DRAIN_BATCH_COUNT" -ge "$DRAIN_BATCH_ROWS" ]; then
+    drain_batch_stop
+    batch_status=$?
+    [ "$batch_status" = 0 ] || exit "$batch_status"
+    exit 0
+  fi
+done <&7
+exec 7<&-
+if [ "$DRAIN_RESTORE_PENDING" = true ]; then
+  if [ "$DRAIN_RETAINED_ANY" = 1 ]; then
+    drain_batch_stop
+    batch_status=$?
+    [ "$batch_status" = 0 ] || [ "$batch_status" = 3 ] || exit "$batch_status"
+    exit "$batch_status"
+  fi
+  restore_pending_mark_source_retired "$DRAIN_RESTORE_SOURCE" "$DRAIN_RESTORE_OFFSET" || exit 1
+  rm -f "$DRAIN_RESTORE_SOURCE" || exit 1
+  restore_pending_retire_raw_source || exit 1
+  rm -f "$DRAIN_RESTORE_MANIFEST" || exit 1
+  DRAIN_DEDUPED=
+  DRAIN_RESTORE_SOURCE=
+  DRAIN_RESTORE_SOURCE_RETIRED=0
+  DRAIN_RESTORE_RAW_SOURCE=
+  DRAIN_RESTORE_RAW_SOURCE_RETIRED=1
+  DRAIN_RESTORE_PENDING=false
+elif [ "$DRAIN_RESUMING" = true ]; then
+  if [ "$DRAIN_RETAINED_ANY" = 1 ]; then
+    next_offset=$DRAIN_RETAINED_OFFSET
+    fm_wake_queue_cursor_write "$next_offset" || exit 1
+  else
+    : | fm_nofollow_write "$FM_WAKE_QUEUE" || exit 1
+    rm -f "$DRAIN_CURSOR" || exit 1
+  fi
+  DRAIN_DEDUPED=
+else
+  rm -f "$DRAIN_TMP"
+  DRAIN_TMP=
+  rm -f "$DRAIN_DEDUPED"
+  DRAIN_DEDUPED=
+fi
 assert_watcher_liveness
+if [ "${FM_WAKE_DRAIN_DIRECT:-0}" = 1 ] && [ "$DRAIN_ACTIONABLE" = 1 ]; then
+  exit 3
+fi
 exit 0
diff --git a/bin/fm-wake-lib.sh b/bin/fm-wake-lib.sh
index f97d430c100..67f3fe1178e 100755
--- a/bin/fm-wake-lib.sh
+++ b/bin/fm-wake-lib.sh
@@ -1,9 +1,12 @@
 #!/usr/bin/env bash
 # Shared durable wake queue and portable lock helpers.
+set -o pipefail
 
 FM_WAKE_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=bin/fm-worker-isolation-lib.sh
 . "$FM_WAKE_LIB_DIR/fm-worker-isolation-lib.sh"
+# shellcheck source=bin/fm-safe-io-lib.sh
+. "$FM_WAKE_LIB_DIR/fm-safe-io-lib.sh"
 if [ "${FM_SESSION_LOCK_BOOTSTRAP:-0}" != 1 ]; then
   fm_worker_refuse_primary_operation "wake state initialization" || exit 1
 fi
@@ -16,7 +19,9 @@ FM_WAKE_QUEUE_LOCK="${FM_WAKE_QUEUE_LOCK:-$STATE/.wake-queue.lock}"
 FM_LOCK_STALE_AFTER="${FM_LOCK_STALE_AFTER:-2}"
 FM_LOCK_LEGACY_IDENTITY_MAX_AGE="${FM_LOCK_LEGACY_IDENTITY_MAX_AGE:-300}"
 FM_LOCK_WAIT_SECS="${FM_LOCK_WAIT_SECS:-30}"
-mkdir -p "$STATE"
+if [ "${FM_WAKE_LIB_NO_INIT:-0}" != 1 ]; then
+  mkdir -p "$STATE"
+fi
 
 fm_current_pid() {
   printf '%s\n' "${BASHPID:-$$}"
@@ -182,7 +187,7 @@ fm_lock_migrate_legacy_identity() {
   [ "$(cat "$owner/pid" 2>/dev/null || true)" = "$pid" ] || return 1
   [ "$(cat "$owner/pid-identity" 2>/dev/null || true)" = "$stored_identity" ] || return 1
   temp="$owner/.pid-identity.migrate.$(fm_current_pid)"
-  printf '%s\n' "$current_identity" > "$temp" || return 1
+  printf '%s\n' "$current_identity" | fm_nofollow_write "$temp" || return 1
   if ! fm_lock_points_to_owner "$lockdir" "$owner" || ! mv -f "$temp" "$owner/pid-identity"; then
     rm -f "$temp" 2>/dev/null || true
     return 1
@@ -246,6 +251,7 @@ fm_lock_clean_known_files() {
     "$lockdir/pid-identity" \
     "$lockdir/watcher-path" \
     "$lockdir/owner-path" \
+    "$lockdir/incarnation" \
     2>/dev/null || true
 }
 
@@ -266,18 +272,23 @@ fm_lock_owner_dir() {
 fm_lock_prepare_owner() {
   local ownerdir=$1 owner_home=${2:-} owner_path=${3:-} mypid back identity start
   mypid=${BASHPID:-$$}
-  printf '%s\n' "$mypid" > "$ownerdir/pid" 2>/dev/null || return 1
+  printf '%s\n' "$mypid" | fm_nofollow_write "$ownerdir/pid" 2>/dev/null || return 1
   back=$(cat "$ownerdir/pid" 2>/dev/null || true)
   [ "$back" = "$mypid" ] || return 1
   identity=$(fm_pid_identity "$mypid" 2>/dev/null || true)
-  [ -z "$identity" ] || printf '%s\n' "$identity" > "$ownerdir/pid-identity"
+  [ -z "$identity" ] || printf '%s\n' "$identity" | fm_nofollow_write "$ownerdir/pid-identity"
   start=$(fm_pid_start "$mypid" 2>/dev/null || true)
-  [ -z "$start" ] || printf '%s\n' "$start" > "$ownerdir/pid-start"
+  [ -z "$start" ] || printf '%s\n' "$start" | fm_nofollow_write "$ownerdir/pid-start"
   if [ -n "$owner_home" ]; then
-    printf '%s\n' "$owner_home" > "$ownerdir/fm-home" || return 1
+    printf '%s\n' "$owner_home" | fm_nofollow_write "$ownerdir/fm-home" || return 1
   fi
   if [ -n "$owner_path" ]; then
-    printf '%s\n' "$owner_path" > "$ownerdir/owner-path" || return 1
+    printf '%s\n' "$owner_path" | fm_nofollow_write "$ownerdir/owner-path" || return 1
+  fi
+  if [ -n "${FM_LOCK_OWNER_INCARNATION:-}" ]; then
+    printf '%s\n' "$FM_LOCK_OWNER_INCARNATION" | fm_nofollow_write "$ownerdir/incarnation" || return 1
+    back=$(cat "$ownerdir/incarnation" 2>/dev/null || true)
+    [ "$back" = "$FM_LOCK_OWNER_INCARNATION" ] || return 1
   fi
 }
 
@@ -332,7 +343,7 @@ fm_lock_claim_blocked_by_steal() {
 fm_lock_claim() {
   local lockdir=$1 ownerdir=$2 allowed_steal_owner=${3:-} mypid back
   mypid=${BASHPID:-$$}
-  if ! { printf '%s\n' "$mypid" > "$ownerdir/pid"; } 2>/dev/null; then
+  if ! { printf '%s\n' "$mypid" | fm_nofollow_write "$ownerdir/pid"; } 2>/dev/null; then
     fm_lock_discard_owner "$ownerdir"
     return 1
   fi
@@ -632,8 +643,194 @@ fm_wake_clean_field() {
   LC_ALL=C tr '\t\r\n' '   '
 }
 
-fm_wake_append() {
+fm_wake_queue_txn_field() {
+  local manifest=$1 wanted=$2
+  fm_nofollow_read "$manifest" | awk -F= -v wanted="$wanted" \
+    '$1 == wanted { print substr($0, index($0, "=") + 1); count++ } END { exit(count == 1 ? 0 : 1) }' \
+    2>/dev/null
+}
+
+fm_wake_queue_txn_manifest_write() {
+  local txn=$1 phase=$2 action=$3 offset=$4 had_queue=$5 had_cursor=$6 tmp
+  tmp=$(mktemp "$txn/.manifest.XXXXXX") || return 1
+  if ! printf 'schema=fm-wake-queue-transaction.v1\nphase=%s\naction=%s\noffset=%s\nhad_queue=%s\nhad_cursor=%s\n' \
+    "$phase" "$action" "$offset" "$had_queue" "$had_cursor" | fm_nofollow_write "$tmp" \
+    || ! fm_nofollow_rename "$tmp" "$txn/manifest"; then
+    rm -f "$tmp"
+    return 1
+  fi
+  return 0
+}
+
+fm_wake_queue_txn_cleanup_locked() {
+  local txn=$1
+  rm -f "$txn/queue.new" "$txn/queue.old" "$txn/cursor.old" "$txn/manifest" "$txn"/.manifest.* || return 1
+  rmdir "$txn" 2>/dev/null
+}
+
+fm_wake_queue_txn_rollback_locked() {
+  local txn=$1 had_queue=$2 had_cursor=$3 cursor status=0
+  cursor=$(fm_wake_queue_cursor_path)
+  if [ -e "$FM_WAKE_QUEUE" ] || [ -L "$FM_WAKE_QUEUE" ]; then
+    [ ! -L "$FM_WAKE_QUEUE" ] || return 1
+    [ -f "$FM_WAKE_QUEUE" ] || return 1
+  fi
+  if [ -e "$cursor" ] || [ -L "$cursor" ]; then
+    [ ! -L "$cursor" ] || return 1
+    [ -f "$cursor" ] || return 1
+  fi
+  if [ -e "$txn/queue.old" ] || [ -L "$txn/queue.old" ]; then
+    [ -f "$txn/queue.old" ] && [ ! -L "$txn/queue.old" ] || return 1
+    rm -f "$FM_WAKE_QUEUE" || return 1
+    fm_nofollow_rename "$txn/queue.old" "$FM_WAKE_QUEUE" || return 1
+  elif [ "$had_queue" = 0 ]; then
+    rm -f "$FM_WAKE_QUEUE" || return 1
+  elif [ ! -e "$FM_WAKE_QUEUE" ]; then
+    return 1
+  fi
+  if [ -e "$txn/cursor.old" ] || [ -L "$txn/cursor.old" ]; then
+    [ -f "$txn/cursor.old" ] && [ ! -L "$txn/cursor.old" ] || return 1
+    rm -f "$cursor" || return 1
+    fm_nofollow_rename "$txn/cursor.old" "$cursor" || return 1
+  elif [ "$had_cursor" = 0 ]; then
+    rm -f "$cursor" || return 1
+  elif [ ! -e "$cursor" ]; then
+    return 1
+  fi
+  if [ -e "$txn/queue.new" ] || [ -L "$txn/queue.new" ]; then
+    [ -f "$txn/queue.new" ] && [ ! -L "$txn/queue.new" ] || return 1
+    rm -f "$txn/queue.new" || status=1
+  fi
+  return "$status"
+}
+
+fm_wake_queue_txn_recover_one_locked() {
+  local txn=$1 manifest="$1/manifest" schema phase action offset had_queue had_cursor
+  [ -f "$manifest" ] && [ ! -L "$manifest" ] || return 1
+  schema=$(fm_wake_queue_txn_field "$manifest" schema) || return 1
+  [ "$schema" = fm-wake-queue-transaction.v1 ] || return 1
+  phase=$(fm_wake_queue_txn_field "$manifest" phase) || return 1
+  action=$(fm_wake_queue_txn_field "$manifest" action) || return 1
+  offset=$(fm_wake_queue_txn_field "$manifest" offset) || return 1
+  had_queue=$(fm_wake_queue_txn_field "$manifest" had_queue) || return 1
+  had_cursor=$(fm_wake_queue_txn_field "$manifest" had_cursor) || return 1
+  case "$phase" in prepared|staged|queue-saved|cursor-saved|queue-installed|rollback|committed) ;; *) return 1 ;; esac
+  case "$action" in write|remove|keep) ;; *) return 1 ;; esac
+  case "$offset" in ''|*[!0-9]*) return 1 ;; esac
+  case "$had_queue" in 0|1) ;; *) return 1 ;; esac
+  case "$had_cursor" in 0|1) ;; *) return 1 ;; esac
+  if [ "$phase" = committed ]; then
+    fm_wake_queue_txn_cleanup_locked "$txn"
+    return $?
+  fi
+  if { [ "$phase" = prepared ] || [ "$phase" = staged ]; } \
+    && [ ! -e "$txn/queue.old" ] && [ ! -e "$txn/cursor.old" ]; then
+    fm_wake_queue_txn_cleanup_locked "$txn"
+    return $?
+  fi
+  fm_wake_queue_txn_rollback_locked "$txn" "$had_queue" "$had_cursor" || return 1
+  fm_wake_queue_txn_cleanup_locked "$txn"
+}
+
+fm_wake_queue_txn_recover_transactions_locked() {
+  local txn
+  for txn in "$STATE"/.wake-queue.txn.*; do
+    [ -e "$txn" ] || continue
+    [ -d "$txn" ] && [ ! -L "$txn" ] || return 1
+    fm_wake_queue_txn_recover_one_locked "$txn" || return 1
+  done
+}
+
+fm_wake_queue_txn_replace_locked() {
+  local replacement=$1 action=$2 offset=${3:-0} txn cursor had_queue=0 had_cursor=0 phase
+  [ -f "$replacement" ] && [ ! -L "$replacement" ] || return 1
+  case "$action" in
+    write) case "$offset" in ''|*[!0-9]*) return 1 ;; esac ;;
+    remove|keep) [ "$offset" = 0 ] || return 1 ;;
+    *) return 1 ;;
+  esac
+  [ ! -L "$FM_WAKE_QUEUE" ] || return 1
+  cursor=$(fm_wake_queue_cursor_path)
+  [ ! -L "$cursor" ] || return 1
+  if [ -e "$FM_WAKE_QUEUE" ]; then
+    [ -f "$FM_WAKE_QUEUE" ] || return 1
+    had_queue=1
+  fi
+  if [ -e "$cursor" ]; then
+    [ -f "$cursor" ] || return 1
+    had_cursor=1
+  fi
+  if [ "$action" = keep ] && [ "$had_cursor" = 1 ]; then
+    return 1
+  fi
+  txn=$(mktemp -d "$STATE/.wake-queue.txn.XXXXXX") || return 1
+  chmod 700 "$txn" || { rmdir "$txn" 2>/dev/null; return 1; }
+  if ! fm_wake_queue_txn_manifest_write "$txn" prepared "$action" "$offset" "$had_queue" "$had_cursor"; then
+    rmdir "$txn" 2>/dev/null
+    return 1
+  fi
+  if ! mv -f "$replacement" "$txn/queue.new"; then
+    fm_wake_queue_txn_cleanup_locked "$txn" || true
+    return 1
+  fi
+  fm_wake_queue_txn_manifest_write "$txn" staged "$action" "$offset" "$had_queue" "$had_cursor" || {
+    rm -f "$txn/queue.new"
+    fm_wake_queue_txn_cleanup_locked "$txn" || true
+    return 1
+  }
+  if [ "$had_queue" = 1 ] && ! fm_nofollow_rename "$FM_WAKE_QUEUE" "$txn/queue.old" 1; then
+    fm_wake_queue_txn_recover_one_locked "$txn" || true
+    return 1
+  fi
+  fm_wake_queue_txn_manifest_write "$txn" queue-saved "$action" "$offset" "$had_queue" "$had_cursor" || {
+    fm_wake_queue_txn_recover_one_locked "$txn" || true
+    return 1
+  }
+  if [ "$had_cursor" = 1 ] && ! fm_nofollow_rename "$cursor" "$txn/cursor.old" 1; then
+    fm_wake_queue_txn_recover_one_locked "$txn" || true
+    return 1
+  fi
+  fm_wake_queue_txn_manifest_write "$txn" cursor-saved "$action" "$offset" "$had_queue" "$had_cursor" || {
+    fm_wake_queue_txn_recover_one_locked "$txn" || true
+    return 1
+  }
+  if ! fm_nofollow_rename "$txn/queue.new" "$FM_WAKE_QUEUE"; then
+    fm_wake_queue_txn_recover_one_locked "$txn" || true
+    return 1
+  fi
+  fm_wake_queue_txn_manifest_write "$txn" queue-installed "$action" "$offset" "$had_queue" "$had_cursor" || {
+    fm_wake_queue_txn_recover_one_locked "$txn" || true
+    return 1
+  }
+  case "$action" in
+    write)
+      fm_wake_queue_cursor_write "$offset" || phase=failed
+      ;;
+    remove)
+      if [ -e "$cursor" ] || [ -L "$cursor" ]; then
+        [ ! -L "$cursor" ] || phase=failed
+        [ "${phase:-}" = failed ] || rm -f "$cursor" || phase=failed
+      fi
+      ;;
+    keep) : ;;
+  esac
+  if [ "${phase:-}" = failed ]; then
+    fm_wake_queue_txn_rollback_locked "$txn" "$had_queue" "$had_cursor" || return 1
+    fm_wake_queue_txn_manifest_write "$txn" rollback "$action" "$offset" "$had_queue" "$had_cursor" || return 1
+    fm_wake_queue_txn_cleanup_locked "$txn" || return 1
+    return 1
+  fi
+  fm_wake_queue_txn_manifest_write "$txn" committed "$action" "$offset" "$had_queue" "$had_cursor" || {
+    fm_wake_queue_txn_rollback_locked "$txn" "$had_queue" "$had_cursor" || return 1
+    return 1
+  }
+  fm_wake_queue_txn_cleanup_locked "$txn" || true
+  return 0
+}
+
+fm_wake_append_locked() {
   local kind=$1 key=$2 payload=$3 clean_key clean_payload epoch seq seq_file status
+  fm_wake_queue_txn_recover_transactions_locked || return 1
   case "$kind" in
     signal|stale|check|heartbeat) ;;
     *) printf 'fm_wake_append: invalid wake kind: %s\n' "$kind" >&2; return 2 ;;
@@ -645,37 +842,434 @@ fm_wake_append() {
   seq_file="$STATE/.wake-queue.seq"
   status=0
 
-  fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK" || {
-    printf 'fm_wake_append: could not serialize the wake queue; refusing to append unlocked\n' >&2
-    return 1
-  }
   seq=$(cat "$seq_file" 2>/dev/null || echo 0)
   case "$seq" in
     ''|*[!0-9]*) seq=0 ;;
   esac
   seq=$((seq + 1))
-  printf '%s\n' "$seq" > "$seq_file" || status=$?
+  printf '%s\n' "$seq" | fm_nofollow_write "$seq_file" || status=$?
   if [ "$status" -eq 0 ]; then
-    printf '%s\t%s\t%s\t%s\t%s\n' "$epoch" "$seq" "$kind" "$clean_key" "$clean_payload" >> "$FM_WAKE_QUEUE" || status=$?
+    printf '%s\t%s\t%s\t%s\t%s\n' "$epoch" "$seq" "$kind" "$clean_key" "$clean_payload" \
+      | fm_nofollow_append "$FM_WAKE_QUEUE" || status=$?
+  fi
+  return "$status"
+}
+
+fm_wake_append() {
+  local status
+  fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK" || {
+    printf 'fm_wake_append: could not serialize the wake queue; refusing to append unlocked\n' >&2
+    return 1
+  }
+  fm_wake_append_locked "$@"
+  status=$?
+  fm_lock_release "$FM_WAKE_QUEUE_LOCK" || status=1
+  return "$status"
+}
+
+fm_wake_queue_key_status_locked() {
+  local queue=$1 key=$2 budget=${FM_WAKE_QUEUE_STATUS_BUDGET_SECS:-1}
+  case "$budget" in ''|*[!0-9]*|0) budget=1 ;; esac
+  command -v perl >/dev/null 2>&1 || return 2
+  perl - "$queue" "$key" "$budget" <<'PERL'
+use strict;
+use warnings;
+use Fcntl qw(:DEFAULT);
+
+my ($path, $wanted, $seconds) = @ARGV;
+$SIG{ALRM} = sub { exit 124 };
+alarm($seconds);
+my $nofollow = eval { O_NOFOLLOW() };
+defined($nofollow) or exit 2;
+sysopen(my $fh, $path, O_RDONLY | $nofollow) or exit 2;
+while (defined(my $line = <$fh>)) {
+  my @fields = split(/\t/, $line, -1);
+  next unless @fields == 5;
+  next unless $fields[0] =~ /\A[0-9]+\z/ && $fields[1] =~ /\A[0-9]+\z/;
+  next unless $fields[2] =~ /\A(?:signal|stale|check|heartbeat)\z/;
+  next unless defined($fields[4]) && $fields[4] ne '';
+  if ($fields[3] eq $wanted) {
+    close($fh) or exit 2;
+    exit 0;
+  }
+}
+$fh->error() and exit 2;
+close($fh) or exit 2;
+exit 1;
+PERL
+  local status=$?
+  case "$status" in
+    0|1) return "$status" ;;
+    *) return 2 ;;
+  esac
+}
+
+fm_wake_append_if_absent_locked() {  # <result-var> <kind> <key> <payload>
+  local result_var=$1 kind=$2 key=$3 payload=$4 status=0
+  FM_WAKE_APPEND_CREATED=0
+  case "$result_var" in ''|*[!A-Za-z0-9_]*) return 2 ;; esac
+  if [ -e "$FM_WAKE_QUEUE" ] || [ -L "$FM_WAKE_QUEUE" ]; then
+    [ -f "$FM_WAKE_QUEUE" ] && [ ! -L "$FM_WAKE_QUEUE" ] || return 1
+    if fm_wake_queue_key_status_locked "$FM_WAKE_QUEUE" "$key"; then
+      printf -v "$result_var" '%s' 0
+      return 0
+    else
+      status=$?
+    fi
+    [ "$status" -eq 1 ] || return "$status"
   fi
-  fm_lock_release "$FM_WAKE_QUEUE_LOCK"
+  fm_wake_append_locked "$kind" "$key" "$payload"
+  status=$?
+  [ "$status" -eq 0 ] && {
+    # shellcheck disable=SC2034 # consumed by fm-inactive-reconcile.sh
+    FM_WAKE_APPEND_CREATED=1
+    printf -v "$result_var" '%s' 1
+  }
+  return "$status"
+}
+
+fm_wake_remove_key_locked() {
+  local key=$1 tmp cursor cursor_offset=0 cursor_active=0 new_offset
+  fm_wake_queue_txn_recover_transactions_locked || return 1
+  [ ! -L "$FM_WAKE_QUEUE" ] || return 1
+  [ -e "$FM_WAKE_QUEUE" ] || return 0
+  [ -f "$FM_WAKE_QUEUE" ] || return 1
+  cursor=$(fm_wake_queue_cursor_path)
+  if [ -e "$cursor" ] || [ -L "$cursor" ]; then
+    fm_wake_queue_cursor_read || return 1
+    cursor_offset=$FM_WAKE_QUEUE_CURSOR_OFFSET
+    cursor_active=1
+  fi
+  tmp=$(mktemp "$STATE/.wake-queue.remove.XXXXXX") || return 1
+  if ! new_offset=$(perl - "$FM_WAKE_QUEUE" "$tmp" "$key" "$cursor_offset" "$cursor_active" <<'PERL'
+use strict;
+use warnings;
+use Fcntl qw(:DEFAULT);
+
+my ($input, $output, $wanted, $cursor_offset, $cursor_active) = @ARGV;
+my $nofollow = eval { O_NOFOLLOW() };
+defined($nofollow) or exit 1;
+sysopen(my $in, $input, O_RDONLY | $nofollow) or exit 1;
+binmode($in);
+sysopen(my $out, $output, O_WRONLY | O_TRUNC | $nofollow) or exit 1;
+binmode($out);
+my $removed_before = 0;
+while (1) {
+  my $start = tell($in);
+  defined($start) or exit 1;
+  my $line = <$in>;
+  last unless defined $line;
+  my $end = tell($in);
+  defined($end) or exit 1;
+  my @fields = split(/\t/, $line, -1);
+  if (defined($fields[3]) && $fields[3] eq $wanted) {
+    $removed_before += $end - $start if $cursor_active && $start < $cursor_offset;
+    next;
+  }
+  print $out $line or exit 1;
+}
+close($in) or exit 1;
+close($out) or exit 1;
+print $cursor_offset - $removed_before if $cursor_active;
+PERL
+  ); then
+    rm -f "$tmp"
+    return 1
+  fi
+  if [ "$cursor_active" = 1 ]; then
+    case "$new_offset" in ''|*[!0-9]*) rm -f "$tmp"; return 1 ;; esac
+  fi
+  [ ! -L "$FM_WAKE_QUEUE" ] || { rm -f "$tmp"; return 1; }
+  if [ "$cursor_active" = 1 ]; then
+    fm_wake_queue_txn_replace_locked "$tmp" write "$new_offset" || { rm -f "$tmp"; return 1; }
+  else
+    fm_wake_queue_txn_replace_locked "$tmp" keep 0 || { rm -f "$tmp"; return 1; }
+  fi
+}
+
+fm_wake_append_if_absent() {  # <result-var> <kind> <key> <payload>
+  local status=0
+  fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK" || {
+    printf 'fm_wake_append_if_absent: could not serialize the wake queue; refusing to append unlocked\n' >&2
+    return 1
+  }
+  fm_wake_append_if_absent_locked "$@" || status=$?
+  fm_lock_release "$FM_WAKE_QUEUE_LOCK" || status=1
   return "$status"
 }
 
 fm_wake_restore_queue() {
-  local drained=$1 restore
-  restore="$STATE/.wake-queue.restore.$(fm_current_pid)"
-  if [ -e "$FM_WAKE_QUEUE" ]; then
-    cat "$drained" "$FM_WAKE_QUEUE" > "$restore" && mv "$restore" "$FM_WAKE_QUEUE"
+  local drained=$1 restore status=0
+  [ -f "$drained" ] && [ ! -L "$drained" ] || return 1
+  fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK" || return 1
+  fm_wake_queue_txn_recover_transactions_locked || status=1
+  if [ "$status" = 0 ]; then
+    [ ! -L "$FM_WAKE_QUEUE" ] || status=1
+    restore=$(mktemp "$STATE/.wake-queue.restore.XXXXXX") || status=1
+    if [ "$status" = 0 ] && [ -e "$FM_WAKE_QUEUE" ]; then
+      [ -f "$FM_WAKE_QUEUE" ] && [ ! -L "$FM_WAKE_QUEUE" ] || status=1
+      [ "$status" -ne 0 ] || cat "$drained" "$FM_WAKE_QUEUE" | fm_nofollow_write "$restore" || status=1
+    elif [ "$status" = 0 ]; then
+      cat "$drained" | fm_nofollow_write "$restore" || status=1
+    fi
+    [ "$status" -ne 0 ] || fm_wake_queue_txn_replace_locked "$restore" remove 0 || status=1
+  fi
+  [ "$status" -eq 0 ] || rm -f "$restore"
+  fm_lock_release "$FM_WAKE_QUEUE_LOCK" || status=1
+  return "$status"
+}
+
+fm_wake_queue_signature() {
+  local queue=$1
+  if [ ! -e "$queue" ]; then
+    printf 'missing'
+    return 0
+  fi
+  [ -f "$queue" ] && [ ! -L "$queue" ] || return 1
+  if [ "$(uname)" = Darwin ]; then
+    stat -f '%d:%i:%z:%m' "$queue" 2>/dev/null
+  else
+    stat -c '%d:%i:%s:%Y:%y' "$queue" 2>/dev/null
+  fi
+}
+
+fm_wake_queue_cursor_path() {
+  printf '%s.cursor' "$FM_WAKE_QUEUE"
+}
+
+fm_wake_queue_identity() {
+  local queue=$1
+  [ -f "$queue" ] && [ ! -L "$queue" ] || return 1
+  if [ "$(uname)" = Darwin ]; then
+    stat -f '%d:%i:%z' "$queue" 2>/dev/null
   else
-    mv "$drained" "$FM_WAKE_QUEUE"
+    stat -c '%d:%i:%s' "$queue" 2>/dev/null
+  fi
+}
+
+fm_wake_queue_cursor_write() {
+  local offset=$1 cursor identity tmp
+  case "$offset" in ''|*[!0-9]*) return 1 ;; esac
+  identity=$(fm_wake_queue_identity "$FM_WAKE_QUEUE") || return 1
+  cursor=$(fm_wake_queue_cursor_path)
+  [ ! -L "$cursor" ] || return 1
+  tmp=$(mktemp "$cursor.XXXXXX") || return 1
+  if ! printf 'schema=fm-wake-queue-cursor.v1\nidentity=%s\noffset=%s\n' \
+    "$identity" "$offset" | fm_nofollow_write "$tmp" || ! fm_nofollow_rename "$tmp" "$cursor"; then
+    rm -f "$tmp"
+    return 1
+  fi
+}
+
+fm_wake_queue_cursor_read() {
+  local cursor identity current offset schema_count identity_count cursor_data
+  cursor=$(fm_wake_queue_cursor_path)
+  [ -f "$cursor" ] && [ ! -L "$cursor" ] || return 1
+  cursor_data=$(fm_nofollow_read "$cursor") || return 1
+  schema_count=$(printf '%s\n' "$cursor_data" | awk -F= '$1 == "schema" { print $2; n++ } END { exit(n == 1 ? 0 : 1) }') || return 1
+  [ "$schema_count" = fm-wake-queue-cursor.v1 ] || return 1
+  identity_count=$(printf '%s\n' "$cursor_data" | awk -F= '$1 == "identity" { print substr($0, index($0, "=") + 1); n++ } END { exit(n == 1 ? 0 : 1) }') || return 1
+  offset=$(printf '%s\n' "$cursor_data" | awk -F= '$1 == "offset" { print $2; n++ } END { exit(n == 1 ? 0 : 1) }') || return 1
+  case "$offset" in ''|*[!0-9]*) return 1 ;; esac
+  case "$identity_count" in *:*:*) ;; *) return 1 ;; esac
+  current=$(fm_wake_queue_identity "$FM_WAKE_QUEUE") || return 1
+  [ "${current%%:*}" = "${identity_count%%:*}" ] || return 1
+  current=${current#*:}; identity_count=${identity_count#*:}
+  [ "${current%%:*}" = "${identity_count%%:*}" ] || return 1
+  current=${current#*:}
+  [ "$offset" -le "$current" ] || return 1
+  if [ "$offset" -gt 0 ]; then
+    perl - "$FM_WAKE_QUEUE" "$offset" <<'PERL' || return 1
+use strict;
+use warnings;
+use Fcntl qw(:DEFAULT);
+my ($path, $offset) = @ARGV;
+my $nofollow = eval { O_NOFOLLOW() };
+defined($nofollow) or exit 1;
+sysopen(my $fh, $path, O_RDONLY | $nofollow) or exit 1;
+binmode($fh);
+seek($fh, $offset - 1, 0) or exit 1;
+my $byte = getc($fh);
+close($fh) or exit 1;
+exit(defined($byte) && $byte eq "\n" ? 0 : 1);
+PERL
+  fi
+  FM_WAKE_QUEUE_CURSOR_OFFSET=$offset
+}
+
+fm_wake_queue_stream_from_offset() {
+  local queue=$1 offset=$2
+  case "$offset" in ''|*[!0-9]*) return 1 ;; esac
+  perl - "$queue" "$offset" <<'PERL'
+use strict;
+use warnings;
+use Fcntl qw(:DEFAULT);
+my ($path, $offset) = @ARGV;
+my $nofollow = eval { O_NOFOLLOW() };
+defined($nofollow) or exit 1;
+sysopen(my $fh, $path, O_RDONLY | $nofollow) or exit 1;
+binmode($fh);
+seek($fh, $offset, 0) or exit 1;
+while (defined(my $line = <$fh>)) {
+  print $line or exit 1;
+}
+close($fh) or exit 1;
+PERL
+}
+
+fm_wake_queue_offset_valid() {
+  local queue=$1 offset=$2
+  [ -f "$queue" ] && [ ! -L "$queue" ] || return 1
+  case "$offset" in ''|*[!0-9]*) return 1 ;; esac
+  perl - "$queue" "$offset" <<'PERL'
+use strict;
+use warnings;
+use Fcntl qw(:DEFAULT);
+my ($path, $offset) = @ARGV;
+my $nofollow = eval { O_NOFOLLOW() };
+defined($nofollow) or exit 1;
+sysopen(my $fh, $path, O_RDONLY | $nofollow) or exit 1;
+binmode($fh);
+seek($fh, 0, 2) or exit 1;
+my $size = tell($fh);
+defined($size) && $offset <= $size or exit 1;
+if ($offset > 0) {
+  seek($fh, $offset - 1, 0) or exit 1;
+  my $byte = getc($fh);
+  defined($byte) && $byte eq "\n" or exit 1;
+}
+close($fh) or exit 1;
+PERL
+}
+
+fm_wake_queue_offset_after_rows() {
+  local queue=$1 offset=$2 rows=$3
+  case "$offset" in ''|*[!0-9]*) return 1 ;; esac
+  case "$rows" in ''|*[!0-9]*) return 1 ;; esac
+  perl - "$queue" "$offset" "$rows" <<'PERL'
+use strict;
+use warnings;
+use Fcntl qw(:DEFAULT);
+my ($path, $offset, $rows) = @ARGV;
+my $nofollow = eval { O_NOFOLLOW() };
+defined($nofollow) or exit 1;
+sysopen(my $fh, $path, O_RDONLY | $nofollow) or exit 1;
+binmode($fh);
+seek($fh, $offset, 0) or exit 1;
+my $next = $offset;
+for (1 .. $rows) {
+  my $line = <$fh>;
+  last unless defined $line;
+  $next = tell($fh);
+  defined($next) or exit 1;
+}
+print $next;
+close($fh) or exit 1;
+PERL
+}
+
+fm_wake_install_queue_cursor_atomic() {
+  local drained=$1 offset=$2 restore expected current status=0
+  [ -f "$drained" ] && [ ! -L "$drained" ] || return 1
+  case "$offset" in ''|*[!0-9]*) return 1 ;; esac
+  for _ in 1 2 3 4 5 6 7 8; do
+    status=0
+    expected=$(fm_wake_queue_signature "$FM_WAKE_QUEUE") || return 1
+    restore=$(mktemp "$STATE/.wake-queue.cursor-install.XXXXXX") || return 1
+    if [ -e "$FM_WAKE_QUEUE" ]; then
+      if [ -f "$FM_WAKE_QUEUE" ] && [ ! -L "$FM_WAKE_QUEUE" ]; then
+        cat "$drained" "$FM_WAKE_QUEUE" | fm_nofollow_write "$restore" || status=1
+      else
+        status=1
+      fi
+    else
+      cat "$drained" | fm_nofollow_write "$restore" || status=1
+    fi
+    if [ "${status:-0}" -ne 0 ]; then
+      rm -f "$restore"
+      return 1
+    fi
+    fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK" || { rm -f "$restore"; return 1; }
+    fm_wake_queue_txn_recover_transactions_locked || status=1
+    current=$(fm_wake_queue_signature "$FM_WAKE_QUEUE") || status=1
+    if [ "${status:-0}" -eq 0 ] && [ "$current" = "$expected" ] \
+      && [ ! -L "$FM_WAKE_QUEUE" ]; then
+      fm_wake_queue_txn_replace_locked "$restore" write "$offset" || status=1
+      fm_lock_release "$FM_WAKE_QUEUE_LOCK" || status=1
+      [ "$status" -eq 0 ] && return 0
+      return 1
+    fi
+    fm_lock_release "$FM_WAKE_QUEUE_LOCK" || true
+    rm -f "$restore"
+    status=0
+  done
+  return 1
+}
+
+fm_wake_restore_queue_atomic() {
+  local drained=$1 restore expected current status=0
+  [ -f "$drained" ] && [ ! -L "$drained" ] || return 1
+  for _ in 1 2 3 4 5 6 7 8; do
+    expected=$(fm_wake_queue_signature "$FM_WAKE_QUEUE") || return 1
+    restore=$(mktemp "$STATE/.wake-queue.restore.XXXXXX") || return 1
+    [ -f "$restore" ] && [ ! -L "$restore" ] || { rm -f "$restore"; return 1; }
+    if [ -e "$FM_WAKE_QUEUE" ]; then
+      [ -f "$FM_WAKE_QUEUE" ] || { rm -f "$restore"; return 1; }
+      cat "$drained" "$FM_WAKE_QUEUE" | fm_nofollow_write "$restore" || status=1
+    else
+      cat "$drained" | fm_nofollow_write "$restore" || status=1
+    fi
+    if [ "$status" -ne 0 ]; then
+      rm -f "$restore"
+      return 1
+    fi
+    fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK" || { rm -f "$restore"; return 1; }
+    fm_wake_queue_txn_recover_transactions_locked || status=1
+    current=$(fm_wake_queue_signature "$FM_WAKE_QUEUE") || status=1
+    if [ "$status" -eq 0 ] && [ "$current" = "$expected" ] \
+      && [ ! -L "$FM_WAKE_QUEUE" ]; then
+      fm_wake_queue_txn_replace_locked "$restore" remove 0 || status=1
+      [ "$status" -ne 0 ] && { fm_lock_release "$FM_WAKE_QUEUE_LOCK" || true; return 1; }
+      fm_lock_release "$FM_WAKE_QUEUE_LOCK" || return 1
+      return 0
+    fi
+    fm_lock_release "$FM_WAKE_QUEUE_LOCK" || true
+    rm -f "$restore"
+    status=0
+  done
+  return 1
+}
+
+fm_wake_surface_consumed_path() {
+  printf '%s/.hb-surface-consumed-%s' "$STATE" "$(printf '%s' "$1" | tr ':/.' '___')"
+}
+
+fm_wake_mark_surface_consumed() {
+  local key=$1 retry marker tmp retry_key published snapshot spawn_incarnation
+  retry="$STATE/.hb-surface-retry-$(printf '%s' "$key" | tr ':/.' '___')"
+  [ -e "$retry" ] || return 0
+  [ -f "$retry" ] && [ ! -L "$retry" ] || return 1
+  retry_key=$(awk -F= -v wanted=wake_key '$1 == wanted { print substr($0, index($0, "=") + 1); count++ } END { exit(count == 1 ? 0 : 1) }' "$retry" 2>/dev/null) || return 1
+  [ "$retry_key" = "$key" ] || return 0
+  published=$(awk -F= -v wanted=wake_published '$1 == wanted { print substr($0, index($0, "=") + 1); count++ } END { exit(count == 1 ? 0 : 1) }' "$retry" 2>/dev/null) || return 1
+  [ "$published" = 2 ] || return 0
+  snapshot=$(awk -F= -v wanted=snapshot '$1 == wanted { print substr($0, index($0, "=") + 1); count++ } END { exit(count == 1 ? 0 : 1) }' "$retry" 2>/dev/null) || return 1
+  spawn_incarnation=$(awk -F= -v wanted=spawn_incarnation '$1 == wanted { print substr($0, index($0, "=") + 1); count++ } END { exit(count == 1 ? 0 : 1) }' "$retry" 2>/dev/null) || return 1
+  marker=$(fm_wake_surface_consumed_path "$key")
+  tmp=$(mktemp "$STATE/.hb-surface-consumed.XXXXXX") || return 1
+  if ! printf 'schema=fm-hb-surface-consumed.v1\ntask=%s\nwake_key=%s\nsnapshot=%s\nspawn_incarnation=%s\n' \
+    "$key" "$key" "$snapshot" "$spawn_incarnation" | fm_nofollow_write "$tmp" \
+    || ! fm_nofollow_rename "$tmp" "$marker"; then
+    rm -f "$tmp"
+    return 1
   fi
 }
 
 fm_wake_print_deduped() {
   local file=$1
   awk -F '\t' '
-    NF >= 5 {
+    NF == 5 && $1 ~ /^[0-9]+$/ && $2 ~ /^[0-9]+$/ &&
+    $3 ~ /^(signal|stale|check|heartbeat)$/ && $5 != "" {
       dedupe = $3 SUBSEP $4
       if ($3 == "heartbeat") {
         dedupe = "heartbeat"
diff --git a/bin/fm-watch.sh b/bin/fm-watch.sh
index 6251a5a2724..055a1a01afa 100755
--- a/bin/fm-watch.sh
+++ b/bin/fm-watch.sh
@@ -28,6 +28,7 @@
 # duplicate invocations of this script still no-op through the watcher singleton
 # lock.
 set -u
+set -o pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=bin/fm-worker-isolation-lib.sh
@@ -49,6 +50,8 @@ mkdir -p "$STATE"
 # capture plus the existing hash/busy checks. Keep the wake policy unchanged.
 # shellcheck source=bin/fm-backend.sh
 . "$SCRIPT_DIR/fm-backend.sh"
+# shellcheck source=bin/fm-pane-idle-lib.sh
+. "$SCRIPT_DIR/fm-pane-idle-lib.sh"
 # shellcheck source=bin/fm-watch-events-lib.sh
 . "$SCRIPT_DIR/fm-watch-events-lib.sh"
 # shellcheck source=bin/fm-pr-lib.sh
@@ -68,6 +71,9 @@ mkdir -p "$STATE"
 WATCH_LOCK="$STATE/.watch.lock"
 WATCH_PATH="$SCRIPT_DIR/fm-watch.sh"
 WATCHER_STALE_GRACE=${FM_WATCHER_STALE_GRACE:-${FM_GUARD_GRACE:-300}}
+WATCH_TASK_LOCK=
+WATCH_TASK_LOCK_OWNER=
+WATCH_TASK_LOCK_HELD=0
 
 # Portable stat. macOS (BSD) stat uses `-f <fmt>`; Linux (GNU) stat uses `-c <fmt>`.
 # Do NOT use the `stat -f <fmt> ... || stat -c <fmt> ...` fallback form: on Linux
@@ -92,6 +98,10 @@ CHECK_TIMEOUT=${FM_CHECK_TIMEOUT:-30}     # seconds allowed per *.check.sh
 SIGNAL_GRACE=${FM_SIGNAL_GRACE:-30}   # seconds to linger after a signal so trailing
                                       # signals (a status write, then the same turn's
                                       # turn-end hook) coalesce into one wake
+PANE_IDLE_INDEX_BUDGET_SECS=$(positive_seconds_or_default \
+  "${FM_PANE_IDLE_INDEX_BUDGET_SECS:-1}" 1)
+WAKE_QUEUE_STATUS_BUDGET_SECS=$(positive_seconds_or_default \
+  "${FM_WAKE_QUEUE_STATUS_BUDGET_SECS:-1}" 1)
 # Busy signatures per harness, OR-ed. Extend via env when new adapters are verified.
 # claude/codex: "esc to interrupt"; opencode: "esc interrupt"; pi: "Working...";
 # grok: "Ctrl+c:cancel" (the mid-turn cancel hint in grok's keybind bar, shown iff a
@@ -152,7 +162,7 @@ pause_marker_record_status() {  # <status-file>
   key=$(pause_key "$win")
   marker="$STATE/.paused-$key"
   if ! grep -qE '^[0-9]+$' "$marker" 2>/dev/null; then
-    date +%s > "$marker"
+    date +%s | fm_nofollow_write "$marker"
   fi
 }
 
@@ -197,7 +207,7 @@ pause_state_class() {  # <window> <task>
   class=$(crew_absorb_class "$task")
   case "$class" in
     paused)
-      date +%s > "$recheck"
+      date +%s | fm_nofollow_write "$recheck"
       printf 'paused'
       ;;
     *)
@@ -216,10 +226,10 @@ handle_paused_stale() {  # <window> <task> <hash>
   local win=$1 task=$2 h=$3 key marker resurfaced now age resurfaced_age reason
   key=$(pause_key "$win")
   marker="$STATE/.paused-$key"
-  printf '%s' "$h" > "$STATE/.stale-$key"
+  printf '%s' "$h" | fm_nofollow_write "$STATE/.stale-$key"
   rm -f "$STATE/.stale-since-$key"
   if ! grep -qE '^[0-9]+$' "$marker" 2>/dev/null; then
-    date +%s > "$marker"
+    date +%s | fm_nofollow_write "$marker"
   fi
   now=$(date +%s)
   marker_epoch=$(cat "$marker" 2>/dev/null || true)
@@ -233,8 +243,8 @@ handle_paused_stale() {  # <window> <task> <hash>
   if [ "$age" -ge "$PAUSE_RESURFACE_SECS" ] && [ "$resurfaced_age" -ge "$PAUSE_RESURFACE_SECS" ]; then
     reason="stale: $win (paused ${age}s, awaiting external; recheck the declared wait)"
     fm_wake_append stale "$win" "$reason" || exit 1
-    printf '%s' "$now" > "$resurfaced"
-    printf '%s' "$now" > "$marker"
+    printf '%s' "$now" | fm_nofollow_write "$resurfaced"
+    printf '%s' "$now" | fm_nofollow_write "$marker"
     wake "$reason"
   fi
   triage_log "absorbed stale (paused, awaiting external, age ${age}s): $win"
@@ -246,41 +256,152 @@ handle_paused_stale() {  # <window> <task> <hash>
 # a logging hiccup never affects supervision.
 triage_log() {
   local sz
-  printf '[%s] %s\n' "$(date '+%Y-%m-%dT%H:%M:%S%z')" "$1" >> "$TRIAGE_LOG" 2>/dev/null || return 0
+  printf '[%s] %s\n' "$(date '+%Y-%m-%dT%H:%M:%S%z')" "$1" | fm_nofollow_append "$TRIAGE_LOG" 2>/dev/null || return 0
   sz=$(wc -c < "$TRIAGE_LOG" 2>/dev/null | tr -d '[:space:]')
   case "$sz" in ''|*[!0-9]*) return 0 ;; esac
   if [ "$sz" -ge "$TRIAGE_LOG_MAX_BYTES" ]; then
-    tail -n 2000 "$TRIAGE_LOG" > "$TRIAGE_LOG.tmp" 2>/dev/null && mv -f "$TRIAGE_LOG.tmp" "$TRIAGE_LOG" 2>/dev/null
+    tail -n 2000 "$TRIAGE_LOG" 2>/dev/null | fm_nofollow_write "$TRIAGE_LOG.tmp" && fm_nofollow_rename "$TRIAGE_LOG.tmp" "$TRIAGE_LOG" 2>/dev/null
     rm -f "$TRIAGE_LOG.tmp" 2>/dev/null || true
   fi
 }
 
 hash_pane() {
-  if command -v md5 >/dev/null 2>&1; then md5 -q; else md5sum | cut -d' ' -f1; fi
+  fm_pane_idle_hash
+}
+
+meta_value_count() {
+  local meta=$1 key=$2 count rc
+  count=$(grep -c "^$key=" "$meta" 2>/dev/null) || {
+    rc=$?
+    [ "$rc" = 1 ] || return 1
+    count=0
+  }
+  printf '%s' "$count"
+}
+
+window_meta_matches() {
+  local w=$1 meta=$2 current
+  [ -f "$meta" ] && [ ! -L "$meta" ] || return 1
+  current=$(fm_pane_idle_meta_value_unique "$meta" window 2>/dev/null) || return 1
+  [ "$current" = "$w" ]
 }
 
 window_kind() {
-  local w=$1 meta mw kind
-  for meta in "$STATE"/*.meta; do
-    [ -e "$meta" ] || continue
-    mw=$(grep '^window=' "$meta" | cut -d= -f2- || true)
-    [ "$mw" = "$w" ] || continue
-    kind=$(grep '^kind=' "$meta" | cut -d= -f2- || true)
-    [ -n "$kind" ] || kind=ship
-    echo "$kind"
+  local w=$1 deadline_ms=${2:-} meta_hint=${3:-} meta mw kind kind_count
+  if [ -n "$meta_hint" ]; then
+    meta=$meta_hint
+    window_meta_matches "$w" "$meta" || return 1
+  elif [ -n "$deadline_ms" ]; then
+    if [ "${FM_PANE_IDLE_META_INDEX_BUILT:-0}" = 1 ]; then
+      meta=$(fm_pane_idle_meta_for_window_bounded "$STATE" "$w" "$deadline_ms" 2>/dev/null) || return 1
+    else
+      meta=$(fm_pane_idle_meta_for_window_direct "$STATE" "$w" "$deadline_ms" 2>/dev/null) || return 1
+    fi
+    if [ -z "$meta" ]; then
+      return 1
+    fi
+  else
+    for meta in "$STATE"/*.meta; do
+      [ -e "$meta" ] || continue
+      [ -f "$meta" ] && [ ! -L "$meta" ] || return 1
+      window_count=$(meta_value_count "$meta" window) || return 1
+      case "$window_count" in
+        0) continue ;;
+        1) mw=$(fm_pane_idle_meta_value_unique "$meta" window 2>/dev/null) || return 1 ;;
+        *) return 3 ;;
+      esac
+      [ "$mw" = "$w" ] || continue
+      kind_count=$(meta_value_count "$meta" kind) || return 1
+      case "$kind_count" in
+        0) kind=ship ;;
+        1) kind=$(fm_pane_idle_meta_value_unique "$meta" kind 2>/dev/null) || return 1 ;;
+        *) return 3 ;;
+      esac
+      case "$kind" in
+        ship|scout|secondmate) echo "$kind"; return 0 ;;
+        *) return 3 ;;
+      esac
+    done
+    echo unknown
     return 0
-  done
-  echo unknown
+  fi
+  [ -f "$meta" ] && [ ! -L "$meta" ] || return 1
+  kind_count=$(meta_value_count "$meta" kind) || return 1
+  case "$kind_count" in
+    0) printf 'ship\n'; return 0 ;;
+    1)
+      kind=$(fm_pane_idle_meta_value_unique "$meta" kind 2>/dev/null) || return 1
+      case "$kind" in
+        ship|scout|secondmate) printf '%s\n' "$kind"; return 0 ;;
+        *) return 3 ;;
+      esac
+      ;;
+    *) return 3 ;;
+  esac
+}
+
+window_backend_from_meta() {
+  local meta=$1 backend_count backend session window session_count window_count
+  [ -f "$meta" ] && [ ! -L "$meta" ] || return 1
+  backend_count=$(meta_value_count "$meta" backend) || return 1
+  case "$backend_count" in
+    0) printf 'tmux'; return 0 ;;
+    1) backend=$(fm_pane_idle_meta_value_unique "$meta" backend 2>/dev/null) || return 1 ;;
+    *) return 3 ;;
+  esac
+  case "$backend" in
+    tmux) printf '%s' "$backend" ;;
+    herdr)
+      session_count=$(meta_value_count "$meta" herdr_session) || return 1
+      [ "$session_count" = 1 ] || return 3
+      session=$(fm_pane_idle_meta_value_unique "$meta" herdr_session 2>/dev/null) || return 1
+      [ "$session" = firstmate ] || return 3
+      window_count=$(meta_value_count "$meta" window) || return 1
+      [ "$window_count" = 1 ] || return 3
+      window=$(fm_pane_idle_meta_value_unique "$meta" window 2>/dev/null) || return 1
+      case "$window" in firstmate:*) printf '%s' "$backend" ;; *) return 3 ;; esac
+      ;;
+    *) return 3 ;;
+  esac
 }
 
 window_backend() {  # <window>
-  local w=$1 meta
+  local w=$1 deadline_ms=${2:-} meta_hint=${3:-} meta
+  if [ -n "$meta_hint" ]; then
+    meta=$meta_hint
+    window_meta_matches "$w" "$meta" || return 1
+    window_backend_from_meta "$meta"
+    return $?
+  elif [ -n "$deadline_ms" ]; then
+    if [ "${FM_PANE_IDLE_META_INDEX_BUILT:-0}" = 1 ]; then
+      meta=$(fm_pane_idle_meta_for_window_bounded "$STATE" "$w" "$deadline_ms" 2>/dev/null) || return 1
+    else
+      meta=$(fm_pane_idle_meta_for_window_direct "$STATE" "$w" "$deadline_ms" 2>/dev/null) || return 1
+    fi
+    if [ -z "$meta" ]; then
+      return 1
+    fi
+    window_backend_from_meta "$meta"
+    return $?
+  fi
   meta=$(fm_backend_meta_for_window "$w" "$STATE" 2>/dev/null || true)
-  [ -n "$meta" ] && fm_backend_of_meta "$meta" || printf 'tmux'
+  [ -n "$meta" ] || return 1
+  window_backend_from_meta "$meta"
 }
 
 recorded_windows() {
-  local meta w seen=
+  local deadline_ms=${1:-} meta w seen=
+  if [ -n "$deadline_ms" ]; then
+    if [ "${FM_PANE_IDLE_META_INDEX_BUILT:-0}" = 1 ] \
+      && [ -f "${FM_PANE_IDLE_META_INDEX_SNAPSHOT:-}" ] \
+      && [ ! -L "${FM_PANE_IDLE_META_INDEX_SNAPSHOT:-}" ]; then
+      fm_pane_idle_meta_index_windows_from_snapshot \
+        "$FM_PANE_IDLE_META_INDEX_SNAPSHOT" "$deadline_ms"
+    else
+      return 124
+    fi
+    return $?
+  fi
   for meta in "$STATE"/*.meta; do
     [ -e "$meta" ] || continue
     w=$(grep '^window=' "$meta" | cut -d= -f2- || true)
@@ -293,12 +414,109 @@ recorded_windows() {
   done
 }
 
+watch_window_scan_prepare() {
+  local source=$1 cursor_path="$STATE/.watch-window.cursor" source_path="$STATE/.watch-window.source"
+  local current tmp
+  [ ! -L "$cursor_path" ] && [ ! -L "$source_path" ] || return 1
+  current=$(cat "$source_path" 2>/dev/null || true)
+  if [ "$current" != "$source" ]; then
+    rm -f "$cursor_path" || return 1
+    tmp=$(mktemp "$source_path.XXXXXX") || return 1
+    [ -f "$tmp" ] && [ ! -L "$tmp" ] || { rm -f "$tmp"; return 1; }
+    if ! printf '%s\n' "$source" | fm_nofollow_write "$tmp" || [ -L "$source_path" ] \
+      || ! fm_nofollow_rename "$tmp" "$source_path"; then
+      rm -f "$tmp"
+      return 1
+    fi
+  fi
+  FM_WATCH_WINDOW_CURSOR=$(cat "$cursor_path" 2>/dev/null || true)
+  if [ "$FM_WATCH_WINDOW_CURSOR" = EOF ]; then
+    rm -f "$cursor_path" || return 1
+    FM_WATCH_WINDOW_CURSOR=
+  fi
+  case "$FM_WATCH_WINDOW_CURSOR" in
+    ''|*[!0-9]*)
+      if [ -n "$FM_WATCH_WINDOW_CURSOR" ]; then
+        rm -f "$cursor_path" || return 1
+      fi
+      FM_WATCH_WINDOW_CURSOR=
+      ;;
+  esac
+}
+
+watch_window_scan_advance() {
+  local cursor=$1
+  case "$cursor" in ''|*$'\r'*|*$'\n'*|*$'\t'*) return 1 ;; esac
+  fm_pane_idle_meta_index_cursor_write "$STATE/.watch-window.cursor" "$cursor" || return 1
+  FM_WATCH_WINDOW_CURSOR=$cursor
+}
+
 event_wait_herdr() {
   local timeout=$1 w backend session first_session='' record rc=0 pane_id to agent window meta task reason
+  local event_scan_deadline windows_tmp windows_status=0 event_cursor event_source
+  local event_cursor_path="$STATE/.herdr-window.cursor" event_source_path="$STATE/.herdr-window.source"
+  local event_window_cursor event_meta
   local -a windows=()
-  while IFS= read -r w; do
-    [ -n "$w" ] || continue
-    backend=$(window_backend "$w")
+  event_scan_deadline=$(( $(fm_pane_idle_now_ms) + PANE_IDLE_INDEX_BUDGET_SECS * 1000 ))
+  [ "${FM_PANE_IDLE_META_INDEX_BUILT:-0}" = 1 ] \
+    && [ -f "${FM_PANE_IDLE_META_INDEX_SNAPSHOT:-}" ] \
+    && [ ! -L "${FM_PANE_IDLE_META_INDEX_SNAPSHOT:-}" ] || return 2
+  event_source="snapshot:${FM_PANE_IDLE_META_INDEX_STATE_STAMP}"
+  [ ! -L "$event_cursor_path" ] && [ ! -L "$event_source_path" ] || return 2
+  event_cursor=$(cat "$event_source_path" 2>/dev/null || true)
+  if [ "$event_cursor" != "$event_source" ]; then
+    rm -f "$event_cursor_path" || return 2
+    fm_pane_idle_meta_index_cursor_write "$event_source_path" "$event_source" || return 2
+  fi
+  event_window_cursor=$(cat "$event_cursor_path" 2>/dev/null || true)
+  if [ "$event_window_cursor" = EOF ]; then
+    rm -f "$event_cursor_path" || return 2
+    event_window_cursor=0
+  fi
+  case "$event_window_cursor" in ''|*[!0-9]*) event_window_cursor=0 ;; esac
+  windows_tmp=$(mktemp "$STATE/.herdr-windows.XXXXXX") || return 2
+  [ -f "$windows_tmp" ] && [ ! -L "$windows_tmp" ] || { rm -f "$windows_tmp"; return 2; }
+  fm_pane_idle_meta_index_windows_from_snapshot_resumable \
+    "$FM_PANE_IDLE_META_INDEX_SNAPSHOT" "$event_window_cursor" \
+    "$event_scan_deadline" | fm_nofollow_write "$windows_tmp" || windows_status=$?
+  case "$windows_status" in
+    0) ;;
+    124) ;;
+    *) rm -f "$windows_tmp"; return 1 ;;
+  esac
+  while IFS= read -r -d '' event_window_cursor \
+    && IFS= read -r -d '' w \
+    && IFS= read -r -d '' event_meta; do
+    [ "$(fm_pane_idle_now_ms)" -lt "$event_scan_deadline" ] || {
+      rm -f "$windows_tmp"
+      return 2
+    }
+    if [ -z "$w" ]; then
+      fm_pane_idle_meta_index_cursor_write "$event_cursor_path" "$event_window_cursor" || {
+        rm -f "$windows_tmp"
+        return 2
+      }
+      continue
+    fi
+    backend_status=0
+    backend=$(window_backend "$w" "$event_scan_deadline" "$event_meta") || backend_status=$?
+    case "$backend_status" in
+      0) ;;
+      3)
+        fm_pane_idle_meta_index_cursor_write "$event_cursor_path" "$event_window_cursor" || {
+          rm -f "$windows_tmp"
+          return 2
+        }
+        continue
+        ;;
+      *)
+        continue
+        ;;
+    esac
+    fm_pane_idle_meta_index_cursor_write "$event_cursor_path" "$event_window_cursor" || {
+      rm -f "$windows_tmp"
+      return 2
+    }
     [ "$backend" = herdr ] || continue
     session=${w%%:*}
     [ -n "$session" ] && [ "$session" != "$w" ] || continue
@@ -307,7 +525,11 @@ event_wait_herdr() {
     fi
     [ "$session" = "$first_session" ] || continue
     windows+=("$w")
-  done < <(recorded_windows)
+  done < "$windows_tmp"
+  rm -f "$windows_tmp" || return 2
+  if [ "$windows_status" = 0 ]; then
+    fm_pane_idle_meta_index_cursor_write "$event_cursor_path" EOF || return 2
+  fi
   [ "${#windows[@]}" -gt 0 ] || return 2
   fm_watch_herdr_events_capable "$first_session" || return 2
 
@@ -339,11 +561,24 @@ event_wait_herdr() {
 # mean an idle fleet, so the heartbeat interval backs off exponentially
 # (base * 2^streak, capped at HEARTBEAT_MAX); any real wake resets the cadence.
 wake() {
+  local wake_output=$1 row _epoch _seq _kind _key _payload confirm_status
   case "$1" in
-    heartbeat*) echo $(( $(cat "$STATE/.heartbeat-streak" 2>/dev/null || echo 0) + 1 )) > "$STATE/.heartbeat-streak" ;;
-    *) echo 0 > "$STATE/.heartbeat-streak" ;;
+    heartbeat*) echo $(( $(cat "$STATE/.heartbeat-streak" 2>/dev/null || echo 0) + 1 )) | fm_nofollow_write "$STATE/.heartbeat-streak" || exit 1 ;;
+    *) echo 0 | fm_nofollow_write "$STATE/.heartbeat-streak" || exit 1 ;;
   esac
-  echo "$1"
+  printf '%s\n' "$wake_output" || exit 1
+  while IFS= read -r row || [ -n "$row" ]; do
+    IFS=$(printf '\t') read -r _epoch _seq _kind _key _payload <<< "$row"
+    case "$_key" in
+      inactive-outcome:*)
+        "$SCRIPT_DIR/fm-inactive-reconcile.sh" caller-output-complete \
+          "$_key" "$row" "$WATCHER_PID" >/dev/null 2>&1 || exit 1
+        confirm_status=0
+        "$SCRIPT_DIR/fm-inactive-reconcile.sh" confirm "$_key" "$row" >/dev/null 2>&1 || confirm_status=$?
+        [ "$confirm_status" = 0 ] || [ "$confirm_status" = 1 ] || exit "$confirm_status"
+        ;;
+    esac
+  done <<< "$wake_output"
   exit 0
 }
 
@@ -439,7 +674,7 @@ run_check_capture() {
   FM_CHECK_SIGNAL_PENDING=
   trap 'FM_CHECK_SIGNAL_PENDING=1' HUP INT TERM
   set -m
-  ( FM_CHECK_OWNED_GROUP=1 run_check_process "$@" ) > "$FM_CHECK_OUTPUT" 2>/dev/null &
+  ( FM_CHECK_OWNED_GROUP=1 run_check_process "$@" 2>/dev/null | fm_nofollow_write "$FM_CHECK_OUTPUT" ) &
   FM_ACTIVE_CHECK_PID=$!
   FM_ACTIVE_CHECK_PGID=$FM_ACTIVE_CHECK_PID
   set +m
@@ -466,28 +701,845 @@ run_check_capture() {
 # fleet-scan can tell apart a captain-relevant status that already woke firstmate
 # from one that has not - the latter being a per-wake-path miss it must surface.
 _hb_surfaced_path() { printf '%s/.hb-surfaced-%s' "$STATE" "$(printf '%s' "$1" | tr ':/.' '___')"; }
+_hb_terminal_surfaced_path() { printf '%s/.hb-terminal-surfaced-%s' "$STATE" "$(printf '%s' "$1" | tr ':/.' '___')"; }
+_hb_surface_task_valid() { fm_pr_task_id_valid "$1"; }
+_hb_surface_retry_path() {
+  _hb_surface_task_valid "$1" || return 1
+  printf '%s/.hb-surface-retry-%s' "$STATE" "$(printf '%s' "$1" | tr ':/.' '___')"
+}
+
+surface_meta_value() {
+  awk -F= -v wanted="$2" '$1 == wanted { print substr($0, index($0, "=") + 1); exit }' "$1" 2>/dev/null
+}
+
+surface_meta_value_unique() {
+  awk -F= -v wanted="$2" '
+    $1 == wanted { value=substr($0, index($0, "=") + 1); count++ }
+    END { if (count == 1) { print value; exit 0 } if (count == 0) exit 1; exit 2 }
+  ' "$1" 2>/dev/null
+}
+
+watch_task_lock_acquire() {
+  local task=$1
+  WATCH_TASK_LOCK="$STATE/.spawn-$task.lock"
+  WATCH_TASK_LOCK_OWNER=
+  WATCH_TASK_LOCK_HELD=0
+  fm_lock_acquire_wait "$WATCH_TASK_LOCK" || return 1
+  WATCH_TASK_LOCK_HELD=1
+  WATCH_TASK_LOCK_OWNER=$(fm_lock_link_owner "$WATCH_TASK_LOCK" 2>/dev/null) || {
+    fm_lock_release "$WATCH_TASK_LOCK" || true
+    WATCH_TASK_LOCK=
+    WATCH_TASK_LOCK_OWNER=
+    WATCH_TASK_LOCK_HELD=0
+    return 1
+  }
+  [ -n "$WATCH_TASK_LOCK_OWNER" ] || {
+    fm_lock_release "$WATCH_TASK_LOCK" || true
+    WATCH_TASK_LOCK=
+    WATCH_TASK_LOCK_OWNER=
+    WATCH_TASK_LOCK_HELD=0
+    return 1
+  }
+}
+
+watch_task_lock_release() {
+  local status=0 lock="$WATCH_TASK_LOCK"
+  if [ "$WATCH_TASK_LOCK_HELD" = 1 ]; then
+    fm_lock_release "$lock" || status=1
+  fi
+  WATCH_TASK_LOCK=
+  WATCH_TASK_LOCK_OWNER=
+  WATCH_TASK_LOCK_HELD=0
+  return "$status"
+}
+
+surface_snapshot_matches_current() {
+  local task=$1 expected=$2 status_snapshot=$3 current state_timeout state_tmp state_rc=0
+  case "$expected" in
+    done:*|failed:*) [ "$expected" = "$status_snapshot" ]; return $? ;;
+    state:\ done\ *|state:\ failed\ *) ;;
+    *) return 1 ;;
+  esac
+  state_timeout=$(positive_seconds_or_default "${FM_WATCH_CREW_STATE_TIMEOUT_SECS:-1}" 1)
+  state_tmp=$(mktemp "$STATE/.hb-crew-state.XXXXXX") || return 1
+  if [ "$WATCH_TASK_LOCK_HELD" = 1 ] && [ "$WATCH_TASK_LOCK" = "$STATE/.spawn-$task.lock" ]; then
+    fm_pane_idle_run_bounded_child "$state_timeout" env \
+      FM_CREW_STATE_NM_TIMEOUT="$state_timeout" \
+      FM_TASK_LOCK_PATH="$WATCH_TASK_LOCK" FM_TASK_LOCK_OWNER="$WATCH_TASK_LOCK_OWNER" \
+      "$FM_CREW_STATE_BIN" "$task" 2>/dev/null | fm_nofollow_write "$state_tmp" || state_rc=$?
+  else
+    fm_pane_idle_run_bounded_child "$state_timeout" env FM_CREW_STATE_NM_TIMEOUT="$state_timeout" \
+      "$FM_CREW_STATE_BIN" "$task" 2>/dev/null | fm_nofollow_write "$state_tmp" || state_rc=$?
+  fi
+  current=
+  if [ "$state_rc" -eq 0 ]; then
+    current=$(cat "$state_tmp" 2>/dev/null) || state_rc=$?
+  fi
+  rm -f "$state_tmp" || [ "$state_rc" -ne 0 ] || state_rc=1
+  [ "$state_rc" -eq 0 ] || return 1
+  case "$current" in *$'\n'*) return 1 ;; esac
+  [ "$current" = "$expected" ]
+}
+
+surface_task_kind() {
+  local task=$1 meta="$STATE/$1.meta" kind rc
+  if [ -f "$meta" ] && [ ! -L "$meta" ]; then
+    if kind=$(surface_meta_value_unique "$meta" kind 2>/dev/null); then
+      :
+    else
+      rc=$?
+      [ "$rc" = 1 ] || return 1
+      kind=ship
+    fi
+  else
+    kind=ship
+  fi
+  case "$kind" in ship|scout|secondmate) printf '%s' "$kind" ;; *) return 1 ;; esac
+}
+
+surface_parent_corr() {
+  local task=$1 kind
+  kind=$(surface_task_kind "$task") || return 1
+  case "$kind" in
+    secondmate)
+      fm_pending_reply_secondmate_route_validate "$FM_HOME" || return 1
+      fm_pending_reply_parent_corr_valid "${FM_PENDING_ROUTE_CORR:-}" || return 1
+      [ -n "${FM_PENDING_ROUTE_CORR:-}" ] || return 1
+      printf '%s' "$FM_PENDING_ROUTE_CORR"
+      ;;
+    ship|scout) FM_PENDING_ROUTE_CORR=; printf '%s' '' ;;
+  esac
+}
+
+surface_receipt_identity_matches_current() {
+  local task=$1 fp=$2 rec=$3 expected_incarnation=$4 outcome=$5 snapshot=$6
+  local kind terminal_source parent_corr current_parent_corr parent_task_id parent_home parent_status expected_fp
+  kind=$(surface_task_kind "$task") || return 1
+  [ "$(surface_meta_value_unique "$rec" kind 2>/dev/null)" = "$kind" ] || return 1
+  terminal_source=$(surface_meta_value_unique "$rec" terminal_source 2>/dev/null) || return 1
+  case "$terminal_source" in run-step|pane) ;; *) return 1 ;; esac
+  current_parent_corr=$(surface_parent_corr "$task") || return 1
+  parent_corr=$(surface_meta_value_unique "$rec" parent_corr 2>/dev/null) || return 1
+  parent_task_id=$(surface_meta_value_unique "$rec" parent_task_id 2>/dev/null) || return 1
+  parent_home=$(surface_meta_value_unique "$rec" parent_home 2>/dev/null) || return 1
+  parent_status=$(surface_meta_value_unique "$rec" parent_status 2>/dev/null) || return 1
+  case "$kind" in
+    secondmate)
+      [ "$parent_corr" = "${FM_PENDING_ROUTE_CORR:-}" ] || return 1
+      [ "$parent_task_id" = "${FM_PENDING_ROUTE_SECOND_MATE_ID:-}" ] || return 1
+      [ "$parent_home" = "${FM_PENDING_ROUTE_PARENT_HOME:-}" ] || return 1
+      [ "$parent_status" = "${FM_PENDING_ROUTE_PARENT_STATUS:-}" ] || return 1
+      ;;
+    ship|scout)
+      [ -z "$parent_corr" ] || return 1
+      [ -z "$parent_task_id" ] || return 1
+      [ -z "$parent_home" ] || return 1
+      [ -z "$parent_status" ] || return 1
+      ;;
+    *) return 1 ;;
+  esac
+  [ "$parent_corr" = "$current_parent_corr" ] || return 1
+  expected_fp=$(surface_hash_text "$task|$expected_incarnation|$outcome|$snapshot|$kind|$terminal_source${current_parent_corr:+|$current_parent_corr}") || return 1
+  [ "$expected_fp" = "$fp" ] || return 1
+  [ "$(surface_meta_value_unique "$rec" fingerprint 2>/dev/null)" = "$expected_fp" ] || return 1
+}
+
+mark_terminal_surfaced_snapshot() {
+  local task=$1 last=$2 spawn_incarnation=$3 tasktmp=$4 window=$5 worktree=$6
+  local marker tmp parent_corr
+  case "$last" in
+    done:*|failed:*|state:\ done\ *|state:\ failed\ *) ;;
+    *) return 0 ;;
+  esac
+  parent_corr=$(surface_parent_corr "$task") || return 1
+  marker=$(_hb_terminal_surfaced_path "$task")
+  tmp=$(mktemp "$STATE/.hb-terminal-surfaced.XXXXXX") || return 1
+  if ! printf 'schema=fm-hb-terminal-surfaced.v1\nsnapshot=%s\nspawn_incarnation=%s\ntasktmp=%s\nwindow=%s\nworktree=%s\nparent_corr=%s\n' \
+    "$last" "$spawn_incarnation" "$tasktmp" "$window" "$worktree" "$parent_corr" | fm_nofollow_write "$tmp" \
+    || ! fm_nofollow_rename "$tmp" "$marker"; then
+    rm -f "$tmp"
+    return 1
+  fi
+}
+
+mark_terminal_surfaced() {
+  local task=$1 last=$2 meta spawn_incarnation tasktmp window worktree rc
+  case "$(status_line_verb "$last")" in
+    done|failed) ;;
+    *) return 0 ;;
+  esac
+  meta="$STATE/$task.meta"
+  [ -f "$meta" ] && [ ! -L "$meta" ] || return 0
+  spawn_incarnation=
+  if spawn_incarnation=$(surface_meta_value_unique "$meta" spawn_incarnation); then
+    :
+  else
+    rc=$?
+    [ "$rc" = 1 ] || [ "$rc" = 2 ] || return 1
+    spawn_incarnation=
+  fi
+  tasktmp=$(surface_meta_value "$meta" tasktmp)
+  window=$(surface_meta_value "$meta" window)
+  worktree=$(surface_meta_value "$meta" worktree)
+  mark_terminal_surfaced_snapshot "$task" "$last" "$spawn_incarnation" \
+    "$tasktmp" "$window" "$worktree"
+}
+
+surface_retry_valid() {
+  local task
+  awk -F= '
+    BEGIN {
+      allowed["schema"]=1; allowed["task"]=1; allowed["snapshot"]=1
+      allowed["spawn_incarnation"]=1; allowed["tasktmp"]=1
+      allowed["window"]=1; allowed["worktree"]=1; allowed["wake_key"]=1
+      allowed["parent_corr"]=1
+      allowed["wake_published"]=1
+      required["schema"]=1; required["task"]=1; required["snapshot"]=1
+      required["spawn_incarnation"]=1; required["tasktmp"]=1
+      required["window"]=1; required["worktree"]=1; required["wake_key"]=1
+      required["parent_corr"]=1
+      required["wake_published"]=1
+      valid=1
+    }
+    /^[^=]+=/ {
+      key=$1
+      if (!(key in allowed) || (key in seen)) valid=0
+      seen[key]=1
+      values[key]=substr($0, index($0, "=") + 1)
+      next
+    }
+    { valid=0 }
+    END {
+      for (key in required) if (!(key in seen)) valid=0
+      exit !(valid && values["schema"] == "fm-hb-surface-retry.v1" && values["task"] != "" && values["snapshot"] != "" && values["wake_key"] != "" && values["wake_published"] ~ /^[012]$/)
+    }
+  ' "$1" 2>/dev/null || return 1
+  task=$(surface_meta_value_unique "$1" task 2>/dev/null) || return 1
+  _hb_surface_task_valid "$task"
+}
+
+surface_retry_matches_current() {
+  local retry=$1 task=$2 last=$3 meta current_spawn saved_spawn
+  local current_tasktmp current_window current_worktree saved_snapshot current_parent_corr saved_parent_corr rc
+  _hb_surface_task_valid "$task" || return 1
+  meta="$STATE/$task.meta"
+  surface_retry_valid "$retry" || return 1
+  [ "$(surface_meta_value_unique "$retry" task 2>/dev/null)" = "$task" ] || return 1
+  saved_parent_corr=$(surface_meta_value_unique "$retry" parent_corr 2>/dev/null) || return 1
+  current_parent_corr=$(surface_parent_corr "$task") || return 1
+  [ "$saved_parent_corr" = "$current_parent_corr" ] || return 1
+  saved_snapshot=$(surface_meta_value_unique "$retry" snapshot 2>/dev/null) || return 1
+  surface_snapshot_matches_current "$task" "$saved_snapshot" "$last" || return 1
+  [ -f "$meta" ] && [ ! -L "$meta" ] || return 1
+  saved_spawn=$(surface_meta_value_unique "$retry" spawn_incarnation 2>/dev/null) || return 1
+  if current_spawn=$(surface_meta_value_unique "$meta" spawn_incarnation 2>/dev/null); then
+    [ "$saved_spawn" = "$current_spawn" ] || return 1
+    return 0
+  fi
+  rc=$?
+  [ "$rc" = 1 ] || return 1
+  [ -z "$saved_spawn" ] || return 1
+  current_tasktmp=$(surface_meta_value "$meta" tasktmp)
+  current_window=$(surface_meta_value "$meta" window)
+  current_worktree=$(surface_meta_value "$meta" worktree)
+  [ "$(surface_meta_value_unique "$retry" tasktmp 2>/dev/null)" = "$current_tasktmp" ] || return 1
+  [ "$(surface_meta_value_unique "$retry" window 2>/dev/null)" = "$current_window" ] || return 1
+  [ "$(surface_meta_value_unique "$retry" worktree 2>/dev/null)" = "$current_worktree" ] || return 1
+}
+
+surface_retry_write() {
+  local task=$1 last=$2 wake_key=$3 wake_published=${4:-1}
+  local meta retry tmp spawn_incarnation tasktmp window worktree parent_corr rc
+  _hb_surface_task_valid "$task" || return 1
+  meta="$STATE/$task.meta"
+  case "$wake_published" in 0|1|2) ;; *) return 1 ;; esac
+  parent_corr=$(surface_parent_corr "$task") || return 1
+  spawn_incarnation='' tasktmp='' window='' worktree=''
+  if [ -f "$meta" ] && [ ! -L "$meta" ]; then
+    if spawn_incarnation=$(surface_meta_value_unique "$meta" spawn_incarnation); then
+      :
+    else
+      rc=$?
+      [ "$rc" = 1 ] || [ "$rc" = 2 ] || return 1
+      spawn_incarnation=
+    fi
+    tasktmp=$(surface_meta_value "$meta" tasktmp)
+    window=$(surface_meta_value "$meta" window)
+    worktree=$(surface_meta_value "$meta" worktree)
+  fi
+  retry=$(_hb_surface_retry_path "$task")
+  if [ -e "$retry" ]; then
+    [ -f "$retry" ] && [ ! -L "$retry" ] && surface_retry_valid "$retry" || return 1
+    if surface_retry_matches_current "$retry" "$task" "$last"; then
+      [ "$(surface_meta_value_unique "$retry" wake_key 2>/dev/null)" = "$wake_key" ] || return 2
+    fi
+  fi
+  tmp=$(mktemp "$STATE/.hb-surface-retry.XXXXXX") || return 1
+  if ! printf 'schema=fm-hb-surface-retry.v1\ntask=%s\nsnapshot=%s\nspawn_incarnation=%s\ntasktmp=%s\nwindow=%s\nworktree=%s\nparent_corr=%s\nwake_key=%s\nwake_published=%s\n' \
+    "$task" "$last" "$spawn_incarnation" "$tasktmp" "$window" "$worktree" "$parent_corr" "$wake_key" "$wake_published" | fm_nofollow_write "$tmp" \
+    || ! fm_nofollow_rename "$tmp" "$retry"; then
+    rm -f "$tmp"
+    return 1
+  fi
+}
+
+surface_retry_mark_published() {
+  local task=$1 last=$2 wake_key=$3 retry tmp line seen=0
+  _hb_surface_task_valid "$task" || return 1
+  retry=$(_hb_surface_retry_path "$task")
+  surface_retry_matches_current "$retry" "$task" "$last" || return 1
+  [ "$(surface_meta_value_unique "$retry" wake_key 2>/dev/null)" = "$wake_key" ] || return 1
+  tmp=$(mktemp "$STATE/.hb-surface-retry.XXXXXX") || return 1
+  {
+    while IFS= read -r line || [ -n "$line" ]; do
+      case "$line" in
+        wake_published=*) printf 'wake_published=1\n'; seen=1 ;;
+        *) printf '%s\n' "$line" ;;
+      esac
+    done < "$retry"
+    [ "$seen" = 1 ] || printf 'wake_published=1\n'
+  } | fm_nofollow_write "$tmp" || { rm -f "$tmp"; return 1; }
+  [ ! -L "$retry" ] || { rm -f "$tmp"; return 1; }
+  fm_nofollow_rename "$tmp" "$retry" || { rm -f "$tmp"; return 1; }
+}
+
+surface_retry_complete_consumed() {
+  local retry=$1 task=$2 last=$3 spawn_incarnation=$4 tasktmp=$5 window=$6 worktree=$7
+  local marker tmp snapshot
+  _hb_surface_task_valid "$task" || return 2
+  surface_retry_matches_current "$retry" "$task" "$last" || return 2
+  snapshot=$(surface_meta_value_unique "$retry" snapshot 2>/dev/null) || return 2
+  mark_terminal_surfaced_snapshot "$task" "$snapshot" "$spawn_incarnation" \
+    "$tasktmp" "$window" "$worktree" || return 2
+  marker=$(_hb_surfaced_path "$task")
+  tmp=$(mktemp "$STATE/.hb-surfaced.XXXXXX") || return 2
+  if ! printf '%s' "$snapshot" | fm_nofollow_write "$tmp" || ! fm_nofollow_rename "$tmp" "$marker"; then
+    rm -f "$tmp"
+    return 2
+  fi
+  rm -f "$retry" || return 2
+  return 0
+}
+
+surface_retry_ordinary_consumed() {
+  local retry=$1 task=$2 last=$3 wake_key=$4 marker spawn_incarnation
+  _hb_surface_task_valid "$task" || return 2
+  [ "$wake_key" = "$task" ] || return 1
+  marker=$(fm_wake_surface_consumed_path "$task")
+  [ -f "$marker" ] && [ ! -L "$marker" ] || return 1
+  awk -F= '
+    BEGIN {
+      allowed["schema"]=1; allowed["task"]=1; allowed["wake_key"]=1
+      allowed["snapshot"]=1; allowed["spawn_incarnation"]=1
+      required["schema"]=1; required["task"]=1; required["wake_key"]=1
+      required["snapshot"]=1; required["spawn_incarnation"]=1
+      valid=1
+    }
+    /^[^=]+=/ {
+      key=$1
+      if (!(key in allowed) || (key in seen)) valid=0
+      seen[key]=1
+      values[key]=substr($0, index($0, "=") + 1)
+      next
+    }
+    { valid=0 }
+    END {
+      for (key in required) if (!(key in seen)) valid=0
+      exit !(valid && values["schema"] == "fm-hb-surface-consumed.v1")
+    }
+  ' "$marker" 2>/dev/null || return 2
+  [ "$(surface_meta_value_unique "$marker" task 2>/dev/null)" = "$task" ] || return 2
+  [ "$(surface_meta_value_unique "$marker" wake_key 2>/dev/null)" = "$wake_key" ] || return 2
+  [ "$(surface_meta_value_unique "$marker" snapshot 2>/dev/null)" = "$last" ] || return 1
+  spawn_incarnation=$(surface_meta_value_unique "$retry" spawn_incarnation 2>/dev/null) || return 2
+  [ "$(surface_meta_value_unique "$marker" spawn_incarnation 2>/dev/null)" = "$spawn_incarnation" ] || return 1
+  surface_retry_complete_consumed "$retry" "$task" "$last" \
+    "$spawn_incarnation" \
+    "$(surface_meta_value_unique "$retry" tasktmp 2>/dev/null)" \
+    "$(surface_meta_value_unique "$retry" window 2>/dev/null)" \
+    "$(surface_meta_value_unique "$retry" worktree 2>/dev/null)" || return $?
+  rm -f "$marker" || return 2
+  return 0
+}
+
+surface_retry_receipt_consumed() {
+  local retry=$1 task=$2 last=$3 wake_key=$4 fp rec suffix outcome expected_incarnation
+  local spawn_incarnation tasktmp window worktree receipt_snapshot saved_snapshot
+  _hb_surface_task_valid "$task" || return 2
+  case "$wake_key" in
+    inactive-outcome:*) fp=${wake_key#inactive-outcome:} ;;
+    *) surface_retry_ordinary_consumed "$retry" "$task" "$last" "$wake_key"; return $? ;;
+  esac
+  case "$fp" in ''|*[!A-Fa-f0-9]*) return 2 ;; esac
+  surface_retry_matches_current "$retry" "$task" "$last" || return 1
+  spawn_incarnation=$(surface_meta_value_unique "$retry" spawn_incarnation 2>/dev/null) || return 2
+  tasktmp=$(surface_meta_value_unique "$retry" tasktmp 2>/dev/null) || return 2
+  window=$(surface_meta_value_unique "$retry" window 2>/dev/null) || return 2
+  worktree=$(surface_meta_value_unique "$retry" worktree 2>/dev/null) || return 2
+  outcome=${last%%:*}
+  expected_incarnation=$(surface_replay_incarnation "$task") || return 2
+  for suffix in presented reported; do
+    rec="$STATE/terminal-outcomes/$fp.$suffix"
+    [ -f "$rec" ] && [ ! -L "$rec" ] || continue
+    [ "$(surface_meta_value_unique "$rec" schema 2>/dev/null)" = fm-jt-terminal-outcome.v1 ] || return 2
+    [ "$(surface_meta_value_unique "$rec" fingerprint 2>/dev/null)" = "$fp" ] || return 2
+    [ "$(surface_meta_value_unique "$rec" task_id 2>/dev/null)" = "$task" ] || return 2
+    [ "$(surface_meta_value_unique "$rec" incarnation 2>/dev/null)" = "$expected_incarnation" ] || continue
+    [ "$(surface_meta_value_unique "$rec" outcome 2>/dev/null)" = "$outcome" ] || continue
+    receipt_snapshot=$(surface_meta_value_unique "$rec" terminal_snapshot 2>/dev/null) || continue
+    surface_receipt_identity_matches_current "$task" "$fp" "$rec" \
+      "$expected_incarnation" "$outcome" "$receipt_snapshot" || continue
+    saved_snapshot=$(surface_meta_value_unique "$retry" snapshot 2>/dev/null) || return 2
+    [ "$receipt_snapshot" = "$saved_snapshot" ] || continue
+    surface_snapshot_matches_current "$task" "$receipt_snapshot" "$last" || continue
+    surface_retry_complete_consumed "$retry" "$task" "$last" "$spawn_incarnation" \
+      "$tasktmp" "$window" "$worktree"
+    return $?
+  done
+  return 1
+}
+
+surface_retry_wake_state() {
+  local wake_key=$1 status wake_deadline remaining
+  [ -e "$FM_WAKE_QUEUE" ] || return 1
+  [ -f "$FM_WAKE_QUEUE" ] && [ ! -L "$FM_WAKE_QUEUE" ] || return 2
+  wake_deadline=$(( $(fm_pane_idle_now_ms) + WAKE_QUEUE_STATUS_BUDGET_SECS * 1000 ))
+  remaining=$(fm_pane_idle_budget_secs "$wake_deadline") || return 2
+  if fm_pane_idle_run_bounded_child "$remaining" perl - "$FM_WAKE_QUEUE" "$wake_key" <<'PERL'
+use strict;
+use warnings;
+use Fcntl qw(:DEFAULT);
+my ($path, $wanted) = @ARGV;
+my $nofollow = eval { O_NOFOLLOW() };
+defined($nofollow) or exit 2;
+sysopen(my $fh, $path, O_RDONLY | $nofollow) or exit 2;
+while (defined(my $line = <$fh>)) {
+  my @fields = split(/\t/, $line, -1);
+  next unless @fields == 5;
+  next unless $fields[0] =~ /\A[0-9]+\z/ && $fields[1] =~ /\A[0-9]+\z/;
+  next unless $fields[2] =~ /\A(?:signal|stale|check|heartbeat)\z/;
+  next unless defined($fields[4]) && $fields[4] ne '';
+  exit 0 if defined($fields[3]) && $fields[3] eq $wanted;
+}
+close($fh) or exit 2;
+exit 1;
+PERL
+  then
+    return 0
+  else
+    status=$?
+  fi
+  [ "$status" = 1 ] && return 1
+  return 2
+}
+
+surface_retry_published_current() {
+  local retry=$1 task=$2 last=$3 wake_key=$4 published
+  _hb_surface_task_valid "$task" || return 2
+  if [ -L "$retry" ] || [ -e "$retry" ]; then
+    [ -f "$retry" ] && [ ! -L "$retry" ] && surface_retry_valid "$retry" || return 2
+  else
+    return 1
+  fi
+  surface_retry_matches_current "$retry" "$task" "$last" || return 1
+  [ "$(surface_meta_value_unique "$retry" wake_key 2>/dev/null)" = "$wake_key" ] || return 2
+  published=$(surface_meta_value_unique "$retry" wake_published 2>/dev/null) || return 2
+  case "$published" in
+    1) return 0 ;;
+    2)
+      surface_retry_wake_state "$wake_key"
+      case "$?" in
+        0) surface_retry_mark_published "$task" "$last" "$wake_key" || return 2; return 0 ;;
+        1) surface_retry_receipt_consumed "$retry" "$task" "$last" "$wake_key"; return $? ;;
+        *) return 2 ;;
+      esac
+      ;;
+    0) ;;
+    *) return 2 ;;
+  esac
+  surface_retry_wake_state "$wake_key"
+  case "$?" in
+    0) surface_retry_mark_published "$task" "$last" "$wake_key" || return 2; return 0 ;;
+    1) return 1 ;;
+    *) return 2 ;;
+  esac
+}
+
+surface_hash_text() {
+  if command -v shasum >/dev/null 2>&1; then
+    printf '%s' "$1" | shasum -a 256 | awk '{print $1}'
+  elif command -v sha256sum >/dev/null 2>&1; then
+    printf '%s' "$1" | sha256sum | awk '{print $1}'
+  else
+    return 1
+  fi
+}
+
+surface_replay_incarnation() {
+  local task=$1 meta="$STATE/$1.meta" token tasktmp window worktree seed digest rc
+  [ -f "$meta" ] && [ ! -L "$meta" ] || return 1
+  if token=$(surface_meta_value_unique "$meta" spawn_incarnation); then
+    case "$token" in ''|legacy-unknown|*[!A-Za-z0-9._:-]*) return 1 ;; esac
+    printf '%s' "$token"
+    return 0
+  fi
+  rc=$?
+  [ "$rc" = 1 ] || return 1
+  tasktmp=$(surface_meta_value "$meta" tasktmp)
+  window=$(surface_meta_value "$meta" window)
+  worktree=$(surface_meta_value "$meta" worktree)
+  if [ -n "$tasktmp" ]; then
+    seed="legacy|tasktmp=$tasktmp"
+  else
+    seed="legacy|window=$window|worktree=$worktree"
+  fi
+  digest=$(surface_hash_text "$seed") || return 1
+  printf 'legacy-%s' "${digest:0:32}"
+}
+
+surface_retry_repair_one() {
+  local retry=$1 task=$2 last=$3
+  local spawn_incarnation tasktmp window worktree wake_key status_file sig sf marker tmp
+  spawn_incarnation=$(surface_meta_value "$retry" spawn_incarnation)
+  tasktmp=$(surface_meta_value "$retry" tasktmp)
+  window=$(surface_meta_value "$retry" window)
+  worktree=$(surface_meta_value "$retry" worktree)
+  surface_retry_matches_current "$retry" "$task" "$last" || return 1
+  case "$(surface_meta_value_unique "$retry" wake_published 2>/dev/null || true)" in
+    1) ;;
+    2)
+      wake_key=$(surface_meta_value_unique "$retry" wake_key 2>/dev/null) || return 1
+      surface_retry_wake_state "$wake_key"
+      case "$?" in
+        0) surface_retry_mark_published "$task" "$last" "$wake_key" || return 1 ;;
+        1)
+          surface_retry_receipt_consumed "$retry" "$task" "$last" "$wake_key"
+          case "$?" in 0|1) return 0 ;; *) return 1 ;; esac
+          ;;
+        *) return 1 ;;
+      esac
+      ;;
+    0) return 0 ;;
+    *) return 1 ;;
+  esac
+  mark_terminal_surfaced_snapshot "$task" "$last" "$spawn_incarnation" \
+    "$tasktmp" "$window" "$worktree" || return 1
+  marker=$(_hb_surfaced_path "$task")
+  tmp=$(mktemp "$STATE/.hb-surfaced.XXXXXX") || return 1
+  if ! printf '%s' "$last" | fm_nofollow_write "$tmp" || ! fm_nofollow_rename "$tmp" "$marker"; then
+    rm -f "$tmp"
+    return 1
+  fi
+  status_file="$STATE/$task.status"
+  if [ -f "$status_file" ] && [ ! -L "$status_file" ] \
+    && [ "$(last_status_line "$status_file")" = "$last" ]; then
+    sig=$(stat_sig "$status_file") || return 1
+    sf="$STATE/.seen-$(basename "$status_file" | tr '.' '_')"
+    printf '%s' "$sig" | fm_nofollow_write "$sf" || return 1
+  fi
+  surface_retry_matches_current "$retry" "$task" "$last" || return 1
+  rm -f "$retry" || return 1
+}
+
+surface_retry_repair() {
+  local retry task last repair_rc status=0 repair_budget deadline_ms
+  repair_budget=$(positive_seconds_or_default "${FM_WATCH_SURFACE_REPAIR_BUDGET_SECS:-1}" 1)
+  [ "$repair_budget" -le 60 ] || repair_budget=60
+  deadline_ms=$(( $(fm_pane_idle_now_ms) + repair_budget * 1000 ))
+  for retry in "$STATE"/.hb-surface-retry-*; do
+    [ "$(fm_pane_idle_now_ms)" -lt "$deadline_ms" ] || break
+    [ -e "$retry" ] || continue
+    [ -f "$retry" ] && [ ! -L "$retry" ] && surface_retry_valid "$retry" || { status=1; continue; }
+    task=$(surface_meta_value "$retry" task)
+    last=$(surface_meta_value "$retry" snapshot)
+    watch_task_lock_acquire "$task" || { status=1; continue; }
+    surface_retry_repair_one "$retry" "$task" "$last"
+    repair_rc=$?
+    watch_task_lock_release || repair_rc=1
+    [ "$repair_rc" = 0 ] || status=1
+  done
+  return "$status"
+}
 
 # Record a status file's captain-relevant last line as surfaced (no-op for a
 # non-captain-relevant or empty status). Call AFTER the wake is enqueued, so the
 # enqueue-before-suppress ordering holds for this marker too.
 mark_surfaced() {  # <status-file>
-  local f=$1 task last
+  local f=$1 wake_key=${2:-} task last retry marker tmp
   task=$(basename "$f"); task="${task%.status}"
+  [ -n "$wake_key" ] || wake_key=$task
   last=$(last_status_line "$f")
   [ -n "$last" ] || return 0
   status_is_captain_relevant "$last" || return 0
-  printf '%s' "$last" > "$(_hb_surfaced_path "$task")"
+  surface_retry_write "$task" "$last" "$wake_key" 1 || return 1
+  retry=$(_hb_surface_retry_path "$task")
+  mark_terminal_surfaced "$task" "$last" || return 1
+  marker=$(_hb_surfaced_path "$task")
+  tmp=$(mktemp "$STATE/.hb-surfaced.XXXXXX") || return 1
+  if ! printf '%s' "$last" | fm_nofollow_write "$tmp" || ! fm_nofollow_rename "$tmp" "$marker"; then
+    rm -f "$tmp"
+    return 1
+  fi
+  rm -f "$retry" || return 1
 }
 
 # Mark every current captain-relevant status as surfaced. Called after the
 # heartbeat backstop enqueues its wake, so the same statuses are not re-surfaced
 # by the next heartbeat.
 mark_all_captain_relevant_surfaced() {
-  local f task last
+  local f status=0
   while IFS=$(printf '\t') read -r f task last; do
     [ -n "$f" ] || continue
-    printf '%s' "$last" > "$(_hb_surfaced_path "$task")"
+    mark_surfaced "$f" || status=1
   done < <(scan_captain_relevant_statuses "$STATE")
+  return "$status"
+}
+
+surface_signal_transaction() {
+  local pending=$1 reason=$2 sf sig f task last terminal status=0 suppressed wake_held=0
+  FM_SURFACE_PUBLISHED=0
+  while IFS=$(printf '\t') read -r sf sig f; do
+    [ -n "$sf" ] || continue
+    task=$(basename "$f"); task=${task%.status}
+    watch_task_lock_acquire "$task" || { status=1; break; }
+    suppressed=0
+    terminal_signal_suppressed "$f" || suppressed=$?
+    case "$suppressed" in
+      0)
+        printf '%s' "$sig" | fm_nofollow_write "$sf" || status=1
+        watch_task_lock_release || status=1
+        [ "$status" = 0 ] || break
+        continue
+        ;;
+      1) ;;
+      *) watch_task_lock_release || true; status=1; break ;;
+    esac
+    last=$(last_status_line "$f")
+    terminal=0
+    case "$last" in done:*|failed:*) terminal=1 ;; esac
+    if [ "$terminal" = 1 ]; then
+      surface_retry_write "$task" "$last" "$task" 2 || {
+        watch_task_lock_release || true
+        status=1
+        break
+      }
+    fi
+    if ! fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK"; then
+      watch_task_lock_release || true
+      status=1
+      break
+    fi
+    wake_held=1
+    if ! fm_wake_append_locked signal "$task" "$reason"; then
+      fm_lock_release "$FM_WAKE_QUEUE_LOCK" || true
+      wake_held=0
+      watch_task_lock_release || true
+      status=1
+      break
+    fi
+    if [ "$terminal" = 1 ]; then
+      surface_retry_mark_published "$task" "$last" "$task" || status=1
+    fi
+    if [ "$status" = 0 ]; then
+      FM_SURFACE_PUBLISHED=1
+      if ! mark_surfaced "$f" || ! printf '%s' "$sig" | fm_nofollow_write "$sf"; then
+        status=1
+      fi
+    fi
+    if [ "$status" = 0 ] && status_is_paused "$(last_status_line "$f")" \
+      && [ "$(status_file_kind "$f")" = secondmate ]; then
+      pause_marker_record_status "$f" || status=1
+    fi
+    fm_lock_release "$FM_WAKE_QUEUE_LOCK" || status=1
+    wake_held=0
+    watch_task_lock_release || status=1
+    [ "$status" = 0 ] || break
+  done <<< "$pending"
+  [ "$wake_held" = 0 ] || fm_lock_release "$FM_WAKE_QUEUE_LOCK" || status=1
+  [ "$WATCH_TASK_LOCK_HELD" = 0 ] || watch_task_lock_release || status=1
+  return "$status"
+}
+
+terminal_surface_marker_current() {
+  local task=$1 meta="$STATE/$1.meta" status_file="$STATE/$1.status"
+  local marker
+  local last saved_snapshot saved_spawn current_spawn current_parent_corr saved_parent_corr rc
+  marker="$STATE/.hb-terminal-surfaced-$(printf '%s' "$1" | tr ':/.' '___')"
+  [ -f "$meta" ] && [ ! -L "$meta" ] || return 1
+  [ -f "$status_file" ] && [ ! -L "$status_file" ] || return 1
+  marker=$(printf '%s' "$marker")
+  [ -f "$marker" ] && [ ! -L "$marker" ] || return 1
+  [ "$(surface_meta_value_unique "$marker" schema 2>/dev/null)" = fm-hb-terminal-surfaced.v1 ] || return 1
+  saved_parent_corr=$(surface_meta_value_unique "$marker" parent_corr 2>/dev/null) || return 1
+  current_parent_corr=$(surface_parent_corr "$task") || return 1
+  [ "$saved_parent_corr" = "$current_parent_corr" ] || return 1
+  last=$(last_status_line "$status_file")
+  case "$last" in done:*|failed:*) ;; *) return 1 ;; esac
+  saved_snapshot=$(surface_meta_value_unique "$marker" snapshot 2>/dev/null) || return 1
+  surface_snapshot_matches_current "$task" "$saved_snapshot" "$last" || return 1
+  saved_spawn=$(surface_meta_value_unique "$marker" spawn_incarnation 2>/dev/null) || return 1
+  if current_spawn=$(surface_meta_value_unique "$meta" spawn_incarnation 2>/dev/null); then
+    [ "$saved_spawn" = "$current_spawn" ] || return 1
+    return 0
+  fi
+  rc=$?
+  [ "$rc" = 1 ] || return 1
+  [ -z "$saved_spawn" ] || return 1
+  [ "$(surface_meta_value_unique "$marker" tasktmp 2>/dev/null)" = "$(surface_meta_value "$meta" tasktmp)" ] || return 1
+  [ "$(surface_meta_value_unique "$marker" window 2>/dev/null)" = "$(surface_meta_value "$meta" window)" ] || return 1
+  [ "$(surface_meta_value_unique "$marker" worktree 2>/dev/null)" = "$(surface_meta_value "$meta" worktree)" ] || return 1
+}
+
+inactive_replay_queued_for_task() {
+  local task=$1 last outcome fp rec receipt_snapshot expected_incarnation queue_deadline queue_match rc
+  [ -e "$FM_WAKE_QUEUE" ] || return 1
+  [ -f "$FM_WAKE_QUEUE" ] && [ ! -L "$FM_WAKE_QUEUE" ] || return 2
+  last=$(last_status_line "$STATE/$task.status") || return 2
+  outcome=${last%%:*}
+  case "$outcome" in done|failed) ;; *) return 1 ;; esac
+  expected_incarnation=$(surface_replay_incarnation "$task") || return 2
+  queue_deadline=$(( $(fm_pane_idle_now_ms) + WAKE_QUEUE_STATUS_BUDGET_SECS * 1000 ))
+  queue_match=$(fm_pane_idle_run_bounded_perl "$queue_deadline" "$FM_WAKE_QUEUE" "$task" <<'PERL'
+use strict;
+use warnings;
+use Fcntl qw(:DEFAULT);
+my ($queue, $task) = @ARGV;
+my $nofollow = eval { O_NOFOLLOW() };
+defined($nofollow) or exit 2;
+sysopen(my $fh, $queue, O_RDONLY | $nofollow) or exit 2;
+my $needle = "task=$task ";
+my $found = 0;
+while (defined(my $line = <$fh>)) {
+  chomp $line;
+  my @fields = split(/\t/, $line, -1);
+  @fields == 5 or exit 2;
+  $fields[0] =~ /\A[0-9]+\z/ && $fields[1] =~ /\A[0-9]+\z/ or exit 2;
+  defined($fields[4]) && $fields[4] ne '' or exit 2;
+  next unless $fields[2] eq 'check';
+  next unless $fields[3] =~ /\Ainactive-outcome:(.*)\z/;
+  my $fp = $1;
+  $fp ne '' && $fp =~ /\A[A-Fa-f0-9]+\z/ or exit 2;
+  next unless index($fields[4], $needle) >= 0;
+  print "$fp\n" or exit 2;
+  $found = 1;
+}
+close($fh) or exit 2;
+exit $found ? 0 : 1;
+PERL
+  )
+  rc=$?
+  case "$rc" in
+    0) ;;
+    1) return 1 ;;
+    *) return 2 ;;
+  esac
+  while IFS= read -r fp; do
+    [ -n "$fp" ] || continue
+    for rec in "$STATE/terminal-outcomes/$fp.pending" \
+      "$STATE/terminal-outcomes/$fp.presented" "$STATE/terminal-outcomes/$fp.reported"; do
+      [ -f "$rec" ] && [ ! -L "$rec" ] || continue
+      [ "$(surface_meta_value_unique "$rec" schema 2>/dev/null)" = fm-jt-terminal-outcome.v1 ] || continue
+      [ "$(surface_meta_value_unique "$rec" fingerprint 2>/dev/null)" = "$fp" ] || continue
+      [ "$(surface_meta_value_unique "$rec" task_id 2>/dev/null)" = "$task" ] || continue
+      [ "$(surface_meta_value_unique "$rec" incarnation 2>/dev/null)" = "$expected_incarnation" ] || continue
+      [ "$(surface_meta_value_unique "$rec" outcome 2>/dev/null)" = "$outcome" ] || continue
+      receipt_snapshot=$(surface_meta_value_unique "$rec" terminal_snapshot 2>/dev/null) || continue
+      surface_receipt_identity_matches_current "$task" "$fp" "$rec" \
+        "$expected_incarnation" "$outcome" "$receipt_snapshot" || continue
+      surface_snapshot_matches_current "$task" "$receipt_snapshot" "$last" || continue
+      return 0
+    done
+  done <<< "$queue_match"
+  return 1
+}
+
+terminal_signal_suppressed() {
+  local f=$1 task last retry retry_status marker_status replay_status retry_wake_key
+  last=$(last_status_line "$f")
+  case "$last" in
+    done:*|failed:*) ;;
+    *) return 1 ;;
+  esac
+  task=$(basename "$f" .status)
+  terminal_surface_marker_current "$task" || marker_status=$?
+  case "${marker_status:-0}" in
+    0) return 0 ;;
+    1) ;;
+    *) return 2 ;;
+  esac
+  inactive_replay_queued_for_task "$task" || replay_status=$?
+  case "${replay_status:-0}" in
+    0) return 0 ;;
+    1) ;;
+    *) return 2 ;;
+  esac
+  retry=$(_hb_surface_retry_path "$task")
+  retry_wake_key=$(surface_meta_value_unique "$retry" wake_key 2>/dev/null || true)
+  surface_retry_published_current "$retry" "$task" "$last" "${retry_wake_key:-$task}" || retry_status=$?
+  case "${retry_status:-0}" in
+    0) return 0 ;;
+    1) return 1 ;;
+    *) return 2 ;;
+  esac
+}
+
+surface_terminal_stale_transaction() {
+  local w=$1 h=$2 status=0 task last terminal=0 marker_status=0 replay_status=0
+  task=$(window_to_task "$w") || return 1
+  watch_task_lock_acquire "$task" || return 1
+  marker_status=0
+  terminal_surface_marker_current "$task" || marker_status=$?
+  if [ "$marker_status" = 0 ]; then
+    watch_task_lock_release || true
+    return 2
+  fi
+  replay_status=0
+  inactive_replay_queued_for_task "$task" || replay_status=$?
+  case "$replay_status" in
+    0)
+      watch_task_lock_release || true
+      return 2
+      ;;
+    1) ;;
+    *)
+      watch_task_lock_release || true
+      return 2
+      ;;
+  esac
+  last=$(last_status_line "$STATE/$task.status")
+  case "$last" in done:*|failed:*) terminal=1 ;; esac
+  if [ "$terminal" = 1 ]; then
+    surface_retry_write "$task" "$last" "$w" 2 || status=1
+  fi
+  if [ "$status" = 0 ] && fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK"; then
+    fm_wake_append_locked stale "$w" "stale: $w" || status=1
+  else
+    status=1
+  fi
+  if [ "$status" = 0 ] && [ "$terminal" = 1 ]; then
+    surface_retry_mark_published "$task" "$last" "$w" || status=1
+  fi
+  if [ "$status" = 0 ]; then
+    mark_surfaced "$STATE/$task.status" "$w" || status=1
+  fi
+  if [ "$status" = 0 ]; then
+    printf '%s' "$h" | fm_nofollow_write "$STATE/.stale-$(printf '%s' "$w" | tr ':/.' '___')" || status=1
+    rm -f "$STATE/.stale-since-$(printf '%s' "$w" | tr ':/.' '___')" || status=1
+  fi
+  fm_lock_release "$FM_WAKE_QUEUE_LOCK" || status=1
+  watch_task_lock_release || status=1
+  return "$status"
+}
+
+surface_heartbeat_transaction() {
+  local status=0
+  fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK" || return 1
+  fm_wake_append_locked heartbeat heartbeat heartbeat || status=1
+  fm_lock_release "$FM_WAKE_QUEUE_LOCK" || status=1
+  if [ "$status" = 0 ]; then
+    mark_all_captain_relevant_surfaced || status=1
+  fi
+  return "$status"
 }
 
 # Cheap heartbeat fleet-scan (the always-on twin of the daemon's catch-all). 0 if
@@ -551,11 +1603,13 @@ watcher_cleanup() {
 trap watcher_cleanup EXIT
 trap 'exit 1' HUP INT TERM
 WATCHER_PID=${BASHPID:-$$}
-printf '%s\n' "$FM_HOME" > "$WATCH_LOCK/fm-home" || true
-printf '%s\n' "$WATCH_PATH" > "$WATCH_LOCK/watcher-path" || true
-fm_pid_identity "$WATCHER_PID" > "$WATCH_LOCK/pid-identity" 2>/dev/null || true
+printf '%s\n' "$FM_HOME" | fm_nofollow_write "$WATCH_LOCK/fm-home" || true
+printf '%s\n' "$WATCH_PATH" | fm_nofollow_write "$WATCH_LOCK/watcher-path" || true
+fm_pid_identity "$WATCHER_PID" | fm_nofollow_write "$WATCH_LOCK/pid-identity" 2>/dev/null || true
 fm_watcher_protocol_acknowledge "$STATE" "$FM_HOME" "$WATCH_PATH" || exit 1
 
+surface_retry_repair || exit 1
+
 [ -e "$STATE/.last-heartbeat" ] || touch "$STATE/.last-heartbeat"
 
 # A merged poll may have queued its terminal wake and then lost the process
@@ -583,12 +1637,46 @@ while :; do
   # alive. Supervision scripts warn when this goes stale with tasks in flight.
   touch "$STATE/.last-watcher-beat"
 
+  drain_output=
+  drain_status=0
+  drain_output=$(FM_WAKE_DRAIN_DIRECT=0 FM_WAKE_DRAIN_DEFER_ACK=1 \
+    FM_WAKE_DRAIN_GENERATION="$WATCHER_PID" "$SCRIPT_DIR/fm-wake-drain.sh") \
+    || drain_status=$?
+  case "$drain_status" in
+    0) [ -n "$drain_output" ] && wake "$drain_output" ;;
+    3) exit 3 ;;
+    *) exit "$drain_status" ;;
+  esac
+
   # Parent-owned secondmate pending-reply reconciliation: resolve correlated
   # parent reports, observe backend busy/idle turn completion, send one recovery
   # repost after grace, and escalate once if the recovery turn is also missed.
   # No conversation scraping; unresolved records are never silently expired.
   fm_pending_reply_tick "$STATE" || true
 
+  # The helper owns its bounded cadence and receipt idempotence. A non-empty
+  # result means it appended an inactive-outcome wake, so surface that wake in
+  # this watcher turn without probing panes or scraping secondmate chat here.
+  if ! inactive_out=$("$SCRIPT_DIR/fm-inactive-reconcile.sh" scan 2>&1); then
+    printf '%s\n' "$inactive_out" >&2
+    exit 1
+  fi
+  if [ -n "$inactive_out" ]; then
+    inactive_drain_output=
+    inactive_drain_status=0
+    inactive_drain_output=$(FM_WAKE_DRAIN_DIRECT=0 FM_WAKE_DRAIN_DEFER_ACK=1 \
+      FM_WAKE_DRAIN_GENERATION="$WATCHER_PID" "$SCRIPT_DIR/fm-wake-drain.sh") \
+      || inactive_drain_status=$?
+    case "$inactive_drain_status" in
+      0)
+        [ -n "$inactive_drain_output" ] || exit 1
+        wake "$inactive_drain_output"
+        ;;
+      3) exit 3 ;;
+      *) exit "$inactive_drain_status" ;;
+    esac
+  fi
+
   # Slow per-task checks (firstmate writes these, e.g. a merged-PR poll).
   # Time-based via .last-check mtime so the cadence survives watcher restarts.
   # Evaluated BEFORE the signal scan: wake() exits the cycle, so a check placed
@@ -657,6 +1745,17 @@ while :; do
     touch "$STATE/.last-check"
   fi
 
+  drain_output=
+  drain_status=0
+  drain_output=$(FM_WAKE_DRAIN_DIRECT=0 FM_WAKE_DRAIN_DEFER_ACK=1 \
+    FM_WAKE_DRAIN_GENERATION="$WATCHER_PID" "$SCRIPT_DIR/fm-wake-drain.sh") \
+    || drain_status=$?
+  case "$drain_status" in
+    0) [ -n "$drain_output" ] && wake "$drain_output" ;;
+    3) exit 3 ;;
+    *) exit "$drain_status" ;;
+  esac
+
   # On the first changed signal, linger one grace period and re-scan before
   # classifying: a crewmate's final status write and the same turn's turn-end
   # hook land seconds apart, and reporting them as separate actionable wakes
@@ -689,27 +1788,12 @@ EOF
     # ordering evaluates it ONLY for a non-afk, no-captain-verb signal.
     # shellcheck disable=SC2086  # $files is a space-separated status-path list (ids carry no spaces)
     if afk_present || signal_reason_is_actionable $files || ! signal_crew_absorbable $files; then
-      while IFS=$(printf '\t') read -r sf sig f; do
-        [ -n "$sf" ] || continue
-        fm_wake_append signal "$(basename "$f")" "$reason" || exit 1
-      done <<EOF
-$pending
-EOF
-      while IFS=$(printf '\t') read -r sf sig f; do
-        [ -n "$sf" ] || continue
-        printf '%s' "$sig" > "$sf"
-        if status_is_paused "$(last_status_line "$f")" && [ "$(status_file_kind "$f")" = secondmate ]; then
-          pause_marker_record_status "$f"
-        fi
-        mark_surfaced "$f"
-      done <<EOF
-$pending
-EOF
-      wake "$reason"
+      surface_signal_transaction "$pending" "$reason" || exit 1
+      [ "$FM_SURFACE_PUBLISHED" = 1 ] && wake "$reason"
     else
       while IFS=$(printf '\t') read -r sf sig f; do
         [ -n "$sf" ] || continue
-        printf '%s' "$sig" > "$sf"
+        printf '%s' "$sig" | fm_nofollow_write "$sf"
       done <<EOF
 $pending
 EOF
@@ -721,15 +1805,80 @@ EOF
   # signature means the crewmate finished, is waiting, or is wedged. Each distinct
   # stale hash is surfaced, absorbed, or timed toward escalation once (.stale-*
   # remembers the hash already classified).
-  while IFS= read -r w; do
-    # A secondmate idling on its own watcher is healthy. Its parent supervises
-    # it through status writes and heartbeats, except while a declared pause
-    # marker is active so the same bounded re-surface cadence still applies.
-    if [ "$(window_kind "$w")" = secondmate ]; then
+  pane_idle_index_deadline=$(( $(fm_pane_idle_now_ms) + PANE_IDLE_INDEX_BUDGET_SECS * 1000 ))
+  pane_idle_index_status=0
+  fm_pane_idle_meta_index_build "$STATE" "$pane_idle_index_deadline" || pane_idle_index_status=$?
+  case "$pane_idle_index_status" in
+    0) ;;
+    124) ;;
+    *) exit "$pane_idle_index_status" ;;
+  esac
+  pane_idle_scan_deadline=$(( $(fm_pane_idle_now_ms) + PANE_IDLE_INDEX_BUDGET_SECS * 1000 ))
+  window_scan_stream=$(mktemp "$STATE/.watch-window-stream.XXXXXX") || exit 1
+  [ -f "$window_scan_stream" ] && [ ! -L "$window_scan_stream" ] || exit 1
+  window_scan_status=0
+  if [ "$FM_PANE_IDLE_META_INDEX_BUILT" = 1 ] \
+    && [ -f "${FM_PANE_IDLE_META_INDEX_SNAPSHOT:-}" ] \
+    && [ ! -L "${FM_PANE_IDLE_META_INDEX_SNAPSHOT:-}" ]; then
+    window_scan_source="snapshot:${FM_PANE_IDLE_META_INDEX_STATE_STAMP}"
+    watch_window_scan_prepare "$window_scan_source" || exit 1
+    fm_pane_idle_meta_index_windows_from_snapshot_resumable \
+      "$FM_PANE_IDLE_META_INDEX_SNAPSHOT" "${FM_WATCH_WINDOW_CURSOR:-0}" \
+      "$pane_idle_scan_deadline" | fm_nofollow_write "$window_scan_stream" || window_scan_status=$?
+  else
+    window_scan_stamp=$(cat "$STATE/.pane-idle-meta-index/.scan.entries.stamp" 2>/dev/null || true)
+    window_scan_source="entries:${window_scan_stamp:-unknown}"
+    watch_window_scan_prepare "$window_scan_source" || exit 1
+    fm_pane_idle_meta_index_windows_direct_resumable "$STATE" \
+      "${FM_WATCH_WINDOW_CURSOR:-}" "$pane_idle_scan_deadline" | fm_nofollow_write "$window_scan_stream" \
+      || window_scan_status=$?
+  fi
+  case "$window_scan_status" in
+    0|124) ;;
+    *) rm -f "$window_scan_stream"; exit "$window_scan_status" ;;
+  esac
+  window_scan_complete=1
+  while IFS= read -r -d '' window_scan_cursor \
+    && IFS= read -r -d '' w \
+    && IFS= read -r -d '' window_meta; do
+    if [ -z "$w" ]; then
+      watch_window_scan_advance "$window_scan_cursor" || exit 1
+      continue
+    fi
+    kind_status=0
+    kind=
+    kind=$(window_kind "$w" "$pane_idle_scan_deadline" "$window_meta") || kind_status=$?
+    case "$kind_status" in
+      0) ;;
+      3)
+        watch_window_scan_advance "$window_scan_cursor" || exit 1
+        continue
+        ;;
+      *)
+        window_scan_complete=0
+        break
+        ;;
+    esac
+    if [ "$kind" = secondmate ]; then
       key=$(printf '%s' "$w" | tr ':/.' '___')
-      [ -e "$STATE/.paused-$key" ] || continue
+      if [ ! -e "$STATE/.paused-$key" ]; then
+        watch_window_scan_advance "$window_scan_cursor" || exit 1
+        continue
+      fi
     fi
-    backend=$(window_backend "$w")
+    backend_status=0
+    backend=$(window_backend "$w" "$pane_idle_scan_deadline" "$window_meta") || backend_status=$?
+    case "$backend_status" in
+      0) ;;
+      3)
+        watch_window_scan_advance "$window_scan_cursor" || exit 1
+        continue
+        ;;
+      *)
+        window_scan_complete=0
+        break
+        ;;
+    esac
     if ! tail40=$(fm_backend_capture "$backend" "$w" 40 2>/dev/null); then
       reason="check: backend capture failed for $w (backend=$backend); inspect the runtime endpoint and task metadata"
       fm_wake_append check "$w" "$reason" || exit 1
@@ -744,56 +1893,71 @@ EOF
     prev=$(cat "$hf" 2>/dev/null || true)
     if [ "$h" = "$prev" ]; then
       n=$(( $(cat "$cf" 2>/dev/null || echo 0) + 1 ))
-      echo "$n" > "$cf"
-      # Busy match runs on the last 6 non-blank lines only (the TUI footer area,
-      # where every verified harness renders its busy indicator) so busy-looking
-      # strings in displayed content cannot suppress stale detection.
+      echo "$n" | fm_nofollow_write "$cf" || exit 1
       if [ "$n" -ge 2 ] && ! printf '%s' "$tail40" | grep -v '^[[:space:]]*$' | tail -6 | grep -qiE "$BUSY_REGEX"; then
-        # The pane is idle/stale at hash $h. Triage decides whether this wakes
-        # firstmate. Detection itself is unchanged from above.
+        if [ "$kind" != secondmate ]; then
+          idle_meta=$window_meta
+          if [ -n "$idle_meta" ]; then
+            idle_task=${idle_meta##*/}
+            idle_task=${idle_task%.meta}
+            idle_backend=$(fm_backend_of_meta "$idle_meta")
+            if ! fm_pane_idle_write "$STATE" "$idle_meta" "$idle_task" "$w" "$idle_backend" "$h" "$n"; then
+              fm_pane_idle_clear "$STATE" "$idle_task" || true
+              fm_pane_idle_meta_index_build "$STATE" "$pane_idle_scan_deadline" force || true
+              refreshed_idle_meta=$(fm_pane_idle_meta_for_window_bounded "$STATE" "$w" \
+                "$pane_idle_scan_deadline" 2>/dev/null || true)
+              if [ -n "$refreshed_idle_meta" ] && [ -f "$refreshed_idle_meta" ] \
+                && [ ! -L "$refreshed_idle_meta" ]; then
+                refreshed_idle_task=${refreshed_idle_meta##*/}
+                refreshed_idle_task=${refreshed_idle_task%.meta}
+                refreshed_idle_backend=$(fm_backend_of_meta "$refreshed_idle_meta")
+                fm_pane_idle_write "$STATE" "$refreshed_idle_meta" "$refreshed_idle_task" \
+                  "$w" "$refreshed_idle_backend" "$h" "$n" \
+                  || fm_pane_idle_clear "$STATE" "$refreshed_idle_task" || true
+              fi
+            fi
+          else
+            fm_pane_idle_clear_for_window "$STATE" "$w" "$pane_idle_scan_deadline" || true
+          fi
+        fi
         if ! afk_present; then
           task=$(window_to_task "$w")
           if [ "$(pause_state_class "$w" "$task")" = paused ]; then
             handle_paused_stale "$w" "$task" "$h"
+            watch_window_scan_advance "$window_scan_cursor" || exit 1
             continue
           fi
         fi
         if afk_present; then
-          # Daemon owns triage: one-shot per distinct stale hash, as before.
           if [ "$(cat "$sf" 2>/dev/null || true)" != "$h" ]; then
             fm_wake_append stale "$w" "stale: $w" || exit 1
-            printf '%s' "$h" > "$sf"
+            printf '%s' "$h" | fm_nofollow_write "$sf"
             wake "stale: $w"
           fi
         elif stale_is_terminal "$w" "$STATE"; then
-          # Terminal status under a stale pane: actionable -> enqueue + exit.
           if [ "$(cat "$sf" 2>/dev/null || true)" != "$h" ]; then
-            fm_wake_append stale "$w" "stale: $w" || exit 1
-            printf '%s' "$h" > "$sf"
-            rm -f "$ssf"
-            mark_surfaced "$STATE/$(window_to_task "$w").status"
+            terminal_surface_status=0
+            surface_terminal_stale_transaction "$w" "$h" || terminal_surface_status=$?
+            case "$terminal_surface_status" in
+              0) ;;
+              2)
+                watch_window_scan_advance "$window_scan_cursor" || exit 1
+                continue
+                ;;
+              *) exit "$terminal_surface_status" ;;
+            esac
+            rm -f "$ssf" || exit 1
             wake "stale: $w"
           fi
         else
-          # Non-terminal stale: a crew gone quiet without a captain-relevant status.
-          # Absorb-only-when-provably-working, decided once per distinct stale hash
-          # (the costly run-step read runs only on first sight, never every poll):
-          #   - provably working: an actively-running pipeline legitimately sits on a
-          #     static pane (e.g. waiting on CI), so absorb and start the wedge timer
-          #     so a genuinely frozen run still escalates past STALE_ESCALATE_SECS;
-          #   - NOT provably working: no running pipeline, idle pane, no busy
-          #     signature - the crew has STOPPED. Surface immediately so firstmate
-          #     peeks (it may be done via an interactive menu that wrote no done:
-          #     status, waiting on a decision, or wedged) instead of leaving the
-          #     finish to wait out the timer.
           if [ "$(cat "$sf" 2>/dev/null || true)" != "$h" ]; then
             if crew_is_provably_working "$(window_to_task "$w")"; then
-              printf '%s' "$h" > "$sf"
-              date +%s > "$ssf"
+            printf '%s' "$h" | fm_nofollow_write "$sf"
+              date +%s | fm_nofollow_write "$ssf"
               triage_log "absorbed non-terminal stale (provably working): $w"
             else
               fm_wake_append stale "$w" "stale: $w" || exit 1
-              printf '%s' "$h" > "$sf"
+              printf '%s' "$h" | fm_nofollow_write "$sf"
               rm -f "$ssf"
               wake "stale: $w"
             fi
@@ -801,7 +1965,7 @@ EOF
             since=$(cat "$ssf" 2>/dev/null || true)
             case "$since" in
               ''|*[!0-9]*)
-                date +%s > "$ssf"
+                date +%s | fm_nofollow_write "$ssf"
                 triage_log "absorbed non-terminal stale timer reset: $w"
                 ;;
               *)
@@ -816,26 +1980,27 @@ EOF
           fi
         fi
       else
-        # Pane busy is proven activity once two samples agree; a first baseline
-        # sample must preserve a declared pause marker across watcher restarts.
+        fm_pane_idle_clear_for_window "$STATE" "$w" "$pane_idle_scan_deadline" || exit 1
         if [ "$n" -ge 2 ]; then
           pause_tracking_clear "$w"
         fi
         rm -f "$ssf"
       fi
     else
-      printf '%s' "$h" > "$hf"
-      echo 0 > "$cf"
-      # Pane content changed: the crew is active again, so reset pause and
-      # escalation timers before a later pause starts a fresh cadence. During
-      # the first baseline after a watcher restart, preserve an existing pause
-      # marker until the next stable sample can reconcile it.
+      printf '%s' "$h" | fm_nofollow_write "$hf"
+      echo 0 | fm_nofollow_write "$cf" || exit 1
+      fm_pane_idle_clear_for_window "$STATE" "$w" "$pane_idle_scan_deadline" || exit 1
       if [ -n "$prev" ]; then
         pause_tracking_clear "$w"
       fi
       rm -f "$ssf"
     fi
-  done < <(recorded_windows)
+    watch_window_scan_advance "$window_scan_cursor" || exit 1
+  done < "$window_scan_stream"
+  if [ "$window_scan_status" = 0 ] && [ "$window_scan_complete" = 1 ]; then
+    watch_window_scan_advance EOF || exit 1
+  fi
+  rm -f "$window_scan_stream" || exit 1
 
   # Heartbeat: the watcher runs a cheap fleet-scan at a regular cadence no matter
   # what. Time-based via .last-heartbeat mtime; interval doubles per consecutive
@@ -852,20 +2017,19 @@ EOF
     # without exiting); the away-mode daemon, when present, owns triage and wants
     # every heartbeat.
     if afk_present; then
-      fm_wake_append heartbeat heartbeat heartbeat || exit 1
+      surface_heartbeat_transaction || exit 1
       touch "$STATE/.last-heartbeat"
       wake "heartbeat"
     elif heartbeat_scan_finds_actionable; then
       # Backstop: a captain-relevant status the per-wake path absorbed by mistake.
       # Enqueue first, then mark every captain-relevant status surfaced so the next
       # heartbeat does not re-fire them (enqueue-before-suppress preserved).
-      fm_wake_append heartbeat heartbeat heartbeat || exit 1
+      surface_heartbeat_transaction || exit 1
       touch "$STATE/.last-heartbeat"
-      mark_all_captain_relevant_surfaced
       wake "heartbeat"
     else
       touch "$STATE/.last-heartbeat"
-      echo $(( $(cat "$STATE/.heartbeat-streak" 2>/dev/null || echo 0) + 1 )) > "$STATE/.heartbeat-streak"
+    echo $(( $(cat "$STATE/.heartbeat-streak" 2>/dev/null || echo 0) + 1 )) | fm_nofollow_write "$STATE/.heartbeat-streak" || exit 1
       triage_log "absorbed heartbeat (no captain-relevant change)"
     fi
   fi
diff --git a/bin/fm-worker-isolation-lib.sh b/bin/fm-worker-isolation-lib.sh
index e1b66e44b7c..e4b12edc1d8 100755
--- a/bin/fm-worker-isolation-lib.sh
+++ b/bin/fm-worker-isolation-lib.sh
@@ -152,7 +152,31 @@ fm_worker_paths_same() {
 }
 
 fm_worker_process_environ() {
-  fm_process_environ "$1"
+  local pid=$1 entry
+  local -a entries=()
+  case "$pid" in
+    ''|*[!0-9]*) return 1 ;;
+  esac
+  if fm_process_environ "$pid"; then
+    return 0
+  fi
+  fm_process_environ_supported || return 1
+  [ -r "/proc/$pid/environ" ] || return 1
+  if ! {
+    while IFS= read -r -d '' entry; do
+      case "$entry" in
+        BASH_FUNC_[A-Za-z0-9_]*'%%=() {'*) continue ;;
+        *$'\n'*) return 1 ;;
+      esac
+      entries+=("$entry")
+    done < "/proc/$pid/environ"
+  } 2>/dev/null; then
+    return 1
+  fi
+  if [ "${#entries[@]}" -gt 0 ]; then
+    printf '%s\n' "${entries[@]}"
+  fi
+  return 0
 }
 
 fm_worker_process_ppid() {
diff --git a/docs/architecture.md b/docs/architecture.md
index b978e5815d7..a65652f6bd9 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -24,6 +24,11 @@ Its `--restart` mode signals only the watcher recorded in the current home's `st
 A pull-based guard (`bin/fm-guard.sh`) warns through supervision tool output if the primary checkout is tangled, or if tasks are in flight and that watcher stops running or queued wakes are waiting to be drained.
 The drain script calls that guard after emptying the queue, which avoids repeating the queued-wakes warning for records it just consumed while still warning on stale watcher liveness.
 It leads with prominent bordered banners for the tangle and no-watcher cases so they cannot be skimmed past.
+The locked session-start path and watcher cadence also run `fm-inactive-reconcile.sh` on a bounded, home-local scan.
+It asks `fm-crew-state.sh` for the canonical current state of quiet direct `ship` and `scout` children, accepts only an authoritative `done` or `failed` result with current incarnation evidence, and stores its single-line state as the receipt snapshot.
+The receipt is an atomic `fm-jt-terminal-outcome.v1` record fingerprinted by task, incarnation, outcome, snapshot, source, and (for secondmates) parent correlation, with one matching `check` wake.
+The locked wake drain presents that receipt, and its owning session-start or watcher caller confirms the output before the receipt is acknowledged; this layer never closes panes, returns slots, removes worktrees, changes PRs, or scrapes secondmate chat.
+New metadata carries a `spawn_incarnation` created under `.spawn-<id>.lock`; legacy metadata without it falls back to a hash of `tasktmp`, or the recorded window and worktree, so relaunches remain distinguishable when possible.
 
 A presence-gated sub-supervisor (`bin/fm-supervise-daemon.sh`) extends this for walk-away supervision: the `/afk` skill activates it, after which the watcher reverts to daemon-managed one-shot mode and the daemon self-handles routine wakes in bash.
 The watcher and daemon share `bin/fm-classify-lib.sh`, so captain-relevant status verbs and signal, stale, and heartbeat-scan classification stay consistent in both modes.
@@ -61,6 +66,7 @@ Seeding is transactional: if validation, cloning, initialization, or registry up
 The same project may appear in multiple secondmate homes when their scopes differ, such as issue triage versus feature development.
 Secondmates are idle by default: after startup recovery reconciles only work already in their own home, an empty queue waits silently for routed tasks, and they never self-initiate surveys or audits.
 Bare `fm-send.sh fm-<id>` requests to a live `kind=secondmate` are prefixed with the from-firstmate marker from `bin/fm-marker-lib.sh`, so the secondmate returns terse answers through status lines and detailed answers through docs plus status pointers instead of replying only in its own chat.
+Secondmate inactive-outcome receipts use the existing parent-owned pending-reply record and `corr=` status correlation through a validated `state/.fm-jt-parent-route` marker. Missing or malformed routes fail closed; the parent watcher remains the only status owner, and no secondmate conversation is scraped.
 Explicit `session:window` sends and direct human typing stay unmarked, so captain intervention in a secondmate pane remains conversational.
 After seeding a secondmate, `fm-backlog-handoff.sh` moves already-judged in-scope queued items from the main backlog into that secondmate home so the domain queue starts in the right place.
 Idle secondmate panes are healthy; teardown is explicit and refuses while the secondmate home has in-flight work unless the captain has approved discard with `--force`.
diff --git a/docs/configuration.md b/docs/configuration.md
index acece62a23a..d7f01185bb2 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -106,6 +106,20 @@ FM_HEARTBEAT_MAX=7200   # heartbeat backoff cap
 FM_CHECK_INTERVAL=300   # seconds between slow checks (merge polls or the X-mode poll shim)
 FM_CHECK_TIMEOUT=30     # seconds allowed per slow check script
 FM_CREW_STATE_NM_TIMEOUT=10   # seconds allowed per no-mistakes query inside fm-crew-state.sh
+FM_INACTIVE_OUTCOME_SECS=900       # minimum quiet seconds before a direct done/failed outcome is reconciled; clamps to 60..1800
+FM_INACTIVE_OUTCOME_BUDGET_SECS=10 # total seconds allowed per home-local inactive-outcome scan; clamps to 1..300
+FM_INACTIVE_OUTCOME_LOCK_WAIT_SECS=30 # seconds to wait for one child's spawn lock; clamps to 0..300
+FM_INACTIVE_OUTCOME_STATE_TIMEOUT_SECS=10 # seconds allowed for one canonical child-state read; clamps to 1..300
+FM_INACTIVE_OUTCOME_PARENT_STATUS_SCAN_SECS=1 # seconds allowed for parent status correlation checks; clamps to 1..60
+FM_INACTIVE_OUTCOME_MAINTENANCE_RESERVE_SECS=1 # seconds reserved for receipt/route maintenance per scan; clamps to 1..60
+FM_REPORTED_ROUTE_REPAIR_LIMIT=32    # maximum reported secondmate routes repaired per maintenance pass; clamps to 1..256
+FM_PENDING_RECEIPT_REPUBLISH_LIMIT=32 # maximum pending receipts republished per maintenance pass; clamps to 1..256
+FM_PANE_IDLE_INDEX_BUDGET_SECS=1     # seconds for one bounded pane-metadata index build; invalid/zero falls back to 1
+FM_WAKE_QUEUE_STATUS_BUDGET_SECS=1   # seconds for one bounded wake-key status check; invalid/zero falls back to 1
+FM_WATCH_CREW_STATE_TIMEOUT_SECS=1   # seconds for one bounded watcher current-state read; invalid/zero falls back to 1
+FM_WATCH_SURFACE_REPAIR_BUDGET_SECS=1 # seconds for bounded watcher surface-retry repair; values above 60 clamp to 60
+FM_WAKE_DRAIN_BATCH_ROWS=16           # maximum wake rows processed by one drain turn; invalid/zero falls back to 16
+FM_WAKE_DRAIN_PRESENTATION_TIMEOUT_SECS=30 # seconds allowed to present one inactive receipt; invalid/zero falls back to 30 and values above 300 clamp to 300
 FMX_PAIRING_TOKEN=      # X mode pairing token; .env opt-in authorizes replies and eligible lifecycle actions
 FMX_RELAY_URL=https://myfirstmate.io   # optional X relay override, mainly for local relay development
 FMX_ENV_FILE=           # optional alternate .env file for direct X client invocations; bootstrap still checks $FM_HOME/.env
diff --git a/docs/scripts.md b/docs/scripts.md
index 30f78c80aed..74d460eec12 100644
--- a/docs/scripts.md
+++ b/docs/scripts.md
@@ -26,6 +26,7 @@ Each file also starts with a short header comment.
 | `fm-supervise-daemon.sh` | Presence-gated sub-supervisor for walk-away (`/afk`) supervision: wraps `fm-watch.sh`, uses the shared wake classifier, self-handles routine wakes in bash, and escalates only captain-relevant events as one verified, batched, single-line digest prefixed with a sentinel marker |
 | `fm-crew-state.sh`       | Print one stable current-state line for a crew by reconciling its matching no-mistakes run-step, even when the pane has closed, with pane and status-log fallback |
 | `fm-numeric-lib.sh`      | Shared bounded nonnegative-integer parser with decimal leading-zero handling, sourced by `fm-crew-state.sh`       |
+| `fm-inactive-reconcile.sh` | Scan this home's direct ordinary children on a bounded cadence, publish fingerprinted inactive terminal receipts, queue one replay wake, and let the locked wake drain present and acknowledge it |
 | `fm-tangle-lib.sh`       | Shared default-branch resolution and primary-checkout tangle classification sourced by bootstrap and guard         |
 | `fm-ff-lib.sh`           | Shared guarded fast-forward helper for `/updatefirstmate` origin pulls and no-fetch local secondmate syncs         |
 | `fm-tasks-axi-lib.sh`    | Shared `tasks-axi` compatibility probe sourced by bootstrap and teardown                                            |
diff --git a/tests/fm-crew-state.test.sh b/tests/fm-crew-state.test.sh
index c55158a81c0..3eea5a2265b 100755
--- a/tests/fm-crew-state.test.sh
+++ b/tests/fm-crew-state.test.sh
@@ -57,7 +57,7 @@ case "${1:-}" in
     shift
     if [ "${1:-}" = --run ]; then
       run_key="FM_FAKE_AXI_STATUS_RUN_${2:-}"
-      printf '%s\n' "${!run_key:-${FM_FAKE_AXI_STATUS_RUN:-}}"
+      printf '%s\n' "${!run_key:-${FM_FAKE_AXI_STATUS_RUN:-${FM_FAKE_AXI_STATUS:-}}}"
     else printf '%s\n' "${FM_FAKE_AXI_STATUS:-}"; fi ;;
   '') printf '%s\n' "${FM_FAKE_AXI_LIST:-}" ;;
 esac
@@ -95,7 +95,12 @@ make_no_timeout_toolbin() {  # <dir> -> echoes toolbin path
 # Run the helper for one case dir. FM_FAKE_* env (run output, busy flag) are read
 # from the caller's environment by the fakes above.
 run_crew_state() {  # <case-dir> <id>
-  PATH="$1/fakebin:$PATH" FM_STATE_OVERRIDE="$1/state" "$CREW_STATE" "$2"
+  local dir=$1 id=$2 meta="$1/state/$2.meta"
+  if [ -f "$meta" ] && [ -n "${FM_FAKE_AXI_STATUS:-}${FM_FAKE_AXI_LIST:-}" ] \
+    && ! grep -q '^spawn_incarnation=' "$meta"; then
+    printf 'spawn_incarnation=test-incarnation\n' >> "$meta"
+  fi
+  PATH="$dir/fakebin:$PATH" FM_STATE_OVERRIDE="$dir/state" "$CREW_STATE" "$id"
 }
 
 new_case() {  # <name> -> echoes case dir with an empty state/
@@ -301,6 +306,13 @@ outcome: failed
 EOF
 }
 
+write_run_step_binding() {  # <state> <id> <run-id> <incarnation>
+  local state=$1 id=$2 run_id=$3 incarnation=$4
+  fm_write_meta "$state/.run-step-incarnation-$id" \
+    schema=fm-jt-run-step-incarnation.v1 task_id="$id" run_id="$run_id" \
+    spawn_incarnation="$incarnation" state=active
+}
+
 run_ci_monitoring() {  # <branch>
   cat <<EOF
 run:
@@ -493,7 +505,8 @@ test_terminal_passed() {
   local d; d=$(new_case passed)
   make_repo_on_branch "$d/wt" fm/feat-d
   make_fakebin "$d" >/dev/null
-  fm_write_meta "$d/state/feat-d.meta" "window=fm:fm-feat-d" "worktree=$d/wt" "kind=ship"
+  fm_write_meta "$d/state/feat-d.meta" "window=fm:fm-feat-d" "worktree=$d/wt" "kind=ship" "spawn_incarnation=test-incarnation" "run_step_id=01RUN"
+  write_run_step_binding "$d/state" feat-d 01RUN test-incarnation
   FM_FAKE_AXI_STATUS="$(run_passed fm/feat-d)"
   local out; out=$(run_crew_state "$d" feat-d)
   assert_contains "$out" "state: done" "passed run -> done"
@@ -507,7 +520,8 @@ test_terminal_passed_delivery_skipped() {
   local d; d=$(new_case passed-delivery-skipped)
   make_repo_on_branch "$d/wt" fm/feat-dsk
   make_fakebin "$d" >/dev/null
-  fm_write_meta "$d/state/feat-dsk.meta" "window=fm:fm-feat-dsk" "worktree=$d/wt" "kind=ship"
+  fm_write_meta "$d/state/feat-dsk.meta" "window=fm:fm-feat-dsk" "worktree=$d/wt" "kind=ship" "spawn_incarnation=test-incarnation" "run_step_id=01RUN"
+  write_run_step_binding "$d/state" feat-dsk 01RUN test-incarnation
   FM_FAKE_AXI_STATUS="$(run_passed_delivery_skipped fm/feat-dsk)"
   local out; out=$(run_crew_state "$d" feat-dsk)
   assert_not_contains "$out" "merged" "passed with skipped delivery must not claim merged"
@@ -518,12 +532,45 @@ test_terminal_passed_delivery_skipped() {
   pass "passed run with skipped pr/ci steps never claims merged"
 }
 
+test_bound_run_missing_evidence_fails_closed() {
+  reset_fakes
+  local d; d=$(new_case bound-missing-evidence)
+  make_repo_on_branch "$d/wt" fm/feat-bound-missing
+  make_fakebin "$d" >/dev/null
+  fm_write_meta "$d/state/feat-bound-missing.meta" \
+    "window=fm:fm-feat-bound-missing" "worktree=$d/wt" "kind=ship" \
+    "spawn_incarnation=test-incarnation" "run_binding_state=bound" "run_id=01OTHER"
+  FM_FAKE_AXI_STATUS="$(run_running fm/feat-bound-missing)"
+  local out; out=$(run_crew_state "$d" feat-bound-missing)
+  assert_contains "$out" "state: unknown" "bound run without evidence -> unknown"
+  assert_contains "$out" "source: run-step" "bound run without evidence -> run-step source"
+  assert_not_contains "$out" "state: working" "bound run without evidence must not use generic attribution"
+  pass "bound run metadata without evidence fails closed"
+}
+
+test_pending_run_binding_fails_closed() {
+  reset_fakes
+  local d; d=$(new_case pending-missing-evidence)
+  make_repo_on_branch "$d/wt" fm/feat-pending-missing
+  make_fakebin "$d" >/dev/null
+  fm_write_meta "$d/state/feat-pending-missing.meta" \
+    "window=fm:fm-feat-pending-missing" "worktree=$d/wt" "kind=ship" \
+    "spawn_incarnation=test-incarnation" "run_binding_state=pending"
+  FM_FAKE_AXI_STATUS="$(run_running fm/feat-pending-missing)"
+  local out; out=$(run_crew_state "$d" feat-pending-missing)
+  assert_contains "$out" "state: unknown" "pending run without evidence -> unknown"
+  assert_contains "$out" "source: run-step" "pending run without evidence -> run-step source"
+  assert_not_contains "$out" "state: working" "pending run without evidence must not use generic attribution"
+  pass "pending run metadata without evidence fails closed"
+}
+
 test_terminal_passed_delivery_completed() {
   reset_fakes
   local d; d=$(new_case passed-delivery-completed)
   make_repo_on_branch "$d/wt" fm/feat-dok
   make_fakebin "$d" >/dev/null
-  fm_write_meta "$d/state/feat-dok.meta" "window=fm:fm-feat-dok" "worktree=$d/wt" "kind=ship"
+  fm_write_meta "$d/state/feat-dok.meta" "window=fm:fm-feat-dok" "worktree=$d/wt" "kind=ship" "spawn_incarnation=test-incarnation" "run_step_id=01RUN"
+  write_run_step_binding "$d/state" feat-dok 01RUN test-incarnation
   FM_FAKE_AXI_STATUS="$(run_passed_delivery_completed fm/feat-dok)"
   local out; out=$(run_crew_state "$d" feat-dok)
   assert_contains "$out" "state: done" "passed with completed delivery -> done"
@@ -536,7 +583,8 @@ test_terminal_failed() {
   local d; d=$(new_case failed)
   make_repo_on_branch "$d/wt" fm/feat-e
   make_fakebin "$d" >/dev/null
-  fm_write_meta "$d/state/feat-e.meta" "window=fm:fm-feat-e" "worktree=$d/wt" "kind=ship"
+  fm_write_meta "$d/state/feat-e.meta" "window=fm:fm-feat-e" "worktree=$d/wt" "kind=ship" "spawn_incarnation=test-incarnation" "run_step_id=01RUN"
+  write_run_step_binding "$d/state" feat-e 01RUN test-incarnation
   FM_FAKE_AXI_STATUS="$(run_failed fm/feat-e)"
   local out; out=$(run_crew_state "$d" feat-e)
   assert_contains "$out" "state: failed" "failed run -> failed"
@@ -544,6 +592,113 @@ test_terminal_failed() {
   pass "terminal failed run is authoritative"
 }
 
+test_active_run_does_not_create_incarnation_binding() {
+  reset_fakes
+  local d out evidence
+  d=$(new_case active-no-binding)
+  make_repo_on_branch "$d/wt" fm/feat-active-no-binding
+  make_fakebin "$d" >/dev/null
+  fm_write_meta "$d/state/feat-active-no-binding.meta" \
+    "window=fm:fm-feat-active-no-binding" "worktree=$d/wt" "kind=ship" \
+    "spawn_incarnation=active-no-binding-inc"
+  FM_FAKE_AXI_STATUS="$(run_running fm/feat-active-no-binding)"
+  out=$(run_crew_state "$d" feat-active-no-binding)
+  assert_contains "$out" "state: working" "active run remains authoritative without binding"
+  evidence="$d/state/.run-step-incarnation-feat-active-no-binding"
+  [ ! -e "$evidence" ] && [ ! -L "$evidence" ] || fail "active branch/head lookup created a binding"
+  pass "active branch/head lookup cannot create terminal evidence"
+}
+
+test_terminal_first_observation_requires_binding() {
+  reset_fakes
+  local d out evidence status
+  d=$(new_case terminal-first-observation)
+  make_repo_on_branch "$d/wt" fm/feat-terminal-first
+  make_fakebin "$d" >/dev/null
+  fm_write_meta "$d/state/feat-terminal-first.meta" \
+    "window=fm:fm-feat-terminal-first" "worktree=$d/wt" "kind=ship" \
+    "spawn_incarnation=terminal-first-inc"
+  FM_FAKE_AXI_STATUS="$(run_passed fm/feat-terminal-first)"
+  set +e
+  out=$(run_crew_state "$d" feat-terminal-first)
+  status=$?
+  set -u
+  [ "$status" -ne 0 ] || fail "terminal first observation was accepted without a binding"
+  evidence="$d/state/.run-step-incarnation-feat-terminal-first"
+  [ ! -e "$evidence" ] && [ ! -L "$evidence" ] || fail "terminal first observation created a binding"
+  pass "terminal first observation requires a lifecycle binding"
+}
+
+test_terminal_candidate_requires_existing_binding() {
+  reset_fakes
+  local d status out evidence
+  d=$(new_case terminal-candidate)
+  make_repo_on_branch "$d/wt" fm/feat-terminal-candidate
+  make_fakebin "$d" >/dev/null
+  fm_write_meta "$d/state/feat-terminal-candidate.meta" \
+    "window=fm:fm-feat-terminal-candidate" "worktree=$d/wt" "kind=ship" \
+    "spawn_incarnation=terminal-candidate-inc"
+  status=$(run_passed fm/unrelated-branch)
+  FM_FAKE_AXI_STATUS="$status"
+  status=$(run_passed fm/feat-terminal-candidate | sed 's/id: "01RUN"/id: "01HIST"/')
+  export FM_FAKE_AXI_STATUS_RUN_01HIST="$status"
+  FM_FAKE_AXI_LIST=$(cat <<EOF
+runs[1]{id,branch,status,head,pr}:
+  "01HIST",fm/feat-terminal-candidate,completed,$FM_FAKE_RUN_HEAD,""
+EOF
+)
+  set +e
+  out=$(run_crew_state "$d" feat-terminal-candidate 2>&1)
+  status=$?
+  set -u
+  [ "$status" -ne 0 ] || fail "terminal candidate run created a new binding"
+  evidence="$d/state/.run-step-incarnation-feat-terminal-candidate"
+  [ ! -e "$evidence" ] && [ ! -L "$evidence" ] || fail "terminal candidate run persisted historical evidence"
+  unset FM_FAKE_AXI_STATUS_RUN_01HIST
+  pass "terminal candidate run requires a pre-existing binding"
+}
+
+test_terminal_metadata_run_id_must_match_binding() {
+  reset_fakes
+  local d status out evidence
+  d=$(new_case terminal-metadata-mismatch)
+  make_repo_on_branch "$d/wt" fm/feat-terminal-metadata-mismatch
+  make_fakebin "$d" >/dev/null
+  fm_write_meta "$d/state/feat-terminal-metadata-mismatch.meta" \
+    "window=fm:fm-feat-terminal-metadata-mismatch" "worktree=$d/wt" "kind=ship" \
+    "spawn_incarnation=terminal-metadata-inc" "run_step_id=spawned-run"
+  write_run_step_binding "$d/state" feat-terminal-metadata-mismatch 01RUN terminal-metadata-inc
+  FM_FAKE_AXI_STATUS="$(run_passed fm/feat-terminal-metadata-mismatch)"
+  set +e
+  out=$(run_crew_state "$d" feat-terminal-metadata-mismatch 2>&1)
+  status=$?
+  set -u
+  [ "$status" -ne 0 ] || fail "terminal run crossed a mismatched metadata run id"
+  evidence="$d/state/.run-step-incarnation-feat-terminal-metadata-mismatch"
+  [ -f "$evidence" ] || fail "mismatched metadata test lost its binding evidence"
+  pass "terminal state requires the metadata and binding run ids to match"
+}
+
+test_bound_run_id_is_selected_before_current_run() {
+  reset_fakes
+  local d out
+  d=$(new_case bound-run-selection)
+  make_repo_on_branch "$d/wt" fm/feat-bound-selection
+  make_fakebin "$d" >/dev/null
+  fm_write_meta "$d/state/feat-bound-selection.meta" \
+    "window=fm:fm-feat-bound-selection" "worktree=$d/wt" "kind=ship" \
+    "spawn_incarnation=bound-selection-inc" "run_step_id=01BOUND"
+  write_run_step_binding "$d/state" feat-bound-selection 01BOUND bound-selection-inc
+  FM_FAKE_AXI_STATUS="$(run_running fm/feat-bound-selection)"
+  FM_FAKE_AXI_STATUS_RUN_01BOUND="$(run_failed fm/feat-bound-selection | sed 's/id: "01RUN"/id: "01BOUND"/')"
+  export FM_FAKE_AXI_STATUS_RUN_01BOUND
+  out=$(run_crew_state "$d" feat-bound-selection)
+  assert_contains "$out" "state: failed" "bound run id selects its exact terminal run"
+  assert_contains "$out" "run-id=01BOUND" "bound run id remains in the terminal detail"
+  unset FM_FAKE_AXI_STATUS_RUN_01BOUND
+  pass "stored run binding wins over the current same-branch run"
+}
+
 # (e) cross-branch attribution: `axi status` returns ANOTHER branch's run, so the
 # helper finds THIS branch's own run via the run list and inspects it directly.
 test_cross_branch_attribution_via_list() {
@@ -733,7 +888,8 @@ test_dead_window_still_reports_terminal_run_step() {
   local d; d=$(new_case dead-window-done)
   make_repo_on_branch "$d/wt" fm/feat-dead-done
   make_fakebin "$d" >/dev/null
-  fm_write_meta "$d/state/feat-dead-done.meta" "window=fm:fm-feat-dead-done" "worktree=$d/wt" "kind=ship"
+  fm_write_meta "$d/state/feat-dead-done.meta" "window=fm:fm-feat-dead-done" "worktree=$d/wt" "kind=ship" "spawn_incarnation=test-incarnation" "run_step_id=01RUN"
+  write_run_step_binding "$d/state" feat-dead-done 01RUN test-incarnation
   printf 'done: PR https://github.com/o/r/pull/3 checks green\n' > "$d/state/feat-dead-done.status"
   FM_FAKE_AXI_STATUS="$(run_passed fm/feat-dead-done)"
   FM_FAKE_TMUX_MISSING=1   # the crew's window has closed
@@ -883,6 +1039,17 @@ test_missing_meta() {
   pass "missing meta is handled gracefully"
 }
 
+test_missing_state_read_is_side_effect_free() {
+  reset_fakes
+  local d out
+  d=$(new_case missing-state)
+  rmdir "$d/state" || fail "missing-state fixture could not remove its state directory"
+  out=$(run_crew_state "$d" missing-state)
+  assert_contains "$out" "state: unknown" "missing state -> unknown"
+  [ ! -e "$d/state" ] || fail "crew-state recreated missing state"
+  pass "missing state reads remain side-effect free"
+}
+
 # Usage error (no id) is the one non-zero exit.
 test_usage_error() {
   reset_fakes
@@ -1018,8 +1185,15 @@ test_gate_block_parked_not_superseded
 test_ci_ready_done_log_beats_monitoring_run
 test_terminal_passed
 test_terminal_passed_delivery_skipped
+test_bound_run_missing_evidence_fails_closed
+test_pending_run_binding_fails_closed
 test_terminal_passed_delivery_completed
 test_terminal_failed
+test_active_run_does_not_create_incarnation_binding
+test_terminal_first_observation_requires_binding
+test_terminal_candidate_requires_existing_binding
+test_terminal_metadata_run_id_must_match_binding
+test_bound_run_id_is_selected_before_current_run
 test_cross_branch_attribution_via_list
 test_cross_branch_attribution_unquoted_run_list
 test_other_branch_run_ignored
@@ -1040,6 +1214,7 @@ test_unknown_fixing_round_stays_visible_unknown
 test_scout_skips_run_lookup
 test_torn_down_worktree
 test_missing_meta
+test_missing_state_read_is_side_effect_free
 test_usage_error
 test_historical_same_branch_rewritten_head_not_current
 test_active_run_descendant_fix_head_remains_current
diff --git a/tests/fm-inactive-outcome.test.sh b/tests/fm-inactive-outcome.test.sh
new file mode 100755
index 00000000000..9cd2e3ecfe1
--- /dev/null
+++ b/tests/fm-inactive-outcome.test.sh
@@ -0,0 +1,4921 @@
+#!/usr/bin/env bash
+# Focused behavior tests for inactive terminal-outcome replay.
+set -u
+
+# A crewmate's inherited environment is deliberately refused by the production
+# helper. Re-exec the behavior suite once with a clean parent ancestry so its
+# throwaway firstmate homes exercise the primary-only path.
+if [ "${FM_INACTIVE_TEST_CLEAN:-0}" != 1 ]; then
+  exec env -u FM_AGENT_ROLE -u FM_AGENT_TASK -u FM_AGENT_OWNER_HOME \
+    -u FM_PRIMARY_ATTESTATION FM_INACTIVE_TEST_CLEAN=1 /bin/bash "$0" "$@"
+fi
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+# Fixture commits must not depend on the runner's global Git identity. This is
+# especially important on hosted macOS, where the stock Git config may have an
+# empty user name.
+fm_git_identity fmtest fmtest@example.invalid
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+RECON="$ROOT/bin/fm-inactive-reconcile.sh"
+DRAIN="$ROOT/bin/fm-wake-drain.sh"
+TMP_ROOT=$(fm_test_tmproot fm-inactive-outcome)
+trap fm_test_cleanup EXIT
+CASE_DIR=
+CASE_ROOT=
+CASE_HOME=
+CASE_FAKEBIN=
+CASE_THREAD=
+CASE_TOKEN=
+
+new_case() {
+  local name=$1 dir root home state fakebin
+  dir="$TMP_ROOT/$name"
+  root="$dir/root"
+  home="$dir/home"
+  state="$home/state"
+  fakebin="$dir/fakebin"
+  mkdir -p "$state" "$home/data" "$home/config" "$fakebin"
+  git init -q -b main "$root"
+  git -C "$root" commit -q --allow-empty -m init
+  cp "$ROOT/AGENTS.md" "$root/AGENTS.md"
+  mkdir -p "$root/bin" "$home/projects"
+  cat > "$fakebin/fm-crew-state.sh" <<'SH'
+#!/usr/bin/env bash
+set -u
+id=${1:-}
+if [ "${FM_FAKE_CREW_STATE_SIGNAL:-0}" = 1 ]; then
+  kill -TERM $$
+fi
+if [ "${FM_FAKE_CREW_STATE_EXIT:-0}" != 0 ]; then
+  exit "$FM_FAKE_CREW_STATE_EXIT"
+fi
+key=$(printf '%s' "$id" | tr -c 'A-Za-z0-9' '_' | tr '[:lower:]' '[:upper:]')
+var="FM_FAKE_CREW_STATE_$key"
+printf '%s\n' "${!var:-${FM_FAKE_CREW_STATE:-state: unknown · source: none · fake default}}"
+SH
+  chmod +x "$fakebin/fm-crew-state.sh"
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "$*" in
+  *capture-pane*)
+    case "$*" in
+      *" -S -40"*) printf '%s\n' "${FM_FAKE_TMUX_CAPTURE:-idle prompt}" ;;
+      *) : ;;
+    esac
+    ;;
+  *) : ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/tmux"
+  cat > "$fakebin/ps" <<'SH'
+#!/usr/bin/env bash
+set -u
+pid=
+previous=
+for argument in "$@"; do
+  [ "$previous" = -p ] && pid=$argument
+  previous=$argument
+done
+case "$*" in
+  *"lstart="*|*"command="*) exec /usr/bin/ps "$@" ;;
+  *"comm="*|*"args="*)
+    if [ "$pid" = "${FM_FAKE_HARNESS_PID:-}" ]; then
+      printf '%s\n' claude
+    else
+      printf '%s\n' bash
+    fi
+    ;;
+  *"ppid="*) printf '%s\n' "${FM_FAKE_HARNESS_PID:-1}" ;;
+  *) exit 1 ;;
+esac
+SH
+  chmod +x "$fakebin/ps"
+  for tool in gh gh-axi curl; do
+    cat > "$fakebin/$tool" <<'SH'
+#!/usr/bin/env bash
+set -u
+[ -z "${FM_NETWORK_LOG:-}" ] || printf '%s %s\n' "$(basename "$0")" "$*" >> "$FM_NETWORK_LOG"
+exit 97
+SH
+    chmod +x "$fakebin/$tool"
+  done
+  CASE_DIR=$dir
+  CASE_ROOT=$root
+  CASE_HOME=$home
+  CASE_FAKEBIN=$fakebin
+  CASE_THREAD="inactive-${name//[^A-Za-z0-9]/-}"
+}
+
+set_old_mtime() {
+  if touch -d '2 minutes ago' "$@" 2>/dev/null; then
+    return 0
+  fi
+  touch -t "$(date -v-2M '+%Y%m%d%H%M.%S')" "$@"
+}
+
+replace_field() {
+  local file=$1 key=$2 value=$3 tmp
+  tmp=$(mktemp "$file.edit.XXXXXX") || return 1
+  awk -F= -v wanted="$key" -v replacement="$value" '
+    $1 == wanted { print wanted "=" replacement; found=1; next }
+    { print }
+    END { if (!found) print wanted "=" replacement }
+  ' "$file" > "$tmp" || { rm -f "$tmp"; return 1; }
+  mv -f "$tmp" "$file"
+}
+
+direct_file_count() {
+  local dir=$1 pattern=$2 file base count=0
+  for file in "$dir"/*; do
+    [ -f "$file" ] || continue
+    base=${file##*/}
+    # shellcheck disable=SC2254 # pattern intentionally accepts a caller-supplied glob
+    case "$base" in $pattern) count=$((count + 1)) ;; esac
+  done
+  printf '%s' "$count"
+}
+
+direct_first_file() {
+  local dir=$1 pattern=$2 file base
+  for file in "$dir"/*; do
+    [ -f "$file" ] || continue
+    base=${file##*/}
+    # shellcheck disable=SC2254 # pattern intentionally accepts a caller-supplied glob
+    case "$base" in
+      $pattern) printf '%s' "$file"; return 0 ;;
+    esac
+  done
+  return 1
+}
+
+prepare_primary_proof() {
+  local root=$1 home=$2 fakebin=$3 token
+  local state="$home/state"
+  mkdir -p "$state" "$home/projects"
+  if [ ! -f "$state/.primary-attestation" ]; then
+    ( cd "$root" && env -u FM_AGENT_ROLE -u FM_AGENT_TASK -u FM_AGENT_OWNER_HOME \
+        -u FM_PRIMARY_ATTESTATION -u FM_ROOT -u STATE \
+        FM_HOME="$home" FM_ROOT_OVERRIDE="$root" FM_STATE_OVERRIDE="$state" \
+        CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" PATH="$fakebin:$PATH" \
+        bash -c '. "$1"; fm_worker_primary_attestation_prepare' _ \
+        "$ROOT/bin/fm-worker-isolation-lib.sh" ) || fail "primary proof setup failed"
+  fi
+  token=$(awk -F= '$1 == "token" {print substr($0, index($0, "=") + 1); exit}' \
+    "$state/.primary-attestation")
+  [ -n "$token" ] || fail "primary proof token was not persisted"
+  printf '%s|codex:%s|fallback\n' "$$" "$CASE_THREAD" > "$state/.lock"
+  CASE_TOKEN=$token
+}
+
+prepare_watcher_protocol() {
+  local root=$1 home=$2 state=$3 pid_start pid_identity watch arm
+  watch="$root/bin/fm-watch.sh"
+  arm="$root/bin/fm-watch-arm.sh"
+  pid_start=$(FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" bash -c '. "$1/bin/fm-wake-lib.sh"; fm_pid_start "$2"' _ "$ROOT" "$$")
+  pid_identity=$(FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" bash -c '. "$1/bin/fm-wake-lib.sh"; fm_pid_identity "$2"' _ "$ROOT" "$$")
+  mkdir -p "$state/.watch.lock" "$state/.watch-arm.lock"
+  printf '%s\n' "$$" > "$state/.watch.lock/pid"
+  printf '%s\n' "$home" > "$state/.watch.lock/fm-home"
+  printf '%s\n' "$watch" > "$state/.watch.lock/watcher-path"
+  printf '%s\n' "$pid_start" > "$state/.watch.lock/pid-start"
+  printf '%s\n' "$pid_identity" > "$state/.watch.lock/pid-identity"
+  printf '%s\n' pending-reply-ticket-v3 > "$state/.watch.lock/pending-reply-protocol"
+  printf '%s\n' "$$" > "$state/.watch-arm.lock/pid"
+  printf '%s\n' "$home" > "$state/.watch-arm.lock/fm-home"
+  printf '%s\n' "$arm" > "$state/.watch-arm.lock/owner-path"
+  printf '%s\n' "$pid_start" > "$state/.watch-arm.lock/pid-start"
+  printf '%s\n' "$pid_identity" > "$state/.watch-arm.lock/pid-identity"
+}
+
+scan() {
+  local root=$1 home=$2 fakebin=$3 startup=${4:-}
+  if [ -d "$home/state" ] && [ ! -L "$home/state" ]; then
+    prepare_primary_proof "$root" "$home" "$fakebin"
+  fi
+  # The suite runs many process-isolated fixtures in one shell. Keep the
+  # harness default bounded, but leave enough headroom for cumulative host
+  # load; tests that target a specific short budget set it explicitly.
+  ( cd "$root" && env -u FM_AGENT_ROLE -u FM_AGENT_TASK -u FM_AGENT_OWNER_HOME \
+      -u FM_ROOT -u STATE PATH="$fakebin:$PATH" \
+      FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$home/state" \
+      FM_PRIMARY_ATTESTATION="$CASE_TOKEN" CODEX_THREAD_ID="$CASE_THREAD" \
+      FM_FAKE_HARNESS_PID="$$" FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" \
+      FM_INACTIVE_OUTCOME_SECS="${FM_INACTIVE_OUTCOME_SECS:-60}" \
+      FM_INACTIVE_OUTCOME_BUDGET_SECS="${FM_INACTIVE_OUTCOME_BUDGET_SECS:-30}" \
+      "$RECON" scan "$startup" )
+}
+
+drain() {
+  local root=$1 home=$2 fakebin=$3 status generation=${FM_WAKE_DRAIN_GENERATION:-$$} strict=${5:-}
+  [ "${4:-}" = no-generation ] && generation=
+  if [ -d "$home/state" ] && [ ! -L "$home/state" ]; then
+    prepare_primary_proof "$root" "$home" "$fakebin"
+  fi
+  ( cd "$root" && env -u FM_AGENT_ROLE -u FM_AGENT_TASK -u FM_AGENT_OWNER_HOME \
+      -u FM_ROOT -u STATE PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+      FM_STATE_OVERRIDE="$home/state" FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+      CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" \
+      FM_WAKE_DRAIN_DEFER_ACK="${FM_WAKE_DRAIN_DEFER_ACK:-0}" \
+      FM_WAKE_DRAIN_GENERATION="$generation" "$DRAIN" )
+  status=$?
+  [ "$strict" = strict ] && return "$status"
+  [ "$status" = 0 ] || [ "$status" = 3 ] || return "$status"
+}
+
+recon_from_root() {
+  local root=$1 fakebin=$2 home=$3 state=$4 previous=$PWD status
+  shift 4
+  cd "$root" || return 1
+  env -u FM_AGENT_ROLE -u FM_AGENT_TASK -u FM_AGENT_OWNER_HOME \
+    -u FM_ROOT -u STATE PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" "$RECON" "$@"
+  status=$?
+  cd "$previous" || return 1
+  return "$status"
+}
+
+write_meta() {
+  local state=$1 id=$2 token=$3 kind=${4:-ship} backend=${5:-tmux} window
+  window=${6:-tmux:fm-$id}
+  local file="$state/$id.meta"
+  fm_write_meta "$file" \
+    "window=$window" "worktree=$state/work-$id" "project=$state/work-$id" \
+    "harness=echo" "kind=$kind" "mode=$kind" "yolo=off" \
+    "backend=$backend" "spawn_incarnation=$token"
+  mkdir -p "$state/work-$id"
+  printf 'working: fixture\n' > "$state/$id.status"
+  : > "$state/$id.turn-ended"
+  set_old_mtime "$file" "$state/$id.status" "$state/$id.turn-ended"
+  case "$kind" in ship|scout) write_idle_proof "$state" "$id" "$backend" "$window" ;; esac
+}
+
+write_run_step_evidence() {
+  local state=$1 id=$2 incarnation=$3 snapshot=$5 run_id
+  run_id=${6:-run-$id}
+  fm_write_meta "$state/.run-step-incarnation-$id" \
+    schema=fm-jt-run-step-incarnation.v1 task_id="$id" run_id="$run_id" \
+    spawn_incarnation="$incarnation" state=active
+}
+
+write_legacy_meta() {
+  local state=$1 id=$2 kind=${3:-ship} backend=${4:-tmux} window
+  window="tmux:fm-$id"
+  fm_write_meta "$state/$id.meta" \
+    "window=$window" "worktree=$state/work-$id" "project=$state/work-$id" \
+    "harness=echo" "kind=$kind" "mode=$kind" "yolo=off" "backend=$backend"
+  mkdir -p "$state/work-$id"
+  printf 'working: fixture\n' > "$state/$id.status"
+  : > "$state/$id.turn-ended"
+  set_old_mtime "$state/$id.meta" "$state/$id.status" "$state/$id.turn-ended"
+  write_idle_proof "$state" "$id" "$backend" "$window"
+}
+
+write_idle_proof() {
+  local state=$1 id=$2 backend=$3 window=$4 hash
+  if command -v md5 >/dev/null 2>&1; then
+    hash=$(printf '%s' 'idle prompt' | md5 -q)
+  else
+    hash=$(printf '%s' 'idle prompt' | md5sum | awk '{print $1}')
+  fi
+  mkdir -p "$state/.pane-idle"
+  printf '%s\n' "$hash" > "$state/.hash-$(printf '%s' "$window" | tr ':/.' '___')"
+  printf '2\n' > "$state/.count-$(printf '%s' "$window" | tr ':/.' '___')"
+  ( cd "$ROOT" && env -u FM_AGENT_ROLE -u FM_AGENT_TASK -u FM_AGENT_OWNER_HOME \
+      FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$CASE_HOME" FM_STATE_OVERRIDE="$state" \
+      bash -c '. "$1/bin/fm-pane-idle-lib.sh"; fm_pane_idle_write "$2" "$3" "$4" "$5" "$6" "$7" "$8"' _ \
+      "$ROOT" "$state" "$state/$id.meta" "$id" "$window" "$backend" "$hash" 2 ) \
+    || fail "idle proof fixture could not be written"
+}
+
+receipt_value() {
+  local file=$1 key=$2
+  awk -F= -v wanted="$key" '$1 == wanted { print substr($0, index($0, "=") + 1); exit }' "$file"
+}
+
+receipt_fingerprint() {
+  local value=$1 kind=${2:-ship} parent_corr=${3:-} source=${4:-pane}
+  if [ "$kind" = secondmate ]; then
+    value="$value|$kind|$source|$parent_corr"
+  else
+    value="$value|$kind|$source"
+  fi
+  if command -v shasum >/dev/null 2>&1; then
+    printf '%s' "$value" | shasum -a 256 | awk '{print $1}'
+  elif command -v sha256sum >/dev/null 2>&1; then
+    printf '%s' "$value" | sha256sum | awk '{print $1}'
+  else
+    return 1
+  fi
+}
+
+receipt_count() {
+  local state=$1 suffix=$2
+  direct_file_count "$state/terminal-outcomes" "*.$suffix"
+}
+
+queue_count() {
+  local state=$1 count=0 source offset suffix_count
+  if [ -f "$state/.wake-queue" ]; then
+    count=$(awk -F '\t' '$3 == "check" && $4 ~ /^inactive-outcome:/ { n++ } END { print n + 0 }' \
+      "$state/.wake-queue" 2>/dev/null)
+  fi
+  if [ -f "$state/.wake-queue.restore" ]; then
+    source=$(awk -F= '$1 == "source" { print $2; exit }' "$state/.wake-queue.restore")
+    offset=$(awk -F= '$1 == "offset" { print $2; exit }' "$state/.wake-queue.restore")
+    if [ -f "$state/$source" ]; then
+      suffix_count=$(env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$ROOT" \
+        FM_HOME="$CASE_HOME" FM_STATE_OVERRIDE="$state" bash -c \
+        '. "$1/bin/fm-wake-lib.sh"; fm_wake_queue_stream_from_offset "$2" "$3"' _ \
+        "$ROOT" "$state/$source" "$offset" | \
+        awk -F '\t' '$3 == "check" && $4 ~ /^inactive-outcome:/ { n++ } END { print n + 0 }')
+      count=$((count + suffix_count))
+    fi
+  fi
+  printf '%s' "$count"
+}
+
+test_done_and_failed_are_replayed_once() {
+  local dir root home fakebin state rec task fingerprint drain_output
+  new_case done-failed
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" done-x1 inc-done
+  write_meta "$state" failed-x1 inc-failed
+  export FM_FAKE_CREW_STATE_DONE_X1='state: done · source: pane · pane is quiet'
+  export FM_FAKE_CREW_STATE_FAILED_X1='state: failed · source: run-step · checks failed · run-id=run-failed-x1'
+  write_run_step_evidence "$state" failed-x1 inc-failed failed \
+    'state: failed · source: run-step · checks failed · run-id=run-failed-x1'
+  rm -f "$state/.pane-idle/failed-x1"
+  scan "$root" "$home" "$fakebin" --startup >/dev/null
+  [ "$(receipt_count "$state" pending)" = 2 ] || fail "done and failed outcomes did not create two pending receipts"
+  [ "$(queue_count "$state")" = 2 ] || fail "done and failed outcomes did not create two wakes"
+  for rec in "$state"/terminal-outcomes/*.pending; do
+    task=$(receipt_value "$rec" task_id)
+    fingerprint=$(basename "$rec" .pending)
+    [ "$(receipt_value "$rec" schema)" = fm-jt-terminal-outcome.v1 ] || fail "receipt schema was not durable"
+    [ "$(receipt_value "$rec" fingerprint)" = "$fingerprint" ] || fail "receipt fingerprint did not bind its filename"
+    case "$task" in
+      done-x1)
+        [ "$(receipt_value "$rec" incarnation)" = inc-done ] || fail "done receipt used the wrong incarnation"
+        [ "$(receipt_value "$rec" outcome)" = 'done' ] || fail "done receipt outcome was incorrect"
+        [ "$(receipt_value "$rec" terminal_snapshot)" = 'state: done · source: pane · pane is quiet' ] || fail "done receipt snapshot was not exact"
+        [ "$fingerprint" = "$(receipt_fingerprint 'done-x1|inc-done|done|state: done · source: pane · pane is quiet')" ] || fail "done receipt fingerprint was not bound to its fields"
+        ;;
+      failed-x1)
+        [ "$(receipt_value "$rec" incarnation)" = inc-failed ] || fail "failed receipt used the wrong incarnation"
+        [ "$(receipt_value "$rec" outcome)" = failed ] || fail "failed receipt outcome was incorrect"
+        [ "$(receipt_value "$rec" terminal_snapshot)" = 'state: failed · source: run-step · checks failed · run-id=run-failed-x1' ] || fail "failed receipt snapshot was not exact"
+        [ "$fingerprint" = "$(receipt_fingerprint 'failed-x1|inc-failed|failed|state: failed · source: run-step · checks failed · run-id=run-failed-x1' ship '' run-step)" ] || fail "failed receipt fingerprint was not bound to its fields"
+        ;;
+      *) fail "receipt persisted an unexpected task id: $task" ;;
+    esac
+    [ "$(receipt_value "$rec" terminal_source)" != "" ] || fail "receipt lost terminal source"
+    [ "$(receipt_value "$rec" terminal_snapshot)" != "" ] || fail "receipt lost terminal snapshot"
+    [ "$(receipt_value "$rec" parent_home)" = "" ] || fail "firstmate receipt invented a parent route"
+  done
+  rec=$(direct_first_file "$state/terminal-outcomes" '*.pending')
+  fingerprint=$(basename "$rec" .pending)
+  if ( cd "$root" && env -u FM_AGENT_ROLE -u FM_AGENT_TASK -u FM_AGENT_OWNER_HOME \
+      -u FM_ROOT -u STATE PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+      FM_STATE_OVERRIDE="$state" FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+      CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" \
+      "$RECON" ack "inactive-outcome:$fingerprint" >/dev/null 2>&1 ); then
+    fail "direct inactive acknowledgement bypassed the wake drain"
+  fi
+  [ -f "$rec" ] || fail "direct inactive acknowledgement removed its pending receipt"
+  set_old_mtime "$state/.inactive-outcome-reconcile"
+  scan "$root" "$home" "$fakebin" >/dev/null || fail "normal watcher cadence scan failed"
+  scan "$root" "$home" "$fakebin" --startup >/dev/null
+  [ "$(receipt_count "$state" pending)" = 2 ] || fail "rescan duplicated inactive outcome receipts"
+  [ "$(queue_count "$state")" = 2 ] || fail "rescan duplicated inactive outcome wakes"
+  drain_output="$dir/drain.out"
+  drain "$root" "$home" "$fakebin" >"$drain_output" \
+    || fail "drain did not present done and failed outcomes"
+  grep -F 'inactive-outcome:' "$drain_output" >/dev/null \
+    || fail "drain did not emit the inactive outcome wake"
+  grep -F 'task=done-x1' "$drain_output" >/dev/null \
+    || fail "drain output omitted the done outcome"
+  grep -F 'task=failed-x1' "$drain_output" >/dev/null \
+    || fail "drain output omitted the failed outcome"
+  [ "$(receipt_count "$state" pending)" = 0 ] || fail "drain did not acknowledge pending receipts"
+  [ "$(receipt_count "$state" presented)" = 2 ] || fail "drain did not preserve two presented receipts"
+  scan "$root" "$home" "$fakebin" --startup >/dev/null
+  [ "$(receipt_count "$state" presented)" = 2 ] || fail "presented receipts were replayed"
+  [ "$(queue_count "$state")" = 0 ] || fail "presented receipts caused a duplicate wake on rescan"
+  unset FM_FAKE_CREW_STATE_DONE_X1 FM_FAKE_CREW_STATE_FAILED_X1
+  pass "done and failed inactive outcomes are replayed once and acknowledged on drain"
+}
+
+test_run_step_incarnation_evidence_requires_lifecycle_binding() {
+  local dir root home fakebin state
+  new_case run-step-evidence-terminal-only
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" run-step-x1 run-step-inc
+  rm -f "$state/.pane-idle/run-step-x1"
+  export FM_FAKE_CREW_STATE_RUN_STEP_X1='state: done · source: run-step · checks green · run-id=run-step-x1'
+  scan "$root" "$home" "$fakebin" --startup >/dev/null
+  [ "$(receipt_count "$state" pending)" = 0 ] || fail "terminal run-step without a binding created a receipt"
+  [ "$(queue_count "$state")" = 0 ] || fail "terminal run-step without a binding queued a wake"
+  new_case run-step-evidence-bound
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" run-step-x1 run-step-inc
+  rm -f "$state/.pane-idle/run-step-x1"
+  write_run_step_evidence "$state" run-step-x1 run-step-inc \
+    'done' 'state: done · source: run-step · checks green · run-id=run-step-x1' run-step-x1
+  export FM_FAKE_CREW_STATE_RUN_STEP_X1='state: done · source: run-step · checks green · run-id=run-step-x1'
+  scan "$root" "$home" "$fakebin" --startup >/dev/null
+  [ "$(receipt_count "$state" pending)" = 1 ] || fail "bound run-step state did not create a receipt"
+  [ "$(queue_count "$state")" = 1 ] || fail "bound run-step state did not queue a wake"
+  unset FM_FAKE_CREW_STATE_RUN_STEP_X1
+  pass "run-step outcomes require an explicit lifecycle binding"
+}
+
+test_portable_timeout_runner_is_used() {
+  local dir root home fakebin state timeout_log
+  new_case portable-timeout
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  timeout_log="$dir/timeout.log"
+  write_meta "$state" portable-x1 portable-inc
+  cat > "$fakebin/timeout" <<'SH'
+#!/usr/bin/env bash
+set -u
+printf '%s\n' "$*" >> "${FM_TIMEOUT_LOG:?}"
+[ "${1:-}" != --foreground ] || exit 91
+shift
+exec "$@"
+SH
+  chmod +x "$fakebin/timeout"
+  export FM_FAKE_CREW_STATE_PORTABLE_X1='state: done · source: pane · portable timeout' FM_TIMEOUT_LOG="$timeout_log"
+  scan "$root" "$home" "$fakebin" --startup >/dev/null
+  [ "$(receipt_count "$state" pending)" = 1 ] || fail "portable timeout runner did not reconcile the child"
+  [ -s "$timeout_log" ] || fail "portable timeout command was not invoked"
+  grep -F 'portable-x1' "$timeout_log" >/dev/null || fail "portable timeout runner did not receive the child command"
+  export FM_INACTIVE_OUTCOME_FORCE_PORTABLE_TIMEOUT=1
+  export FM_FAKE_CREW_STATE_EXIT=7
+  if scan "$root" "$home" "$fakebin" --startup >/dev/null 2>&1; then
+    fail "portable timeout runner hid a non-zero child status"
+  fi
+  unset FM_FAKE_CREW_STATE_PORTABLE_X1 FM_FAKE_CREW_STATE_EXIT FM_INACTIVE_OUTCOME_FORCE_PORTABLE_TIMEOUT FM_TIMEOUT_LOG
+  pass "inactive scan uses the portable timeout invocation"
+}
+
+test_portable_timeout_preserves_signal_failure() {
+  local dir root home fakebin state
+  new_case portable-timeout-signal
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" signal-x1 signal-inc
+  export FM_FAKE_CREW_STATE_SIGNAL=1 FM_INACTIVE_OUTCOME_FORCE_PORTABLE_TIMEOUT=1
+  if scan "$root" "$home" "$fakebin" --startup >/dev/null 2>&1; then
+    fail "portable timeout runner converted a signal failure into success"
+  fi
+  [ ! -e "$state/.inactive-outcome-reconcile" ] || fail "signal failure advanced the cadence marker"
+  unset FM_FAKE_CREW_STATE_SIGNAL FM_INACTIVE_OUTCOME_FORCE_PORTABLE_TIMEOUT
+  pass "portable timeout preserves signal failures"
+}
+
+test_portable_timeout_expires_child() {
+  local dir root home fakebin state
+  new_case portable-timeout-expiry
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" expiry-x1 expiry-inc
+  cat > "$fakebin/fm-crew-state.sh" <<'SH'
+#!/usr/bin/env bash
+sleep 2
+printf 'state: done · source: pane · should time out\n'
+SH
+  chmod +x "$fakebin/fm-crew-state.sh"
+  export FM_INACTIVE_OUTCOME_FORCE_PORTABLE_TIMEOUT=1 FM_INACTIVE_OUTCOME_BUDGET_SECS=1
+  scan "$root" "$home" "$fakebin" --startup >/dev/null 2>&1 \
+    || fail "portable timeout fallback killed the watcher"
+  [ ! -e "$state/.inactive-outcome-reconcile" ] || fail "portable timeout expiry advanced the cadence marker"
+  [ "$(receipt_count "$state" pending)" = 0 ] || fail "portable timeout expiry created a receipt"
+  unset FM_INACTIVE_OUTCOME_FORCE_PORTABLE_TIMEOUT FM_INACTIVE_OUTCOME_BUDGET_SECS
+  pass "portable timeout fallback propagates child expiry"
+}
+
+test_leading_zero_cadence_is_normalized() {
+  local dir root home fakebin state
+  new_case leading-zero-cadence
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" zero-x1 zero-inc
+  export FM_FAKE_CREW_STATE_ZERO_X1='state: done · source: pane · leading zero'
+  export FM_INACTIVE_OUTCOME_SECS=0080 FM_INACTIVE_OUTCOME_BUDGET_SECS=0010 FM_INACTIVE_OUTCOME_LOCK_WAIT_SECS=008
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "leading-zero cadence aborted the scan"
+  [ "$(receipt_count "$state" pending)" = 1 ] || fail "leading-zero cadence did not reconcile the child"
+  unset FM_FAKE_CREW_STATE_ZERO_X1 FM_INACTIVE_OUTCOME_SECS FM_INACTIVE_OUTCOME_BUDGET_SECS FM_INACTIVE_OUTCOME_LOCK_WAIT_SECS
+  pass "leading-zero cadence values are normalized before arithmetic"
+}
+
+test_oversized_cadence_is_clamped() {
+  local dir root home fakebin state
+  new_case oversized-cadence
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" oversized-x1 oversized-inc
+  export FM_FAKE_CREW_STATE_OVERSIZED_X1='state: done · source: pane · oversized cadence'
+  export FM_INACTIVE_OUTCOME_SECS=999999999999999999999999999999999999
+  touch -t 200001010000 "$state/oversized-x1.meta" "$state/oversized-x1.status" \
+    "$state/oversized-x1.turn-ended" || fail "could not age the oversized cadence fixture"
+  touch -t 200001010000 "$state/.inactive-outcome-reconcile" \
+    || fail "could not age the cadence marker"
+  scan "$root" "$home" "$fakebin" >/dev/null \
+    || fail "oversized cadence value prevented reconciliation"
+  [ "$(receipt_count "$state" pending)" = 1 ] \
+    || fail "oversized cadence value was not clamped before arithmetic"
+  unset FM_FAKE_CREW_STATE_OVERSIZED_X1 FM_INACTIVE_OUTCOME_SECS
+  pass "oversized decimal cadence values clamp before arithmetic"
+}
+
+test_metadata_enumeration_failure_propagates_without_advancing_scan() {
+  local dir root home fakebin state real_perl
+  new_case find-failure
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" find-x1 find-inc
+  real_perl=$(command -v perl)
+  cat > "$fakebin/perl" <<SH
+#!/usr/bin/env bash
+if [ "\$1" = - ] && [ "\$3" = meta ]; then exit 42; fi
+exec "$real_perl" "\$@"
+SH
+  chmod +x "$fakebin/perl"
+  if scan "$root" "$home" "$fakebin" --startup >/dev/null 2>&1; then
+    fail "find enumeration failure was reported as success"
+  fi
+  [ ! -e "$state/.inactive-outcome-reconcile" ] || fail "find failure advanced the cadence marker"
+  [ "$(receipt_count "$state" pending)" = 0 ] || fail "find failure created a receipt"
+  pass "metadata enumeration failures propagate and preserve retry state"
+}
+
+test_find_enumeration_respects_scan_budget() {
+  local dir root home fakebin state find_log real_perl
+  new_case find-budget
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  find_log="$dir/find.log"
+  write_meta "$state" find-budget-x1 find-budget-inc
+  write_meta "$state" find-budget-x2 find-budget-inc-2
+  real_perl=$(command -v perl)
+  cat > "$fakebin/perl" <<SH
+#!/usr/bin/env bash
+if [ "\$1" = - ] && [ "\$3" = meta ]; then
+  : > "\${FM_FIND_LOG:?}"
+  if [ "\$4" = 0 ] || [ -z "\$4" ]; then
+    printf '%s\\0' "\$2/find-budget-x1.meta"
+    printf '%s\\n' 1 > "\$5"
+  else
+    printf '%s\\0' "\$2/find-budget-x2.meta"
+    printf '%s\\n' 2 > "\$5"
+  fi
+  sleep 3
+  exit 0
+fi
+exec "$real_perl" "\$@"
+SH
+  chmod +x "$fakebin/perl"
+  export FM_INACTIVE_OUTCOME_BUDGET_SECS=2 FM_FIND_LOG="$find_log"
+  scan "$root" "$home" "$fakebin" --startup >/dev/null 2>&1 \
+    || fail "slow find enumeration terminated supervision instead of deferring"
+  [ ! -e "$state/.inactive-outcome-reconcile" ] || fail "budget-exhausted enumeration advanced the cadence marker"
+  [ "$(receipt_count "$state" pending)" = 0 ] || fail "budget-exhausted enumeration created a receipt"
+  [ -e "$find_log" ] || fail "bounded scan did not invoke the find child"
+  [ -f "$state/.inactive-outcome-find.incomplete" ] \
+    || fail "budget-exhausted enumeration did not persist resumable progress"
+  [ "$(cat "$state/.inactive-outcome-find.enum.cursor")" = 1 ] \
+    || fail "budget-exhausted enumeration did not persist its source cursor"
+  scan "$root" "$home" "$fakebin" --startup >/dev/null 2>&1 \
+    || fail "resumable enumeration retry terminated supervision"
+  scan "$root" "$home" "$fakebin" --startup >/dev/null 2>&1 \
+    || fail "resumable enumeration suffix retry terminated supervision"
+  [ "$(cat "$state/.inactive-outcome-find.enum.cursor")" = 2 ] \
+    || fail "resumable enumeration restarted from the beginning"
+  unset FM_INACTIVE_OUTCOME_BUDGET_SECS FM_FIND_LOG
+  pass "inactive enumeration is bounded by the per-scan budget"
+}
+
+test_minimum_budget_preserves_direct_scan() {
+  local dir root home fakebin state
+  new_case minimum-direct-scan
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" minimum-x1 minimum-inc
+  cat > "$fakebin/find" <<'SH'
+#!/usr/bin/env bash
+printf '%s\0' "$1/minimum-x1.meta"
+SH
+  chmod +x "$fakebin/find"
+  export FM_FAKE_CREW_STATE_MINIMUM_X1='state: done · source: pane · minimum direct scan'
+  export FM_INACTIVE_OUTCOME_BUDGET_SECS=1
+  scan "$root" "$home" "$fakebin" --startup >/dev/null \
+    || fail "minimum scan budget skipped the direct child scan"
+  [ "$(receipt_count "$state" pending)" = 1 ] \
+    || fail "minimum scan budget did not reconcile the direct child"
+  unset FM_FAKE_CREW_STATE_MINIMUM_X1 FM_INACTIVE_OUTCOME_BUDGET_SECS
+  pass "minimum scan budget preserves the direct child scan"
+}
+
+test_ack_recomputes_fingerprint_from_receipt_fields() {
+  local dir root home fakebin state rec fingerprint field tampered deduped offset remainder
+  for field in task_id incarnation outcome terminal_snapshot kind fingerprint; do
+    new_case "fingerprint-binding-$field"
+    dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+    state="$home/state"
+    write_meta "$state" fingerprint-x1 fingerprint-inc
+    export FM_FAKE_CREW_STATE_FINGERPRINT_X1='state: done · source: pane · original snapshot'
+    scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "fingerprint fixture scan failed for $field"
+    rec=$(direct_first_file "$state/terminal-outcomes" '*.pending')
+    fingerprint=$(basename "$rec" .pending)
+    case "$field" in
+      task_id) tampered='tampered-x1' ;;
+      incarnation) tampered='tampered-inc' ;;
+      outcome) tampered=failed ;;
+      terminal_snapshot) tampered='tampered snapshot' ;;
+      kind) tampered=secondmate ;;
+      fingerprint) tampered='tampered-fingerprint' ;;
+    esac
+    replace_field "$rec" "$field" "$tampered"
+    if drain "$root" "$home" "$fakebin" >/dev/null 2>&1; then
+      fail "drain accepted a receipt whose $field no longer matched its fingerprint"
+    fi
+    [ -f "$rec" ] || fail "$field fingerprint mismatch removed the pending receipt"
+    [ -f "$state/.wake-queue.restore" ] \
+      || fail "$field fingerprint mismatch did not persist its restore boundary"
+    deduped=
+    for candidate in "$state"/.wake-queue.deduped.*; do
+      [ -f "$candidate" ] || continue
+      deduped=$candidate
+      break
+    done
+    [ -n "$deduped" ] || fail "$field fingerprint mismatch did not retain its durable source"
+    offset=$(awk -F= '$1 == "offset" { print $2; exit }' "$state/.wake-queue.restore")
+    remainder=$(env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+      FM_STATE_OVERRIDE="$state" bash -c \
+      '. "$1/bin/fm-wake-lib.sh"; fm_wake_queue_stream_from_offset "$2" "$3"' _ \
+      "$ROOT" "$deduped" "$offset")
+    [ "$(printf '%s\n' "$remainder" | awk -F '\t' -v wanted="inactive-outcome:$fingerprint" '$4 == wanted { n++ } END { print n + 0 }')" = 1 ] \
+      || fail "$field fingerprint mismatch did not preserve its wake for retry"
+    if [ "$field" = fingerprint ]; then
+      [ "$(receipt_value "$rec" fingerprint)" = "$tampered" ] || fail "$field fixture did not retain its tampered serialized value"
+    else
+      [ "$(receipt_value "$rec" fingerprint)" = "$fingerprint" ] || fail "$field fixture changed its filename binding"
+    fi
+    unset FM_FAKE_CREW_STATE_FINGERPRINT_X1
+  done
+  pass "drain recomputes the receipt fingerprint from bound fields"
+}
+
+test_reserved_claim_recovers_to_a_new_wake_row() {
+  local dir root home fakebin state fingerprint old_row new_row
+  new_case claim-recovery
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  fingerprint=$(receipt_fingerprint 'claim-x1|claim-inc|done|state: done · source: pane · claim recovery')
+  mkdir -p "$state/terminal-outcomes"
+  fm_write_meta "$state/terminal-outcomes/$fingerprint.pending" \
+    schema=fm-jt-terminal-outcome.v1 fingerprint="$fingerprint" task_id=claim-x1 \
+    incarnation=claim-inc outcome=done terminal_source=pane \
+    terminal_snapshot='state: done · source: pane · claim recovery' kind=ship
+  old_row='1	1	check	inactive-outcome:'"$fingerprint"$'\told row'
+  new_row='2	2	check	inactive-outcome:'"$fingerprint"$'\tnew row'
+  printf 'schema=fm-inactive-outcome-claim.v1\nfingerprint=%s\nrow=%s\nstate=reserved\ncreated_epoch=1\n' \
+    "$fingerprint" "$old_row" > "$state/terminal-outcomes/.$fingerprint.claim"
+  printf '%s\n' "$new_row" > "$state/.wake-queue"
+  drain "$root" "$home" "$fakebin" >/dev/null || fail "drain did not recover a reserved claim"
+  [ -e "$state/terminal-outcomes/$fingerprint.presented" ] || fail "recovered claim did not present its receipt"
+  [ ! -e "$state/terminal-outcomes/.$fingerprint.claim" ] || fail "recovered claim was not retired"
+  pass "reserved inactive claims recover when the wake row is recreated"
+}
+
+test_presenting_claim_recovers_before_output() {
+  local dir root home fakebin state fingerprint row
+  new_case presenting-claim-recovery
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  fingerprint=$(receipt_fingerprint 'presenting-x1|presenting-inc|done|state: done · source: pane · presenting recovery')
+  mkdir -p "$state/terminal-outcomes"
+  fm_write_meta "$state/terminal-outcomes/$fingerprint.pending" \
+    schema=fm-jt-terminal-outcome.v1 fingerprint="$fingerprint" task_id=presenting-x1 \
+    incarnation=presenting-inc outcome=done terminal_source=pane \
+    terminal_snapshot='state: done · source: pane · presenting recovery' kind=ship
+  row='2	2	check	inactive-outcome:'"$fingerprint"$'\trecreated row'
+  printf 'schema=fm-inactive-outcome-claim.v1\nfingerprint=%s\nrow=1\t1\tcheck\tinactive-outcome:%s\told row\nstate=presenting\ncreated_epoch=1\n' \
+    "$fingerprint" "$fingerprint" > "$state/terminal-outcomes/.$fingerprint.claim"
+  printf '%s\n' "$row" > "$state/.wake-queue"
+  drain "$root" "$home" "$fakebin" >"$dir/presenting.out" \
+    || fail "drain did not recover a presenting claim"
+  grep -F 'recreated row' "$dir/presenting.out" >/dev/null \
+    || fail "recovered presenting claim did not present the recreated wake"
+  [ -e "$state/terminal-outcomes/$fingerprint.presented" ] || fail "recovered presenting claim did not present its receipt"
+  [ ! -e "$state/terminal-outcomes/.$fingerprint.claim" ] || fail "recovered presenting claim was not retired"
+  pass "presenting inactive claims recover before output"
+}
+
+test_output_started_claim_is_not_reprinted() {
+  local dir root home fakebin state fingerprint row
+  new_case output-started-claim
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  fingerprint=$(receipt_fingerprint 'output-started-x1|output-started-inc|done|state: done · source: pane · output started')
+  mkdir -p "$state/terminal-outcomes"
+  fm_write_meta "$state/terminal-outcomes/$fingerprint.pending" \
+    schema=fm-jt-terminal-outcome.v1 fingerprint="$fingerprint" task_id=output-started-x1 \
+    incarnation=output-started-inc outcome=done terminal_source=pane \
+    terminal_snapshot='state: done · source: pane · output started' kind=ship
+  row='2	2	check	inactive-outcome:'"$fingerprint"$'\tpost-output row'
+  printf 'schema=fm-inactive-outcome-claim.v1\nfingerprint=%s\nrow=1\t1\tcheck\tinactive-outcome:%s\told row\nstate=presenting\noutput_started=1\noutput_complete=1\ncreated_epoch=1\n' \
+    "$fingerprint" "$fingerprint" > "$state/terminal-outcomes/.$fingerprint.claim"
+  printf '%s\n' "$row" > "$state/.wake-queue"
+  drain "$root" "$home" "$fakebin" >"$dir/output-started.out" \
+    || fail "drain did not recover an output-started claim"
+  [ ! -s "$dir/output-started.out" ] || fail "output-started claim was printed a second time"
+  [ "$(queue_count "$state")" = 1 ] || fail "output-started claim lost its retry wake"
+  [ -e "$state/terminal-outcomes/.$fingerprint.claim" ] || fail "output-started claim was discarded"
+  [ ! -e "$state/terminal-outcomes/$fingerprint.presented" ] || fail "output-started claim finalized without confirmation"
+  pass "output-started inactive claims fail closed after a drain crash"
+}
+
+test_uncertain_output_claim_fails_closed() {
+  local dir root home fakebin state fingerprint row
+  new_case uncertain-output-claim
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  fingerprint=$(receipt_fingerprint 'uncertain-output-x1|uncertain-output-inc|done|state: done · source: pane · uncertain output')
+  mkdir -p "$state/terminal-outcomes"
+  fm_write_meta "$state/terminal-outcomes/$fingerprint.pending" \
+    schema=fm-jt-terminal-outcome.v1 fingerprint="$fingerprint" task_id=uncertain-output-x1 \
+    incarnation=uncertain-output-inc outcome=done terminal_source=pane \
+    terminal_snapshot='state: done · source: pane · uncertain output' kind=ship
+  row=$'2\t2\tcheck\tinactive-outcome:'"$fingerprint"$'\tuncertain output row'
+  printf 'schema=fm-inactive-outcome-claim.v1\nfingerprint=%s\nrow=%s\nstate=presenting\noutput_started=1\noutput_emitted=1\noutput_complete=0\noutput_confirmed=0\ncreated_epoch=1\n' \
+    "$fingerprint" "$row" > "$state/terminal-outcomes/.$fingerprint.claim"
+  printf '%s\n' "$row" > "$state/.wake-queue"
+  drain "$root" "$home" "$fakebin" >"$dir/uncertain-output.out" \
+    || fail "uncertain output claim drain failed"
+  [ ! -s "$dir/uncertain-output.out" ] || fail "uncertain output claim was reprinted"
+  [ "$(queue_count "$state")" = 1 ] || fail "uncertain output claim lost its retry wake"
+  [ -e "$state/terminal-outcomes/.$fingerprint.claim" ] || fail "uncertain output claim was discarded"
+  [ "$(receipt_value "$state/terminal-outcomes/.$fingerprint.claim" output_confirmed)" = 0 ] \
+    || fail "uncertain output claim was finalized without caller-visible confirmation"
+  [ ! -e "$state/terminal-outcomes/$fingerprint.presented" ] \
+    || fail "uncertain output claim was acknowledged"
+  pass "uncertain output claims fail closed without reprinting"
+}
+
+test_presented_claim_is_acknowledged_in_deferred_drain() {
+  local dir root home fakebin state fingerprint row
+  new_case presented-claim-ack
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  fingerprint=$(receipt_fingerprint 'presented-x1|presented-inc|done|state: done · source: pane · presented claim')
+  mkdir -p "$state/terminal-outcomes"
+  fm_write_meta "$state/terminal-outcomes/$fingerprint.pending" \
+    schema=fm-jt-terminal-outcome.v1 fingerprint="$fingerprint" task_id=presented-x1 \
+    incarnation=presented-inc outcome=done terminal_source=pane \
+    terminal_snapshot='state: done · source: pane · presented claim' kind=ship
+  row=$'2\t2\tcheck\tinactive-outcome:'"$fingerprint"$'\tpresented claim row'
+  printf 'schema=fm-inactive-outcome-claim.v1\nfingerprint=%s\nrow=%s\nstate=presented\noutput_started=1\noutput_complete=1\ndefer_ack=0\ncreated_epoch=1\n' \
+    "$fingerprint" "$row" > "$state/terminal-outcomes/.$fingerprint.claim"
+  printf '%s\n' "$row" > "$state/.wake-queue"
+  if FM_WAKE_DRAIN_DEFER_ACK=1 FM_WAKE_DRAIN_GENERATION="$$" \
+    drain "$root" "$home" "$fakebin" >"$dir/presented-claim.out"; then
+    fail "deferred drain accepted an incomplete presented claim"
+  fi
+  [ ! -s "$dir/presented-claim.out" ] || fail "deferred drain re-presented a completed claim"
+  [ "$(queue_count "$state")" = 1 ] || fail "deferred drain consumed an incomplete presented claim"
+  [ -e "$state/terminal-outcomes/.$fingerprint.claim" ] \
+    || fail "deferred drain discarded an incomplete presented claim"
+  [ ! -e "$state/terminal-outcomes/$fingerprint.reported" ] \
+    || fail "deferred drain reported an incomplete presented claim"
+  pass "deferred drains fail closed on incomplete presented claims"
+}
+
+test_pre_output_claim_retries_after_crash() {
+  local dir root home fakebin state fingerprint row
+  new_case pre-output-claim
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  fingerprint=$(receipt_fingerprint 'pre-output-x1|pre-output-inc|done|state: done · source: pane · pre-output')
+  mkdir -p "$state/terminal-outcomes"
+  fm_write_meta "$state/terminal-outcomes/$fingerprint.pending" \
+    schema=fm-jt-terminal-outcome.v1 fingerprint="$fingerprint" task_id=pre-output-x1 \
+    incarnation=pre-output-inc outcome=done terminal_source=pane \
+    terminal_snapshot='state: done · source: pane · pre-output' kind=ship
+  row=$'2\t2\tcheck\tinactive-outcome:'"$fingerprint"$'\tpre-output row'
+  printf 'schema=fm-inactive-outcome-claim.v1\nfingerprint=%s\nrow=%s\nstate=presenting\noutput_started=1\ncreated_epoch=1\n' \
+    "$fingerprint" "$row" > "$state/terminal-outcomes/.$fingerprint.claim"
+  printf '%s\n' "$row" > "$state/.wake-queue"
+  drain "$root" "$home" "$fakebin" >"$dir/pre-output.out" \
+    || fail "pre-output claim did not recover"
+  grep -F 'pre-output row' "$dir/pre-output.out" >/dev/null \
+    || fail "pre-output claim was suppressed before successful emission"
+  [ -e "$state/terminal-outcomes/$fingerprint.presented" ] \
+    || fail "pre-output retry did not finalize the receipt"
+  pass "pre-output claims retry until emission completes"
+}
+
+test_output_completion_failure_does_not_reprint() {
+  local dir root home fakebin state fingerprint row
+  new_case output-completion-failure
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  fingerprint=$(receipt_fingerprint 'output-failure-x1|output-failure-inc|done|state: done · source: pane · output failure' )
+  mkdir -p "$state/terminal-outcomes"
+  fm_write_meta "$state/terminal-outcomes/$fingerprint.pending" \
+    schema=fm-jt-terminal-outcome.v1 fingerprint="$fingerprint" task_id=output-failure-x1 \
+    incarnation=output-failure-inc outcome=done terminal_source=pane \
+    terminal_snapshot='state: done · source: pane · output failure' kind=ship
+  row=$'2\t2\tcheck\tinactive-outcome:'"$fingerprint"$'\toutput completion failure row'
+  printf '%s\n' "$row" > "$state/.wake-queue"
+  cat > "$fakebin/perl" <<'SH'
+#!/usr/bin/env bash
+set -u
+args=("$@")
+target="${args[$((${#args[@]} - 2))]}"
+source="${args[$((${#args[@]} - 3))]}"
+case "$target" in
+  *.claim)
+    if grep -Fqx 'output_complete=1' "$source" 2>/dev/null; then
+      count=$(cat "${FM_FAIL_CLAIM_MOVE:?}" 2>/dev/null || printf '0')
+      count=$((count + 1))
+      printf '%s\n' "$count" > "$FM_FAIL_CLAIM_MOVE"
+      if [ "$count" = 1 ]; then
+        exit 91
+      fi
+    fi
+    ;;
+esac
+exec /usr/bin/perl "$@"
+SH
+  chmod +x "$fakebin/perl"
+  export FM_FAIL_CLAIM_MOVE="$dir/fail-claim-move"
+  export FM_WAKE_DRAIN_DIRECT=1 FM_WAKE_DRAIN_DEFER_ACK=1 FM_WAKE_DRAIN_GENERATION="$$"
+  if drain "$root" "$home" "$fakebin" '' strict >"$dir/output-failure.out"; then
+    fail "output completion failure was hidden"
+  fi
+  [ "$(grep -Fxc "$row" "$dir/output-failure.out")" = 1 ] \
+    || fail "output completion failure lost or duplicated the emitted row"
+  [ "$(receipt_count "$state" presented)" = 0 ] \
+    || fail "output completion failure finalized the receipt"
+  [ "$(receipt_count "$state" pending)" = 1 ] \
+    || fail "output completion failure did not retain the receipt"
+  [ "$(receipt_value "$state/terminal-outcomes/.$fingerprint.claim" output_started)" = 1 ] \
+    || fail "output completion failure did not retain the emitted marker"
+  [ "$(receipt_value "$state/terminal-outcomes/.$fingerprint.claim" output_emitted)" = 1 ] \
+    || fail "output completion failure did not bind emission state"
+  [ "$(receipt_value "$state/terminal-outcomes/.$fingerprint.claim" output_complete)" = 0 ] \
+    || fail "output completion failure incorrectly persisted completion"
+  drain "$root" "$home" "$fakebin" >"$dir/output-failure-retry.out" \
+    || fail "output completion retry did not finalize the receipt"
+  [ ! -s "$dir/output-failure-retry.out" ] \
+    || fail "output completion retry reprinted the emitted row"
+  [ "$(receipt_count "$state" presented)" = 1 ] \
+    || fail "output completion retry did not finalize the receipt"
+  [ "$(receipt_count "$state" pending)" = 0 ] \
+    || fail "output completion retry left the receipt pending"
+  [ ! -e "$state/terminal-outcomes/.$fingerprint.claim" ] \
+    || fail "output completion retry left a stale claim"
+  unset FM_FAIL_CLAIM_MOVE FM_WAKE_DRAIN_DIRECT FM_WAKE_DRAIN_DEFER_ACK FM_WAKE_DRAIN_GENERATION
+  pass "post-output failures retry without duplicate presentation"
+}
+
+test_direct_drain_finalizes_after_successful_output() {
+  local dir root home fakebin state fingerprint row
+  new_case direct-success
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" direct-x1 direct-inc
+  export FM_FAKE_CREW_STATE_DIRECT_X1='state: done · source: pane · direct presentation'
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "direct receipt setup failed"
+  fingerprint=$(basename "$(direct_first_file "$state/terminal-outcomes" '*.pending')" .pending)
+  row=$(awk -F '\t' -v key="inactive-outcome:$fingerprint" '$4 == key { print; exit }' "$state/.wake-queue")
+  export FM_WAKE_DRAIN_DIRECT=1 FM_WAKE_DRAIN_DEFER_ACK=1 FM_WAKE_DRAIN_GENERATION="$$"
+  drain "$root" "$home" "$fakebin" >"$dir/direct.out" \
+    || fail "direct drain did not finalize a successful presentation"
+  grep -F "$row" "$dir/direct.out" >/dev/null || fail "direct drain did not emit the wake row"
+  [ "$(receipt_count "$state" presented)" = 1 ] || fail "direct drain left the receipt unfinalized"
+  [ "$(receipt_count "$state" pending)" = 0 ] || fail "direct drain left a pending receipt"
+  [ "$(queue_count "$state")" = 0 ] || fail "direct drain left the wake queued"
+  [ ! -e "$state/terminal-outcomes/.$fingerprint.claim" ] || fail "direct drain left a presentation claim"
+  printf '%s\n' "$row" > "$state/.wake-queue"
+  drain "$root" "$home" "$fakebin" >"$dir/direct-replay.out" \
+    || fail "direct replay drain failed"
+  [ ! -s "$dir/direct-replay.out" ] || fail "direct drain replayed a finalized receipt"
+  unset FM_FAKE_CREW_STATE_DIRECT_X1 FM_WAKE_DRAIN_DIRECT FM_WAKE_DRAIN_DEFER_ACK FM_WAKE_DRAIN_GENERATION
+  pass "direct inactive drains finalize successful output once"
+}
+
+test_standalone_drain_refuses_inactive_ack() {
+  local dir root home fakebin state fingerprint row deduped offset remainder
+  new_case standalone-no-generation
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" standalone-x1 standalone-inc
+  export FM_FAKE_CREW_STATE_STANDALONE_X1='state: done · source: pane · standalone presentation'
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "standalone receipt setup failed"
+  fingerprint=$(basename "$(direct_first_file "$state/terminal-outcomes" '*.pending')" .pending)
+  row=$(awk -F '\t' -v key="inactive-outcome:$fingerprint" '$4 == key { print; exit }' "$state/.wake-queue")
+  unset FM_WAKE_DRAIN_DIRECT FM_WAKE_DRAIN_DEFER_ACK FM_WAKE_DRAIN_GENERATION
+  if drain "$root" "$home" "$fakebin" no-generation >"$dir/standalone.out"; then
+    fail "standalone drain acknowledged an inactive outcome without generation"
+  fi
+  [ "$(receipt_count "$state" pending)" = 1 ] || fail "standalone drain removed the pending receipt"
+  [ "$(queue_count "$state")" = 1 ] || fail "standalone drain removed the wake row"
+  [ -f "$state/.wake-queue.restore" ] || fail "standalone drain did not persist its restore boundary"
+  deduped=
+  for candidate in "$state"/.wake-queue.deduped.*; do
+    [ -f "$candidate" ] || continue
+    deduped=$candidate
+    break
+  done
+  [ -n "$deduped" ] || fail "standalone drain did not retain its durable source"
+  offset=$(awk -F= '$1 == "offset" { print $2; exit }' "$state/.wake-queue.restore")
+  remainder=$(env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" bash -c \
+    '. "$1/bin/fm-wake-lib.sh"; fm_wake_queue_stream_from_offset "$2" "$3"' _ \
+    "$ROOT" "$deduped" "$offset")
+  [ "$remainder" = "$row" ] || fail "standalone drain did not retain the wake suffix"
+  unset FM_FAKE_CREW_STATE_STANDALONE_X1
+  pass "standalone drain refuses inactive acknowledgement"
+}
+
+test_finalized_receipt_rows_are_suppressed() {
+  local dir root home fakebin state fingerprint row
+  new_case finalized-row
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" finalized-x1 finalized-inc
+  export FM_FAKE_CREW_STATE_FINALIZED_X1='state: done · source: pane · finalized row'
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "finalized receipt setup failed"
+  fingerprint=$(basename "$(direct_first_file "$state/terminal-outcomes" '*.pending')" .pending)
+  row=$(awk -F '\t' -v key="inactive-outcome:$fingerprint" '$4 == key { print; exit }' "$state/.wake-queue")
+  drain "$root" "$home" "$fakebin" >/dev/null || fail "initial finalized receipt drain failed"
+  printf '%s\n' "$row" > "$state/.wake-queue"
+  drain "$root" "$home" "$fakebin" >"$dir/stale.out" \
+    || fail "stale finalized receipt row was not safely suppressed"
+  [ ! -s "$dir/stale.out" ] || fail "stale finalized receipt row was printed again"
+  [ "$(receipt_count "$state" presented)" = 1 ] || fail "stale finalized receipt changed receipt state"
+  [ ! -e "$state/terminal-outcomes/.$fingerprint.claim" ] || fail "stale finalized receipt left a claim"
+  unset FM_FAKE_CREW_STATE_FINALIZED_X1
+  pass "finalized receipt rows are suppressed after drain rollback"
+}
+
+test_drain_processes_bounded_batches() {
+  local dir root home fakebin state first second remainder
+  new_case drain-batch
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  first=$'1\t1\tcheck\tbatch-first\tfirst batch wake'
+  second=$'1\t2\tcheck\tbatch-second\tsecond batch wake'
+  printf '%s\n%s\n' "$first" "$second" > "$state/.wake-queue"
+  export FM_WAKE_DRAIN_BATCH_ROWS=1
+  drain "$root" "$home" "$fakebin" > "$dir/drain.out" \
+    || fail "bounded wake drain failed"
+  grep -Fqx "$first" "$dir/drain.out" || fail "bounded wake drain skipped its first row"
+  ! grep -Fqx "$second" "$dir/drain.out" || fail "bounded wake drain processed beyond its batch"
+  [ -f "$state/.wake-queue.cursor" ] || fail "bounded wake drain did not persist its offset"
+  remainder=$(env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    bash -c '. "$1/bin/fm-wake-lib.sh"; fm_wake_queue_stream_from_offset "$FM_WAKE_QUEUE" "$(awk -F= '\''$1 == "offset" { print $2 }'\'' "$FM_WAKE_QUEUE.cursor")"' \
+    _ "$ROOT" | sed '/^$/d')
+  [ "$remainder" = "$second" ] || fail "bounded wake drain restored the wrong remainder"
+  unset FM_WAKE_DRAIN_BATCH_ROWS
+  drain "$root" "$home" "$fakebin" > "$dir/drain-remainder.out" \
+    || fail "bounded wake drain did not resume its durable offset"
+  grep -Fqx "$second" "$dir/drain-remainder.out" || fail "durable offset skipped the remainder"
+  [ ! -e "$state/.wake-queue.cursor" ] || fail "durable offset was not cleared after drain completion"
+  [ ! -s "$state/.wake-queue" ] || fail "bounded wake drain left processed rows queued"
+  pass "wake drain restores unprocessed bounded batches"
+}
+
+test_wake_cursor_survives_processed_row_removal() {
+  local dir root home fakebin state first second remainder
+  new_case wake-cursor-removal
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  first=$'1\t1\tcheck\tcursor-first\tfirst cursor wake'
+  second=$'1\t2\tcheck\tcursor-second\tsecond cursor wake'
+  printf '%s\n%s\n' "$first" "$second" > "$state/.wake-queue"
+  export FM_WAKE_DRAIN_BATCH_ROWS=1
+  drain "$root" "$home" "$fakebin" > "$dir/drain.out" \
+    || fail "cursor removal setup drain failed"
+  unset FM_WAKE_DRAIN_BATCH_ROWS
+  env -u FM_AGENT_ROLE -u FM_AGENT_TASK -u FM_AGENT_OWNER_HOME \
+    -u FM_ROOT -u STATE PATH="$fakebin:$PATH" FM_SESSION_LOCK_BOOTSTRAP=1 \
+    FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" bash -c '
+      . "$1/bin/fm-wake-lib.sh"
+      fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK" || exit 1
+      status=0
+      fm_wake_remove_key_locked cursor-second || status=$?
+      fm_lock_release "$FM_WAKE_QUEUE_LOCK" || status=1
+      exit "$status"
+    ' _ "$ROOT" || fail "processed-row removal failed"
+  [ -f "$state/.wake-queue.cursor" ] || fail "processed-row removal discarded the cursor"
+  remainder=$(env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" bash -c '. "$1/bin/fm-wake-lib.sh"; fm_wake_queue_cursor_read && fm_wake_queue_stream_from_offset "$FM_WAKE_QUEUE" "$FM_WAKE_QUEUE_CURSOR_OFFSET"' \
+    _ "$ROOT" | sed '/^$/d')
+  [ -z "$remainder" ] || fail "processed-row removal replayed a consumed wake"
+  drain "$root" "$home" "$fakebin" > "$dir/retry.out" \
+    || fail "drain after processed-row removal failed"
+  ! grep -Fqx "$first" "$dir/retry.out" || fail "processed wake replayed after row removal"
+  [ ! -e "$state/.wake-queue.cursor" ] || fail "cursor remained after removed-row retry"
+  [ ! -s "$state/.wake-queue" ] || fail "removed-row retry left queue data"
+  pass "wake cursor survives removal of processed rows"
+}
+
+test_malformed_finalized_receipt_fails_closed() {
+  local dir root home fakebin state fingerprint row
+  new_case malformed-finalized-receipt
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" malformed-finalized-x1 malformed-finalized-inc
+  export FM_FAKE_CREW_STATE_MALFORMED_FINALIZED_X1='state: done · source: pane · malformed finalized'
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "malformed finalized receipt setup failed"
+  fingerprint=$(basename "$(direct_first_file "$state/terminal-outcomes" '*.pending')" .pending)
+  row=$(awk -F '\t' -v key="inactive-outcome:$fingerprint" '$4 == key { print; exit }' "$state/.wake-queue")
+  drain "$root" "$home" "$fakebin" >/dev/null || fail "initial finalized receipt drain failed"
+  replace_field "$state/terminal-outcomes/$fingerprint.presented" task_id tampered-finalized
+  printf '%s\n' "$row" > "$state/.wake-queue"
+  if drain "$root" "$home" "$fakebin" >"$dir/malformed-finalized.out" 2>&1; then
+    fail "malformed finalized receipt was suppressed"
+  fi
+  [ "$(queue_count "$state")" = 1 ] || fail "malformed finalized receipt wake was consumed"
+  [ "$(receipt_count "$state" presented)" = 1 ] || fail "malformed finalized receipt state disappeared"
+  unset FM_FAKE_CREW_STATE_MALFORMED_FINALIZED_X1
+  pass "malformed finalized receipts fail closed before wake suppression"
+}
+
+test_deferred_ack_retries_after_caller_crash() {
+  local dir root home fakebin state fingerprint row replayed_row drain_output rec
+  new_case deferred-ack
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" deferred-x1 deferred-inc
+  export FM_FAKE_CREW_STATE_DEFERRED_X1='state: done · source: pane · deferred presentation'
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "deferred receipt setup failed"
+  fingerprint=$(basename "$(direct_first_file "$state/terminal-outcomes" '*.pending')" .pending)
+  row=$(awk -F '\t' -v key="inactive-outcome:$fingerprint" '$4 == key { print; exit }' "$state/.wake-queue")
+  [ -n "$row" ] || fail "deferred receipt did not queue its wake"
+  drain_output="$dir/deferred.out"
+  export FM_WAKE_DRAIN_DEFER_ACK=1 FM_WAKE_DRAIN_GENERATION="$$"
+  if ! drain "$root" "$home" "$fakebin" >"$drain_output"; then
+    fail "deferred wake drain failed"
+  fi
+  [ -f "$state/terminal-outcomes/$fingerprint.pending" ] || fail "deferred drain consumed the receipt before caller confirmation"
+  [ ! -e "$state/terminal-outcomes/$fingerprint.presented" ] || fail "deferred drain finalized the receipt before caller confirmation"
+  [ "$(receipt_value "$state/terminal-outcomes/.$fingerprint.claim" state)" = presenting ] \
+    || fail "deferred drain did not retain the presentation claim"
+  [ "$(receipt_value "$state/terminal-outcomes/.$fingerprint.claim" defer_ack)" = 1 ] \
+    || fail "deferred drain did not mark the claim for caller confirmation"
+  [ "$(receipt_value "$state/terminal-outcomes/.$fingerprint.claim" output_started)" = 1 ] \
+    || fail "deferred drain did not persist the emitted handoff"
+  [ "$(receipt_value "$state/terminal-outcomes/.$fingerprint.claim" output_complete)" = 1 ] \
+    || fail "deferred drain did not persist output completion"
+  replayed_row=$'2\t2\tcheck\tinactive-outcome:'"$fingerprint"$'\treplayed deferred row'
+  printf '%s\n' "$replayed_row" > "$state/.wake-queue"
+  drain "$root" "$home" "$fakebin" >"$dir/live-deferred.out" \
+    || fail "live deferred claim drain failed"
+  [ ! -s "$dir/live-deferred.out" ] || fail "live deferred claim was presented twice"
+  [ "$(receipt_value "$state/terminal-outcomes/.$fingerprint.claim" row)" = "$row" ] \
+    || fail "live deferred claim row was replaced by a replayed wake"
+  [ -f "$state/terminal-outcomes/$fingerprint.pending" ] \
+    || fail "live deferred claim was acknowledged before caller confirmation"
+  replace_field "$state/terminal-outcomes/.$fingerprint.claim" defer_generation "$$"
+  replace_field "$state/terminal-outcomes/.$fingerprint.claim" defer_generation_start proc:0
+  rm -f "$state/deferred-x1.meta" "$state/deferred-x1.status" "$state/deferred-x1.turn-ended"
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "pending deferred receipt was not republished after caller crash"
+  [ "$(queue_count "$state")" = 1 ] || fail "pending deferred receipt did not get a retry wake"
+  row=$(awk -F '\t' -v key="inactive-outcome:$fingerprint" '$4 == key { print; exit }' "$state/.wake-queue")
+  drain_output="$dir/retry.out"
+  export FM_WAKE_DRAIN_DEFER_ACK=1 FM_WAKE_DRAIN_GENERATION="$$"
+  drain "$root" "$home" "$fakebin" >"$drain_output" \
+    || fail "retry drain did not recover the deferred confirmation handoff"
+  [ -e "$state/terminal-outcomes/$fingerprint.presented" ] || fail "retry drain did not recover the deferred receipt"
+  [ ! -e "$state/terminal-outcomes/$fingerprint.pending" ] || fail "retry drain left the receipt pending"
+  [ ! -e "$state/terminal-outcomes/.$fingerprint.claim" ] || fail "retry drain left the deferred claim"
+  [ ! -s "$drain_output" ] || fail "retry drain re-presented an already emitted row"
+  unset FM_WAKE_DRAIN_DEFER_ACK FM_WAKE_DRAIN_GENERATION FM_FAKE_CREW_STATE_DEFERRED_X1
+  pass "deferred inactive receipts recover after caller crash"
+}
+
+test_deferred_drain_kills_presentation_descendants() {
+  local dir root home fakebin state marker fingerprint row
+  new_case deferred-descendant-cleanup
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  marker="$dir/descendant-survived"
+  write_meta "$state" deferred-descendant-x1 deferred-descendant-inc
+  export FM_FAKE_CREW_STATE_DEFERRED_DESCENDANT_X1='state: done · source: pane · descendant cleanup'
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "descendant cleanup receipt setup failed"
+  fingerprint=$(basename "$(direct_first_file "$state/terminal-outcomes" '*.pending')" .pending)
+  row=$(awk -F '\t' -v key="inactive-outcome:$fingerprint" '$4 == key { print; exit }' "$state/.wake-queue")
+  [ -n "$row" ] || fail "descendant cleanup receipt did not queue its wake"
+  cat > "$fakebin/timeout" <<'SH'
+#!/usr/bin/env bash
+set -u
+shift
+( sleep 2; printf 'survived\n' > "${FM_DESCENDANT_MARKER:?}" ) &
+descendant=$!
+"$@" >/dev/null 2>&1 &
+child=$!
+sleep 5
+kill "$child" 2>/dev/null || true
+wait "$child" 2>/dev/null || true
+kill "$descendant" 2>/dev/null || true
+wait "$descendant" 2>/dev/null || true
+exit 124
+SH
+  chmod +x "$fakebin/timeout"
+  export FM_WAKE_DRAIN_DEFER_ACK=1 FM_WAKE_DRAIN_GENERATION="$$" \
+    FM_WAKE_DRAIN_PRESENTATION_TIMEOUT_SECS=1 FM_DESCENDANT_MARKER="$marker"
+  if drain "$root" "$home" "$fakebin" >"$dir/descendant.out"; then
+    fail "presentation timeout was hidden"
+  fi
+  sleep 3
+  [ ! -e "$marker" ] || fail "presentation descendant survived timeout cleanup"
+  unset FM_WAKE_DRAIN_DEFER_ACK FM_WAKE_DRAIN_GENERATION \
+    FM_WAKE_DRAIN_PRESENTATION_TIMEOUT_SECS FM_DESCENDANT_MARKER \
+    FM_FAKE_CREW_STATE_DEFERRED_DESCENDANT_X1
+  pass "presentation timeout cleanup kills descendant processes"
+}
+
+test_deferred_output_completion_waits_for_confirmation() {
+  local dir root home fakebin state fingerprint row
+  new_case deferred-output-complete-retry
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  fingerprint=$(receipt_fingerprint 'deferred-retry-x1|deferred-retry-inc|done|state: done · source: pane · deferred output retry')
+  mkdir -p "$state/terminal-outcomes"
+  fm_write_meta "$state/terminal-outcomes/$fingerprint.pending" \
+    schema=fm-jt-terminal-outcome.v1 fingerprint="$fingerprint" task_id=deferred-retry-x1 \
+    incarnation=deferred-retry-inc outcome=done terminal_source=pane \
+    terminal_snapshot='state: done · source: pane · deferred output retry' kind=ship
+  row=$'2\t2\tcheck\tinactive-outcome:'"$fingerprint"$'\tdeferred output retry row'
+  printf '%s\n' "$row" > "$state/.wake-queue"
+  export FM_WAKE_DRAIN_DEFER_ACK=1 FM_WAKE_DRAIN_GENERATION="$$"
+  drain "$root" "$home" "$fakebin" >"$dir/deferred-retry.out" \
+    || fail "deferred output-complete drain failed"
+  [ "$(receipt_value "$state/terminal-outcomes/.$fingerprint.claim" state)" = presenting ] \
+    || fail "deferred output-complete drain advanced the claim before confirmation"
+  [ "$(receipt_value "$state/terminal-outcomes/.$fingerprint.claim" output_complete)" = 1 ] \
+    || fail "deferred output-complete drain did not persist completion"
+  [ -f "$state/terminal-outcomes/$fingerprint.pending" ] \
+    || fail "deferred output-complete drain consumed the receipt early"
+  [ ! -e "$state/terminal-outcomes/$fingerprint.presented" ] \
+    || fail "deferred output-complete drain presented before confirmation"
+  recon_from_root "$root" "$fakebin" "$home" "$state" \
+      caller-output-complete "inactive-outcome:$fingerprint" "$row" \
+    || fail "deferred output-complete drain rejected caller completion"
+  recon_from_root "$root" "$fakebin" "$home" "$state" \
+      confirm "inactive-outcome:$fingerprint" "$row" \
+    || fail "deferred output-complete drain rejected caller confirmation"
+  [ -e "$state/terminal-outcomes/$fingerprint.presented" ] \
+    || fail "deferred output-complete drain did not finalize after confirmation"
+  [ ! -e "$state/terminal-outcomes/.$fingerprint.claim" ] \
+    || fail "deferred output-complete drain left a claim"
+  unset FM_WAKE_DRAIN_DEFER_ACK FM_WAKE_DRAIN_GENERATION
+  pass "deferred output completion waits for caller confirmation"
+}
+
+test_deferred_output_completion_failure_retains_emitted_row() {
+  local dir root home fakebin state fingerprint row
+  new_case deferred-output-complete-failure
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  fingerprint=$(receipt_fingerprint 'deferred-failure-x1|deferred-failure-inc|done|state: done · source: pane · deferred output failure')
+  mkdir -p "$state/terminal-outcomes"
+  fm_write_meta "$state/terminal-outcomes/$fingerprint.pending" \
+    schema=fm-jt-terminal-outcome.v1 fingerprint="$fingerprint" task_id=deferred-failure-x1 \
+    incarnation=deferred-failure-inc outcome=done terminal_source=pane \
+    terminal_snapshot='state: done · source: pane · deferred output failure' kind=ship
+  row=$'2\t2\tcheck\tinactive-outcome:'"$fingerprint"$'\tdeferred output failure row'
+  printf '%s\n' "$row" > "$state/.wake-queue"
+  cat > "$fakebin/perl" <<'SH'
+#!/usr/bin/env bash
+set -u
+args=("$@")
+target="${args[$((${#args[@]} - 2))]}"
+source="${args[$((${#args[@]} - 3))]}"
+case "$target" in
+  *.claim)
+    if grep -Fqx 'output_complete=1' "$source" 2>/dev/null; then
+      count=$(cat "${FM_FAIL_CLAIM_MOVE:?}" 2>/dev/null || printf '0')
+      count=$((count + 1))
+      printf '%s\n' "$count" > "$FM_FAIL_CLAIM_MOVE"
+      [ "$count" -le 2 ] || exec /usr/bin/mv "$@"
+      exit 91
+    fi
+    ;;
+esac
+exec /usr/bin/perl "$@"
+SH
+  chmod +x "$fakebin/perl"
+  export FM_FAIL_CLAIM_MOVE="$dir/fail-claim-move"
+  export FM_WAKE_DRAIN_DEFER_ACK=1 FM_WAKE_DRAIN_GENERATION="$$"
+  if drain "$root" "$home" "$fakebin" '' strict >"$dir/deferred-failure.out"; then
+    fail "deferred output-complete persistence failure was hidden"
+  fi
+  [ "$(grep -Fxc "$row" "$dir/deferred-failure.out")" = 1 ] \
+    || fail "deferred output-complete failure duplicated or lost the emitted row"
+  [ "$(queue_count "$state")" = 1 ] \
+    || fail "deferred output-complete failure did not retain the wake row"
+  [ "$(receipt_value "$state/terminal-outcomes/.$fingerprint.claim" output_started)" = 1 ] \
+    || fail "deferred output-complete failure lost the emitted marker"
+  [ "$(receipt_value "$state/terminal-outcomes/.$fingerprint.claim" output_emitted)" = 1 ] \
+    || fail "deferred output-complete failure lost the emission state"
+  [ "$(receipt_value "$state/terminal-outcomes/.$fingerprint.claim" output_complete)" = 0 ] \
+    || fail "deferred output-complete failure persisted completion"
+  replace_field "$state/terminal-outcomes/.$fingerprint.claim" defer_generation_start proc:0
+  rm -f "$fakebin/perl"
+  unset FM_FAIL_CLAIM_MOVE FM_WAKE_DRAIN_DEFER_ACK FM_WAKE_DRAIN_GENERATION
+  drain "$root" "$home" "$fakebin" >"$dir/deferred-failure-retry.out" \
+    || fail "deferred output-complete retry did not retain the emitted row"
+  [ ! -s "$dir/deferred-failure-retry.out" ] \
+    || fail "deferred output-complete retry reprinted the emitted row"
+  [ ! -e "$state/terminal-outcomes/$fingerprint.presented" ] \
+    || fail "deferred output-complete retry finalized without caller confirmation"
+  [ -e "$state/terminal-outcomes/$fingerprint.pending" ] \
+    || fail "deferred output-complete retry lost the receipt"
+  [ "$(queue_count "$state")" = 1 ] \
+    || fail "deferred output-complete retry lost the wake"
+  pass "deferred output completion failures retain uncertain rows"
+}
+
+test_deferred_ack_confirms_after_caller_emission() {
+  local dir root home fakebin state fingerprint row drain_output
+  new_case deferred-confirm
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" deferred-confirm-x1 deferred-confirm-inc
+  export FM_FAKE_CREW_STATE_DEFERRED_CONFIRM_X1='state: done · source: pane · deferred confirmation'
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "deferred confirmation setup failed"
+  fingerprint=$(basename "$(direct_first_file "$state/terminal-outcomes" '*.pending')" .pending)
+  row=$(awk -F '\t' -v key="inactive-outcome:$fingerprint" '$4 == key { print; exit }' "$state/.wake-queue")
+  drain_output="$dir/deferred-confirm.out"
+  export FM_WAKE_DRAIN_DEFER_ACK=1 FM_WAKE_DRAIN_GENERATION="$$"
+  drain "$root" "$home" "$fakebin" >"$drain_output" \
+    || fail "deferred confirmation drain failed"
+  printf '%s\n' "$(cat "$drain_output")" > "$dir/caller-visible.out"
+  if env -u FM_AGENT_ROLE -u FM_AGENT_TASK -u FM_AGENT_OWNER_HOME \
+    -u FM_ROOT -u STATE PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" bash -c \
+    'cd "$4"; "$1" caller-output-complete "$2" "$3"; status=$?; exit "$status"' _ "$RECON" \
+    "inactive-outcome:$fingerprint" "$row" "$root"; then
+    fail "foreign caller finalized a deferred receipt"
+  fi
+  recon_from_root "$root" "$fakebin" "$home" "$state" \
+      caller-output-complete "inactive-outcome:$fingerprint" "$row" \
+    || fail "caller output confirmation did not finalize the receipt"
+  recon_from_root "$root" "$fakebin" "$home" "$state" \
+      confirm "inactive-outcome:$fingerprint" "$row" \
+    || fail "caller confirmation did not finalize the receipt"
+  [ -e "$state/terminal-outcomes/$fingerprint.presented" ] \
+    || fail "caller confirmation did not move the receipt"
+  [ ! -e "$state/terminal-outcomes/$fingerprint.pending" ] \
+    || fail "caller confirmation left the receipt pending"
+  [ ! -e "$state/terminal-outcomes/.$fingerprint.claim" ] \
+    || fail "caller confirmation left the claim"
+  unset FM_WAKE_DRAIN_DEFER_ACK FM_WAKE_DRAIN_GENERATION FM_FAKE_CREW_STATE_DEFERRED_CONFIRM_X1
+  pass "deferred inactive receipts finalize after caller emission"
+}
+
+test_deferred_ack_recovers_after_output_confirmation() {
+  local dir root home fakebin state fingerprint row drain_output
+  new_case deferred-output-recovery
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" deferred-output-recovery-x1 deferred-output-recovery-inc
+  export FM_FAKE_CREW_STATE_DEFERRED_OUTPUT_RECOVERY_X1='state: done · source: pane · deferred output recovery'
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "deferred output recovery setup failed"
+  fingerprint=$(basename "$(direct_first_file "$state/terminal-outcomes" '*.pending')" .pending)
+  row=$(awk -F '\t' -v key="inactive-outcome:$fingerprint" '$4 == key { print; exit }' "$state/.wake-queue")
+  export FM_WAKE_DRAIN_DEFER_ACK=1 FM_WAKE_DRAIN_GENERATION="$$"
+  drain "$root" "$home" "$fakebin" >"$dir/deferred-output-recovery.out" \
+    || fail "deferred output recovery drain failed"
+  recon_from_root "$root" "$fakebin" "$home" "$state" \
+      caller-output-complete "inactive-outcome:$fingerprint" "$row" \
+    || fail "caller output confirmation failed"
+  replace_field "$state/terminal-outcomes/.$fingerprint.claim" defer_generation_start proc:0
+  printf '%s\n' "$row" > "$state/.wake-queue"
+  drain_output="$dir/deferred-output-recovery-retry.out"
+  drain "$root" "$home" "$fakebin" >"$drain_output" \
+    || fail "deferred output recovery retry failed"
+  [ ! -s "$drain_output" ] || fail "confirmed output was presented again after caller crash"
+  [ -e "$state/terminal-outcomes/$fingerprint.presented" ] \
+    || fail "confirmed output was not acknowledged during recovery"
+  [ ! -e "$state/terminal-outcomes/.$fingerprint.claim" ] \
+    || fail "confirmed output left a recovery claim"
+  unset FM_WAKE_DRAIN_DEFER_ACK FM_WAKE_DRAIN_GENERATION FM_FAKE_CREW_STATE_DEFERRED_OUTPUT_RECOVERY_X1
+  pass "deferred inactive receipts recover confirmed output without replay"
+}
+
+test_pending_receipts_replay_after_child_scan_failure() {
+  local dir root home fakebin state
+  new_case pending-replay-after-failure
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" pending-replay-x1 pending-replay-inc
+  export FM_FAKE_CREW_STATE_PENDING_REPLAY_X1='state: done · source: pane · pending replay'
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "pending replay setup failed"
+  : > "$state/.wake-queue"
+  export FM_FAKE_CREW_STATE_EXIT=19
+  if scan "$root" "$home" "$fakebin" --startup >/dev/null 2>&1; then
+    fail "child scan failure was reported as success during pending replay"
+  fi
+  [ "$(queue_count "$state")" = 1 ] || fail "pending receipt was not replayed after child scan failure"
+  unset FM_FAKE_CREW_STATE_PENDING_REPLAY_X1 FM_FAKE_CREW_STATE_EXIT
+  pass "pending receipts replay independently after child scan failure"
+}
+
+test_scan_failure_retries_without_advancing_cadence() {
+  local dir root home fakebin state wake_dir wake_removed retry_out
+  new_case scan-failure
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  wake_dir="$dir/wake"
+  wake_removed="$dir/wake-removed"
+  mkdir -p "$wake_dir"
+  : > "$wake_dir/queue"
+  write_meta "$state" first-x1 first-inc
+  write_meta "$state" second-x1 second-inc
+  cat > "$fakebin/fm-crew-state.sh" <<'SH'
+#!/usr/bin/env bash
+set -u
+if [ "${FM_BREAK_QUEUE:-0}" = 1 ]; then
+  if [ -e "${FM_BREAK_QUEUE_MARKER:-}" ]; then
+    mv "${FM_WAKE_QUEUE_DIR}" "${FM_WAKE_QUEUE_REMOVED}"
+  else
+    : > "${FM_BREAK_QUEUE_MARKER}"
+  fi
+fi
+printf 'state: done · source: pane · scan retry\n'
+SH
+  chmod +x "$fakebin/fm-crew-state.sh"
+  export FM_WAKE_QUEUE="$wake_dir/queue" FM_WAKE_QUEUE_LOCK="$wake_dir/lock"
+  export FM_WAKE_QUEUE_DIR="$wake_dir" FM_WAKE_QUEUE_REMOVED="$wake_removed" \
+    FM_BREAK_QUEUE_MARKER="$dir/scan-first" FM_BREAK_QUEUE=1
+  scan "$root" "$home" "$fakebin" --startup >/dev/null 2>&1 \
+    || fail "retryable wake publication contention stopped the scan"
+  [ ! -e "$state/.inactive-outcome-reconcile" ] || fail "failed scan advanced the cadence marker"
+  [ "$(receipt_count "$state" pending)" = 1 ] || fail "receipt was created without publication-lock ownership"
+  for leaked in "$state"/.first-x1.inactive-state.*; do
+    [ -e "$leaked" ] || continue
+    fail "failed crew-state scan leaked its temporary output"
+  done
+  for leaked in "$state"/.second-x1.inactive-state.*; do
+    [ -e "$leaked" ] || continue
+    fail "failed crew-state scan leaked its temporary output"
+  done
+  if ! grep -l '^task_id=first-x1$' "$state"/terminal-outcomes/*.pending >/dev/null 2>&1 \
+    && ! grep -l '^task_id=second-x1$' "$state"/terminal-outcomes/*.pending >/dev/null 2>&1; then
+    fail "a successfully published child receipt was not retained"
+  fi
+  case "$(cat "$state/.inactive-outcome-reconcile.cursor")" in
+    first-x1|second-x1) ;;
+    *) fail "cursor did not preserve the last successful child" ;;
+  esac
+  mv "$wake_removed" "$wake_dir"
+  export FM_BREAK_QUEUE=0
+  if ! retry_out=$(scan "$root" "$home" "$fakebin" --startup 2>&1); then
+    fail "retry after child failure did not complete: $retry_out"
+  fi
+  [ "$(receipt_count "$state" pending)" = 2 ] || fail "failed child was skipped on retry"
+  unset FM_WAKE_QUEUE FM_WAKE_QUEUE_LOCK FM_WAKE_QUEUE_DIR FM_WAKE_QUEUE_REMOVED FM_BREAK_QUEUE
+  pass "scan failures preserve retry state and cadence"
+}
+
+test_state_paths_reject_symlinks_and_non_directories() {
+  local dir root home fakebin state real_state
+  new_case symlink-state
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  real_state="$dir/real-state"
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  mv "$state" "$real_state"
+  ln -s "$real_state" "$state"
+  if scan "$root" "$home" "$fakebin" --startup >/dev/null 2>&1; then
+    fail "symlinked state path was accepted"
+  fi
+  [ ! -e "$real_state/.inactive-outcome-reconcile" ] || fail "symlinked state received a cadence marker"
+
+  new_case file-state
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  mv "$state" "$dir/state-directory"
+  printf 'not a directory\n' > "$state"
+  if scan "$root" "$home" "$fakebin" --startup >/dev/null 2>&1; then
+    fail "non-directory state path was accepted"
+  fi
+  pass "inactive reconciliation rejects unsafe state paths"
+}
+
+test_reused_task_id_gets_new_fingerprint() {
+  local dir root home fakebin state rec first_fp second_fp incarnation fingerprint
+  new_case reused-id
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" reused-x1 incarnation-old
+  export FM_FAKE_CREW_STATE_REUSED_X1='state: done · source: pane · first run quiet'
+  scan "$root" "$home" "$fakebin" --startup >/dev/null
+  replace_field "$state/reused-x1.meta" spawn_incarnation incarnation-new
+  write_idle_proof "$state" reused-x1 tmux tmux:fm-reused-x1
+  set_old_mtime "$state/reused-x1.meta"
+  scan "$root" "$home" "$fakebin" --startup >/dev/null
+  [ "$(receipt_count "$state" pending)" = 2 ] || fail "reused task id did not create a new incarnation receipt"
+  [ "$(queue_count "$state")" = 2 ] || fail "reused task id did not create a new fingerprinted wake"
+  for rec in "$state"/terminal-outcomes/*.pending; do
+    [ "$(receipt_value "$rec" task_id)" = reused-x1 ] || fail "reused task receipt lost its task id"
+    incarnation=$(receipt_value "$rec" incarnation)
+    case "$incarnation" in incarnation-old|incarnation-new) ;; *) fail "reused task receipt lost its incarnation" ;; esac
+    [ "$(receipt_value "$rec" outcome)" = 'done' ] || fail "reused task receipt lost its outcome"
+    [ "$(receipt_value "$rec" terminal_snapshot)" = 'state: done · source: pane · first run quiet' ] || fail "reused task receipt snapshot was not exact"
+    fingerprint=$(basename "$rec" .pending)
+    [ "$fingerprint" = "$(receipt_fingerprint "reused-x1|$incarnation|done|state: done · source: pane · first run quiet")" ] || fail "reused task fingerprint was not bound to its fields"
+  done
+  first_fp=
+  second_fp=
+  for rec in "$state"/terminal-outcomes/*.pending; do
+    if [ -z "$first_fp" ]; then
+      first_fp=$(basename "$rec" .pending)
+    else
+      second_fp=$(basename "$rec" .pending)
+    fi
+  done
+  [ -n "$first_fp" ] && [ -n "$second_fp" ] && [ "$first_fp" != "$second_fp" ] \
+    || fail "reused task receipts did not retain distinct fingerprints"
+  unset FM_FAKE_CREW_STATE_REUSED_X1
+  pass "reused task ids are separated by the spawn incarnation"
+}
+
+test_spawn_publishes_incarnation_token() {
+  local dir root home fakebin state project worktree tmux_state pane_pid out status meta token evidence run_id tasktmp bridge_output
+  new_case spawn-contract
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  project="$dir/project"
+  worktree="$dir/worktree"
+  tmux_state="$dir/tmux-window-name"
+  git init -q -b main "$project"
+  git -C "$project" commit -q --allow-empty -m init
+  git -C "$project" worktree add -q --detach "$worktree"
+  mkdir -p "$home/data/spawn-contract" "$home/projects" "$home/config"
+  printf 'spawn contract brief\n' > "$home/data/spawn-contract/brief.md"
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+  case "$*" in
+    *"#{pane_current_path}"*) printf '%s\n' "${FM_FAKE_PANE_PATH:-}"; exit 0 ;;
+    *"#{pane_pid}"*) printf '%s\n' "${FM_FAKE_PANE_PID:-}"; exit 0 ;;
+    *"#{window_name}"*) cat "$FM_FAKE_TMUX_STATE"; exit 0 ;;
+esac
+case "${1:-}" in
+  display-message|list-windows|has-session|new-session|send-keys|kill-window|set-window-option) exit 0 ;;
+  new-window) printf '%s\n' '@42'; exit 0 ;;
+  rename-window) printf '%s\n' "${@: -1}" > "$FM_FAKE_TMUX_STATE"; exit 0 ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/tmux"
+  cat > "$fakebin/treehouse" <<'SH'
+#!/usr/bin/env bash
+exit 0
+SH
+  chmod +x "$fakebin/treehouse"
+  cat > "$fakebin/no-mistakes" <<'SH'
+#!/usr/bin/env bash
+printf 'run:\n  id: "01SPAWNCONTRACT"\n  status: running\n'
+SH
+  chmod +x "$fakebin/no-mistakes"
+  : > "$tmux_state"
+  ( cd "$worktree" && exec sleep 30 ) >/dev/null 2>&1 &
+  pane_pid=$!
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  out=$(cd "$root" && env -u NO_MISTAKES_GATE -u FM_AGENT_ROLE -u FM_AGENT_TASK -u FM_AGENT_OWNER_HOME \
+    -u FM_ROOT -u STATE PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$home/data" FM_PROJECTS_OVERRIDE="$home/projects" \
+    FM_CONFIG_OVERRIDE="$home/config" FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_SPAWN_NO_GUARD=1 \
+    FM_FAKE_PANE_PATH="$worktree" FM_FAKE_PANE_PID="$pane_pid" FM_FAKE_TMUX_STATE="$tmux_state" TMUX=fake,1,0 \
+    FM_SPAWN_WT_WAIT_SECS=3 "$root/bin/fm-spawn.sh" spawn-contract "$project" \
+    --harness codex 2>&1)
+  status=$?
+  kill "$pane_pid" 2>/dev/null || true
+  [ "$status" = 0 ] || fail "public fm-spawn path failed: $out"
+  meta="$state/spawn-contract.meta"
+  [ -f "$meta" ] || fail "public fm-spawn path did not publish metadata"
+  token=$(receipt_value "$meta" spawn_incarnation)
+  case "$token" in ''|legacy-unknown) fail "public fm-spawn path published no incarnation token" ;; esac
+  grep -F 'spawn_incarnation=' "$meta" >/dev/null || fail "spawn metadata omitted its incarnation field"
+  evidence="$state/.run-step-incarnation-spawn-contract"
+  [ ! -e "$evidence" ] && [ ! -L "$evidence" ] || fail "spawn fabricated a run-step binding without the actual no-mistakes run id"
+  [ "$(grep -c '^run_step_id=' "$meta" 2>/dev/null || true)" = 0 ] || fail "spawn persisted a synthetic run-step id"
+  tasktmp=$(receipt_value "$meta" tasktmp)
+  [ -x "$tasktmp/bin/no-mistakes" ] || fail "spawn did not install the run-id bridge"
+  bridge_output=$(cd "$root" && env PATH="$tasktmp/bin:$fakebin:$PATH" no-mistakes axi run 2>&1) \
+    || fail "run-id bridge rejected the actual no-mistakes run output"
+  printf '%s\n' "$bridge_output" | grep -Fqx '  id: "01SPAWNCONTRACT"' \
+    || fail "run-id bridge did not preserve no-mistakes output"
+  [ "$(receipt_value "$evidence" run_id)" = 01SPAWNCONTRACT ] \
+    || fail "run-id bridge did not persist the actual no-mistakes run id"
+  [ "$(receipt_value "$evidence" state)" = active ] \
+    || fail "run-id bridge did not activate evidence after metadata binding"
+  [ "$(receipt_value "$evidence" spawn_incarnation)" = "$token" ] \
+    || fail "run-id bridge bound the wrong spawn incarnation"
+  [ "$(receipt_value "$meta" run_binding_state)" = bound ] \
+    || fail "run-id bridge did not mark the spawn metadata bound"
+  [ "$(receipt_value "$meta" run_id)" = 01SPAWNCONTRACT ] \
+    || fail "run-id bridge did not persist the actual run id in spawn metadata"
+  mkdir -p "$home/data/spawn-mismatch"
+  printf 'spawn mismatch brief\n' > "$home/data/spawn-mismatch/brief.md"
+  mv "$root/bin/fm-wake-lib.sh" "$root/bin/fm-wake-lib.real.sh"
+  sed 's/^fm_lock_try_acquire() {/fm_original_lock_try_acquire() {/' \
+    "$root/bin/fm-wake-lib.real.sh" > "$root/bin/fm-wake-lib.sh"
+  cat >> "$root/bin/fm-wake-lib.sh" <<'SH'
+fm_lock_try_acquire() {
+  fm_original_lock_try_acquire "$@"
+  local rc=$? owner
+  if [ "$rc" = 0 ] && [ "$1" = "${FM_TEST_LOCK_PATH:?}" ]; then
+    owner=$(fm_lock_link_owner "$1") || return 1
+    printf 'wrong-incarnation\n' > "$owner/incarnation"
+  fi
+  return "$rc"
+}
+SH
+  chmod +x "$root/bin/fm-wake-lib.sh"
+  export FM_TEST_LOCK_PATH="$state/.spawn-spawn-mismatch.lock"
+  out=$(cd "$root" && env -u NO_MISTAKES_GATE -u FM_AGENT_ROLE -u FM_AGENT_TASK -u FM_AGENT_OWNER_HOME \
+    -u FM_ROOT -u STATE PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$home/data" FM_PROJECTS_OVERRIDE="$home/projects" \
+    FM_CONFIG_OVERRIDE="$home/config" FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_SPAWN_NO_GUARD=1 \
+    FM_FAKE_PANE_PATH="$worktree" FM_FAKE_PANE_PID="$pane_pid" FM_FAKE_TMUX_STATE="$tmux_state" TMUX=fake,1,0 \
+    FM_SPAWN_WT_WAIT_SECS=3 "$root/bin/fm-spawn.sh" spawn-mismatch "$project" \
+    --harness codex 2>&1)
+  status=$?
+  [ "$status" -ne 0 ] || fail "mismatched lock incarnation was accepted"
+  [ ! -e "$state/spawn-mismatch.meta" ] || fail "mismatched lock incarnation published task metadata"
+  unset FM_TEST_LOCK_PATH
+  pass "public fm-spawn publishes the incarnation token in task metadata"
+}
+
+test_run_bridge_rejects_relaunched_generation() {
+  local dir root home fakebin state handoff lock held release holder bridge_pid status
+  new_case bridge-generation
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  handoff="$state/.run-step-handoff-bridge-race"
+  lock="$state/.spawn-bridge-race.lock"
+  held="$dir/lock-held"
+  release="$dir/release-lock"
+  fm_write_meta "$state/bridge-race.meta" \
+    window=tmux:fm-bridge-race worktree="$state/work-bridge-race" \
+    project="$state/work-bridge-race" harness=echo kind=ship mode=no-mistakes \
+    yolo=off spawn_incarnation=inc-a run_binding_state=pending \
+    run_binding_handoff=.run-step-handoff-bridge-race
+  mkdir -p "$state/work-bridge-race"
+  fm_write_meta "$handoff" schema=fm-jt-run-step-handoff.v1 task_id=bridge-race \
+    spawn_incarnation=inc-a state=pending
+  cat > "$fakebin/real-no-mistakes" <<'SH'
+#!/usr/bin/env bash
+printf 'run:\n  id: "01OLDGENERATION"\n'
+SH
+  chmod +x "$fakebin/real-no-mistakes"
+  FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_TASK_LOCK_PATH="$lock" \
+    bash -c '. "$1/bin/fm-wake-lib.sh"; fm_lock_acquire_wait "$FM_TASK_LOCK_PATH" || exit 1; : > "$2"; while [ ! -e "$3" ]; do sleep 0.01; done; fm_lock_release "$FM_TASK_LOCK_PATH"' \
+    _ "$root" "$held" "$release" &
+  holder=$!
+  for _ in $(seq 1 100); do
+    [ -e "$held" ] && break
+    sleep 0.01
+  done
+  [ -e "$held" ] || fail "generation race fixture did not acquire the task lock"
+  FM_RUN_BINDING_ROOT="$root" FM_RUN_BINDING_HOME="$home" \
+    FM_RUN_BINDING_STATE="$state" FM_RUN_BINDING_TASK=bridge-race \
+    FM_RUN_BINDING_INCARNATION=inc-a FM_RUN_BINDING_HANDOFF="$handoff" \
+    FM_RUN_BINDING_TMP="$dir" FM_SESSION_LOCK_BOOTSTRAP=1 \
+    "$root/bin/fm-run-step-bridge.sh" wrap "$fakebin/real-no-mistakes" axi run \
+    > "$dir/bridge.out" 2>&1 &
+  bridge_pid=$!
+  sleep 0.1
+  fm_write_meta "$state/bridge-race.meta" \
+    window=tmux:fm-bridge-race worktree="$state/work-bridge-race" \
+    project="$state/work-bridge-race" harness=echo kind=ship mode=no-mistakes \
+    yolo=off spawn_incarnation=inc-b run_binding_state=pending \
+    run_binding_handoff=.run-step-handoff-bridge-race
+  fm_write_meta "$handoff" schema=fm-jt-run-step-handoff.v1 task_id=bridge-race \
+    spawn_incarnation=inc-b state=pending
+  : > "$release"
+  wait "$holder" || fail "generation race lock holder failed"
+  status=0
+  wait "$bridge_pid" || status=$?
+  [ "$status" -ne 0 ] || fail "stale bridge published after a generation change"
+  [ ! -e "$state/.run-step-incarnation-bridge-race" ] || \
+    fail "stale bridge wrote run evidence for the relaunched task"
+  [ "$(receipt_value "$state/bridge-race.meta" spawn_incarnation)" = inc-b ] || \
+    fail "generation race changed the relaunched incarnation"
+  [ "$(receipt_value "$state/bridge-race.meta" run_binding_state)" = pending ] || \
+    fail "generation race marked the relaunched metadata bound"
+  [ "$(grep -c '^run_id=' "$state/bridge-race.meta" 2>/dev/null || true)" = 0 ] || \
+    fail "generation race left a stale run id in relaunched metadata"
+  pass "run binding rejects stale bridge generations"
+}
+
+test_run_bridge_metadata_stage_failure_preserves_committed_pair() {
+  local dir root home fakebin state handoff meta evidence status
+  new_case bridge-metadata-stage
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  handoff="$state/.run-step-handoff-bridge-metadata-stage"
+  meta="$state/bridge-metadata-stage.meta"
+  evidence="$state/.run-step-incarnation-bridge-metadata-stage"
+  fm_write_meta "$meta" \
+    window=tmux:fm-bridge-metadata-stage worktree="$state/work-bridge-metadata-stage" \
+    project="$state/work-bridge-metadata-stage" harness=echo kind=ship mode=no-mistakes \
+    yolo=off spawn_incarnation=inc-a run_binding_state=bound run_id=01STABLE \
+    run_binding_handoff=.run-step-handoff-bridge-metadata-stage
+  mkdir -p "$state/work-bridge-metadata-stage"
+  fm_write_meta "$handoff" schema=fm-jt-run-step-handoff.v1 task_id=bridge-metadata-stage \
+    spawn_incarnation=inc-a state=bound run_id=01STABLE
+  fm_write_meta "$evidence" schema=fm-jt-run-step-incarnation.v1 \
+    task_id=bridge-metadata-stage run_id=01STABLE spawn_incarnation=inc-a state=active
+  cat > "$fakebin/real-no-mistakes" <<'SH'
+#!/usr/bin/env bash
+printf 'run:\n  id: "01STABLE"\n'
+SH
+  chmod +x "$fakebin/real-no-mistakes"
+  cat > "$fakebin/perl" <<'SH'
+#!/usr/bin/env bash
+set -u
+if [ "$#" -ge 5 ] && [ "$4" = "${FM_TEST_META_TARGET:?}" ]; then
+  exit 91
+fi
+exec /usr/bin/perl "$@"
+SH
+  chmod +x "$fakebin/perl"
+  set +e
+  env PATH="$fakebin:$PATH" FM_RUN_BINDING_ROOT="$root" FM_RUN_BINDING_HOME="$home" \
+    FM_RUN_BINDING_STATE="$state" FM_RUN_BINDING_TASK=bridge-metadata-stage \
+    FM_RUN_BINDING_INCARNATION=inc-a FM_RUN_BINDING_HANDOFF="$handoff" \
+    FM_RUN_BINDING_TMP="$dir" FM_TEST_META_TARGET="$meta" FM_SESSION_LOCK_BOOTSTRAP=1 \
+    "$root/bin/fm-run-step-bridge.sh" wrap "$fakebin/real-no-mistakes" axi run \
+    > "$dir/bridge.out" 2>&1
+  status=$?
+  set -u
+  [ "$status" -ne 0 ] || fail "metadata staging failure was treated as success"
+  [ "$(receipt_value "$meta" run_binding_state)" = bound ] \
+    || fail "metadata staging failure changed the committed metadata state"
+  [ "$(receipt_value "$evidence" state)" = active ] \
+    || fail "metadata staging failure replaced committed active evidence"
+  pass "run binding metadata staging failure preserves the committed pair"
+}
+
+test_run_bridge_rejects_staged_run_rebinding() {
+  local dir root home fakebin state handoff meta evidence fail_marker status
+  new_case bridge-staged-rebinding
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  handoff="$state/.run-step-handoff-bridge-staged-rebinding"
+  meta="$state/bridge-staged-rebinding.meta"
+  evidence="$state/.run-step-incarnation-bridge-staged-rebinding"
+  fail_marker="$dir/fail-evidence-mv"
+  fm_write_meta "$meta" \
+    window=tmux:fm-bridge-staged-rebinding worktree="$state/work-bridge-staged-rebinding" \
+    project="$state/work-bridge-staged-rebinding" harness=echo kind=ship mode=no-mistakes \
+    yolo=off spawn_incarnation=inc-a run_binding_state=pending \
+    run_binding_handoff=.run-step-handoff-bridge-staged-rebinding
+  mkdir -p "$state/work-bridge-staged-rebinding"
+  fm_write_meta "$handoff" schema=fm-jt-run-step-handoff.v1 task_id=bridge-staged-rebinding \
+    spawn_incarnation=inc-a state=pending
+  : > "$fail_marker"
+  cat > "$fakebin/perl" <<'SH'
+#!/usr/bin/env bash
+set -u
+if [ "$#" -ge 5 ] && [ "$4" = "${FM_TEST_EVIDENCE_TARGET:?}" ] && [ -e "${FM_TEST_EVIDENCE_FAIL:?}" ]; then
+  rm -f "$FM_TEST_EVIDENCE_FAIL"
+  exit 91
+fi
+exec /usr/bin/perl "$@"
+SH
+  chmod +x "$fakebin/perl"
+  cat > "$fakebin/real-no-mistakes" <<'SH'
+#!/usr/bin/env bash
+printf 'run:\n  id: "01STAGEDORIGINAL"\n'
+SH
+  chmod +x "$fakebin/real-no-mistakes"
+  set +e
+  env PATH="$fakebin:$PATH" FM_RUN_BINDING_ROOT="$root" FM_RUN_BINDING_HOME="$home" \
+    FM_RUN_BINDING_STATE="$state" FM_RUN_BINDING_TASK=bridge-staged-rebinding \
+    FM_RUN_BINDING_INCARNATION=inc-a FM_RUN_BINDING_HANDOFF="$handoff" \
+    FM_RUN_BINDING_TMP="$dir" FM_TEST_EVIDENCE_TARGET="$evidence" \
+    FM_TEST_EVIDENCE_FAIL="$fail_marker" FM_SESSION_LOCK_BOOTSTRAP=1 \
+    "$root/bin/fm-run-step-bridge.sh" wrap "$fakebin/real-no-mistakes" axi run \
+    > "$dir/first.out" 2>&1
+  status=$?
+  set -u
+  [ "$status" -ne 0 ] || fail "initial staged publication failure was treated as success"
+  [ "$(receipt_value "$meta" run_binding_state)" = staged ] \
+    || fail "initial publication failure did not leave staged metadata"
+  [ "$(receipt_value "$meta" run_id)" = 01STAGEDORIGINAL ] \
+    || fail "initial publication failure did not retain its run id"
+  [ ! -e "$evidence" ] && [ ! -L "$evidence" ] \
+    || fail "initial publication failure unexpectedly published evidence"
+  cat > "$fakebin/real-no-mistakes" <<'SH'
+#!/usr/bin/env bash
+printf 'run:\n  id: "01STAGEDREBOUND"\n'
+SH
+  chmod +x "$fakebin/real-no-mistakes"
+  set +e
+  env PATH="$fakebin:$PATH" FM_RUN_BINDING_ROOT="$root" FM_RUN_BINDING_HOME="$home" \
+    FM_RUN_BINDING_STATE="$state" FM_RUN_BINDING_TASK=bridge-staged-rebinding \
+    FM_RUN_BINDING_INCARNATION=inc-a FM_RUN_BINDING_HANDOFF="$handoff" \
+    FM_RUN_BINDING_TMP="$dir" FM_TEST_EVIDENCE_TARGET="$evidence" \
+    FM_TEST_EVIDENCE_FAIL="$fail_marker" FM_SESSION_LOCK_BOOTSTRAP=1 \
+    "$root/bin/fm-run-step-bridge.sh" wrap "$fakebin/real-no-mistakes" axi run \
+    > "$dir/second.out" 2>&1
+  status=$?
+  set -u
+  [ "$status" -ne 0 ] || fail "staged run binding was rebound to a new run id"
+  [ "$(receipt_value "$meta" run_binding_state)" = bound ] \
+    || fail "staged binding recovery did not activate the original metadata state"
+  [ "$(receipt_value "$meta" run_id)" = 01STAGEDORIGINAL ] \
+    || fail "rejected rebinding changed the staged run id"
+  [ "$(receipt_value "$evidence" state)" = active ] \
+    || fail "staged binding recovery did not publish active evidence"
+  [ "$(receipt_value "$evidence" run_id)" = 01STAGEDORIGINAL ] \
+    || fail "staged binding recovery published a replacement run id"
+  pass "staged run bindings reject rebinding within one incarnation"
+}
+
+test_run_bridge_rejects_existing_evidence_rebinding() {
+  local dir root home fakebin state handoff meta evidence status
+  run_case() {
+    local evidence_state=$1 expected_run=$2
+    new_case "bridge-existing-evidence-$evidence_state"
+    dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+    state="$home/state"
+    cp -a "$ROOT/bin/." "$root/bin/"
+    handoff="$state/.run-step-handoff-bridge-existing-evidence"
+    meta="$state/bridge-existing-evidence.meta"
+    evidence="$state/.run-step-incarnation-bridge-existing-evidence"
+    fm_write_meta "$meta" \
+      window=tmux:fm-bridge-existing-evidence worktree="$state/work-bridge-existing-evidence" \
+      project="$state/work-bridge-existing-evidence" harness=echo kind=ship mode=no-mistakes \
+      yolo=off spawn_incarnation=inc-a run_binding_state=pending \
+      run_binding_handoff=.run-step-handoff-bridge-existing-evidence
+    mkdir -p "$state/work-bridge-existing-evidence"
+    fm_write_meta "$handoff" schema=fm-jt-run-step-handoff.v1 task_id=bridge-existing-evidence \
+      spawn_incarnation=inc-a state=pending
+    fm_write_meta "$evidence" schema=fm-jt-run-step-incarnation.v1 \
+      task_id=bridge-existing-evidence run_id="$expected_run" spawn_incarnation=inc-a \
+      state="$evidence_state"
+    cat > "$fakebin/real-no-mistakes" <<'SH'
+#!/usr/bin/env bash
+printf 'run:\n  id: "01REPLACEMENT"\n'
+SH
+    chmod +x "$fakebin/real-no-mistakes"
+    set +e
+    env PATH="$fakebin:$PATH" FM_RUN_BINDING_ROOT="$root" FM_RUN_BINDING_HOME="$home" \
+      FM_RUN_BINDING_STATE="$state" FM_RUN_BINDING_TASK=bridge-existing-evidence \
+      FM_RUN_BINDING_INCARNATION=inc-a FM_RUN_BINDING_HANDOFF="$handoff" \
+      FM_RUN_BINDING_TMP="$dir" FM_SESSION_LOCK_BOOTSTRAP=1 \
+      "$root/bin/fm-run-step-bridge.sh" wrap "$fakebin/real-no-mistakes" axi run \
+      > "$dir/bridge.out" 2>&1
+    status=$?
+    set -u
+    [ "$status" -ne 0 ] || fail "existing $evidence_state evidence was overwritten"
+    [ "$(receipt_value "$meta" run_binding_state)" = pending ] \
+      || fail "existing $evidence_state evidence changed metadata state"
+    [ "$(receipt_value "$evidence" run_id)" = "$expected_run" ] \
+      || fail "existing $evidence_state evidence changed its run id"
+    [ "$(receipt_value "$evidence" state)" = "$evidence_state" ] \
+      || fail "existing $evidence_state evidence changed its state"
+  }
+  run_case staged 01STAGED
+  run_case corrupt 01CORRUPT
+  pass "existing run evidence rejects replacement binding"
+}
+
+test_run_bridge_rejects_bound_metadata_without_evidence() {
+  local dir root home fakebin state handoff meta evidence status
+  new_case bridge-bound-missing-evidence
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  handoff="$state/.run-step-handoff-bridge-bound-missing-evidence"
+  meta="$state/bridge-bound-missing-evidence.meta"
+  evidence="$state/.run-step-incarnation-bridge-bound-missing-evidence"
+  fm_write_meta "$meta" \
+    window=tmux:fm-bridge-bound-missing-evidence worktree="$state/work-bridge-bound-missing-evidence" \
+    project="$state/work-bridge-bound-missing-evidence" harness=echo kind=ship mode=no-mistakes \
+    yolo=off spawn_incarnation=inc-a run_binding_state=bound run_id=01ORIGINAL \
+    run_binding_handoff=.run-step-handoff-bridge-bound-missing-evidence
+  mkdir -p "$state/work-bridge-bound-missing-evidence"
+  fm_write_meta "$handoff" schema=fm-jt-run-step-handoff.v1 task_id=bridge-bound-missing-evidence \
+    spawn_incarnation=inc-a state=bound run_id=01ORIGINAL
+  cat > "$fakebin/real-no-mistakes" <<'SH'
+#!/usr/bin/env bash
+printf 'run:\n  id: "01REPLACEMENT"\n'
+SH
+  chmod +x "$fakebin/real-no-mistakes"
+  set +e
+  env PATH="$fakebin:$PATH" FM_RUN_BINDING_ROOT="$root" FM_RUN_BINDING_HOME="$home" \
+    FM_RUN_BINDING_STATE="$state" FM_RUN_BINDING_TASK=bridge-bound-missing-evidence \
+    FM_RUN_BINDING_INCARNATION=inc-a FM_RUN_BINDING_HANDOFF="$handoff" \
+    FM_RUN_BINDING_TMP="$dir" FM_SESSION_LOCK_BOOTSTRAP=1 \
+    "$root/bin/fm-run-step-bridge.sh" wrap "$fakebin/real-no-mistakes" axi run \
+    > "$dir/bridge.out" 2>&1
+  status=$?
+  set -u
+  [ "$status" -ne 0 ] || fail "bound metadata without evidence was rebound"
+  [ "$(receipt_value "$meta" run_binding_state)" = bound ] \
+    || fail "bound metadata without evidence changed state"
+  [ "$(receipt_value "$meta" run_id)" = 01ORIGINAL ] \
+    || fail "bound metadata without evidence changed run id"
+  [ ! -e "$evidence" ] && [ ! -L "$evidence" ] \
+    || fail "bound metadata without evidence published replacement evidence"
+  pass "bound metadata without evidence rejects replacement binding"
+}
+
+test_run_bridge_total_wait_is_bounded() {
+  local dir root home fakebin state handoff meta evidence status started elapsed
+  new_case bridge-total-wait
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  handoff="$state/.run-step-handoff-bridge-total-wait"
+  meta="$state/bridge-total-wait.meta"
+  evidence="$state/.run-step-incarnation-bridge-total-wait"
+  fm_write_meta "$meta" \
+    window=tmux:fm-bridge-total-wait worktree="$state/work-bridge-total-wait" \
+    project="$state/work-bridge-total-wait" harness=echo kind=ship mode=no-mistakes \
+    yolo=off spawn_incarnation=inc-a run_binding_state=pending \
+    run_binding_handoff=.run-step-handoff-bridge-total-wait
+  mkdir -p "$state/work-bridge-total-wait"
+  fm_write_meta "$handoff" schema=fm-jt-run-step-handoff.v1 task_id=bridge-total-wait \
+    spawn_incarnation=inc-a state=pending
+  cat > "$fakebin/real-no-mistakes" <<'SH'
+#!/usr/bin/env bash
+printf 'run:\n  id: "01TOTALWAIT"\n'
+while :; do :; done
+SH
+  chmod +x "$fakebin/real-no-mistakes"
+  started=$(date +%s)
+  set +e
+  env PATH="$fakebin:$PATH" FM_RUN_BINDING_ROOT="$root" FM_RUN_BINDING_HOME="$home" \
+    FM_RUN_BINDING_STATE="$state" FM_RUN_BINDING_TASK=bridge-total-wait \
+    FM_RUN_BINDING_INCARNATION=inc-a FM_RUN_BINDING_HANDOFF="$handoff" \
+    FM_RUN_BINDING_TMP="$dir" FM_RUN_BINDING_TOTAL_WAIT_SECS=1 FM_SESSION_LOCK_BOOTSTRAP=1 \
+    "$root/bin/fm-run-step-bridge.sh" wrap "$fakebin/real-no-mistakes" axi run \
+    > "$dir/bridge.out" 2>&1
+  status=$?
+  set -u
+  elapsed=$(( $(date +%s) - started ))
+  [ "$status" -ne 0 ] || fail "bridge accepted a child that exceeded its total wait"
+  [ "$elapsed" -le 5 ] || fail "bridge total wait exceeded its bound: ${elapsed}s"
+  [ "$(receipt_value "$meta" run_binding_state)" = pending ] \
+    || fail "bridge total timeout changed pending metadata"
+  [ ! -e "$evidence" ] && [ ! -L "$evidence" ] \
+    || fail "bridge total timeout published incomplete evidence"
+  pass "run bridge total wait is bounded"
+}
+
+test_run_bridge_timeout_terminates_descendants() {
+  local dir root home fakebin state handoff meta evidence desc_pid status
+  new_case bridge-descendant-timeout
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  handoff="$state/.run-step-handoff-bridge-descendant-timeout"
+  meta="$state/bridge-descendant-timeout.meta"
+  evidence="$state/.run-step-incarnation-bridge-descendant-timeout"
+  fm_write_meta "$meta" \
+    window=tmux:fm-bridge-descendant-timeout worktree="$state/work-bridge-descendant-timeout" \
+    project="$state/work-bridge-descendant-timeout" harness=echo kind=ship mode=no-mistakes \
+    yolo=off spawn_incarnation=inc-a run_binding_state=pending \
+    run_binding_handoff=.run-step-handoff-bridge-descendant-timeout
+  mkdir -p "$state/work-bridge-descendant-timeout"
+  fm_write_meta "$handoff" schema=fm-jt-run-step-handoff.v1 task_id=bridge-descendant-timeout \
+    spawn_incarnation=inc-a state=pending
+  cat > "$fakebin/real-no-mistakes" <<'SH'
+#!/usr/bin/env bash
+set -u
+printf 'run:\n  id: "01DESCENDANTTIMEOUT"\n'
+(sleep 30) &
+printf '%s\n' "$!" > "${FM_TEST_DESCENDANT_PID:?}"
+while :; do sleep 1; done
+SH
+  chmod +x "$fakebin/real-no-mistakes"
+  set +e
+  env PATH="$fakebin:$PATH" FM_RUN_BINDING_ROOT="$root" FM_RUN_BINDING_HOME="$home" \
+    FM_RUN_BINDING_STATE="$state" FM_RUN_BINDING_TASK=bridge-descendant-timeout \
+    FM_RUN_BINDING_INCARNATION=inc-a FM_RUN_BINDING_HANDOFF="$handoff" \
+    FM_RUN_BINDING_TMP="$dir" FM_RUN_BINDING_TOTAL_WAIT_SECS=1 \
+    FM_TEST_DESCENDANT_PID="$dir/descendant.pid" FM_SESSION_LOCK_BOOTSTRAP=1 \
+    "$root/bin/fm-run-step-bridge.sh" wrap "$fakebin/real-no-mistakes" axi run \
+    > "$dir/bridge.out" 2>&1
+  status=$?
+  set -u
+  [ "$status" -ne 0 ] || fail "bridge accepted a timed-out descendant group"
+  [ -f "$dir/descendant.pid" ] || fail "bridge fixture did not start a descendant"
+  desc_pid=$(cat "$dir/descendant.pid")
+  if kill -0 "$desc_pid" 2>/dev/null; then
+    kill -KILL "$desc_pid" 2>/dev/null || true
+    fail "bridge timeout left a descendant process alive"
+  fi
+  [ "$(receipt_value "$meta" run_binding_state)" = pending ] \
+    || fail "bridge descendant timeout changed pending metadata"
+  [ ! -e "$evidence" ] && [ ! -L "$evidence" ] \
+    || fail "bridge descendant timeout published incomplete evidence"
+  pass "run bridge timeout terminates descendant processes"
+}
+
+test_run_bridge_rejects_temporary_symlink() {
+  local dir root home fakebin state handoff meta evidence outside temp_link status
+  new_case bridge-temporary-symlink
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  handoff="$state/.run-step-handoff-bridge-temporary-symlink"
+  meta="$state/bridge-temporary-symlink.meta"
+  evidence="$state/.run-step-incarnation-bridge-temporary-symlink"
+  outside="$dir/outside-target"
+  temp_link="$dir/run-step-temp-link"
+  printf 'protected\n' > "$outside"
+  fm_write_meta "$meta" \
+    window=tmux:fm-bridge-temporary-symlink worktree="$state/work-bridge-temporary-symlink" \
+    project="$state/work-bridge-temporary-symlink" harness=echo kind=ship mode=no-mistakes \
+    yolo=off spawn_incarnation=inc-a run_binding_state=pending \
+    run_binding_handoff=.run-step-handoff-bridge-temporary-symlink
+  mkdir -p "$state/work-bridge-temporary-symlink"
+  fm_write_meta "$handoff" schema=fm-jt-run-step-handoff.v1 task_id=bridge-temporary-symlink \
+    spawn_incarnation=inc-a state=pending
+  cat > "$fakebin/mktemp" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "${1:-}" in
+  */.run-step-incarnation.*.XXXXXX)
+    rm -f "${FM_TEST_TEMP_LINK:?}"
+    ln -s "${FM_TEST_TEMP_TARGET:?}" "$FM_TEST_TEMP_LINK"
+    printf '%s\n' "$FM_TEST_TEMP_LINK"
+    exit 0
+    ;;
+esac
+exec /usr/bin/mktemp "$@"
+SH
+  chmod +x "$fakebin/mktemp"
+  cat > "$fakebin/real-no-mistakes" <<'SH'
+#!/usr/bin/env bash
+printf 'run:\n  id: "01TEMPORARYSYMLINK"\n'
+SH
+  chmod +x "$fakebin/real-no-mistakes"
+  set +e
+  env PATH="$fakebin:$PATH" FM_RUN_BINDING_ROOT="$root" FM_RUN_BINDING_HOME="$home" \
+    FM_RUN_BINDING_STATE="$state" FM_RUN_BINDING_TASK=bridge-temporary-symlink \
+    FM_RUN_BINDING_INCARNATION=inc-a FM_RUN_BINDING_HANDOFF="$handoff" \
+    FM_RUN_BINDING_TMP="$dir" FM_TEST_TEMP_LINK="$temp_link" FM_TEST_TEMP_TARGET="$outside" \
+    FM_SESSION_LOCK_BOOTSTRAP=1 \
+    "$root/bin/fm-run-step-bridge.sh" wrap "$fakebin/real-no-mistakes" axi run \
+    > "$dir/bridge.out" 2>&1
+  status=$?
+  set -u
+  [ "$status" -ne 0 ] || fail "temporary binding symlink was accepted"
+  [ "$(cat "$outside")" = protected ] || fail "temporary binding symlink redirected state outside the home"
+  [ ! -e "$evidence" ] && [ ! -L "$evidence" ] \
+    || fail "temporary binding symlink left authoritative evidence"
+  pass "run binding rejects replaced temporary symlinks"
+}
+
+test_receipt_rejects_temporary_symlink() {
+  local dir root home fakebin state outside temp_link status
+  new_case receipt-temporary-symlink
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  outside="$dir/outside-target"
+  temp_link="$dir/receipt-temp-link"
+  write_meta "$state" receipt-temporary-symlink receipt-inc
+  export FM_FAKE_CREW_STATE_RECEIPT_TEMPORARY_SYMLINK='state: done · source: pane · receipt temp'
+  printf 'protected\n' > "$outside"
+  cat > "$fakebin/mktemp" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "${1:-}" in
+  */terminal-outcomes/.receipt.XXXXXX)
+    rm -f "${FM_TEST_RECEIPT_TEMP_LINK:?}"
+    ln -s "${FM_TEST_RECEIPT_TEMP_TARGET:?}" "$FM_TEST_RECEIPT_TEMP_LINK"
+    printf '%s\n' "$FM_TEST_RECEIPT_TEMP_LINK"
+    exit 0
+    ;;
+esac
+exec /usr/bin/mktemp "$@"
+SH
+  chmod +x "$fakebin/mktemp"
+  export FM_TEST_RECEIPT_TEMP_LINK="$temp_link" FM_TEST_RECEIPT_TEMP_TARGET="$outside"
+  set +e
+  scan "$root" "$home" "$fakebin" --startup >/dev/null
+  status=$?
+  set -u
+  [ "$status" -ne 0 ] || fail "receipt temporary symlink was accepted"
+  [ "$(cat "$outside")" = protected ] || fail "receipt temporary symlink redirected state outside the home"
+  [ "$(direct_file_count "$state/terminal-outcomes" '*.pending')" = 0 ] \
+    || fail "receipt temporary symlink left a pending receipt"
+  unset FM_TEST_RECEIPT_TEMP_LINK FM_TEST_RECEIPT_TEMP_TARGET \
+    FM_FAKE_CREW_STATE_RECEIPT_TEMPORARY_SYMLINK
+  pass "receipt writes reject replaced temporary symlinks"
+}
+
+test_run_bridge_rolls_back_failed_metadata_binding() {
+  local dir root home fakebin state handoff meta evidence meta_count status
+  new_case bridge-metadata-rollback
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  handoff="$state/.run-step-handoff-bridge-rollback"
+  meta="$state/bridge-rollback.meta"
+  evidence="$state/.run-step-incarnation-bridge-rollback"
+  meta_count="$dir/meta-mv-count"
+  fm_write_meta "$meta" \
+    window=tmux:fm-bridge-rollback worktree="$state/work-bridge-rollback" \
+    project="$state/work-bridge-rollback" harness=echo kind=ship mode=no-mistakes \
+    yolo=off spawn_incarnation=inc-a run_binding_state=pending \
+    run_binding_handoff=.run-step-handoff-bridge-rollback
+  mkdir -p "$state/work-bridge-rollback"
+  fm_write_meta "$handoff" schema=fm-jt-run-step-handoff.v1 task_id=bridge-rollback \
+    spawn_incarnation=inc-a state=pending
+  cat > "$fakebin/real-no-mistakes" <<'SH'
+#!/usr/bin/env bash
+printf 'run:\n  id: "01ROLLBACKMETA"\n'
+SH
+  chmod +x "$fakebin/real-no-mistakes"
+  cat > "$fakebin/perl" <<'SH'
+#!/usr/bin/env bash
+set -u
+if [ "$#" -ge 5 ] && [ "$4" = "${FM_TEST_META_TARGET:-}" ]; then
+  count=$(cat "${FM_TEST_META_COUNT:?}" 2>/dev/null || printf '0')
+  count=$((count + 1))
+  printf '%s\n' "$count" > "$FM_TEST_META_COUNT"
+  [ "$count" = 2 ] && exit 91
+fi
+exec /usr/bin/perl "$@"
+SH
+  chmod +x "$fakebin/perl"
+  set +e
+  env PATH="$fakebin:$PATH" FM_RUN_BINDING_ROOT="$root" FM_RUN_BINDING_HOME="$home" \
+    FM_RUN_BINDING_STATE="$state" FM_RUN_BINDING_TASK=bridge-rollback \
+    FM_RUN_BINDING_INCARNATION=inc-a FM_RUN_BINDING_HANDOFF="$handoff" \
+    FM_RUN_BINDING_TMP="$dir" FM_TEST_META_TARGET="$meta" FM_TEST_META_COUNT="$meta_count" \
+    FM_SESSION_LOCK_BOOTSTRAP=1 \
+    "$root/bin/fm-run-step-bridge.sh" wrap "$fakebin/real-no-mistakes" axi run \
+    > "$dir/bridge.out" 2>&1
+  status=$?
+  set -u
+  [ "$status" -ne 0 ] || fail "metadata publication failure was treated as success"
+  [ "$(receipt_value "$evidence" state)" = staged ] \
+    || fail "metadata publication failure did not leave non-terminal evidence"
+  [ "$(receipt_value "$meta" run_binding_state)" = staged ] \
+    || fail "metadata publication failure did not leave staged metadata"
+  [ "$(receipt_value "$meta" run_id)" = 01ROLLBACKMETA ] \
+    || fail "metadata publication failure lost the recoverable run id"
+  pass "run binding rolls back to staged state when metadata publication fails"
+}
+
+test_run_bridge_activation_failure_is_recoverable() {
+  local dir root home fakebin state handoff meta evidence count_file status
+  new_case bridge-activation-rollback
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  handoff="$state/.run-step-handoff-bridge-activation"
+  meta="$state/bridge-activation.meta"
+  evidence="$state/.run-step-incarnation-bridge-activation"
+  count_file="$dir/evidence-mv-count"
+  fm_write_meta "$meta" \
+    window=tmux:fm-bridge-activation worktree="$state/work-bridge-activation" \
+    project="$state/work-bridge-activation" harness=echo kind=ship mode=no-mistakes \
+    yolo=off spawn_incarnation=inc-a run_binding_state=pending \
+    run_binding_handoff=.run-step-handoff-bridge-activation
+  mkdir -p "$state/work-bridge-activation"
+  fm_write_meta "$handoff" schema=fm-jt-run-step-handoff.v1 task_id=bridge-activation \
+    spawn_incarnation=inc-a state=pending
+  cat > "$fakebin/real-no-mistakes" <<'SH'
+#!/usr/bin/env bash
+printf 'run:\n  id: "01ACTIVATIONFAIL"\n'
+SH
+  chmod +x "$fakebin/real-no-mistakes"
+  cat > "$fakebin/perl" <<'SH'
+#!/usr/bin/env bash
+set -u
+if [ "$#" -ge 5 ] && [ "$4" = "${FM_TEST_EVIDENCE_TARGET:-}" ]; then
+  count=$(cat "${FM_TEST_EVIDENCE_COUNT:?}" 2>/dev/null || printf '0')
+  count=$((count + 1))
+  printf '%s\n' "$count" > "$FM_TEST_EVIDENCE_COUNT"
+  [ "$count" = 2 ] && exit 91
+fi
+exec /usr/bin/perl "$@"
+SH
+  chmod +x "$fakebin/perl"
+  set +e
+  env PATH="$fakebin:$PATH" FM_RUN_BINDING_ROOT="$root" FM_RUN_BINDING_HOME="$home" \
+    FM_RUN_BINDING_STATE="$state" FM_RUN_BINDING_TASK=bridge-activation \
+    FM_RUN_BINDING_INCARNATION=inc-a FM_RUN_BINDING_HANDOFF="$handoff" \
+    FM_RUN_BINDING_TMP="$dir" FM_TEST_EVIDENCE_TARGET="$evidence" \
+    FM_TEST_EVIDENCE_COUNT="$count_file" FM_SESSION_LOCK_BOOTSTRAP=1 \
+    "$root/bin/fm-run-step-bridge.sh" wrap "$fakebin/real-no-mistakes" axi run \
+    > "$dir/bridge.out" 2>&1
+  status=$?
+  set -u
+  [ "$status" -ne 0 ] || fail "activation failure was treated as success"
+  [ "$(receipt_value "$meta" run_binding_state)" = staged ] \
+    || fail "activation failure left metadata bound"
+  [ "$(receipt_value "$evidence" state)" = staged ] \
+    || fail "activation failure left terminal evidence active"
+  pass "run binding activation failure leaves a recoverable staged state"
+}
+
+test_pane_idle_reclaim_advances_malformed_cursor() {
+  local dir root home fakebin state index_dir snapshot window key status
+  new_case pane-idle-reclaim-malformed
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  index_dir="$state/.reclaim-index"
+  snapshot="$dir/reclaim.snapshot"
+  window=tmux:fm-reclaim-live
+  if command -v shasum >/dev/null 2>&1; then
+    key=$(printf '%s' "$window" | shasum -a 256 | awk '{print $1}')
+  else
+    key=$(printf '%s' "$window" | sha256sum | awk '{print $1}')
+  fi
+  mkdir -p "$index_dir"
+  printf '%s\0%s\0%s\0' "$state/reclaim.meta" "$window" 1 > "$snapshot"
+  ln -s "$dir/missing-pane-index-entry" "$index_dir/$key"
+  printf 'malformed-entry\n%s\n' "$key" > "$index_dir/.reclaim.entries"
+  : > "$index_dir/.reclaim.entries.complete"
+  set +e
+  env FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    PATH="$fakebin:$PATH" bash -c \
+    '. "$1/bin/fm-pane-idle-lib.sh"; fm_pane_idle_meta_index_reclaim "$2" "" "$3"' _ \
+    "$ROOT" "$index_dir" "$snapshot"
+  status=$?
+  set -u
+  [ "$status" = 1 ] || fail "reclaim did not fail closed on a symlinked pane-index entry"
+  [ "$(cat "$index_dir/.reclaim.cursor" 2>/dev/null || true)" = 1 ] \
+    || fail "reclaim did not advance past the malformed durable entry"
+  [ -L "$index_dir/$key" ] || fail "reclaim removed the symlinked pane-index entry"
+  pass "reclaim advances its durable cursor past malformed entries"
+}
+
+test_session_start_drains_before_inactive_scan() {
+  local dir root home fakebin state out status wake_line inactive_line
+  new_case session-start-wiring
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  write_meta "$state" session-x1 session-inc
+  export FM_FAKE_CREW_STATE_SESSION_X1='state: done · source: pane · session wiring'
+  printf '1\t1\tsignal\ttask-before\tqueued before inactive scan\n' > "$state/.wake-queue"
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  out=$(cd "$root" && env -u NO_MISTAKES_GATE -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+    PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$home/data" FM_CONFIG_OVERRIDE="$home/config" \
+    FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" \
+    FM_INACTIVE_OUTCOME_SECS=60 FM_INACTIVE_OUTCOME_BUDGET_SECS=10 \
+    FM_PRIMARY_ATTESTATION="$CASE_TOKEN" CODEX_THREAD_ID="$CASE_THREAD" \
+    FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux "$root/bin/fm-session-start.sh" 2>&1)
+  status=$?
+  [ "$status" = 0 ] || fail "session-start integration path failed: $out"
+  wake_line=$(printf '%s\n' "$out" | grep -n '^1[[:space:]]\+1[[:space:]]\+signal[[:space:]]\+task-before' | head -1 | cut -d: -f1)
+  inactive_line=$(printf '%s\n' "$out" | grep -n 'queued inactive outcome: task=session-x1' | head -1 | cut -d: -f1)
+  [ -n "$wake_line" ] && [ -n "$inactive_line" ] && [ "$wake_line" -lt "$inactive_line" ] \
+    || fail "session-start did not drain the existing wake before inactive reconciliation"
+  [ "$(awk -F '\t' '$4 == "task-before" { n++ } END { print n + 0 }' "$state/.wake-queue")" = 0 ] \
+    || fail "session-start left the pre-existing wake queued"
+  [ "$(queue_count "$state")" = 1 ] || fail "session-start did not queue exactly one inactive wake after draining"
+  [ "$(receipt_count "$state" pending)" = 1 ] || fail "session-start did not run inactive reconciliation"
+  mv "$root/bin/fm-wake-drain.sh" "$root/bin/fm-wake-drain.real"
+  cat > "$root/bin/fm-wake-drain.sh" <<'SH'
+#!/usr/bin/env bash
+exit 23
+SH
+  chmod +x "$root/bin/fm-wake-drain.sh"
+  set +e
+  out=$(cd "$root" && env -u NO_MISTAKES_GATE -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+    PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$home/data" FM_CONFIG_OVERRIDE="$home/config" \
+    FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_INACTIVE_OUTCOME_SECS=60 \
+    FM_INACTIVE_OUTCOME_BUDGET_SECS=10 FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux \
+    "$root/bin/fm-session-start.sh" 2>&1)
+  status=$?
+  [ "$status" = 0 ] || fail "session-start changed its always-zero reporting contract after drain failure"
+  printf '%s\n' "$out" | grep -F 'inactive reconciliation skipped' >/dev/null \
+    || fail "session-start did not report that inactive reconciliation was skipped after drain failure"
+  [ "$(receipt_count "$state" pending)" = 1 ] || fail "session-start scanned after a failed wake drain"
+  [ "$(queue_count "$state")" = 1 ] || fail "session-start changed the queue after a failed wake drain"
+  unset FM_FAKE_CREW_STATE_SESSION_X1
+  pass "session-start drains existing wakes before inactive reconciliation"
+}
+
+test_session_start_generation_bound_replay() {
+  local dir root home fakebin state out status
+  new_case session-start-generation
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  write_meta "$state" session-bound-x1 session-bound-inc
+  export FM_FAKE_CREW_STATE_SESSION_BOUND_X1='state: done · source: pane · session generation'
+  scan "$root" "$home" "$fakebin" --startup >/dev/null \
+    || fail "session-start generation fixture did not queue an inactive outcome"
+  [ "$(receipt_count "$state" pending)" = 1 ] || fail "session-start generation fixture did not retain a pending receipt"
+  out=$(cd "$root" && env -u NO_MISTAKES_GATE -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+    PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$home/data" FM_CONFIG_OVERRIDE="$home/config" \
+    FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_INACTIVE_OUTCOME_SECS=60 \
+    FM_INACTIVE_OUTCOME_BUDGET_SECS=10 FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux \
+    "$root/bin/fm-session-start.sh" 2>&1)
+  status=$?
+  [ "$status" = 0 ] || fail "session-start generation-bound replay failed: $out"
+  printf '%s\n' "$out" | grep -F 'inactive-outcome:' >/dev/null \
+    || fail "session-start did not emit the inactive row for caller confirmation"
+  [ "$(receipt_count "$state" pending)" = 0 ] || fail "session-start did not acknowledge the generation-bound replay"
+  [ "$(receipt_count "$state" presented)" = 1 ] || fail "session-start did not finalize the generation-bound replay"
+  [ "$(queue_count "$state")" = 0 ] || fail "session-start left the generation-bound replay queued"
+  unset FM_FAKE_CREW_STATE_SESSION_BOUND_X1
+  pass "session-start acknowledges inactive outcomes through its generation"
+}
+
+test_watcher_runs_inactive_cadence() {
+  local dir root home fakebin state out second_out status fingerprint
+  new_case watcher-wiring
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  write_meta "$state" watcher-x1 watcher-inc
+  printf '1\t1\tsignal\ttask-before\tqueued before watcher scan\n' > "$state/.wake-queue"
+  export FM_FAKE_CREW_STATE_WATCHER_X1='state: failed · source: pane · watcher wiring'
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "$*" in
+  *"#{pane_current_path}"*) printf '%s\n' "${FM_FAKE_PANE_PATH:-}" ;;
+  *"#{pane_pid}"*) printf '%s\n' "${FM_FAKE_HARNESS_PID:-$$}" ;;
+  *"#{window_name}"*) printf '%s\n' firstmate ;;
+  *capture-pane*) printf 'idle prompt\n' ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/tmux"
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  out=$(cd "$root" && env -u NO_MISTAKES_GATE -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+    PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$home/data" FM_CONFIG_OVERRIDE="$home/config" \
+    FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" \
+    FM_INACTIVE_OUTCOME_SECS=60 FM_INACTIVE_OUTCOME_BUDGET_SECS=10 \
+    FM_PRIMARY_ATTESTATION="$CASE_TOKEN" CODEX_THREAD_ID="$CASE_THREAD" \
+    FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux TMUX=fake,1,0 FM_FAKE_PANE_PATH="$home" \
+    FM_POLL=1 FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 FM_WATCHER_HEARTBEAT=999999 \
+    "$root/bin/fm-watch.sh" 2>&1)
+  status=$?
+  [ "$status" = 0 ] || fail "watcher cadence failed while surfacing the queued wake"
+  printf '%s\n' "$out" | grep -F $'1\t1\tsignal\ttask-before\tqueued before watcher scan' >/dev/null \
+    || fail "watcher did not surface the existing wake first"
+  [ "$(awk -F '\t' '$4 == "task-before" { n++ } END { print n + 0 }' "$state/.wake-queue")" = 0 ] \
+    || fail "watcher left the existing wake queued"
+  [ "$(receipt_count "$state" pending)" = 0 ] || fail "watcher scanned inactive outcomes before draining the queued wake"
+
+  second_out=$(cd "$root" && env -u NO_MISTAKES_GATE -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+    PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$home/data" FM_CONFIG_OVERRIDE="$home/config" \
+    FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" \
+    FM_INACTIVE_OUTCOME_SECS=60 FM_INACTIVE_OUTCOME_BUDGET_SECS=10 \
+    FM_PRIMARY_ATTESTATION="$CASE_TOKEN" CODEX_THREAD_ID="$CASE_THREAD" \
+    FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux TMUX=fake,1,0 FM_FAKE_PANE_PATH="$home" \
+    FM_POLL=1 FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 FM_WATCHER_HEARTBEAT=999999 \
+    "$root/bin/fm-watch.sh" 2>&1)
+  status=$?
+  [ "$status" = 0 ] || fail "watcher cadence failed while surfacing the inactive outcome wake"
+  printf '%s\n' "$second_out" | grep -F 'inactive-outcome:' >/dev/null \
+    || fail "watcher did not surface the exact inactive outcome wake in the scan turn"
+  fingerprint=$(basename "$(direct_first_file "$state/terminal-outcomes" '*.pending')" .pending)
+  ! printf '%s\n' "$second_out" | grep -F 'check: inactive terminal outcome replay queued' >/dev/null \
+    || fail "watcher emitted a second generic inactive wake"
+  [ "$(receipt_count "$state" pending)" = 0 ] || fail "watcher cadence did not acknowledge the inactive receipt"
+  [ "$(receipt_count "$state" presented)" = 1 ] || fail "watcher cadence did not finalize the inactive receipt"
+  [ "$(queue_count "$state")" = 0 ] || fail "watcher cadence did not consume the inactive outcome wake"
+  [ ! -e "$state/terminal-outcomes/.$fingerprint.claim" ] || fail "watcher cadence left a presentation claim"
+
+  write_meta "$state" watcher-failure-x1 watcher-failure-inc
+  export FM_FAKE_CREW_STATE_WATCHER_FAILURE_X1='state: failed · source: pane · watcher output failure'
+  rm -f "$state/.inactive-outcome-reconcile"
+  mv "$root/bin/fm-wake-drain.sh" "$root/bin/fm-wake-drain.real"
+  cat > "$root/bin/fm-wake-drain.sh" <<SH
+#!/usr/bin/env bash
+set -u
+count_file="\${FM_STATE_OVERRIDE}/.drain-count"
+count=\$(cat "\$count_file" 2>/dev/null || echo 0)
+count=\$((count + 1))
+printf '%s\n' "\$count" > "\$count_file"
+if [ "\$count" = 2 ]; then
+  exit 3
+fi
+exec "$root/bin/fm-wake-drain.real"
+SH
+  chmod +x "$root/bin/fm-wake-drain.sh"
+  set +e
+  ( cd "$root" && env -u NO_MISTAKES_GATE -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+      PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+      FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$home/data" FM_CONFIG_OVERRIDE="$home/config" \
+      FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" \
+      FM_INACTIVE_OUTCOME_SECS=60 FM_INACTIVE_OUTCOME_BUDGET_SECS=10 \
+      FM_PRIMARY_ATTESTATION="$CASE_TOKEN" CODEX_THREAD_ID="$CASE_THREAD" \
+      FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux TMUX=fake,1,0 FM_FAKE_PANE_PATH="$home" \
+      FM_POLL=1 FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 FM_WATCHER_HEARTBEAT=999999 \
+      "$root/bin/fm-watch.sh" ) > "$dir/failed-scan.out" 2>&1
+  status=$?
+  set -u
+  [ "$status" = 3 ] || fail "watcher did not fail closed when the same-turn drain failed"
+  [ "$(receipt_count "$state" pending)" = 1 ] || fail "watcher failure fixture did not create one pending receipt"
+  [ "$(queue_count "$state")" = 1 ] || fail "watcher failure fixture did not retain one wake"
+  mv "$root/bin/fm-wake-drain.real" "$root/bin/fm-wake-drain.sh"
+  set +e
+  ( cd "$root" && env -u NO_MISTAKES_GATE -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+      PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+      FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$home/data" FM_CONFIG_OVERRIDE="$home/config" \
+      FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_INACTIVE_OUTCOME_SECS=60 \
+      FM_INACTIVE_OUTCOME_BUDGET_SECS=10 FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+      CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux TMUX=fake,1,0 \
+      FM_FAKE_PANE_PATH="$home" FM_POLL=1 FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 \
+      FM_WATCHER_HEARTBEAT=999999 "$root/bin/fm-watch.sh" ) | head -n 0
+  status=${PIPESTATUS[0]}
+  set -u
+  [ "$status" -ne 0 ] || fail "watcher treated a broken presentation pipe as success"
+  [ "$(receipt_count "$state" pending)" = 1 ] \
+    || fail "watcher consumed the inactive receipt after presentation failure"
+  [ -e "$state/terminal-outcomes/.$(basename "$(direct_first_file "$state/terminal-outcomes" '*.pending')" .pending).claim" ] \
+    || fail "watcher did not retain a retryable presentation claim"
+  unset FM_FAKE_CREW_STATE_WATCHER_X1 FM_FAKE_CREW_STATE_WATCHER_FAILURE_X1
+  pass "watcher cadence gates acknowledgement on successful output"
+}
+
+test_surfaced_terminal_is_not_replayed() {
+  local dir root home fakebin state out status
+  new_case surfaced-terminal
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  write_meta "$state" surfaced-x1 surfaced-inc
+  printf 'done: surfaced terminal\n' > "$state/surfaced-x1.status"
+  : > "$state/surfaced-x1.turn-ended"
+  touch "$state/surfaced-x1.meta" "$state/surfaced-x1.status" "$state/surfaced-x1.turn-ended"
+  export FM_FAKE_CREW_STATE_SURFACED_X1='state: done · source: pane · surfaced terminal'
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "$*" in
+  *"#{pane_current_path}"*) printf '%s\n' "${FM_FAKE_PANE_PATH:-}" ;;
+  *"#{pane_pid}"*) printf '%s\n' "${FM_FAKE_HARNESS_PID:-$$}" ;;
+  *"#{window_name}"*) printf '%s\n' firstmate ;;
+  *capture-pane*) printf 'idle prompt\n' ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/tmux"
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  out=$(cd "$root" && env -u NO_MISTAKES_GATE -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+    PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$home/data" FM_CONFIG_OVERRIDE="$home/config" \
+    FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_INACTIVE_OUTCOME_SECS=60 \
+    FM_INACTIVE_OUTCOME_BUDGET_SECS=10 FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux TMUX=fake,1,0 \
+    FM_FAKE_PANE_PATH="$home" FM_POLL=1 FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 \
+    FM_WATCHER_HEARTBEAT=999999 "$root/bin/fm-watch.sh" 2>&1)
+  status=$?
+  [ "$status" = 0 ] || fail "watcher did not surface the terminal status: $out"
+  [ -f "$state/.hb-surfaced-surfaced-x1" ] || fail "watcher did not persist the surfaced status"
+  [ -f "$state/.hb-terminal-surfaced-surfaced-x1" ] || fail "watcher did not persist the incarnation-bound terminal marker"
+  set_old_mtime "$state/surfaced-x1.meta" "$state/surfaced-x1.status" "$state/surfaced-x1.turn-ended"
+  scan "$root" "$home" "$fakebin" --startup >/dev/null
+  [ "$(receipt_count "$state" pending)" = 0 ] || fail "already surfaced terminal outcome was replayed"
+  [ "$(queue_count "$state")" = 0 ] || fail "already surfaced terminal outcome queued a wake"
+  replace_field "$state/surfaced-x1.meta" spawn_incarnation resurfaced-inc
+  write_idle_proof "$state" surfaced-x1 tmux tmux:fm-surfaced-x1
+  set_old_mtime "$state/surfaced-x1.meta" "$state/surfaced-x1.status" "$state/surfaced-x1.turn-ended"
+  scan "$root" "$home" "$fakebin" --startup >/dev/null
+  [ "$(receipt_count "$state" pending)" = 1 ] || fail "new incarnation was incorrectly suppressed by an old surface marker"
+  [ "$(queue_count "$state")" = 1 ] || fail "new incarnation did not queue its inactive wake"
+  unset FM_FAKE_CREW_STATE_SURFACED_X1
+  pass "terminal replay suppression is bound to surfaced status and incarnation"
+}
+
+test_canonical_terminal_snapshot_suppresses_status_replay() {
+  local dir root home fakebin state canonical out status
+  new_case canonical-terminal-snapshot
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  write_meta "$state" canonical-x1 canonical-inc
+  printf '%s\n' 'done: checks green' > "$state/canonical-x1.status"
+  canonical='state: done · source: run-step · checks green · run-id=canonical-x1'
+  export FM_FAKE_CREW_STATE_CANONICAL_X1="$canonical"
+  rm -f "$state/canonical-x1.turn-ended"
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "$*" in
+  *"#{pane_current_path}"*) printf '%s\n' "${FM_FAKE_PANE_PATH:-}" ;;
+  *"#{pane_pid}"*) printf '%s\n' "${FM_FAKE_HARNESS_PID:-$$}" ;;
+  *"#{window_name}"*) printf '%s\n' firstmate ;;
+  *capture-pane*) printf 'idle prompt\n' ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/tmux"
+  fm_write_meta "$state/.hb-terminal-surfaced-canonical-x1" \
+    schema=fm-hb-terminal-surfaced.v1 snapshot="$canonical" \
+    spawn_incarnation=canonical-inc tasktmp="$state/work-canonical-x1" \
+    window=tmux:fm-canonical-x1 worktree="$state/work-canonical-x1" parent_corr=
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  out=$(cd "$root" && env -u NO_MISTAKES_GATE -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+    PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$home/data" FM_CONFIG_OVERRIDE="$home/config" \
+    FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_INACTIVE_OUTCOME_SECS=60 \
+    FM_INACTIVE_OUTCOME_BUDGET_SECS=10 FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux TMUX=fake,1,0 \
+    FM_FAKE_PANE_PATH="$home" FM_POLL=1 FM_SIGNAL_GRACE=0 FM_CHECK_INTERVAL=999999 \
+    FM_HEARTBEAT=999999 FM_WATCHER_HEARTBEAT=999999 bash -c \
+      '. "$1/bin/fm-pane-idle-lib.sh"; shift; fm_pane_idle_run_bounded_child "$@"' \
+      _ "$ROOT" 5 "$root/bin/fm-watch.sh" 2>&1)
+  status=$?
+  set -u
+  [ "$status" = 124 ] || fail "watcher canonical suppression failed: $out"
+  [ "$(queue_count "$state")" = 0 ] || fail "canonical terminal marker queued a duplicate wake"
+  unset FM_FAKE_CREW_STATE_CANONICAL_X1
+  pass "watcher suppresses equivalent canonical terminal snapshots"
+}
+
+test_postpublication_uncertainty_is_not_replayed() {
+  local dir root home fakebin state out status flag
+  new_case postpublication-uncertainty
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  write_meta "$state" postpublish-x1 postpublish-inc
+  printf 'done: postpublication uncertainty\n' > "$state/postpublish-x1.status"
+  : > "$state/postpublish-x1.turn-ended"
+  touch "$state/postpublish-x1.meta" "$state/postpublish-x1.status" "$state/postpublish-x1.turn-ended"
+  touch "$state/.inactive-outcome-reconcile"
+  export FM_FAKE_CREW_STATE_POSTPUBLISH_X1='state: done · source: pane · postpublication uncertainty'
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "$*" in
+  *"#{pane_current_path}"*) printf '%s\n' "${FM_FAKE_PANE_PATH:-}" ;;
+  *"#{pane_pid}"*) printf '%s\n' "${FM_FAKE_HARNESS_PID:-$$}" ;;
+  *"#{window_name}"*) printf '%s\n' firstmate ;;
+  *capture-pane*) printf 'idle prompt\n' ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/tmux"
+  flag="$dir/fail-postpublication-mark"
+  : > "$flag"
+  cat > "$fakebin/perl" <<'SH'
+#!/usr/bin/env bash
+set -u
+args=("$@")
+source_file="${args[$((${#args[@]} - 3))]}"
+target="${args[$((${#args[@]} - 2))]}"
+if [ -e "${FM_TEST_FAIL_POSTPUBLICATION:-}" ] \
+  && [[ "$target" == *.hb-surface-retry-* ]] \
+  && grep -Fqx 'wake_published=1' "$source_file" 2>/dev/null; then
+  rm -f "$FM_TEST_FAIL_POSTPUBLICATION"
+  exit 91
+fi
+exec /usr/bin/perl "$@"
+SH
+  chmod +x "$fakebin/perl"
+  export FM_TEST_FAIL_POSTPUBLICATION="$flag"
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  set +e
+  out=$(cd "$root" && env -u NO_MISTAKES_GATE -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+    PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$home/data" FM_CONFIG_OVERRIDE="$home/config" \
+    FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_INACTIVE_OUTCOME_SECS=60 \
+    FM_INACTIVE_OUTCOME_BUDGET_SECS=10 FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux TMUX=fake,1,0 \
+    FM_FAKE_PANE_PATH="$home" FM_POLL=1 FM_SIGNAL_GRACE=0 FM_CHECK_INTERVAL=999999 \
+    FM_HEARTBEAT=999999 FM_WATCHER_HEARTBEAT=999999 "$root/bin/fm-watch.sh" 2>&1)
+  status=$?
+  set -u
+  [ "$status" -ne 0 ] || fail "post-publication persistence failure was treated as success"
+  [ "$(receipt_value "$state/.hb-surface-retry-postpublish-x1" wake_published)" = 2 ] \
+    || fail "post-publication failure did not retain an uncertain retry state"
+  [ "$(awk 'NF { n++ } END { print n + 0 }' "$state/.wake-queue")" = 1 ] \
+    || fail "post-publication failure did not retain its wake"
+  rm -f "$fakebin/perl"
+  unset FM_TEST_FAIL_POSTPUBLICATION
+  out=$(cd "$root" && env -u NO_MISTAKES_GATE -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+    PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$home/data" FM_CONFIG_OVERRIDE="$home/config" \
+    FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_INACTIVE_OUTCOME_SECS=60 \
+    FM_INACTIVE_OUTCOME_BUDGET_SECS=10 FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux TMUX=fake,1,0 \
+    FM_FAKE_PANE_PATH="$home" FM_POLL=1 FM_SIGNAL_GRACE=0 FM_CHECK_INTERVAL=999999 \
+    FM_HEARTBEAT=999999 FM_WATCHER_HEARTBEAT=999999 "$root/bin/fm-watch.sh" 2>&1) \
+    || fail "post-publication retry did not repair its wake"
+  [ "$(awk 'NF { n++ } END { print n + 0 }' "$state/.wake-queue")" = 0 ] \
+    || fail "post-publication retry left its wake queued"
+  printf '%s\n' "$out" | grep -F 'signal' >/dev/null \
+    || fail "post-publication retry did not surface its retained wake"
+  unset FM_FAKE_CREW_STATE_POSTPUBLISH_X1
+  pass "post-publication uncertainty suppresses duplicate wakes"
+}
+
+test_ordinary_terminal_wake_consumption_is_durable() {
+  local dir root home fakebin state retry last out signal_file seen_file status
+  new_case ordinary-terminal-consumed
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  write_meta "$state" ordinary-consumed-x1 ordinary-consumed-inc
+  last='done: ordinary terminal consumed'
+  printf '%s\n' "$last" > "$state/ordinary-consumed-x1.status"
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  env -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+    _FM_WORKER_ISOLATION_SNAPSHOT_READY=0 FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" \
+    FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    PATH="$fakebin:$PATH" \
+    bash -c 'cd "$1" || exit 1; . "$1/bin/fm-watch.sh"; surface_retry_write "$3" "$4" "$3" 2' _ \
+    "$root" "$state" ordinary-consumed-x1 "$last" \
+    || fail "ordinary terminal retry fixture was not written"
+  retry="$state/.hb-surface-retry-ordinary-consumed-x1"
+  [ "$(receipt_value "$retry" wake_published)" = 2 ] || fail "ordinary retry was not uncertain"
+  env -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+    _FM_WORKER_ISOLATION_SNAPSHOT_READY=0 FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" \
+    FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    PATH="$fakebin:$PATH" \
+    bash -c 'cd "$1" || exit 1; . "$1/bin/fm-wake-lib.sh"; fm_wake_append signal "$3" terminal' _ \
+    "$root" "$state" ordinary-consumed-x1 \
+    || fail "ordinary terminal wake was not queued"
+  drain "$root" "$home" "$fakebin" >/dev/null || fail "ordinary terminal wake drain failed"
+  [ -f "$state/.hb-surface-consumed-ordinary-consumed-x1" ] \
+    || fail "drain did not persist ordinary wake consumption"
+  [ ! -s "$state/.wake-queue" ] || fail "ordinary terminal wake drain left its row queued"
+  for signal_file in "$state/ordinary-consumed-x1.status" "$state/ordinary-consumed-x1.turn-ended"; do
+    case "$(uname -s)" in
+      Darwin) seen=$(stat -f '%z:%Fm' "$signal_file") ;;
+      *) seen=$(stat -c '%s:%Y' "$signal_file") ;;
+    esac
+    seen_file="$state/.seen-$(basename "$signal_file" | tr '.' '_')"
+    printf '%s' "$seen" > "$seen_file"
+  done
+  set +e
+  out=$(cd "$root" && env -u NO_MISTAKES_GATE -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+    PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$home/data" FM_CONFIG_OVERRIDE="$home/config" \
+    FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_INACTIVE_OUTCOME_SECS=60 \
+    FM_INACTIVE_OUTCOME_BUDGET_SECS=10 FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux TMUX=fake,1,0 \
+    FM_FAKE_PANE_PATH="$home" FM_POLL=1 FM_SIGNAL_GRACE=0 FM_CHECK_INTERVAL=999999 \
+    FM_HEARTBEAT=999999 FM_WATCHER_HEARTBEAT=999999 bash -c \
+      '. "$1/bin/fm-pane-idle-lib.sh"; shift; fm_pane_idle_run_bounded_child "$@"' \
+      _ "$ROOT" 5 "$root/bin/fm-watch.sh" 2>&1)
+  status=$?
+  set -u
+  [ "$status" = 124 ] || fail "watcher did not remain alive while suppressing the consumed wake: $out"
+  [ -f "$state/.hb-terminal-surfaced-ordinary-consumed-x1" ] \
+    || fail "watcher did not complete ordinary consumed wake surfacing"
+  [ ! -e "$retry" ] || fail "ordinary consumed retry was not cleared"
+  [ ! -e "$state/.hb-surface-consumed-ordinary-consumed-x1" ] \
+    || fail "ordinary consumed marker was not cleared"
+  pass "ordinary terminal wake consumption survives watcher crashes"
+}
+
+test_surface_marker_failure_is_retryable() {
+  local dir root home fakebin state out status
+  new_case surface-marker-failure
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  write_meta "$state" surface-marker-x1 surface-marker-inc
+  printf 'done: surface marker retry\n' > "$state/surface-marker-x1.status"
+  : > "$state/surface-marker-x1.turn-ended"
+  touch "$state/surface-marker-x1.meta" "$state/surface-marker-x1.status" "$state/surface-marker-x1.turn-ended"
+  ln -s "$dir/marker-target" "$state/.hb-terminal-surfaced-surface-marker-x1"
+  export FM_FAKE_CREW_STATE_SURFACE_MARKER_X1='state: working · source: pane · marker retry'
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "$*" in
+  *"#{pane_current_path}"*) printf '%s\n' "${FM_FAKE_PANE_PATH:-}" ;;
+  *"#{pane_pid}"*) printf '%s\n' "${FM_FAKE_HARNESS_PID:-$$}" ;;
+  *"#{window_name}"*) printf '%s\n' firstmate ;;
+  *capture-pane*) printf 'idle prompt\n' ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/tmux"
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  set +e
+  out=$(cd "$root" && env -u NO_MISTAKES_GATE -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+    PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$home/data" FM_CONFIG_OVERRIDE="$home/config" \
+    FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_INACTIVE_OUTCOME_SECS=60 \
+    FM_INACTIVE_OUTCOME_BUDGET_SECS=10 FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux TMUX=fake,1,0 \
+    FM_FAKE_PANE_PATH="$home" FM_POLL=1 FM_SIGNAL_GRACE=0 FM_CHECK_INTERVAL=999999 \
+    FM_HEARTBEAT=999999 FM_WATCHER_HEARTBEAT=999999 "$root/bin/fm-watch.sh" 2>&1)
+  status=$?
+  set -u
+  [ "$status" -ne 0 ] || fail "surface-marker failure was treated as success"
+  [ -f "$state/.hb-surface-retry-surface-marker-x1" ] \
+    || fail "surface-marker failure did not retain its retry transaction"
+  [ "$(awk 'NF { n++ } END { print n + 0 }' "$state/.wake-queue")" -ge 1 ] \
+    || fail "surface-marker failure did not retain its queued wake"
+  export FM_FAKE_CREW_STATE_SURFACE_MARKER_X1='state: done · source: pane · marker retry'
+  set +e
+  out=$(scan "$root" "$home" "$fakebin" --startup 2>&1)
+  status=$?
+  set -u
+  [ "$status" = 0 ] || fail "surface-marker retry suppression scan failed: $out"
+  [ "$(receipt_count "$state" pending)" = 0 ] \
+    || fail "unresolved surface-marker retry created a duplicate receipt"
+  export FM_FAKE_CREW_STATE_SURFACE_MARKER_X1='state: working · source: pane · marker retry'
+  printf 'done: surface marker newer\n' > "$state/surface-marker-x1.status"
+  set +e
+  out=$(cd "$root" && env -u NO_MISTAKES_GATE -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+    PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$home/data" FM_CONFIG_OVERRIDE="$home/config" \
+    FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_INACTIVE_OUTCOME_SECS=60 \
+    FM_INACTIVE_OUTCOME_BUDGET_SECS=10 FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux TMUX=fake,1,0 \
+    FM_FAKE_PANE_PATH="$home" FM_POLL=1 FM_SIGNAL_GRACE=0 FM_CHECK_INTERVAL=999999 \
+    FM_HEARTBEAT=999999 FM_WATCHER_HEARTBEAT=999999 "$root/bin/fm-watch.sh" 2>&1)
+  status=$?
+  set -u
+  [ "$status" -ne 0 ] || fail "stale surface-marker retry was repaired"
+  [ -f "$state/.hb-surface-retry-surface-marker-x1" ] \
+    || fail "stale surface-marker retry was discarded"
+  printf 'done: surface marker retry\n' > "$state/surface-marker-x1.status"
+  rm -f "$state/.hb-terminal-surfaced-surface-marker-x1"
+  out=$(cd "$root" && env -u NO_MISTAKES_GATE -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+    PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$home/data" FM_CONFIG_OVERRIDE="$home/config" \
+    FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_INACTIVE_OUTCOME_SECS=60 \
+    FM_INACTIVE_OUTCOME_BUDGET_SECS=10 FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux TMUX=fake,1,0 \
+    FM_FAKE_PANE_PATH="$home" FM_POLL=1 FM_SIGNAL_GRACE=0 FM_CHECK_INTERVAL=999999 \
+    FM_HEARTBEAT=999999 FM_WATCHER_HEARTBEAT=999999 "$root/bin/fm-watch.sh" 2>&1)
+  status=$?
+  [ "$status" = 0 ] || fail "surface-marker retry failed: $out"
+  [ ! -e "$state/.hb-surface-retry-surface-marker-x1" ] \
+    || fail "surface-marker retry transaction was not cleared"
+  [ -f "$state/.hb-terminal-surfaced-surface-marker-x1" ] \
+    || fail "surface-marker retry did not persist the terminal marker"
+  [ "$(awk 'NF { n++ } END { print n + 0 }' "$state/.wake-queue")" = 0 ] \
+    || fail "surface-marker retry left the wake queued"
+  scan "$root" "$home" "$fakebin" --startup >/dev/null \
+    || fail "surface-marker retry follow-up scan failed"
+  [ "$(receipt_count "$state" pending)" = 0 ] \
+    || fail "surface-marker retry caused an inactive receipt replay"
+  unset FM_FAKE_CREW_STATE_SURFACE_MARKER_X1
+  pass "surface-marker failures retain and repair their wake transaction"
+}
+
+test_surface_retry_rejects_unsafe_task_path() {
+  local dir root home fakebin state retry status
+  new_case surface-unsafe-task
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  retry="$state/.hb-surface-retry-unsafe-task"
+  fm_write_meta "$retry" \
+    schema=fm-hb-surface-retry.v1 task=../../outside snapshot='state: done unsafe' \
+    spawn_incarnation=inc-a tasktmp= window=tmux:surface-unsafe-task worktree= \
+    parent_corr= wake_key=unsafe-task wake_published=1
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  set +e
+  env -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+    PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" \
+    FM_WATCH_SURFACE_REPAIR_BUDGET_SECS=1 \
+    bash -c '. "$1/bin/fm-watch.sh"; surface_retry_repair' _ "$root" \
+    > "$dir/surface.out" 2>&1
+  status=$?
+  set -u
+  [ "$status" -ne 0 ] || fail "surface repair accepted an unsafe task id"
+  [ -f "$retry" ] || fail "unsafe surface retry was removed"
+  pass "surface retry rejects unsafe task paths"
+}
+
+test_legacy_metadata_uses_stable_fallback() {
+  local dir root home fakebin state rec incarnation tmp
+  new_case legacy-fallback
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_legacy_meta "$state" legacy-x1
+  tmp=$(mktemp "$state/.legacy-meta.XXXXXX") || fail "legacy metadata fixture could not be staged"
+  awk -F= '$1 != "backend" && $1 != "kind"' "$state/legacy-x1.meta" > "$tmp" \
+    || fail "legacy metadata compatibility fields could not be removed"
+  mv -f "$tmp" "$state/legacy-x1.meta"
+  set_old_mtime "$state/legacy-x1.meta"
+  export FM_FAKE_CREW_STATE_LEGACY_X1='state: done · source: pane · legacy quiet'
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "legacy metadata scan failed"
+  rec=$(direct_first_file "$state/terminal-outcomes" '*.pending')
+  [ -n "$rec" ] || fail "legacy metadata did not create a receipt"
+  incarnation=$(receipt_value "$rec" incarnation)
+  case "$incarnation" in legacy-*) ;; *) fail "legacy metadata lacked a documented fallback incarnation" ;; esac
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "legacy metadata rescan failed"
+  [ "$(receipt_count "$state" pending)" = 1 ] || fail "legacy fallback was not stable across rescans"
+  unset FM_FAKE_CREW_STATE_LEGACY_X1
+  pass "legacy metadata receives a stable fallback incarnation"
+}
+
+test_empty_spawn_incarnation_is_rejected() {
+  local dir root home fakebin state
+  new_case empty-spawn-incarnation
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" empty-inc-x1 empty-inc
+  replace_field "$state/empty-inc-x1.meta" spawn_incarnation ''
+  export FM_FAKE_CREW_STATE_EMPTY_INC_X1='state: done · source: pane · malformed incarnation'
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "empty incarnation scan failed"
+  [ "$(receipt_count "$state" pending)" = 0 ] || fail "explicit empty incarnation used the legacy fallback"
+  [ "$(queue_count "$state")" = 0 ] || fail "explicit empty incarnation created a wake"
+  unset FM_FAKE_CREW_STATE_EMPTY_INC_X1
+  pass "explicit empty spawn incarnations fail closed"
+}
+
+test_relaunch_and_teardown_races_recheck_under_spawn_lock() {
+  local dir root home fakebin state holder scanner ready release
+  new_case races
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" relaunch-x1 old-inc
+  export FM_FAKE_CREW_STATE_RELAUNCH_X1='state: done · source: pane · relaunch race'
+  ready="$dir/ready"
+  release="$dir/release"
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  (
+    cd "$root" && env -u FM_AGENT_ROLE -u FM_AGENT_TASK -u FM_AGENT_OWNER_HOME \
+      -u FM_ROOT -u STATE FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+      FM_PRIMARY_ATTESTATION="$CASE_TOKEN" CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" \
+      PATH="$fakebin:$PATH" bash -c '. "$1/bin/fm-wake-lib.sh"; fm_lock_acquire_wait "$2/.spawn-relaunch-x1.lock"; : > "$3"; while [ ! -e "$4" ]; do sleep 0.01; done; fm_lock_release "$2/.spawn-relaunch-x1.lock"' _ "$ROOT" "$state" "$ready" "$release"
+  ) &
+  holder=$!
+  for _ in $(seq 1 100); do [ -e "$ready" ] && break; sleep 0.01; done
+  scan "$root" "$home" "$fakebin" --startup >"$dir/relaunch.scan.out" 2>&1 &
+  scanner=$!
+  sleep 1
+  replace_field "$state/relaunch-x1.meta" spawn_incarnation new-inc
+  write_idle_proof "$state" relaunch-x1 tmux tmux:fm-relaunch-x1
+  : > "$release"
+  wait "$holder" || fail "spawn-lock relaunch fixture failed"
+  wait "$scanner" || fail "relaunch reconciliation fixture failed"
+  [ "$(direct_file_count "$state/terminal-outcomes" '*.pending')" = 0 ] \
+    || fail "fresh relaunch was replayed before its quiet period"
+  set_old_mtime "$state/relaunch-x1.meta"
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "aged relaunch reconciliation failed"
+  grep -F 'incarnation=new-inc' "$state"/terminal-outcomes/*.pending >/dev/null || fail "relaunch race used stale incarnation"
+
+  write_meta "$state" teardown-x1 teardown-inc
+  export FM_FAKE_CREW_STATE_TEARDOWN_X1='state: done · source: pane · teardown race'
+  ready="$dir/ready-teardown"
+  release="$dir/release-teardown"
+  (
+    cd "$root" && env -u FM_AGENT_ROLE -u FM_AGENT_TASK -u FM_AGENT_OWNER_HOME \
+      -u FM_ROOT -u STATE FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+      FM_PRIMARY_ATTESTATION="$CASE_TOKEN" CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" \
+      PATH="$fakebin:$PATH" bash -c '. "$1/bin/fm-wake-lib.sh"; fm_lock_acquire_wait "$2/.spawn-teardown-x1.lock"; : > "$3"; while [ ! -e "$4" ]; do sleep 0.01; done; fm_lock_release "$2/.spawn-teardown-x1.lock"' _ "$ROOT" "$state" "$ready" "$release"
+  ) &
+  holder=$!
+  for _ in $(seq 1 100); do [ -e "$ready" ] && break; sleep 0.01; done
+  scan "$root" "$home" "$fakebin" --startup >"$dir/teardown.scan.out" 2>&1 &
+  scanner=$!
+  sleep 1
+  rm -f "$state/teardown-x1.meta" "$state/teardown-x1.status" "$state/teardown-x1.turn-ended"
+  : > "$release"
+  wait "$holder" || fail "spawn-lock teardown fixture failed"
+  wait "$scanner" || fail "teardown reconciliation fixture failed"
+  [ "$(direct_file_count "$state/terminal-outcomes" '*teardown-x1*.pending')" = 0 ] || fail "teardown race created a receipt after meta removal"
+  unset FM_FAKE_CREW_STATE_RELAUNCH_X1 FM_FAKE_CREW_STATE_TEARDOWN_X1
+  pass "relaunch and teardown races recheck metadata under the spawn lock"
+}
+
+test_parent_home_secondmate_records_are_skipped() {
+  local dir root home fakebin state
+  new_case parent-home-skip
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" parent-sm-x1 parent-inc secondmate
+  export FM_FAKE_CREW_STATE_PARENT_SM_X1='state: done · source: pane · parent record'
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "parent-home scan failed"
+  [ "$(receipt_count "$state" pending)" = 0 ] || fail "parent-home secondmate record was replayed"
+  [ "$(queue_count "$state")" = 0 ] || fail "parent-home secondmate record queued a wake"
+  write_meta "$state" duplicate-kind-x1 duplicate-kind-inc ship
+  printf 'kind=secondmate\n' >> "$state/duplicate-kind-x1.meta"
+  export FM_FAKE_CREW_STATE_DUPLICATE_KIND_X1='state: done · source: pane · duplicate kind'
+  set_old_mtime "$state/duplicate-kind-x1.meta"
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "duplicate kind scan failed"
+  [ "$(receipt_count "$state" pending)" = 0 ] || fail "duplicate kind metadata bypassed secondmate exclusion"
+  [ "$(queue_count "$state")" = 0 ] || fail "duplicate kind metadata queued a wake"
+  unset FM_FAKE_CREW_STATE_PARENT_SM_X1 FM_FAKE_CREW_STATE_DUPLICATE_KIND_X1
+  pass "parent-home secondmate records stay outside inactive replay"
+}
+
+test_herdr_identity_and_default_captain_refusal() {
+  local dir root home fakebin state herdr_log
+  new_case herdr-identity
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  herdr_log="$dir/herdr.log"
+  cat > "$fakebin/herdr" <<'SH'
+#!/usr/bin/env bash
+set -u
+printf '%s\n' "$*" >> "${FM_HERDR_LOG:?}"
+case "$*" in
+  *'status --json'*)
+    if [ "${FM_FAKE_HERDR_DOWN:-0}" = 1 ]; then
+      printf '{"server":{"running":false}}\n'
+    else
+      printf '{"server":{"running":true}}\n'
+    fi
+    ;;
+  *' server'*) printf 'unexpected server start\n' >&2; exit 97 ;;
+  *'pane read'*) printf 'idle prompt\n' ;;
+  *'agent get'*) printf '{"result":{"agent":{"agent_status":"idle"}}}\n' ;;
+  *) : ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/herdr"
+  write_meta "$state" herdr-good good-inc ship herdr firstmate:pane-good
+  printf 'herdr_session=firstmate\nherdr_workspace_id=ws\nherdr_tab_id=tab\nherdr_pane_id=pane\n' >> "$state/herdr-good.meta"
+  printf 'herdr_session=default\n' >> "$state/herdr-good.meta"
+  write_meta "$state" herdr-unique unique-inc ship herdr firstmate:pane
+  printf 'herdr_session=firstmate\nherdr_workspace_id=ws\nherdr_tab_id=tab\nherdr_pane_id=pane\n' >> "$state/herdr-unique.meta"
+  write_meta "$state" herdr-default default-inc ship herdr default:pane
+  printf 'herdr_session=default\nherdr_workspace_id=ws\nherdr_tab_id=tab\nherdr_pane_id=pane\n' >> "$state/herdr-default.meta"
+  write_meta "$state" herdr-captain captain-inc ship herdr CAPTAIN:pane
+  printf 'herdr_session=CAPTAIN\nherdr_workspace_id=ws\nherdr_tab_id=tab\nherdr_pane_id=pane\n' >> "$state/herdr-captain.meta"
+  set_old_mtime "$state/herdr-good.meta" "$state/herdr-unique.meta" \
+    "$state/herdr-default.meta" "$state/herdr-captain.meta"
+  export FM_FAKE_CREW_STATE_HERDR_GOOD='state: done · source: pane · dedicated session quiet'
+  export FM_FAKE_CREW_STATE_HERDR_UNIQUE='state: done · source: pane · unique session quiet'
+  export FM_FAKE_CREW_STATE_HERDR_DEFAULT='state: done · source: pane · must refuse'
+  export FM_FAKE_CREW_STATE_HERDR_CAPTAIN='state: done · source: pane · must refuse'
+  export FM_NETWORK_LOG="$dir/network.log" FM_HERDR_LOG="$herdr_log"
+  PATH="$fakebin:$PATH" scan "$root" "$home" "$fakebin" --startup >/dev/null \
+    || fail "Herdr identity scan failed"
+  [ "$(receipt_count "$state" pending)" = 1 ] || fail "Herdr duplicate identity was accepted or default/CAPTAIN were not refused"
+  grep -l '^task_id=herdr-unique$' "$state"/terminal-outcomes/*.pending >/dev/null \
+    || fail "unique Herdr identity was not accepted"
+  [ ! -s "$dir/network.log" ] || fail "inactive reconciliation made a forge/network call"
+  ! grep -E '(^| )server( |$)' "$herdr_log" >/dev/null \
+    || fail "inactive reconciliation attempted to start Herdr"
+  write_meta "$state" herdr-no-start no-start-inc ship herdr firstmate:pane-no-start
+  printf 'herdr_session=firstmate\n' >> "$state/herdr-no-start.meta"
+  export FM_FAKE_CREW_STATE_HERDR_NO_START='state: done · source: pane · no server start'
+  export FM_FAKE_HERDR_DOWN=1
+  PATH="$fakebin:$PATH" scan "$root" "$home" "$fakebin" --startup >/dev/null \
+    || fail "Herdr no-server-start guard failed the read-only scan"
+  ! grep -E '(^| )server( |$)' "$herdr_log" >/dev/null \
+    || fail "Herdr no-server-start guard attempted a server command"
+  unset FM_FAKE_CREW_STATE_HERDR_GOOD FM_FAKE_CREW_STATE_HERDR_UNIQUE \
+    FM_FAKE_CREW_STATE_HERDR_DEFAULT FM_FAKE_CREW_STATE_HERDR_CAPTAIN \
+    FM_FAKE_CREW_STATE_HERDR_NO_START FM_FAKE_HERDR_DOWN FM_NETWORK_LOG FM_HERDR_LOG
+  pass "Herdr uses the dedicated firstmate identity and refuses default/CAPTAIN"
+}
+
+test_occupancy_unknown_is_not_terminal() {
+  local dir root home fakebin state
+  new_case occupancy-unknown
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" unknown-x1 unknown-inc
+  export FM_FAKE_CREW_STATE_UNKNOWN_X1='state: unknown · source: none · occupancy unknown'
+  scan "$root" "$home" "$fakebin" --startup >/dev/null \
+    || fail "occupancy scan failed"
+  [ "$(receipt_count "$state" pending)" = 0 ] || fail "occupancy unknown was treated as terminal"
+  [ "$(queue_count "$state")" = 0 ] || fail "occupancy unknown created an actionable wake"
+  unset FM_FAKE_CREW_STATE_UNKNOWN_X1
+  pass "occupancy unknown remains non-terminal"
+}
+
+test_status_log_terminal_is_not_replayed() {
+  local dir root home fakebin state
+  new_case stale-status-log
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" stale-x1 stale-inc
+  export FM_FAKE_CREW_STATE_STALE_X1='state: done · source: status-log · stale done event'
+  scan "$root" "$home" "$fakebin" --startup >/dev/null \
+    || fail "status-log scan failed"
+  [ "$(receipt_count "$state" pending)" = 0 ] || fail "stale status-log done was treated as terminal"
+  [ "$(queue_count "$state")" = 0 ] || fail "stale status-log done created an actionable wake"
+  unset FM_FAKE_CREW_STATE_STALE_X1
+  pass "status-log terminal output remains fail-closed"
+}
+
+test_pane_idle_proof_is_required_and_bound() {
+  local dir root home fakebin state proof key
+  new_case pane-idle-proof
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "$*" in
+  *capture-pane*) printf '%s\n' "${FM_FAKE_TMUX_CAPTURE:-idle prompt}" ;;
+  *) : ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/tmux"
+  write_meta "$state" pane-proof-x1 pane-proof-inc
+  export FM_FAKE_CREW_STATE_PANE_PROOF_X1='state: done · source: pane · proof required'
+  proof="$state/.pane-idle/pane-proof-x1"
+  key=$(printf '%s' tmux:fm-pane-proof-x1 | tr ':/.' '___')
+  rm -f "$proof"
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "missing pane-idle proof scan failed"
+  [ "$(receipt_count "$state" pending)" = 0 ] || fail "missing pane-idle proof was accepted"
+  write_idle_proof "$state" pane-proof-x1 tmux tmux:fm-pane-proof-x1
+  replace_field "$proof" observed_epoch 1
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "stale pane-idle proof scan failed"
+  [ "$(receipt_count "$state" pending)" = 0 ] || fail "stale pane-idle proof was accepted"
+  write_idle_proof "$state" pane-proof-x1 tmux tmux:fm-pane-proof-x1
+  printf '%s\n' 00000000000000000000000000000000 > "$state/.hash-$key"
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "changed pane-idle hash scan failed"
+  [ "$(receipt_count "$state" pending)" = 0 ] || fail "changed pane-idle hash was accepted"
+  write_idle_proof "$state" pane-proof-x1 tmux tmux:fm-pane-proof-x1
+  replace_field "$state/pane-proof-x1.meta" spawn_incarnation pane-proof-inc-2
+  set_old_mtime "$state/pane-proof-x1.meta"
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "mismatched incarnation scan failed"
+  [ "$(receipt_count "$state" pending)" = 0 ] || fail "mismatched pane-idle incarnation was accepted"
+  write_idle_proof "$state" pane-proof-x1 tmux tmux:fm-pane-proof-x1
+  export FM_FAKE_TMUX_CAPTURE='Working...'
+  export FM_BUSY_REGEX='Working\.\.\.'
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "busy pane-idle proof scan failed"
+  [ "$(receipt_count "$state" pending)" = 0 ] || fail "busy pane-idle proof was accepted"
+  export FM_FAKE_TMUX_CAPTURE='idle prompt'
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "valid pane-idle proof scan failed"
+  [ "$(receipt_count "$state" pending)" = 1 ] || fail "valid pane-idle proof was not accepted"
+  unset FM_BUSY_REGEX FM_FAKE_TMUX_CAPTURE FM_FAKE_CREW_STATE_PANE_PROOF_X1
+  pass "inactive replay requires a fresh identity-bound pane-idle proof"
+}
+
+test_pane_idle_publication_rechecks_under_lock() {
+  local dir root home fakebin state count_file scan_status
+  new_case pane-idle-publication-race
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  count_file="$dir/tmux-capture-count"
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "$*" in
+  *capture-pane*)
+    count=$(cat "${FM_FAKE_TMUX_COUNT_FILE:?}" 2>/dev/null || printf '0')
+    count=$((count + 1))
+    printf '%s\n' "$count" > "$FM_FAKE_TMUX_COUNT_FILE"
+    if [ "$count" = 1 ]; then
+      printf 'idle prompt\n'
+    else
+      printf 'Working...\n'
+    fi
+    ;;
+  *) : ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/tmux"
+  write_meta "$state" pane-race-x1 pane-race-inc
+  export FM_FAKE_CREW_STATE_PANE_RACE_X1='state: done · source: pane · publication race'
+  export FM_FAKE_TMUX_COUNT_FILE="$count_file"
+  : > "$count_file"
+  scan_status=0
+  scan "$root" "$home" "$fakebin" --startup >/dev/null 2>&1 || scan_status=$?
+  [ "$scan_status" = 0 ] || fail "publication-boundary pane retry was not reported as deferred"
+  [ "$(cat "$count_file")" -ge 2 ] || fail "publication-boundary pane was not revalidated"
+  [ "$(receipt_count "$state" pending)" = 0 ] || fail "busy publication-boundary pane created a receipt"
+  [ "$(queue_count "$state")" = 0 ] || fail "busy publication-boundary pane created a wake"
+  [ -e "$state/.inactive-outcome-find.pending" ] || [ -e "$state/.inactive-outcome-find.retry" ] \
+    || fail "publication-boundary failure discarded the durable retry path"
+  [ ! -e "$state/.inactive-outcome-reconcile" ] || fail "publication-boundary failure advanced the cadence marker"
+  unset FM_FAKE_TMUX_COUNT_FILE FM_FAKE_CREW_STATE_PANE_RACE_X1
+  pass "inactive receipt publication rechecks pane idleness under lock"
+}
+
+test_pane_idle_index_reclaims_retired_windows() {
+  local dir root home fakebin state window key live_window live_key index_dir
+  new_case pane-idle-index-retirement
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" retired-index-x1 retired-index-inc
+  write_meta "$state" live-index-x2 live-index-inc ship tmux tmux:fm-live-index-x2
+  window=tmux:fm-retired-index-x1
+  live_window=tmux:fm-live-index-x2
+  if command -v shasum >/dev/null 2>&1; then
+    key=$(printf '%s' "$window" | shasum -a 256 | awk '{print $1}')
+  else
+    key=$(printf '%s' "$window" | sha256sum | awk '{print $1}')
+  fi
+  if command -v shasum >/dev/null 2>&1; then
+    live_key=$(printf '%s' "$live_window" | shasum -a 256 | awk '{print $1}')
+  else
+    live_key=$(printf '%s' "$live_window" | sha256sum | awk '{print $1}')
+  fi
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "initial pane-idle index scan failed"
+  index_dir="$state/.inactive-outcome-pane-idle-index"
+  [ -f "$index_dir/$key" ] || fail "initial pane-idle index entry was not published"
+  [ -f "$index_dir/$live_key" ] || fail "complete current pane-idle snapshot omitted the live window"
+  rm -f "$state/retired-index-x1.meta" "$state/retired-index-x1.status" "$state/retired-index-x1.turn-ended"
+  scan "$root" "$home" "$fakebin" --startup >/dev/null || fail "retired pane-idle index scan failed"
+  [ ! -e "$index_dir/$key" ] || fail "retired pane-idle index entry was not reclaimed"
+  [ -f "$index_dir/$live_key" ] || fail "retired-key reclamation removed the live snapshot entry"
+  [ -f "$index_dir/.ready" ] || fail "pane-idle index did not publish a complete current snapshot"
+  pass "pane-idle index reclaims retired windows after publication"
+}
+
+test_pane_idle_index_refreshes_changed_metadata() {
+  local dir root home fakebin state
+  new_case pane-idle-index-refresh
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" cached-index-x1 cached-index-inc
+  env FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    bash -c '
+      . "$1/bin/fm-pane-idle-lib.sh"
+      fm_pane_idle_meta_index_build "$2" || exit 1
+      [ "$(fm_pane_idle_meta_for_window "$2" tmux:fm-cached-index-x1)" = "$2/cached-index-x1.meta" ] || exit 1
+      sleep 1
+      printf "task=cached-index-x2\nwindow=tmux:fm-cached-index-x2\n" > "$2/cached-index-x2.meta"
+      fm_pane_idle_meta_index_build "$2" || exit 1
+      [ "$(fm_pane_idle_meta_for_window "$2" tmux:fm-cached-index-x2)" = "$2/cached-index-x2.meta" ]
+    ' _ "$ROOT" "$state" \
+    || fail "long-lived pane index did not refresh after metadata creation"
+  pass "pane-idle index refreshes after metadata creation"
+}
+
+test_pane_idle_index_retries_metadata_stamp_race() {
+  local dir root home fakebin state flag
+  new_case pane-idle-index-race
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  flag="$dir/race.flag"
+  printf 'window=tmux:fm-race-a\n' > "$state/race-a.meta"
+  cat > "$fakebin/perl" <<'SH'
+#!/usr/bin/env bash
+set -u
+if [ "${1:-}" = - ] && [ "${2:-}" = "${FM_TEST_RACE_STATE:-}" ] \
+  && [ ! -e "${FM_TEST_RACE_FLAG:-}" ]; then
+  tmp=$(mktemp "${FM_TEST_RACE_DIR:?}/perl-output.XXXXXX")
+  /usr/bin/perl "$@" > "$tmp"
+  rc=$?
+  printf 'window=tmux:fm-race-b\n' > "$FM_TEST_RACE_STATE/race-b.meta"
+  cat "$tmp"
+  rm -f "$tmp"
+  : > "$FM_TEST_RACE_FLAG"
+  exit "$rc"
+fi
+exec /usr/bin/perl "$@"
+SH
+  chmod +x "$fakebin/perl"
+  env FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    FM_TEST_RACE_STATE="$state" FM_TEST_RACE_FLAG="$flag" FM_TEST_RACE_DIR="$dir" \
+    PATH="$fakebin:$PATH" bash -c '
+      . "$1/bin/fm-pane-idle-lib.sh"
+      fm_pane_idle_meta_index_build "$2" || exit 1
+      [ "$(fm_pane_idle_meta_for_window "$2" tmux:fm-race-b)" = "$2/race-b.meta" ]
+    ' _ "$ROOT" "$state" \
+    || fail "metadata stamp race published an incomplete pane-idle index"
+  pass "pane-idle index retries metadata stamp races"
+}
+
+test_pane_idle_index_rejects_publication_stamp_race() {
+  local dir root home fakebin state index key flag status
+  new_case pane-idle-index-publication-race
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"; index="$state/index"; flag="$dir/publication-race.flag"
+  mkdir -p "$index"
+  write_meta "$state" publication-race-x1 publication-race-inc
+  if command -v shasum >/dev/null 2>&1; then
+    key=$(printf '%s' tmux:fm-publication-race-x1 | shasum -a 256 | awk '{print $1}')
+  else
+    key=$(printf '%s' tmux:fm-publication-race-x1 | sha256sum | awk '{print $1}')
+  fi
+  : > "$flag"
+  cat > "$fakebin/perl" <<'SH'
+#!/usr/bin/env bash
+set -u
+args=("$@")
+source_file="${args[$((${#args[@]} - 3))]}"
+target="${args[$((${#args[@]} - 2))]}"
+if [ "$target" = "${FM_TEST_PUBLICATION_PATH:?}" ] && [ -e "${FM_TEST_PUBLICATION_FLAG:?}" ]; then
+  rm -f "$FM_TEST_PUBLICATION_FLAG"
+  printf 'window=tmux:fm-publication-race-x2\n' > "$FM_TEST_PUBLICATION_STATE/publication-race-x2.meta"
+fi
+exec /usr/bin/perl "$@"
+SH
+  chmod +x "$fakebin/perl"
+  set +e
+  env FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    FM_TEST_PUBLICATION_PATH="$index/$key" FM_TEST_PUBLICATION_FLAG="$flag" \
+    FM_TEST_PUBLICATION_STATE="$state" PATH="$fakebin:$PATH" \
+    bash -c '. "$1/bin/fm-pane-idle-lib.sh"; fm_pane_idle_meta_index_persist "$2" "$3"' _ \
+    "$ROOT" "$state" "$index"
+  status=$?
+  set -u
+  [ "$status" = 124 ] || fail "publication stamp race was accepted as current"
+  [ ! -e "$index/.ready" ] || fail "publication stamp race left a ready marker"
+  env FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    FM_TEST_PUBLICATION_PATH="$index/$key" FM_TEST_PUBLICATION_FLAG="$flag" \
+    FM_TEST_PUBLICATION_STATE="$state" PATH="$fakebin:$PATH" bash -c \
+    '. "$1/bin/fm-pane-idle-lib.sh"; fm_pane_idle_meta_index_persist "$2" "$3"' _ \
+    "$ROOT" "$state" "$index" \
+    || fail "pane-idle index did not recover after publication stamp race"
+  [ -f "$index/.ready" ] || fail "recovered pane-idle index was not marked ready"
+  pass "pane-idle publication validates final state stamps"
+}
+
+test_watcher_bounded_metadata_fail_closed() {
+  local dir root home fakebin state status
+  new_case watcher-bounded-metadata
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  write_meta "$state" bounded-metadata-x1 bounded-metadata-inc
+  fm_write_meta "$state/herdr-default.meta" \
+    window=default:pane worktree="$state/work-herdr-default" project="$state/work-herdr-default" \
+    kind=ship mode=ship yolo=off backend=herdr herdr_session=default
+  fm_write_meta "$state/herdr-captain.meta" \
+    window=CAPTAIN:pane worktree="$state/work-herdr-captain" project="$state/work-herdr-captain" \
+    kind=ship mode=ship yolo=off backend=herdr herdr_session=CAPTAIN
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  set +e
+  env -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+    _FM_WORKER_ISOLATION_SNAPSHOT_READY=0 FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" \
+    FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    PATH="$fakebin:$PATH" \
+    bash -c '
+      cd "$1" || exit 1
+      . "$1/bin/fm-watch.sh"
+      deadline=$(fm_pane_idle_now_ms)
+      if window_kind tmux:fm-bounded-metadata-x1 "$deadline" >/dev/null; then exit 1; fi
+      if window_backend tmux:fm-bounded-metadata-x1 "$deadline" >/dev/null; then exit 1; fi
+      fm_pane_idle_meta_index_build "$STATE" || exit 1
+      fresh_deadline=$(( $(fm_pane_idle_now_ms) + 1000 ))
+      recorded_windows "$fresh_deadline" | grep -Fx tmux:fm-bounded-metadata-x1 >/dev/null || exit 1
+      [ "$(window_kind tmux:fm-bounded-metadata-x1 "$fresh_deadline")" = ship ] || exit 1
+      if window_backend default:pane "$fresh_deadline" >/dev/null; then exit 1; fi
+      if window_backend CAPTAIN:pane "$fresh_deadline" >/dev/null; then exit 1; fi
+      exit 0
+    ' _ "$root"
+  status=$?
+  set -u
+  [ "$status" = 0 ] || fail "bounded metadata lookup did not fail closed"
+  pass "watcher refuses unresolved bounded metadata"
+}
+
+test_watcher_skips_deterministic_malformed_metadata() {
+  local dir root home fakebin state out status valid_key
+  local watch_timeout=10
+  new_case watcher-malformed-metadata
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  write_meta "$state" malformed-kind-x1 malformed-kind-inc
+  replace_field "$state/malformed-kind-x1.meta" kind invalid-kind
+  write_meta "$state" malformed-backend-x1 malformed-backend-inc
+  replace_field "$state/malformed-backend-x1.meta" backend invalid-backend
+  write_meta "$state" valid-scan-x1 valid-scan-inc
+  rm -f "$state"/.hash-* "$state"/.count-* "$state"/*.status "$state"/*.turn-ended
+  touch "$state/.inactive-outcome-reconcile"
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  set +e
+  out=$(cd "$root" && env -u NO_MISTAKES_GATE -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+    PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$home/data" FM_CONFIG_OVERRIDE="$home/config" \
+    FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_INACTIVE_OUTCOME_SECS=60 \
+    FM_INACTIVE_OUTCOME_BUDGET_SECS=10 FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux TMUX=fake,1,0 \
+    FM_FAKE_PANE_PATH="$home" FM_POLL=1 FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 \
+    FM_WATCHER_HEARTBEAT=999999 FM_BUSY_REGEX='idle prompt' bash -c \
+      '. "$1/bin/fm-pane-idle-lib.sh"; shift; fm_pane_idle_run_bounded_child "$@"' \
+      _ "$ROOT" "$watch_timeout" "$root/bin/fm-watch.sh" 2>&1)
+  status=$?
+  set -u
+  [ "$status" = 124 ] || fail "watcher did not remain bounded while scanning malformed metadata: $out"
+  valid_key=$(printf '%s' tmux:fm-valid-scan-x1 | tr ':/.' '___')
+  [ -f "$state/.hash-$valid_key" ] || fail "watcher did not process the valid window after malformed metadata"
+  pass "watcher advances past deterministic malformed metadata"
+}
+
+test_pane_idle_snapshot_reads_honor_deadline() {
+  local dir root home fakebin state deadline status
+  new_case pane-idle-snapshot-deadline
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" snapshot-deadline-x1 snapshot-deadline-inc
+  cat > "$fakebin/perl" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "${2:-}" in
+  */.pane-idle-meta-index/snapshot) sleep 2 ;;
+esac
+exec /usr/bin/perl "$@"
+SH
+  chmod +x "$fakebin/perl"
+  set +e
+  env FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    PATH="$fakebin:$PATH" bash -c '
+      . "$1/bin/fm-pane-idle-lib.sh"
+      fm_pane_idle_meta_index_build "$2" || exit 1
+      deadline=$(( $(fm_pane_idle_now_ms) + 1000 ))
+      fm_pane_idle_meta_for_window "$2" tmux:fm-snapshot-deadline-x1 "$deadline" >/dev/null
+    ' _ "$ROOT" "$state"
+  status=$?
+  set -u
+  [ "$status" = 124 ] || fail "indexed snapshot lookup ignored its deadline"
+  pass "pane-idle snapshot reads honor deadlines"
+}
+
+test_pane_idle_snapshot_compare_honors_deadline() {
+  local dir root home fakebin state index deadline status
+  new_case pane-idle-snapshot-compare-deadline
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"; index="$state/index"
+  write_meta "$state" snapshot-compare-x1 snapshot-compare-inc
+  mkdir -p "$index"
+  cat > "$fakebin/cmp" <<'SH'
+#!/usr/bin/env bash
+set -u
+if [ "${FM_TEST_SLEEP_CMP:-0}" = 1 ]; then sleep 2; fi
+exec /usr/bin/cmp "$@"
+SH
+  chmod +x "$fakebin/cmp"
+  env FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    PATH="$fakebin:$PATH" FM_TEST_SLEEP_CMP=0 bash -c '
+      . "$1/bin/fm-pane-idle-lib.sh"
+      fm_pane_idle_meta_index_persist "$2" "$3"
+    ' _ "$ROOT" "$state" "$index" \
+    || fail "could not create the baseline pane-idle snapshot"
+  set +e
+  env FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    PATH="$fakebin:$PATH" FM_TEST_SLEEP_CMP=1 bash -c '
+      . "$1/bin/fm-pane-idle-lib.sh"
+      deadline=$(( $(fm_pane_idle_now_ms) + 1000 ))
+      fm_pane_idle_meta_index_persist "$2" "$3" "$deadline"
+    ' _ "$ROOT" "$state" "$index"
+  status=$?
+  set -u
+  [ "$status" = 124 ] || fail "snapshot comparison ignored its deadline"
+  pass "pane-idle snapshot comparisons honor deadlines"
+}
+
+test_pane_idle_lookup_propagates_deadline() {
+  local dir root home fakebin state deadline status proof
+  new_case pane-idle-lookup-deadline
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  write_meta "$state" deadline-x1 deadline-inc
+  proof="$state/.pane-idle/deadline-x1"
+  deadline=$(env FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    bash -c '. "$1/bin/fm-pane-idle-lib.sh"; fm_pane_idle_now_ms' _ "$ROOT" "$state") \
+    || fail "could not create a pane-idle lookup deadline"
+  set +e
+  env FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    bash -c '. "$1/bin/fm-pane-idle-lib.sh"; fm_pane_idle_meta_for_window "$2" tmux:fm-deadline-x1 "$3"' \
+    _ "$ROOT" "$state" "$deadline" >/dev/null 2>&1
+  status=$?
+  set -u
+  [ "$status" = 124 ] || fail "pane-idle lookup ignored its deadline"
+  env FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    bash -c '. "$1/bin/fm-pane-idle-lib.sh"; fm_pane_idle_clear_for_window "$2" tmux:fm-deadline-x1 "$3"' \
+    _ "$ROOT" "$state" "$deadline" \
+    || fail "deadline-limited pane-idle clear failed"
+  [ -f "$proof" ] || fail "deadline-limited clear removed the idle proof"
+  pass "pane-idle lookup and clear honor scan deadlines"
+}
+
+test_pane_idle_index_resumes_and_rejects_path_cursor() {
+  local dir root home fakebin state progress output stamp
+  new_case pane-idle-index-cursor
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  progress="$state/.pane-idle-meta-index"
+  output="$state/cursor-output"
+  write_meta "$state" cursor-a cursor-a-inc
+  write_meta "$state" cursor-b cursor-b-inc
+  mkdir -p "$progress"
+  : > "$output"
+  printf '%s\n%s\n' "$state/cursor-a.meta" "$state/cursor-b.meta" > "$progress/.scan.entries"
+  printf 'complete\n' > "$progress/.scan.entries.complete"
+  stamp=$(env FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    bash -c '. "$1/bin/fm-pane-idle-lib.sh"; fm_pane_idle_path_stamp "$2"' \
+    _ "$ROOT" "$state") || fail "could not stamp the pane-idle metadata state"
+  printf '%s\n' "$stamp" > "$progress/.scan.entries.stamp"
+  printf '%s\n' "$state/cursor-a.meta" > "$progress/.scan.cursor"
+  env FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    bash -c '. "$1/bin/fm-pane-idle-lib.sh"; fm_pane_idle_meta_index_collect "$2" "$3"' \
+    _ "$ROOT" "$state" "$output" || fail "valid path cursor did not resume the pane-idle scan"
+  [ ! -e "$progress/.scan.seen" ] || \
+    ! grep -Fqx "$state/cursor-a.meta" "$progress/.scan.seen" \
+    || fail "valid path cursor rescanned its completed metadata"
+  grep -Fqx "$state/cursor-b.meta" "$progress/.scan.seen" \
+    || fail "valid path cursor skipped the remaining metadata"
+
+  new_case pane-idle-index-invalid-cursor
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  progress="$state/.pane-idle-meta-index"
+  output="$state/cursor-output"
+  write_meta "$state" invalid-a invalid-a-inc
+  mkdir -p "$progress"
+  : > "$output"
+  printf '%s\n' "$state/invalid-a.meta" > "$progress/.scan.entries"
+  printf 'complete\n' > "$progress/.scan.entries.complete"
+  stamp=$(env FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    bash -c '. "$1/bin/fm-pane-idle-lib.sh"; fm_pane_idle_path_stamp "$2"' \
+    _ "$ROOT" "$state") || fail "could not stamp the invalid cursor state"
+  printf '%s\n' "$stamp" > "$progress/.scan.entries.stamp"
+  printf '/tmp/unsafe-pane-idle.meta\n' > "$progress/.scan.cursor"
+  if env FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    bash -c '. "$1/bin/fm-pane-idle-lib.sh"; fm_pane_idle_meta_index_collect "$2" "$3"' \
+    _ "$ROOT" "$state" "$output"; then
+    fail "unsafe path cursor was accepted"
+  fi
+  [ ! -s "$progress/.scan.seen" ] || fail "unsafe path cursor processed metadata"
+  pass "pane-idle scan resumes valid path cursors and rejects unsafe cursors"
+}
+
+test_pane_idle_resumable_duplicate_windows_fail_closed() {
+  local dir root home fakebin state progress first_output second_output first_cursor first_window second_cursor second_window
+  new_case pane-idle-cross-chunk-duplicate
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  progress="$state/.pane-idle-meta-index"
+  first_output="$state/duplicate-first"
+  second_output="$state/duplicate-second"
+  write_meta "$state" duplicate-a duplicate-a-inc
+  write_meta "$state" duplicate-b duplicate-b-inc
+  replace_field "$state/duplicate-a.meta" window tmux:duplicate-window
+  replace_field "$state/duplicate-b.meta" window tmux:duplicate-window
+  mkdir -p "$progress"
+  printf '%s\n%s\n' "$state/duplicate-a.meta" "$state/duplicate-b.meta" > "$progress/.scan.entries"
+  printf 'complete\n' > "$progress/.scan.entries.complete"
+  env FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    bash -c '. "$1/bin/fm-pane-idle-lib.sh"; fm_pane_idle_meta_index_windows_direct_resumable "$2" 0' \
+    _ "$ROOT" "$state" > "$first_output" || fail "first duplicate-window chunk failed"
+  exec 3<"$first_output"
+  IFS= read -r -d '' first_cursor <&3 || fail "first duplicate-window cursor was missing"
+  IFS= read -r -d '' first_window <&3 || fail "first duplicate-window result was incomplete"
+  exec 3<&-
+  [ -n "$first_cursor" ] || fail "first duplicate-window cursor did not advance"
+  [ -z "$first_window" ] || fail "first duplicate-window chunk emitted an ambiguous window"
+  env FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    bash -c '. "$1/bin/fm-pane-idle-lib.sh"; fm_pane_idle_meta_index_windows_direct_resumable "$2" "$3"' \
+    _ "$ROOT" "$state" "$first_cursor" > "$second_output" \
+    || fail "second duplicate-window chunk failed"
+  exec 3<"$second_output"
+  IFS= read -r -d '' second_cursor <&3 || fail "second duplicate-window cursor was missing"
+  IFS= read -r -d '' second_window <&3 || fail "second duplicate-window result was incomplete"
+  exec 3<&-
+  [ "$second_cursor" != "$first_cursor" ] || fail "second duplicate-window cursor did not advance"
+  [ -z "$second_window" ] || fail "second duplicate-window chunk emitted an ambiguous window"
+  pass "pane-idle resumable scans suppress duplicate windows globally"
+}
+
+test_pane_idle_index_retries_partial_publication_idempotently() {
+  local dir root home fakebin state progress output stamp
+  local record_fields aggregate_lines
+  new_case pane-idle-index-idempotency
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  progress="$state/.pane-idle-meta-index"
+  output="$state/idempotent-output"
+  write_meta "$state" idempotent-x1 idempotent-inc
+  mkdir -p "$progress"
+  : > "$output"
+  printf '%s\n' "$state/idempotent-x1.meta" > "$progress/.scan.entries"
+  printf 'complete\n' > "$progress/.scan.entries.complete"
+  stamp=$(env FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    bash -c '. "$1/bin/fm-pane-idle-lib.sh"; fm_pane_idle_path_stamp "$2"' \
+    _ "$ROOT" "$state") || fail "could not stamp the idempotency state"
+  printf '%s\n' "$stamp" > "$progress/.scan.entries.stamp"
+  env FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    bash -c '. "$1/bin/fm-pane-idle-lib.sh"; fm_pane_idle_meta_index_collect "$2" "$3"' \
+    _ "$ROOT" "$state" "$output" || fail "initial pane-idle index build failed"
+  rm -f "$progress/.scan.complete" "$progress/.scan.aggregate.complete" \
+    "$progress/.scan.sorted" "$progress/.scan.sorted.complete"
+  printf 'partial-record\0' >> "$progress/.scan.records"
+  printf 'partial-aggregate' >> "$progress/.scan.aggregate"
+  printf '%s\n' "$state/0.meta" > "$progress/.scan.cursor"
+  printf '0\n' > "$progress/.scan.aggregate.cursor"
+  env FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    bash -c '. "$1/bin/fm-pane-idle-lib.sh"; fm_pane_idle_meta_index_collect "$2" "$3"' \
+    _ "$ROOT" "$state" "$output" || fail "partial pane-idle index retry failed"
+  record_fields=$(tr -cd '\0' < "$progress/.scan.records" | wc -c | tr -d ' ')
+  [ "$record_fields" = 3 ] || fail "partial retry duplicated the metadata record"
+  [ "$(grep -Fxc "$state/idempotent-x1.meta" "$progress/.scan.seen")" = 1 ] \
+    || fail "partial retry duplicated the seen marker"
+  aggregate_lines=$(wc -l < "$progress/.scan.aggregate" | tr -d ' ')
+  [ "$aggregate_lines" = 1 ] || fail "partial retry duplicated the aggregate mapping"
+  pass "pane-idle partial publication retries without duplicate records"
+}
+
+test_secondmate_route_accepts_effective_state_overrides() {
+  local dir root home fakebin child_home child_state effective_state pending_dir corr marker
+  new_case secondmate-effective-state
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  child_home="$dir/secondmate-home"
+  child_state="$child_home/state"
+  effective_state="$dir/effective-state"
+  pending_dir="$dir/effective-pending"
+  marker="$child_state/.fm-jt-parent-route"
+  mkdir -p "$child_state" "$child_home/data" "$child_home/config" "$effective_state"
+  printf 'sm-effective\n' > "$child_home/.fm-secondmate-home"
+  : > "$effective_state/sm-effective.status"
+  corr=$(env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$effective_state" FM_PENDING_REPLY_DIR_OVERRIDE="$pending_dir" \
+    bash -c '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_create "$2" "$3" sm-effective "effective state request"' \
+    _ "$ROOT" "$home" "$effective_state") \
+    || fail "effective-state pending record was not created"
+  env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$effective_state" FM_PENDING_REPLY_DIR_OVERRIDE="$pending_dir" \
+    bash -c '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_secondmate_route_write "$2" "$3" "$4" "$5" "$6"' \
+    _ "$ROOT" "$child_home" "$home" "$effective_state" sm-effective "$corr" \
+    || fail "effective-state secondmate route was rejected"
+  [ -f "$marker" ] || fail "effective-state route marker was not written"
+  [ "$(receipt_value "$marker" parent_status)" = "$effective_state/sm-effective.status" ] \
+    || fail "effective-state route serialized the wrong parent status"
+  env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$effective_state" FM_PENDING_REPLY_DIR_OVERRIDE="$pending_dir" \
+    bash -c '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_secondmate_route_validate "$2" "$3" 2' \
+    _ "$ROOT" "$child_home" "$corr" \
+    || fail "effective-state secondmate route did not validate"
+  unset FM_STATE_OVERRIDE FM_PENDING_REPLY_DIR_OVERRIDE
+  pass "secondmate routes validate effective state and pending-reply overrides"
+}
+
+test_valid_secondmate_route_reports_parent_once() {
+  local dir root home fakebin state child_home child_state parent_status corr rec outside send_out route_backup
+  local outside_parent outside_parent_link other_parent fail_move_once fingerprint
+  local history_corr history_record history_status history_rec active_record active_backup
+  new_case secondmate-route-valid
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  child_home="$dir/secondmate-home"
+  child_state="$child_home/state"
+  mkdir -p "$child_state" "$child_state/terminal-outcomes" "$child_home/data" "$child_home/config" \
+    "$state/pending-replies" "$state/pending-reply-history"
+  printf 'sm-valid\n' > "$child_home/.fm-secondmate-home"
+  write_meta "$state" sm-valid parent-inc secondmate tmux firstmate:fm-sm-valid
+  printf 'home=%s\n' "$child_home" >> "$state/sm-valid.meta"
+  write_meta "$child_state" child-x1 child-inc
+  parent_status="$state/sm-valid.status"
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "$*" in
+  *"#{cursor_y}"*) printf '1\n' ;;
+  *capture-pane*)
+    case "$*" in
+      *" -S -40"*) printf 'idle prompt\n' ;;
+      *) : ;;
+    esac
+    ;;
+  *) : ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/tmux"
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  prepare_watcher_protocol "$root" "$home" "$state"
+  send_out=$(cd "$root" && env -u NO_MISTAKES_GATE -u FM_AGENT_ROLE -u FM_AGENT_TASK -u FM_AGENT_OWNER_HOME \
+    -u FM_ROOT -u STATE PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux TMUX=fake,1,0 \
+    FM_SEND_SETTLE=0 FM_SEND_SLEEP=0 FM_SEND_RETRIES=1 "$root/bin/fm-send.sh" \
+    fm-sm-valid "parent request" 2>&1) || fail "public fm-send route setup failed: $send_out"
+  corr=$(basename "$(direct_first_file "$state/pending-replies" '*')")
+  [ -n "$corr" ] || fail "public fm-send did not create a correlation record"
+  export FM_FAKE_CREW_STATE_CHILD_X1='state: failed · source: pane · child quiet'
+  scan "$root" "$child_home" "$fakebin" --startup >/dev/null
+  [ "$(receipt_count "$child_state" pending)" = 1 ] || fail "valid secondmate route did not create a pending receipt"
+  rec=$(direct_first_file "$child_state/terminal-outcomes" '*.pending')
+  [ "$(receipt_value "$rec" parent_task_id)" = sm-valid ] || fail "secondmate receipt did not persist its parent task identity"
+  [ "$(receipt_value "$rec" parent_corr)" = "$corr" ] || fail "secondmate receipt did not persist its parent correlation"
+  [ "$(receipt_value "$rec" parent_home)" = "$home" ] || fail "secondmate receipt did not persist its parent home"
+  [ "$(receipt_value "$rec" parent_status)" = "$parent_status" ] || fail "secondmate receipt did not persist its parent status path"
+  other_parent="$dir/other-parent"
+  mkdir -p "$other_parent"
+  replace_field "$state/pending-replies/$corr" parent_home "$other_parent"
+  if drain "$root" "$child_home" "$fakebin" >/dev/null 2>&1; then
+    fail "secondmate acknowledgement accepted a mismatched real parent home"
+  fi
+  [ "$(receipt_count "$child_state" pending)" = 1 ] || fail "mismatched real parent home consumed the pending receipt"
+  replace_field "$state/pending-replies/$corr" parent_home "$home"
+  route_backup="$dir/route-backup"
+  mv "$child_state/.fm-jt-parent-route" "$route_backup"
+  if drain "$root" "$child_home" "$fakebin" >/dev/null 2>&1; then
+    fail "secondmate acknowledgement accepted a missing route marker"
+  fi
+  [ "$(receipt_count "$child_state" pending)" = 1 ] || fail "missing route marker consumed the pending receipt"
+  ! grep -Fq "failed [corr=$corr]: inactive terminal outcome replayed: task=child-x1" "$parent_status" 2>/dev/null \
+    || fail "missing route marker wrote parent status"
+  mv "$route_backup" "$child_state/.fm-jt-parent-route"
+  replace_field "$child_state/.fm-jt-parent-route" corr_id 1123456789abcdef
+  if drain "$root" "$child_home" "$fakebin" >/dev/null 2>&1; then
+    fail "secondmate acknowledgement accepted a mismatched route marker"
+  fi
+  [ "$(receipt_count "$child_state" pending)" = 1 ] || fail "mismatched route marker consumed the pending receipt"
+  ! grep -Fq "failed [corr=$corr]: inactive terminal outcome replayed: task=child-x1" "$parent_status" 2>/dev/null \
+    || fail "mismatched route marker wrote parent status"
+  replace_field "$child_state/.fm-jt-parent-route" corr_id "$corr"
+  active_record="$state/pending-replies/$corr"
+  active_backup="$dir/active-record-backup"
+  mkdir -p "$state/pending-reply-history"
+  cp "$active_record" "$state/pending-reply-history/$corr"
+  mv "$active_record" "$active_backup"
+  ln -s "$active_backup" "$active_record"
+  if drain "$root" "$child_home" "$fakebin" >/dev/null 2>&1; then
+    fail "secondmate receipt validation fell through a symlinked active record"
+  fi
+  [ "$(receipt_count "$child_state" pending)" = 1 ] || fail "symlinked active record lost the pending receipt"
+  rm -f "$active_record" "$state/pending-reply-history/$corr"
+  mv "$active_backup" "$active_record"
+  outside_parent="$dir/outside-parent"
+  outside_parent_link="$dir/outside-parent-link"
+  mkdir -p "$outside_parent/state"
+  ln -s "$outside_parent" "$outside_parent_link"
+  replace_field "$rec" parent_home "$outside_parent_link"
+  if drain "$root" "$child_home" "$fakebin" >/dev/null 2>&1; then
+    fail "secondmate acknowledgement accepted a symlinked parent home"
+  fi
+  [ ! -e "$outside_parent/state/pending-replies/.txn-$corr.lock" ] \
+    || fail "secondmate acknowledgement acquired a transaction lock before path validation"
+  replace_field "$rec" parent_home "$home"
+  outside="$dir/outside-status"
+  printf 'outside\n' > "$outside"
+  rm -f "$parent_status"
+  ln -s "$outside" "$parent_status"
+  if drain "$root" "$child_home" "$fakebin" >/dev/null 2>&1; then
+    fail "secondmate acknowledgement followed a parent status symlink"
+  fi
+  [ "$(receipt_count "$child_state" pending)" = 1 ] || fail "symlinked parent status lost the pending receipt"
+  rm -f "$parent_status"
+  fingerprint=${rec##*/}
+  fingerprint=${fingerprint%.pending}
+  rm -f "$child_state/terminal-outcomes/.$fingerprint.claim"
+  fail_move_once="$dir/fail-reported-rename-once"
+  : > "$fail_move_once"
+  cat > "$fakebin/perl" <<'SH'
+#!/usr/bin/env bash
+set -u
+if [ "$#" -eq 5 ] && [ "${5:-}" = 1 ] && case "${4:-}" in *.reported) true ;; *) false ;; esac \
+  && [ -e "${FM_TEST_FAIL_REPORTED_RENAME:?}" ]; then
+  rm -f "$FM_TEST_FAIL_REPORTED_RENAME"
+  exit 42
+fi
+exec /usr/bin/perl "$@"
+SH
+  chmod +x "$fakebin/perl"
+  export FM_TEST_FAIL_REPORTED_RENAME="$fail_move_once"
+  if drain "$root" "$child_home" "$fakebin" >/dev/null 2>&1; then
+    fail "secondmate acknowledgement hid a receipt move failure"
+  fi
+  [ "$(receipt_count "$child_state" pending)" = 1 ] || fail "receipt move failure consumed the pending receipt"
+  [ -f "$child_state/.fm-jt-parent-route" ] || fail "receipt move failure cleared the route before transition"
+  rm -f "$fakebin/perl"
+  unset FM_TEST_FAIL_REPORTED_RENAME
+  replace_field "$child_state/terminal-outcomes/.$fingerprint.claim" output_started 1
+  replace_field "$child_state/terminal-outcomes/.$fingerprint.claim" output_emitted 1
+  replace_field "$child_state/terminal-outcomes/.$fingerprint.claim" output_complete 1
+  replace_field "$child_state/terminal-outcomes/.$fingerprint.claim" output_confirmed 1
+  replace_field "$child_state/terminal-outcomes/.$fingerprint.claim" caller_confirmed 1
+  replace_field "$child_state/terminal-outcomes/.$fingerprint.claim" defer_generation_start proc:0
+  if ! drain "$root" "$child_home" "$fakebin" >"$dir/second-drain.out" 2>&1; then
+    cat "$dir/second-drain.out" >&2
+    fail "valid secondmate route drain failed after symlink removal"
+  fi
+  ! grep -F 'inactive-outcome:' "$dir/second-drain.out" >/dev/null \
+    || fail "already-recorded parent report was presented again"
+  [ "$(receipt_count "$child_state" reported)" = 1 ] || fail "valid secondmate route was not reported"
+  [ ! -e "$child_state/.fm-jt-parent-route" ] || fail "reported secondmate route was not cleared after its parent report"
+  grep -F "failed [corr=$corr]: inactive terminal outcome replayed: task=child-x1" "$parent_status" >/dev/null \
+    || fail "valid secondmate route did not append the correlated parent status"
+  drain "$root" "$child_home" "$fakebin" >/dev/null
+  [ "$(grep -Fc "failed [corr=$corr]: inactive terminal outcome replayed: task=child-x1" "$parent_status")" = 1 ] \
+    || fail "secondmate parent report was duplicated"
+
+  printf 'sm-history\n' > "$child_home/.fm-secondmate-home"
+  write_meta "$state" sm-history history-parent-inc secondmate tmux firstmate:fm-sm-history
+  printf 'home=%s\n' "$child_home" >> "$state/sm-history.meta"
+  history_status="$state/sm-history.status"
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  send_out=$(cd "$root" && env -u NO_MISTAKES_GATE -u FM_AGENT_ROLE -u FM_AGENT_TASK -u FM_AGENT_OWNER_HOME \
+    -u FM_ROOT -u STATE PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux TMUX=fake,1,0 \
+    FM_SEND_SETTLE=0 FM_SEND_SLEEP=0 FM_SEND_RETRIES=1 "$root/bin/fm-send.sh" \
+    fm-sm-history "history request" 2>&1) || fail "public fm-send history route setup failed: $send_out"
+  history_corr=
+  for history_record in "$state"/pending-replies/*; do
+    [ -f "$history_record" ] || continue
+    [ "$(basename "$history_record")" = "$corr" ] || history_corr=$(basename "$history_record")
+  done
+  [ -n "$history_corr" ] || fail "public fm-send did not create a distinct history correlation"
+  history_record="$state/pending-replies/$history_corr"
+  replace_field "$history_record" phase resolved
+  (cd "$root" && env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    bash -c '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_archive_terminal "$2" "$3"' \
+    _ "$ROOT" "$state" "$history_corr") \
+    || fail "parent terminal lifecycle did not archive the history record"
+  [ -f "$state/pending-reply-history/$history_corr" ] || fail "parent history record was not archived"
+  write_meta "$child_state" child-history-x1 child-history-inc
+  export FM_FAKE_CREW_STATE_CHILD_HISTORY_X1='state: done · source: pane · history child quiet'
+  scan "$root" "$child_home" "$fakebin" --startup \
+    || fail "pending-reply-history route scan failed"
+  [ "$(receipt_count "$child_state" pending)" = 2 ] || fail "pending-reply-history route did not create route-bound receipts"
+  history_rec=
+  for rec in "$child_state"/terminal-outcomes/*.pending; do
+    [ -f "$rec" ] || continue
+    [ "$(receipt_value "$rec" task_id)" = child-history-x1 ] || continue
+    history_rec=$rec
+  done
+  [ -n "$history_rec" ] || fail "history route did not create its route-bound receipt"
+  [ "$(receipt_value "$history_rec" parent_corr)" = "$history_corr" ] \
+    || fail "history route receipt used the wrong parent correlation"
+  drain "$root" "$child_home" "$fakebin" >/dev/null \
+    || fail "pending-reply-history route drain failed"
+  [ "$(receipt_count "$child_state" reported)" = 3 ] || fail "history route receipts were not reported"
+  [ ! -e "$child_state/.fm-jt-parent-route" ] || fail "history route marker was not cleared after presentation"
+  ! grep -F 'inactive terminal outcome replayed: task=child-history-x1' "$history_status" >/dev/null 2>&1 \
+    || fail "resolved history route appended a duplicate parent status"
+  unset FM_FAKE_CREW_STATE_CHILD_X1 FM_FAKE_CREW_STATE_CHILD_HISTORY_X1
+  pass "valid secondmate outcomes use the parent status correlation exactly once"
+}
+
+test_deferred_recorded_secondmate_finishes_without_output() {
+  local dir root home fakebin state child_home child_state parent_status corr rec fingerprint line send_out
+  new_case secondmate-recorded-deferred
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  child_home="$dir/secondmate-home"
+  child_state="$child_home/state"
+  parent_status="$state/sm-recorded.status"
+  mkdir -p "$child_state" "$child_state/terminal-outcomes" "$child_home/data" "$child_home/config" \
+    "$state/pending-replies" "$state/pending-reply-history"
+  printf 'sm-recorded\n' > "$child_home/.fm-secondmate-home"
+  write_meta "$state" sm-recorded parent-inc secondmate tmux firstmate:fm-sm-recorded
+  printf 'home=%s\n' "$child_home" >> "$state/sm-recorded.meta"
+  write_meta "$child_state" child-recorded-x1 child-recorded-inc
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "$*" in
+  *"#{cursor_y}"*) printf '1\n' ;;
+  *capture-pane*)
+    case "$*" in
+      *" -S -40"*) printf 'idle prompt\n' ;;
+      *) : ;;
+    esac
+    ;;
+  *) : ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/tmux"
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  prepare_watcher_protocol "$root" "$home" "$state"
+  send_out=$(cd "$root" && env -u NO_MISTAKES_GATE -u FM_AGENT_ROLE -u FM_AGENT_TASK -u FM_AGENT_OWNER_HOME \
+    -u FM_ROOT -u STATE PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux TMUX=fake,1,0 \
+    FM_SEND_SETTLE=0 FM_SEND_SLEEP=0 FM_SEND_RETRIES=1 "$root/bin/fm-send.sh" \
+    fm-sm-recorded "parent request" 2>&1) || fail "recorded secondmate route setup failed: $send_out"
+  corr=$(basename "$(direct_first_file "$state/pending-replies" '*')")
+  [ -n "$corr" ] || fail "recorded secondmate route did not create a correlation"
+  export FM_FAKE_CREW_STATE_CHILD_RECORDED_X1='state: failed · source: pane · child already reported'
+  scan "$root" "$child_home" "$fakebin" --startup >/dev/null \
+    || fail "recorded secondmate scan failed"
+  rec=$(direct_first_file "$child_state/terminal-outcomes" '*.pending')
+  fingerprint=$(basename "$rec" .pending)
+  line="failed [corr=$corr]: inactive terminal outcome replayed: task=child-recorded-x1 fingerprint=$fingerprint"
+  printf '%s\n' "$line" >> "$parent_status"
+  export FM_WAKE_DRAIN_DEFER_ACK=1 FM_WAKE_DRAIN_GENERATION="$$"
+  drain "$root" "$child_home" "$fakebin" >"$dir/recorded-deferred.out" \
+    || fail "recorded secondmate deferred drain failed"
+  [ ! -s "$dir/recorded-deferred.out" ] \
+    || fail "already-recorded secondmate receipt was presented to the caller"
+  [ "$(receipt_count "$child_state" pending)" = 0 ] \
+    || fail "already-recorded secondmate receipt remained pending"
+  [ "$(receipt_count "$child_state" reported)" = 1 ] \
+    || fail "already-recorded secondmate receipt was not finalized"
+  [ "$(queue_count "$child_state")" = 0 ] \
+    || fail "already-recorded secondmate wake remained queued"
+  [ ! -e "$child_state/.fm-jt-parent-route" ] \
+    || fail "already-recorded secondmate route was not cleared"
+  [ "$(grep -Fc "$line" "$parent_status")" = 1 ] \
+    || fail "already-recorded secondmate parent report was duplicated"
+  unset FM_WAKE_DRAIN_DEFER_ACK FM_WAKE_DRAIN_GENERATION FM_FAKE_CREW_STATE_CHILD_RECORDED_X1
+  pass "recorded secondmate reports finalize without caller output"
+}
+
+test_reported_secondmate_route_repair_after_crash() {
+  local dir root home fakebin state child_home child_state parent_status corr fingerprint flag
+  new_case secondmate-reported-route-repair
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  child_home="$dir/secondmate-home"
+  child_state="$child_home/state"
+  parent_status="$state/sm-reported.status"
+  corr=0123456789abcdef
+  mkdir -p "$child_state" "$child_state/terminal-outcomes" "$child_home/data" "$child_home/config" \
+    "$state/pending-replies" "$state/pending-reply-history"
+  printf 'sm-reported\n' > "$child_home/.fm-secondmate-home"
+  fm_write_meta "$state/pending-replies/$corr" \
+    schema=fm-pending-reply.v1 corr_id="$corr" task_id=sm-reported \
+    parent_home="$home" parent_status="$parent_status" delivered_epoch=1 phase=awaiting_report
+  env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" bash -c \
+    '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_secondmate_route_write "$2" "$3" "$4" "$5" "$6"' \
+    _ "$ROOT" "$child_home" "$home" "$state" sm-reported "$corr" \
+    || fail "reported route fixture was not written"
+  fingerprint=$(receipt_fingerprint 'child-reported-x1|child-reported-inc|failed|state: failed · source: pane · reported crash' secondmate "$corr")
+  fm_write_meta "$child_state/terminal-outcomes/$fingerprint.reported" \
+    schema=fm-jt-terminal-outcome.v1 fingerprint="$fingerprint" task_id=child-reported-x1 \
+    incarnation=child-reported-inc outcome=failed terminal_source=pane \
+    terminal_snapshot='state: failed · source: pane · reported crash' kind=secondmate \
+    parent_task_id=sm-reported parent_home="$home" parent_status="$parent_status" parent_corr="$corr"
+  flag="$dir/fail-route-clear-once"
+  : > "$flag"
+  cat > "$fakebin/rm" <<'SH'
+#!/usr/bin/env bash
+set -u
+for arg in "$@"; do
+  if [ "$arg" = "${FM_TEST_ROUTE_RM_PATH:-}" ] && [ -e "${FM_TEST_ROUTE_RM_ONCE:-}" ]; then
+    /bin/rm -f "$FM_TEST_ROUTE_RM_ONCE"
+    exit 42
+  fi
+done
+exec /bin/rm "$@"
+SH
+  chmod +x "$fakebin/rm"
+  export FM_TEST_ROUTE_RM_PATH="$child_state/.fm-jt-parent-route" FM_TEST_ROUTE_RM_ONCE="$flag"
+  if scan "$root" "$child_home" "$fakebin" --startup >/dev/null 2>&1; then
+    fail "reported route cleanup failure was hidden"
+  fi
+  [ -f "$child_state/terminal-outcomes/$fingerprint.reported" ] \
+    || fail "reported receipt was lost during route cleanup failure"
+  [ -e "$child_state/.fm-jt-parent-route" ] \
+    || fail "route was removed before reported cleanup completed"
+  rm -f "$fakebin/rm"
+  unset FM_TEST_ROUTE_RM_PATH FM_TEST_ROUTE_RM_ONCE
+  scan "$root" "$child_home" "$fakebin" --startup >/dev/null \
+    || fail "reported route cleanup did not retry"
+  [ ! -e "$child_state/.fm-jt-parent-route" ] \
+    || fail "reported route remained after retry"
+  pass "reported secondmate routes recover after receipt finalization crashes"
+}
+
+test_reported_route_repair_is_bounded() {
+  local dir root home fakebin state fingerprint first second index
+  new_case reported-route-repair-limit
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  mkdir -p "$state/terminal-outcomes"
+  for index in 1 2 3; do
+    fingerprint=$(receipt_fingerprint "reported-limit-x${index}|reported-limit-inc-${index}|done|reported limit ${index}")
+    fm_write_meta "$state/terminal-outcomes/$fingerprint.reported" \
+      schema=fm-jt-terminal-outcome.v1 fingerprint="$fingerprint" task_id="reported-limit-x${index}" \
+      incarnation="reported-limit-inc-${index}" outcome=done terminal_source=pane \
+      terminal_snapshot="reported limit ${index}" kind=ship
+  done
+  export FM_REPORTED_ROUTE_REPAIR_LIMIT=1
+  scan "$root" "$home" "$fakebin" --startup >/dev/null \
+    || fail "bounded reported-receipt maintenance failed on the first scan"
+  first=$(cat "$state/.reported-secondmate-route-repair.cursor" 2>/dev/null || true)
+  [ -n "$first" ] || fail "bounded reported-receipt maintenance did not persist a cursor"
+  scan "$root" "$home" "$fakebin" --startup >/dev/null \
+    || fail "bounded reported-receipt maintenance failed on the second scan"
+  second=$(cat "$state/.reported-secondmate-route-repair.cursor" 2>/dev/null || true)
+  [ -n "$second" ] && [ "$second" != "$first" ] \
+    || fail "bounded reported-receipt maintenance did not advance incrementally"
+  [ "$(receipt_count "$state" reported)" = 3 ] \
+    || fail "bounded reported-receipt maintenance discarded durable receipts"
+  unset FM_REPORTED_ROUTE_REPAIR_LIMIT
+  pass "reported route maintenance advances through bounded receipt batches"
+}
+
+test_pending_receipt_republish_is_bounded() {
+  local dir root home fakebin state fingerprint first second index
+  new_case pending-receipt-republish-limit
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  mkdir -p "$state/terminal-outcomes"
+  for index in 1 2 3; do
+    write_meta "$state" "pending-limit-x${index}" "pending-limit-inc-${index}"
+    fingerprint=$(receipt_fingerprint "pending-limit-x${index}|pending-limit-inc-${index}|done|pending limit ${index}")
+    fm_write_meta "$state/terminal-outcomes/$fingerprint.pending" \
+      schema=fm-jt-terminal-outcome.v1 fingerprint="$fingerprint" task_id="pending-limit-x${index}" \
+      incarnation="pending-limit-inc-${index}" outcome=done terminal_source=pane \
+      terminal_snapshot="pending limit ${index}" kind=ship \
+      parent_task_id= parent_home= parent_status= parent_corr=
+  done
+  export FM_INACTIVE_OUTCOME_BUDGET_SECS=30
+  export FM_PENDING_RECEIPT_REPUBLISH_LIMIT=1
+  scan "$root" "$home" "$fakebin" --startup >/dev/null \
+    || fail "bounded pending-receipt maintenance failed on the first scan"
+  first=$(cat "$state/.pending-receipt-republish.cursor" 2>/dev/null || true)
+  [ -n "$first" ] || fail "bounded pending-receipt maintenance did not persist a cursor"
+  [ "$(queue_count "$state")" = 1 ] || fail "bounded pending-receipt maintenance exceeded its first batch"
+  scan "$root" "$home" "$fakebin" --startup >/dev/null \
+    || fail "bounded pending-receipt maintenance failed on the second scan"
+  second=$(cat "$state/.pending-receipt-republish.cursor" 2>/dev/null || true)
+  [ -n "$second" ] && [ "$second" != "$first" ] \
+    || fail "bounded pending-receipt maintenance did not rotate its cursor"
+  [ "$(queue_count "$state")" = 2 ] || fail "bounded pending-receipt maintenance did not republish the next receipt"
+  [ "$(receipt_count "$state" pending)" = 3 ] \
+    || fail "bounded pending-receipt maintenance discarded durable receipts"
+  unset FM_PENDING_RECEIPT_REPUBLISH_LIMIT FM_INACTIVE_OUTCOME_BUDGET_SECS
+  pass "pending-receipt maintenance rotates bounded receipt batches"
+}
+
+test_pending_receipt_rejects_unsafe_task_path() {
+  local dir root home fakebin state fingerprint rec
+  new_case pending-receipt-unsafe-task
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  mkdir -p "$state/terminal-outcomes"
+  fingerprint=$(receipt_fingerprint '../../outside|unsafe-inc|done|unsafe task path')
+  rec="$state/terminal-outcomes/$fingerprint.pending"
+  fm_write_meta "$rec" \
+    schema=fm-jt-terminal-outcome.v1 fingerprint="$fingerprint" task_id=../../outside \
+    incarnation=unsafe-inc outcome=done terminal_source=pane \
+    terminal_snapshot='unsafe task path' kind=ship
+  if scan "$root" "$home" "$fakebin" --startup >/dev/null 2>&1; then
+    fail "unsafe pending receipt was accepted"
+  fi
+  [ -f "$rec" ] || fail "unsafe pending receipt was consumed"
+  [ "$(queue_count "$state")" = 0 ] || fail "unsafe pending receipt queued a wake"
+  [ ! -e "$dir/outside.meta" ] || fail "unsafe pending receipt escaped the state directory"
+  pass "pending receipts reject unsafe task paths"
+}
+
+test_secondmate_route_replacement_preserves_old_receipt() {
+  local dir root home fakebin state child_home child_state parent_status corr_a corr_b rec send_out marker history_backup active_route_backup
+  new_case secondmate-route-replacement
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  child_home="$dir/secondmate-home"
+  child_state="$child_home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  mkdir -p "$child_state" "$child_home/data" "$child_home/config" "$state/pending-replies"
+  printf 'sm-replace\n' > "$child_home/.fm-secondmate-home"
+  write_meta "$state" sm-replace parent-replace-inc secondmate tmux firstmate:fm-sm-replace
+  printf 'home=%s\n' "$child_home" >> "$state/sm-replace.meta"
+  write_meta "$child_state" child-replace-x1 child-replace-inc
+  parent_status="$state/sm-replace.status"
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "$*" in
+  *"#{cursor_y}"*) printf '1\n' ;;
+  *capture-pane*)
+    case "$*" in
+      *" -S -40"*) printf 'idle prompt\n' ;;
+      *) : ;;
+    esac
+    ;;
+  *) : ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/tmux"
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  prepare_watcher_protocol "$root" "$home" "$state"
+  send_out=$(cd "$root" && env -u NO_MISTAKES_GATE -u FM_AGENT_ROLE -u FM_AGENT_TASK -u FM_AGENT_OWNER_HOME \
+    -u FM_ROOT -u STATE PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux TMUX=fake,1,0 \
+    FM_SEND_SETTLE=0 FM_SEND_SLEEP=0 FM_SEND_RETRIES=1 "$root/bin/fm-send.sh" \
+    fm-sm-replace "first request" 2>&1) || fail "initial public route setup failed: $send_out"
+  corr_a=$(basename "$(direct_first_file "$state/pending-replies" '*')")
+  [ -n "$corr_a" ] || fail "initial route did not create a correlation"
+  export FM_FAKE_CREW_STATE_CHILD_REPLACE_X1='state: done · source: pane · old route receipt'
+  scan "$root" "$child_home" "$fakebin" --startup >/dev/null || fail "old route scan failed"
+  rec=$(direct_first_file "$child_state/terminal-outcomes" '*.pending')
+  [ -n "$rec" ] || fail "old route did not create a pending receipt"
+  replace_field "$state/pending-replies/$corr_a" phase resolved
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  send_out=$(cd "$root" && env -u NO_MISTAKES_GATE -u FM_AGENT_ROLE -u FM_AGENT_TASK -u FM_AGENT_OWNER_HOME \
+    -u FM_ROOT -u STATE PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux TMUX=fake,1,0 \
+    FM_SEND_SETTLE=0 FM_SEND_SLEEP=0 FM_SEND_RETRIES=1 "$root/bin/fm-send.sh" \
+    fm-sm-replace "replacement request" 2>&1) || fail "replacement public route setup failed: $send_out"
+  corr_b=
+  for marker in "$state"/pending-replies/*; do
+    [ -f "$marker" ] || continue
+    [ "$(basename "$marker")" = "$corr_a" ] || corr_b=$(basename "$marker")
+  done
+  [ -n "$corr_b" ] || fail "replacement route did not create a new correlation"
+  [ "$(receipt_value "$child_state/.fm-jt-parent-route" corr_id)" = "$corr_b" ] \
+    || fail "replacement route did not publish the new correlation"
+  replace_field "$state/pending-replies/$corr_b" phase awaiting_report
+  replace_field "$state/pending-replies/$corr_b" delivered_epoch ''
+  active_route_backup="$dir/active-route-backup"
+  cp "$child_state/.fm-jt-parent-route" "$active_route_backup"
+  replace_field "$child_state/.fm-jt-parent-route" parent_home "$dir/not-a-parent-home"
+  : > "$child_state/.wake-queue"
+  scan "$root" "$child_home" "$fakebin" --startup \
+    || fail "malformed active route scan failed"
+  [ "$(queue_count "$child_state")" = 0 ] \
+    || fail "malformed active route fell through to history"
+  [ "$(receipt_count "$child_state" pending)" = 1 ] \
+    || fail "malformed active route consumed the old receipt"
+  cp "$active_route_backup" "$child_state/.fm-jt-parent-route"
+  history_backup="$dir/history-route-backup"
+  [ -f "$child_state/.fm-jt-parent-route-history.$corr_a" ] \
+    || fail "replacement route did not retain the old correlation history marker"
+  cp "$child_state/.fm-jt-parent-route-history.$corr_a" "$history_backup"
+  replace_field "$child_state/.fm-jt-parent-route-history.$corr_a" corr_id "$corr_b"
+  : > "$child_state/.wake-queue"
+  scan "$root" "$child_home" "$fakebin" --startup \
+    || fail "mismatched history marker scan failed"
+  [ "$(queue_count "$child_state")" = 0 ] \
+    || fail "mismatched history marker created a wake for the wrong route"
+  [ "$(receipt_count "$child_state" pending)" = 1 ] \
+    || fail "mismatched history marker consumed the old receipt"
+  cp "$history_backup" "$child_state/.fm-jt-parent-route-history.$corr_a"
+  replace_field "$state/pending-replies/$corr_b" phase delivery_unknown
+  : > "$child_state/.wake-queue"
+  scan "$root" "$child_home" "$fakebin" --startup \
+    || fail "delivery-unknown active route scan failed"
+  [ "$(queue_count "$child_state")" = 1 ] \
+    || fail "delivery-unknown active route blocked the matching history receipt"
+  replace_field "$state/pending-replies/$corr_b" phase awaiting_report
+  scan "$root" "$child_home" "$fakebin" --startup \
+    || fail "pending old-route receipt was not reconciled after route replacement"
+  [ "$(queue_count "$child_state")" = 1 ] \
+    || fail "pending old-route receipt did not get a matching history wake"
+  drain "$root" "$child_home" "$fakebin" >/dev/null \
+    || fail "old receipt did not drain after route replacement"
+  [ "$(receipt_count "$child_state" reported)" = 1 ] || fail "old route receipt was not reported"
+  [ "$(receipt_value "$child_state/.fm-jt-parent-route" corr_id)" = "$corr_b" ] \
+    || fail "old receipt cleanup removed the replacement route"
+  [ ! -e "$child_state/.fm-jt-parent-route-history.$corr_a" ] \
+    || fail "old route history was not retired after acknowledgement"
+  unset FM_FAKE_CREW_STATE_CHILD_REPLACE_X1
+  pass "secondmate route replacement preserves correlation-scoped old receipts"
+}
+
+test_secondmate_route_replacement_replays_unchanged_terminal() {
+  local dir root home fakebin state child_home child_state corr_a corr_b rec send_out corr_count
+  new_case secondmate-route-replay
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  child_home="$dir/secondmate-home"
+  child_state="$child_home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  mkdir -p "$child_state" "$child_home/data" "$child_home/config" "$state/pending-replies"
+  printf 'sm-replay\n' > "$child_home/.fm-secondmate-home"
+  write_meta "$state" sm-replay parent-replay-inc secondmate tmux firstmate:fm-sm-replay
+  printf 'home=%s\n' "$child_home" >> "$state/sm-replay.meta"
+  write_meta "$child_state" child-replay-x1 child-replay-inc
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "$*" in
+  *"#{cursor_y}"*) printf '1\n' ;;
+  *capture-pane*)
+    case "$*" in
+      *" -S -40"*) printf 'idle prompt\n' ;;
+      *) : ;;
+    esac
+    ;;
+  *) : ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/tmux"
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  prepare_watcher_protocol "$root" "$home" "$state"
+  send_out=$(cd "$root" && env -u NO_MISTAKES_GATE -u FM_AGENT_ROLE -u FM_AGENT_TASK -u FM_AGENT_OWNER_HOME \
+    -u FM_ROOT -u STATE PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux TMUX=fake,1,0 \
+    FM_SEND_SETTLE=0 FM_SEND_SLEEP=0 FM_SEND_RETRIES=1 "$root/bin/fm-send.sh" \
+    fm-sm-replay "first request" 2>&1) || fail "initial replay route setup failed: $send_out"
+  corr_a=$(basename "$(direct_first_file "$state/pending-replies" '*')")
+  [ -n "$corr_a" ] || fail "initial replay route did not create a correlation"
+  export FM_FAKE_CREW_STATE_CHILD_REPLAY_X1='state: done · source: pane · unchanged terminal state'
+  scan "$root" "$child_home" "$fakebin" --startup >/dev/null \
+    || fail "initial unchanged terminal scan failed"
+  [ "$(receipt_count "$child_state" pending)" = 1 ] || fail "initial replay route did not create a receipt"
+  rec=$(direct_first_file "$child_state/terminal-outcomes" '*.pending')
+  mv "$rec" "${rec%.pending}.presented"
+  : > "$child_state/.wake-queue"
+  replace_field "$state/pending-replies/$corr_a" phase resolved
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  send_out=$(cd "$root" && env -u NO_MISTAKES_GATE -u FM_AGENT_ROLE -u FM_AGENT_TASK -u FM_AGENT_OWNER_HOME \
+    -u FM_ROOT -u STATE PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux TMUX=fake,1,0 \
+    FM_SEND_SETTLE=0 FM_SEND_SLEEP=0 FM_SEND_RETRIES=1 "$root/bin/fm-send.sh" \
+    fm-sm-replay "replacement request" 2>&1) || fail "replacement replay route setup failed: $send_out"
+  corr_b=
+  for marker in "$state"/pending-replies/*; do
+    [ -f "$marker" ] || continue
+    [ "$(basename "$marker")" = "$corr_a" ] || corr_b=$(basename "$marker")
+  done
+  [ -n "$corr_b" ] || fail "replacement replay route did not create a new correlation"
+  [ "$(receipt_value "$child_state/.fm-jt-parent-route" corr_id)" = "$corr_b" ] \
+    || fail "replacement replay route did not publish the new correlation"
+  scan "$root" "$child_home" "$fakebin" --startup >/dev/null \
+    || fail "unchanged terminal state was not replayed for the replacement route"
+  [ "$(receipt_count "$child_state" pending)" = 1 ] \
+    || fail "replacement route did not create a current receipt"
+  [ "$(receipt_count "$child_state" presented)" = 1 ] \
+    || fail "old route receipt was not retained"
+  corr_count=0
+  for rec in "$child_state"/terminal-outcomes/*.pending; do
+    [ -f "$rec" ] || continue
+    [ "$(receipt_value "$rec" parent_corr)" = "$corr_b" ] || continue
+    corr_count=$((corr_count + 1))
+  done
+  [ "$corr_count" = 1 ] || fail "replacement receipt was not bound to the new correlation"
+  [ "$(queue_count "$child_state")" = 1 ] || fail "replacement route did not queue a current wake"
+  unset FM_FAKE_CREW_STATE_CHILD_REPLAY_X1
+  pass "unchanged terminals replay for each secondmate correlation"
+}
+
+test_undelivered_secondmate_route_cleanup_is_idempotent() {
+  local dir root home fakebin state child_home child_state marker corr rec fail_rm_once valid_marker
+  new_case secondmate-undelivered-cleanup
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  child_home="$dir/secondmate-home"
+  child_state="$child_home/state"
+  marker="$child_state/.fm-jt-parent-route"
+  corr=0123456789abcdef
+  mkdir -p "$child_state" "$child_home/data" "$child_home/config" "$state/pending-replies"
+  printf 'sm-cleanup\n' > "$child_home/.fm-secondmate-home"
+  fm_write_meta "$state/pending-replies/$corr" \
+    schema=fm-pending-reply.v1 corr_id="$corr" task_id=sm-cleanup \
+    parent_home="$home" parent_status="$state/sm-cleanup.status" phase=awaiting_report delivered_epoch=
+  env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" bash -c \
+    '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_secondmate_route_write "$2" "$3" "$4" "$5" "$6"' \
+    _ "$ROOT" "$child_home" "$home" "$state" sm-cleanup "$corr" \
+    || fail "undelivered route fixture was not written"
+  [ -f "$marker" ] || fail "undelivered route fixture is missing"
+  rec="$state/pending-replies/$corr"
+  fail_rm_once="$dir/fail-undelivered-rm-once"
+  : > "$fail_rm_once"
+  cat > "$fakebin/rm" <<'SH'
+#!/usr/bin/env bash
+set -u
+for arg in "$@"; do
+  if [ "$arg" = "${FM_TEST_UNDELIVERED_RECORD:-}" ] && [ -e "${FM_TEST_UNDELIVERED_RM_ONCE:-}" ]; then
+    /bin/rm -f "$FM_TEST_UNDELIVERED_RM_ONCE"
+    exit 42
+  fi
+done
+exec /bin/rm "$@"
+SH
+  chmod +x "$fakebin/rm"
+  export FM_TEST_UNDELIVERED_RECORD="$rec" FM_TEST_UNDELIVERED_RM_ONCE="$fail_rm_once"
+  if env PATH="$fakebin:$PATH" FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" bash -c \
+    '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_discard_undelivered "$2" "$3"' \
+    _ "$ROOT" "$state" "$corr"; then
+    fail "undelivered record removal failure was hidden"
+  fi
+  [ -e "$rec" ] || fail "undelivered record was removed after a failed cleanup"
+  [ -e "$marker" ] || fail "undelivered route was cleared before record removal"
+  valid_marker=$(cat "$marker")
+  printf 'malformed=route\n' > "$marker"
+  if env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" bash -c \
+    '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_secondmate_route_clear_undelivered "$2" "$3"' \
+    _ "$ROOT" "$child_home" "$corr"; then
+    fail "malformed undelivered route cleanup was treated as success"
+  fi
+  [ -e "$rec" ] || fail "malformed undelivered route cleanup removed the parent record"
+  printf '%s\n' "$valid_marker" > "$marker"
+  rm -f "$fakebin/rm"
+  unset FM_TEST_UNDELIVERED_RECORD FM_TEST_UNDELIVERED_RM_ONCE
+  env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" bash -c \
+    '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_discard_undelivered "$2" "$3"' \
+    _ "$ROOT" "$state" "$corr" \
+    || fail "undelivered record cleanup did not retry"
+  [ ! -e "$rec" ] || fail "undelivered record remained after retry"
+  env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" bash -c \
+    '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_secondmate_route_clear_undelivered "$2" "$3"' \
+    _ "$ROOT" "$child_home" "$corr" \
+    || fail "undelivered route cleanup rejected an already-removed record"
+  [ ! -e "$marker" ] || fail "undelivered route cleanup left a stale marker"
+  env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" bash -c \
+    '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_secondmate_route_clear_undelivered "$2" "$3"' \
+    _ "$ROOT" "$child_home" "$corr" \
+    || fail "undelivered route cleanup was not idempotent"
+  pass "undelivered secondmate route cleanup is safe and idempotent"
+}
+
+test_concurrent_secondmate_routes_are_rejected() {
+  local dir root home fakebin state child_home child_state marker corr_one corr_two outside existing_real existing_link
+  local existing_record record_backup existing_history history_backup clear_real clear_link
+  new_case secondmate-route-concurrent
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  child_home="$dir/secondmate-home"
+  child_state="$child_home/state"
+  marker="$child_state/.fm-jt-parent-route"
+  corr_one=0123456789abcdef
+  corr_two=1123456789abcdef
+  mkdir -p "$child_state" "$child_home/data" "$child_home/config" "$state/pending-replies"
+  printf 'sm-concurrent\n' > "$child_home/.fm-secondmate-home"
+  fm_write_meta "$state/pending-replies/$corr_one" \
+    schema=fm-pending-reply.v1 corr_id="$corr_one" task_id=sm-concurrent \
+    parent_home="$home" parent_status="$state/sm-concurrent.status" delivered_epoch=1 phase=awaiting_report
+  fm_write_meta "$state/pending-replies/$corr_two" \
+    schema=fm-pending-reply.v1 corr_id="$corr_two" task_id=sm-concurrent \
+    parent_home="$home" parent_status="$state/sm-concurrent.status" delivered_epoch=1 phase=awaiting_report
+  route_write() {
+    env PATH="$fakebin:$PATH" FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+      FM_STATE_OVERRIDE="$state" bash -c \
+      '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_secondmate_route_write "$2" "$3" "$4" "$5" "$6"' \
+      _ "$ROOT" "$child_home" "$home" "$state" sm-concurrent "$1"
+  }
+  mv "$child_home/.fm-secondmate-home" "$dir/secondmate-marker"
+  ln -s "$dir/secondmate-marker" "$child_home/.fm-secondmate-home"
+  if route_write "$corr_one"; then
+    fail "symlinked secondmate home marker was accepted"
+  fi
+  rm -f "$child_home/.fm-secondmate-home"
+  mv "$dir/secondmate-marker" "$child_home/.fm-secondmate-home"
+  existing_real="$dir/existing-real-home"
+  existing_link="$dir/existing-home-link"
+  mkdir -p "$existing_real/state/pending-replies"
+  fm_write_meta "$existing_real/state/pending-replies/$corr_one" \
+    schema=fm-pending-reply.v1 corr_id="$corr_one" task_id=sm-concurrent \
+    parent_home="$existing_real" parent_status="$existing_real/state/sm-concurrent.status" \
+    delivered_epoch=1 phase=resolved
+  ln -s "$existing_real" "$existing_link"
+  printf 'schema=fm-jt-parent-route.v1\nsecondmate_id=sm-concurrent\nparent_home=%s\nparent_status=%s\ncorr_id=%s\n' \
+    "$existing_link" "$existing_real/state/sm-concurrent.status" "$corr_one" > "$marker"
+  if route_write "$corr_two"; then
+    fail "existing secondmate home symlink was accepted during route replacement"
+  fi
+  rm -f "$marker"
+  existing_record="$existing_real/state/pending-replies/$corr_one"
+  record_backup="$dir/record-backup"
+  mv "$existing_record" "$record_backup"
+  ln -s "$record_backup" "$existing_record"
+  printf 'schema=fm-jt-parent-route.v1\nsecondmate_id=sm-concurrent\nparent_home=%s\nparent_status=%s\ncorr_id=%s\n' \
+    "$existing_real" "$existing_real/state/sm-concurrent.status" "$corr_one" > "$marker"
+  if route_write "$corr_two"; then
+    fail "symlinked active secondmate record was accepted during route replacement"
+  fi
+  rm -f "$marker" "$existing_record"
+  mv "$record_backup" "$existing_record"
+  existing_history="$existing_real/state/pending-reply-history/$corr_one"
+  history_backup="$dir/history-backup"
+  mkdir -p "$existing_real/state/pending-reply-history"
+  mv "$existing_record" "$history_backup"
+  ln -s "$history_backup" "$existing_history"
+  printf 'schema=fm-jt-parent-route.v1\nsecondmate_id=sm-concurrent\nparent_home=%s\nparent_status=%s\ncorr_id=%s\n' \
+    "$existing_real" "$existing_real/state/sm-concurrent.status" "$corr_one" > "$marker"
+  if route_write "$corr_two"; then
+    fail "symlinked history secondmate record was accepted during route replacement"
+  fi
+  rm -f "$marker" "$existing_history"
+  mv "$history_backup" "$existing_record"
+  route_write "$corr_one" || fail "initial secondmate route was not written"
+  marker_before=$(cat "$marker")
+  outside="$dir/temp-target"
+  printf 'protected\n' > "$outside"
+  cat > "$fakebin/mktemp" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "${1:-}" in
+  */.fm-jt-parent-route.XXXXXX)
+    target="${1%.XXXXXX}blocked"
+    rm -f "$target"
+    ln -s "$FM_ROUTE_TEMP_TARGET" "$target"
+    printf '%s\n' "$target"
+    exit 0
+    ;;
+esac
+exec /usr/bin/mktemp "$@"
+SH
+  chmod +x "$fakebin/mktemp"
+  if env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" PATH="$fakebin:$PATH" FM_ROUTE_TEMP_TARGET="$outside" bash -c \
+    '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_secondmate_route_write "$2" "$3" "$4" "$5" "$6"' \
+    _ "$ROOT" "$child_home" "$home" "$state" sm-concurrent "$corr_two"; then
+    fail "second route replaced an active route unexpectedly"
+  fi
+  [ "$(cat "$outside")" = protected ] || fail "route publication followed a pre-created temporary symlink"
+  if route_write "$corr_two"; then
+    fail "concurrent secondmate route was silently replaced"
+  fi
+  [ "$(cat "$marker")" = "$marker_before" ] || fail "concurrent route rejection changed the active marker"
+  clear_real="$dir/clear-real"
+  clear_link="$dir/clear-link"
+  mkdir -p "$clear_real/state"
+  printf 'schema=fm-jt-parent-route.v1\nsecondmate_id=sm-concurrent\nparent_home=%s\nparent_status=%s\ncorr_id=%s\n' \
+    "$home" "$state/sm-concurrent.status" "$corr_one" > "$clear_real/state/.fm-jt-parent-route"
+  ln -s "$clear_real" "$clear_link"
+  if env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    bash -c '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_secondmate_route_clear "$2" "$3"' \
+    _ "$ROOT" "$clear_link" "$corr_one"; then
+    fail "route cleanup followed a symlinked secondmate home"
+  fi
+  [ -e "$clear_real/state/.fm-jt-parent-route" ] || fail "unsafe route cleanup removed the target marker"
+  pass "concurrent secondmate routes fail closed without overwriting"
+}
+
+test_route_replacement_rejects_malformed_parent_record() {
+  local dir root home fakebin state child_home child_state marker corr_one corr_two
+  new_case malformed-route-replacement
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  child_home="$dir/secondmate-home"
+  child_state="$child_home/state"
+  marker="$child_state/.fm-jt-parent-route"
+  corr_one=0123456789abcdef
+  corr_two=1123456789abcdef
+  mkdir -p "$child_state" "$child_home/data" "$child_home/config" \
+    "$state/pending-replies"
+  printf 'sm-malformed\n' > "$child_home/.fm-secondmate-home"
+  fm_write_meta "$state/pending-replies/$corr_one" \
+    schema=fm-pending-reply.v1 corr_id="$corr_one" task_id=sm-malformed \
+    parent_home="$home" parent_status="$state/sm-malformed.status" \
+    delivered_epoch=1 phase=resolved
+  route_write() {
+    env PATH="$fakebin:$PATH" FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" \
+      FM_HOME="$home" FM_STATE_OVERRIDE="$state" bash -c \
+      '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_secondmate_route_write "$2" "$3" "$4" "$5" "$6"' \
+      _ "$ROOT" "$child_home" "$home" "$state" sm-malformed "$1"
+  }
+  route_write "$corr_one" || fail "malformed replacement fixture route was not written"
+  replace_field "$state/pending-replies/$corr_one" task_id wrong-task
+  if route_write "$corr_two"; then
+    fail "route replacement accepted a mismatched existing parent record"
+  fi
+  [ "$(receipt_value "$marker" corr_id)" = "$corr_one" ] \
+    || fail "malformed parent record replacement changed the active route"
+  [ ! -e "$child_state/.fm-jt-parent-route-history.$corr_one" ] \
+    || fail "malformed parent record replacement archived an invalid route"
+  pass "route replacement validates the complete existing parent record"
+}
+
+test_recovery_route_reuse_validates_parent_record() {
+  local dir root home fakebin state child_home child_state marker corr
+  new_case recovery-route-reuse
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  child_home="$dir/secondmate-home"
+  child_state="$child_home/state"
+  marker="$child_state/.fm-jt-parent-route"
+  corr=0123456789abcdef
+  mkdir -p "$child_state" "$child_home/data" "$child_home/config" "$state/pending-replies"
+  printf 'sm-reuse\n' > "$child_home/.fm-secondmate-home"
+  fm_write_meta "$state/pending-replies/$corr" \
+    schema=fm-pending-reply.v1 corr_id="$corr" task_id=sm-reuse \
+    parent_home="$home" parent_status="$state/sm-reuse.status" \
+    delivered_epoch=1 phase=recovery_sending
+  route_write() {
+    env PATH="$fakebin:$PATH" FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" \
+      FM_HOME="$home" FM_STATE_OVERRIDE="$state" bash -c \
+      '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_secondmate_route_write "$2" "$3" "$4" "$5" "$6"' \
+      _ "$ROOT" "$child_home" "$home" "$state" sm-reuse "$1"
+  }
+  route_write "$corr" || fail "recovery route fixture was not written"
+  replace_field "$state/pending-replies/$corr" phase awaiting_report
+  replace_field "$state/pending-replies/$corr" delivered_epoch ''
+  route_write "$corr" || fail "undelivered same-route recovery was rejected"
+  replace_field "$state/pending-replies/$corr" phase delivery_unknown
+  route_write "$corr" || fail "delivery-unknown same-route recovery was rejected"
+  replace_field "$state/pending-replies/$corr" phase recovery_sending
+  replace_field "$state/pending-replies/$corr" delivered_epoch 1
+  marker_before=$(cat "$marker")
+  replace_field "$state/pending-replies/$corr" task_id wrong-task
+  if route_write "$corr"; then
+    fail "recovery route reuse accepted a mismatched parent record"
+  fi
+  [ "$(cat "$marker")" = "$marker_before" ] || fail "mismatched recovery route reuse changed the marker"
+  if env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" bash -c \
+    '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_corr_reusable "$2" "$3" sm-reuse' \
+    _ "$ROOT" "$state" "$corr"; then
+    fail "recovery resend reused a mismatched parent record"
+  fi
+  replace_field "$state/pending-replies/$corr" task_id sm-reuse
+  printf 'task_id=sm-reuse\n' >> "$state/pending-replies/$corr"
+  if route_write "$corr"; then
+    fail "recovery route reuse accepted duplicate parent fields"
+  fi
+  if env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" bash -c \
+    '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_corr_reusable "$2" "$3" sm-reuse' \
+    _ "$ROOT" "$state" "$corr"; then
+    fail "recovery resend reused duplicate parent fields"
+  fi
+  pass "recovery route reuse validates the complete parent record"
+}
+
+test_failed_record_removal_is_retryable() {
+  local dir root home fakebin state child_home child_state marker flag rec corr
+  new_case failed-record-cleanup
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  child_home="$dir/secondmate-home"
+  child_state="$child_home/state"
+  marker="$child_state/.fm-jt-parent-route"
+  mkdir -p "$child_state" "$child_home/data" "$child_home/config" "$child_home/projects"
+  printf 'sm-record-cleanup\n' > "$child_home/.fm-secondmate-home"
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  prepare_watcher_protocol "$root" "$home" "$state"
+  corr=$(env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" bash -c \
+    '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_create "$2" "$3" sm-record-cleanup "cleanup request"' \
+    _ "$ROOT" "$home" "$state") || fail "cleanup record was not created"
+  env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" bash -c \
+    '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_secondmate_route_write "$2" "$3" "$4" sm-record-cleanup "$5"' \
+    _ "$ROOT" "$child_home" "$home" "$state" "$corr" \
+    || fail "cleanup route was not written"
+  rec="$state/pending-replies/$corr"
+  flag="$dir/fail-record-remove-once"
+  : > "$flag"
+  cat > "$fakebin/rm" <<'SH'
+#!/usr/bin/env bash
+set -u
+for arg in "$@"; do
+  if [ "$arg" = "${FM_TEST_CLEANUP_RECORD:-}" ] && [ -e "${FM_TEST_CLEANUP_RECORD_ONCE:-}" ]; then
+    /bin/rm -f "$FM_TEST_CLEANUP_RECORD_ONCE"
+    exit 42
+  fi
+done
+exec /bin/rm "$@"
+SH
+  chmod +x "$fakebin/rm"
+  export FM_TEST_CLEANUP_RECORD="$rec" FM_TEST_CLEANUP_RECORD_ONCE="$flag"
+  if env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" PATH="$fakebin:$PATH" bash -c \
+    '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_schedule_undelivered_cleanup "$2" "$3" "$4" && fm_pending_reply_discard_undelivered "$2" "$3" 1' \
+    _ "$ROOT" "$state" "$corr" "$child_home"; then
+    fail "record removal failure was hidden"
+  fi
+  [ -f "$rec" ] || fail "record removal failure lost the parent record"
+  [ -e "$marker" ] || fail "record removal failure cleared the route"
+  [ -f "$rec.cleanup-meta" ] || fail "record removal failure was not durable"
+  rm -f "$fakebin/rm"
+  unset FM_TEST_CLEANUP_RECORD FM_TEST_CLEANUP_RECORD_ONCE
+  env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" bash -c \
+    '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_retry_undelivered_cleanup "$2" "$3"' \
+    _ "$ROOT" "$state" "$rec.cleanup-meta" \
+    || fail "record removal cleanup did not retry"
+  [ ! -e "$rec" ] || fail "record removal cleanup left the parent record"
+  [ ! -e "$marker" ] || fail "record removal cleanup left the route"
+  [ ! -e "$rec.cleanup-meta" ] || fail "record removal cleanup left its retry marker"
+  pass "failed record removal is durably retryable with its route"
+}
+
+test_failed_marked_send_restores_record_on_route_cleanup_failure() {
+  local dir root home fakebin state child_home child_state marker flag rec corr send_out
+  new_case failed-marked-cleanup
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  child_home="$dir/secondmate-home"
+  child_state="$child_home/state"
+  marker="$child_state/.fm-jt-parent-route"
+  mkdir -p "$child_state" "$child_home/data" "$child_home/config" "$child_home/projects"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  printf 'sm-cleanup\n' > "$child_home/.fm-secondmate-home"
+  write_meta "$state" sm-cleanup cleanup-inc secondmate tmux firstmate:fm-sm-cleanup
+  printf 'home=%s\n' "$child_home" >> "$state/sm-cleanup.meta"
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+exit 1
+SH
+  chmod +x "$fakebin/tmux"
+  flag="$dir/fail-route-clear-once"
+  : > "$flag"
+  cat > "$fakebin/rm" <<'SH'
+#!/usr/bin/env bash
+set -u
+for arg in "$@"; do
+  if [ "$arg" = "${FM_TEST_CLEANUP_ROUTE:-}" ] && [ -e "${FM_TEST_CLEANUP_ROUTE_ONCE:-}" ]; then
+    /bin/rm -f "$FM_TEST_CLEANUP_ROUTE_ONCE"
+    exit 42
+  fi
+done
+exec /bin/rm "$@"
+SH
+  chmod +x "$fakebin/rm"
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  prepare_watcher_protocol "$root" "$home" "$state"
+  export FM_TEST_CLEANUP_ROUTE="$marker" FM_TEST_CLEANUP_ROUTE_ONCE="$flag"
+  send_out=$(cd "$root" && env -u NO_MISTAKES_GATE -u FM_AGENT_ROLE -u FM_AGENT_TASK \
+    -u FM_AGENT_OWNER_HOME -u FM_ROOT -u STATE -u FM_PENDING_REPLY_EXISTING_CORR \
+    PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux TMUX=fake,1,0 \
+    FM_SEND_SETTLE=0 FM_SEND_SLEEP=0 FM_SEND_RETRIES=1 "$root/bin/fm-send.sh" \
+    fm-sm-cleanup "cleanup request" 2>&1) && fail "marked send cleanup failure was hidden"
+  rec=$(direct_first_file "$state/pending-replies" '*')
+  [ -f "$rec" ] || fail "route cleanup failure orphaned the parent expectation"
+  corr=$(basename "$rec")
+  [ "$(receipt_value "$marker" corr_id)" = "$corr" ] || fail "route cleanup failure changed the active route"
+  [ ! -e "$rec.cleanup" ] || fail "route cleanup failure left a hidden record backup"
+  rm -f "$fakebin/rm"
+  unset FM_TEST_CLEANUP_ROUTE FM_TEST_CLEANUP_ROUTE_ONCE
+  env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" bash -c \
+    '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_discard_undelivered "$2" "$3" 1 && fm_pending_reply_secondmate_route_clear_undelivered "$4" "$3" && fm_pending_reply_finish_undelivered "$2" "$3"' \
+    _ "$ROOT" "$state" "$corr" "$child_home" \
+    || fail "marked send cleanup did not retry transactionally"
+  [ ! -e "$rec" ] || fail "marked send cleanup retry left the parent record"
+  [ ! -e "$marker" ] || fail "marked send cleanup retry left the route"
+  pass "failed marked sends restore parent records across route cleanup failures"
+}
+
+test_failed_concurrent_send_discards_only_new_record() {
+  local dir root home fakebin state child_home child_state marker old_corr send_out
+  new_case failed-concurrent-send
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  child_home="$dir/secondmate-home"
+  child_state="$child_home/state"
+  marker="$child_state/.fm-jt-parent-route"
+  old_corr=0123456789abcdef
+  mkdir -p "$child_state" "$child_home/data" "$child_home/config" "$child_home/projects" \
+    "$state/pending-replies"
+  printf 'sm-race\n' > "$child_home/.fm-secondmate-home"
+  write_meta "$state" sm-race parent-race-inc secondmate tmux firstmate:fm-sm-race
+  printf 'home=%s\n' "$child_home" >> "$state/sm-race.meta"
+  fm_write_meta "$state/pending-replies/$old_corr" \
+    schema=fm-pending-reply.v1 corr_id="$old_corr" task_id=sm-race \
+    parent_home="$home" parent_status="$state/sm-race.status" \
+    delivered_epoch=1 phase=awaiting_report
+  env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" bash -c \
+    '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_secondmate_route_write "$2" "$3" "$4" "$5" "$6"' \
+    _ "$ROOT" "$child_home" "$home" "$state" sm-race "$old_corr" \
+    || fail "existing concurrent route was not written"
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  prepare_watcher_protocol "$root" "$home" "$state"
+  send_out=$(cd "$root" && env -u NO_MISTAKES_GATE -u FM_AGENT_ROLE -u FM_AGENT_TASK \
+    -u FM_AGENT_OWNER_HOME -u FM_ROOT -u STATE -u FM_PENDING_REPLY_EXISTING_CORR \
+    PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux TMUX=fake,1,0 \
+    FM_SEND_SETTLE=0 FM_SEND_SLEEP=0 FM_SEND_RETRIES=1 "$root/bin/fm-send.sh" \
+    fm-sm-race "competing request" 2>&1) && fail "concurrent route bind unexpectedly succeeded"
+  [ "$(direct_file_count "$state/pending-replies" '*')" = 1 ] \
+    || fail "failed concurrent send left a new pending-reply record"
+  [ -f "$state/pending-replies/$old_corr" ] \
+    || fail "failed concurrent send discarded the unrelated active record"
+  [ "$(receipt_value "$state/pending-replies/$old_corr" phase)" = awaiting_report ] \
+    || fail "failed concurrent send changed the unrelated route phase"
+  [ "$(receipt_value "$state/pending-replies/$old_corr" delivered_epoch)" = 1 ] \
+    || fail "failed concurrent send changed the unrelated delivery state"
+  [ "$(receipt_value "$child_state/.fm-jt-parent-route" corr_id)" = "$old_corr" ] \
+    || fail "failed concurrent send replaced the unrelated active route"
+  pass "failed concurrent send discards only its new undelivered record"
+}
+
+test_failed_marked_send_discards_never_bound_record() {
+  local dir root home fakebin state child_home child_state send_out flag rec
+  new_case failed-never-bound-send
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  child_home="$dir/unsafe-secondmate-home"
+  child_state="$child_home/state"
+  mkdir -p "$state/pending-replies" "$child_home/state-real" "$child_home/data" \
+    "$child_home/config" "$child_home/projects"
+  ln -s "$child_home/state-real" "$child_state"
+  printf 'sm-never-bound\n' > "$child_home/.fm-secondmate-home"
+  write_meta "$state" sm-never-bound never-bound-inc secondmate tmux firstmate:fm-sm-never-bound
+  printf 'home=%s\n' "$child_home" >> "$state/sm-never-bound.meta"
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+exit 1
+SH
+  chmod +x "$fakebin/tmux"
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  prepare_watcher_protocol "$root" "$home" "$state"
+  flag="$dir/never-bound-record-remove"
+  : > "$flag"
+  cat > "$fakebin/rm" <<'SH'
+#!/usr/bin/env bash
+set -u
+for arg in "$@"; do
+  case "$arg" in
+    */pending-replies/*)
+      case "$(basename "$arg")" in
+        .*) ;;
+        *)
+          if [ -e "${FM_TEST_NEVER_BOUND_ONCE:-}" ]; then
+            /bin/rm -f "$FM_TEST_NEVER_BOUND_ONCE"
+            exit 42
+          fi
+          ;;
+      esac
+      ;;
+  esac
+done
+exec /bin/rm "$@"
+SH
+  chmod +x "$fakebin/rm"
+  export FM_TEST_NEVER_BOUND_ONCE="$flag"
+  cp -a "$ROOT/bin/." "$root/bin/"
+  send_out=$(cd "$root" && env -u NO_MISTAKES_GATE -u FM_AGENT_ROLE -u FM_AGENT_TASK \
+    -u FM_AGENT_OWNER_HOME -u FM_ROOT -u STATE -u FM_PENDING_REPLY_EXISTING_CORR \
+    PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" FM_PRIMARY_ATTESTATION="$CASE_TOKEN" \
+    CODEX_THREAD_ID="$CASE_THREAD" FM_FAKE_HARNESS_PID="$$" FM_BACKEND=tmux TMUX=fake,1,0 \
+    FM_SEND_SETTLE=0 FM_SEND_SLEEP=0 FM_SEND_RETRIES=1 "$root/bin/fm-send.sh" \
+    fm-sm-never-bound "never bound request" 2>&1) && fail "never-bound marked send unexpectedly succeeded"
+  rec=
+  for candidate in "$state/pending-replies"/*; do
+    base=$(basename "$candidate")
+    [ -f "$candidate" ] || continue
+    [ "${#base}" = 16 ] || continue
+    rec=$candidate
+    break
+  done
+  [ -f "$rec" ] || fail "never-bound cleanup did not retain the failed record for retry"
+  [ -f "$rec.cleanup-meta" ] || fail "never-bound cleanup did not persist repair metadata"
+  [ ! -e "$child_state/.fm-jt-parent-route" ] \
+    || fail "never-bound send installed a route through an unsafe state path"
+  rm -f "$fakebin/rm"
+  unset FM_TEST_NEVER_BOUND_ONCE
+  rm -f "$child_state"
+  mkdir -p "$child_state"
+  env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" bash -c \
+    '. "$1/bin/fm-pending-reply-lib.sh"; fm_pending_reply_retry_undelivered_cleanup "$2" "$3"' \
+    _ "$ROOT" "$state" "$rec.cleanup-meta" \
+    || fail "never-bound cleanup did not retry after the unsafe state was repaired"
+  [ ! -e "$rec" ] || fail "never-bound retry left the parent record"
+  [ ! -e "$rec.cleanup-meta" ] || fail "never-bound retry left repair metadata"
+  pass "failed marked sends discard expectations without a committed route"
+}
+
+test_drain_restores_only_unprocessed_rows() {
+  local dir root home fakebin state first second second_corr deduped offset remainder
+  new_case drain-rollback
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  first=$(receipt_fingerprint 'first-x1|first-inc|done|done')
+  second_corr=0123456789abcdef
+  second=$(receipt_fingerprint 'second-x1|second-inc|failed|failed' secondmate "$second_corr")
+  mkdir -p "$state/terminal-outcomes"
+  fm_write_meta "$state/terminal-outcomes/$first.pending" \
+    schema=fm-jt-terminal-outcome.v1 fingerprint="$first" task_id=first-x1 \
+    incarnation=first-inc outcome=done terminal_source=pane terminal_snapshot=done kind=ship
+  fm_write_meta "$state/terminal-outcomes/$second.pending" \
+    schema=fm-jt-terminal-outcome.v1 fingerprint="$second" task_id=second-x1 \
+    incarnation=second-inc outcome=failed terminal_source=pane terminal_snapshot=failed kind=secondmate \
+    parent_task_id=second-parent parent_home="$home" parent_status="$state/second-parent.status" parent_corr="$second_corr"
+  printf 'sm-rollback\n' > "$home/.fm-secondmate-home"
+  printf '1\t1\tcheck\tinactive-outcome:%s\tfirst\n2\t2\tcheck\tinactive-outcome:%s\tsecond\n' \
+    "$first" "$second" > "$state/.wake-queue"
+  if drain "$root" "$home" "$fakebin" >"$dir/drain.out" 2>&1; then
+    fail "drain accepted a malformed secondmate route"
+  fi
+  [ -e "$state/terminal-outcomes/$first.presented" ] || fail "presented receipt was not acknowledged"
+  [ ! -e "$state/terminal-outcomes/$first.pending" ] || fail "presented receipt remained pending"
+  [ -e "$state/terminal-outcomes/$second.pending" ] || fail "failed receipt was lost"
+  [ -f "$state/.wake-queue.restore" ] || fail "drain rollback did not persist its restore boundary"
+  deduped=
+  for candidate in "$state"/.wake-queue.deduped.*; do
+    [ -f "$candidate" ] || continue
+    deduped=$candidate
+    break
+  done
+  [ -n "$deduped" ] || fail "drain rollback did not retain its deduplicated source"
+  offset=$(awk -F= '$1 == "offset" { print $2; exit }' "$state/.wake-queue.restore")
+  remainder=$(env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" bash -c \
+    '. "$1/bin/fm-wake-lib.sh"; fm_wake_queue_stream_from_offset "$2" "$3"' _ \
+    "$ROOT" "$deduped" "$offset")
+  [ "$(printf '%s\n' "$remainder" | awk -F '\t' -v wanted="inactive-outcome:$second" \
+    '$4 == wanted && $5 == "second" { n++ } END { print n + 0 }')" = 1 ] \
+    || fail "drain rollback did not retain only the unprocessed suffix"
+  [ "$(awk 'NF { n++ } END { print n + 0 }' "$state/.wake-queue")" = 0 ] \
+    || fail "drain rollback rewrote the live queue while persisting its suffix"
+  [ "$(direct_file_count "$state" '.wake-queue.unprocessed.*')" = 0 ] \
+    || fail "drain rollback created an unbounded suffix copy"
+  pass "drain rollback persists a bounded unprocessed suffix"
+}
+
+test_legacy_secondmate_receipt_is_rejected_before_claim() {
+  local root home fakebin state owner drain_file row corr fingerprint status
+  new_case legacy-secondmate-receipt
+  root=$CASE_ROOT
+  home=$CASE_HOME
+  fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  prepare_primary_proof "$root" "$home" "$fakebin"
+  corr=0123456789abcdef
+  mkdir -p "$state/terminal-outcomes"
+  fingerprint=$(receipt_fingerprint 'legacy-x1|legacy-inc|failed|failed' secondmate)
+  fm_write_meta "$state/terminal-outcomes/$fingerprint.pending" \
+    schema=fm-jt-terminal-outcome.v1 fingerprint="$fingerprint" task_id=legacy-x1 \
+    incarnation=legacy-inc outcome=failed terminal_source=pane terminal_snapshot=failed kind=secondmate \
+    parent_task_id=legacy-parent parent_home="$home" parent_status="$state/legacy-parent.status" parent_corr="$corr"
+  row="1\t1\tcheck\tinactive-outcome:$fingerprint\tlegacy"
+  drain_file="$state/.wake-queue.deduped.$$"
+  printf '%s\n' "$row" > "$drain_file"
+  owner="$state/.wake-queue.lock.owner-manual"
+  mkdir "$owner"
+  printf '%s\n' "$$" > "$owner/pid"
+  ln -s "$owner" "$state/.wake-queue.lock"
+  status=0
+  export FM_WAKE_DRAIN_FILE="$drain_file"
+  recon_from_root "$root" "$fakebin" "$home" "$state" \
+    claim "inactive-outcome:$fingerprint" "$row" || status=$?
+  unset FM_WAKE_DRAIN_FILE
+  [ "$status" -eq 2 ] || fail "legacy secondmate receipt was accepted by claim"
+  [ -f "$state/terminal-outcomes/$fingerprint.pending" ] \
+    || fail "legacy secondmate receipt was removed during rejected claim"
+  [ ! -e "$state/terminal-outcomes/.$fingerprint.claim" ] \
+    || fail "legacy secondmate receipt created a claim before rejection"
+  pass "legacy secondmate receipt is rejected before claim"
+}
+
+test_deferred_claim_retains_row_beyond_resume_cursor() {
+  local dir root home fakebin state fingerprint row offset
+  new_case deferred-resume-cursor
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  fingerprint=$(receipt_fingerprint 'deferred-resume-x1|deferred-resume-inc|done|state: done · source: pane · deferred resume')
+  mkdir -p "$state/terminal-outcomes"
+  fm_write_meta "$state/terminal-outcomes/$fingerprint.pending" \
+    schema=fm-jt-terminal-outcome.v1 fingerprint="$fingerprint" task_id=deferred-resume-x1 \
+    incarnation=deferred-resume-inc outcome=done terminal_source=pane \
+    terminal_snapshot='state: done · source: pane · deferred resume' kind=ship
+  row=$'1\t1\tcheck\tinactive-outcome:'"$fingerprint"$'\tdeferred resume row'
+  printf '%s\n' "$row" > "$state/.wake-queue"
+  env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" bash -c '
+      . "$1/bin/fm-wake-lib.sh"
+      fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK" || exit 1
+      status=0
+      fm_wake_queue_cursor_write 0 || status=$?
+      fm_lock_release "$FM_WAKE_QUEUE_LOCK" || status=1
+      exit "$status"
+    ' _ "$ROOT" || fail "deferred resume cursor fixture could not be written"
+  export FM_WAKE_DRAIN_DEFER_ACK=1 FM_WAKE_DRAIN_GENERATION="$$"
+  drain "$root" "$home" "$fakebin" >"$dir/deferred-resume.out" \
+    || fail "deferred resume drain failed"
+  offset=$(awk -F= '$1 == "offset" { print $2; exit }' "$state/.wake-queue.cursor")
+  [ "$offset" = 0 ] || fail "deferred inactive row cursor advanced past the unacknowledged claim"
+  [ "$(awk -F '\t' -v wanted="inactive-outcome:$fingerprint" '$4 == wanted { n++ } END { print n + 0 }' "$state/.wake-queue")" = 1 ] \
+    || fail "deferred inactive row was not retained for replay"
+  unset FM_WAKE_DRAIN_DEFER_ACK FM_WAKE_DRAIN_GENERATION
+  pass "deferred inactive rows remain durable beyond resume cursors"
+}
+
+test_resumed_drain_preserves_deferred_row_after_prior_removal() {
+  local dir root home fakebin state fingerprint first second third offset
+  new_case resumed-drain-prior-removal
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  state="$home/state"
+  fingerprint=$(receipt_fingerprint 'resume-remove-x1|resume-remove-inc|done|resume remove')
+  mkdir -p "$state/terminal-outcomes"
+  fm_write_meta "$state/terminal-outcomes/$fingerprint.pending" \
+    schema=fm-jt-terminal-outcome.v1 fingerprint="$fingerprint" task_id=resume-remove-x1 \
+    incarnation=resume-remove-inc outcome=done terminal_source=pane \
+    terminal_snapshot='resume remove' kind=ship
+  first=$'1\t1\tcheck\tresume-first\tfirst resume row'
+  second=$'1\t2\tcheck\tinactive-outcome:'"$fingerprint"$'\tdeferred resume row'
+  third=$'1\t3\tcheck\tresume-third\tthird resume row'
+  printf '%s\n%s\n%s\n' "$first" "$second" "$third" > "$state/.wake-queue"
+  export FM_WAKE_DRAIN_BATCH_ROWS=1
+  drain "$root" "$home" "$fakebin" > "$dir/first.out" \
+    || fail "initial bounded resume drain failed"
+  unset FM_WAKE_DRAIN_BATCH_ROWS
+  env FM_SESSION_LOCK_BOOTSTRAP=1 FM_ROOT_OVERRIDE="$root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$state" bash -c '
+      . "$1/bin/fm-wake-lib.sh"
+      fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK" || exit 1
+      status=0
+      fm_wake_remove_key_locked resume-first || status=$?
+      fm_lock_release "$FM_WAKE_QUEUE_LOCK" || status=1
+      exit "$status"
+    ' _ "$ROOT" || fail "prior processed row removal failed"
+  export FM_WAKE_DRAIN_DEFER_ACK=1 FM_WAKE_DRAIN_GENERATION="$$" FM_WAKE_DRAIN_BATCH_ROWS=2
+  drain "$root" "$home" "$fakebin" > "$dir/resumed.out" \
+    || fail "resumed drain after prior removal failed"
+  offset=$(awk -F= '$1 == "offset" { print $2; exit }' "$state/.wake-queue.cursor")
+  [ "$offset" = 0 ] || fail "resumed drain advanced past an unacknowledged deferred row"
+  [ "$(awk -F '\t' -v wanted="inactive-outcome:$fingerprint" '$4 == wanted { n++ } END { print n + 0 }' "$state/.wake-queue")" = 1 ] \
+    || fail "deferred row was skipped after a prior row was removed"
+  unset FM_WAKE_DRAIN_DEFER_ACK FM_WAKE_DRAIN_GENERATION FM_WAKE_DRAIN_BATCH_ROWS
+  pass "resumed drain retains deferred rows across prior removals"
+}
+
+test_malformed_or_missing_secondmate_route_fails_closed() {
+  local dir root home fakebin state child_home child_state parent_status other_home
+  new_case secondmate-route
+  dir=$CASE_DIR; root=$CASE_ROOT; home=$CASE_HOME; fakebin=$CASE_FAKEBIN
+  child_home="$dir/secondmate-home"
+  child_state="$child_home/state"
+  mkdir -p "$child_state" "$child_home/data" "$child_home/config"
+  mkdir -p "$home/state/pending-replies"
+  printf 'sm-x1\n' > "$child_home/.fm-secondmate-home"
+  write_meta "$child_state" child-x1 child-inc
+  export FM_FAKE_CREW_STATE_CHILD_X1='state: failed · source: pane · child quiet'
+  scan "$root" "$child_home" "$fakebin" --startup >/dev/null
+  [ "$(receipt_count "$child_state" pending)" = 0 ] || fail "missing secondmate parent route was not fail-closed"
+  parent_status="$home/state/parent-x1.status"
+  printf 'schema=fm-jt-parent-route.v1\nparent_home=%s\nparent_status=%s\ninvalid=\n' "$home" "$parent_status" > "$child_state/.fm-jt-parent-route"
+  scan "$root" "$child_home" "$fakebin" --startup >/dev/null
+  [ "$(receipt_count "$child_state" pending)" = 0 ] || fail "malformed secondmate parent route was not fail-closed"
+  [ ! -e "$parent_status" ] || fail "malformed secondmate route wrote parent status"
+  parent_status="$home/state/sm-x1.status"
+  printf 'untouched\n' > "$parent_status"
+  printf 'schema=fm-jt-parent-route.v1\nsecondmate_id=sm-x1\nparent_home=%s\nparent_status=%s\ncorr_id=0123456789abcdef\n' \
+    "$home" "$parent_status" > "$child_state/.fm-jt-parent-route"
+  fm_write_meta "$home/state/pending-replies/0123456789abcdef" \
+    schema=wrong-schema corr_id=0123456789abcdef task_id=sm-x1 \
+    parent_home="$home" parent_status="$parent_status" delivered_epoch=1 phase=awaiting_report
+  scan "$root" "$child_home" "$fakebin" --startup >/dev/null
+  [ "$(receipt_count "$child_state" pending)" = 0 ] || fail "malformed parent schema was accepted"
+  rm -f "$child_state/.fm-jt-parent-route"
+  printf 'schema=fm-jt-parent-route.v1\nsecondmate_id=\nsecondmate_id=sm-x1\nparent_home=%s\nparent_status=%s\ncorr_id=0123456789abcdef\n' \
+    "$home" "$parent_status" > "$child_state/.fm-jt-parent-route"
+  fm_write_meta "$home/state/pending-replies/0123456789abcdef" \
+    schema=fm-pending-reply.v1 corr_id=0123456789abcdef task_id=sm-x1 \
+    parent_home="$home" parent_status="$parent_status" delivered_epoch=1 phase=awaiting_report
+  scan "$root" "$child_home" "$fakebin" --startup >/dev/null
+  [ "$(receipt_count "$child_state" pending)" = 0 ] || fail "duplicate route fields were accepted"
+  other_home="$dir/other-parent-home"
+  mkdir -p "$other_home/state"
+  rm -f "$child_state/.fm-jt-parent-route"
+  parent_status="$other_home/state/sm-x1.status"
+  printf 'untouched\n' > "$parent_status"
+  printf 'schema=fm-jt-parent-route.v1\nsecondmate_id=sm-x1\nparent_home=%s\nparent_status=%s\ncorr_id=fedcba9876543210\n' \
+    "$home" "$parent_status" > "$child_state/.fm-jt-parent-route"
+  fm_write_meta "$home/state/pending-replies/fedcba9876543210" \
+    schema=fm-pending-reply.v1 corr_id=fedcba9876543210 task_id=sm-x1 \
+    parent_home="$home" parent_status="$parent_status" delivered_epoch=1 phase=awaiting_report
+  scan "$root" "$child_home" "$fakebin" --startup >/dev/null
+  [ "$(receipt_count "$child_state" pending)" = 0 ] || fail "cross-home parent status was accepted"
+  grep -Fx 'untouched' "$parent_status" >/dev/null || fail "cross-home route touched the other state path"
+  rm -f "$child_home/.fm-jt-parent-route"
+  rm -f "$child_home/.fm-secondmate-home"
+  ln -s "$dir/missing-secondmate-marker" "$child_home/.fm-secondmate-home"
+  printf 'schema=fm-jt-parent-route.v1\nsecondmate_id=sm-x1\nparent_home=%s\nparent_status=%s\ncorr_id=0123456789abcdef\n' \
+    "$home" "$parent_status" > "$child_state/.fm-jt-parent-route"
+  scan "$root" "$child_home" "$fakebin" --startup >/dev/null \
+    || fail "dangling secondmate marker scan failed"
+  [ "$(receipt_count "$child_state" pending)" = 0 ] || fail "dangling secondmate marker was treated as an ordinary home"
+  unset FM_FAKE_CREW_STATE_CHILD_X1
+  pass "malformed and missing secondmate parent routes fail closed without chat scraping"
+}
+
+if [ -n "${FM_INACTIVE_TEST_ONLY:-}" ]; then
+  "$FM_INACTIVE_TEST_ONLY"
+  exit $?
+fi
+
+test_done_and_failed_are_replayed_once
+test_run_step_incarnation_evidence_requires_lifecycle_binding
+test_portable_timeout_runner_is_used
+test_portable_timeout_preserves_signal_failure
+test_portable_timeout_expires_child
+test_leading_zero_cadence_is_normalized
+test_oversized_cadence_is_clamped
+test_metadata_enumeration_failure_propagates_without_advancing_scan
+test_find_enumeration_respects_scan_budget
+test_minimum_budget_preserves_direct_scan
+test_ack_recomputes_fingerprint_from_receipt_fields
+test_reserved_claim_recovers_to_a_new_wake_row
+test_presenting_claim_recovers_before_output
+test_output_started_claim_is_not_reprinted
+test_uncertain_output_claim_fails_closed
+test_pre_output_claim_retries_after_crash
+test_output_completion_failure_does_not_reprint
+test_direct_drain_finalizes_after_successful_output
+test_standalone_drain_refuses_inactive_ack
+test_drain_processes_bounded_batches
+test_wake_cursor_survives_processed_row_removal
+test_finalized_receipt_rows_are_suppressed
+test_malformed_finalized_receipt_fails_closed
+test_presented_claim_is_acknowledged_in_deferred_drain
+test_deferred_ack_retries_after_caller_crash
+test_deferred_drain_kills_presentation_descendants
+test_deferred_output_completion_waits_for_confirmation
+test_deferred_output_completion_failure_retains_emitted_row
+test_deferred_ack_confirms_after_caller_emission
+test_deferred_ack_recovers_after_output_confirmation
+test_pending_receipts_replay_after_child_scan_failure
+test_scan_failure_retries_without_advancing_cadence
+test_state_paths_reject_symlinks_and_non_directories
+test_reused_task_id_gets_new_fingerprint
+test_spawn_publishes_incarnation_token
+test_run_bridge_rejects_relaunched_generation
+test_run_bridge_metadata_stage_failure_preserves_committed_pair
+test_run_bridge_rejects_staged_run_rebinding
+test_run_bridge_rejects_existing_evidence_rebinding
+test_run_bridge_rejects_bound_metadata_without_evidence
+test_run_bridge_total_wait_is_bounded
+test_run_bridge_timeout_terminates_descendants
+test_run_bridge_rejects_temporary_symlink
+test_receipt_rejects_temporary_symlink
+test_run_bridge_rolls_back_failed_metadata_binding
+test_run_bridge_activation_failure_is_recoverable
+test_pane_idle_reclaim_advances_malformed_cursor
+test_session_start_drains_before_inactive_scan
+test_session_start_generation_bound_replay
+test_watcher_runs_inactive_cadence
+test_surfaced_terminal_is_not_replayed
+test_canonical_terminal_snapshot_suppresses_status_replay
+test_postpublication_uncertainty_is_not_replayed
+test_ordinary_terminal_wake_consumption_is_durable
+test_surface_marker_failure_is_retryable
+test_surface_retry_rejects_unsafe_task_path
+test_legacy_metadata_uses_stable_fallback
+test_empty_spawn_incarnation_is_rejected
+test_relaunch_and_teardown_races_recheck_under_spawn_lock
+test_parent_home_secondmate_records_are_skipped
+test_herdr_identity_and_default_captain_refusal
+test_occupancy_unknown_is_not_terminal
+test_status_log_terminal_is_not_replayed
+test_pane_idle_proof_is_required_and_bound
+test_pane_idle_publication_rechecks_under_lock
+test_pane_idle_index_reclaims_retired_windows
+test_pane_idle_index_refreshes_changed_metadata
+test_pane_idle_index_retries_metadata_stamp_race
+test_pane_idle_index_rejects_publication_stamp_race
+test_watcher_bounded_metadata_fail_closed
+test_watcher_skips_deterministic_malformed_metadata
+test_pane_idle_snapshot_reads_honor_deadline
+test_pane_idle_snapshot_compare_honors_deadline
+test_pane_idle_lookup_propagates_deadline
+test_pane_idle_index_resumes_and_rejects_path_cursor
+test_pane_idle_resumable_duplicate_windows_fail_closed
+test_pane_idle_index_retries_partial_publication_idempotently
+test_secondmate_route_accepts_effective_state_overrides
+test_valid_secondmate_route_reports_parent_once
+test_deferred_recorded_secondmate_finishes_without_output
+test_reported_secondmate_route_repair_after_crash
+test_reported_route_repair_is_bounded
+test_pending_receipt_republish_is_bounded
+test_pending_receipt_rejects_unsafe_task_path
+test_secondmate_route_replacement_preserves_old_receipt
+test_secondmate_route_replacement_replays_unchanged_terminal
+test_undelivered_secondmate_route_cleanup_is_idempotent
+test_concurrent_secondmate_routes_are_rejected
+test_route_replacement_rejects_malformed_parent_record
+test_recovery_route_reuse_validates_parent_record
+test_failed_record_removal_is_retryable
+test_failed_marked_send_restores_record_on_route_cleanup_failure
+test_failed_concurrent_send_discards_only_new_record
+test_failed_marked_send_discards_never_bound_record
+test_drain_restores_only_unprocessed_rows
+test_deferred_claim_retains_row_beyond_resume_cursor
+test_resumed_drain_preserves_deferred_row_after_prior_removal
+test_malformed_or_missing_secondmate_route_fails_closed
+test_legacy_secondmate_receipt_is_rejected_before_claim
diff --git a/tests/fm-spawn-dispatch-profile.test.sh b/tests/fm-spawn-dispatch-profile.test.sh
index 166c9fd933b..bdf1c7d043c 100755
--- a/tests/fm-spawn-dispatch-profile.test.sh
+++ b/tests/fm-spawn-dispatch-profile.test.sh
@@ -115,7 +115,8 @@ run_spawn() {
   FM_ROOT_OVERRIDE='' FM_HOME="$home" \
     FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
     FM_PROJECTS_OVERRIDE="$home/projects" FM_CONFIG_OVERRIDE="$home/config" \
-    FM_SPAWN_NO_GUARD=1 FM_FAKE_PANE_PATH="$wt" FM_FAKE_TMUX_STATE="$home/tmux-window-name" TMUX="fake,1,0" \
+    FM_SPAWN_NO_GUARD=1 FM_FAKE_PANE_PATH="$wt" \
+    FM_FAKE_TMUX_STATE="$home/tmux-window-name" TMUX="fake,1,0" \
   FM_FAKE_LAUNCH_LOG="$launchlog" FM_FAKE_PANE_PATH_STATE="$(dirname "$launchlog")/pane-path" \
     FM_FAKE_SECOND_PANE_PATH="$(dirname "$launchlog")/wt2" GROK_HOME="$home/grok-home" PATH="$fakebin:$PATH" \
     "$SPAWN" "$@" 2>&1
diff --git a/tests/fm-tangle-guard.test.sh b/tests/fm-tangle-guard.test.sh
index 0d4ac1be3a6..461dc4527b4 100755
--- a/tests/fm-tangle-guard.test.sh
+++ b/tests/fm-tangle-guard.test.sh
@@ -191,7 +191,8 @@ run_spawn() {
   FM_ROOT_OVERRIDE='' FM_HOME="$home" \
     FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
     FM_PROJECTS_OVERRIDE="$home/projects" FM_CONFIG_OVERRIDE="$home/config" \
-    FM_SPAWN_NO_GUARD=1 FM_FAKE_PANE_PATH="$pane" FM_FAKE_PANE_SEQ="${FM_FAKE_PANE_SEQ:-}" \
+    FM_SPAWN_NO_GUARD=1 FM_FAKE_PANE_PATH="$pane" \
+    FM_FAKE_PANE_SEQ="${FM_FAKE_PANE_SEQ:-}" \
     FM_SPAWN_WT_WAIT_SECS=3 FM_FAKE_TMUX_STATE="$home/tmux-window-name" TMUX="fake,1,0" \
     PATH="$fakebin:$PATH" \
     "$ROOT/bin/fm-spawn.sh" "$id" "$proj" codex 2>&1
diff --git a/tests/fm-wake-queue.test.sh b/tests/fm-wake-queue.test.sh
index b2b15f24b06..38182b909ea 100755
--- a/tests/fm-wake-queue.test.sh
+++ b/tests/fm-wake-queue.test.sh
@@ -209,6 +209,30 @@ test_drain_dedupes_obvious_duplicates() {
   pass "drain collapses obvious duplicate heartbeat and signal records"
 }
 
+test_malformed_wake_row_does_not_suppress_republish() {
+  local dir state deduped rows
+  dir=$(make_case malformed-republish)
+  state="$dir/state"
+  printf '1\t1\tcheck\tduplicate-key\n' > "$state/.wake-queue"
+  FM_SESSION_LOCK_BOOTSTRAP=1 FM_STATE_OVERRIDE="$state" bash -c '
+    . "$1/bin/fm-wake-lib.sh"
+    fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK" || exit 1
+    fm_wake_append_if_absent_locked created signal duplicate-key replacement
+    status=$?
+    fm_lock_release "$FM_WAKE_QUEUE_LOCK" || status=1
+    [ "$status" -eq 0 ] && [ "$created" -eq 1 ]
+  ' _ "$ROOT" || fail "malformed wake row suppressed republish"
+  rows=$(awk -F '\t' '$4 == "duplicate-key" { n++ } END { print n + 0 }' "$state/.wake-queue")
+  [ "$rows" = 2 ] || fail "republish did not add a complete wake row"
+  deduped=$(FM_SESSION_LOCK_BOOTSTRAP=1 FM_STATE_OVERRIDE="$state" bash -c \
+    '. "$1/bin/fm-wake-lib.sh"; fm_wake_print_deduped "$2"' _ "$ROOT" "$state/.wake-queue")
+  [ "$(printf '%s\n' "$deduped" | awk 'NF { n++ } END { print n + 0 }')" = 1 ] \
+    || fail "dedupe did not discard the malformed wake row"
+  printf '%s\n' "$deduped" | grep -F $'\tsignal\tduplicate-key\treplacement' >/dev/null \
+    || fail "dedupe did not preserve the replacement wake row"
+  pass "malformed wake rows cannot suppress republish"
+}
+
 # The drain runs at the top of every wake-handling turn, so it also asserts
 # watcher liveness via fm-guard.sh: a lapsed re-arm chain then surfaces even on a
 # plain drain-and-handle turn that runs no other supervision script. It must warn
@@ -297,6 +321,63 @@ test_unpreparable_lock_refuses_instead_of_spinning() {
   pass "a lock that can never be prepared refuses promptly instead of waiting forever"
 }
 
+test_prepared_wake_transaction_recovery_removes_manifest() {
+  local dir state txn queue_count
+  dir=$(make_case prepared-transaction-recovery)
+  state="$dir/state"
+  txn=$(mktemp -d "$state/.wake-queue.txn.XXXXXX") || fail "could not create an interrupted wake transaction"
+  printf 'schema=fm-wake-queue-transaction.v1\nphase=prepared\naction=write\noffset=0\nhad_queue=0\nhad_cursor=0\n' \
+    > "$txn/manifest" || fail "could not persist the interrupted transaction manifest"
+  printf 'interrupted\n' > "$txn/queue.new" || fail "could not persist the staged queue"
+  append_wake "$state" signal recovered-key 'signal: recovered' \
+    || fail "wake append did not recover a prepared transaction"
+  [ ! -e "$txn" ] || fail "prepared transaction directory remained after recovery"
+  ! find "$state" -maxdepth 1 -type d -name '.wake-queue.txn.*' -print -quit | grep -q . \
+    || fail "prepared transaction residue remained after recovery"
+  grep -F $'\tsignal\trecovered-key\tsignal: recovered' "$state/.wake-queue" >/dev/null \
+    || fail "wake append did not publish after prepared transaction recovery"
+  append_wake "$state" signal retry-key 'signal: retry' \
+    || fail "wake append remained blocked after prepared transaction recovery"
+  queue_count=$(awk 'NF { n++ } END { print n + 0 }' "$state/.wake-queue")
+  [ "$queue_count" -eq 2 ] || fail "wake queue did not retain both post-recovery records"
+  pass "prepared wake transaction recovery removes its manifest and unblocks appends"
+}
+
+test_orphaned_drain_source_is_recovered() {
+  local dir state row out
+  dir=$(make_case orphaned-drain-source)
+  state="$dir/state"
+  row=$'1\t1\tsignal\torphaned-key\tsignal: orphaned'
+  printf '%s\n' "$row" > "$state/.wake-queue"
+  mv "$state/.wake-queue" "$state/.wake-queue.drain.99999" \
+    || fail "could not stage the interrupted drain source"
+  FM_STATE_OVERRIDE="$state" "$DRAIN" > "$dir/drain.out" \
+    || fail "drain did not recover the orphaned source"
+  out=$(cat "$dir/drain.out")
+  grep -Fqx "$row" "$dir/drain.out" || fail "orphaned source row was not drained: $out"
+  [ ! -e "$state/.wake-queue.drain.99999" ] || fail "orphaned source was not removed"
+  pass "drain recovers a source stranded between move and queue recreation"
+}
+
+test_restore_manifest_retires_raw_source_before_clear() {
+  local dir state row raw
+  dir=$(make_case restore-manifest-source)
+  state="$dir/state"
+  row=$'1\t1\tsignal\tretired-key\tsignal: retired'
+  raw=.wake-queue.drain.99998
+  printf '%s\n' "$row" > "$state/.wake-queue.deduped.99999"
+  printf '%s\n' "$row" > "$state/$raw"
+  printf 'schema=fm-wake-queue-restore.v1\nsource=.wake-queue.deduped.99999\noffset=0\nsource_retired=1\nraw_source=%s\nraw_source_retired=0\n' "$raw" \
+    > "$state/.wake-queue.restore"
+  FM_STATE_OVERRIDE="$state" "$DRAIN" > "$dir/drain.out" \
+    || fail "drain did not recover a retired restore source"
+  [ ! -e "$state/.wake-queue.deduped.99999" ] || fail "retired restore source remained"
+  [ ! -e "$state/$raw" ] || fail "owned raw drain source remained"
+  [ ! -e "$state/.wake-queue.restore" ] || fail "restore manifest remained after source retirement"
+  ! grep -Fqx "$row" "$dir/drain.out" || fail "retired restore source was replayed"
+  pass "restore manifest retires its raw source before clearing"
+}
+
 test_concurrent_append_and_drain
 test_signal_catchup_without_running_watcher
 test_stale_enqueue_before_suppressor
@@ -304,5 +385,9 @@ test_not_working_stale_enqueue_before_suppressor
 test_check_output_is_queued
 test_atomic_double_drain
 test_drain_dedupes_obvious_duplicates
+test_malformed_wake_row_does_not_suppress_republish
 test_drain_asserts_watcher_liveness
 test_unpreparable_lock_refuses_instead_of_spinning
+test_prepared_wake_transaction_recovery_removes_manifest
+test_orphaned_drain_source_is_recovered
+test_restore_manifest_retires_raw_source_before_clear
diff --git a/tests/fm-worker-isolation.test.sh b/tests/fm-worker-isolation.test.sh
index bc86affd79b..ff1526aefd3 100755
--- a/tests/fm-worker-isolation.test.sh
+++ b/tests/fm-worker-isolation.test.sh
@@ -331,6 +331,36 @@ test_primary_ancestry_refuses_any_inherited_worker_marker() {
   pass "primary proof refuses any inherited worker declaration marker"
 }
 
+test_primary_ancestry_handles_exported_functions_without_weakening_newline_rejection() {
+  local status payload
+  require_procfs || {
+    pass "skip: exported-function ancestry proof requires readable Linux procfs"
+    return 0
+  }
+  if bash -c '
+    exported_helper() { :; }
+    export -f exported_helper
+    . "$1"; fm_worker_primary_ancestry_clear
+  ' _ "$ROOT/bin/fm-worker-isolation-lib.sh"; then
+    status=0
+  else
+    status=$?
+  fi
+  expect_code 0 "$status" "exported Bash functions must not block primary ancestry proof"
+
+  payload=$'owner\nFM_AGENT_ROLE=secondmate'
+  if env -u FM_AGENT_ROLE -u FM_AGENT_TASK -u FM_AGENT_OWNER_HOME \
+      FM_AGENT_OWNER_HOME="$payload" bash -c '
+        . "$1"; fm_worker_primary_ancestry_clear
+      ' _ "$ROOT/bin/fm-worker-isolation-lib.sh"; then
+    status=0
+  else
+    status=$?
+  fi
+  expect_code 1 "$status" "newline-bearing worker markers must remain rejected"
+  pass "primary ancestry tolerates exported functions but rejects unsafe marker environments"
+}
+
 test_reparented_markerless_worker_is_refused() {
   local result="$TMP_ROOT/reparented-markerless.result" parent status out primary_home token
   primary_home=$(make_primary_home "$TMP_ROOT/reparented-primary")
@@ -715,6 +745,8 @@ SH
   chmod +x "$fakebin/ps"
   primary="$case_dir/primary-root"
   mkdir -p "$home/data/$id" "$home/projects" "$home/state" "$home/config"
+  printf '%s\n' '- project [local-only] - worker-isolation launch fixture (added 2026-08-17)' \
+    > "$home/data/projects.md"
   make_primary_root "$primary"
   token="launch-$id"
   fm_test_write_primary_attestation "$primary" \
@@ -752,7 +784,8 @@ test_every_verified_harness_launches_with_its_home_declaration() {
       FM_PRIMARY_ATTESTATION="$PRIMARY_ATTESTATION" \
       FM_STATE_OVERRIDE="$HOME_DIR/state" FM_DATA_OVERRIDE="$HOME_DIR/data" \
       FM_PROJECTS_OVERRIDE="$HOME_DIR/projects" FM_CONFIG_OVERRIDE="$HOME_DIR/config" \
-      FM_SPAWN_NO_GUARD=1 TMUX="fake,1,0" FM_FAKE_PANE_PATH="$WT_DIR" FM_FAKE_PANE_PID="$pid" \
+      FM_SPAWN_NO_GUARD=1 TMUX="fake,1,0" \
+      FM_FAKE_PANE_PATH="$WT_DIR" FM_FAKE_PANE_PID="$pid" \
       FM_FAKE_TMUX_STATE="$CASE_DIR/tmux-window-name" \
       FM_FAKE_LAUNCH_LOG="$CASE_DIR/launch.log" \
       PATH="$FAKEBIN_DIR:$PATH" \
@@ -1832,6 +1865,7 @@ test_markerless_worker_is_refused_at_primary_cwd
 test_forged_primary_role_is_refused_from_worker_ancestry
 test_primary_ancestry_refuses_unreadable_process_environment
 test_primary_ancestry_refuses_any_inherited_worker_marker
+test_primary_ancestry_handles_exported_functions_without_weakening_newline_rejection
 test_reparented_markerless_worker_is_refused
 test_primary_origin_requires_state_attestation
 test_primary_initialization_requires_explicit_bootstrap