From 713f27d1d2fdee0f2b2dd76283693ac33e8c41a8 Mon Sep 17 00:00:00 2001
From: dnth <dickson.neoh@gmail.com>
Date: Sat, 5 Sep 2026 01:40:46 +0800
Subject: [PATCH 1/2] fix(decisions): close keyed answers at answer time
 through one intake

Port upstream kunchenguid/firstmate #2490 (keyed-answer path), adapted to
this fork, together with the two smaller upstream pieces it depends on
for the incident it is meant to fix: the #2202 colon-first decision-key
parser and the unrouted-close mechanics from #2330 that `answer` shares.

On 2026-08-30 a worker wrote `needs-decision: [key=X] ...` with the tag
after the verb colon. The status fold collapsed that stated key into the
shared `default` bucket, so `fm-send --resolve-key X` was refused three
times while the captain's answer sat on disk.

bin/fm-classify-lib.sh now honors a complete `[key=<slug>]` token at the
head of the note as an equivalent position to the documented before-colon
one, strips the consumed token from the note so both positions fold to
byte-identical records, keeps a mid-note mention as prose, rejects a
malformed stated key instead of rewriting it to `default`, and bumps the
persisted fold version so stale cursors are rebuilt from byte 0.

bin/fm-decision-hold.sh owns "a keyed answer closes its matching hold" as
one channel-agnostic capability: `answer` closes a single actively held
hold that routes no work through a shared unrouted close that keeps every
guard (captain decision file, active-hold requirement, digest-based retry
identity, refusal while routed work is still blocked); `answers` is the
stdin intake that maps `<key>\t<answer>\t<label>` lines to
`<origin>-decision-<key>` and closes each through `answer`; `bind`,
`unbind`, and `binding` record a captured-answer source's origin under
state/decision-bindings/. Every path records a `Resolution mode:` and
older routed records remain valid.

Every channel is an ordinary caller. bin/fm-send.sh --resolve-key still
closes a key the status log owns exactly as before and now feeds the
intake for a key that names an active captain hold on the target task,
which is what lets chat answer a decision `complete` already transferred
to its durable hold; a key open in neither ledger is still refused before
anything is sent. bin/fm-procevent.sh pipes a bound source's captured
result through `fm-procevent-<adapter>.sh answers` into the intake without
naming an adapter or parsing a result, never acknowledges the capture, and
drops the binding on retire. bin/fm-procevent-lavish.sh gains `answers`,
which reports only rows tagged `choice` so freeform prose cannot forge a
key.

Not pulled in: upstream #2728's captain-hold migration, and #2330's
`decline` and `repair` commands; the shared close is parameterized so
they slot in later without weakening `answer`.

Tests: the four upstream #2490 regressions (fixture adapter through the
real runner, unbound source, answer guards, chat channel) join
tests/fm-decision-hold-lifecycle.test.sh, the #2202 parser suite is added
as tests/fm-classify-decision-key.test.sh, and the colon-first end-to-end
case joins tests/fm-send-resolve-key.test.sh.

Claude-Session: https://claude.ai/code/session_01SSAeLowy3hRkryXkiKqYvD
---
 .../skills/decision-hold-lifecycle/SKILL.md   |  16 +-
 .agents/skills/process-event-sources/SKILL.md |  10 +
 AGENTS.md                                     |   1 +
 bin/fm-classify-lib.sh                        |  91 +++-
 bin/fm-decision-hold.sh                       | 401 +++++++++++++++---
 bin/fm-procevent-lavish.sh                    |  87 +++-
 bin/fm-procevent.sh                           |  47 +-
 bin/fm-send.sh                                |  81 +++-
 bin/fm-test-run.sh                            |   1 +
 docs/configuration.md                         |   7 +
 docs/decision-hold-lifecycle.md               |  77 +++-
 docs/scripts.md                               |   2 +-
 docs/verification/process-event-sources.md    |   2 +
 tests/fm-classify-decision-key.test.sh        | 181 ++++++++
 tests/fm-decision-hold-lifecycle.test.sh      | 354 ++++++++++++++++
 tests/fm-send-resolve-key.test.sh             |  35 ++
 16 files changed, 1301 insertions(+), 92 deletions(-)
 create mode 100755 tests/fm-classify-decision-key.test.sh

diff --git a/.agents/skills/decision-hold-lifecycle/SKILL.md b/.agents/skills/decision-hold-lifecycle/SKILL.md
index 5db5690ebc9..98b4a10ee14 100644
--- a/.agents/skills/decision-hold-lifecycle/SKILL.md
+++ b/.agents/skills/decision-hold-lifecycle/SKILL.md
@@ -21,7 +21,14 @@ After inventorying the whole report and review surface, run `bin/fm-decision-hol
 A completed investigation and an ended visual review use this same owner and completion command; a visual tool, including Lavish, never owns a parallel completion policy.
 Run the command in the originating work's authoritative `FM_HOME`; main-home work creates main-home holds, and secondmate-owned work creates holds in that secondmate home's backlog rather than copying them into the main backlog.
 Do not close a hold merely because the originating investigation completed, its report was archived, its visual review ended, or its task was torn down.
-The hold remains the authoritative Captain's Call item until the captain's answer is durably recorded, dependent work is created in the same backlog and blocked by that hold, and `bin/fm-decision-hold.sh resolve` routes the answer by clearing those dependency edges before closing the hold.
+When the captain's answer authorizes follow-up work, the hold remains the authoritative Captain's Call item until that answer is durably recorded, dependent work is created in the same backlog and blocked by the hold, and `bin/fm-decision-hold.sh resolve` routes the answer by clearing those dependency edges before closing the hold.
+When the captain simply answers a hold that has no follow-up work routed behind it yet, `bin/fm-decision-hold.sh answer` records that answer and closes the hold, so answering is closing rather than a separate later act that can be forgotten.
+"A keyed answer closes its matching hold" is one capability with one owner, `bin/fm-decision-hold.sh answers`, and every channel that carries a captain answer feeds it the same `<decision-key>` and answer.
+A channel never maps a key to a hold, records a decision, or closes anything itself, so no channel is special and a new one needs no new closing logic.
+Chat already feeds it: `bin/fm-send.sh --resolve-key` answers a decision in whichever ledger still holds it open, including a decision already transferred to its durable hold.
+A captured-answer source feeds it too once bound with `bin/fm-decision-hold.sh bind <source-id> <origin-id>`; bind before arming the source, and key each structured question by the hold's own decision key.
+An unbound source and a question slug that is not a decision key both simply feed nothing: the answer is still captured and firstmate is still woken, and closing falls back to the commands above.
+A hold closed outside this owner leaves no durable answer, so the completion gate keeps failing; neither close path may stand in for an answer the captain has not given.
 Resolved findings, recommendations that need no captain choice, and prose that merely sounds decision-like do not create holds.
 Bearings reads the resulting structured state and must never compensate by scraping historical reports, visual-review artifacts, terminal output, chat, or other prose.
 
@@ -32,9 +39,10 @@ Bearings reads the resulting structured state and must never compensate by scrap
 3. For each choice, choose a stable key and use the script's `hold` command with a concise title, reason, and repository.
 4. Run the script's `complete` command with the full unresolved-key inventory for that review pass.
 5. Relay the choices to the captain as decisions from Bearings' Captain's Call section under `AGENTS.md` section 9; do not use the word hold in captain chat.
-6. After the captain decides, record dependent work with normal tasks-axi commands and block it by the hold identity.
-7. Put the captain's exact durable decision in a file and use the script's `resolve` command with every routed task.
-8. Confirm Bearings no longer shows the closed hold and that routed work remains in structured backlog state.
+6. If the captain authorizes dependent work, record it with normal tasks-axi commands and block it by the hold identity.
+7. Put the captain's exact durable decision in a file and close the hold with the script's `resolve` command and every routed task, or its `answer` command when the captain answered a hold with no routed work behind it.
+   A hold that a channel already closed by feeding its keyed answer needs neither; confirm it in step 8 instead.
+8. Confirm Bearings no longer shows the closed hold and that any routed work remains in structured backlog state.
 
 `bin/fm-decision-hold.sh --help` owns command syntax, identity construction, completion attestation, retry behavior, and close ordering.
 `docs/decision-hold-lifecycle.md` records the mechanism and regression evidence without restating this policy.
diff --git a/.agents/skills/process-event-sources/SKILL.md b/.agents/skills/process-event-sources/SKILL.md
index a023fff33d1..32f9f2c654c 100644
--- a/.agents/skills/process-event-sources/SKILL.md
+++ b/.agents/skills/process-event-sources/SKILL.md
@@ -29,6 +29,16 @@ For a Lavish review artifact:
 bin/fm-procevent-lavish.sh arm <artifact.html>
 ```
 
+When a source carries captain answers to decisions that already have durable holds, bind it to their origin BEFORE arming it, so it can never produce an answer that has nowhere to go:
+
+```sh
+bin/fm-decision-hold.sh bind <source-id> <origin-id>
+```
+
+The runner then passes each captured result to that source's own adapter `answers` command and pipes the keyed answers it prints into the one keyed-answer intake, which owns every rule about what they mean.
+This is generic: any adapter with an `answers` command works, and the runner still wakes you to act on the result.
+`decision-hold-lifecycle` owns when a binding is required and what the keys must be.
+
 A configured remote secondmate reply source is armed and handled through `bin/fm-procevent-remote-reply.sh`.
 Its header owns exact commands, while the adapter owns cursor continuity, validated deduplicated status ingest, path-confined document fetch, acknowledgement, and re-arming after a good delta.
 A continuity break is escalated once and stays unarmed until an operator deliberately rebases it.
diff --git a/AGENTS.md b/AGENTS.md
index ab8a66bd438..69207bf27ec 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -111,6 +111,7 @@ state/               volatile runtime signals; gitignored
   pending-replies/   parent-owned secondmate pending-reply records (correlation id, delivery vs reply, recovery, escalation); fm-pending-reply-lib.sh
   procevent/         registered process-to-event sources, one private record per canonical source id; written by bin/fm-procevent.sh or an adapter through the shared registration publisher, and their presence alone keeps supervision required (section 13)
   procevent-inbox/   private captured results and their durable handled-acknowledgement markers; source output lives here and never in an event line
+  decision-bindings/ private bindings from a captured-answer source id to the captain-hold origin its keyed answers close; written only by bin/fm-decision-hold.sh bind, dropped by unbind and by source retirement (section 13; docs/decision-hold-lifecycle.md)
   when/              private condition->action watch specs, their trust bindings, and single-fire markers; written only by bin/fm-procevent-when.sh (section 13's process-event-sources trigger)
   x-inbox/           generated X-mode pending mention payloads; fmx-respond drains it (section 14)
   x-context/         generated X-mode durable per-request reply context and one-wake offer markers, keyed by request_id; survives inbox cleanup and expires within seven days (section 14; bin/fm-x-lib.sh)
diff --git a/bin/fm-classify-lib.sh b/bin/fm-classify-lib.sh
index 37be682330c..878eedc4674 100755
--- a/bin/fm-classify-lib.sh
+++ b/bin/fm-classify-lib.sh
@@ -209,12 +209,25 @@ status_is_paused_or_captain_held() {  # <status-line>
 # rule 6), so closure never depends on a busy worker's discipline.
 #
 # Decision key grammar (backward-compatible with the existing "<verb>: <note>"
-# format): an OPTIONAL "[key=<slug>]" token sits between the verb and the colon,
+# format): an OPTIONAL "[key=<slug>]" token names the decision. Its documented
+# position sits between the verb and the colon, and a complete token at the
+# head of the note is accepted as an EQUIVALENT position, because that
+# misplaced-colon shape is common real worker output whose stated key must
+# never silently collapse into the shared "default" bucket (upstream issue
+# #2109; observed here on 2026-08-30 as three refused --resolve-key answers):
 #   needs-decision [key=api-shape]: <summary>
+#   needs-decision: [key=api-shape] <summary>
 #   resolved       [key=api-shape]: <how it was decided>
-# A line with no token uses the key "default", preserving the historical
-# one-open-decision-per-task behavior (a bare "resolved:" closes "default").
-# The three parsers are pure reads of a single line. A prefix is structured
+# Both positions state the same key and yield the same note (a consumed
+# note-head token is key metadata, stripped from the note); when both positions
+# carry a token, the documented before-colon one wins and the note-head token
+# stays note text. A token deeper inside the note is prose, never a stated key,
+# so a summary merely MENTIONING "[key=x]" cannot open or close that decision.
+# A line with no token in either position uses the key "default", preserving
+# the historical one-open-decision-per-task behavior (a bare "resolved:" closes
+# "default"). A stated key whose slug fails the charset below is rejected (the
+# folds skip the line), never rewritten to "default".
+# The parsers are pure reads of a single line. A prefix is structured
 # only when every token after its first word is a space-delimited [key=...] or
 # [corr=...] token; otherwise trimmed pre-colon text retains legacy semantics.
 status_line_verb() {  # <status-line> -> structured verb or legacy pre-colon text
@@ -249,25 +262,65 @@ status_line_verb() {  # <status-line> -> structured verb or legacy pre-colon tex
   esac
   printf '%s' "$prefix"
 }
+# 0 when a complete "[key=...]" token sits in the documented position before
+# the line's first colon (or anywhere on a line that has no colon at all).
+_fm_key_before_colon() {  # <status-line>
+  case "${1%%:*}" in
+    *\[key=*\]*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+# Raw slug of a complete "[key=<slug>]" token at the head of the note (the
+# first thing after the line's first colon, ignoring whitespace). Fails when
+# the line has no colon or no complete token there; slug charset validity is
+# the caller's check via _fm_decision_slug_ok, exactly as for the before-colon
+# position.
+_fm_key_at_note_head() {  # <status-line> -> raw slug
+  local rest
+  case "$1" in
+    *:*) rest=${1#*:} ;;
+    *) return 1 ;;
+  esac
+  rest=${rest#"${rest%%[![:space:]]*}"}
+  case "$rest" in
+    \[key=*\]*) rest=${rest#\[key=}; printf '%s' "${rest%%\]*}" ;;
+    *) return 1 ;;
+  esac
+}
+# 0 when a stated key slug is well-formed: nonempty, A-Za-z0-9._- only.
+_fm_decision_slug_ok() {  # <slug>
+  case "$1" in
+    ''|*[!A-Za-z0-9._-]*) return 1 ;;
+    *) return 0 ;;
+  esac
+}
 status_line_note() {  # <status-line> -> text after the first colon, trimmed
+  local n k
   case "$1" in
-    *:*) local n=${1#*:}; printf '%s' "${n#"${n%%[![:space:]]*}"}" ;;
-    *) printf '%s' "$1" ;;
+    *:*) n=${1#*:}; n=${n#"${n%%[![:space:]]*}"} ;;
+    *) printf '%s' "$1"; return 0 ;;
   esac
+  # A note-head token that states this line's key (no before-colon token, valid
+  # slug) is key metadata, not note text: strip it so both stated-key positions
+  # yield the same note.
+  if ! _fm_key_before_colon "$1" && k=$(_fm_key_at_note_head "$1") \
+    && _fm_decision_slug_ok "$k"; then
+    n=${n#"[key=$k]"}
+    n=${n#"${n%%[![:space:]]*}"}
+  fi
+  printf '%s' "$n"
 }
 _fm_decision_key() {  # <status-line> -> key slug, or "default" when no token
-  local prefix=${1%%:*} k
-  case "$prefix" in
-    *\[key=*\]*)
-      k=${prefix#*\[key=}
-      k=${k%%\]*}
-      case "$k" in
-        ''|*[!A-Za-z0-9._-]*) return 1 ;;
-        *) printf '%s' "$k" ;;
-      esac
-      ;;
-    *) printf 'default' ;;
-  esac
+  local k
+  if _fm_key_before_colon "$1"; then
+    k=${1%%:*}
+    k=${k#*\[key=}
+    k=${k%%\]*}
+  else
+    k=$(_fm_key_at_note_head "$1") || { printf 'default'; return 0; }
+  fi
+  _fm_decision_slug_ok "$k" || return 1
+  printf '%s' "$k"
 }
 # Drop the record for <key> from a newline-terminated "<key>\t<verb>\t<note>" set.
 # Portable (no associative arrays) so the fold runs on bash 3.2 as well as 4+.
@@ -430,7 +483,7 @@ _fm_open_decisions_file_ident() {  # <file> -> "dev:inode", empty on I/O failure
   fi
 }
 
-FM_OPEN_DECISIONS_FOLD_VERSION=5
+FM_OPEN_DECISIONS_FOLD_VERSION=6
 
 _fm_status_file_size() {  # <status-file>
   local f=$1
diff --git a/bin/fm-decision-hold.sh b/bin/fm-decision-hold.sh
index aeb140a296a..64f23490baa 100755
--- a/bin/fm-decision-hold.sh
+++ b/bin/fm-decision-hold.sh
@@ -7,8 +7,8 @@
 # The invoking agent inventories unresolved decisions, assigns stable keys, and
 # routes dependent work. This script supplies deterministic identities, creates
 # and verifies structured tasks-axi captain holds, records completion attestation
-# in the originating task's metadata, and closes a hold only after a durable
-# decision record has been linked to existing dependent work.
+# in the originating task's metadata, and requires a durable captain decision
+# record before it closes a hold.
 #
 # A hold identity is <origin-id>-decision-<decision-key>. Origin ids and decision
 # keys must already be privacy-safe slugs. Repeating `hold` with the same identity
@@ -24,6 +24,11 @@
 #   fm-decision-hold.sh verify <origin-id>
 #   fm-decision-hold.sh resolve <origin-id> <decision-key> \
 #     --decision-file <path> --routed-to <task-id> [--routed-to <task-id>...]
+#   fm-decision-hold.sh answer <origin-id> <decision-key> --decision-file <path>
+#   fm-decision-hold.sh answers <origin-id> --source <provenance>   (keyed answers on stdin)
+#   fm-decision-hold.sh bind <source-id> <origin-id>
+#   fm-decision-hold.sh unbind <source-id>
+#   fm-decision-hold.sh binding <source-id>
 #
 # `complete` is the shared investigation and visual-review completion gate.
 # `--none` is an explicit semantic attestation that the just-reviewed surface has
@@ -33,10 +38,61 @@
 # `verify` is read-only and is called by scout teardown so teardown cannot erase a
 # source before this gate has succeeded.
 #
-# `resolve` requires every --routed-to task to exist and to be blocked by the hold.
-# It writes the captain decision and routed identities into the hold body, clears
-# those dependency edges, and only then marks the hold Done. A failure before the
-# final step leaves the captain hold open.
+# `resolve` and `answer` close active holds. Both paths require a non-empty
+# captain decision file of at most 8192 bytes, record the same durable resolution
+# block in the hold body, and store the decision digest plus routed identities so
+# an exact retry is idempotent while a changed decision or, for `resolve`, routed
+# set is rejected. New records include a `Resolution mode:` naming their path;
+# older routed records remain valid.
+#
+# `resolve` is the routed path. It requires every --routed-to task to exist and to
+# be blocked by the hold. It writes the captain decision and routed identities into
+# the hold body, clears those dependency edges, and only then marks the hold Done.
+# A failure before the final step leaves the captain hold open.
+#
+# `answer` is the answer-time closure path, the hold ledger's counterpart to
+# `fm-send.sh --resolve-key`: it exists so the act that carries the captain's
+# answer is the act that closes the hold, instead of leaving closure to a
+# separate later call nobody is forced to make. It records the captain's answer
+# on an actively held hold, records `(none)` as the routed identities because no
+# follow-up work has been routed behind the hold yet, and closes it. It takes no
+# --routed-to task and refuses while any task is still blocked by the hold, so a
+# decision whose follow-up work is already routed still goes through `resolve`
+# and the routed-vs-unrouted distinction survives. The unrouted close is one
+# shared implementation (close_unrouted_hold) parameterized only by the recorded
+# resolution mode, so a later unrouted path such as upstream's `decline` cannot
+# drift into a weaker close than `answer`.
+#
+# ONE KEYED-ANSWER INTAKE, FED BY EVERY CHANNEL.
+# "A keyed answer closes its matching hold" is a single capability, owned here
+# and nowhere else. `answers` is its channel-agnostic entry point: it reads
+# `<decision-key>\t<answer>\t<label>` lines on stdin, maps each key to this
+# origin's `<origin-id>-decision-<key>` hold, and closes it through the very same
+# `answer` path above, so every guard applies identically no matter which channel
+# the answer arrived on. `--source` is provenance text recorded in the durable
+# decision, never a behavior switch: this command has no per-channel branch and
+# no knowledge of chat, review decks, or any transport.
+#
+# A channel's ONLY job is to turn whatever it received into those keyed lines and
+# pipe them here. It must never map keys to holds, build decision records, decide
+# routed-versus-unrouted, or close a hold itself. A future channel needs no change
+# here at all.
+#
+# The decision text is a pure function of (source, key, answer, label), which is
+# what makes a replayed delivery an idempotent no-op rather than a rejected
+# "different captain decision". A key whose hold is absent, already closed, or
+# still blocking routed work is reported as `skipped:` and left for `resolve`;
+# skipping is never forced closure, and the command exits nonzero when any key
+# was skipped.
+#
+# `bind`, `unbind`, and `binding` record which origin a captured-answer SOURCE
+# belongs to, for any channel whose answers arrive detached from the origin (a
+# process-event source id, for example). The binding is a private record under
+# `state/decision-bindings/`; a source with no binding feeds nothing, so this
+# whole path is opt-in per source and an unbound source behaves as if it did not
+# exist. `bind` deliberately does not require the source to exist yet, so a
+# channel can be bound BEFORE it is armed and never produce an answer that has
+# nowhere to go.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -96,6 +152,25 @@ hold_id() {  # <origin-id> <decision-key>
   printf '%s-decision-%s\n' "$1" "$2"
 }
 
+# The routed-identity token recorded when a close path routes no work. Slug
+# validation rejects parentheses, so no real task identity can collide with it.
+ROUTED_NONE='(none)'
+
+DECISION_TEXT=''
+DECISION_DIGEST=''
+
+load_decision() {  # <path>; sets DECISION_TEXT and DECISION_DIGEST
+  local path=$1 decision
+  [ -n "$path" ] || fail "--decision-file is required"
+  [ -f "$path" ] || fail "decision file does not exist: $path"
+  decision=$(cat "$path")
+  [ -n "$decision" ] || fail "decision file must not be empty"
+  [ "$(printf '%s' "$decision" | LC_ALL=C wc -c | tr -d ' ')" -le 8192 ] \
+    || fail "decision file exceeds 8192 bytes"
+  DECISION_TEXT=$decision
+  DECISION_DIGEST=$(sha256_text "$decision")
+}
+
 tasks_axi() {
   (cd "$FM_HOME" && tasks-axi "$@")
 }
@@ -157,6 +232,68 @@ origin_open_decisions() {  # <origin-id>
   printf '%s' "$open"
 }
 
+body_has_resolution_record() {  # <hold-body>
+  case "$1" in
+    *"Resolution recorded by fm-decision-hold."*"Routed work:"*) return 0 ;;
+  esac
+  return 1
+}
+
+resolution_body() {  # <mode> <routed-csv> [routed-task-id...]
+  local mode=$1 routed_csv=$2 body dep
+  shift 2
+  # Command substitution strips the trailing newline, so restore it before the
+  # routed-work list to keep each entry on its own durable backlog line.
+  body=$(printf 'Resolution recorded by fm-decision-hold.\nDecision digest: %s\nRouted identities: %s\nResolution mode: %s\n\nCaptain decision:\n%s\n\nRouted work:' \
+    "$DECISION_DIGEST" "$routed_csv" "$mode" "$DECISION_TEXT")
+  body="${body}"$'\n'
+  if [ "$#" -eq 0 ]; then
+    body="${body}${ROUTED_NONE}"$'\n'
+  else
+    for dep in "$@"; do
+      body="${body}- ${dep}"$'\n'
+    done
+  fi
+  printf '%s' "$body"
+}
+
+# tasks-axi quotes multi-entry blocked_by as "a,b,c"; strip so edge ids match.
+normalized_blocked_by() {  # <show-output>
+  local blocked
+  blocked=$(show_field "$1" blocked_by | tr -d '[:space:]')
+  blocked=${blocked#\"}
+  blocked=${blocked%\"}
+  printf '%s' "$blocked"
+}
+
+# Space-separated ids of live work still blocked by <hold-id>. The listing is only
+# a cheap prefilter whose first field is always an unquoted id; every candidate is
+# confirmed against its own authoritative record before it is reported.
+tasks_blocked_by() {  # <hold-id>
+  local id=$1 rows row candidate show found=''
+  rows=$(tasks_axi list --fields blocked_by) \
+    || fail "could not read backlog work while checking what $id still blocks"
+  while IFS= read -r row; do
+    case "$row" in
+      *"$id"*) : ;;
+      *) continue ;;
+    esac
+    candidate=${row%%,*}
+    candidate=${candidate// /}
+    [ -n "$candidate" ] || continue
+    [ "$candidate" != "$id" ] || continue
+    case "$candidate" in
+      *[!A-Za-z0-9._-]*) continue ;;
+    esac
+    show=$(task_show "$candidate") || continue
+    list_has_key "$(normalized_blocked_by "$show")" "$id" || continue
+    found="${found}${found:+ }$candidate"
+  done <<EOF
+$rows
+EOF
+  printf '%s' "$found"
+}
+
 verify_hold_active() {  # <hold-id>
   local id=$1 show state held kind hold_kind
   show=$(task_show "$id") || fail "captain hold $id is absent from $FM_HOME/data/backlog.md"
@@ -178,10 +315,7 @@ verify_hold_resolved() {  # <hold-id>
   body=$(show_field "$show" body)
   [ "$state" = "done" ] || return 1
   [ "$kind" = captain ] || return 1
-  case "$body" in
-    *"Resolution recorded by fm-decision-hold."*"Routed work:"*) return 0 ;;
-  esac
-  return 1
+  body_has_resolution_record "$body"
 }
 
 verify_hold_durable() {  # <hold-id>
@@ -195,10 +329,8 @@ verify_hold_durable() {  # <hold-id>
   if [ "$state" = queued ] && [ "$held" = yes ] && [ "$kind" = captain ] && [ "$hold_kind" = captain ]; then
     return 0
   fi
-  if [ "$state" = "done" ] && [ "$kind" = captain ]; then
-    case "$body" in
-      *"Resolution recorded by fm-decision-hold."*"Routed work:"*) return 0 ;;
-    esac
+  if [ "$state" = "done" ] && [ "$kind" = captain ] && body_has_resolution_record "$body"; then
+    return 0
   fi
   fail "captain decision $id is neither actively held nor durably resolved"
 }
@@ -368,7 +500,7 @@ EOF
 }
 
 command_resolve() {
-  local origin=${1:-} key=${2:-} decision_file='' id='' decision='' decision_digest='' body='' routed='' routed_csv='' dep show blocked state hold_show hold_body resolution_recorded=0
+  local origin=${1:-} key=${2:-} decision_file='' id='' body='' routed='' routed_csv='' dep show blocked state hold_show hold_body resolution_recorded=0
   [ "$#" -ge 2 ] || { usage >&2; exit 2; }
   shift 2
   while [ "$#" -gt 0 ]; do
@@ -381,22 +513,16 @@ command_resolve() {
   done
   validate_slug origin-id "$origin"
   validate_slug decision-key "$key"
-  [ -n "$decision_file" ] || fail "--decision-file is required"
-  [ -f "$decision_file" ] || fail "decision file does not exist: $decision_file"
-  decision=$(cat "$decision_file")
-  [ -n "$decision" ] || fail "decision file must not be empty"
-  [ "$(printf '%s' "$decision" | LC_ALL=C wc -c | tr -d ' ')" -le 8192 ] \
-    || fail "decision file exceeds 8192 bytes"
-  [ -n "$routed" ] || fail "at least one --routed-to task is required"
+  load_decision "$decision_file"
+  [ -n "$routed" ] || fail "at least one --routed-to task is required; use answer when the captain's answer routes no work yet"
   routed=$(printf '%s\n' "$routed" | tr ' ' '\n' | sed '/^$/d' | LC_ALL=C sort -u | paste -sd' ' -)
   routed_csv=$(printf '%s\n' "$routed" | tr ' ' ',')
-  decision_digest=$(sha256_text "$decision")
   require_tasks_axi
   id=$(hold_id "$origin" "$key")
   if verify_hold_resolved "$id"; then
     hold_show=$(task_show "$id")
     hold_body=$(show_field "$hold_show" body)
-    verify_resolution_identity "$id" "$hold_body" "$decision_digest" "$routed_csv"
+    verify_resolution_identity "$id" "$hold_body" "$DECISION_DIGEST" "$routed_csv"
     printf 'resolved: %s\n' "$id"
     return 0
   fi
@@ -405,7 +531,7 @@ command_resolve() {
   hold_body=$(show_field "$hold_show" body)
   case "$hold_body" in
     *"Resolution recorded by fm-decision-hold."*)
-      verify_resolution_identity "$id" "$hold_body" "$decision_digest" "$routed_csv"
+      verify_resolution_identity "$id" "$hold_body" "$DECISION_DIGEST" "$routed_csv"
       resolution_recorded=1
       ;;
   esac
@@ -415,50 +541,223 @@ command_resolve() {
     state=$(show_field "$show" state)
     [ "$state" != "done" ] || [ "$resolution_recorded" = 1 ] \
       || fail "routed task $dep is already done"
-    # tasks-axi quotes multi-entry blocked_by as "a,b,c"; strip so edge ids match.
-    blocked=$(show_field "$show" blocked_by | tr -d '[:space:]')
-    blocked=${blocked#\"}
-    blocked=${blocked%\"}
-    case ",$blocked," in
-      *",$id,"*) : ;;
-      *)
-        case "$hold_body" in
-          *"Resolution recorded by fm-decision-hold."*"- $dep"*) : ;;
-          *) fail "routed task $dep is not durably blocked by $id" ;;
-        esac
-        ;;
-    esac
+    blocked=$(normalized_blocked_by "$show")
+    if ! list_has_key "$blocked" "$id"; then
+      case "$hold_body" in
+        *"Resolution recorded by fm-decision-hold."*"- $dep"*) : ;;
+        *) fail "routed task $dep is not durably blocked by $id" ;;
+      esac
+    fi
   done
 
-  body=$(printf 'Resolution recorded by fm-decision-hold.\nDecision digest: %s\nRouted identities: %s\n\nCaptain decision:\n%s\n\nRouted work:\n' "$decision_digest" "$routed_csv" "$decision")
-  for dep in $routed; do
-    body="${body}- ${dep}"$'\n'
-  done
+  # shellcheck disable=SC2086  # routed is a validated space-separated slug list.
+  body=$(resolution_body routed "$routed_csv" $routed)
   tasks_axi update "$id" --body "$body" >/dev/null \
     || fail "could not record the captain decision on $id"
   for dep in $routed; do
     show=$(task_show "$dep") || fail "routed task $dep disappeared before routing"
-    blocked=$(show_field "$show" blocked_by | tr -d '[:space:]')
-    blocked=${blocked#\"}
-    blocked=${blocked%\"}
-    case ",$blocked," in
-      *",$id,"*)
-        tasks_axi unblock "$dep" --by "$id" >/dev/null \
-          || fail "could not route the recorded decision to $dep"
-        ;;
-    esac
+    if list_has_key "$(normalized_blocked_by "$show")" "$id"; then
+      tasks_axi unblock "$dep" --by "$id" >/dev/null \
+        || fail "could not route the recorded decision to $dep"
+    fi
   done
   tasks_axi "done" "$id" >/dev/null || fail "could not close resolved captain hold $id"
   verify_hold_resolved "$id" || fail "captain hold $id did not retain its durable resolution record"
   printf 'resolved: %s -> %s\n' "$id" "$routed"
 }
 
+parse_decision_only_flags() {  # <args...>; prints the --decision-file value
+  local decision_file=''
+  while [ "$#" -gt 0 ]; do
+    case "$1" in
+      --decision-file) shift; decision_file=${1:-} ;;
+      *) usage >&2; exit 2 ;;
+    esac
+    shift
+  done
+  printf '%s' "$decision_file"
+}
+
+# The one unrouted close path. `answer` is its only caller today; upstream's
+# `decline` shares it and differs only in the resolution mode it records and
+# the outcome word it prints. Every guard - the captain decision file, the
+# active-hold requirement, the retry identity, and the refusal to release
+# still-routed work - lives here once, so no caller can drift into a weaker
+# close than another.
+close_unrouted_hold() {  # <mode> <outcome-word> <origin-id> <decision-key> <flag-args...>
+  local mode=$1 outcome=$2 origin=$3 key=$4 decision_file id body hold_show hold_body state dependents
+  shift 4
+  decision_file=$(parse_decision_only_flags "$@") || exit 2
+  validate_slug origin-id "$origin"
+  validate_slug decision-key "$key"
+  load_decision "$decision_file"
+  require_tasks_axi
+  id=$(hold_id "$origin" "$key")
+  if verify_hold_resolved "$id"; then
+    hold_show=$(task_show "$id")
+    hold_body=$(show_field "$hold_show" body)
+    verify_resolution_identity "$id" "$hold_body" "$DECISION_DIGEST" "$ROUTED_NONE"
+    printf '%s: %s\n' "$outcome" "$id"
+    return 0
+  fi
+  hold_show=$(task_show "$id") || fail "captain hold $id is absent from $FM_HOME/data/backlog.md"
+  state=$(show_field "$hold_show" state)
+  [ "$state" != "done" ] \
+    || fail "captain hold $id was closed outside fm-decision-hold and carries no captain decision record"
+  verify_hold_active "$id"
+  hold_body=$(show_field "$hold_show" body)
+  case "$hold_body" in
+    *"Resolution recorded by fm-decision-hold."*)
+      verify_resolution_identity "$id" "$hold_body" "$DECISION_DIGEST" "$ROUTED_NONE"
+      ;;
+  esac
+  dependents=$(tasks_blocked_by "$id") || exit 1
+  [ -z "$dependents" ] \
+    || fail "captain hold $id still blocks routed work ($dependents); use resolve to record that work"
+  body=$(resolution_body "$mode" "$ROUTED_NONE")
+  tasks_axi update "$id" --body "$body" >/dev/null \
+    || fail "could not record the captain decision on $id"
+  tasks_axi "done" "$id" >/dev/null || fail "could not close $mode captain hold $id"
+  verify_hold_resolved "$id" || fail "captain hold $id did not retain its durable resolution record"
+  printf '%s: %s\n' "$outcome" "$id"
+}
+
+command_answer() {
+  [ "$#" -ge 2 ] || { usage >&2; exit 2; }
+  close_unrouted_hold answered answered "$@"
+}
+
+# --- the one keyed-answer intake, and the source bindings that feed it --------
+
+BINDING_DIR="$STATE/decision-bindings"
+BINDING_SCHEMA=fm-decision-binding.v1
+
+validate_source_id() {  # <source-id>
+  validate_slug source-id "$1"
+  [ "${#1}" -le 64 ] || fail "source-id must be at most 64 characters: $1"
+}
+
+binding_path() { printf '%s/%s.origin\n' "$BINDING_DIR" "$1"; }
+
+# The origin a captured-answer source belongs to, or empty when it is unbound.
+# An unreadable or wrong-schema record is a hard error rather than a silent
+# "unbound": feeding nothing is the safe direction only when it is a deliberate
+# choice, never when it is a corrupted record.
+read_binding() {  # <source-id>
+  local path origin schema
+  path=$(binding_path "$1")
+  [ -e "$path" ] || return 0
+  [ -f "$path" ] && [ ! -L "$path" ] || fail "decision binding is unsafe: $path"
+  schema=$(sed -n 's/^schema=//p' "$path" | head -1)
+  [ "$schema" = "$BINDING_SCHEMA" ] || fail "decision binding has an incompatible schema: $path"
+  origin=$(sed -n 's/^origin=//p' "$path" | head -1)
+  case "$origin" in
+    ''|*[!A-Za-z0-9._-]*) fail "decision binding has an invalid origin id: $path" ;;
+  esac
+  printf '%s\n' "$origin"
+}
+
+command_bind() {
+  local source=${1:-} origin=${2:-} dest tmp
+  [ "$#" -eq 2 ] || { usage >&2; exit 2; }
+  validate_source_id "$source"
+  validate_slug origin-id "$origin"
+  (umask 077; mkdir -p "$BINDING_DIR") || fail "cannot create $BINDING_DIR"
+  [ -d "$BINDING_DIR" ] && [ ! -L "$BINDING_DIR" ] || fail "decision binding dir is unsafe: $BINDING_DIR"
+  dest=$(binding_path "$source")
+  tmp=$(umask 077; mktemp "$BINDING_DIR/.origin.XXXXXX") || fail "cannot stage the decision binding"
+  if ! { printf 'schema=%s\norigin=%s\n' "$BINDING_SCHEMA" "$origin" > "$tmp" \
+    && chmod 0600 "$tmp" && mv -f -- "$tmp" "$dest"; }; then
+    rm -f -- "$tmp"
+    fail "cannot record the decision binding for $source"
+  fi
+  printf 'bound: %s -> %s\n' "$source" "$origin"
+}
+
+command_unbind() {
+  local source=${1:-}
+  [ "$#" -eq 1 ] || { usage >&2; exit 2; }
+  validate_source_id "$source"
+  rm -f -- "$(binding_path "$source")"
+  printf 'unbound: %s\n' "$source"
+}
+
+command_binding() {
+  local source=${1:-} origin
+  [ "$#" -eq 1 ] || { usage >&2; exit 2; }
+  validate_source_id "$source"
+  origin=$(read_binding "$source") || exit 1
+  [ -n "$origin" ] || return 1
+  printf '%s\n' "$origin"
+}
+
+# The durable captain decision one keyed answer records. Pure function of its
+# inputs, so the same answer delivered twice is idempotent rather than a
+# conflicting decision.
+keyed_decision_text() {  # <source> <key> <answer> <label>
+  printf 'Captain answered this decision through %s.\n' "$1"
+  printf 'Decision key: %s\n' "$2"
+  printf 'Answer: %s\n' "$3"
+  [ -z "$4" ] || printf 'Answer as shown to the captain: %s\n' "$4"
+}
+
+sanitize_field() {  # <text>
+  printf '%s' "$1" | tr '\n\r\t' '   ' | LC_ALL=C tr -d '\000-\037\177' | cut -c1-512
+}
+
+command_answers() {
+  local origin=${1:-} source='' key answer label hold tmp err closed=0 skipped=0 reason
+  [ "$#" -ge 1 ] || { usage >&2; exit 2; }
+  shift
+  while [ "$#" -gt 0 ]; do
+    case "$1" in
+      --source) shift; source=${1:-} ;;
+      *) usage >&2; exit 2 ;;
+    esac
+    shift
+  done
+  validate_slug origin-id "$origin"
+  [ -n "$source" ] || fail "--source provenance is required so the durable decision records where the answer came from"
+  source=$(sanitize_field "$source")
+  require_tasks_axi
+  tmp=$(umask 077; mktemp "${TMPDIR:-/tmp}/fm-keyed-decision.XXXXXX") || fail "cannot stage the captain decision"
+  err=$(umask 077; mktemp "${TMPDIR:-/tmp}/fm-keyed-decision-err.XXXXXX") \
+    || { rm -f -- "$tmp"; fail "cannot stage the captain decision diagnostics"; }
+  while IFS=$'\t' read -r key answer label; do
+    [ -n "${key:-}" ] || continue
+    case "$key" in *[!A-Za-z0-9._-]*) continue ;; esac
+    [ "${#key}" -le 64 ] || continue
+    answer=$(sanitize_field "${answer:-}")
+    [ -n "$answer" ] || continue
+    label=$(sanitize_field "${label:-}")
+    hold="$origin-decision-$key"
+    keyed_decision_text "$source" "$key" "$answer" "$label" > "$tmp" \
+      || fail "cannot stage the captain decision for $hold"
+    if "$0" answer "$origin" "$key" --decision-file "$tmp" >/dev/null 2>"$err"; then
+      printf 'closed: %s\n' "$hold"
+      closed=$((closed + 1))
+    else
+      reason=$(tr -d '\n' < "$err" | sed 's/^fm-decision-hold: //')
+      printf 'skipped: %s (%s)\n' "$hold" "$reason"
+      skipped=$((skipped + 1))
+    fi
+  done
+  rm -f -- "$tmp" "$err"
+  printf 'answers: closed=%s skipped=%s origin=%s\n' "$closed" "$skipped" "$origin"
+  [ "$skipped" -eq 0 ]
+}
+
 case "${1:-}" in
   id) shift; command_id "$@" ;;
   hold) shift; command_hold "$@" ;;
   complete) shift; command_complete "$@" ;;
   verify) shift; command_verify "$@" ;;
   resolve) shift; command_resolve "$@" ;;
+  answer) shift; command_answer "$@" ;;
+  answers) shift; command_answers "$@" ;;
+  bind) shift; command_bind "$@" ;;
+  unbind) shift; command_unbind "$@" ;;
+  binding) shift; command_binding "$@" ;;
   -h|--help) usage ;;
   *) usage >&2; exit 2 ;;
 esac
diff --git a/bin/fm-procevent-lavish.sh b/bin/fm-procevent-lavish.sh
index f84d1b5d956..cf36ab597a3 100755
--- a/bin/fm-procevent-lavish.sh
+++ b/bin/fm-procevent-lavish.sh
@@ -6,6 +6,7 @@
 #   fm-procevent-lavish.sh classify <result-file>
 #   fm-procevent-lavish.sh terminal <result-file>
 #   fm-procevent-lavish.sh read <result-file>
+#   fm-procevent-lavish.sh answers <result-file>
 #   fm-procevent-lavish.sh source-id <artifact.html>
 #   fm-procevent-lavish.sh retire <artifact.html>
 #
@@ -24,6 +25,17 @@
 # and how to read a completed result. Ownership, durable capture, publication,
 # and restart recovery all belong to bin/fm-procevent.sh.
 #
+# `answers` is this adapter's half of the generic keyed-answer contract in
+# bin/fm-procevent.sh. It reports what the captain actually chose, as
+# `<decision-key>\t<answer>\t<label>` lines, and stops there. It maps nothing to a
+# hold, records no decision, and closes nothing: a captain answer is not special to
+# Lavish, so every rule about what a keyed answer DOES belongs to the one intake in
+# bin/fm-decision-hold.sh, which the runner feeds. A Lavish review is just an
+# ephemeral discussion format that happens to carry answers.
+#
+# Only rows tagged `choice` are read. A freeform captain message is prose that may
+# contain anything, and must never be able to forge a decision key.
+#
 # It wraps ONLY the currently published interface, verified against 0.1.45:
 #   Usage: lavish-axi poll <html-file> [--agent-reply "..."]
 # and that command "long-polls indefinitely" server-side. The adapter therefore
@@ -51,7 +63,7 @@ FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
 . "$SCRIPT_DIR/fm-procevent-lib.sh"
 
 die() { printf 'error: %s\n' "$1" >&2; exit 1; }
-usage() { sed -n '2,39p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; exit 2; }
+usage() { sed -n '2,51p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; exit 2; }
 
 # Canonical identity is physical, not the path string: Lavish itself keys a
 # session on the realpath of the artifact, so two names for one file are one
@@ -73,6 +85,7 @@ cmd_source_id() {
 cmd_arm() {
   local artifact=${1-} id real
   [ -n "$artifact" ] || usage
+  [ "$#" -eq 1 ] || usage
   command -v lavish-axi >/dev/null 2>&1 || die "lavish-axi is not installed"
   id=$(cmd_source_id "$artifact") || exit 1
   real=$(perl -MCwd=realpath -e '$p = realpath($ARGV[0]); defined($p) or exit 1; print "$p\n"' "$artifact" 2>/dev/null) \
@@ -208,6 +221,77 @@ cmd_read() {
   ' "$file" "$lifecycle" "$session_ended"
 }
 
+# Print `key<TAB>answer<TAB>label` for every structured choice the captain
+# submitted in a captured result. The published response frames queued feedback as
+# a `prompts[N]{field,...}:` header followed by exactly N indented CSV rows whose
+# quoted fields carry JSON-style escapes, so this reads the declared field ORDER
+# rather than assuming a fixed column, and takes only rows whose `tag` field is
+# `choice`. A freeform `message` row is captain prose and is deliberately never a
+# source of decision keys. A row that does not carry both a slug-shaped `question`
+# and an `answer` inside its `Context data:` block is skipped, so a deck that does
+# not key its forms by decision key simply yields nothing.
+cmd_answers() {
+  local file=${1-}
+  [ -n "$file" ] || usage
+  [ -f "$file" ] && [ ! -L "$file" ] || die "result file does not exist: $file"
+  perl -e '
+    use strict; use warnings;
+    my ($path) = @ARGV;
+    open my $fh, "<", $path or exit 1;
+    my (@fields, $want, @rows);
+    while (my $line = <$fh>) {
+      if (!@fields) {
+        next unless $line =~ /^prompts\[(\d+)\]\{([^}]*)\}:\s*$/;
+        ($want, @fields) = ($1, split /,/, $2);
+        next;
+      }
+      last unless $line =~ /^\s/;
+      last if @rows >= $want;
+      chomp $line;
+      push @rows, $line;
+    }
+    close $fh;
+    my %seen;
+    my @out;
+    for my $row (@rows) {
+      $row =~ s/^\s+//;
+      my @vals;
+      while (length $row) {
+        if ($row =~ s/^"((?:[^"\\]|\\.)*)"//) {
+          my $v = $1;
+          $v =~ s/\\(.)/$1 eq "n" ? "\n" : $1 eq "t" ? "\t" : $1 eq "r" ? "\r" : $1/ge;
+          push @vals, $v;
+        } else {
+          $row =~ s/^([^,]*)//;
+          push @vals, $1;
+        }
+        last unless $row =~ s/^,//;
+      }
+      my %f;
+      $f{$fields[$_]} = $vals[$_] for 0 .. $#fields;
+      next unless defined $f{tag} && $f{tag} eq "choice";
+      my $prompt = $f{prompt};
+      next unless defined $prompt && $prompt =~ /Context data:\s*(\{.*\})/s;
+      my $ctx = $1;
+      next unless $ctx =~ /"question"\s*:\s*"((?:[^"\\]|\\.)*)"/;
+      my $key = $1;
+      next unless $ctx =~ /"answer"\s*:\s*"((?:[^"\\]|\\.)*)"/;
+      my $answer = $1;
+      $_ =~ s/\\(.)/$1/g for ($key, $answer);
+      next unless $key =~ /\A[A-Za-z0-9._-]{1,64}\z/;
+      next unless length $answer && length($answer) <= 512;
+      my $label = defined $f{text} ? $f{text} : "";
+      s/[\x00-\x1f\x7f]/ /g for ($answer, $label);
+      $label = substr($label, 0, 512);
+      # A re-answered form appears again later in the queue; the last submission wins.
+      if (defined $seen{$key}) { $out[$seen{$key}] = undef }
+      $seen{$key} = scalar @out;
+      push @out, "$key\t$answer\t$label";
+    }
+    print "$_\n" for grep { defined } @out;
+  ' "$file"
+}
+
 case "${1-}" in
   arm)       shift; cmd_arm "$@" ;;
   retire)    shift; cmd_retire "$@" ;;
@@ -215,6 +299,7 @@ case "${1-}" in
   classify)  shift; cmd_classify "$@" ;;
   terminal)  shift; cmd_terminal "$@" ;;
   read)      shift; cmd_read "$@" ;;
+  answers)   shift; cmd_answers "$@" ;;
   ''|-h|--help|help) usage ;;
   *) die "unknown command: $1" ;;
 esac
diff --git a/bin/fm-procevent.sh b/bin/fm-procevent.sh
index 1c45fb40212..569199e3e62 100755
--- a/bin/fm-procevent.sh
+++ b/bin/fm-procevent.sh
@@ -51,6 +51,23 @@
 # only terminal verdict. A missing command, an error, or any other exit keeps the
 # registration armed, so an adapter that has no notion of ending needs no change.
 #
+# Keyed captain answers are adapter-owned through one more seam of the same kind,
+# and this runner still decides nothing about them. Some sources carry the
+# captain's answer to a durable decision. What such an answer MEANS is owned once,
+# by bin/fm-decision-hold.sh's keyed-answer intake, and reaching it must not
+# depend on an agent remembering. So after capture, a source that has been bound
+# to a decision origin has its result passed to
+# `bin/fm-procevent-<adapter>.sh answers <result-file>`, and whatever that prints
+# is piped straight into that one intake. The adapter reports only what the
+# captain chose; the intake owns every rule about what happens next. This runner
+# names no adapter, parses no result, and knows no decision rule, so a future
+# source needs nothing here beyond an `answers` command and a binding.
+#
+# Feeding is deliberately independent of handling: it never acknowledges a result
+# and never suppresses a wake. Recording the captain's answer is transcription,
+# while ACTING on it is firstmate's judgement, so the capture stays unacknowledged
+# and its `check` wake reaches the handler exactly as it would have anyway.
+#
 # Ownership is machine-wide per canonical source, because separate Firstmate
 # homes can share one underlying source store. A live owner is never displaced;
 # only a claim whose whole generation is gone is reclaimed. A runner leads its
@@ -79,7 +96,7 @@ REG=$(fm_procevent_registry_dir "$STATE")
 MAX_OUTPUT_BYTES=${FM_PROCEVENT_MAX_OUTPUT_BYTES:-1048576}
 
 die() { printf 'error: %s\n' "$1" >&2; exit 1; }
-usage() { sed -n '2,63p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; exit 2; }
+usage() { sed -n '2,80p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; exit 2; }
 
 adapter_script() { printf '%s/bin/fm-procevent-%s.sh\n' "$FM_ROOT" "$1"; }
 
@@ -98,6 +115,24 @@ source_file()  { printf '%s/%s.source\n' "$REG" "$1"; }
 runner_file()  { printf '%s/%s.runner\n' "$REG" "$1"; }
 staging_file() { printf '%s/.%s.%s.output\n' "$REG" "$1" "$2"; }
 
+# Pass a bound source's captured result to the one keyed-answer intake. The
+# adapter turns its own format into keyed lines; the intake owns everything those
+# lines mean. Silenced and best-effort exactly like the terminal seam above: an
+# unbound source, an adapter with no `answers` command, and a failure on either
+# side all leave the capture untouched and still announced, because this never
+# acknowledges anything (see the keyed-answer note in the header).
+feed_keyed_answers() {  # <adapter> <source-id> <result-file>
+  local adapter=$1 id=$2 result=$3 script origin seq
+  script=$(adapter_script "$adapter")
+  [ -f "$script" ] && [ ! -L "$script" ] || return 1
+  origin=$("$SCRIPT_DIR/fm-decision-hold.sh" binding "$id" 2>/dev/null) || return 1
+  [ -n "$origin" ] || return 1
+  seq=$(fm_procevent_result_sequence "$result") || return 1
+  "$script" answers "$result" 2>/dev/null \
+    | "$SCRIPT_DIR/fm-decision-hold.sh" answers "$origin" \
+        --source "the captured result $id sequence $seq" >/dev/null 2>&1
+}
+
 read_adapter() {  # <source-id>
   local f; f=$(source_file "$1")
   [ -f "$f" ] && [ ! -L "$f" ] || return 1
@@ -311,6 +346,12 @@ cmd_start() {
   STAGED_OUTPUT=
   [ "$truncated" -eq 1 ] && printf 'truncated: %s at %s bytes\n' "$id" "$MAX_OUTPUT_BYTES" >&2
 
+  # Independent of publication and acknowledgement, so it runs once per capture
+  # for every adapter and cannot change what the handler receives.
+  if feed_keyed_answers "$adapter" "$id" "$durable"; then
+    printf 'answers-fed: %s\n' "$id"
+  fi
+
   publish_pending >/dev/null
   rm -f -- "$(runner_file "$id")"
   # Publication is already durable, so retiring an ended source here can never
@@ -567,6 +608,10 @@ cmd_retire() {
   rm -f -- "$(source_file "$id")"
   rm -f -- "$(runner_file "$id")"
   fm_procevent_source_lock_release "$id"
+  # A retired source produces no further answer, so drop any decision binding it
+  # carried. Generic and idempotent: the binding owner is asked to forget this
+  # source id, and an unbound source is unaffected.
+  "$SCRIPT_DIR/fm-decision-hold.sh" unbind "$id" >/dev/null 2>&1 || true
   printf 'retired: %s\n' "$id"
 }
 
diff --git a/bin/fm-send.sh b/bin/fm-send.sh
index eae0e053e2a..bffdaf42f5e 100755
--- a/bin/fm-send.sh
+++ b/bin/fm-send.sh
@@ -90,10 +90,22 @@
 # remote secondmate alike - because the open-decision ledger fm-wake-drain
 # folds lives in this home's own state dir (a remote mate's escalations reach
 # it through the parent-replies ingest); only the answer message crosses the
-# backend or remote transport. Each named key must currently be open in that
-# ledger per status_open_decisions (bin/fm-classify-lib.sh) or fm-send refuses
-# before sending, so a mistyped key cannot deliver an answer while silently
-# orphaning the decision. A failed or unconfirmed send never closes a key; a
+# backend or remote transport.
+#
+# Chat is also a channel that carries keyed captain answers, so the same flag
+# feeds bin/fm-decision-hold.sh's one keyed-answer intake for any key that names
+# a durable decision hold on the target task. fm-send maps nothing to a hold and
+# closes nothing itself; it hands the intake `<key>\t<answer>\t<label>` exactly
+# as every other channel does, and the intake owns what that means. This is what
+# lets an answer reach a decision that has already been transferred from the live
+# status log to its durable hold, which the status ledger alone can no longer
+# close.
+#
+# Each named key must therefore currently be open in ONE of the two ledgers: open
+# in this home's status log per status_open_decisions (bin/fm-classify-lib.sh), or
+# an active captain hold for the target task. A key in neither is refused before
+# sending, so a mistyped key cannot deliver an answer while silently orphaning the
+# decision. A failed or unconfirmed send never closes a key; a
 # delivered answer whose closing append fails exits nonzero with the exact
 # manual close command, leaving the decision open to re-surface (the safe
 # direction). A send without the flag never closes anything: a routine steer,
@@ -620,6 +632,25 @@ fi
 # send, is what keeps a mistyped key loud instead of delivering an answer that
 # silently leaves its decision open.
 RESOLVE_STATUS_FILE=
+# Which ledger each answered key belongs to. A key still open in the status log
+# is owned by the status log: fm-decision-hold's `complete` closes that live copy
+# at the moment it transfers a decision to its durable hold, so "still open in
+# status" and "already a hold" are the two sides of one transfer, never both at
+# once. Checking the hold only for keys the status log no longer owns also keeps
+# the common path free of any backlog read.
+RESOLVE_STATUS_KEYS=
+RESOLVE_HOLD_KEYS=
+
+fm_send_hold_is_active() {  # <task-id> <decision-key>
+  local show
+  command -v tasks-axi >/dev/null 2>&1 || return 1
+  show=$( (cd "$FM_HOME" && tasks-axi show "$1-decision-$2" --full) 2>/dev/null ) || return 1
+  case "$show" in *"held: yes"*) : ;; *) return 1 ;; esac
+  case "$show" in *"hold_kind: captain"*) : ;; *) return 1 ;; esac
+  case "$show" in *"state: queued"*) return 0 ;; esac
+  return 1
+}
+
 if [ -n "$RESOLVE_KEYS" ]; then
   if [ -z "$TARGET_SELECTOR" ] || [ -z "$TARGET_META" ]; then
     echo "error: --resolve-key needs a task selector resolved through this home's metadata; an explicit backend target has no decision ledger here" >&2
@@ -638,21 +669,48 @@ if [ -n "$RESOLVE_KEYS" ]; then
   resolve_open_set=$(status_open_decisions "$RESOLVE_STATUS_FILE")
   for k in $RESOLVE_KEYS; do
     case "$resolve_open_set" in
-      "$k"$'\t'*|*$'\n'"$k"$'\t'*) ;;
-      *)
-        echo "error: --resolve-key '$k': no open decision or blocker with that key in $RESOLVE_STATUS_FILE (already closed, mistyped, or transferred). Re-check the OPEN DECISIONS listing, then resend without that key or with the right one; nothing was sent." >&2
-        exit 1
+      "$k"$'\t'*|*$'\n'"$k"$'\t'*)
+        RESOLVE_STATUS_KEYS="${RESOLVE_STATUS_KEYS}${RESOLVE_STATUS_KEYS:+ }$k"
+        continue
         ;;
     esac
+    # Not open in the status log. A decision already transferred to its durable
+    # hold is exactly this case, and it is answerable - just through the other
+    # ledger - so check there before refusing.
+    if fm_send_hold_is_active "$RESOLVE_TASK_ID" "$k"; then
+      RESOLVE_HOLD_KEYS="${RESOLVE_HOLD_KEYS}${RESOLVE_HOLD_KEYS:+ }$k"
+      continue
+    fi
+    echo "error: --resolve-key '$k': no open decision or blocker with that key in $RESOLVE_STATUS_FILE, and no active captain decision $RESOLVE_TASK_ID-decision-$k (already closed or mistyped). Re-check the OPEN DECISIONS listing, then resend without that key or with the right one; nothing was sent." >&2
+    exit 1
   done
 fi
+# Feed the answered hold keys to the ONE keyed-answer intake, as keyed lines,
+# exactly the way every other channel does. fm-send decides nothing here: it does
+# not map a key to a hold, build a decision record, or choose a close path.
+fm_send_feed_resolved_holds() {  # <answer-text>
+  local note=$1 k lines=''
+  [ -n "$RESOLVE_HOLD_KEYS" ] || return 0
+  note=$(printf '%s' "$note" | tr '\n\r\t' '   ' | LC_ALL=C tr -d '\000-\037\177')
+  for k in $RESOLVE_HOLD_KEYS; do
+    lines="${lines}${k}"$'\t'"${note}"$'\t'$'\n'
+  done
+  if ! printf '%s' "$lines" | "$SCRIPT_DIR/fm-decision-hold.sh" answers "$RESOLVE_TASK_ID" \
+    --source "a firstmate answer sent to $RESOLVE_TASK_ID" >/dev/null 2>&1; then
+    echo "error: the answer was delivered to $T, but this captain decision could not be closed: ${RESOLVE_HOLD_KEYS}. Close it with fm-decision-hold.sh (answer, or resolve when it routes work) - do not resend the answer." >&2
+    return 1
+  fi
+}
+
 # Close each answered decision in this home's ledger, only after delivery is
-# fully confirmed. An append failure exits nonzero with the manual close
-# command; the decision then stays open and re-surfaces, never silently lost.
+# fully confirmed: the status-log keys by appending their resolved lines, then
+# the hold keys through the keyed-answer intake above. An append failure exits
+# nonzero with the manual close command; the decision then stays open and
+# re-surfaces, never silently lost.
 fm_send_close_resolved_keys() {  # <answer-text>
   local note=$1 k quoted_line quoted_status failed=0
   note=$(printf '%s' "$note" | tr '\n\r\t' '   ' | LC_ALL=C tr -d '\000-\037\177')
-  for k in $RESOLVE_KEYS; do
+  for k in $RESOLVE_STATUS_KEYS; do
     fm_send_resolved_line "$k" "$note"
     if ! printf '%s\n' "$FM_SEND_RESOLVED_LINE" >> "$RESOLVE_STATUS_FILE"; then
       printf -v quoted_line '%q' "$FM_SEND_RESOLVED_LINE"
@@ -666,6 +724,7 @@ fm_send_close_resolved_keys() {  # <answer-text>
     echo "error: close every listed key manually; do not resend the answer." >&2
     return 1
   fi
+  fm_send_feed_resolved_holds "$1"
 }
 
 fm_send_hermes_skill_resolution() {  # <hermes-home> <skill>
diff --git a/bin/fm-test-run.sh b/bin/fm-test-run.sh
index cde479ffda3..8a6651d65ac 100755
--- a/bin/fm-test-run.sh
+++ b/bin/fm-test-run.sh
@@ -136,6 +136,7 @@ family_for_basename() {
     fm-arm-pretool-check.test.sh|fm-ask-user-authority.test.sh|\
     fm-brief.test.sh|fm-receipt.test.sh|fm-receipt-check.test.sh|fm-vendor-auth-probe.test.sh|\
     fm-calm-pi-extension.test.sh|fm-cd-pretool-check.test.sh|\
+    fm-classify-decision-key.test.sh|\
     fm-composer-ghost.test.sh|fm-composer-lib.test.sh|\
     fm-crew-state.test.sh|fm-decision-hold-lifecycle.test.sh|\
     fm-documentation-audiences.test.sh|fm-ensure-agents-md.test.sh|fm-grok-harness.test.sh|\
diff --git a/docs/configuration.md b/docs/configuration.md
index ba5a1e1bd87..42276aee844 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -584,6 +584,13 @@ A failed terminal removal stays durably terminal and is completed by ordinary re
 A source that has ended therefore captures at most one terminal result, is never restarted, and leaves no recurring poll work, while explicit `retire` stays the supported and idempotent path afterwards.
 For Lavish that verdict covers an ended session, a missing session, and the final feedback of a `Send & End` review, which the published poll marks with `session_ended` before it returns only empty ended sessions.
 
+Keyed captain answers use one more seam of the same kind, and the runner still decides nothing about them.
+Some sources carry the captain's answer to a durable decision, and what such an answer means is owned once by `bin/fm-decision-hold.sh`'s keyed-answer intake rather than by any channel.
+A source bound to a decision origin with `bin/fm-decision-hold.sh bind <source-id> <origin-id>` therefore has each captured result passed to `bin/fm-procevent-<adapter>.sh answers <result-file>`, and whatever that prints is piped straight into that intake.
+The adapter reports only what the captain chose; the intake owns every rule about what happens next, so the runner names no adapter, parses no result, and carries no decision rule, and a future source needs nothing here beyond an `answers` command and a binding.
+Feeding is independent of handling: it never acknowledges a result and never suppresses a wake, because recording the answer is transcription while acting on it is firstmate's judgement.
+An unbound source, an adapter with no `answers` command, and a failure on either side all leave the capture untouched and still announced.
+
 Ownership is machine-wide per canonical source, because separate homes can share one underlying source store.
 Claims live under `$XDG_STATE_HOME/firstmate/procevent-claims` (override with `FM_PROCEVENT_CLAIM_ROOT`).
 Each claim binds its home and runner PID to a process identity, unique claim generation, and exact registration-file generation.
diff --git a/docs/decision-hold-lifecycle.md b/docs/decision-hold-lifecycle.md
index 234055aec3f..8064315df99 100644
--- a/docs/decision-hold-lifecycle.md
+++ b/docs/decision-hold-lifecycle.md
@@ -23,10 +23,47 @@ For an open keyed status decision, it appends a `captain-held [key=<key>]: ...`
 Scout teardown calls the script's read-only `verify` subcommand after checking for the report and before removing any source state.
 The `--force` path remains the explicit captain-approved discard escape hatch.
 
-The `resolve` subcommand requires a decision file and at least one existing dependent task whose structured `blocked-by` edge points to the hold.
-It records the decision digest and routed task identities as a retry identity in the hold body, clears each dependency edge through tasks-axi, and marks the hold Done only after those writes succeed.
-An exact retry can finish a partial routing operation, while a changed decision or routed-task set is rejected.
-A failed intermediate step leaves the hold open.
+The `resolve` and `answer` subcommands close active holds.
+Both require a non-empty captain decision file and record the same resolution block in the hold body with the decision digest, routed identities, and a `Resolution mode:` naming the path.
+An exact retry is idempotent, while a changed decision or, for `resolve`, a changed routed-task set is rejected.
+
+The `resolve` subcommand is the routed path and additionally requires at least one existing dependent task whose structured `blocked-by` edge points to the hold.
+It clears each dependency edge through tasks-axi and marks the hold Done only after those writes succeed.
+An exact retry can finish a partial routing operation, and a failed intermediate step leaves the hold open.
+
+The `answer` subcommand is the unrouted path, implemented once as a shared close parameterized only by the recorded `Resolution mode:`, so a later unrouted path such as upstream's `decline` cannot drift into a weaker close.
+It records `(none)` as the routed identities and refuses while any task in the same backlog is still blocked by the hold, because releasing routed work without recording it is `resolve`'s job.
+Every candidate found in the listing prefilter is confirmed against its own structured record before the refusal is reported.
+`answer` exists so the act carrying a captain answer can also be the act that closes its hold.
+
+## Answer-time closure
+
+The live status-log decision ledger has always had answer-time closure through `bin/fm-send.sh --resolve-key`: answering a keyed decision closes it in the same act.
+The durable hold ledger did not, so an answer could be captured, believed, and even implemented while its hold stayed open, and the captain could then be asked to re-answer a decision already on disk.
+
+"A keyed answer closes its matching hold" is now one capability with one owner.
+`answers` is its channel-agnostic entry point: it reads `<decision-key>`, answer, and label lines on stdin, maps each key to `<origin-id>-decision-<key>`, and closes it through the same `answer` path, so every guard applies identically no matter which channel the answer arrived on.
+`--source` is provenance text recorded in the durable decision, never a behavior switch, and the command carries no per-channel branch and no knowledge of chat, review decks, or any transport.
+A channel's only job is to turn whatever it received into those keyed lines and pipe them in; it never maps keys to holds, builds decision records, chooses between the close paths, or closes a hold itself.
+The decision text is a pure function of source, key, answer, and label, which is what makes a replayed delivery an idempotent no-op rather than a rejected different decision.
+A key whose hold is absent, already closed, or still blocking routed work is reported as skipped and left for `resolve`, and the command exits nonzero when any key was skipped.
+
+`bind`, `unbind`, and `binding` record which origin a captured-answer source belongs to, for a channel whose answers arrive detached from the origin.
+The binding is a private record under `state/decision-bindings/`, and a source with no binding feeds nothing, so the path is opt-in per source.
+`bind` deliberately does not require the source to exist yet, so a channel can be bound before it is armed and never produce an answer that has nowhere to go.
+
+Two channels feed that one intake today, and both are ordinary callers rather than special cases.
+
+`bin/fm-send.sh --resolve-key` is the chat channel.
+Its existing status-log close is unchanged for a key the status log still owns, and the status-log fold honors a stated `[key=<slug>]` token both before the verb colon and at the head of the note, so a worker's misplaced colon can no longer collapse a stated key into `default` and make the answer refuse.
+For a key the status log no longer owns it checks whether that key names an active captain hold on the target task, and feeds the answer as one keyed line if so, which is what lets chat answer a decision already transferred to its hold.
+A key open in neither ledger is still refused before anything is sent.
+Because `complete` closes the live status copy at the moment it transfers a decision to its hold, the two ledgers are the two sides of one transfer and never both own a key at once, so the common path still performs no backlog read.
+
+`bin/fm-procevent.sh` is the captured-result channel, and its wiring is generic.
+After capture, a bound source has its result passed to `bin/fm-procevent-<adapter>.sh answers <result-file>` and whatever that prints is piped into the intake, so any adapter with an `answers` command works and the runner names no adapter, parses no result, and carries no decision rule.
+Feeding is independent of handling: it never acknowledges a result and never suppresses a wake, so recording the captain's answer cannot retire the notification firstmate needs in order to act on it.
+`bin/fm-procevent-lavish.sh answers` is one such adapter command; it reports the structured choices a review captured and stops there, reading only rows tagged `choice` so freeform captain prose can never forge a decision key.
 
 ## Structured read surfaces
 
@@ -43,12 +80,21 @@ The projection remains read-only and does not inspect historical prose.
 Verification date: 2026-07-14.
 Additional quoted `blocked_by` regression verification date: 2026-07-17.
 Plural blocker-readiness and mixed-home projection verification date: 2026-07-22.
+Answer-time closure and colon-first decision-key verification date: 2026-09-05.
 
 The focused end-to-end regression uses only synthetic `sample` identities and decision text.
 It begins with a completed investigation and visual review whose genuine unresolved choice exists only in the report.
 The initial Bearings snapshot correctly has no open decision, and the new teardown gate refuses to erase the source.
 A later regression covers tasks-axi's quoted multi-entry `blocked_by` output so `resolve` matches the first, middle, and last ids and rejects a genuinely absent id.
 
+Four answer-time closure regressions run against the published poll response shape, with synthetic `sample` identities.
+A bound source whose origin exposes six holds captures one review carrying five structured choices plus one freeform message, and the runner feeds it through a fixture adapter that is not the review adapter at all, so what is proven is that any bound channel with an `answers` command gets closure rather than that one channel is wired specially.
+Four holds whose answers route no work close, the one still blocking routed work is skipped and stays available to `resolve`, and the one whose key appears only inside the freeform prose never closes.
+The capture is left unacknowledged throughout, so the wake firstmate needs in order to act on the answers is never retired.
+A replayed delivery closes nothing new and is not rejected as a different decision, a source with no binding closes nothing at all, and the `answer` subcommand itself refuses an empty or missing decision file, an absent hold, and a drifted retry.
+A separate regression drives the real `fm-send` over a stubbed transport to prove the chat channel reaches the same intake for a decision already transferred to its hold, which the status ledger alone can no longer close.
+The status-log side is covered by `tests/fm-classify-decision-key.test.sh`, which drives the real full and incremental folds over a worker's colon-first `needs-decision: [key=<slug>]` line and pins that the stated key opens and closes under its own name in both positions, and by an end-to-end `fm-send --resolve-key` case for the same colon-first shape.
+
 The final verification commands and their exact summarized outputs follow.
 
 ```text
@@ -62,6 +108,26 @@ ok - resolved findings and decision-like prose do not create false holds
 ok - terminal single-owner stale status decisions do not block empty inventory
 ok - main-home and secondmate-home captain holds remain correctly routed
 ok - resolve matches first/middle/last in quoted blocked_by and rejects a genuinely absent id
+ok - a bound channel's captured answers close their captain holds at answer time
+ok - a channel source with no decision binding closes nothing
+ok - the answer path keeps every guard the unrouted close path already had
+ok - the chat channel feeds the same keyed-answer intake a captured review does
+
+$ bash tests/fm-classify-decision-key.test.sh
+ok - a stated [key=X] opens X whether it precedes or follows the verb colon
+ok - a keyless needs-decision still opens and closes the default key
+ok - a resolution closes its decision regardless of either line's key position
+ok - blocked [key=X] opens X in both key positions
+ok - two colon-form keyed decisions never collapse into one shared bucket
+ok - a [key=x] mentioned mid-note is prose, never an opened or closed key
+ok - a malformed stated key is rejected in both positions, never folded as default
+ok - the incremental fold matches the full fold across appends in both key positions
+
+$ bash tests/fm-send-resolve-key.test.sh
+ok - fm-send --resolve-key closes the open decision at answer time
+ok - fm-send --resolve-key: a colon-first stated key is open under that key and answerable
+ok - a key that is not open refuses before anything is sent
+(17 assertions total; the status-log ledger's behavior is otherwise unchanged)
 
 $ bash tests/fm-fleet-snapshot-view.test.sh
 ok - backlog normalization preserves strict roles and resolves every blocker compatibly
@@ -83,6 +149,9 @@ all teardown safety cases passed
 $ bin/fm-lint.sh
 fm-lint.sh: ShellCheck 0.11.0 (pinned 0.11.0)
 
+$ bin/fm-doc-audience-check.sh
+fm-doc-audience-check: ok surfaces=71 local_links=280
+
 $ git diff --check
 (no output)
 
diff --git a/docs/scripts.md b/docs/scripts.md
index 6a1c73d99d3..f5980eeaa33 100644
--- a/docs/scripts.md
+++ b/docs/scripts.md
@@ -24,7 +24,7 @@ The shared no-mistakes gate refusal for fleet lifecycle entrypoints is summarize
 | `fm-todo-project.sh`     | Project the board into session-todo JSON (`--emit`) or check board drift (`--check`, optionally `--reconcile`); the script header owns mutation limits |
 | `fm-backlog-handoff.sh`  | Validate and delegate queued backlog-item moves into a secondmate home               |
 | `fm-backlog-receive.sh`  | Idempotently ingest one confined remote handoff outbox through tasks-axi             |
-| `fm-decision-hold.sh`    | Create, verify, complete, and resolve durable captain-held decisions                 |
+| `fm-decision-hold.sh`    | Create, verify, complete, answer, and resolve durable captain-held decisions         |
 | `fm-brief.sh`            | Scaffold ship (explicit `--mode`), scout, secondmate-charter, and Herdr-lab briefs   |
 | `fm-herdr-lab.sh`        | Provision and guardedly operate an isolated, never-default Herdr lab session         |
 | `fm-install-herdr.sh`    | Install CI's exact-version Herdr pin with official asset URL, SHA-256, and protocol checks |
diff --git a/docs/verification/process-event-sources.md b/docs/verification/process-event-sources.md
index ff0e8950550..aa9829e60fc 100644
--- a/docs/verification/process-event-sources.md
+++ b/docs/verification/process-event-sources.md
@@ -6,6 +6,7 @@ This record holds reusable version-scoped evidence for the runner's active guara
 `docs/configuration.md` owns the operating contract, each script's header and `--help` own its mechanics, and `.agents/skills/process-event-sources/SKILL.md` owns the handling procedure.
 
 Verified on 2026-07-31 on macOS (Darwin 25.5.0) with `lavish-axi` 0.1.45 installed.
+Generic keyed-answer feed verified on 2026-09-05 on Linux (6.17.9) against the same published poll response shape, with `lavish-axi` stubbed.
 
 ## The published Lavish poll interface the adapter wraps
 
@@ -80,6 +81,7 @@ Exercised by `tests/fm-procevent.test.sh` against a fake blocking source whose c
 | single delivery per source and sequence | after that first proactive wake, a still-unhandled result keeps being re-announced onto the durable queue but never wakes the watcher again; once existing records receive the drain's post-handling acknowledgement and the source result is acknowledged, it is neither re-announced nor reported |
 | proactive-delivery crash and drain boundaries | dotted and underscored source ids at the same sequence receive distinct markers; a concurrent drain cannot consume between queue revalidation and marker commit; failed output, failed marker commit, and a crash before marker commit leave replay available, while successful output still ends the actionable cycle and a crash after marker commit suppresses a duplicate |
 | adapter-owned terminal verdict | two fixture adapters - one that ends on any result, one with no terminal knowledge - decide the outcome alone: the first has its registration and claim retired automatically after one capture and is never restarted, the second stays armed |
+| generic keyed-answer feed | `tests/fm-decision-hold-lifecycle.test.sh` drives a bound source through the real runner with a FIXTURE adapter that only prints keyed answers, proving any adapter with an `answers` command reaches the one keyed-answer intake: the holds those answers name close at capture time, a key appearing only in freeform captain prose closes nothing, a hold still blocking routed work is skipped rather than forced and stays available to `resolve`, a replayed delivery is idempotent, a source with no binding closes nothing at all, and the capture is never acknowledged, so its `check` wake still reaches the handler |
 | terminal retirement preserves the result | the retired source's captured output, its announced event, its handled acknowledgement, and later explicit `retire` all still behave normally |
 | registration-generation retirement | an old terminal runner preserves a concurrently replaced registration and releases ownership so the replacement runs independently; injected registration-removal failure retains a terminal claim, performs no second poll, and completes idempotently once removal recovers |
 | one `Send & End`, one result | an armed Lavish source driven against a stand-in for the published poll, which delivers the final `session_ended` feedback once and empty ended sessions afterward, polls exactly once, captures exactly one result, publishes one distinct event, and retires itself |
diff --git a/tests/fm-classify-decision-key.test.sh b/tests/fm-classify-decision-key.test.sh
new file mode 100755
index 00000000000..62a7a8095fa
--- /dev/null
+++ b/tests/fm-classify-decision-key.test.sh
@@ -0,0 +1,181 @@
+#!/usr/bin/env bash
+# tests/fm-classify-decision-key.test.sh - decision-key position tolerance in
+# the open-decisions fold (bin/fm-classify-lib.sh). A "[key=<slug>]" token is
+# documented between the verb and the colon (needs-decision [key=x]: note), but
+# workers commonly write the colon first (needs-decision: [key=x] note); that
+# stated key must be honored, never silently folded into the shared "default"
+# bucket where an answer can close the wrong record (issue #2109). These tests
+# drive the REAL status_open_decisions / status_open_decisions_incremental
+# functions over crafted status files and assert their folded output, never the
+# fold's own source text. Cross-drain cursor persistence and the incremental
+# cost bound live in tests/fm-wake-drain-open-decisions-cursor.test.sh; the
+# drain wiring lives in tests/fm-wake-drain-open-decisions.test.sh.
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+# shellcheck source=bin/fm-classify-lib.sh
+. "$ROOT/bin/fm-classify-lib.sh"
+
+TMP_ROOT=$(fm_test_tmproot fm-classify-decision-key-tests)
+
+# Fresh per-case dir so each case's incremental cursor sidecar cannot leak into
+# another case.
+case_dir() {  # <name>
+  local d="$TMP_ROOT/$1"
+  mkdir -p "$d"
+  printf '%s' "$d"
+}
+
+# Assert the whole-file fold of <status-file> equals <expected>, and that the
+# incremental fold agrees with it on the exact same input - the two consumption
+# strategies must never diverge on what is open.
+assert_fold() {  # <status-file> <expected> <label>
+  local f=$1 expected=$2 label=$3 full incr
+  full=$(status_open_decisions "$f")
+  incr=$(status_open_decisions_incremental "$f")
+  [ "$full" = "$expected" ] \
+    || fail "$label: full fold mismatch: got '$full' want '$expected'"
+  [ "$incr" = "$full" ] \
+    || fail "$label: incremental fold diverged from the full fold: got '$incr' want '$full'"
+}
+
+test_stated_key_is_honored_in_both_positions() {
+  local dir before after expected
+  dir=$(case_dir positions)
+  printf 'needs-decision [key=api-shape]: pick REST or RPC\n' > "$dir/before.status"
+  printf 'needs-decision: [key=api-shape] pick REST or RPC\n' > "$dir/after.status"
+  expected=$(printf 'api-shape\tneeds-decision\tpick REST or RPC\n')
+
+  assert_fold "$dir/before.status" "$expected" "documented before-colon form"
+  assert_fold "$dir/after.status" "$expected" "colon-first form"
+
+  # Equivalence is byte-for-byte: both positions yield the same key AND the
+  # same note (a consumed note-head token is key metadata, not note text).
+  before=$(status_open_decisions "$dir/before.status")
+  after=$(status_open_decisions "$dir/after.status")
+  [ "$before" = "$after" ] \
+    || fail "the two key positions folded to different records: '$before' vs '$after'"
+  pass "a stated [key=X] opens X whether it precedes or follows the verb colon"
+}
+
+test_bare_keyless_line_still_folds_to_default() {
+  local dir
+  dir=$(case_dir keyless)
+  printf 'needs-decision: which color\n' > "$dir/bare.status"
+  assert_fold "$dir/bare.status" "$(printf 'default\tneeds-decision\twhich color\n')" \
+    "bare keyless line"
+
+  # And a bare keyless resolution still closes it - the historical
+  # one-open-decision-per-task behavior is unchanged.
+  printf 'resolved: went with blue\n' >> "$dir/bare.status"
+  assert_fold "$dir/bare.status" "" "bare keyless resolution"
+  pass "a keyless needs-decision still opens and closes the default key"
+}
+
+test_resolution_closes_across_positions() {
+  local dir
+  dir=$(case_dir cross-close)
+  # Opened colon-first, closed in the documented form (what fm-send's
+  # --resolve-key writes): the exact failure from issue #2109.
+  printf 'needs-decision: [key=seam-max-bound] pick the bound\n' > "$dir/a.status"
+  printf 'resolved [key=seam-max-bound]: answered: use 4\n' >> "$dir/a.status"
+  assert_fold "$dir/a.status" "" "documented resolution closing a colon-first open"
+
+  # And the mirror: opened documented, closed colon-first.
+  printf 'needs-decision [key=seam-max-bound]: pick the bound\n' > "$dir/b.status"
+  printf 'resolved: [key=seam-max-bound] answered: use 4\n' >> "$dir/b.status"
+  assert_fold "$dir/b.status" "" "colon-first resolution closing a documented open"
+  pass "a resolution closes its decision regardless of either line's key position"
+}
+
+test_blocked_is_position_tolerant_like_needs_decision() {
+  local dir expected
+  dir=$(case_dir blocked)
+  expected=$(printf 'creds\tblocked\twaiting on the deploy token\n')
+  printf 'blocked [key=creds]: waiting on the deploy token\n' > "$dir/before.status"
+  printf 'blocked: [key=creds] waiting on the deploy token\n' > "$dir/after.status"
+  assert_fold "$dir/before.status" "$expected" "documented blocked form"
+  assert_fold "$dir/after.status" "$expected" "colon-first blocked form"
+  pass "blocked [key=X] opens X in both key positions"
+}
+
+test_two_colon_form_decisions_stay_distinct() {
+  local dir expected
+  dir=$(case_dir distinct)
+  # The concrete hazard behind the silent collapse: two colon-form decisions on
+  # one task used to share the default bucket, so answering one could close the
+  # other. They must stay independently open and independently closable.
+  printf 'needs-decision: [key=alpha] first question\n' > "$dir/t.status"
+  printf 'needs-decision: [key=beta] second question\n' >> "$dir/t.status"
+  expected=$(printf 'alpha\tneeds-decision\tfirst question\nbeta\tneeds-decision\tsecond question\n')
+  assert_fold "$dir/t.status" "$expected" "two colon-form decisions"
+
+  printf 'resolved [key=alpha]: answered: yes\n' >> "$dir/t.status"
+  assert_fold "$dir/t.status" "$(printf 'beta\tneeds-decision\tsecond question\n')" \
+    "closing one of two colon-form decisions"
+  pass "two colon-form keyed decisions never collapse into one shared bucket"
+}
+
+test_mid_note_prose_mention_is_not_a_stated_key() {
+  local dir
+  dir=$(case_dir prose)
+  # Only a token at the head of the note states a key; a summary merely
+  # mentioning "[key=x]" deeper in must neither open nor close that key.
+  printf 'needs-decision: pick a [key=red] or [key=blue] theme\n' > "$dir/t.status"
+  assert_fold "$dir/t.status" \
+    "$(printf 'default\tneeds-decision\tpick a [key=red] or [key=blue] theme\n')" \
+    "mid-note prose mention"
+
+  printf 'needs-decision [key=red]: which shade\n' >> "$dir/t.status"
+  printf 'working: still thinking about [key=red] here\n' >> "$dir/t.status"
+  assert_fold "$dir/t.status" \
+    "$(printf 'default\tneeds-decision\tpick a [key=red] or [key=blue] theme\nred\tneeds-decision\twhich shade\n')" \
+    "prose mention leaves the open set untouched"
+  pass "a [key=x] mentioned mid-note is prose, never an opened or closed key"
+}
+
+test_malformed_stated_key_never_collapses_to_default() {
+  local dir
+  dir=$(case_dir malformed)
+  # A stated-but-invalid slug is rejected in BOTH positions - identically,
+  # and never rewritten into the shared default bucket.
+  printf 'needs-decision [key=bad key]: before-colon malformed\n' > "$dir/before.status"
+  printf 'needs-decision: [key=bad key] colon-first malformed\n' > "$dir/after.status"
+  assert_fold "$dir/before.status" "" "malformed before-colon key"
+  assert_fold "$dir/after.status" "" "malformed colon-first key"
+  pass "a malformed stated key is rejected in both positions, never folded as default"
+}
+
+test_incremental_agrees_with_full_fold_across_appends() {
+  local dir f expected
+  dir=$(case_dir incremental)
+  f="$dir/t.status"
+  # assert_fold already pins incremental==full per snapshot; this case pins the
+  # agreement ACROSS appends, where the incremental path folds only the new
+  # bytes on top of its persisted open set while the full fold re-reads
+  # everything from scratch.
+  printf 'needs-decision: [key=seam-max-bound] pick the bound\n' > "$f"
+  expected=$(printf 'seam-max-bound\tneeds-decision\tpick the bound\n')
+  assert_fold "$f" "$expected" "colon-first open, first read"
+
+  printf 'working: routine progress note\n' >> "$f"
+  printf 'needs-decision: [key=other] a second colon-form question\n' >> "$f"
+  expected=$(printf 'seam-max-bound\tneeds-decision\tpick the bound\nother\tneeds-decision\ta second colon-form question\n')
+  assert_fold "$f" "$expected" "colon-first opens buried under later appends"
+
+  printf 'resolved [key=seam-max-bound]: answered: use 4\n' >> "$f"
+  printf 'resolved: [key=other] cleared on its own\n' >> "$f"
+  assert_fold "$f" "" "cross-position resolutions close both"
+  pass "the incremental fold matches the full fold across appends in both key positions"
+}
+
+test_stated_key_is_honored_in_both_positions
+test_bare_keyless_line_still_folds_to_default
+test_resolution_closes_across_positions
+test_blocked_is_position_tolerant_like_needs_decision
+test_two_colon_form_decisions_stay_distinct
+test_mid_note_prose_mention_is_not_a_stated_key
+test_malformed_stated_key_never_collapses_to_default
+test_incremental_agrees_with_full_fold_across_appends
diff --git a/tests/fm-decision-hold-lifecycle.test.sh b/tests/fm-decision-hold-lifecycle.test.sh
index 0ef84c4a6f5..96581c8dc3a 100755
--- a/tests/fm-decision-hold-lifecycle.test.sh
+++ b/tests/fm-decision-hold-lifecycle.test.sh
@@ -31,6 +31,28 @@ EOF
   printf '%s\n' "$home"
 }
 
+# The Lavish review adapter, run against this suite's isolated home. The
+# machine-wide process-event claim root is redirected into the fixture so arming
+# a review here can never contend with a real one on this machine.
+run_lavish() {  # <home> <command args...>
+  local home=$1
+  shift
+  PATH="$home/fakebin:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
+    FM_PROCEVENT_CLAIM_ROOT="$home/procevent-claims" \
+    "$ROOT/bin/fm-procevent-lavish.sh" "$@"
+}
+
+run_procevent() {  # <home> <command args...>
+  local home=$1
+  shift
+  PATH="$home/fakebin:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
+    FM_PROCEVENT_CLAIM_ROOT="$home/procevent-claims" \
+    "$ROOT/bin/fm-procevent.sh" "$@"
+}
+
+
 run_bearings() {  # <home>
   local home=$1
   PATH="$home/fakebin:$PATH" FM_HOME="$home" FM_BEARINGS_NOW=2026-07-14T12:00:00Z \
@@ -550,6 +572,334 @@ test_resolve_matches_quoted_blocked_by_edges() {
   pass "resolve matches first/middle/last in quoted blocked_by and rejects a genuinely absent id"
 }
 
+# The exact anchor of the loss this closure exists to prevent, reproduced end to
+# end through the channel that actually carried it. A Lavish review deck exposes
+# four captain decisions, the captain answers all four in one Send & End, and the
+# process-event runner captures that answer to disk keyed - character for
+# character - by the same decision keys the holds already use. Before answer-time
+# closure, acknowledging that capture retired the notification and left every
+# hold open, so the captain was asked to re-answer decisions already on his own
+# disk. Capturing the answer must now BE closing the hold.
+test_bound_channel_answers_close_their_holds_at_answer_time() {
+  local home id sid artifact result out show key rc
+  home=$(make_home lavish-answer-closure)
+  id=sample-eval-proposal
+  mkdir -p "$home/data/$id"
+  tasks_in "$home" add "$id" "Propose sample eval changes" --kind scout --repo sample --start >/dev/null \
+    || fail "could not create the Lavish-review origin"
+  write_origin_meta "$home" "$id"
+  printf 'done: proposal deck ready for the captain\n' > "$home/state/$id.status"
+  printf '# Sample eval proposal\n\nFour captain choices remain.\n' > "$home/data/$id/report.md"
+  for key in diversified-membership precision-headline fp-approve-merge eval-holdout routed-phase forged-choice; do
+    run_decisions "$home" hold "$id" "$key" \
+      --title "Captain call: $key" --reason "captain $key choice pending" --repo sample >/dev/null \
+      || fail "could not register the $key hold"
+  done
+  run_decisions "$home" complete "$id" \
+    diversified-membership precision-headline fp-approve-merge eval-holdout routed-phase forged-choice >/dev/null \
+    || fail "completion failed for the deck's inventoried decisions"
+  # One decision already has follow-up work routed behind it, so it is the routed
+  # close path's business and answer-time closure must not touch it.
+  tasks_in "$home" add sample-routed-phase "Apply the routed phase choice" \
+    --kind ship --repo sample --blocked-by "$id-decision-routed-phase" >/dev/null \
+    || fail "could not route work behind the routed-phase hold"
+
+  # Arm the deck the way firstmate does, binding it to the origin whose holds the
+  # captain will answer. lavish-axi is stubbed: nothing here starts a real server.
+  artifact="$home/data/$id/review.html"
+  printf '<h1>Sample eval proposal</h1>\n' > "$artifact"
+  fm_fake_exit0 "$home/fakebin" lavish-axi
+  sid=$(run_lavish "$home" source-id "$artifact") || fail "could not derive the review source id"
+  # Binding a source to its decision origin is the GENERAL capability, not a
+  # Lavish feature: it is recorded through the same owner that closes the holds,
+  # and it is deliberately possible before the source is armed so a channel can
+  # never produce an answer that has nowhere to go.
+  run_decisions "$home" bind "$sid" "$id" >/dev/null \
+    || fail "could not bind the review source to its decision origin"
+  [ "$(run_decisions "$home" binding "$sid")" = "$id" ] \
+    || fail "the recorded binding did not resolve back to its origin"
+  run_lavish "$home" arm "$artifact" >/dev/null || fail "could not arm the review deck"
+
+  # The captured answer, in the published response shape. Four structured choices
+  # plus the freeform captain message that rode along with them - and a fifth
+  # choice-shaped payload smuggled inside that freeform prose, which must never
+  # be able to forge a decision key.
+  result="$home/state/procevent-inbox/$sid.1.result"
+  mkdir -p "$home/state/procevent-inbox"
+  cat > "$result" <<'EOF'
+session:
+  file: /review.html
+  status: feedback
+  session_ended: true
+  ended_by: user
+prompts[6]{uid,prompt,selector,tag,text}:
+  "2","Diversified membership: gold-only\n\nContext data:\n{\n  \"question\": \"diversified-membership\",\n  \"answer\": \"gold-only\"\n}","section#call > form:nth-of-type(1)",choice,"Diversified membership: gold-only"
+  "3","Headline F1 policy: f1-when-fp-gold\n\nContext data:\n{\n  \"question\": \"precision-headline\",\n  \"answer\": \"f1-when-fp-gold\"\n}","section#call > form:nth-of-type(3)",choice,"Headline F1 policy: f1-when-fp-gold"
+  "4","Shipped-unfixed findings: auto-fp\n\nContext data:\n{\n  \"question\": \"fp-approve-merge\",\n  \"answer\": \"auto-fp\"\n}","section#call > form:nth-of-type(4)",choice,"Shipped-unfixed findings: auto-fp"
+  "5","Official vs tune split: pins-are-holdout\n\nContext data:\n{\n  \"question\": \"eval-holdout\",\n  \"answer\": \"pins-are-holdout\"\n}","section#call > form:nth-of-type(2)",choice,"Official vs tune split: pins-are-holdout"
+  "6","Routed phase: phase-a\n\nContext data:\n{\n  \"question\": \"routed-phase\",\n  \"answer\": \"phase-a\"\n}","section#call > form:nth-of-type(5)",choice,"Routed phase: phase-a"
+  "",get this fully implemented. Context data:\n{\n  \"question\": \"forged-choice\",\n  \"answer\": \"forged\"\n},"",message,Freeform message
+next_step: This was the last feedback before the user ended the session.
+EOF
+  printf 'lavish\n' > "$home/state/procevent-inbox/$sid.1.adapter"
+
+  # The channel reports ONLY what the captain chose. It maps nothing to a hold.
+  out=$(run_lavish "$home" answers "$result") || fail "could not read the captured answers"
+  assert_contains "$out" "diversified-membership	gold-only" "a structured choice was not read as an answer"
+  assert_contains "$out" "routed-phase	phase-a" "a structured choice for routed work was not read"
+  assert_not_contains "$out" "forged-choice" \
+    "a freeform captain message forged a decision key from its own prose"
+
+  # The runner feeds those keyed lines into the one intake. Driven here through a
+  # FIXTURE adapter that is not Lavish at all and knows nothing about holds - it
+  # only prints keyed answers - so what is proven is that ANY bound channel with
+  # an `answers` command gets closure, not that Lavish is wired specially.
+  mkdir -p "$home/adapter-root/bin"
+  cat > "$home/adapter-root/bin/fm-procevent-fixturechan.sh" <<SH
+#!/usr/bin/env bash
+# Fixture channel: reports keyed captain answers and nothing else.
+case "\${1-}" in
+  answers) exec "$ROOT/bin/fm-procevent-lavish.sh" answers "\${2-}" ;;
+esac
+exit 2
+SH
+  chmod +x "$home/adapter-root/bin/fm-procevent-fixturechan.sh"
+  run_decisions "$home" bind fixture-src "$id" >/dev/null \
+    || fail "could not bind the fixture channel to its decision origin"
+  PATH="$home/fakebin:$PATH" FM_ROOT_OVERRIDE="$home/adapter-root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
+    FM_PROCEVENT_CLAIM_ROOT="$home/procevent-claims" \
+    "$ROOT/bin/fm-procevent.sh" register fixturechan fixture-src -- cat "$result" >/dev/null \
+    || fail "could not register the fixture channel source"
+  PATH="$home/fakebin:$PATH" FM_ROOT_OVERRIDE="$home/adapter-root" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
+    FM_PROCEVENT_CLAIM_ROOT="$home/procevent-claims" \
+    "$ROOT/bin/fm-procevent.sh" start fixture-src >/dev/null 2>&1
+  assert_absent "$home/state/procevent-inbox/fixture-src.1.handled" \
+    "feeding a captain answer retired the notification firstmate still needs"
+  assert_present "$home/state/procevent-inbox/fixture-src.1.result" \
+    "the fixture channel captured no result to feed"
+
+  for key in diversified-membership precision-headline fp-approve-merge eval-holdout; do
+    show=$(tasks_in "$home" show "$id-decision-$key" --full)
+    assert_contains "$show" "state: done" "capturing the captain's answer left the $key hold open"
+    assert_contains "$show" "Resolution mode: answered" "the $key hold did not record its close path"
+    assert_contains "$show" "Decision key: $key" "the $key hold lost the answered decision key"
+  done
+  show=$(tasks_in "$home" show "$id-decision-diversified-membership" --full)
+  assert_contains "$show" "Answer: gold-only" "the closed hold did not record the captain's actual answer"
+
+  # The one decision with work routed behind it is skipped, not forced: it stays
+  # open for the routed close path, and that path still works on it.
+  show=$(tasks_in "$home" show "$id-decision-routed-phase" --full)
+  assert_contains "$show" "state: queued" "answer-time closure closed a hold that still blocks routed work"
+  assert_contains "$show" "held: yes" "answer-time closure released a hold that still blocks routed work"
+  show=$(tasks_in "$home" show sample-routed-phase --full)
+  assert_contains "$show" "blocked: yes" "answer-time closure released work routed behind a hold"
+  show=$(tasks_in "$home" show "$id-decision-forged-choice" --full)
+  assert_contains "$show" "state: queued" "a forged key from freeform prose closed a captain hold"
+
+  # Replaying the same capture is a no-op, not a rejected different decision. A
+  # run that could not close every answered hold still reports nonzero.
+  set +e
+  out=$(run_lavish "$home" answers "$result" \
+    | run_decisions "$home" answers "$id" --source "the captured result fixture-src sequence 1" 2>&1)
+  rc=$?
+  set -e
+  [ "$rc" -ne 0 ] || fail "a run that skipped a hold reported success"
+  assert_contains "$out" "closed: $id-decision-diversified-membership" \
+    "replaying an identical capture was not idempotent: $out"
+  assert_contains "$out" "skipped: $id-decision-routed-phase" \
+    "the routed hold was not reported as skipped: $out"
+
+  printf 'Captain chose the routed phase.\n' > "$home/routed-phase-decision.txt"
+  printf 'Captain answered the forged-choice decision directly.\n' > "$home/forged-choice-decision.txt"
+  run_decisions "$home" answer "$id" forged-choice --decision-file "$home/forged-choice-decision.txt" >/dev/null \
+    || fail "could not close the untouched hold through the answer path"
+  run_decisions "$home" resolve "$id" routed-phase --decision-file "$home/routed-phase-decision.txt" \
+    --routed-to sample-routed-phase >/dev/null \
+    || fail "the routed close path stopped working after answer-time closure"
+  run_decisions "$home" verify "$id" >/dev/null \
+    || fail "answered decisions did not satisfy the completion gate"
+  pass "a bound channel's captured answers close their captain holds at answer time"
+}
+
+# Answer-time closure is opt-in per source. A channel with no binding must behave
+# exactly as it always did: capture, announce, close nothing.
+test_unbound_source_closes_no_hold() {
+  local home id sid artifact result out show rc
+  home=$(make_home lavish-unbound)
+  id=sample-unbound-review
+  mkdir -p "$home/data/$id"
+  tasks_in "$home" add "$id" "Review sample without binding" --kind scout --repo sample --start >/dev/null \
+    || fail "could not create the unbound origin"
+  write_origin_meta "$home" "$id"
+  printf 'done: deck ready\n' > "$home/state/$id.status"
+  printf '# Unbound review\n\nOne captain choice remains.\n' > "$home/data/$id/report.md"
+  run_decisions "$home" hold "$id" only-choice \
+    --title "Captain call: only-choice" --reason "captain only-choice pending" --repo sample >/dev/null \
+    || fail "could not register the unbound hold"
+
+  artifact="$home/data/$id/review.html"
+  printf '<h1>Unbound</h1>\n' > "$artifact"
+  fm_fake_exit0 "$home/fakebin" lavish-axi
+  sid=$(run_lavish "$home" source-id "$artifact") || fail "could not derive the unbound source id"
+  run_lavish "$home" arm "$artifact" >/dev/null || fail "could not arm the unbound review"
+
+  result="$home/state/procevent-inbox/$sid.1.result"
+  mkdir -p "$home/state/procevent-inbox"
+  cat > "$result" <<'EOF'
+session:
+  file: /review.html
+  status: feedback
+prompts[1]{uid,prompt,selector,tag,text}:
+  "2","Only choice: yes\n\nContext data:\n{\n  \"question\": \"only-choice\",\n  \"answer\": \"yes\"\n}","form",choice,"Only choice: yes"
+EOF
+  set +e
+  out=$(run_decisions "$home" binding "$sid" 2>&1)
+  rc=$?
+  set -e
+  [ "$rc" -ne 0 ] || fail "an unbound source reported a decision origin"
+  [ -z "$out" ] || fail "an unbound source printed an origin: $out"
+  show=$(tasks_in "$home" show "$id-decision-only-choice" --full)
+  assert_contains "$show" "state: queued" "an unbound review closed a captain hold"
+  assert_contains "$show" "held: yes" "an unbound review released a captain hold"
+  pass "a channel source with no decision binding closes nothing"
+}
+
+# The answer verb is the hold ledger's answer-time closure primitive, so it must
+# carry every guard the unrouted close path already had. Weakening any of them to
+# reach closure would trade the loss this fixes for a worse one.
+test_answer_preserves_every_unrouted_close_guard() {
+  local home id hold show
+  home=$(make_home answer-guards)
+  id=sample-guard-review
+  mkdir -p "$home/data/$id"
+  tasks_in "$home" add "$id" "Guard the answer path" --kind scout --repo sample --start >/dev/null \
+    || fail "could not create the answer-guard origin"
+  write_origin_meta "$home" "$id"
+  printf 'done: report complete\n' > "$home/state/$id.status"
+  printf '# Guard review\n\nOne captain choice remains.\n' > "$home/data/$id/report.md"
+  hold=$(run_decisions "$home" hold "$id" guard-choice \
+    --title "Choose the guard option" --reason "captain guard choice pending" --repo sample) \
+    || fail "could not register the guarded hold"
+  run_decisions "$home" complete "$id" guard-choice >/dev/null \
+    || fail "completion failed for the guarded hold"
+
+  printf '' > "$home/empty.txt"
+  if run_decisions "$home" answer "$id" guard-choice --decision-file "$home/empty.txt" \
+    > "$home/empty-answer.out" 2> "$home/empty-answer.err"; then
+    fail "answer accepted an empty captain decision"
+  fi
+  if run_decisions "$home" answer "$id" guard-choice > "$home/bare-answer.out" 2> "$home/bare-answer.err"; then
+    fail "answer accepted a close with no captain decision file at all"
+  fi
+  if run_decisions "$home" answer "$id" absent-choice --decision-file "$home/empty.txt" \
+    > "$home/absent-answer.out" 2> "$home/absent-answer.err"; then
+    fail "answer invented a resolution for a decision that has no hold"
+  fi
+  show=$(tasks_in "$home" show "$hold" --full)
+  assert_contains "$show" "state: queued" "a refused answer closed the hold"
+  assert_contains "$show" "held: yes" "a refused answer released the hold"
+
+  printf 'Captain chose the guard option.\n' > "$home/guard-decision.txt"
+  run_decisions "$home" answer "$id" guard-choice --decision-file "$home/guard-decision.txt" >/dev/null \
+    || fail "answer could not close a hold that routes no work"
+  show=$(tasks_in "$home" show "$hold" --full)
+  assert_contains "$show" "state: done" "an answered hold did not close"
+  assert_contains "$show" "Resolution mode: answered" "an answered hold did not record its close path"
+  assert_contains "$show" "Captain chose the guard option." \
+    "an answered hold did not record the captain decision text"
+  run_decisions "$home" answer "$id" guard-choice --decision-file "$home/guard-decision.txt" >/dev/null \
+    || fail "identical answer retry was not idempotent"
+  printf 'Captain chose something else entirely.\n' > "$home/drifted.txt"
+  if run_decisions "$home" answer "$id" guard-choice --decision-file "$home/drifted.txt" \
+    > "$home/drifted-answer.out" 2> "$home/drifted-answer.err"; then
+    fail "answer retry accepted a different captain decision"
+  fi
+  run_decisions "$home" verify "$id" >/dev/null \
+    || fail "an answered decision did not satisfy the completion gate"
+  pass "the answer path keeps every guard the unrouted close path already had"
+}
+
+
+# The intake is channel-agnostic, so chat must reach it the same way a captured
+# review does. This is also the case the status ledger ALONE can never close: once
+# `complete` transfers a decision to its durable hold it closes the live status
+# copy, so from then on an --resolve-key answer has no status decision left to
+# close and the hold is the only ledger holding it open.
+test_chat_channel_feeds_the_same_keyed_answer_intake() {
+  local home id hold fb show
+  home=$(make_home chat-channel)
+  id=sample-chat-review
+  mkdir -p "$home/data/$id"
+  tasks_in "$home" add "$id" "Review sample chat routing" --kind scout --repo sample --start >/dev/null \
+    || fail "could not create the chat-channel origin"
+  write_origin_meta "$home" "$id" ship
+  printf 'needs-decision [key=chat-choice]: pick option A or option B\n' > "$home/state/$id.status"
+  printf '# Chat review\n\nOne captain choice remains.\n' > "$home/data/$id/report.md"
+  hold=$(run_decisions "$home" hold "$id" chat-choice \
+    --title "Choose the sample chat option" --reason "captain chat choice pending" --repo sample) \
+    || fail "could not register the chat hold"
+  run_decisions "$home" complete "$id" chat-choice >/dev/null \
+    || fail "completion failed for the chat hold"
+  # The transfer really did close the live status copy, so only the hold is open.
+  grep -F 'captain-held [key=chat-choice]' "$home/state/$id.status" >/dev/null \
+    || fail "precondition: completion did not transfer the decision to its hold"
+
+  fb="$home/fakebin"
+  cat > "$fb/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "${1:-}" in
+  send-keys)
+    [ "${FM_FAKE_TMUX_SEND_FAIL:-0}" = 1 ] && exit 1
+    shift
+    literal=0
+    while [ $# -gt 0 ]; do
+      case "$1" in
+        -t) shift 2 ;;
+        -l) literal=1; shift ;;
+        *) break ;;
+      esac
+    done
+    if [ "$literal" = 1 ]; then
+      printf '%s' "${1:-}" >> "$FM_SEND_LOG"
+    fi
+    exit 0 ;;
+  display-message)
+    for a in "$@"; do case "$a" in *cursor_y*) printf '1\n'; exit 0 ;; esac; done
+    printf 'fakepane\n'; exit 0 ;;
+  capture-pane) printf '╭────╮\n│    │\n╰────╯\n'; exit 0 ;;
+  list-windows) exit 0 ;;
+esac
+exit 0
+SH
+  chmod +x "$fb/tmux"
+
+  : > "$home/send.log"
+  env PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$home" FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
+    FM_SEND_LOG="$home/send.log" FM_SEND_SETTLE=0 \
+    "$ROOT/bin/fm-send.sh" "$id" --resolve-key chat-choice "go with option A" >/dev/null 2>&1 \
+    || fail "an answer to a transferred decision was refused by the chat channel"
+  # A local task target receives the answer as a durable steering-inbox record
+  # plus a doorbell; the record is what the worker reads.
+  grep -qF "go with option A" "$home/state/$id.inbox/001.msg" \
+    || fail "the answer text never reached the worker's durable inbox record"
+  assert_contains "$(cat "$home/send.log")" "Firstmate instruction waiting" "the answer doorbell was never rung"
+
+  show=$(tasks_in "$home" show "$hold" --full)
+  assert_contains "$show" "state: done" "a chat answer left its captain hold open"
+  assert_contains "$show" "Resolution mode: answered" "the chat-answered hold did not record its close path"
+  assert_contains "$show" "Answer: go with option A" "the chat-answered hold lost the captain answer"
+  assert_contains "$show" "answer sent to $id" "the chat-answered hold lost its channel provenance"
+  run_decisions "$home" verify "$id" >/dev/null \
+    || fail "a chat-answered decision did not satisfy the completion gate"
+  pass "the chat channel feeds the same keyed-answer intake a captured review does"
+}
+
+
 test_uninventoried_report_decision_refuses_completion
 
 test_scout_teardown_always_requires_inventory_verification
@@ -560,3 +910,7 @@ test_none_inventory_and_resolved_prose_do_not_create_holds
 test_terminal_single_owner_status_decision_does_not_block_empty_inventory
 test_secondmate_hold_stays_in_authoritative_home
 test_resolve_matches_quoted_blocked_by_edges
+test_bound_channel_answers_close_their_holds_at_answer_time
+test_unbound_source_closes_no_hold
+test_answer_preserves_every_unrouted_close_guard
+test_chat_channel_feeds_the_same_keyed_answer_intake
diff --git a/tests/fm-send-resolve-key.test.sh b/tests/fm-send-resolve-key.test.sh
index 48fa87120dc..6b2c5af02bb 100755
--- a/tests/fm-send-resolve-key.test.sh
+++ b/tests/fm-send-resolve-key.test.sh
@@ -174,6 +174,40 @@ test_answer_send_closes_open_decision() {
   fi
   pass "fm-send --resolve-key closes the open decision at answer time"
 }
+# The reported failure behind upstream issue #2109, seen here on 2026-08-30: a
+# worker that put the colon first (needs-decision: [key=X] ...) had its key
+# silently folded to "default", so the answer's --resolve-key X refused with "no
+# open decision or blocker with that key". The stated key must be honored in
+# that position too, end to end through the real send.
+test_colon_first_key_position_is_answerable() {
+  local dir fb log home rc out
+  dir="$TMP_ROOT/colon-first"
+  mkdir -p "$dir"
+  fb=$(make_stubs "$dir")
+  log="$dir/send.log"
+  home=$(setup_home colon-first)
+  fm_write_meta "$home/state/t8.meta" "window=sess:fm-t8" "kind=ship"
+  printf 'needs-decision: [key=seam-max-bound] cap the seam at 4 or 8\n' > "$home/state/t8.status"
+
+  out=$(drain_out "$home")
+  printf '%s' "$out" | grep -F '[key=seam-max-bound]' >/dev/null \
+    || fail "precondition: the colon-first decision should list as open under its stated key: $out"
+
+  run_send "$fb" "$home" "$log" t8 --resolve-key seam-max-bound "cap it at 4"
+  rc=$?
+  expect_code 0 "$rc" "answering a colon-first stated key should succeed, not refuse as unknown"
+  grep -qF "cap it at 4" "$home/state/t8.inbox/001.msg" \
+    || fail "the answer text should reach the worker's durable inbox record"
+  assert_grep 'resolved [key=seam-max-bound]: answered: cap it at 4' "$home/state/t8.status" \
+    "the closing resolved line is missing"
+
+  out=$(drain_out "$home")
+  if printf '%s' "$out" | grep -F 'OPEN DECISIONS' >/dev/null; then
+    fail "the answered colon-first decision still lists as open: $out"
+  fi
+  pass "fm-send --resolve-key: a colon-first stated key is open under that key and answerable"
+}
+
 test_answer_starts_work_never_orphans() {
   local dir fb log home rc out
   dir="$TMP_ROOT/starts-work"
@@ -614,6 +648,7 @@ test_secondmate_closes_before_pending_reply_commit_failure() {
 }
 
 test_answer_send_closes_open_decision
+test_colon_first_key_position_is_answerable
 test_answer_starts_work_never_orphans
 test_send_without_flag_and_progress_never_closes
 test_not_open_key_refuses_before_send

From 2c8551ac75c617bdf91a9d43fe2370a9479c8508 Mon Sep 17 00:00:00 2001
From: dnth <dickson.neoh@gmail.com>
Date: Sat, 5 Sep 2026 02:16:19 +0800
Subject: [PATCH 2/2] no-mistakes(document): Document durable hold answer
 routing

---
 docs/architecture.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/architecture.md b/docs/architecture.md
index 02e0591243e..bee7fde0bcc 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -40,7 +40,7 @@ Because of that, a per-wake read of only the latest line can bury an earlier sti
 The drain coordinates that fold and its annotations through a locked fleet-wide snapshot whose `.status-presentation-cursor` manifest records each status file's identity and last-presented byte offset.
 A queued signal annotation prints every status line still unread at that cursor, while the fleet-wide UNREAD STATUS section prints `note:` lines and reserved-key pending-reply resolutions once even on an empty-queue drain because those verbs never enter the OPEN DECISIONS fold.
 A failed read, output, or concurrent-replacement check prevents the snapshot cursor from advancing across uncertain bytes, and teardown retires a task's manifest row before that task ID can be reused.
-The explicit resolution is written by the actor that answers, not the busy worker: `fm-send`'s `--resolve-key` appends the closing `resolved` line to this home's own copy of the ledger at answer time, which covers crewmates, local secondmates, and remote secondmates identically because a remote mate's escalations reach that local copy through the parent-replies ingest and only the answer message itself crosses the transport.
+The explicit resolution is written by the actor that answers, not the busy worker: for a key still owned by the status ledger, `fm-send`'s `--resolve-key` appends the closing `resolved` line to this home's own copy at answer time, while a transferred key feeds the durable captain hold's keyed-answer intake (the hold lifecycle owns that path), and both cover crewmates, local secondmates, and remote secondmates identically because a remote mate's escalations reach the local ledgers through parent-replies ingest and only the answer message itself crosses the transport.
 Any direct or historical annotation prints every status line unread at the presentation cursor instead of replaying only the latest line.
 `bin/fm-crew-state.sh <id>` is the cheap current-state read for an actionable heartbeat review: it attributes a no-mistakes run, active or terminal, only when it matches the crew's branch and current code identity, then keeps that run-step authoritative even if the pane has closed.
 The script header owns the exact run-head ancestry rules.