diff --git a/.agents/skills/harness-adapters/references/common/dispatch.md b/.agents/skills/harness-adapters/references/common/dispatch.md
index 96db331b557..4b60fae0648 100644
--- a/.agents/skills/harness-adapters/references/common/dispatch.md
+++ b/.agents/skills/harness-adapters/references/common/dispatch.md
@@ -27,6 +27,7 @@ Tool references record empirical knowledge for those executable owners.
 
 For an approved new adapter check, use the spawn owner's raw-launch escape hatch only for a trivial supervised task.
 Verify detection in `../../../bin/fm-harness.sh`, launch in `../../../bin/fm-spawn.sh`, busy state in `../../../bin/fm-busy-lib.sh`, shared composer behavior in `../../../bin/fm-composer-lib.sh`, lifecycle in `../../../bin/fm-control-lib.sh`, and tmux liveness in `../../../bin/backends/tmux.sh` when secondmate use is supported.
+Also observe, in a real child of a real session of that harness, whether it exports a launch marker naming its own session pid: `FM_SESSION_LAUNCH_MARKERS` in `../../../bin/fm-session-lock-lib.sh` has a verified row for Claude alone, and every other harness decides session-lock ownership by process ancestry until a row is verified for it, which `../../../docs/verification/runtime-backends.md#session-lock-identity-and-the-suspended-holder` owns.
 Also verify primary integration through `references/common/primary-hooks.md`, model discovery through `references/common/model-and-effort.md`, and one tool record.
 A value remains unreachable until its executable owner, portable regression, applicable credentialed live guard, and verification record land together.
 `../firstmate-coding-guidelines/SKILL.md` owns harness-dependent proof.
diff --git a/bin/fm-claude-stop-autoarm.sh b/bin/fm-claude-stop-autoarm.sh
index 5f8b2d14a75..f778e6be137 100755
--- a/bin/fm-claude-stop-autoarm.sh
+++ b/bin/fm-claude-stop-autoarm.sh
@@ -117,18 +117,19 @@ fm_hook_payload_is_foreign_host "$PAYLOAD" && exit 0
 fm_primary_scope_matches "$FM_ROOT" "$STATE" || exit 0
 
 # --- identity: only the lock-owning session's hooks may arm ------------------
-# A prior session may have died after leaving its numeric harness pid in .lock.
-# Use the shared liveness predicate to recognize only that stale-owner case.
+# A prior session may have left its numeric harness pid in .lock after dying or
+# being suspended. The shared holder predicate recognizes exactly those
+# recoverable cases and keeps a genuinely competing session inert.
 # Defer the mutating claim until after the unchanged AFK and need gates, so an
 # idle or away home remains byte-for-byte inert. Missing or malformed locks are
-# uncertainty rather than stale-owner evidence and remain inert.
+# uncertainty rather than recoverable-owner evidence and remain inert.
 RECOVER_SESSION_LOCK=0
 if ! fm_session_lock_owned_by_self "$STATE"; then
   LOCK_PID=$(cat "$STATE/.lock" 2>/dev/null || true)
   case "$LOCK_PID" in
     ''|*[!0-9]*) exit 0 ;;
   esac
-  fm_harness_pid_alive "$LOCK_PID" && exit 0
+  fm_session_lock_holder_competes "$LOCK_PID" && exit 0
   RECOVER_SESSION_LOCK=1
 fi
 
diff --git a/bin/fm-context.sh b/bin/fm-context.sh
new file mode 100755
index 00000000000..0b19251401c
--- /dev/null
+++ b/bin/fm-context.sh
@@ -0,0 +1,154 @@
+#!/usr/bin/env bash
+# fm-context.sh - how much context window this session and each crew has left.
+#
+# Why this exists: a session that runs out of context compacts, and a crew that
+# compacts mid-task can lose a decision it was told once and then repeat work or
+# quietly drop a constraint. The percentage a harness renders in its own status
+# line is visible only to whoever is looking at that pane, so it cannot be acted
+# on by supervision and it cannot be read for THIS session at all.
+#
+# The authoritative source is the session transcript, not rendered output. Claude
+# Code records exact token usage on every assistant record, so the current
+# context is the last such record's input_tokens + cache_creation_input_tokens +
+# cache_read_input_tokens. That is a structural fact rather than a vendor string,
+# so it does not break when a status line is restyled.
+#
+# Usage: fm-context.sh [--json] [--window <tokens>] [--threshold <percent>] [<task-id>...]
+#   No task ids reports this session plus every task with a state/<id>.meta.
+#   --window     context window to measure against (default 1000000).
+#   --threshold  exit 1 if any reported session has less than this percent of the
+#                window remaining, so a guard can gate on it. Default 0, never fails.
+#   --json       one JSON object per line instead of the table.
+#
+# Both numbers are always printed - used and remaining - because a bare
+# percentage is read as either one depending on who is reading it.
+#
+# LIMITATION, stated rather than hidden: the window is a parameter, not a
+# measurement. The transcript records what was consumed, never the model's
+# capacity, and it does not record the harness's auto-compact headroom. The
+# model name is printed so a wrong --window is visible instead of silent.
+set -euo pipefail
+
+FM_HOME="${FM_HOME:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)}"
+PROJECTS_ROOT="${CLAUDE_PROJECTS_ROOT:-$HOME/.claude/projects}"
+
+window=1000000
+threshold=0
+as_json=0
+declare -a wanted=()
+
+die() { printf 'fm-context.sh: %s\n' "$1" >&2; exit 2; }
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --json) as_json=1; shift ;;
+    --window) [ $# -ge 2 ] || die "--window needs a value"; window="$2"; shift 2 ;;
+    --threshold) [ $# -ge 2 ] || die "--threshold needs a value"; threshold="$2"; shift 2 ;;
+    -h|--help) sed -n '2,32p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; exit 0 ;;
+    -*) die "unknown option: $1" ;;
+    *) wanted+=("$1"); shift ;;
+  esac
+done
+
+command -v jq >/dev/null 2>&1 || die "jq is required"
+[ "$window" -gt 0 ] 2>/dev/null || die "--window must be a positive integer"
+
+# A transcript lives under a directory named after its working directory with
+# every '/' and '.' replaced by '-', so the mapping is derivable rather than
+# needing a lookup table.
+transcript_dir() {
+  printf '%s/%s' "$PROJECTS_ROOT" "$(printf '%s' "$1" | tr './' '--')"
+}
+
+# Streams the file and keeps the newest assistant usage, so a large transcript is
+# not slurped into memory. Prints "<tokens> <model>" or nothing.
+read_usage() {
+  local file="$1"
+  [ -r "$file" ] || return 0
+  jq -rn '
+    reduce inputs as $r ([0,"?"];
+      if $r.type == "assistant" and ($r.message.usage != null)
+      then [ (($r.message.usage.input_tokens // 0)
+              + ($r.message.usage.cache_creation_input_tokens // 0)
+              + ($r.message.usage.cache_read_input_tokens // 0)),
+             ($r.message.model // "?") ]
+      else . end)
+    | select(.[0] > 0) | "\(.[0]) \(.[1])"
+  ' "$file" 2>/dev/null || true
+}
+
+# The newest transcript in a directory, used when no session id is known.
+newest_transcript() {
+  local dir="$1"
+  [ -d "$dir" ] || return 0
+  find "$dir" -maxdepth 1 -name '*.jsonl' -printf '%T@ %p\n' 2>/dev/null |
+    sort -rn | head -1 | cut -d' ' -f2-
+}
+
+emit() {
+  local label="$1" tokens="$2" model="$3"
+  local used_pct left left_pct
+  used_pct=$(( tokens * 100 / window ))
+  left=$(( window - tokens ))
+  [ "$left" -lt 0 ] && left=0
+  left_pct=$(( left * 100 / window ))
+  if [ "$as_json" = 1 ]; then
+    jq -cn --arg label "$label" --arg model "$model" \
+      --argjson used "$tokens" --argjson left "$left" \
+      --argjson used_pct "$used_pct" --argjson left_pct "$left_pct" \
+      --argjson window "$window" \
+      '{label:$label, model:$model, window:$window, used:$used,
+        used_percent:$used_pct, remaining:$left, remaining_percent:$left_pct}'
+  else
+    printf '%-30s %9d used (%3d%%)  %9d left (%3d%%)  %s\n' \
+      "$label" "$tokens" "$used_pct" "$left" "$left_pct" "$model"
+  fi
+  if [ "$threshold" -gt 0 ] && [ "$left_pct" -lt "$threshold" ]; then
+    return 1
+  fi
+  return 0
+}
+
+breached=0
+
+report_one() {
+  local label="$1" file="$2"
+  local line
+  line=$(read_usage "$file")
+  [ -n "$line" ] || return 0
+  emit "$label" "${line%% *}" "${line##* }" || breached=1
+}
+
+if [ "$as_json" = 0 ]; then
+  printf '%-30s %-22s %-22s %s\n' "session" "context" "remaining" "model"
+fi
+
+# This session, when its id is known; otherwise the newest transcript for this home.
+if [ ${#wanted[@]} -eq 0 ]; then
+  self_dir=$(transcript_dir "$FM_HOME")
+  self_file=""
+  if [ -n "${CLAUDE_CODE_SESSION_ID:-}" ] && [ -r "$self_dir/$CLAUDE_CODE_SESSION_ID.jsonl" ]; then
+    self_file="$self_dir/$CLAUDE_CODE_SESSION_ID.jsonl"
+  else
+    self_file=$(newest_transcript "$self_dir")
+  fi
+  [ -n "$self_file" ] && report_one "this session" "$self_file"
+fi
+
+# Crew: each task's worktree is recorded in its metadata, and the worktree maps
+# to a transcript directory by the same rule.
+shopt -s nullglob
+for meta in "$FM_HOME"/state/*.meta; do
+  id=$(basename "$meta" .meta)
+  if [ ${#wanted[@]} -gt 0 ]; then
+    match=0
+    for w in "${wanted[@]}"; do [ "$w" = "$id" ] && match=1; done
+    [ "$match" = 1 ] || continue
+  fi
+  worktree=$(sed -n 's/^worktree=//p' "$meta" | head -1)
+  [ -n "$worktree" ] || continue
+  report_one "$id" "$(newest_transcript "$(transcript_dir "$worktree")")"
+done
+shopt -u nullglob
+
+exit "$breached"
diff --git a/bin/fm-lock.sh b/bin/fm-lock.sh
index 52d7c8aee4b..9249bd8385b 100755
--- a/bin/fm-lock.sh
+++ b/bin/fm-lock.sh
@@ -3,6 +3,15 @@
 # Writes the harness (agent) process PID found by walking the shell's ancestry,
 # which lives as long as the firstmate session - unlike the transient subshell
 # PID of any one tool call, which is dead moments after it is written.
+#
+# Acquisition yields ONLY to a genuinely competing session, decided by
+# fm_session_lock_holder_competes in bin/fm-session-lock-lib.sh: a recorded
+# holder that is this same session in another process tree, or a durably
+# suspended one, does not block. Every acquisition then converges the lock onto
+# the acquiring session's own pid, so repeated runs are idempotent, and any live
+# holder it converged onto, took over from, or could not identify is named on
+# stdout rather than being silent.
+#
 # Usage: fm-lock.sh           acquire; exit 1 unless ownership is verified
 #        fm-lock.sh status    print holder and liveness; always exits 0
 set -u
@@ -29,7 +38,13 @@ if [ "${1:-}" = "status" ]; then
     echo "lock: unreadable"
     exit 0
   }
-  if fm_harness_pid_alive "$old"; then echo "lock: held by live harness pid $old"; else echo "lock: stale (pid $old dead or not a harness)"; fi
+  if ! fm_harness_pid_alive "$old"; then
+    echo "lock: stale (pid $old dead or not a harness)"
+  elif fm_harness_pid_suspended "$old"; then
+    echo "lock: held by SUSPENDED harness pid $old (reclaimable: a stopped session is not holding this home)"
+  else
+    echo "lock: held by live harness pid $old"
+  fi
   exit 0
 fi
 
@@ -55,13 +70,17 @@ release_claim_lock() {
 trap release_claim_lock EXIT
 trap 'exit 1' HUP INT TERM
 
+# Why the yield reason is captured rather than printed here: the fast path
+# below is only a pre-check, and the authoritative decision is retaken under the
+# claim lock. Printing it once, at the end, keeps one acquisition to one line.
+YIELDED=
 if [ -f "$LOCK" ] && [ ! -L "$LOCK" ]; then
   old=$(cat "$LOCK" 2>/dev/null || true)
   if [ "$old" = "$me" ]; then
     echo "lock acquired: harness pid $me"
     exit 0
   fi
-  if fm_harness_pid_alive "$old"; then
+  if fm_session_lock_holder_competes "$old"; then
     echo "error: another live firstmate session holds the lock (pid $old); operate read-only until resolved" >&2
     exit 1
   fi
@@ -86,9 +105,22 @@ if [ -e "$LOCK" ] || [ -L "$LOCK" ]; then
     echo "error: session lock is unreadable; operate read-only until resolved" >&2
     exit 1
   }
-  if [ "$old" != "$me" ] && fm_harness_pid_alive "$old"; then
-    echo "error: another live firstmate session holds the lock (pid $old); operate read-only until resolved" >&2
-    exit 1
+  if [ "$old" != "$me" ]; then
+    if fm_session_lock_holder_competes "$old"; then
+      echo "error: another live firstmate session holds the lock (pid $old); operate read-only until resolved" >&2
+      exit 1
+    fi
+    # Reclaiming an owner that is gone has always been silent and stays that
+    # way. The three holders that are alive and still yield are the ones worth
+    # naming - this session's own holder in another tree, a durably suspended
+    # session, and a live process the identity rules cannot type as a harness -
+    # so name them rather than moving the lock out from under a visible process
+    # quietly. None of the three is exceptional; the last is the ordinary
+    # reading of a stale lock whose pid an unrelated process now occupies.
+    # The predicate supplies the whole clause and leaves it empty for the silent
+    # case, so this is one assignment rather than a second liveness question that
+    # could disagree with the classification that just ran.
+    YIELDED=$FM_SESSION_HOLDER_YIELD_REASON
   fi
 fi
 if ! { printf '%s\n' "$me" > "$LOCK"; } 2>/dev/null; then
@@ -104,4 +136,8 @@ if [ ! -f "$LOCK" ] || [ -L "$LOCK" ] || [ "$written" != "$me" ]; then
   exit 1
 fi
 release_claim_lock
-echo "lock acquired: harness pid $me"
+if [ -n "$YIELDED" ]; then
+  echo "lock acquired: harness pid $me ($YIELDED)"
+else
+  echo "lock acquired: harness pid $me"
+fi
diff --git a/bin/fm-session-lock-lib.sh b/bin/fm-session-lock-lib.sh
index c2a117b0b84..61b03e35634 100644
--- a/bin/fm-session-lock-lib.sh
+++ b/bin/fm-session-lock-lib.sh
@@ -2,11 +2,36 @@
 # Shared session-lock harness identity.
 #
 # ONE owner of the "which verified-harness process holds this home's session
-# lock, and does the current process descend from that same harness?" decision.
+# lock, and is the current process part of that same session?" decision.
 # bin/fm-lock.sh uses it to acquire and inspect state/.lock;
-# bin/fm-claude-stop-autoarm.sh uses it to prove a Stop hook fires inside the
-# lock-owning primary session before it may arm or rewake.
+# bin/fm-claude-stop-autoarm.sh and bin/fm-turnend-guard-cursor.sh use it to
+# prove a turn-end hook fires inside the lock-owning primary session before it
+# may arm or rewake.
 # This file is sourced by scripts and has no side effects on source.
+#
+# Two independent kinds of same-session evidence are accepted, because the
+# process tree alone is not the session:
+#
+#   Ancestry (below): the lock names a process in this one's contiguous
+#   verified-harness ancestry. This is the original evidence and still the
+#   primary one.
+#
+#   Session cohort (further below): the lock names a live harness process tied to
+#   this one by a launch relationship in EITHER direction - it started this
+#   session, or this session started it - and co-located with it. A harness can
+#   put a session's work in a process tree that never reaches the pid holding the
+#   lock - a background session rehosted under its own pty reparents to init -
+#   and ancestry then reports one genuine session as two competing ones.
+#
+# Neither kind vetoes the other: each is a positive proof on its own, and the
+# absence of cohort evidence leaves the ancestry verdict exactly as it was.
+# Within the cohort proof the signals are AND-ed, not OR-ed, because the one
+# property that must survive is that a genuinely separate concurrent session is
+# still refused.
+#
+# The cohort proof is per-harness and currently reaches only Claude; every other
+# adapter is decided by ancestry alone. FM_SESSION_LAUNCH_MARKERS below owns that
+# scope limit, why it is safe, and what extending it requires.
 
 # Cursor process identity is NOT expressible as a command-name pattern and is
 # deliberately not added to the tables below: Cursor's installed names are
@@ -47,6 +72,107 @@ fm_harness_path_name() {  # <path>
   return 1
 }
 
+# Print the exact harness name when path $1's BASENAME is exactly a verified
+# harness name, or return 1.
+#
+# The strictest of this file's rules, and the single owner of the exact-equality
+# test. Two callers reach it, and they hand it different things. The `MainThread`
+# branch below passes a SCRIPT PATH from argv, its only token of evidence, so it
+# takes the strictest reading of it; the sibling interpreter branch reads the same
+# token positions under the same stop-at-the-first-flag rule but by whole path
+# component, because the only shape it identifies at all is a node-hosted bin
+# entry that is NOT named after the harness. fm_harness_comm_name below passes a
+# REPORTED COMMAND NAME, and normalizes the reporter's own artifacts out of it
+# first; that normalization is stated there and deliberately does not reach the
+# script-path caller, which sees neither of those artifacts.
+#
+# Exact equality is deliberate, and under `MainThread` it is the ONLY evidence
+# there is: the command path is literally `MainThread` and argv[0] is the
+# interpreter, so neither the command-path nor the argv[0] rule above can see the
+# script at all. A harness whose script basename is not exactly the harness name
+# - a version-suffixed name, or a `.js` bin entry - is therefore deliberately not
+# identified in that branch. Teaching it such a shape is a verification task
+# against a real release, the same as extending FM_SESSION_LAUNCH_MARKERS, and
+# not a reason to loosen this rule.
+fm_harness_basename_name() {  # <path>
+  local path=$1 base name
+  [ -n "$path" ] || return 1
+  base=${path##*/}
+  for name in "${FM_HARNESS_NAMES[@]}"; do
+    if [ "$base" = "$name" ]; then
+      printf '%s' "$name"
+      return 0
+    fi
+  done
+  return 1
+}
+
+# Print the exact harness name that COMMAND NAME $1 reports, or return 1.
+#
+# The same exact-equality test as fm_harness_basename_name, applied to a command
+# name after two reporting artifacts are undone. Both are properties of how the
+# name reaches us rather than of the program, so leaving them in place refuses a
+# harness its own home while it is the only session alive:
+#
+#   1. A command name is not always one word, and it is truncated to 15
+#      characters. Linux reports the kernel task name, which node and Bun
+#      harnesses rename to label a worker role, so Claude Code's background pty
+#      worker `claude bg-pty-host` arrives as `claude bg-pty-h` - one executable
+#      word, one role label, and a cut that lands mid-word. The executable is the
+#      FIRST word, so only that word is compared and the cut cannot reach it: no
+#      verified harness name is longer than 15 characters.
+#   2. Claude Code's installed executable is literally named `claude.exe` on
+#      every platform, because it is a single-file Bun build, so a process that
+#      execs it reports that name verbatim. `.exe` is the only executable suffix
+#      any verified harness carries.
+#
+# Neither step loosens the comparison itself, which is still exact equality
+# against FM_HARNESS_NAMES, and that is what keeps this from becoming a prefix
+# rule: `claude-code` has neither a space nor a suffix, so it is still not a
+# harness, and neither are `claudette` or `claude_code`. Path components are
+# untouched here, so `pi` keeps the basename anchoring that stops an interior
+# `/home/pi` component from naming a harness.
+fm_harness_comm_name() {  # <comm>
+  local base=${1##*/}
+  base=${base%% *}
+  base=${base%.exe}
+  fm_harness_basename_name "$base"
+}
+
+# Print the exact harness name carried by an ARGV token $1, or return 1.
+#
+# A whole path component, as fm_harness_path_name reads it, except that `pi` and
+# `pi-signed` must be the token's own basename. FM_HARNESS_RE anchors those two
+# names as `^pi$` and `^pi-signed$` because they are too short and too ordinary
+# to survive an unanchored reading, and a two-character interior component is
+# exactly where that bites: `/home/pi` is the default home directory on Raspberry
+# Pi OS, so `node /home/pi/app.js` would otherwise be a verified Pi harness, and
+# as a recycled recorded holder it would refuse a real session its own home.
+# The command path and argv[0] rule above reads those names as components too and
+# is deliberately left alone here; this anchoring covers only the argv tokens,
+# which the rule this replaced could never match for these two names at all.
+fm_harness_argv_path_name() {  # <path>
+  local path=$1 base name
+  [ -n "$path" ] || return 1
+  base=${path##*/}
+  for name in "${FM_HARNESS_NAMES[@]}"; do
+    case "$name" in
+      pi|pi-signed)
+        if [ "$base" = "$name" ]; then
+          printf '%s' "$name"
+          return 0
+        fi
+        ;;
+      *)
+        case "/$path/" in
+          */"$name"/*) printf '%s' "$name"; return 0 ;;
+        esac
+        ;;
+    esac
+  done
+  return 1
+}
+
 # True when the process described by command name $1 and full argument string $2
 # is a verified harness. Sets FM_HARNESS_IS_CLAUDE for the ancestry walk.
 #
@@ -57,11 +183,27 @@ fm_harness_path_name() {  # <path>
 #      argv[0] in `ps -o comm=`, while procps on Linux reports the kernel exec
 #      name and ignores argv[0] entirely, so a version-named Claude Code binary
 #      is identified by its install path on macOS and by argv[0] on Linux.
-#   3. a bare interpreter (node, python) running a harness script path.
-#   4. Cursor's own structural identity, owned by bin/fm-cursor-lib.sh.
+#   3. a bare interpreter (node, python) running a harness script path, taken
+#      from the argv tokens before the first flag by whole path component.
+#   4. node's own `MainThread` exec name, resolved from the one argv token after
+#      the interpreter by exact basename only, and refused outright when that
+#      token is a flag.
+#   5. Cursor's own structural identity, owned by bin/fm-cursor-lib.sh.
+#
+# Rules 3 and 4 read an ARGUMENT LIST, which is data the process was handed rather
+# than the program it is running, so they identify a recorded pid for the ancestry
+# walk and the liveness predicate and they carry no weight in the cohort's
+# acceptance decision. fm_harness_exec_kind below is that stricter reading, and
+# the difference between the two is stated there.
+#
+# This answers WHETHER, not WHICH. FM_HARNESS_IS_CLAUDE is the one thing it also
+# reports, because the ancestry walk needs it to know when to keep climbing a
+# nested worker chain; it is a global every call clobbers. Which harness a
+# particular pid IS belongs to fm_harness_exec_kind below, which reads only
+# executable identity and is the only naming the cohort proof may act on.
 FM_HARNESS_IS_CLAUDE=0
 fm_harness_process_matches() {  # <comm> <args>
-  local comm=$1 args=$2 base argv0 name
+  local comm=$1 args=$2 base argv0 name script rest
   FM_HARNESS_IS_CLAUDE=0
   base=$(basename -- "$comm")
   if printf '%s' "$base" | grep -qE "$FM_HARNESS_RE"; then
@@ -73,23 +215,175 @@ fm_harness_process_matches() {  # <comm> <args>
     case "$name" in claude) FM_HARNESS_IS_CLAUDE=1 ;; esac
     return 0
   fi
-  # Bare interpreter (e.g. node): match the harness name in its script path.
+  # Bare interpreter (e.g. node, python) that reports its OWN name as the exec
+  # name: identity comes from the interpreter's script path in argv, read under
+  # the same discipline the MainThread branch below uses. The tokens after the
+  # interpreter are read in order and the scan STOPS at the first one beginning
+  # with `-`, because from there on a path-shaped token may be an interpreter flag
+  # or the VALUE of one, and a flag's value can be named anything at all. A token
+  # before that boundary carries a verdict only when a whole path component of it
+  # is exactly a harness name.
+  #
+  # Reading the whole argument string is what this rule used to do, and it
+  # identified shapes that are not harnesses at all, because that test was an
+  # unanchored regex with no path-component requirement in it: an unrelated
+  # service carrying any ordinary `~/.claude/...` hook, settings, log or
+  # transcript argument reported itself as Claude, as did
+  # `node --require /opt/hooks/claude/instrument.js /srv/app/server.js` and
+  # `python3 /srv/app.py --config /etc/claude/x.toml`. None of the three is
+  # identified now.
+  #
+  # Stopping at the first flag gives up the inferred
+  # `node --experimental-foo /path/to/claude/cli.js` shape on purpose, which is
+  # the same trade the MainThread branch takes: the alternative is an allowlist of
+  # value-taking interpreter flags that would rot silently every time a vendor
+  # adds one, and silently stale recorded state is the failure this whole
+  # mechanism exists to remove. Both outputs are derived from the token that
+  # matched and never from the whole argv, so a harness name sitting elsewhere in
+  # the arguments can neither name the kind nor raise the Claude flag.
+  #
+  # Two limits of this rule are known and stated rather than left implied. It
+  # reads EVERY token before that flag rather than the script token alone, so a
+  # positional path argument can decide the verdict and this rule and the
+  # MainThread branch disagree on identical argv: `node /srv/app/server.js
+  # /opt/claude/agent.json` is Claude here and is nothing there. And the component
+  # it needs is an exact one, so a real npm layout whose package directory is
+  # `claude-code` or `opencode-ai` rather than the bare harness name is not
+  # identified at all. Both bound identification for the ancestry walk and the
+  # liveness predicate only; neither can reach the cohort's acceptance decision,
+  # which fm_harness_exec_kind below settles from executable identity alone.
+  #
+  # The npm-layout limit runs in BOTH directions, and the second direction is
+  # stated here because this lands on a running fleet by in-place update. The
+  # liveness predicate also judges a RECORDED holder, so a session lock an older
+  # firstmate wrote for a still-live session of one of those unidentified shapes
+  # now reads as not-a-harness and is reclaimed while that session is still
+  # running. It is bounded to that adoption window rather than being a standing
+  # hole, because this rule refuses to record such a holder in the first place,
+  # and it is not closed.
+  #
+  # That shape is one INSTANCE of a wider condition rather than its cause. Any
+  # live process occupying the recorded pid that these rules cannot type reads
+  # the same way, and the ordinary trigger is an unrelated process that inherited
+  # a recycled pid from a lock nobody released. fm_harness_pid_state's header
+  # below is the single owner of that condition rather than this block restating
+  # it. The mitigation covers all of it: fm_session_lock_holder_competes
+  # classifies a live-but-unidentified holder apart from a gone one, so the
+  # reclaim announces itself rather than moving the lock out from under a visible
+  # process in silence.
   case "$comm" in
     *node*|*python*)
-      if printf '%s' "$args" | grep -qE "$FM_HARNESS_RE"; then
-        case "$args" in *claude*) FM_HARNESS_IS_CLAUDE=1 ;; esac
-        return 0
+      rest=${args#* }
+      if [ "$rest" != "$args" ]; then
+        while [ -n "$rest" ]; do
+          script=${rest%% *}
+          case "$rest" in
+            *' '*) rest=${rest#* } ;;
+            *) rest='' ;;
+          esac
+          [ -n "$script" ] || continue
+          case "$script" in
+            -*) break ;;
+          esac
+          if name=$(fm_harness_argv_path_name "$script"); then
+            case "$name" in claude) FM_HARNESS_IS_CLAUDE=1 ;; esac
+            return 0
+          fi
+        done
       fi
       ;;
   esac
+  # Node renames its own main thread, so an npm-installed harness can report
+  # `MainThread` as its exec name and carry no interpreter name for the case
+  # above to catch: codex-cli 0.139.0 under nvm on Linux reports comm
+  # `MainThread` with argv `node .../bin/codex`, and without this it is not a
+  # harness at all, which leaves a codex primary unable to acquire its own home.
+  #
+  # Identity then has to come from the interpreter's SCRIPT PATH, and the ONLY
+  # candidate is the single token immediately after the interpreter, matched by
+  # the strictest rule this file has, exact basename. `MainThread` is a name any
+  # node program can present, and the rest of an interpreter's argv is not the
+  # script: it also carries the values of the interpreter's own flags, and those
+  # values are paths that can be named anything, `/opt/vendor/claude` included.
+  #
+  # So the branch REFUSES to identify anything as soon as that first token is a
+  # flag, rather than trying to work out where the flags end. An interpreter that
+  # reports its own name is decided by the rule above, which stops at the first
+  # flag in the same way but reads every token up to it, by whole path component
+  # rather than by basename. Neither reading reaches the cohort's acceptance
+  # decision, which fm_harness_exec_kind settles from executable identity alone.
+  #
+  # The refusal gives up the inferred `node --enable-source-maps .../bin/codex`
+  # shape on purpose: the alternative is an allowlist of value-taking interpreter
+  # flags, which would rot silently every time a vendor adds one, and silently
+  # stale recorded state is the exact failure this whole mechanism exists to
+  # remove. Refusing to guess is the intended behaviour, and only the plain
+  # `node <script>` shape - the one actually observed from a real codex install -
+  # is identified here.
+  if [ "$base" = MainThread ]; then
+    script=${args#* }
+    if [ "$script" != "$args" ]; then
+      script=${script%% *}
+      case "$script" in
+        -*) : ;;
+        */*)
+          if name=$(fm_harness_basename_name "$script"); then
+            case "$name" in claude) FM_HARNESS_IS_CLAUDE=1 ;; esac
+            return 0
+          fi
+          ;;
+      esac
+    fi
+  fi
   # Cursor: its own owner decides, from Cursor's name or versioned install tree
   # in the command path or argv[0]. Without this a Cursor primary can never
   # locate its own harness in the ancestry, so every session start refuses the
   # fleet lock as read-only and the park can never arm.
-  fm_cursor_process_matches "$comm" "$args" "$argv0" && return 0
+  if fm_cursor_process_matches "$comm" "$args" "$argv0"; then
+    return 0
+  fi
   return 1
 }
 
+# Print the harness name that the EXECUTABLE IDENTITY of command name $1 with
+# argument string $2 names, or return 1.
+#
+# The strict reading, and the only one the cohort proof below is allowed to use:
+# the reported command name's own basename is exactly a verified harness name, or
+# a whole path component of that command name or of argv[0] is. An argument list
+# is never read here.
+#
+# The cohort needs identity, and an argument list does not carry identity. A
+# launch marker proves a LAUNCH relationship and nothing more, so a codex session
+# the captain started from inside a Claude session carries a truthful CLAUDE_PID
+# naming that Claude holder. The evidence for that pair and for the rehosted
+# Claude background session the marker path exists to accept is otherwise
+# identical - same marker, same value, same container, holder outside the asking
+# ancestry in both - and the process name is the only thing that differs. So the
+# name has to be the thing the acceptance turns on, and it has to come from what
+# the process IS rather than from a path it was handed on its command line.
+fm_harness_exec_kind() {  # <comm> <args>
+  local comm=$1 args=$2
+  fm_harness_comm_name "$comm" && return 0
+  fm_harness_path_name "$comm" && return 0
+  fm_harness_path_name "${args%% *}"
+}
+
+# Print the harness name live pid $1 is running as under that strict reading, or
+# return 1. Always call it through a command substitution.
+fm_harness_pid_kind() {  # <pid>
+  local pid=$1 comm args kind
+  case "$pid" in
+    ''|*[!0-9]*) return 1 ;;
+  esac
+  kill -0 "$pid" 2>/dev/null || return 1
+  comm=$(ps -o comm= -p "$pid" 2>/dev/null) || return 1
+  args=$(ps -o args= -p "$pid" 2>/dev/null)
+  kind=$(fm_harness_exec_kind "$comm" "$args") || return 1
+  [ -n "$kind" ] || return 1
+  printf '%s\n' "$kind"
+}
+
 # Walk the current process ancestry (up to 16 hops) and print this session's
 # contiguous verified-harness ancestry, innermost pid first.
 #
@@ -113,7 +407,7 @@ fm_harness_ancestry_pids() {
   for _ in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16; do
     comm=$(ps -o comm= -p "$pid" 2>/dev/null) || break
     args=$(ps -o args= -p "$pid" 2>/dev/null)
-    if fm_harness_process_matches "$comm" "$args"; then
+    if fm_harness_process_matches "$comm" "$args" >/dev/null; then
       printf '%s\n' "$pid"
       printed=1
       [ "$FM_HARNESS_IS_CLAUDE" -eq 1 ] || break
@@ -145,23 +439,601 @@ EOF
   printf '%s\n' "$outermost"
 }
 
-# True if $1 is a live process that looks like a verified harness.
-fm_harness_pid_alive() {
+# Classify recorded pid $1 and print exactly one of three words. This is the
+# single place the question is answered, so no caller can ask it a second time
+# and disagree with the classification that already ran about a holder that died
+# in between.
+#
+#   gone          not a live process, or it vanished before its command NAME
+#                 could be read
+#   unidentified  a live process whose command WAS read and which the identity
+#                 rules above then declined to type as a harness
+#   harness       a live process typed as a harness
+#
+# The middle word exists because those first two are not the same event for a
+# pid recorded in a session lock: reclaiming a holder that is simply gone has
+# always been silent, while reclaiming one that is still visibly running has to
+# be able to name itself.
+#
+# The `gone` verdict is NOT complete, and that is stated here rather than left
+# to read as closed. A process that disappears before its command NAME can be
+# read is caught and stays silent, but the argument list is read separately and
+# its status is discarded, so a holder that exits in the window between those
+# two reads is classified from the command name alone - and for the bare
+# interpreter shape this whole distinction exists for, that yields
+# `unidentified` and mislabels an otherwise-silent acquisition line. The window
+# is left open because both available tightenings are worse than a wrong clause:
+# reading a failed argument list as `gone` would SILENTLY reclaim a live harness
+# holder's home wherever `ps -o args=` fails while `ps -o comm=` succeeds, and
+# re-probing liveness after the read is the duplicate liveness question this
+# single classifier exists to prevent. The verdict, the reclaim, and which
+# session wins are identical either way.
+fm_harness_pid_state() {  # <pid>
   local pid=$1 comm args
-  kill -0 "$pid" 2>/dev/null || return 1
-  comm=$(ps -o comm= -p "$pid" 2>/dev/null) || return 1
+  kill -0 "$pid" 2>/dev/null || { printf 'gone\n'; return 0; }
+  comm=$(ps -o comm= -p "$pid" 2>/dev/null) || { printf 'gone\n'; return 0; }
+  [ -n "$comm" ] || { printf 'gone\n'; return 0; }
   args=$(ps -o args= -p "$pid" 2>/dev/null)
-  fm_harness_process_matches "$comm" "$args"
+  if fm_harness_process_matches "$comm" "$args" >/dev/null; then
+    printf 'harness\n'
+  else
+    printf 'unidentified\n'
+  fi
+}
+
+# True if $1 is a live process that looks like a verified harness.
+# Pure liveness: a STOPPED harness satisfies this, because it exists. Whether a
+# stopped holder still holds the lock is a separate question, decided by
+# fm_harness_pid_suspended and fm_session_lock_holder_competes below.
+fm_harness_pid_alive() {
+  [ "$(fm_harness_pid_state "$1")" = harness ]
+}
+
+# --- session cohort: same-session evidence the process tree cannot carry -----
+#
+# Runtime session containers, in the innermost-first order owned by
+# bin/fm-backend.sh's fm_backend_detect. Each row is
+# "<runtime> <guard-var> <pane-var>": the guard proves a process runs inside
+# that runtime, and the pane variable names ONE pane or surface within it.
+#
+# Only PANE-scoped identifiers appear here. A session-scoped or workspace-scoped
+# identifier would make two panes of one workspace look like one session, which
+# is the opposite of what this table is for. That is why zellij and orca have no
+# row: neither injects a verified pane-scoped identifier into the processes it
+# starts, so a home under them keeps the ancestry-only verdict. cmux's five keys
+# are injected and non-overridable, so its per-surface id is usable.
+#
+# Innermost-first matters as much as pane scope. tmux started inside a herdr
+# pane puts two independent sessions in one herdr pane, so once a process is
+# proven inside a runtime, only THAT runtime's pane id may be compared; falling
+# through to an outer container would merge those two sessions into one.
+FM_SESSION_CONTAINERS='tmux TMUX TMUX_PANE
+herdr HERDR_ENV HERDR_PANE_ID
+cmux CMUX_WORKSPACE_ID CMUX_SURFACE_ID'
+
+# Print the value environment variable $2 carried into pid $1, or return 1.
+#
+# A Linux-compatible /proc is the only source portable enough to trust: macOS
+# has no /proc, and `ps -E` is both privileged there and ambiguous to parse for
+# values containing spaces. A host without it simply produces no container
+# evidence, which leaves the ancestry and controlling-terminal evidence to
+# decide rather than widening anything.
+fm_session_pid_env() {  # <pid> <var>
+  local pid=$1 var=$2 proc_root=${FM_PROC_ROOT_OVERRIDE:-/proc} entry
+  case "$pid" in
+    ''|*[!0-9]*) return 1 ;;
+  esac
+  [ -r "$proc_root/$pid/environ" ] || return 1
+  while IFS= read -r -d '' entry || [ -n "$entry" ]; do
+    case "$entry" in
+      "$var="*) printf '%s\n' "${entry#*=}"; return 0 ;;
+    esac
+  done < "$proc_root/$pid/environ"
+  return 1
+}
+
+# Print "<runtime>=<pane-id>" for the innermost runtime container the process
+# runs inside, or return 1 when there is no usable container evidence.
+# fm_session_container_self reads this process's own live environment, which is
+# what any child of it inherits; fm_session_container_of_pid reads another
+# process's inherited environment.
+#
+# A runtime whose guard is present but whose pane id is missing returns 1 rather
+# than falling through to the next row, so a half-populated inner runtime can
+# never be answered with an outer container's id.
+fm_session_container_self() {
+  local runtime guard panevar guardval paneval
+  while read -r runtime guard panevar; do
+    [ -n "$runtime" ] || continue
+    guardval=${!guard:-}
+    [ -n "$guardval" ] || continue
+    paneval=${!panevar:-}
+    [ -n "$paneval" ] || return 1
+    printf '%s=%s\n' "$runtime" "$paneval"
+    return 0
+  done <<EOF
+$FM_SESSION_CONTAINERS
+EOF
+  return 1
+}
+
+fm_session_container_of_pid() {  # <pid>
+  local pid=$1 runtime guard panevar guardval paneval
+  while read -r runtime guard panevar; do
+    [ -n "$runtime" ] || continue
+    guardval=$(fm_session_pid_env "$pid" "$guard") || continue
+    [ -n "$guardval" ] || continue
+    paneval=$(fm_session_pid_env "$pid" "$panevar") || return 1
+    [ -n "$paneval" ] || return 1
+    printf '%s=%s\n' "$runtime" "$paneval"
+    return 0
+  done <<EOF
+$FM_SESSION_CONTAINERS
+EOF
+  return 1
+}
+
+# Print pid $1's controlling terminal, or return 1 when it has none.
+#
+# "No controlling terminal" is reported as "?" by procps and "??" or "-" by BSD
+# ps. Those mean the ABSENCE of a terminal, never a shared one, so two detached
+# sessions must never be matched through them.
+fm_session_tty_of_pid() {  # <pid>
+  local pid=$1 tty
+  case "$pid" in
+    ''|*[!0-9]*) return 1 ;;
+  esac
+  tty=$(ps -o tty= -p "$pid" 2>/dev/null | tr -d '[:space:]') || return 1
+  case "$tty" in
+    ''|'?'|'??'|'-') return 1 ;;
+  esac
+  printf '%s\n' "$tty"
+}
+
+# Environment variables a verified harness exports into EVERY process it starts,
+# naming its own session pid. This is the launch relationship the process tree
+# loses: it is written at exec time, so it survives the child being reparented,
+# rehosted under a fresh pty, or orphaned to init.
+#
+# Each row is "<harness> <var>": the harness that was VERIFIED to export it, and
+# the variable. The harness column is load-bearing, not documentation. A marker
+# variable is an ordinary environment variable, so every descendant of a session
+# inherits it, including a different harness the captain started from inside that
+# session. Scoping each row to its own harness is what stops that inherited value
+# being read as a launch relationship between two genuinely separate sessions.
+#
+# SCOPE LIMIT, stated because it is easy to assume away: this table has exactly
+# ONE row, so the cohort proof below can only ever fire when BOTH sides of the
+# pair are Claude. codex, opencode, pi, pi-signed, grok, kimi, and cursor have no
+# verified marker, so on those harnesses fm_session_lock_owned_by_self is decided
+# by ancestry alone and a session the harness rehosted outside its own process
+# tree still refuses its own home and degrades that session start to read-only.
+# That is the unfixed half of the defect for those adapters, not a fixed one.
+#
+# The same unfixed half reaches Claude itself whenever a Claude session's own
+# executable identity does not name it, because fm_harness_exec_kind is what
+# opens the marker path and it reads only the command name and argv[0]. Two
+# shapes lose the accept path and land on the ancestry-only verdict: a
+# node-hosted launch identified only by its script argument, `node
+# /path/to/claude/cli.js`, and an npm install reporting comm `MainThread` with
+# the harness named nowhere but in argv. That is the fail-closed direction rather
+# than a regression, because the alternative accepts a different harness that
+# merely inherited the marker, but it is a real limit and not a closed one.
+#
+# One recognition limit sits underneath all of that and is stated rather than
+# fixed here, and it is narrower than it first looks. The npm layout whose
+# package directory is `claude-code` was observed rather than imagined: the
+# install in use reports its own executable, `claude.exe` under
+# .../node_modules/@anthropic-ai/claude-code/bin/, and fm_harness_comm_name types
+# that by name, so for that shape the package directory never has to be read at
+# all. What stays unidentified is the node-hosted variant of the same layout,
+# where the command name is the interpreter or `MainThread` and `claude-code` is
+# the only place the harness is named: no rule here matches a path component that
+# is not exactly a harness name, so such a session resolves no harness ancestry,
+# fm_session_lock_owned_by_self returns false, and its session start degrades to
+# read-only against its own home - the exact false-refusal lockout this mechanism
+# exists to remove. Closing it means observing the command name and argv a real
+# node-hosted install reports rather than inventing them, which is the same
+# verification this file demands for a marker row. The opt-in guard in
+# docs/verification/runtime-backends.md records exactly that for every installed
+# harness, so a real one produces the evidence a later fix needs.
+#
+# Why leaving it that way is safe rather than merely incomplete: a row is
+# consulted only when the asking session and the holder are both the harness that
+# row was verified for, so a marker a different harness merely inherited is never
+# believed, and a harness with no row of its own is decided by ancestry alone. The
+# alternative is worse in both directions. A guessed variable name that no harness
+# sets is indistinguishable from no row, so it buys nothing while reading as
+# coverage; a guessed name a harness does set for some other purpose would be
+# believed, and a launch marker is one half of the proof that keeps a genuinely
+# separate concurrent session out of this home.
+#
+# Extending it is therefore a verification task, not an editing one: observe the
+# variable in a real child of a real session of that harness, add the row with
+# that harness in the first column, and refresh the per-harness record in
+# docs/verification/runtime-backends.md, whose opt-in guard reports the marker it
+# actually observed. Do not add a row from documentation or inference.
+FM_SESSION_LAUNCH_MARKERS='claude CLAUDE_PID'
+
+# True when the table has a row for harness $1. Asking this first keeps the
+# cohort proof from resolving any process kind it will not end up using.
+fm_session_launch_marker_exists() {  # <harness>
+  local want=$1 harness var
+  [ -n "$want" ] || return 1
+  while read -r harness var; do
+    [ -n "$var" ] || continue
+    [ "$harness" = "$want" ] && return 0
+  done <<EOF
+$FM_SESSION_LAUNCH_MARKERS
+EOF
+  return 1
 }
 
-# True when state dir $1 holds a session lock whose pid is ANY harness ancestor
-# of the current process: this script runs inside the session that owns the
-# home's fleet lock. Membership is the honest test of that question, because the
-# lock owner sits at an unknown depth in a contiguous Claude run - it is the
-# outermost pid when the hook fires inside the session's own nested worker chain,
-# and an inner pid when a harness-named daemon parents the session. A missing
-# lock, a malformed lock, a lock held by a harness outside this ancestry, or an
-# ancestry that cannot be resolved all fail closed.
+# Print the harness session pid recorded in pid $1's inherited environment by a
+# row belonging to harness $2, or return 1. A row for any other harness is not
+# consulted, however present its variable happens to be in that environment.
+fm_session_launcher_pid() {  # <pid> <harness>
+  local pid=$1 want=$2 harness var val
+  [ -n "$want" ] || return 1
+  while read -r harness var; do
+    [ -n "$var" ] || continue
+    [ "$harness" = "$want" ] || continue
+    val=$(fm_session_pid_env "$pid" "$var") || continue
+    case "$val" in
+      ''|*[!0-9]*) continue ;;
+    esac
+    printf '%s\n' "$val"
+    return 0
+  done <<EOF
+$FM_SESSION_LAUNCH_MARKERS
+EOF
+  return 1
+}
+
+# Print the start time of pid $1 in clock ticks since boot, or return 1.
+#
+# Field 22 of /proc/<pid>/stat. It is fixed for the whole life of a pid and is
+# reassigned when the pid is reused, which is what lets a marker's named pid be
+# ORDERED against the process whose environment carried that marker.
+#
+# The parse deliberately discards everything through the LAST ')' rather than
+# taking field 22 of the raw line. Field 2 is the command name in parentheses and
+# it CAN contain spaces, which shifts every later field: a real background worker
+# reports `<pid> (claude bg-pty-h) S ...`, where a whole-line field 22 reads 0.
+# Zero is the earliest start time expressible, so it would satisfy every forward
+# comparison below - a silent fail-open on exactly the process shape this file
+# exists to identify. Do not simplify this back to a whole-line field index.
+#
+# FM_PROC_ROOT_OVERRIDE is honoured exactly as fm_session_pid_env honours it, so
+# one fixture drives both reads.
+fm_session_pid_start_time() {  # <pid>
+  local pid=$1 proc_root=${FM_PROC_ROOT_OVERRIDE:-/proc} raw rest value
+  case "$pid" in
+    ''|*[!0-9]*) return 1 ;;
+  esac
+  raw=$(cat "$proc_root/$pid/stat" 2>/dev/null) || return 1
+  case "$raw" in
+    *')'*) rest=${raw##*)} ;;
+    *) return 1 ;;
+  esac
+  value=$(printf '%s\n' "$rest" | awk '{print $20}')
+  case "$value" in
+    ''|*[!0-9]*) return 1 ;;
+  esac
+  printf '%s\n' "$value"
+}
+
+# True when a marker naming pid $2 could actually have been carried by pid $1.
+#
+# ONE invariant, applied at every site a marker is accepted rather than as two
+# rules that can drift apart: A MARKER'S NAMED PID MUST NOT HAVE STARTED AFTER
+# THE PROCESS WHOSE ENVIRONMENT CARRIED IT. A launcher necessarily exists before
+# anything that inherited its environment, so this is a monotonic fact about the
+# pair rather than another name heuristic, and it is precisely what numeric
+# equality cannot tell: an environment snapshot naming pid 100 says nothing about
+# whether the process now holding pid 100 is the one it named.
+#
+# Callers supply the ACTUAL carrier, never $$ blindly, so the one invariant
+# produces both directions. Forward, where our own marker names the holder, the
+# carrier is this process or the ancestry member whose environ was read and the
+# holder must predate it. Reverse, where the holder's marker names us, the
+# carrier is the holder and the pid it names must predate the holder.
+#
+# The comparison is <=, not strict <. Clock ticks are coarse - commonly 10ms - so
+# a real launcher and the child it spawns can land on one tick value, and
+# refusing those would be a false refusal of a legitimate launch, which is the
+# failure class this whole mechanism exists to remove.
+#
+# Either start time being unreadable or unparseable REFUSES the relationship,
+# which degrades this path to the ancestry verdict rather than handing the home
+# to a session that merely inherited a recycled pid.
+fm_session_marker_ordered() {  # <carrier-pid> <named-pid>
+  local carrier named
+  carrier=$(fm_session_pid_start_time "$1") || return 1
+  named=$(fm_session_pid_start_time "$2") || return 1
+  [ "$named" -le "$carrier" ]
+}
+
+# True when live harness pid $1 is this process's OWN session reached through a
+# different process tree, recording the evidence in FM_SESSION_COHORT_EVIDENCE.
+#
+# TWO independent signals from different sources must BOTH hold, so that neither
+# is load-bearing on its own and the absence of either falls back to the
+# ancestry verdict rather than opening ownership up:
+#
+#   1. Relationship, satisfied by EITHER direction of one launch pair, and only
+#      between two sessions of the SAME harness: the marker row consulted is the
+#      one belonging to the holder's own harness, and it is consulted only when
+#      that harness also appears in this session's harness ancestry, because a
+#      marker variable is inherited by every descendant including a different
+#      harness the captain started from inside that session. Forward: some
+#      process in this session - this one, or a member of its harness ancestry -
+#      carries that marker naming the holder as the harness session that started
+#      it. Reverse: the holder's own exec-time marker names this process or a
+#      member of this session's harness ancestry. Both
+#      directions are required because acquisition converges the lock onto the
+#      acquiring session's own pid, so either member of a launcher/launched pair
+#      can end up recorded as the holder while the other one asks; testing only
+#      the forward direction would move the read-only degradation onto the
+#      launching session instead of removing it. Either way this is what makes
+#      the holder OUR session rather than merely a neighbour, and it is the
+#      signal the process tree destroys when a harness rehosts a session under
+#      its own pty and the tree reparents to init. Either direction must also be
+#      ORDERED, per fm_session_marker_ordered above: the pid a marker names must
+#      not have started after the process that carried that marker, which is what
+#      stops a recycled pid from satisfying a stale marker.
+#   2. Co-location. Both processes are in the same innermost runtime container,
+#      or on the same controlling terminal. Two providers, either sufficient,
+#      because a rehosted session keeps its pane and loses its terminal.
+#
+# Requiring the relationship is what preserves the property the lock exists for.
+# Co-location alone would accept a genuinely separate session that merely shares
+# a pane - a second agent started by hand in the captain's own terminal is
+# exactly that, and it must still be refused.
+#
+# The two signals are NOT fully independent under pid recycling, and that is
+# stated rather than implied away. A marker is an environment snapshot taken at
+# exec time and matched against the holder by numeric equality, so a marker
+# naming pid 100 keeps matching once pid 100 has been recycled onto an unrelated
+# session of the same harness: the relationship itself is stale-satisfied there,
+# and co-location alone would be what was left. What restores the relationship's
+# meaning is the start-time ordering every acceptance site below requires, since
+# a recycled occupant started after the process that carried the marker and so
+# cannot be the launcher that marker names.
+# $2 and $3 are internal fast paths for callers that have already done the same
+# work, and change no verdict: $2 is this session's harness ancestry when the
+# caller has already resolved it, and $3 is 1 only when the caller has already
+# proven the holder is a live harness. Every other caller passes one argument and
+# gets both checks here, so the liveness precondition still runs before any
+# recorded identity of the holder is consulted in either direction.
+FM_SESSION_COHORT_EVIDENCE=
+fm_session_same_cohort() {  # <pid> [<ancestry-pids>] [<holder-alive-verified>]
+  local pid=$1 pids=${2-} verified=${3:-0} mine theirs member launcher kind
+  local related=0 relation='' located='' same_kind=0
+  FM_SESSION_COHORT_EVIDENCE=
+  case "$pid" in
+    ''|*[!0-9]*) return 1 ;;
+  esac
+  # A dead or recycled pid must never be matched, so the holder has to be a live
+  # harness before any of its recorded identity is consulted.
+  if [ "$verified" != 1 ]; then
+    fm_harness_pid_alive "$pid" || return 1
+  fi
+
+  # The harness kind of BOTH sides has to be settled before any marker is read,
+  # so this session's ancestry is resolved first even on the call path that did
+  # not pass it in. An asking side with no resolvable harness ancestry gets no
+  # marker path at all: ownership stays a claim only a harness session can make,
+  # never one an ordinary script sharing the captain's terminal can make.
+  if [ -z "$pids" ]; then
+    pids=$(fm_harness_ancestry_pids 2>/dev/null || true)
+  fi
+  [ -n "$pids" ] || return 1
+
+  # The holder's kind comes from the holder itself, captured at its own match.
+  # This session's kind comes from its harness ANCESTRY rather than from the pid
+  # whose environment is read, because that pid is an ordinary shell which merely
+  # inherited the marker. Requiring the row's harness on both sides is what stops
+  # a marker one harness exported from being believed by another that inherited
+  # it, which would let a second, genuinely separate session take this home.
+  kind=$(fm_harness_pid_kind "$pid" 2>/dev/null || true)
+  fm_session_launch_marker_exists "$kind" || return 1
+  while IFS= read -r member; do
+    [ -n "$member" ] || continue
+    if [ "$(fm_harness_pid_kind "$member" 2>/dev/null || true)" = "$kind" ]; then
+      same_kind=1
+      break
+    fi
+  done <<EOF
+$pids
+EOF
+  [ "$same_kind" -eq 1 ] || return 1
+
+  launcher=$(fm_session_launcher_pid "$$" "$kind" 2>/dev/null || true)
+  if [ "$launcher" = "$pid" ] && fm_session_marker_ordered "$$" "$pid"; then
+    related=1
+    relation="launched this session"
+  fi
+  if [ "$related" -eq 0 ]; then
+    while IFS= read -r member; do
+      [ -n "$member" ] || continue
+      launcher=$(fm_session_launcher_pid "$member" "$kind" 2>/dev/null || true)
+      if [ "$launcher" = "$pid" ] && fm_session_marker_ordered "$member" "$pid"; then
+        related=1
+        relation="launched this session"
+        break
+      fi
+    done <<EOF
+$pids
+EOF
+  fi
+  if [ "$related" -eq 0 ]; then
+    launcher=$(fm_session_launcher_pid "$pid" "$kind" 2>/dev/null || true)
+    if [ -n "$launcher" ] && fm_session_marker_ordered "$pid" "$launcher"; then
+      if [ "$launcher" = "$$" ]; then
+        related=1
+      else
+        while IFS= read -r member; do
+          [ -n "$member" ] || continue
+          if [ "$launcher" = "$member" ]; then
+            related=1
+            break
+          fi
+        done <<EOF
+$pids
+EOF
+      fi
+      if [ "$related" -eq 1 ]; then
+        relation="was launched by this session"
+      fi
+    fi
+  fi
+  [ "$related" -eq 1 ] || return 1
+
+  if theirs=$(fm_session_container_of_pid "$pid") \
+    && mine=$(fm_session_container_self) \
+    && [ "$mine" = "$theirs" ]; then
+    located="same container $mine"
+  elif theirs=$(fm_session_tty_of_pid "$pid") \
+    && mine=$(fm_session_tty_of_pid "$$") \
+    && [ "$mine" = "$theirs" ]; then
+    located="same terminal $mine"
+  else
+    return 1
+  fi
+
+  FM_SESSION_COHORT_EVIDENCE="$relation; $located"
+  return 0
+}
+
+# True when pid $1 is durably STOPPED (SIGSTOP, or a shell job suspended with
+# Ctrl-Z), confirmed over several samples so a momentary stop is not mistaken
+# for a suspended session.
+#
+# The decision this encodes: a stopped holder does not hold the lock. `kill -0`
+# succeeds on a stopped process, so treating stopped as holding turns one
+# suspended session into a permanent lockout of the whole home - a strictly
+# worse and less recoverable failure than the race the lock prevents, since a
+# stopped process mutates nothing while stopped and nothing guarantees it ever
+# resumes. The takeover stays bounded rather than silent: the suspended session
+# is no longer the recorded owner, so on resume its own turn-end hooks fail the
+# ownership test and go inert instead of competing, and bin/fm-lock.sh reports
+# the reclaim on the acquiring side.
+#
+# Only `T` counts. Linux also reports `t` for a tracing stop, which is routinely
+# transient inside a debugger or strace, and reclaiming a home from it would be
+# a reflex rather than a decision.
+#
+# The verdict fails CLOSED - NOT suspended - on every state it cannot confirm,
+# because reporting a live holder as suspended is what lets an acquisition take
+# over a genuinely separate concurrent session's home. So the sample count and
+# the gap between samples reject empty, non-numeric and zero values back to their
+# defaults instead of being trusted from the environment, an unreadable process
+# state is not a stop, and a sample sequence that cannot be completed is not a
+# confirmation.
+FM_SESSION_STOP_SAMPLES_DEFAULT=3
+FM_SESSION_STOP_SAMPLE_SLEEP_DEFAULT=0.2
+FM_SESSION_STOP_SAMPLES=${FM_SESSION_STOP_SAMPLES:-$FM_SESSION_STOP_SAMPLES_DEFAULT}
+FM_SESSION_STOP_SAMPLE_SLEEP=${FM_SESSION_STOP_SAMPLE_SLEEP:-$FM_SESSION_STOP_SAMPLE_SLEEP_DEFAULT}
+fm_harness_pid_suspended() {  # <pid>
+  local pid=$1 samples nap i=0 confirmed=0 state
+  case "$pid" in
+    ''|*[!0-9]*) return 1 ;;
+  esac
+  samples=${FM_SESSION_STOP_SAMPLES:-$FM_SESSION_STOP_SAMPLES_DEFAULT}
+  case "$samples" in
+    ''|*[!0-9]*|0) samples=$FM_SESSION_STOP_SAMPLES_DEFAULT ;;
+  esac
+  # The gap is a fractional number of seconds, so it also has to admit one
+  # decimal point while still rejecting any zero-valued gap, which would collapse
+  # the confirmation window a momentary stop is separated by.
+  nap=${FM_SESSION_STOP_SAMPLE_SLEEP:-$FM_SESSION_STOP_SAMPLE_SLEEP_DEFAULT}
+  case "$nap" in
+    ''|.|*[!0-9.]*|*.*.*) nap=$FM_SESSION_STOP_SAMPLE_SLEEP_DEFAULT ;;
+    *)
+      case "${nap//./}" in
+        *[!0]*) : ;;
+        *) nap=$FM_SESSION_STOP_SAMPLE_SLEEP_DEFAULT ;;
+      esac
+      ;;
+  esac
+  while [ "$i" -lt "$samples" ]; do
+    state=$(ps -o state= -p "$pid" 2>/dev/null | tr -d '[:space:]')
+    case "$state" in
+      T*) confirmed=$((confirmed + 1)) ;;
+      *) return 1 ;;
+    esac
+    i=$((i + 1))
+    if [ "$i" -lt "$samples" ]; then
+      sleep "$nap" || return 1
+    fi
+  done
+  [ "$confirmed" -gt 0 ] && [ "$confirmed" -eq "$samples" ]
+}
+
+# True when session-lock holder $1 is a COMPETING session the caller must yield
+# to. This is the question every caller of the old bare liveness check was
+# actually asking, and it is the single owner of the answer.
+#
+# Not competing: a pid that is gone, a live pid the identity rules decline to
+# type as a harness, a pid in this process's own session cohort, and a durably
+# suspended harness. Everything else is.
+#
+# FM_SESSION_HOLDER_YIELD_REASON is a whole clause rather than a noun phrase,
+# because those cases are not the same event and a caller that prefixed one
+# verb onto all of them would report the cohort case - one session converging its
+# own lock onto its own pid - as a home changing hands.
+#
+# Only the GONE case leaves it EMPTY, because reclaiming a holder that no longer
+# exists has always been silent and is the ordinary path every session start
+# takes. The other three reclaim a process that was still present when the
+# classification read it, so each says so. The verdict and the reason both come
+# from ONE classification of the recorded pid, so a caller cannot ask the
+# liveness question again and disagree with this one about a holder that died in
+# between. That classification's own gone-versus-unidentified limit is open
+# rather than closed, and fm_harness_pid_state's header above is the single
+# owner of the statement of it rather than this one repeating it.
+# shellcheck disable=SC2034 # Read by bin/fm-lock.sh to report why it did not yield.
+FM_SESSION_HOLDER_YIELD_REASON=
+fm_session_lock_holder_competes() {  # <pid>
+  local pid=$1 state
+  FM_SESSION_HOLDER_YIELD_REASON=
+  state=$(fm_harness_pid_state "$pid")
+  if [ "$state" = gone ]; then
+    return 1
+  fi
+  if [ "$state" != harness ]; then
+    # shellcheck disable=SC2034 # Read by bin/fm-lock.sh to report why it did not yield.
+    FM_SESSION_HOLDER_YIELD_REASON="reclaimed from pid $pid, which is alive but not recognised as a harness"
+    return 1
+  fi
+  if fm_session_same_cohort "$pid" '' 1; then
+    FM_SESSION_HOLDER_YIELD_REASON="converged onto this session's own holder pid $pid ($FM_SESSION_COHORT_EVIDENCE)"
+    return 1
+  fi
+  if fm_harness_pid_suspended "$pid"; then
+    # shellcheck disable=SC2034 # Read by bin/fm-lock.sh to report why it did not yield.
+    FM_SESSION_HOLDER_YIELD_REASON="took over from suspended harness pid $pid"
+    return 1
+  fi
+  return 0
+}
+
+# True when state dir $1 holds a session lock this process's own session owns.
+#
+# Ancestry membership is the primary proof, and is the honest test for it,
+# because the lock owner sits at an unknown depth in a contiguous Claude run -
+# it is the outermost pid when the hook fires inside the session's own nested
+# worker chain, and an inner pid when a harness-named daemon parents the session.
+# When the lock names a harness OUTSIDE that ancestry, the session-cohort proof
+# above decides, which is what keeps a session whose work the harness moved into
+# a separate process tree from reporting itself as a competitor.
+#
+# A missing lock, a malformed lock, an ancestry that cannot be resolved, and a
+# lock held by a harness that is neither an ancestor nor in this session's
+# cohort all still fail closed. Requiring a resolvable ancestry before the
+# cohort proof is deliberate: ownership stays a claim only a harness session can
+# make, never one an ordinary script sharing the captain's terminal can make.
 fm_session_lock_owned_by_self() {
   local state=$1 lock_pid pids pid
   lock_pid=$(cat "$state/.lock" 2>/dev/null || true)
@@ -174,5 +1046,5 @@ fm_session_lock_owned_by_self() {
   done <<EOF
 $pids
 EOF
-  return 1
+  fm_session_same_cohort "$lock_pid" "$pids"
 }
diff --git a/bin/fm-test-run.sh b/bin/fm-test-run.sh
index bfad5cbb5d2..44473db0ce3 100755
--- a/bin/fm-test-run.sh
+++ b/bin/fm-test-run.sh
@@ -328,6 +328,7 @@ family_for_basename() {
     fm-opencode-primary-live-e2e.test.sh|fm-pi-branch-live-e2e.test.sh|\
     fm-pi-branch-responsiveness-live-e2e.test.sh|\
     fm-pi-primary-live-e2e.test.sh|fm-omp-primary-live-e2e.test.sh|\
+    fm-session-lock-identity-live-e2e.test.sh|\
     fm-sessionstart-hook-live-e2e.test.sh|fm-sessionstart-instruction-refresh-live-e2e.test.sh|\
     fm-quota-array-dispatch-live-e2e.test.sh|fm-send-secondmate-marker-herdr-e2e.test.sh|\
     fm-send-inbox-doorbell-live-e2e.test.sh|\
@@ -687,6 +688,7 @@ tests/fm-send-resolve-key.test.sh 19619
 tests/fm-send-secondmate-marker-herdr-e2e.test.sh 51
 tests/fm-send-secondmate-marker.test.sh 6252
 tests/fm-session-lock-ancestry.test.sh 1414
+tests/fm-session-lock-identity-live-e2e.test.sh 19
 tests/fm-session-start.test.sh 156952
 tests/fm-sessionstart-hook-live-e2e.test.sh 20
 tests/fm-sessionstart-instruction-refresh-live-e2e.test.sh 22
@@ -1426,7 +1428,7 @@ families_for_changed_path() {
     docs/configuration.md|docs/supervision-protocols/*)
       printf '%s\n' pure-contract-unit
       ;;
-    tests/lib.sh|tests/*-helpers.sh|tests/fixtures.sh)
+    tests/lib.sh|tests/session-signals.sh|tests/*-helpers.sh|tests/fixtures.sh)
       families_for_test_reference "$(basename "$path")" \
         || printf '%s\n' "__unmapped__:$path"
       ;;
diff --git a/bin/fm-time.sh b/bin/fm-time.sh
new file mode 100755
index 00000000000..ad674cf2efc
--- /dev/null
+++ b/bin/fm-time.sh
@@ -0,0 +1,894 @@
+#!/usr/bin/env bash
+# fm-time.sh - propose, approve, and report the captain's own work hours.
+#
+# Firstmate orchestrates but never clocks the captain in: this script scans
+# this home's own durable records for evidence that work happened, PROPOSES
+# candidate work windows from that evidence, and records nothing until the
+# captain approves, corrects, or rejects each one. Live start/stop and
+# retroactive log entries are recorded immediately because starting, stopping,
+# or logging IS the captain's approval.
+#
+# Usage:
+#   fm-time.sh propose [--since "<YYYY-MM-DD HH:MM>"] [--replace]
+#   fm-time.sh list
+#   fm-time.sh approve <id> [--start "<YYYY-MM-DD HH:MM>"] [--end "<YYYY-MM-DD HH:MM>"]
+#                           [--project <name>] [--task <name>] [--desc <text>]
+#   fm-time.sh reject <id>...
+#   fm-time.sh split <id> --at "<YYYY-MM-DD HH:MM>"
+#   fm-time.sh start [--project <name>] [--task <name>] [--desc <text>]
+#   fm-time.sh stop [--desc <text>]
+#   fm-time.sh log --start "<YYYY-MM-DD HH:MM>" --end "<YYYY-MM-DD HH:MM>"
+#                   [--project <name>] [--task <name>] --desc <text>
+#   fm-time.sh report [--month YYYY-MM] [--project <name>]
+#
+# Evidence signals (propose). Investigated candidates and why each is used or
+# skipped:
+#   - state/<id>.status mtime         used: last-touch ping for that task, tagged
+#                                      with the tail status line as its evidence text.
+#   - state/<id>.meta mtime           used: a task's earliest activity often
+#                                      predates its first status line, but this
+#                                      file is also rewritten well after spawn
+#                                      (mode changes, control actions, a merged
+#                                      PR's pr= field), so its evidence text
+#                                      says only "task record touched", never
+#                                      "spawned" - that would overclaim what a
+#                                      bare mtime can prove.
+#   - data/<id>/report.md mtime       used: scout-report-finalized ping.
+#   - data/backlog.md, data/done-archive.md
+#                                     used: "(done YYYY-MM-DD)", "(reported
+#                                      YYYY-MM-DD)" (tasks-axi writes this for a
+#                                      task closed with --report), and "(merged
+#                                      YYYY-MM-DD)" (tasks-axi writes this for a
+#                                      task closed with --pr) entries all become
+#                                      day-only pings (noon local), the one
+#                                      signal that survives a torn-down task's
+#                                      state files.
+#   - state/.wake-queue                used opportunistically: it carries real epoch
+#                                      seconds, but the queue is drained on
+#                                      acknowledgement, so it holds only whatever is
+#                                      CURRENTLY undrained, never a durable history.
+#   - session lock (state/.lock)       NOT used: one file, one mtime, no history -
+#                                      it names only the current holder, so it cannot
+#                                      answer "when was work happening" after the fact.
+#   - project git commit history       NOT used in this version: firstmate's own
+#                                      projects/<name> clones sit on their default
+#                                      branch, so this would see only merged work, not
+#                                      the in-flight branches a captain most wants
+#                                      tracked. Left as a documented future signal.
+# Every window's evidence list survives into the proposal so `approve` is an
+# informed decision, not a rubber stamp of a guess.
+#
+# Window merging. Evidence pings for the same (project, task) within the
+# time-tracking-gap-minutes config setting (default 45 minutes) of each other
+# join one window; a bigger gap starts a new one. 45 minutes, not something
+# tighter, because this repo's own crewmates are instructed to append status
+# only on sparse phase changes rather than routine progress (AGENTS.md section
+# 8), so a continuously-worked task can easily go 30-60 minutes between
+# evidence pings without having stopped. A lone ping still costs the
+# time-tracking-pad-minutes config setting (default 15 minutes) of credited
+# time, because a single commit-sized signal is real work, not zero-duration
+# work.
+#
+# After hours. A window's classification is decided by its START time only:
+# any day listed in config/time-tracking-weekend-days (default "6,7", ISO
+# weekday numbers 1=Monday..7=Sunday, empty = no weekend rule at all so no work
+# week is hardcoded) is after hours regardless of clock time; otherwise a start
+# before config/time-tracking-workday-start (default 09:00) or at/after
+# config/time-tracking-workday-end (default 18:00) is after hours.
+#
+# Storage. All state lives under this home's gitignored data/time-tracking/,
+# never under state/ (supervision-owned) and never inside a project:
+#   data/time-tracking/cursor       epoch through which evidence has been fully
+#                                    resolved (approved, rejected, or split); the
+#                                    floor for the next propose scan.
+#   data/time-tracking/proposals.md the current pending batch, one "## <id>" block
+#                                    per candidate window; propose refuses to
+#                                    generate a new batch while one is pending
+#                                    unless --replace is given.
+#   data/time-tracking/entries.md   the durable approved ledger, one "## <id>"
+#                                    block per recorded window. Plain
+#                                    "key=value" lines and one line per evidence
+#                                    entry: diffable, and safe to hand-edit because
+#                                    duration and after-hours status are always
+#                                    recomputed from start/end at report time,
+#                                    never trusted from a stored field.
+#   data/time-tracking/active       present only between `start` and `stop`.
+#   data/time-tracking/.lock        transient mkdir-based mutex held only for
+#                                    the span of a single command's own
+#                                    read-modify-write; not part of the durable
+#                                    record, and never held across commands.
+#
+# Configuration (gitignored, one setting per file, absent = default):
+#   config/time-tracking-gap-minutes         session-merge gap, minutes (default 45)
+#   config/time-tracking-pad-minutes         credited minutes for a lone ping (default 15)
+#   config/time-tracking-workday-start       local HH:MM (default 09:00)
+#   config/time-tracking-workday-end         local HH:MM (default 18:00)
+#   config/time-tracking-weekend-days        comma list, ISO 1-7 (default 6,7)
+#
+# Environment:
+#   FM_HOME   operational home whose state/, data/, and config/ are used.
+#
+# Never touches state/.lock, state/.wake-queue, or any other supervision file
+# except to read it; never writes to projects/.
+set -euo pipefail
+
+SELF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+FM_ROOT="$(cd "$SELF_DIR/.." && pwd)"
+FM_HOME="${FM_HOME:-$FM_ROOT}"
+STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
+DATA="${FM_DATA_OVERRIDE:-$FM_HOME/data}"
+CONFIG="${FM_CONFIG_OVERRIDE:-$FM_HOME/config}"
+TT="$DATA/time-tracking"
+
+die() { printf 'fm-time: %s\n' "$*" >&2; exit 1; }
+
+# Count of "## pN" blocks in proposals.md. grep -c already prints 0 and no
+# other output on zero matches, so no `|| echo 0` fallback is needed - adding
+# one would double-print when grep's own "0" line is followed by the fallback.
+proposal_count() {
+  [ -r "$TT/proposals.md" ] || { printf 0; return; }
+  grep -c '^## p' "$TT/proposals.md" 2>/dev/null || true
+}
+
+usage() {
+  awk 'NR == 1 { next }
+       /^#/ { sub(/^# ?/, ""); print; next }
+       { exit }' "${BASH_SOURCE[0]}"
+}
+
+# ---------------------------------------------------------------- portable time
+
+fm_time_mtime() {  # <path> -> epoch seconds, or nothing on failure
+  if [ "$(uname)" = Darwin ]; then
+    /usr/bin/stat -f %m "$1" 2>/dev/null
+  else
+    stat -c %Y "$1" 2>/dev/null
+  fi
+}
+
+now_epoch() { printf '%s\n' "${FM_TIME_NOW_OVERRIDE:-$(date +%s)}"; }
+
+# epoch -> "YYYY-MM-DD HH:MM" local wall clock.
+epoch_to_local() {
+  date -r "$1" '+%Y-%m-%d %H:%M' 2>/dev/null || date -d "@$1" '+%Y-%m-%d %H:%M' 2>/dev/null
+}
+
+# "YYYY-MM-DD HH:MM" local -> epoch. Empty output on unparseable input.
+local_to_epoch() {
+  date -j -f '%Y-%m-%d %H:%M' "$1" '+%s' 2>/dev/null || date -d "$1" '+%s' 2>/dev/null
+}
+
+epoch_to_dow() {  # ISO weekday, 1=Monday .. 7=Sunday
+  date -r "$1" '+%u' 2>/dev/null || date -d "@$1" '+%u' 2>/dev/null
+}
+
+epoch_to_hm() {
+  date -r "$1" '+%H:%M' 2>/dev/null || date -d "@$1" '+%H:%M' 2>/dev/null
+}
+
+epoch_to_yyyymm() {
+  date -r "$1" '+%Y-%m' 2>/dev/null || date -d "@$1" '+%Y-%m' 2>/dev/null
+}
+
+fmt_minutes() {  # <minutes> -> "1h15m"
+  local m=$1 h
+  h=$((m / 60)); m=$((m % 60))
+  printf '%dh%02dm' "$h" "$m"
+}
+
+# ---------------------------------------------------------------- config
+
+read_config() {  # <file-name> <default>
+  local path="$CONFIG/$1" line
+  if [ -r "$path" ]; then
+    while IFS= read -r line || [ -n "$line" ]; do
+      line=${line%%#*}
+      line=${line#"${line%%[![:space:]]*}"}
+      line=${line%"${line##*[![:space:]]}"}
+      if [ -n "$line" ]; then
+        printf '%s' "$line"
+        return 0
+      fi
+    done < "$path"
+  fi
+  printf '%s' "$2"
+}
+
+GAP_MINUTES=$(read_config time-tracking-gap-minutes 45)
+PAD_MINUTES=$(read_config time-tracking-pad-minutes 15)
+WORKDAY_START=$(read_config time-tracking-workday-start 09:00)
+WORKDAY_END=$(read_config time-tracking-workday-end 18:00)
+WEEKEND_DAYS=$(read_config time-tracking-weekend-days 6,7)
+
+is_after_hours() {  # <epoch> -> yes|no
+  local epoch=$1 dow hm
+  dow=$(epoch_to_dow "$epoch") || { printf 'no'; return; }
+  case ",$WEEKEND_DAYS," in
+    *",$dow,"*) printf 'yes'; return ;;
+  esac
+  hm=$(epoch_to_hm "$epoch") || { printf 'no'; return; }
+  if [[ "$hm" < "$WORKDAY_START" || "$hm" > "$WORKDAY_END" || "$hm" == "$WORKDAY_END" ]]; then
+    printf 'yes'
+  else
+    printf 'no'
+  fi
+}
+
+# ---------------------------------------------------------------- own lock
+
+# A tiny mkdir-based mutex over this home's OWN time-tracking files - never
+# the supervision session lock (state/.lock), which this script only ever
+# reads. mkdir is atomic on every filesystem this script already assumes, so
+# this needs no flock dependency (flock is absent on macOS; see
+# fm-supervise-daemon.sh's own comment on the same tradeoff). The holder's own
+# pid is recorded inside the lock dir the instant it is created, and staleness
+# is decided by that pid's liveness (kill -0), not by how long the lock has
+# been held: `propose` can legitimately hold this lock across a slow evidence
+# scan, and a fixed wall-clock cutoff would let a second command steal the
+# lock out from under a still-running one, corrupting proposals.md or entries
+# in a lost-update race. LOCK_STALE_SECS is kept only as a narrow fallback for
+# the brief window after mkdir succeeds but before the pid file is written
+# (e.g. a crash in between): once a pid is on record, its liveness is
+# authoritative and the lock is held exactly as long as its owner is alive.
+TT_LOCK="$TT/.lock"
+LOCK_STALE_SECS="${FM_TIME_LOCK_STALE_OVERRIDE:-10}"
+
+tt_lock() {
+  mkdir -p "$TT"
+  local tries=0 age owner_pid
+  while ! mkdir "$TT_LOCK" 2>/dev/null; do
+    owner_pid=$(cat "$TT_LOCK/pid" 2>/dev/null) || owner_pid=""
+    if [ -n "$owner_pid" ]; then
+      if ! kill -0 "$owner_pid" 2>/dev/null; then
+        rm -rf "$TT_LOCK" 2>/dev/null || true
+        continue
+      fi
+    else
+      age=$(fm_time_mtime "$TT_LOCK" 2>/dev/null) || age=""
+      if [ -n "$age" ] && [ "$(( $(now_epoch) - age ))" -ge "$LOCK_STALE_SECS" ]; then
+        rm -rf "$TT_LOCK" 2>/dev/null || true
+        continue
+      fi
+    fi
+    tries=$((tries + 1))
+    [ "$tries" -lt 100 ] || die "another fm-time.sh command appears to be running against this home; try again"
+    sleep 0.1
+  done
+  printf '%s\n' "$$" > "$TT_LOCK/pid"
+  trap tt_release_if_owner EXIT
+}
+
+# Removes the lock only if its recorded pid is still this process's own pid.
+# Used both as the ordinary unlock path and as the EXIT trap handler so a
+# signal arriving between tt_unlock's own removal and its `trap -` clear can
+# never blow away a lock a *different* command has since acquired: by the
+# time the trap fires, the pid file either matches this process (safe to
+# remove) or belongs to someone else / is already gone (leave it alone).
+tt_release_if_owner() {
+  local owner_pid
+  owner_pid=$(cat "$TT_LOCK/pid" 2>/dev/null) || owner_pid=""
+  [ "$owner_pid" = "$$" ] && rm -rf "$TT_LOCK" 2>/dev/null
+  return 0
+}
+
+tt_unlock() {
+  tt_release_if_owner
+  trap - EXIT
+}
+
+# ---------------------------------------------------------------- cursor
+
+CURSOR_FILE="$TT/cursor"
+
+read_cursor() {
+  local c
+  if [ -r "$CURSOR_FILE" ]; then
+    c=$(head -1 "$CURSOR_FILE" 2>/dev/null)
+    case "$c" in *[!0-9]*|'') ;; *) printf '%s' "$c"; return ;; esac
+  fi
+  # No cursor yet: default floor is 30 days back so a first run is bounded.
+  printf '%s' "$(( $(now_epoch) - 30 * 86400 ))"
+}
+
+write_cursor() {
+  mkdir -p "$TT"
+  printf '%s\n' "$1" > "$CURSOR_FILE.tmp"
+  mv "$CURSOR_FILE.tmp" "$CURSOR_FILE"
+}
+
+# ---------------------------------------------------------------- evidence gathering
+
+# Emits TSV lines: epoch<TAB>project<TAB>task<TAB>source<TAB>text
+gather_evidence() {  # <since-epoch> <out-file>
+  local since=$1 out=$2 f id mtime meta project text line kind key payload epoch
+
+  : > "$out"
+
+  for f in "$STATE"/*.status; do
+    [ -e "$f" ] || break
+    id=$(basename "$f" .status)
+    mtime=$(fm_time_mtime "$f") || continue
+    [ -n "$mtime" ] && [ "$mtime" -gt "$since" ] || continue
+    project=-
+    meta="$STATE/$id.meta"
+    if [ -r "$meta" ]; then
+      project=$(sed -n 's/^project=//p' "$meta" | head -1)
+      [ -n "$project" ] && project=$(basename "$project") || project=-
+    fi
+    text=$(tail -1 "$f" 2>/dev/null | tr -d '\t' | cut -c1-140)
+    printf '%s\t%s\t%s\tstatus\t%s\n' "$mtime" "$project" "$id" "$text" >> "$out"
+  done
+
+  for f in "$STATE"/*.meta; do
+    [ -e "$f" ] || break
+    id=$(basename "$f" .meta)
+    mtime=$(fm_time_mtime "$f") || continue
+    [ -n "$mtime" ] && [ "$mtime" -gt "$since" ] || continue
+    project=$(sed -n 's/^project=//p' "$f" | head -1)
+    [ -n "$project" ] && project=$(basename "$project") || project=-
+    printf '%s\t%s\t%s\tmeta\ttask record touched\n' "$mtime" "$project" "$id" >> "$out"
+  done
+
+  for f in "$DATA"/*/report.md; do
+    [ -e "$f" ] || break
+    id=$(basename "$(dirname "$f")")
+    mtime=$(fm_time_mtime "$f") || continue
+    [ -n "$mtime" ] && [ "$mtime" -gt "$since" ] || continue
+    project=-
+    meta="$STATE/$id.meta"
+    if [ -r "$meta" ]; then
+      project=$(sed -n 's/^project=//p' "$meta" | head -1)
+      [ -n "$project" ] && project=$(basename "$project") || project=-
+    fi
+    printf '%s\t%s\t%s\treport\tscout report finalized\n' "$mtime" "$project" "$id" >> "$out"
+  done
+
+  local bf
+  for bf in "$DATA/backlog.md" "$DATA/done-archive.md"; do
+    [ -r "$bf" ] || continue
+    while IFS= read -r line; do
+      case "$line" in
+        '- [x] '*) ;;
+        *) continue ;;
+      esac
+      id=${line#"- [x] "}
+      id=${id%% - *}
+      [ -n "$id" ] || continue
+      case "$line" in
+        *'(done '????-??-??')'*)
+          text=$(printf '%s' "$line" | sed -n 's/.*(done \([0-9-]\{10\}\)).*/\1/p')
+          ;;
+        *'(reported '????-??-??')'*)
+          # tasks-axi writes "(reported YYYY-MM-DD)" instead of "(done ...)"
+          # when a scout task is closed with --report; without this branch
+          # every scout completion (roughly a fifth of this repo's own
+          # archive) is silently invisible to propose.
+          text=$(printf '%s' "$line" | sed -n 's/.*(reported \([0-9-]\{10\}\)).*/\1/p')
+          ;;
+        *'(merged '????-??-??')'*)
+          # tasks-axi writes "(merged YYYY-MM-DD)" instead of "(done ...)"
+          # when a task is closed with --pr (verified against this repo's own
+          # tasks-axi binary: `done <id> --pr <url>` produces this marker);
+          # without this branch every PR-linked completion is silently
+          # invisible to propose.
+          text=$(printf '%s' "$line" | sed -n 's/.*(merged \([0-9-]\{10\}\)).*/\1/p')
+          ;;
+        *) continue ;;
+      esac
+      [ -n "$text" ] || continue
+      epoch=$(local_to_epoch "$text 12:00") || continue
+      [ -n "$epoch" ] && [ "$epoch" -gt "$since" ] || continue
+      project=$(printf '%s' "$line" | sed -n 's/.*(repo: \([^)]*\)).*/\1/p')
+      [ -n "$project" ] || project=-
+      payload=$(printf '%s' "$line" \
+        | sed 's/^- \[x\] [^ ]* - //' \
+        | sed -e 's/ (done [0-9-]*)//' -e 's/ (reported [0-9-]*)//' -e 's/ (merged [0-9-]*)//' -e 's/ (repo: [^)]*)//' \
+        | cut -c1-140)
+      printf '%s\t%s\t%s\tbacklog\t%s\n' "$epoch" "$project" "$id" "$payload" >> "$out"
+    done < "$bf"
+  done
+
+  if [ -r "$STATE/.wake-queue" ]; then
+    while IFS=$'\t' read -r epoch _seq kind key payload; do
+      case "$epoch" in ''|*[!0-9]*) continue ;; esac
+      [ "$epoch" -gt "$since" ] || continue
+      printf '%s\tfirstmate\t%s\twake\t%s: %s\n' "$epoch" "${key:--}" "$kind" "$payload" >> "$out"
+    done < "$STATE/.wake-queue"
+  fi
+}
+
+# ---------------------------------------------------------------- clustering
+
+# Reads evidence TSV on stdin (any order), writes proposal blocks to stdout in
+# the "## pN" key=value shape described in the header.
+cluster_evidence() {
+  sort -t $'\t' -k2,2 -k3,3 -k1,1n "$1" | awk -F'\t' -v gap=$((GAP_MINUTES * 60)) -v pad=$((PAD_MINUTES * 60)) '
+    function flush(n) {
+      if (n == 0) return
+      pid++
+      printf "## p%d\n", pid
+      printf "start=%s\n", start_disp
+      printf "end=%s\n", end_disp
+      printf "project=%s\n", cur_project
+      printf "task=%s\n", cur_task
+      printf "desc=%s\n", last_text
+      for (i = 1; i <= n; i++) printf "evidence=%s\n", ev[i]
+      printf "\n"
+    }
+    BEGIN { pid = 0; n = 0 }
+    {
+      epoch = $1; project = $2; task = $3; source = $4; text = $5
+      key = project SUBSEP task
+      if (n > 0 && (key != cur_key || (epoch - last_epoch) > gap)) {
+        flush(n)
+        n = 0
+      }
+      if (n == 0) {
+        cur_key = key; cur_project = project; cur_task = task
+        first_epoch = epoch
+        cmd = "date -r " epoch " \"+%Y-%m-%d %H:%M\" 2>/dev/null || date -d @" epoch " \"+%Y-%m-%d %H:%M\""
+        cmd | getline start_disp
+        close(cmd)
+      }
+      last_epoch = epoch
+      last_text = text
+      n++
+      ev[n] = epoch " | " source " | " text
+      end_epoch = epoch + pad
+      cmd = "date -r " end_epoch " \"+%Y-%m-%d %H:%M\" 2>/dev/null || date -d @" end_epoch " \"+%Y-%m-%d %H:%M\""
+      cmd | getline end_disp
+      close(cmd)
+    }
+    END { flush(n) }
+  '
+}
+
+# ---------------------------------------------------------------- propose / list
+
+cmd_propose() {
+  local replace=0 since_opt="" since_epoch out
+  while [ "$#" -gt 0 ]; do
+    case "$1" in
+      --replace) replace=1; shift ;;
+      --since) since_opt=$2; shift 2 ;;
+      *) die "propose: unknown argument: $1" ;;
+    esac
+  done
+
+  mkdir -p "$TT"
+  tt_lock
+  if [ "$(proposal_count)" -gt 0 ] && [ "$replace" -ne 1 ]; then
+    die "a pending proposal batch already exists; resolve it with approve/reject/split, or pass --replace to discard it and rescan"
+  fi
+
+  if [ -n "$since_opt" ]; then
+    since_epoch=$(local_to_epoch "$since_opt") || die "propose: unparseable --since value: $since_opt"
+  else
+    since_epoch=$(read_cursor)
+  fi
+
+  local now
+  now=$(now_epoch)
+  out=$(mktemp "$TT/.evidence.XXXXXX")
+  trap 'rm -f "$out"' RETURN
+  gather_evidence "$since_epoch" "$out"
+
+  {
+    printf '# time-tracking proposals\n'
+    printf '# scan_from=%s scan_to=%s generated=%s\n' "$since_epoch" "$now" "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+    printf '#\n'
+    cluster_evidence "$out"
+  } > "$TT/proposals.md.tmp"
+  mv "$TT/proposals.md.tmp" "$TT/proposals.md"
+  rm -f "$out"
+  trap - RETURN
+
+  local count
+  count=$(proposal_count)
+  if [ "$count" -eq 0 ]; then
+    # Nothing to resolve, so nothing blocks the cursor from moving forward;
+    # otherwise every future propose would keep rescanning this same dead range.
+    # Only do this when the scan used the persisted cursor: an explicit --since
+    # is a one-off query and must never silently move the standing cursor.
+    [ -n "$since_opt" ] || write_cursor "$now"
+    : > "$TT/proposals.md"
+    printf 'no work windows found in evidence since %s\n' "$(epoch_to_local "$since_epoch")"
+  else
+    printf '%s proposed window(s) since %s - review with: fm-time.sh list\n' "$count" "$(epoch_to_local "$since_epoch")"
+  fi
+  tt_unlock
+}
+
+cmd_list() {
+  if [ ! -s "$TT/proposals.md" ] || [ "$(proposal_count)" -eq 0 ]; then
+    printf 'no pending proposals. Run: fm-time.sh propose\n'
+    return 0
+  fi
+  awk '
+    /^## / { if (id != "") print ""; id = substr($0, 4); print "[" id "]"; next }
+    /^evidence=/ { print "  evidence: " substr($0, 10); next }
+    /^(start|end|project|task|desc)=/ { split($0, kv, "="); printf "  %-8s %s\n", kv[1], substr($0, length(kv[1]) + 2); next }
+  ' "$TT/proposals.md"
+}
+
+# Extracts the "## <id> ... (blank line or EOF)" block for <id> from <file>.
+extract_block() {  # <file> <id>
+  awk -v want="## $2" '
+    $0 == want { found = 1; next }
+    found && /^## / { exit }
+    found && NF == 0 { exit }
+    found { print }
+  ' "$1"
+}
+
+block_field() {  # <block-text> <field>
+  printf '%s\n' "$1" | sed -n "s/^$2=//p" | head -1
+}
+
+remove_block() {  # <file> <id> -> rewrites file without that block
+  awk -v want="## $2" '
+    BEGIN { skip = 0 }
+    $0 == want { skip = 1; next }
+    skip && /^## / { skip = 0 }
+    skip && NF == 0 { skip = 0; next }
+    !skip { print }
+  ' "$1"
+}
+
+# True (0) once no "## p" block remains in proposals.md.
+batch_empty() {
+  [ "$(proposal_count)" -eq 0 ]
+}
+
+advance_cursor_if_batch_done() {
+  if batch_empty; then
+    local scan_to
+    scan_to=$(sed -n 's/.*scan_to=\([0-9]*\).*/\1/p' "$TT/proposals.md" | head -1)
+    [ -n "$scan_to" ] && write_cursor "$scan_to"
+    : > "$TT/proposals.md"
+  fi
+}
+
+next_entry_id() {
+  printf 'e-%s-%s\n' "$(now_epoch)" "$$"
+}
+
+append_entry() {  # start end project task desc
+  mkdir -p "$TT"
+  {
+    printf '## %s\n' "$(next_entry_id)"
+    printf 'start=%s\n' "$1"
+    printf 'end=%s\n' "$2"
+    printf 'project=%s\n' "${3:--}"
+    printf 'task=%s\n' "${4:--}"
+    printf 'desc=%s\n' "$5"
+    printf '\n'
+  } >> "$TT/entries.md"
+}
+
+cmd_approve() {
+  local id=${1:-} start_ov="" end_ov="" project_ov="" task_ov="" desc_ov=""
+  [ -n "$id" ] || die "approve: usage: fm-time.sh approve <id> [--start ..] [--end ..] [--project ..] [--task ..] [--desc ..]"
+  shift
+  while [ "$#" -gt 0 ]; do
+    case "$1" in
+      --start) start_ov=$2; shift 2 ;;
+      --end) end_ov=$2; shift 2 ;;
+      --project) project_ov=$2; shift 2 ;;
+      --task) task_ov=$2; shift 2 ;;
+      --desc) desc_ov=$2; shift 2 ;;
+      *) die "approve: unknown argument: $1" ;;
+    esac
+  done
+
+  tt_lock
+  [ -s "$TT/proposals.md" ] || die "approve: no pending proposals"
+  local block
+  block=$(extract_block "$TT/proposals.md" "$id")
+  [ -n "$block" ] || die "approve: no pending proposal named $id"
+
+  local start end project task desc
+  start=${start_ov:-$(block_field "$block" start)}
+  end=${end_ov:-$(block_field "$block" end)}
+  project=${project_ov:-$(block_field "$block" project)}
+  task=${task_ov:-$(block_field "$block" task)}
+  desc=${desc_ov:-$(block_field "$block" desc)}
+
+  local s e
+  s=$(local_to_epoch "$start") || die "approve: unparseable start: $start"
+  e=$(local_to_epoch "$end") || die "approve: unparseable end: $end"
+  [ "$e" -gt "$s" ] || die "approve: end must be after start ($start -> $end)"
+
+  append_entry "$start" "$end" "$project" "$task" "$desc"
+  remove_block "$TT/proposals.md" "$id" > "$TT/proposals.md.tmp"
+  mv "$TT/proposals.md.tmp" "$TT/proposals.md"
+  advance_cursor_if_batch_done
+  tt_unlock
+  printf 'approved %s: %s (%s -> %s)\n' "$id" "$desc" "$start" "$end"
+}
+
+cmd_reject() {
+  [ "$#" -gt 0 ] || die "reject: usage: fm-time.sh reject <id>..."
+  tt_lock
+  [ -s "$TT/proposals.md" ] || die "reject: no pending proposals"
+  local id
+  for id in "$@"; do
+    local block
+    block=$(extract_block "$TT/proposals.md" "$id")
+    [ -n "$block" ] || { printf 'reject: no pending proposal named %s (skipped)\n' "$id"; continue; }
+    remove_block "$TT/proposals.md" "$id" > "$TT/proposals.md.tmp"
+    mv "$TT/proposals.md.tmp" "$TT/proposals.md"
+    printf 'rejected %s\n' "$id"
+  done
+  advance_cursor_if_batch_done
+  tt_unlock
+}
+
+cmd_split() {
+  local id=${1:-} at=""
+  [ -n "$id" ] || die "split: usage: fm-time.sh split <id> --at \"<YYYY-MM-DD HH:MM>\""
+  shift
+  while [ "$#" -gt 0 ]; do
+    case "$1" in
+      --at) at=$2; shift 2 ;;
+      *) die "split: unknown argument: $1" ;;
+    esac
+  done
+  [ -n "$at" ] || die "split: --at is required"
+
+  tt_lock
+  [ -s "$TT/proposals.md" ] || die "split: no pending proposals"
+  local block
+  block=$(extract_block "$TT/proposals.md" "$id")
+  [ -n "$block" ] || die "split: no pending proposal named $id"
+
+  local start end project task desc split_epoch start_epoch end_epoch
+  start=$(block_field "$block" start)
+  end=$(block_field "$block" end)
+  project=$(block_field "$block" project)
+  task=$(block_field "$block" task)
+  desc=$(block_field "$block" desc)
+  start_epoch=$(local_to_epoch "$start") || die "split: unparseable stored start: $start"
+  end_epoch=$(local_to_epoch "$end") || die "split: unparseable stored end: $end"
+  split_epoch=$(local_to_epoch "$at") || die "split: unparseable --at value: $at"
+  [ "$split_epoch" -gt "$start_epoch" ] && [ "$split_epoch" -lt "$end_epoch" ] \
+    || die "split: --at must fall strictly between $start and $end"
+
+  local evidence before after
+  evidence=$(printf '%s\n' "$block" | sed -n 's/^evidence=//p')
+  before=""
+  after=""
+  local line ep
+  while IFS= read -r line; do
+    [ -n "$line" ] || continue
+    ep=${line%% | *}
+    ep=$(local_to_epoch "$ep" 2>/dev/null || printf '%s' "$ep")
+    case "$ep" in
+      *[!0-9]*) before="$before$line"$'\n' ;;
+      *) if [ "$ep" -lt "$split_epoch" ]; then before="$before$line"$'\n'; else after="$after$line"$'\n'; fi ;;
+    esac
+  done <<< "$evidence"
+
+  remove_block "$TT/proposals.md" "$id" > "$TT/proposals.md.tmp"
+  {
+    cat "$TT/proposals.md.tmp"
+    printf '## %s-a\n' "$id"
+    printf 'start=%s\n' "$start"
+    printf 'end=%s\n' "$at"
+    printf 'project=%s\n' "$project"
+    printf 'task=%s\n' "$task"
+    printf 'desc=%s\n' "$desc"
+    printf '%s' "$before" | sed 's/^/evidence=/'
+    printf '\n'
+    printf '## %s-b\n' "$id"
+    printf 'start=%s\n' "$at"
+    printf 'end=%s\n' "$end"
+    printf 'project=%s\n' "$project"
+    printf 'task=%s\n' "$task"
+    printf 'desc=%s\n' "$desc"
+    printf '%s' "$after" | sed 's/^/evidence=/'
+    printf '\n'
+  } > "$TT/proposals.md.new"
+  mv "$TT/proposals.md.new" "$TT/proposals.md"
+  rm -f "$TT/proposals.md.tmp"
+  tt_unlock
+  printf 'split %s into %s-a (%s -> %s) and %s-b (%s -> %s)\n' "$id" "$id" "$start" "$at" "$id" "$at" "$end"
+}
+
+# ---------------------------------------------------------------- start / stop / log
+
+cmd_start() {
+  local project=- task=- desc=""
+  while [ "$#" -gt 0 ]; do
+    case "$1" in
+      --project) project=$2; shift 2 ;;
+      --task) task=$2; shift 2 ;;
+      --desc) desc=$2; shift 2 ;;
+      *) die "start: unknown argument: $1" ;;
+    esac
+  done
+  mkdir -p "$TT"
+  tt_lock
+  [ -e "$TT/active" ] && die "start: a live session is already running; run: fm-time.sh stop"
+  {
+    printf 'start=%s\n' "$(epoch_to_local "$(now_epoch)")"
+    printf 'project=%s\n' "$project"
+    printf 'task=%s\n' "$task"
+    printf 'desc=%s\n' "$desc"
+  } > "$TT/active"
+  tt_unlock
+  printf 'started tracking%s\n' "$([ -n "$desc" ] && printf ': %s' "$desc")"
+}
+
+cmd_stop() {
+  local desc_ov=""
+  while [ "$#" -gt 0 ]; do
+    case "$1" in
+      --desc) desc_ov=$2; shift 2 ;;
+      *) die "stop: unknown argument: $1" ;;
+    esac
+  done
+  tt_lock
+  [ -e "$TT/active" ] || die "stop: no live session is running; run: fm-time.sh start"
+  local start project task desc end start_epoch end_epoch
+  start=$(sed -n 's/^start=//p' "$TT/active" | head -1)
+  project=$(sed -n 's/^project=//p' "$TT/active" | head -1)
+  task=$(sed -n 's/^task=//p' "$TT/active" | head -1)
+  desc=$(sed -n 's/^desc=//p' "$TT/active" | head -1)
+  [ -n "$desc_ov" ] && desc=$desc_ov
+  end=$(epoch_to_local "$(now_epoch)")
+  start_epoch=$(local_to_epoch "$start") || die "stop: unparseable stored start: $start"
+  end_epoch=$(local_to_epoch "$end") || die "stop: unparseable end: $end"
+  # A start/stop within the same wall-clock minute would otherwise record an
+  # entry whose stored start and end are identical once truncated to minute
+  # granularity - report then silently discards it as invalid, losing the
+  # tracked session. Refuse it up front instead, leaving the active session
+  # in place so the captain can just wait a moment and stop again.
+  [ "$end_epoch" -gt "$start_epoch" ] || die "stop: wait until the current minute has elapsed before stopping"
+  append_entry "$start" "$end" "$project" "$task" "$desc"
+  rm -f "$TT/active"
+  tt_unlock
+  printf 'stopped: %s (%s -> %s)\n' "${desc:-(no description)}" "$start" "$end"
+}
+
+cmd_log() {
+  local start="" end="" project=- task=- desc=""
+  while [ "$#" -gt 0 ]; do
+    case "$1" in
+      --start) start=$2; shift 2 ;;
+      --end) end=$2; shift 2 ;;
+      --project) project=$2; shift 2 ;;
+      --task) task=$2; shift 2 ;;
+      --desc) desc=$2; shift 2 ;;
+      *) die "log: unknown argument: $1" ;;
+    esac
+  done
+  [ -n "$start" ] && [ -n "$end" ] || die "log: --start and --end are required"
+  [ -n "$desc" ] || die "log: --desc is required"
+  local s e
+  s=$(local_to_epoch "$start") || die "log: unparseable --start: $start"
+  e=$(local_to_epoch "$end") || die "log: unparseable --end: $end"
+  [ "$e" -gt "$s" ] || die "log: --end must be after --start"
+  tt_lock
+  append_entry "$start" "$end" "$project" "$task" "$desc"
+  tt_unlock
+  printf 'logged: %s (%s -> %s)\n' "$desc" "$start" "$end"
+}
+
+# ---------------------------------------------------------------- report
+
+cmd_report() {
+  local month="" project_filter=""
+  while [ "$#" -gt 0 ]; do
+    case "$1" in
+      --month) month=$2; shift 2 ;;
+      --project) project_filter=$2; shift 2 ;;
+      *) die "report: unknown argument: $1" ;;
+    esac
+  done
+  [ -n "$month" ] || month=$(epoch_to_yyyymm "$(now_epoch)")
+  [ -e "$TT/entries.md" ] || { printf 'no time entries recorded yet.\n'; return 0; }
+
+  local tmp
+  tmp=$(mktemp "$TT/.report.XXXXXX")
+  trap 'rm -f "$tmp"' RETURN
+
+  awk -v RS='' -v FS='\n' '
+    /^## / {
+      start=""; end=""; project=""; task=""; desc=""
+      for (i = 1; i <= NF; i++) {
+        line = $i
+        if (line ~ /^start=/) start = substr(line, 7)
+        else if (line ~ /^end=/) end = substr(line, 5)
+        else if (line ~ /^project=/) project = substr(line, 9)
+        else if (line ~ /^task=/) task = substr(line, 6)
+        else if (line ~ /^desc=/) desc = substr(line, 6)
+      }
+      if (start != "") print start "\t" end "\t" project "\t" task "\t" desc
+    }
+  ' "$TT/entries.md" > "$tmp"
+
+  local total=0 after_total=0 count=0 invalid=0
+  local -A proj_total proj_after
+  local -A key_total key_after key_desc
+  local line s e p t d s_epoch e_epoch dur ah ym
+
+  while IFS=$'\t' read -r s e p t d; do
+    ym=${s%% *}
+    ym=${ym%-*}
+    [ "$ym" = "$month" ] || continue
+    [ -z "$project_filter" ] || [ "$p" = "$project_filter" ] || continue
+    s_epoch=$(local_to_epoch "$s") || { invalid=$((invalid + 1)); continue; }
+    e_epoch=$(local_to_epoch "$e") || { invalid=$((invalid + 1)); continue; }
+    if [ "$e_epoch" -le "$s_epoch" ]; then invalid=$((invalid + 1)); continue; fi
+    dur=$(( (e_epoch - s_epoch) / 60 ))
+    ah=$(is_after_hours "$s_epoch")
+    total=$((total + dur))
+    count=$((count + 1))
+    [ "$ah" = yes ] && after_total=$((after_total + dur))
+    proj_total[$p]=$(( ${proj_total[$p]:-0} + dur ))
+    [ "$ah" = yes ] && proj_after[$p]=$(( ${proj_after[$p]:-0} + dur ))
+    key_total["$p"$'\t'"$t"]=$(( ${key_total["$p"$'\t'"$t"]:-0} + dur ))
+    [ "$ah" = yes ] && key_after["$p"$'\t'"$t"]=$(( ${key_after["$p"$'\t'"$t"]:-0} + dur ))
+    if [ -n "$d" ]; then
+      case "${key_desc["$p"$'\t'"$t"]:-}" in
+        *"$d"*) ;;
+        '') key_desc["$p"$'\t'"$t"]="$d" ;;
+        *) key_desc["$p"$'\t'"$t"]="${key_desc["$p"$'\t'"$t"]}; $d" ;;
+      esac
+    fi
+  done < "$tmp"
+  rm -f "$tmp"
+  trap - RETURN
+
+  printf 'Time tracking report - %s\n' "$month"
+  if [ "$count" -eq 0 ]; then
+    printf 'no entries recorded for this month%s.\n' "$([ -n "$project_filter" ] && printf ' for project %s' "$project_filter")"
+    [ "$invalid" -gt 0 ] && printf '(%d entr%s skipped: end not after start; check hand edits)\n' \
+      "$invalid" "$([ "$invalid" -eq 1 ] && printf y || printf ies)"
+    return 0
+  fi
+  printf 'total: %s tracked across %d entr%s\n' "$(fmt_minutes "$total")" "$count" "$([ "$count" -eq 1 ] && printf y || printf ies)"
+  printf '  after hours (weekend or outside %s-%s local): %s\n' "$WORKDAY_START" "$WORKDAY_END" "$(fmt_minutes "$after_total")"
+  printf '  business hours: %s\n' "$(fmt_minutes "$((total - after_total))")"
+  [ "$invalid" -gt 0 ] && printf '(%d entr%s skipped: end not after start; check hand edits)\n' \
+    "$invalid" "$([ "$invalid" -eq 1 ] && printf y || printf ies)"
+  printf '\nby project / task:\n'
+
+  local p_key kt task_name
+  local -a sorted_projects sorted_tasks
+  mapfile -t sorted_projects < <(printf '%s\n' "${!proj_total[@]}" | sort)
+  for p_key in "${sorted_projects[@]}"; do
+    printf '  %s  %s' "$([ "$p_key" = - ] && printf '(unattributed)' || printf '%s' "$p_key")" "$(fmt_minutes "${proj_total[$p_key]}")"
+    [ "${proj_after[$p_key]:-0}" -gt 0 ] && printf ' (%s after hours)' "$(fmt_minutes "${proj_after[$p_key]}")"
+    printf '\n'
+    mapfile -t sorted_tasks < <(
+      for kt in "${!key_total[@]}"; do
+        case "$kt" in "$p_key"$'\t'*) printf '%s\n' "$kt" ;; esac
+      done | sort
+    )
+    for kt in "${sorted_tasks[@]}"; do
+      task_name=${kt#*$'\t'}
+      printf '    %s  %s' "$([ "$task_name" = - ] && printf '(unattributed)' || printf '%s' "$task_name")" "$(fmt_minutes "${key_total[$kt]}")"
+      [ "${key_after[$kt]:-0}" -gt 0 ] && printf ' (%s after hours)' "$(fmt_minutes "${key_after[$kt]}")"
+      printf '\n'
+      [ -n "${key_desc[$kt]:-}" ] && printf '      %s\n' "${key_desc[$kt]}"
+    done
+  done
+}
+
+# ---------------------------------------------------------------- dispatch
+
+case "${1:-}" in
+  propose) shift; cmd_propose "$@" ;;
+  list)    shift; cmd_list "$@" ;;
+  approve) shift; cmd_approve "$@" ;;
+  reject)  shift; cmd_reject "$@" ;;
+  split)   shift; cmd_split "$@" ;;
+  start)   shift; cmd_start "$@" ;;
+  stop)    shift; cmd_stop "$@" ;;
+  log)     shift; cmd_log "$@" ;;
+  report)  shift; cmd_report "$@" ;;
+  ''|-h|--help|help) usage ;;
+  *) die "unknown subcommand: $1 (try --help)" ;;
+esac
diff --git a/bin/fm-turnend-guard-cursor.sh b/bin/fm-turnend-guard-cursor.sh
index e09bdba3763..f1c906c448e 100755
--- a/bin/fm-turnend-guard-cursor.sh
+++ b/bin/fm-turnend-guard-cursor.sh
@@ -249,13 +249,13 @@ current_session_still_ours() {
   fm_session_lock_owned_by_self "$STATE"
 }
 
-# Only the lock-owning session may arm or wake. A prior session that died
-# leaving its numeric harness pid behind is the one recoverable
-# case, delegated to bin/fm-lock.sh so acquisition keeps its single owner.
+# Only the lock-owning session may arm or wake. A prior session that died or was
+# suspended leaving its numeric harness pid behind is the recoverable case,
+# delegated to bin/fm-lock.sh so acquisition keeps its single owner.
 if ! fm_session_lock_owned_by_self "$STATE"; then
   LOCK_PID=$(cat "$STATE/.lock" 2>/dev/null || true)
   case "$LOCK_PID" in ''|*[!0-9]*) exit 0 ;; esac
-  fm_harness_pid_alive "$LOCK_PID" && exit 0
+  fm_session_lock_holder_competes "$LOCK_PID" && exit 0
   "$SCRIPT_DIR/fm-lock.sh" >/dev/null 2>&1 || exit 0
   fm_session_lock_owned_by_self "$STATE" || exit 0
 fi
diff --git a/bin/fm-turnend-guard.sh b/bin/fm-turnend-guard.sh
index 398fa68b7b7..89a0afba3db 100755
--- a/bin/fm-turnend-guard.sh
+++ b/bin/fm-turnend-guard.sh
@@ -79,7 +79,10 @@
 #      with the repair banner, bounded to FM_CLAUDE_TURNEND_BLOCK_BUDGET
 #      (default 3) consecutive blocks per session - safely below Claude Code's
 #      hard 8-consecutive-block override - then allow one loud attended
-#      fail-open only for an already verified failure episode.
+#      fail-open. That valve opens on either an already verified failure episode
+#      or a verified ABSENT auto-arm, because an auto-arm that never ran records
+#      no failure to verify and must not therefore be un-endable; see
+#      failopen_condition_verified below.
 set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -353,7 +356,7 @@ autoarm_owns_recovery() {
 terminal_fail_open() {
   local pid role old_session old_count
   [ "$COUNT" -gt "$BLOCK_BUDGET" ] || return 1
-  failure_episode_verified || return 1
+  failopen_condition_verified || return 1
   [ ! -e "$FAILURE_ALARM" ] || return 1
   # A live open generation claim is a concurrent recovery decision to step
   # aside for, exactly like the legacy live-owner case below.
@@ -390,7 +393,7 @@ terminal_fail_open() {
   esac
   role=$(fm_lock_role "$OWNER_LOCK" 2>/dev/null || true)
   if [ "$role" != terminal-check ] || [ "$old_session" != "$SESSION_ID" ] \
-    || [ "$old_count" -le "$BLOCK_BUDGET" ] || ! failure_episode_verified \
+    || [ "$old_count" -le "$BLOCK_BUDGET" ] || ! failopen_condition_verified \
     || [ -e "$FAILURE_ALARM" ]; then
     fm_lock_release "$BUDGET_LOCK"
     fm_lock_release "$OWNER_LOCK"
@@ -436,6 +439,60 @@ failure_episode_verified() {
   esac
 }
 
+# The auto-arm left no evidence it is running this home at all: its epoch ledger
+# is absent, or the last entry is older than one event epoch.
+#
+# This is the SECOND, independent way into the attended fail-open, and it exists
+# because the first one cannot cover its own precondition. failure_episode_verified
+# above proves an auto-arm that ran and exhausted itself, so every reason the
+# auto-arm never ran - it stood down at its own identity gate, its hook is not
+# registered, its host stripped it - produced no failure episode to advance and
+# left this guard re-blocking with no way out but Claude's hard 8-block override.
+# Supervision being unstartable for a reason this guard cannot repair must reach
+# the same bounded valve however it arose, so this predicate is about the ABSENCE
+# of the mechanism rather than about any particular cause of that absence.
+#
+# It stays as narrow as the first one: away mode still owns supervision when
+# present, a fresh ledger entry still means the auto-arm is mid-flight and is
+# still given the block, and the caller's exhausted block budget and one-shot
+# alarm bound this path exactly as they bound the other.
+#
+# The two absences are one condition but not one fact, so which of them held is
+# recorded in FM_TURNEND_AUTOARM_ABSENCE: `absent` when there is no ledger at all
+# and nothing ever recorded an attempt, `stale` when an attempt is on record and
+# nothing has run since. Only the second is a statement the notice below could
+# get wrong by claiming the first.
+FM_TURNEND_AUTOARM_ABSENCE=
+autoarm_never_established() {
+  FM_TURNEND_AUTOARM_ABSENCE=
+  [ ! -e "$STATE/.afk" ] || return 1
+  if [ ! -e "$STATE/.claude-autoarm-epoch" ]; then
+    FM_TURNEND_AUTOARM_ABSENCE=absent
+    return 0
+  fi
+  [ "$(fm_path_age "$STATE/.claude-autoarm-epoch")" -ge "$EPOCH_FRESH" ] || return 1
+  FM_TURNEND_AUTOARM_ABSENCE=stale
+  return 0
+}
+
+# Either proof of an unrepairable supervision failure opens the one bounded
+# attended fail-open. FM_TURNEND_FAILOPEN_KIND records which of the three states
+# was verified, so the notice states what actually holds rather than describing an
+# exhausted retry that may never have happened or an attempt that is on record.
+FM_TURNEND_FAILOPEN_KIND=
+failopen_condition_verified() {
+  FM_TURNEND_FAILOPEN_KIND=
+  if failure_episode_verified; then
+    FM_TURNEND_FAILOPEN_KIND=exhausted
+    return 0
+  fi
+  if autoarm_never_established; then
+    FM_TURNEND_FAILOPEN_KIND=$FM_TURNEND_AUTOARM_ABSENCE
+    return 0
+  fi
+  return 1
+}
+
 i=0
 while [ "$i" -lt $((SYNC_WAIT_MS / 100)) ]; do
   if autoarm_owns_recovery; then
@@ -469,7 +526,18 @@ if [ "$terminal_status" -eq 0 ]; then
   else
     NEED_DESC="X-mode relay polling active"
   fi
-  printf '{"systemMessage":"FIRSTMATE SUPERVISION IS GENUINELY DOWN: %s, the Stop-owned auto-arm exhausted its bounded retries and one failure notice, no watcher or automatic continuation exists, and the block budget is exhausted. Keep this session attended and diagnose the automatic Stop-hook and watcher startup before relying on unattended supervision."}\n' "$NEED_DESC"
+  case "$FM_TURNEND_FAILOPEN_KIND" in
+    absent)
+      FAILOPEN_CAUSE="the Stop-owned auto-arm never claimed this home at all and left no attempt on record"
+      ;;
+    stale)
+      FAILOPEN_CAUSE="the Stop-owned auto-arm last recorded an attempt more than one event epoch ago and has not run since, so it is no longer establishing supervision"
+      ;;
+    *)
+      FAILOPEN_CAUSE="the Stop-owned auto-arm exhausted its bounded retries and one failure notice"
+      ;;
+  esac
+  printf '{"systemMessage":"FIRSTMATE SUPERVISION IS GENUINELY DOWN: %s, %s, no watcher or automatic continuation exists, and the block budget is exhausted. Keep this session attended and diagnose the automatic Stop-hook and watcher startup before relying on unattended supervision."}\n' "$NEED_DESC" "$FAILOPEN_CAUSE"
   exit 0
 fi
 [ "$terminal_status" -eq 2 ] && exit 0
diff --git a/docs/configuration.md b/docs/configuration.md
index 4fd711f011f..5bdf2ab7e55 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -225,6 +225,13 @@ Fleet-local operational facts and gotchas live locally in `data/learnings.md`; i
 The file is created lazily on first learning and follows the internal [`stow` skill's](../.agents/skills/stow/SKILL.md) aging-tier and cold-archive contract: inspect the current file first and curate it instead of appending forever.
 There is no shared learnings file by captain decision.
 
+## Time tracking (config/time-tracking-*, data/time-tracking/)
+
+`bin/fm-time.sh` proposes candidate work windows from this home's own durable evidence, records nothing until the captain approves or corrects each one, and reports a month-end breakdown of hours by project and task with after-hours called out separately.
+It is a standalone command the captain runs directly; nothing in Firstmate's own operating loop invokes it.
+All of its records live locally under this home's gitignored `data/time-tracking/`, and its optional tuning knobs live under gitignored `config/time-tracking-*` files.
+The script's own header and `bin/fm-time.sh --help` are the single owner of exact evidence sources, storage format, and configuration keys.
+
 ## Startup memory budget (config/startup-memory-budget)
 
 `config/startup-memory-budget` is the primary-authoritative per-home allowance for the startup prompt-memory surface: `data/captain.md`, `data/captain-shared.md`, and `data/learnings.md` together.
@@ -875,7 +882,7 @@ FM_STATE_OVERRIDE=       # alternate state dir, mainly for tests
 FM_DATA_OVERRIDE=        # alternate data dir, mainly for tests
 FM_PROJECTS_OVERRIDE=    # alternate projects dir, mainly for tests
 FM_CONFIG_OVERRIDE=      # alternate config dir, mainly for tests
-FM_PROC_ROOT_OVERRIDE=   # alternate /proc root for Linux process-identity reads in fm-wake-lib.sh and fm-teardown.sh, mainly for tests
+FM_PROC_ROOT_OVERRIDE=   # alternate /proc root for every Linux process-identity read in bin/ (session-lock, wake, cursor, and teardown identity), mainly for tests
 FM_BACKEND=             # optional runtime backend override for new spawns; tmux/herdr/zellij/orca/cmux support ship/scout spawns, codex-app is not accepted
 FM_TRACE_CONTEXT=       # optional trace-context override; see "Trace context propagation"
 FM_TASK_ID=             # internal task-worker marker fm-spawn.sh exports into ship and scout panes, never set by hand; bin/fm-test-run.sh refuses to execute in the repository primary checkout while it is set
diff --git a/docs/scripts.md b/docs/scripts.md
index 43d692db5a8..c0f25a39435 100644
--- a/docs/scripts.md
+++ b/docs/scripts.md
@@ -43,7 +43,7 @@ The shared no-mistakes gate refusal for fleet lifecycle entrypoints is summarize
 | `fm-ensure-agents-md.sh` | Ensure a project's real `AGENTS.md`, its `CLAUDE.md` `@AGENTS.md` pointer, and self-governance guidance (explicit project mark documented in the helper's header and help) |
 | `fm-guard.sh`            | Warn on primary-checkout tangles, main-session pending wakes, and unhealthy supervision |
 | `fm-primary-scope-lib.sh` | Shared marker-or-plain-checkout primary-home predicate for tracked hooks             |
-| `fm-session-lock-lib.sh` | Shared session-lock harness identity (ancestry walk and holder liveness) for fm-lock.sh and the Claude Stop auto-arm |
+| `fm-session-lock-lib.sh` | Shared session-lock harness identity (ancestry walk, session-cohort proof, suspended-holder decision, and competing-holder verdict) for fm-lock.sh and the turn-end hooks |
 | `fm-claude-stop-autoarm.sh` | Claude Stop `asyncRewake` hook owning tokenless watcher continuity with single-flight exit-2 rewake (docs/watcher-continuity.md) |
 | `fm-turnend-guard.sh`    | Shared primary turn-end guard predicate so no turn ends blind (docs/turnend-guard.md) |
 | `fm-turnend-guard-grok.sh` | Grok Stop-hook adapter for the primary turn-end guard                              |
@@ -144,6 +144,7 @@ The shared no-mistakes gate refusal for fleet lifecycle entrypoints is summarize
 | `fm-public-followup-emit.sh` | Report one typed terminal work result into the home that owes the public reply, or stage it when that home is on another machine |
 | `fm-public-followup-collect.sh` | Read and retire the typed terminal results a remote work home staged for the home that owes the public reply |
 | `fm-inbox.sh`            | The captain's out-of-band capture surface: queue a note, dictate one, read status, ask a side question |
+| `fm-time.sh`             | Propose work windows from durable evidence for the captain to approve or correct, plus start/stop/log and a month-end hours-by-subject report |
 | `fm-voice-relay.py`      | Hold the spoken conversation on this host, answer from the records, and hand real work to `fm-inbox.sh` ([voice-relay.md](voice-relay.md)) |
 | `fm-voice-client.py`     | The laptop end of the spoken interface: capture, playback, and turn timing over SSH; audio devices unverified |
 | `fm_voice_frame.py`      | The wire format both machines share, copied to the laptop beside the client          |
diff --git a/docs/sessionstart-nudge.md b/docs/sessionstart-nudge.md
index 68f9b9c4ecb..ff97ab5ee86 100644
--- a/docs/sessionstart-nudge.md
+++ b/docs/sessionstart-nudge.md
@@ -58,7 +58,8 @@ The Guard Predicates section of [`turnend-guard.md`](turnend-guard.md#guard-pred
 The nudge payload starts with U+2063 and the stable `FIRSTMATE_OP: ` label, carries the current `session-start` protocol kind, and retains exactly ``Run `bin/fm-session-start.sh` now, exactly once, before executing any other instructions.`` as its body.
 The Ahoy skill owns the rule that this marked operational input is never a captain-authored session boundary, including its narrow legacy compatibility cases, and its own step 0 helm check is the fallback that protects a nudge-tier harness whose first command is a skill.
 
-Before printing, the nudge wrapper reads `state/.lock` and walks at most eight parents from its own pid in its own separate, hard-coded loop, independent of `bin/fm-lock.sh`'s ancestry walk (`fm_harness_ancestry_pid()` in `bin/fm-session-lock-lib.sh`, which now walks up to sixteen parents and can extend past a claude-named match to a still-more-ancestral one) and of Pi's `lockOwnership()`.
+Before printing, the nudge wrapper reads `state/.lock` and walks at most eight parents from its own pid in its own separate, hard-coded loop, independent of `bin/fm-lock.sh`'s own ownership decision (`bin/fm-session-lock-lib.sh`, which walks up to sixteen parents, can extend past a claude-named match to a still-more-ancestral one, and additionally accepts a lock held by a co-located session that provably started this one or was provably started by it) and of Pi's `lockOwnership()`.
+A wrapper that misses one of those shapes prints a second nudge, which the once-per-session start is designed to absorb, so it is deliberately not kept in step with that owner.
 If the lock names a live pid in that ancestry, session start already ran in this harness session and the wrapper stays silent.
 Every ordinary transport path in both wrappers exits 0, including malformed state and adapter errors, because a Claude SessionStart exit 2 blocks session initialization.
 The run wrapper's internal `--pi-prerequisite` mode uses silent exit 3 only for an intentional gate or scope stand-down, letting Pi distinguish ineligibility from an eligible empty native result without changing any harness hook's exit contract.
diff --git a/docs/turnend-guard.md b/docs/turnend-guard.md
index a3e73dfb54f..c0a15ef84b7 100644
--- a/docs/turnend-guard.md
+++ b/docs/turnend-guard.md
@@ -108,7 +108,15 @@ The auto-arm itself rechecks the healthy watcher predicate and retries a bounded
 The first fresh exhausted-failure epoch preserves its handoff without consuming a blocked-stop count, while later fresh failed epochs advance the same monotonic progression instead of resetting it.
 When none of those proofs appears, it re-blocks up to `FM_CLAUDE_TURNEND_BLOCK_BUDGET` times (default 3, below Claude's 8-block override).
 In Claude mode, positive watcher recovery clears the block budget, failure notice, and attended alarm together under the existing budget lock before either hook reports ordinary recovery.
-The one loud attended fail-open is available only when the auto-arm has recorded an exhausted failure, its one notice is already consumed, the block budget is exhausted, and a final check finds neither a healthy watcher nor an automatic continuation.
+The one loud attended fail-open opens on either of two verified conditions, and in both cases only when the block budget is exhausted and a final check finds neither a healthy watcher nor an automatic continuation.
+The first is an exhausted failure episode: the auto-arm recorded an exhausted failure and its one notice is already consumed.
+The second is a verified ABSENT auto-arm: its epoch ledger is missing entirely, or its last entry is older than one event epoch.
+The second condition exists because the first cannot cover its own precondition.
+An auto-arm that never ran records no failure to verify, so every reason it could not start - it stood down at its own identity gate, its hook is not registered, its host stripped it - previously left this guard re-blocking with no way out but Claude's hard 8-block override.
+Supervision being unstartable for a reason this guard cannot repair has to reach the same bounded valve however it arose, so that condition is about the absence of the mechanism rather than any particular cause of it.
+Both conditions stay narrow the same way: away mode still owns supervision when present, and a fresh ledger entry still means the auto-arm is mid-flight and is still given the block.
+The notice names the state it actually verified, as one of three distinct causes: an exhausted failure episode, an auto-arm that never claimed this home and left no attempt on record, or an auto-arm whose last recorded attempt is older than one event epoch and has not run since.
+That is why the absent condition is reported as two causes rather than one, so an auto-arm that stopped running is not described as one that never ran, and neither is described as an exhausted retry that never happened.
 Each epoch identity is accounted at most once under the budget lock.
 Whenever both coordination locks are needed, positive auto-arm recovery and the terminal check acquire the auto-arm owner lock before the budget lock.
 After that alarm, the Stop auto-arm suppresses further exit-2 continuations until positive watcher recovery, so the final fail-open remains reachable.
@@ -181,7 +189,7 @@ That warning uses `bin/fm-supervision-instructions.sh --repair-line`, so it alwa
 
 ## Regression coverage
 
-`tests/fm-turnend-guard.test.sh` covers the predicate, main and secondmate primary scope, child-worktree exclusion, `FM_HOME` and `FM_STATE_OVERRIDE` precedence, the live-lock and fresh-beacon guard predicate, the cooperative `--claude` open-generation claim wait, monotonic failed-epoch progression, bounded attended fail-open, post-alarm continuation suppression, positive recovery reset, generation and legacy claim cases that must block or clear instead of allowing a blind stop, away-mode daemon ownership between watcher cycles and over a watcher lock left behind by an exited watcher, plus its dead, pid-reused, absent, stale-beacon, and away-mode-off negatives, the away-mode beacon's poll-derived grace widening for a live daemon still mid-cycle and its bound against a dead daemon, a beacon older than that wider grace, and FM_POLL's inapplicability with away mode off, Pi logical-run latching, missing-`jq` behavior, all five primary registrations, Grok native and legacy selection, typed field precedence, malformed input, and exactly-one-path safety.
+`tests/fm-turnend-guard.test.sh` covers the predicate, main and secondmate primary scope, child-worktree exclusion, `FM_HOME` and `FM_STATE_OVERRIDE` precedence, the live-lock and fresh-beacon guard predicate, the cooperative `--claude` claim wait including the open-generation claim, monotonic failed-epoch progression, both entries to the bounded attended fail-open and the fresh-entry boundary that keeps it shut, post-alarm continuation suppression, positive recovery reset, the abandoned auto-arm, arming, and generation claim cases that must block or clear instead of allowing a blind stop, away-mode daemon ownership between watcher cycles and over a watcher lock left behind by an exited watcher, plus its dead, pid-reused, absent, stale-beacon, and away-mode-off negatives, the away-mode beacon's poll-derived grace widening for a live daemon still mid-cycle and its bound against a dead daemon, a beacon older than that wider grace, and FM_POLL's inapplicability with away mode off, Pi logical-run latching, missing-`jq` behavior, all five primary registrations, Grok native and legacy selection, typed field precedence, malformed input, and exactly-one-path safety.
 `tests/fm-guard-stale-banner.test.sh` covers the pull-guard predicate, including the persistent-model fresh-leftover-beacon negative control, the auto-arm model's healthy fresh-beacon-without-a-watcher case and stale-beacon alarm, and the extension model's live-watcher path, ownership-qualified fresh hand-off, held-lock failures, independently broken ownership signals, stale-beacon alarm, queued-wake warning, and Pi and pi-signed harness routing.
 It also covers true-reason banner wording and reason-keyed episode dedup surviving a beacon mtime change.
 `tests/fm-cursor-primary.test.sh` covers the Cursor park end to end over real processes with no harness installed: each tracked Claude-shaped entrypoint standing down on a Cursor payload, both follow-up sources, the bounded repair nag and its reset, the nested loop bounds, supersession, away-mode and lock-ownership inertness, Pi-host stand-down without Cursor identity and continued parking when `PI_CODING_AGENT` leaks alongside `CURSOR_AGENT` or `CURSOR_INVOKED_AS`, child-worktree exclusion, and that the adapter never exits 2.
diff --git a/docs/verification/runtime-backends.md b/docs/verification/runtime-backends.md
index f8e63fa8ca4..0c055c84fd3 100644
--- a/docs/verification/runtime-backends.md
+++ b/docs/verification/runtime-backends.md
@@ -230,6 +230,131 @@ Valid cleanup removed only the exact task-bound target and left the control wind
 The metadata-only validation covers tmux, Herdr, Zellij, Orca, and cmux before backend dispatch.
 Claude, Codex, OpenCode, Pi, pi-signed, Grok, Kimi, Cursor, and Muse share that backend cleanup boundary; their harness-specific hook files, tokens, transcript bindings, and session-log sidecars are cleaned only after it, so no harness needs a separate endpoint parser.
 
+### Session-lock identity and the suspended holder
+
+`bin/fm-session-lock-lib.sh` decides which harness process holds a home's session lock and whether the current process is that same session.
+Its verdict comes from vendor-emitted process names, argv, kernel process state, and the environment a harness hands to the processes it starts, so the per-harness result below is refreshed by a real-harness run rather than transcribed from a previous release.
+
+The installed adapters were exercised on 2026-08-20 with tmux 3.6 on Linux 6.18.33.2-microsoft-standard-WSL2 x86_64.
+Each harness ran as a child of a pane shell, which is the shape a captain's own session has and the shape the suspended-holder incident was observed in.
+Each was also launched a second time as its own INSTALLED executable, because the PATH entry is a symlink named exactly after the harness and a launch through it can only ever observe the name already expected.
+
+```sh
+FM_SESSION_LOCK_IDENTITY_LIVE=1 bin/fm-test-run.sh tests/fm-session-lock-identity-live-e2e.test.sh
+```
+
+Observed output:
+
+```text
+# claude 2.1.237 (Claude Code): installed executable claude.exe reports comm='claude.exe' acceptance-kind='claude'
+# claude 2.1.237 (Claude Code): comm='claude' argv='/home/u/.nvm/versions/node/v24.16.0/bin/claude' acceptance-kind='claude'
+# claude 2.1.237 (Claude Code): no descendant of a bare launch carried a launch marker verified for claude
+ok - session-lock identity: claude 2.1.237 (Claude Code) is identified, refuses an unrelated session, and releases while suspended
+# codex codex-cli 0.139.0: executable identity names no harness, so the launch-marker accept path stays closed for it and its session-lock verdict is decided by process ancestry alone
+# codex codex-cli 0.139.0: the installed executable codex.js is an interpreter script, so its own name never reaches a reported command name and only the launcher name is typed
+# codex codex-cli 0.139.0: comm='MainThread' argv='node /home/u/.nvm/versions/node/v24.16.0/bin/codex' acceptance-kind='none'
+# codex codex-cli 0.139.0: no descendant of a bare launch carried a launch marker verified for codex
+ok - session-lock identity: codex codex-cli 0.139.0 is identified, refuses an unrelated session, and releases while suspended
+# skip: opencode is not installed on this machine, so its session-lock identity is unverified here
+# skip: pi is not installed on this machine, so its session-lock identity is unverified here
+# skip: pi-signed is not installed on this machine, so its session-lock identity is unverified here
+# skip: grok is not installed on this machine, so its session-lock identity is unverified here
+# skip: kimi is not installed on this machine, so its session-lock identity is unverified here
+# skip: cursor is not installed on this machine, so its session-lock identity is unverified here
+# reporter control 'claude.exe': comm='claude.exe' acceptance-kind='claude' (expected claude)
+# reporter control 'claude bg-pty-host': comm='claude bg-pty-h' acceptance-kind='claude' (expected claude)
+# reporter control 'claudette': comm='claudette' acceptance-kind='none' (expected none)
+# reporter control 'claude-code': comm='claude-code' acceptance-kind='none' (expected none)
+# reporter control 'node': comm='node' acceptance-kind='none' (expected none)
+# reporter control 'python3': comm='python3' acceptance-kind='none' (expected none)
+ok - session-lock identity: this machine's reported command names are typed after the reporter's own artifacts, and near misses still are not
+# unchecked: the cross-harness kind distinctness that scopes launch markers needs two harnesses that name themselves by executable identity, and only 1 did here (kinds observed: claude:claude)
+# unverified on this machine (not installed): opencode pi pi-signed grok kimi cursor
+# checked 2 installed harness(es)
+```
+
+| Harness | Version | `ps -o comm=` | Installed executable | Acceptance kind | Identified | Refuses an unrelated session | Releases while suspended |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| claude | 2.1.237 (Claude Code) | `claude` | `claude.exe`, reports `claude.exe` | `claude` from either | yes | yes | yes |
+| codex | codex-cli 0.139.0 | `MainThread` | `codex.js`, an interpreter script | none | yes | yes | yes |
+
+Claude Code is the harness whose reported command name is not the bare harness name, in two ways that are the reporter's doing rather than the program's, and both were unidentified until the name was normalized before the exact-equality test.
+Its installed executable is a single-file native build named `claude.exe`, so a process that execs it directly reports that name verbatim; and it renames its own background pty worker task to `claude bg-pty-host`, which the 15-character kernel task-name limit cuts to `claude bg-pty-h`.
+Normalization takes the first space-delimited word and strips the platform executable suffix, then compares exactly as before, so `claude.exe` and `claude bg-pty-h` both name `claude` while `claudette`, `claude-code`, `node`, and `python3` still name nothing.
+Those six reporter controls are run against real processes carrying those exact names, because whether an artifact appears at all depends on the platform: procps reports the kernel task name and truncates it, while BSD `ps` reports argv[0] and does not.
+The acceptance cases assert the divergence before the verdict, so a machine that stopped producing an artifact fails rather than passing without testing anything.
+
+`codex.js` is reported rather than failed because an interpreter script's own name never reaches a reported command name: the kernel runs the interpreter named in its `#!` line, so the process is called after the launcher or the interpreter instead.
+Only a native executable's own name can reach `ps`, which is why the check is a hard failure for one and an observation for the other.
+
+Codex is the harness whose reported name depends on its install method.
+The macOS table above records `codex` for a native 0.146.0 install, while an npm install under nvm runs it as a node script and node renames its own main thread, so `ps -o comm=` reports `MainThread` and no interpreter name at all.
+Identity for that shape comes from the interpreter's script path in argv, taken as the one token immediately after the interpreter and matched by exact basename.
+Whole-path-component matching, which identifies a version-named executable by its install path elsewhere in that file, is too loose for the one token this branch has: under that rule `node /opt/hooks/claude/instrument.js` would report an instrumentation script as a harness on the strength of the directory it lives in.
+Exact basename alone is not enough either, because a flag's value can be named anything at all, `--require=/opt/vendor/claude` included, so the classifier refuses to identify the process at all as soon as that first token is a flag.
+Only the plain `node <script>` shape recorded above is identified, which is deliberate: the alternative is an allowlist of value-taking interpreter flags that would rot silently as vendors add them, so a wrapper-inserted flag makes this evidence unavailable rather than guessed, and a new shape is added here only after it is observed from a real release.
+
+Everything in the two paragraphs above is scoped to the `MainThread` exec name, and an interpreter that reports its OWN name such as `node` or `python3` never reaches that branch, so it is decided by its own rule.
+That rule reads the argv tokens after the interpreter in order, stops at the first token beginning with `-`, and carries a verdict only from a whole path component of a token before that stop.
+It previously matched a verified harness name anywhere in the whole argument string with no path-component requirement in the test at all, which is why it was corrected here rather than deferred again: `node --require /opt/hooks/claude/instrument.js /srv/app/server.js`, `python3 /srv/app.py --config /etc/claude/x.toml`, and any unrelated node or python service carrying an ordinary `~/.claude/...` hook, settings, log or transcript argument each reported itself as a Claude harness, and the last of those is the shape most likely to exist on a machine that runs Claude Code.
+None of the three is identified now.
+The real install this rule does protect is the npm codex layout, `node /usr/lib/node_modules/@openai/codex/bin/codex.js`, whose package directory is exactly `codex`, which is why the rule reads path components rather than a basename.
+It does not protect Claude Code's or OpenCode's npm layouts, and that is a limit rather than a claim: `node /usr/lib/node_modules/@anthropic-ai/claude-code/cli.js` is not identified, because the components are `@anthropic-ai` and `claude-code` and neither is exactly `claude`, and `node /usr/lib/node_modules/opencode-ai/bin/opencode.mjs` is not identified either.
+The Claude Code half of that has since been narrowed by observation: the npm install actually in use does not run as a node script at all, because it ships its own single-file native executable and is identified by that executable's name, so its `claude-code` package directory never has to be read.
+What the limit still covers is a node-hosted launch out of that layout, where the interpreter is the command name and the package directory is the only place the harness is named.
+An install recognised by no rule in this file cannot resolve a harness ancestry, so `fm_session_lock_owned_by_self` returns false and that session start degrades to read-only against its own home, which is the false-refusal lockout this work exists to remove.
+The same limit runs in the other direction as well, because the identification above also judges a RECORDED holder: a session lock an older firstmate wrote for a still-live session of one of those unidentified shapes now reads as not-a-harness, so it does not compete and the next session reclaims the home while that session is still running.
+That is bounded to an in-place-update adoption window rather than being a standing hole, because the current rules refuse to record such a holder in the first place, and it is not closed.
+The mitigation chosen for it is that `fm_session_lock_holder_competes` classifies a live-but-unidentified holder apart from one that is simply gone, so `bin/fm-lock.sh` names that reclaim on stdout with the holder pid instead of moving the lock in silence.
+Closing it means observing the command name and argv a real node-hosted install reports rather than inventing them, which is the same guess the file refuses for a launch-marker row, so the guard above is what closes it: it records the command name and argv it actually observes for every installed harness, and a real one run through it produces the evidence a later fix needs.
+Stopping at the first flag gives up the inferred `node --experimental-foo /path/to/claude/cli.js` shape, exactly as the `MainThread` branch gives up its own flag-prefixed shape and for the same reason.
+Two further limits of this rule are stated rather than implied closed: it reads every token before that flag rather than the script token alone, so `node /srv/app/server.js /opt/claude/agent.json` is Claude here and is nothing under the `MainThread` branch on identical argv; and `pi` and `pi-signed` are read as a token's own basename rather than as an interior component, because `/home/pi` is the Raspberry Pi OS default home and `node /home/pi/app.js` would otherwise be a verified Pi harness.
+
+Everything above decides IDENTIFICATION, which is what the ancestry walk and the liveness predicate need in order to interpret a recorded pid at all.
+It does not decide the launch-marker acceptance below, which is typed from executable identity alone: the reported command name's own basename once the reporter's own artifacts are normalized out of it, or a whole path component of that command name or of argv[0], and never an argument list.
+A launch marker proves a launch relationship rather than identity, so a codex session the captain started from inside a Claude session carries a truthful `CLAUDE_PID` naming that Claude holder, and the evidence for that pair is otherwise identical to the rehosted Claude session the marker path exists to accept.
+The consequence is that a harness named nowhere but in its argument list - a node-hosted launch, or the npm `MainThread` shape recorded above - is identified here and still gets no accept path, which `FM_SESSION_LAUNCH_MARKERS` in `bin/fm-session-lock-lib.sh` owns alongside the reason that fail-closed direction is the right one.
+
+The launch marker is the environment variable a harness exports into every process it starts, naming its own session pid.
+It is what lets a session the harness rehosted under its own pty still recognize the lock its process tree can no longer reach, in whichever direction of the launch pair recorded it.
+A bare launch with no prompt starts no child, so the live guard reports it as unobserved rather than asserting it; the marker itself is confirmed from inside a real session.
+
+```sh
+echo "$CLAUDE_PID"
+sleep 5 & tr '\0' '\n' < /proc/$!/environ | sed -n 's/^CLAUDE_PID=/child inherits CLAUDE_PID=/p'
+bash -c '. bin/fm-session-lock-lib.sh; fm_harness_ancestry_pid'
+```
+
+Observed output inside Claude Code 2.1.234 on the same machine and date:
+
+```text
+179487
+child inherits CLAUDE_PID=179487
+179487
+```
+
+The marker names the session pid, every child inherits it, and it matches the pid the ancestry walk resolves.
+Matching that number is necessary rather than sufficient: because the value is an exec-time snapshot, a recycled pid keeps satisfying it, so the pid a marker names must also have started no later than the process that carried the marker, read from field 22 of `/proc/<pid>/stat` and refused outright when either side cannot be read.
+A later `export` does not rewrite `/proc/<pid>/environ`, so the value a process was started with survives its own reassignment, which is what carries the relationship across a reparented tree.
+Claude is the only adapter with a verified marker at this date.
+codex, opencode, pi, pi-signed, grok, kimi, and cursor have none, so on those harnesses session-lock ownership is decided by process ancestry alone and a session rehosted outside its own process tree still refuses its own home.
+That is the behavior they had before this record existed rather than a regression, and `FM_SESSION_LAUNCH_MARKERS` in `bin/fm-session-lock-lib.sh` owns the reason that is safe: each row is scoped to the harness it was verified for, so a marker a different harness merely inherited from a session it was started inside is never believed.
+Adding a row is a verification task: observe the variable in a real child of a real session of that harness, then refresh this table with that harness in the row.
+The guard above reports the marker it actually observed per harness, scoped the same way, and reports `no descendant of a bare launch carried a launch marker verified for <harness>` when a prompt-free launch started no child to read or the harness has no row.
+It also records the harness kind each installed release reports and refuses a pass where two installed harnesses report the same kind, because that scoping is only as good as telling the two apart.
+Only claude named itself by executable identity in the run above, so that distinctness had nothing to compare and the guard says so rather than reporting it as checked.
+
+Suspension is confirmed over several samples, and this run also recorded a kernel behavior worth keeping: on this WSL2 build `SIGSTOP` does not stop a pty **session leader** at all, while it stops an ordinary child normally.
+
+```text
+A(session leader): state=S progressed=10
+B(child of pane shell): state=T progressed=0
+```
+
+A process the kernel leaves running is correctly reported as running, so this is a fixture constraint rather than a classifier gap: any check that suspends a harness must start it as a child of a pane shell, not as the pane process itself.
+
+`tests/fm-session-lock-ancestry.test.sh` pins the same logic in CI with real processes and no harness.
+
 ## Claude workspace trust
 
 Verified 2026-09-03 on Claude Code 2.1.259.
diff --git a/docs/verification/supervision.md b/docs/verification/supervision.md
index 0476de1318e..86e80735449 100644
--- a/docs/verification/supervision.md
+++ b/docs/verification/supervision.md
@@ -324,6 +324,7 @@ That inertness result is scoped to the builds it exercised: it did not establish
 The secondmate-home scope and manual-repair wake path were measured with Claude Code 2.1.207 on 2026-07-12, when a native background completion re-invoked the idle model with no human input.
 The current Stop-owned main/secondmate inclusion and child-worktree exclusion are covered deterministically by `tests/fm-claude-stop-autoarm.test.sh`.
 Session-lock ownership in `bin/fm-session-lock-lib.sh` is decided against a session's whole contiguous harness ancestry rather than one chosen pid, so the Stop auto-arm reaches its lock owner wherever that owner sits: the outermost pid of Claude Code's multi-level `bg-spare` hook worker chain, or an inner pid when a harness-named daemon parents the session.
+A lock outside that ancestry is decided by the session-cohort proof instead, whose per-harness evidence lives in [`runtime-backends.md`](runtime-backends.md#session-lock-identity-and-the-suspended-holder).
 Harness identity is read from the executable path and `argv[0]` as well as the command basename, because Claude Code's native installer names the per-session executable by its version (`.../share/claude/versions/2.1.220`): `ps -o comm=` reports that path on macOS and the bare version string on Linux, and neither basename names a harness.
 `tests/fm-session-lock-ancestry.test.sh` pins both platforms' reporting semantics behind a deterministic process table and runs the real Stop auto-arm in version-named, daemon-parented, and combined real process trees.
 `tests/fm-watch-arm.test.sh` runs real watcher and arm cycles against durable on-disk state to verify that a delivered reason survives until post-handling acknowledgement and stops replaying after acknowledgement, while an unrelated queue append cannot make a watcher cycle that delivered nothing look successful.
diff --git a/docs/watcher-continuity.md b/docs/watcher-continuity.md
index 19d3d15f93d..f28e74d5ae1 100644
--- a/docs/watcher-continuity.md
+++ b/docs/watcher-continuity.md
@@ -14,7 +14,20 @@ omp's replacement follows the same generation-owner contract in `.omp/extensions
 Cursor's `.cursor/hooks.json` `stop` hook (`bin/fm-turnend-guard-cursor.sh`) owns routine tokenless re-arm for a Cursor primary by parking that awaited hook on `bin/fm-watch-arm.sh` and returning an actionable close as one follow-up; [`turnend-guard.md`](turnend-guard.md#harness-integrations) owns its Pi-host stand-down, loop bounds, and supersession baton.
 Claude's `.claude/settings.json` Stop `asyncRewake` hook (`bin/fm-claude-stop-autoarm.sh`) owns routine tokenless re-arm.
 The hook fires on every Stop, and an eligible primary with supervision need admits one home-scoped owner that foregrounds `bin/fm-watch-arm.sh` inside the hook-owned process tree.
-A numeric session-lock owner that fails the shared `fm_harness_pid_alive` predicate is reclaimed through `bin/fm-lock.sh` before auto-arm state changes, while a live owner, absent lock, or malformed lock keeps the competing hook inert.
+A numeric session-lock owner that fails the shared `fm_session_lock_holder_competes` predicate is reclaimed through `bin/fm-lock.sh` before auto-arm state changes, while a competing owner, absent lock, or malformed lock keeps the hook inert.
+That predicate is the single owner of the session-lock recovery boundary in `bin/fm-session-lock-lib.sh`, and four holders do not compete: a pid that is gone, a live pid the identity rules decline to type as a harness, a durably stopped harness, and a live harness co-located with this session that either provably started it or was provably started by it.
+Only the first of those is reclaimed silently, because a holder that no longer exists is the ordinary path every session start takes.
+The second reclaims a process that was still present when the predicate classified it, so it is announced rather than silent, and the condition it reports is general: some live process occupies the recorded pid and the identity rules cannot type it as a harness.
+Most often that means the recorded pid no longer belongs to any harness at all, because a session died without releasing `state/.lock` and the pid was later reused by an unrelated process, which is the benign and expected case rather than a fault to chase.
+Read the line as a statement about the recorded pid rather than as a diagnosis of whatever now occupies it, and treat a lock an older firstmate wrote for a still-live session whose install shape the current identity rules do not identify as one named instance of the same condition, which [`verification/runtime-backends.md`](verification/runtime-backends.md#session-lock-identity-and-the-suspended-holder) owns as a bounded adoption-window limit.
+That general condition is exactly why this case reclaims rather than refuses: refusing on a live but unidentified pid would let ordinary pid reuse lock a home read-only, which is the defect this boundary exists to remove.
+The co-located holder is recognized from a launch marker the harness writes into the processes it starts, read in whichever direction of that pair recorded it, and consulted only when the asking session and the holder are both the harness that marker was verified for, which is Claude alone, so on codex, opencode, pi, pi-signed, grok, kimi, and cursor this boundary is still decided by process ancestry alone.
+Both sides of that pair are named from executable identity alone, never from an argument list, because a launch marker proves a launch relationship rather than identity and a different harness started from inside a session inherits it truthfully.
+The pair must also be ORDERED, because a marker is an environment snapshot matched against the holder by numeric equality and so keeps matching once that pid has been recycled onto an unrelated session of the same harness.
+The pid a marker names must therefore not have started after the process that carried that marker, which a recycled occupant cannot satisfy, and an unreadable start time on either side refuses the relationship and falls back to the ancestry verdict.
+Do not read the co-located holder as cross-harness behavior: `FM_SESSION_LAUNCH_MARKERS` in that file owns the limit and why it is safe, and [`verification/runtime-backends.md`](verification/runtime-backends.md#session-lock-identity-and-the-suspended-holder) owns the per-harness evidence.
+The stopped case is a deliberate decision rather than pure liveness, because `kill -0` succeeds on a stopped process and treating it as still holding turns one suspended session into a permanent lockout of the whole home.
+It is confirmed over several samples so a momentary stop is not read as a suspended session, and it is made visible rather than surprising: `bin/fm-lock.sh status` reports a suspended holder as reclaimable, and acquisition names any live holder it yielded past, distinguishing a genuine takeover from a suspended session, one session converging its own lock onto its own pid, and a reclaim from a live holder it could not identify.
 The stale-owner claim occurs only after the existing AFK and supervision-need gates pass.
 After each non-actionable arm close, the hook rechecks the identity-matched watcher lock and fresh beacon before retrying a bounded number of times.
 A cycle-end failure is benign when that live-watcher predicate is true, and the hook suppresses the arm output and continues silently.
@@ -119,7 +132,10 @@ The same suite covers ordinary same-process session replacement for `/new`, `/re
 `tests/fm-watcher-lock.test.sh` covers verified-successor attach, recovery publication before stale-lock removal, the typed self-eviction failure, bounded and successor-linked lifecycle rows, and a SIGSTOP counterfactual that distinguishes a live PID from a stale beacon before classifying termination.
 `tests/fm-subagent-pretool-check.test.sh` proves Claude retains only the non-status Bash seatbelts.
 `tests/fm-claude-stop-autoarm.test.sh` covers the auto-arm's scope, stale and live session owners, unchanged AFK and need boundaries, single-flight, bounded failure retries, benign live-watcher cycle ends, one-notice failure episodes, and exit-2 translation.
+It also covers abandoned single-flight claims: a claim the ledger shows already finished, and one whose recorded pid-identity no longer matches its live pid while the ledger still reads arming or is absent entirely, are both reclaimed so a lapsed home re-arms, while an identity-matched claim still arming, one the ledger does not name, and the guard's own terminal check keep the gate closed ([`turnend-guard.md`](turnend-guard.md) owns that boundary).
 It also covers generation-claim single-flight, stuck-claim supersession, superseded-owner silence, notice-marker refusal and retry, ownership-atomic episode reset, and the legacy upgrade shim; [`turnend-guard.md`](turnend-guard.md) owns those behavior contracts.
+`tests/fm-session-lock-ancestry.test.sh` covers the recovery boundary itself with real processes and no harness: a session rehosted outside its own process tree owning the lock it cannot reach, a co-located session with no launch relationship still refused, a launch relationship alone refused across containers, each co-location signal carrying the verdict with the other driven apart, a real suspended holder releasing and holding again on resume, and the command names a real install reports being typed while near misses are not.
+`FM_SESSION_LOCK_IDENTITY_LIVE=1 tests/fm-session-lock-identity-live-e2e.test.sh` is the opt-in guard that proves the same boundary against every installed harness and fails naming the harness and version.
 `FM_CLAUDE_LIVE_E2E=1 tests/fm-claude-stop-autoarm-live-e2e.test.sh` starts with the reproduced stale-lock state, runs session start first, completes two tokenless cycles, and checks the competing-live-owner negative control.
 `tests/fm-turnend-guard.test.sh` covers the cooperative `--claude` guard, including monotonic failed-epoch progression, the integrated bounded fail-open, post-alarm continuation suppression, and positive recovery reset; [`turnend-guard.md`](turnend-guard.md#regression-coverage) lists that suite's full generation and legacy claim coverage.
 
diff --git a/tests/fm-claude-stop-autoarm-live-e2e.test.sh b/tests/fm-claude-stop-autoarm-live-e2e.test.sh
index ae14d9f3af5..59d6aa8b7be 100755
--- a/tests/fm-claude-stop-autoarm-live-e2e.test.sh
+++ b/tests/fm-claude-stop-autoarm-live-e2e.test.sh
@@ -146,13 +146,36 @@ FAKE_CLAUDE="$LAB/claude"
 ln -s /bin/bash "$FAKE_CLAUDE"
 mkdir -p "$LIVE_OWNER_HOME/state" "$LIVE_OWNER_HOME/config"
 printf 'project=fixture\n' > "$LIVE_OWNER_HOME/state/task.meta"
-"$FAKE_CLAUDE" -c 'sleep 3; :' &
+# Both fake harnesses start with every session-cohort signal cleared, from the
+# list tests/session-signals.sh derives from the library's own tables, because
+# this guard runs inside a REAL Claude session: inheriting its launch marker and
+# pane id would put the "competing" holder in the hook's own session cohort and
+# the control would prove nothing. The trailing no-op keeps each harness-named
+# process in the tree rather than letting bash exec it away, which would send the
+# ancestry walk past the fixture into that same real session.
+# shellcheck source=tests/session-signals.sh
+. "$ROOT/tests/session-signals.sh"
+fm_test_clear_signals_argv
+CLEAN=("${FM_TEST_CLEAR_SIGNALS_ARGV[@]}")
+"${CLEAN[@]}" "$FAKE_CLAUDE" -c 'sleep 3; :' &
 LIVE_OWNER_PID=$!
 printf '%s\n' "$LIVE_OWNER_PID" > "$LIVE_OWNER_HOME/state/.lock"
 LIVE_OWNER_RC=0
 printf '%s\n' '{"session_id":"live-owner-control"}' \
-  | FM_HOME="$LIVE_OWNER_HOME" FM_ROOT_OVERRIDE="$PROJECT" "$FAKE_CLAUDE" -c '"$FM_ROOT_OVERRIDE/bin/fm-claude-stop-autoarm.sh"' \
+  | "${CLEAN[@]}" FM_HOME="$LIVE_OWNER_HOME" FM_ROOT_OVERRIDE="$PROJECT" FM_FIX_HOLDER="$LIVE_OWNER_PID" \
+      "$FAKE_CLAUDE" -c '
+        . "$FM_ROOT_OVERRIDE/bin/fm-session-lock-lib.sh"
+        fm_harness_ancestry_pids > "$FM_HOME/state/hook-ancestry"
+        printf "%s\n" "$$" > "$FM_HOME/state/hook-harness-pid"
+        fm_session_same_cohort "$FM_FIX_HOLDER" && printf "yes\n" > "$FM_HOME/state/hook-cohort"
+        "$FM_ROOT_OVERRIDE/bin/fm-claude-stop-autoarm.sh"
+        exit $?
+      ' \
       >"$LAB/live-owner.out" 2>"$LAB/live-owner.err" || LIVE_OWNER_RC=$?
+[ "$(tr -d '[:space:]' < "$LIVE_OWNER_HOME/state/hook-ancestry")" = "$(tr -d '[:space:]' < "$LIVE_OWNER_HOME/state/hook-harness-pid")" ] \
+  || fail "the competing-owner control resolved '$(tr '\n' ' ' < "$LIVE_OWNER_HOME/state/hook-ancestry")' as its harness ancestry instead of its own fixture pid, so the walk left the fixture and the holder is not a separate session"
+[ ! -e "$LIVE_OWNER_HOME/state/hook-cohort" ] \
+  || fail "the competing-owner control's holder was accepted into this session's own cohort, so it no longer tests a separate session"
 [ "$LIVE_OWNER_RC" -eq 0 ] || fail "competing Stop hook returned $LIVE_OWNER_RC while another live session owned the home"
 [ "$(cat "$LIVE_OWNER_HOME/state/.lock")" = "$LIVE_OWNER_PID" ] || fail "competing Stop hook replaced the live session owner"
 [ ! -e "$LIVE_OWNER_HOME/state/arm-ran" ] || fail "competing Stop hook armed while another live session owned the home"
diff --git a/tests/fm-claude-stop-autoarm.test.sh b/tests/fm-claude-stop-autoarm.test.sh
index bbae5f16574..4f5ea8eb6f0 100755
--- a/tests/fm-claude-stop-autoarm.test.sh
+++ b/tests/fm-claude-stop-autoarm.test.sh
@@ -22,6 +22,23 @@ ln -s /bin/bash "$FAKEBIN/claude"
 FAKE_CLAUDE="$FAKEBIN/claude"
 export FAKE_CLAUDE
 
+# Every fake harness this suite starts - the hook's own and the competing holder
+# alike - runs with the session-cohort signals cleared, from the one list
+# tests/lib.sh owns. Without that they inherit the captain session's launch
+# marker and pane id from the environment this suite was started in, which makes
+# the "other harness" holder genuinely part of the hook's own session cohort and
+# quietly turns the competing-session control below into a same-session one.
+#
+# Every fake harness also ends its command list with an explicit `exit $?` after
+# the hook, because bash exec's the last simple command of a `-c` string in place:
+# without that the harness-named process is REPLACED by the hook and disappears
+# from the tree, and the ancestry walk climbs past the fixture into the real
+# session running this suite instead of terminating inside the fixture. A bare
+# trailing no-op keeps the process but discards the hook's exit code, which is
+# itself an asserted outcome here, so the status is passed back explicitly.
+fm_test_clear_signals_argv
+CLEAN=("${FM_TEST_CLEAR_SIGNALS_ARGV[@]}")
+
 # Copy the hook and its sourced dependencies into a fixture checkout.
 install_autoarm_scripts() {
   local dir=$1
@@ -71,9 +88,10 @@ make_crewmate_worktree_dir() {
 run_autoarm() {
   local dir=$1 rc=0
   printf '%s\n' '{"session_id":"sess-autoarm","stop_hook_active":false}' \
-    | FM_HOME="$dir" "$FAKE_CLAUDE" -c '
+    | "${CLEAN[@]}" FM_HOME="$dir" "$FAKE_CLAUDE" -c '
         printf "%s\n" "$$" > "$FM_HOME/state/.lock"
         "$FM_HOME/bin/fm-claude-stop-autoarm.sh"
+        exit $?
       ' 2>&1 || rc=$?
   printf 'RC=%s\n' "$rc" >&2
   return "$rc"
@@ -264,9 +282,10 @@ test_reclaims_stale_session_lock_before_arming() {
   printf '9999999\n' > "$dir/state/.lock"
   write_arm_fixture "$dir" actionable
   out=$(printf '%s\n' '{"session_id":"stale"}' \
-    | FM_HOME="$dir" "$FAKE_CLAUDE" -c '
+    | "${CLEAN[@]}" FM_HOME="$dir" "$FAKE_CLAUDE" -c '
         printf "%s\n" "$$" > "$FM_HOME/state/expected-owner"
         "$FM_HOME/bin/fm-claude-stop-autoarm.sh"
+        exit $?
       ' 2>&1); status=$?
   expect_code 2 "$status" "a dead recorded session owner must be reclaimed before the actionable rewake"
   expected_owner=$(cat "$dir/state/expected-owner")
@@ -277,20 +296,52 @@ test_reclaims_stale_session_lock_before_arming() {
   pass "auto-arm: a demonstrably dead recorded session owner is reclaimed through fm-lock.sh before arming"
 }
 
+# The property the session lock exists for, so this control has to keep meaning
+# what it says: the holder must be a GENUINELY separate session. It reports the
+# two things that decide that - the ancestry the hook resolved, and the cohort
+# verdict on the holder - and asserts them before asserting inertness, because
+# both an inherited launch marker and a fake harness that exec'd itself away turn
+# this fixture into a same-session one that would pass for the wrong reason.
 test_inert_when_lock_held_by_other_harness() {
-  local dir other out status owner_after
+  local dir other out status owner_after harness_pid ancestry suite_ancestry p
   dir=$(make_primary_dir "$TMP_ROOT/other-lock")
   : > "$dir/state/task.meta"
   write_arm_fixture "$dir" actionable
-  # The trailing no-op keeps the fake harness process alive instead of allowing
-  # bash to exec the final sleep into a non-harness process.
-  "$FAKE_CLAUDE" -c 'sleep 60; :' &
+  "${CLEAN[@]}" "$FAKE_CLAUDE" -c 'sleep 60; :' &
   other=$!
   printf '%s\n' "$other" > "$dir/state/.lock"
-  out=$(printf '%s\n' '{"session_id":"s"}' | FM_HOME="$dir" "$FAKE_CLAUDE" -c '"$FM_HOME/bin/fm-claude-stop-autoarm.sh"' 2>&1); status=$?
+  out=$(printf '%s\n' '{"session_id":"s"}' \
+    | "${CLEAN[@]}" FM_HOME="$dir" FM_FIX_HOLDER="$other" "$FAKE_CLAUDE" -c '
+        printf "%s\n" "$$" > "$FM_HOME/state/hook-harness-pid"
+        . "$FM_HOME/bin/fm-session-lock-lib.sh"
+        fm_harness_ancestry_pids > "$FM_HOME/state/hook-ancestry"
+        if fm_session_same_cohort "$FM_FIX_HOLDER"; then
+          printf "yes\n" > "$FM_HOME/state/hook-cohort"
+        else
+          printf "no\n" > "$FM_HOME/state/hook-cohort"
+        fi
+        "$FM_HOME/bin/fm-claude-stop-autoarm.sh"
+        exit $?
+      ' 2>&1); status=$?
   owner_after=$(cat "$dir/state/.lock")
+  harness_pid=$(tr -d '[:space:]' < "$dir/state/hook-harness-pid")
+  ancestry=$(tr '\n' ' ' < "$dir/state/hook-ancestry")
   kill "$other" 2>/dev/null || true
   wait "$other" 2>/dev/null || true
+
+  # Divergence: the walk terminated on the fixture's own harness, so it never
+  # reached the session running this suite, and the holder is genuinely outside
+  # this session's cohort rather than merely uncorroborated.
+  [ "$(printf '%s' "$ancestry" | tr -d '[:space:]')" = "$harness_pid" ] || fail \
+    "the hook resolved '$ancestry' as its harness ancestry instead of the fixture's own pid $harness_pid, so this fixture no longer terminates the walk inside itself"
+  suite_ancestry=$(bash -c '. "$0"; fm_harness_ancestry_pids' "$ROOT/bin/fm-session-lock-lib.sh" 2>/dev/null | tr '\n' ' ' || true)
+  for p in $suite_ancestry; do
+    assert_not_contains " $ancestry " " $p " \
+      "the hook's ancestry reached the session running this suite (pid $p), so the fixture's holder is not a separate session at all"
+  done
+  [ "$(cat "$dir/state/hook-cohort" 2>/dev/null)" = no ] || fail \
+    "the fixture's competing holder was accepted into this session's own cohort, so this control no longer tests a separate session"
+
   expect_code 0 "$status" "hook must stay inert when another live harness holds the session lock"
   [ "$owner_after" = "$other" ] || fail "hook replaced another live harness owner: expected $other, got $owner_after"
   [ ! -e "$dir/state/arm-ran" ] || fail "hook armed while another session owned the lock"
@@ -321,7 +372,8 @@ test_stale_lock_recovery_preserves_afk_and_need_gates() {
   : > "$afk_dir/state/.afk"
   printf '9999999\n' > "$afk_dir/state/.lock"
   write_arm_fixture "$afk_dir" actionable
-  out=$(printf '%s\n' '{"session_id":"stale-afk"}' | FM_HOME="$afk_dir" "$FAKE_CLAUDE" -c '"$FM_HOME/bin/fm-claude-stop-autoarm.sh"' 2>&1); status=$?
+  out=$(printf '%s\n' '{"session_id":"stale-afk"}' \
+    | "${CLEAN[@]}" FM_HOME="$afk_dir" "$FAKE_CLAUDE" -c '"$FM_HOME/bin/fm-claude-stop-autoarm.sh"; exit $?' 2>&1); status=$?
   expect_code 0 "$status" "a stale owner must not widen the AFK gate"
   [ "$(cat "$afk_dir/state/.lock")" = 9999999 ] || fail "AFK stale lock was reclaimed despite away ownership"
   [ ! -e "$afk_dir/state/arm-ran" ] || fail "stale AFK home armed"
@@ -329,7 +381,8 @@ test_stale_lock_recovery_preserves_afk_and_need_gates() {
   idle_dir=$(make_primary_dir "$TMP_ROOT/stale-idle")
   printf '9999999\n' > "$idle_dir/state/.lock"
   write_arm_fixture "$idle_dir" actionable
-  out=$(printf '%s\n' '{"session_id":"stale-idle"}' | FM_HOME="$idle_dir" "$FAKE_CLAUDE" -c '"$FM_HOME/bin/fm-claude-stop-autoarm.sh"' 2>&1); status=$?
+  out=$(printf '%s\n' '{"session_id":"stale-idle"}' \
+    | "${CLEAN[@]}" FM_HOME="$idle_dir" "$FAKE_CLAUDE" -c '"$FM_HOME/bin/fm-claude-stop-autoarm.sh"; exit $?' 2>&1); status=$?
   expect_code 0 "$status" "a stale owner must not widen the supervision-need gate"
   [ "$(cat "$idle_dir/state/.lock")" = 9999999 ] || fail "idle stale lock was reclaimed without supervision need"
   [ ! -e "$idle_dir/state/arm-ran" ] || fail "stale idle home armed"
@@ -350,12 +403,14 @@ test_resolves_outermost_claude_pid_in_nested_bgspare_chain() {
   # so bash cannot tail-exec-collapse it into the outer pid, which would
   # collapse the two-hop chain this test depends on down to one hop.
   out=$(printf '%s\n' '{"session_id":"nested"}' \
-    | FM_HOME="$dir" "$FAKE_CLAUDE" -c '
+    | "${CLEAN[@]}" FM_HOME="$dir" "$FAKE_CLAUDE" -c '
         printf "%s\n" "$$" > "$FM_HOME/state/.lock"
         "$FAKE_CLAUDE" -c "
           printf \"%s\n\" \"\$\$\" > \"\$FM_HOME/state/inner-pid\"
           \"\$FM_HOME/bin/fm-claude-stop-autoarm.sh\"
+          exit \$?
         "
+        exit $?
       ' 2>&1); status=$?
   inner_pid=$(cat "$dir/state/inner-pid" 2>/dev/null || true)
   lock_pid=$(cat "$dir/state/.lock" 2>/dev/null || true)
@@ -651,7 +706,7 @@ test_single_flight_admits_exactly_one_owner() {
   dir=$(make_primary_dir "$TMP_ROOT/single-flight")
   : > "$dir/state/task.meta"
   write_arm_fixture "$dir" slow-actionable
-  FM_HOME="$dir" "$FAKE_CLAUDE" -c '
+  "${CLEAN[@]}" FM_HOME="$dir" "$FAKE_CLAUDE" -c '
     printf "%s\n" "$$" > "$FM_HOME/state/.lock"
     printf "%s\n" "{\"session_id\":\"s\"}" | "$FM_HOME/bin/fm-claude-stop-autoarm.sh" >/dev/null 2>"$FM_HOME/state/err1" &
     p1=$!
@@ -659,6 +714,7 @@ test_single_flight_admits_exactly_one_owner() {
     p2=$!
     wait "$p1"; echo $? > "$FM_HOME/state/rc1"
     wait "$p2"; echo $? > "$FM_HOME/state/rc2"
+    :
   '
   rc1=$(cat "$dir/state/rc1")
   rc2=$(cat "$dir/state/rc2")
diff --git a/tests/fm-context.test.sh b/tests/fm-context.test.sh
new file mode 100755
index 00000000000..428f2413d5c
--- /dev/null
+++ b/tests/fm-context.test.sh
@@ -0,0 +1,407 @@
+#!/usr/bin/env bash
+# Behavior tests for bin/fm-context.sh - the context-window report read from
+# session transcripts rather than from a harness's rendered status line.
+#
+# Every case builds its own transcript world under a temp root and points the
+# script at it with CLAUDE_PROJECTS_ROOT and FM_HOME, so nothing here depends on
+# the running machine's real transcripts or on any live session.
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+command -v jq >/dev/null 2>&1 || { echo "skip: jq not found (required by fm-context.sh)"; exit 0; }
+
+TMP_ROOT=$(fm_test_tmproot fm-context)
+CONTEXT="$ROOT/bin/fm-context.sh"
+BASH_BIN=$(command -v bash)
+
+# --- fixture builders --------------------------------------------------------
+
+# ctx_world <name>: build an isolated home plus its transcript root and echo the
+# world directory. A world is the pair the script reads: FM_HOME (whose
+# state/*.meta name the crew) and CLAUDE_PROJECTS_ROOT (where transcripts live).
+ctx_world() {
+  local world="$TMP_ROOT/$1"
+  mkdir -p "$world/home/state" "$world/transcripts"
+  printf '%s\n' "$world"
+}
+
+# ctx_transcript_dir <world> <session-directory>: echo the transcript directory
+# the script derives for a session whose working directory is <session-directory>,
+# creating it. The mapping (every '/' and '.' becomes '-') is the harness's own
+# on-disk layout; test_unmapped_directory_is_not_read pins that it is load-bearing.
+ctx_transcript_dir() {
+  local world=$1 path=$2 dir
+  dir="$world/transcripts/$(printf '%s' "$path" | tr './' '--')"
+  mkdir -p "$dir"
+  printf '%s\n' "$dir"
+}
+
+# ctx_assistant <model> <input> <cache-creation> <cache-read>: one assistant
+# transcript record carrying usage.
+ctx_assistant() {
+  printf '{"type":"assistant","message":{"model":"%s","usage":{"input_tokens":%s,"cache_creation_input_tokens":%s,"cache_read_input_tokens":%s}}}\n' \
+    "$1" "$2" "$3" "$4"
+}
+
+# ctx_task <world> <id> <worktree>: register a crew task by writing the metadata
+# line the script reads, and echo the task's transcript directory.
+ctx_task() {
+  local world=$1 id=$2 worktree=$3
+  fm_write_meta "$world/home/state/$id.meta" "worktree=$worktree"
+  ctx_transcript_dir "$world" "$worktree"
+}
+
+# ctx_run <world> [args...]: run the script against <world>. Sets CTX_OUT,
+# CTX_RC, and CTX_ERR rather than echoing, so a case can assert on all three.
+ctx_run() {
+  local world=$1
+  shift
+  CTX_OUT=$(CLAUDE_PROJECTS_ROOT="$world/transcripts" FM_HOME="$world/home" \
+    bash "$CONTEXT" "$@" 2>"$world/.stderr")
+  CTX_RC=$?
+  CTX_ERR=$(cat "$world/.stderr")
+}
+
+# ctx_field <json> <label> <field>: read one field of the reported row labelled
+# <label> out of --json output.
+ctx_field() {
+  printf '%s\n' "$1" | jq -r --arg l "$2" --arg f "$3" 'select(.label == $l) | .[$f]'
+}
+
+# --- transcript parsing ------------------------------------------------------
+
+test_usage_comes_from_the_last_assistant_record() {
+  local world dir
+  world=$(ctx_world last-record)
+  dir=$(ctx_transcript_dir "$world" "$world/home")
+  {
+    printf '{"type":"user","message":{"content":"hello"}}\n'
+    ctx_assistant stale-model 1 1 1
+    printf '{"type":"user","message":{"content":"again"}}\n'
+    ctx_assistant current-model 100 200 700
+  } > "$dir/session.jsonl"
+
+  ctx_run "$world" --json --window 100000
+  expect_code 0 "$CTX_RC" "a readable transcript must report cleanly"
+  [ "$(ctx_field "$CTX_OUT" 'this session' used)" = 1000 ] \
+    || fail "used must sum the LAST assistant record's three token fields (100+200+700), got: $CTX_OUT"
+  [ "$(ctx_field "$CTX_OUT" 'this session' model)" = current-model ] \
+    || fail "the model must come from the same record the usage came from, got: $CTX_OUT"
+  pass "fm-context.sh: usage is the last assistant record's input + cache-creation + cache-read"
+}
+
+test_records_without_usage_do_not_erase_the_figure() {
+  local world dir
+  world=$(ctx_world no-usage)
+  dir=$(ctx_transcript_dir "$world" "$world/home")
+  {
+    ctx_assistant real-model 4000 3000 3000
+    printf '{"type":"assistant","message":{"model":"toolresult-only"}}\n'
+    printf '{"type":"summary","summary":"compacted"}\n'
+    printf '{"type":"user","message":{"usage":{"input_tokens":999999}}}\n'
+  } > "$dir/session.jsonl"
+
+  ctx_run "$world" --json --window 100000
+  expect_code 0 "$CTX_RC" "trailing usage-free records must not turn into a failure"
+  [ "$(ctx_field "$CTX_OUT" 'this session' used)" = 10000 ] \
+    || fail "records with no usage, and a user record carrying usage, must not change the figure, got: $CTX_OUT"
+  [ "$(ctx_field "$CTX_OUT" 'this session' model)" = real-model ] \
+    || fail "the model must survive trailing usage-free records, got: $CTX_OUT"
+  pass "fm-context.sh: only assistant records carrying usage move the figure"
+}
+
+test_newest_transcript_wins_and_session_id_overrides_it() {
+  local world dir
+  world=$(ctx_world newest)
+  dir=$(ctx_transcript_dir "$world" "$world/home")
+  ctx_assistant older-model 1000 0 0 > "$dir/older.jsonl"
+  # Age the older file rather than sleeping, so the ordering is exact and free.
+  touch -t 200001010000 "$dir/older.jsonl"
+  ctx_assistant newer-model 40000 0 10000 > "$dir/newer.jsonl"
+
+  ctx_run "$world" --json --window 100000
+  [ "$(ctx_field "$CTX_OUT" 'this session' model)" = newer-model ] \
+    || fail "with no session id, the newest transcript must be reported, got: $CTX_OUT"
+  [ "$(ctx_field "$CTX_OUT" 'this session' used)" = 50000 ] \
+    || fail "the newest transcript's usage must be reported, got: $CTX_OUT"
+
+  CTX_OUT=$(CLAUDE_PROJECTS_ROOT="$world/transcripts" FM_HOME="$world/home" \
+    CLAUDE_CODE_SESSION_ID=older bash "$CONTEXT" --json --window 100000)
+  [ "$(ctx_field "$CTX_OUT" 'this session' model)" = older-model ] \
+    || fail "a known session id must pin its own transcript over the newest one, got: $CTX_OUT"
+  pass "fm-context.sh: newest transcript by default, the named session when its id is known"
+}
+
+test_unmapped_directory_is_not_read() {
+  local world
+  world=$(ctx_world unmapped)
+  # Same basename, but not the derived path-encoded directory name.
+  mkdir -p "$world/transcripts/home"
+  ctx_assistant stray-model 5000 0 0 > "$world/transcripts/home/session.jsonl"
+
+  ctx_run "$world" --json --window 100000
+  expect_code 0 "$CTX_RC" "a world with no matching transcript directory must not fail"
+  [ -z "$CTX_OUT" ] \
+    || fail "a transcript outside the derived directory must not be reported, got: $CTX_OUT"
+  pass "fm-context.sh: only the directory derived from the session path is read"
+}
+
+test_no_transcripts_is_not_a_failure() {
+  local world
+  world=$(ctx_world empty)
+  ctx_run "$world" --window 100000
+  expect_code 0 "$CTX_RC" "an empty world must exit 0, not trip on the absent transcript"
+  [ "$(printf '%s\n' "$CTX_OUT" | wc -l | tr -d ' ')" = 1 ] \
+    || fail "an empty world must print the header and no row, got: $CTX_OUT"
+  assert_contains "$CTX_OUT" "remaining" "the table header must still name its columns"
+  assert_contains "$CTX_OUT" "model" "the table header must still name its columns"
+  pass "fm-context.sh: a world with no transcripts prints the header alone and exits 0"
+}
+
+# --- output shapes -----------------------------------------------------------
+
+test_json_row_shape_and_arithmetic() {
+  local world dir keys
+  world=$(ctx_world json-shape)
+  dir=$(ctx_transcript_dir "$world" "$world/home")
+  ctx_assistant shape-model 30000 0 0 > "$dir/session.jsonl"
+
+  ctx_run "$world" --json --window 100000
+  expect_code 0 "$CTX_RC" "--json must exit 0 with no threshold"
+  [ "$(printf '%s\n' "$CTX_OUT" | wc -l | tr -d ' ')" = 1 ] \
+    || fail "--json must emit exactly one object per line, got: $CTX_OUT"
+  keys=$(printf '%s\n' "$CTX_OUT" | jq -r '[keys_unsorted[]] | sort | join(",")')
+  [ "$keys" = "label,model,remaining,remaining_percent,used,used_percent,window" ] \
+    || fail "--json row keys changed, got: $keys"
+  [ "$(ctx_field "$CTX_OUT" 'this session' window)" = 100000 ] || fail "window must echo --window"
+  [ "$(ctx_field "$CTX_OUT" 'this session' used)" = 30000 ] || fail "used is wrong: $CTX_OUT"
+  [ "$(ctx_field "$CTX_OUT" 'this session' used_percent)" = 30 ] || fail "used_percent is wrong: $CTX_OUT"
+  [ "$(ctx_field "$CTX_OUT" 'this session' remaining)" = 70000 ] || fail "remaining is wrong: $CTX_OUT"
+  [ "$(ctx_field "$CTX_OUT" 'this session' remaining_percent)" = 70 ] || fail "remaining_percent is wrong: $CTX_OUT"
+  # Numbers must be JSON numbers a gate can compare, never quoted strings.
+  printf '%s\n' "$CTX_OUT" | jq -e '(.used | type) == "number" and (.remaining_percent | type) == "number"' >/dev/null \
+    || fail "--json must emit numeric fields, not strings: $CTX_OUT"
+  # Every emitted line must parse, so no table header can contaminate the stream.
+  printf '%s\n' "$CTX_OUT" | jq -e . >/dev/null \
+    || fail "--json emitted a line that is not JSON: $CTX_OUT"
+  pass "fm-context.sh: --json emits one numeric object per session with the documented keys"
+}
+
+test_table_prints_both_used_and_remaining() {
+  local world dir
+  world=$(ctx_world table)
+  dir=$(ctx_transcript_dir "$world" "$world/home")
+  ctx_assistant table-model 25000 0 0 > "$dir/session.jsonl"
+
+  ctx_run "$world" --window 100000
+  expect_code 0 "$CTX_RC" "the table must exit 0 with no threshold"
+  assert_contains "$CTX_OUT" "this session" "the table must label this session"
+  assert_contains "$CTX_OUT" "25000 used ( 25%)" "the table must print the used figure and percent"
+  assert_contains "$CTX_OUT" "75000 left ( 75%)" "the table must print the remaining figure and percent"
+  assert_contains "$CTX_OUT" "table-model" "the table must name the model so a wrong --window is visible"
+  pass "fm-context.sh: the table prints used and remaining together, plus the model"
+}
+
+test_usage_beyond_the_window_clamps_remaining_to_zero() {
+  local world dir
+  world=$(ctx_world over-window)
+  dir=$(ctx_transcript_dir "$world" "$world/home")
+  ctx_assistant over-model 250000 0 0 > "$dir/session.jsonl"
+
+  ctx_run "$world" --json --window 100000
+  [ "$(ctx_field "$CTX_OUT" 'this session' used)" = 250000 ] \
+    || fail "used must report the real consumption even past the window, got: $CTX_OUT"
+  [ "$(ctx_field "$CTX_OUT" 'this session' remaining)" = 0 ] \
+    || fail "remaining must clamp at zero rather than going negative, got: $CTX_OUT"
+  [ "$(ctx_field "$CTX_OUT" 'this session' remaining_percent)" = 0 ] \
+    || fail "remaining_percent must clamp at zero, got: $CTX_OUT"
+  pass "fm-context.sh: usage past the window clamps remaining to zero without hiding the overshoot"
+}
+
+test_an_unreadable_transcript_does_not_take_down_the_report() {
+  local world dir
+  world=$(ctx_world corrupt)
+  dir=$(ctx_transcript_dir "$world" "$world/home")
+  ctx_assistant intact-model 30000 0 0 > "$dir/session.jsonl"
+  dir=$(ctx_task "$world" task-corrupt "$world/wt/corrupt")
+  printf 'not json at all\n{"type":"assistant","message":{\n' > "$dir/session.jsonl"
+
+  ctx_run "$world" --json --window 100000
+  expect_code 0 "$CTX_RC" "one unreadable transcript must not fail the whole report"
+  [ "$(ctx_field "$CTX_OUT" 'this session' used)" = 30000 ] \
+    || fail "the readable sessions must still be reported, got: $CTX_OUT"
+  assert_not_contains "$CTX_OUT" "task-corrupt" "an unreadable transcript must not be reported as a figure"
+  [ -z "$CTX_ERR" ] || fail "an unreadable transcript must not leak parser noise, got: $CTX_ERR"
+  pass "fm-context.sh: an unreadable transcript is skipped, the rest of the fleet still reports"
+}
+
+# --- crew discovery ----------------------------------------------------------
+
+test_crew_tasks_are_reported_from_their_recorded_worktree() {
+  local world dir
+  world=$(ctx_world crew)
+  dir=$(ctx_transcript_dir "$world" "$world/home")
+  ctx_assistant self-model 10000 0 0 > "$dir/session.jsonl"
+  dir=$(ctx_task "$world" task-alpha "$world/wt/alpha")
+  ctx_assistant alpha-model 60000 0 0 > "$dir/session.jsonl"
+  # A task whose metadata records no worktree has no transcript to resolve.
+  fm_write_meta "$world/home/state/task-beta.meta" "window=fm:beta"
+
+  ctx_run "$world" --json --window 100000
+  expect_code 0 "$CTX_RC" "reporting the crew must exit 0 with no threshold"
+  [ "$(ctx_field "$CTX_OUT" task-alpha used)" = 60000 ] \
+    || fail "a crew task must be read from the transcript of its recorded worktree, got: $CTX_OUT"
+  [ "$(ctx_field "$CTX_OUT" 'this session' used)" = 10000 ] \
+    || fail "this session must be reported alongside the crew, got: $CTX_OUT"
+  assert_not_contains "$CTX_OUT" "task-beta" "a task with no recorded worktree must be skipped, not guessed"
+  pass "fm-context.sh: each crew task is read from its own recorded worktree, and a worktree-less task is skipped"
+}
+
+test_task_ids_narrow_the_report_to_the_crew() {
+  local world dir
+  world=$(ctx_world filter)
+  dir=$(ctx_transcript_dir "$world" "$world/home")
+  ctx_assistant self-model 10000 0 0 > "$dir/session.jsonl"
+  dir=$(ctx_task "$world" task-alpha "$world/wt/alpha")
+  ctx_assistant alpha-model 60000 0 0 > "$dir/session.jsonl"
+  dir=$(ctx_task "$world" task-gamma "$world/wt/gamma")
+  ctx_assistant gamma-model 20000 0 0 > "$dir/session.jsonl"
+
+  ctx_run "$world" --json --window 100000 task-gamma
+  expect_code 0 "$CTX_RC" "a named task must report cleanly"
+  assert_contains "$CTX_OUT" '"label":"task-gamma"' "the named task must be reported"
+  assert_not_contains "$CTX_OUT" "task-alpha" "an unnamed task must not be reported"
+  assert_not_contains "$CTX_OUT" "this session" "naming tasks must drop the this-session row"
+
+  ctx_run "$world" --json --window 100000 no-such-task
+  expect_code 0 "$CTX_RC" "an unknown task id must not be an error"
+  [ -z "$CTX_OUT" ] || fail "an unknown task id must report nothing, got: $CTX_OUT"
+  pass "fm-context.sh: task ids narrow the report to those tasks and drop this session"
+}
+
+# --- --threshold gating ------------------------------------------------------
+
+test_threshold_fails_only_below_the_boundary() {
+  local world dir
+  world=$(ctx_world threshold)
+  dir=$(ctx_transcript_dir "$world" "$world/home")
+  # Exactly 40% remaining, so the boundary itself is testable from both sides.
+  ctx_assistant boundary-model 60000 0 0 > "$dir/session.jsonl"
+
+  ctx_run "$world" --json --window 100000
+  [ "$(ctx_field "$CTX_OUT" 'this session' remaining_percent)" = 40 ] \
+    || fail "fixture must sit exactly on the 40% boundary, got: $CTX_OUT"
+
+  ctx_run "$world" --json --window 100000 --threshold 39
+  expect_code 0 "$CTX_RC" "40% remaining is above a 39% threshold"
+  ctx_run "$world" --json --window 100000 --threshold 40
+  expect_code 0 "$CTX_RC" "the threshold is a floor: remaining exactly at it must pass"
+  ctx_run "$world" --json --window 100000 --threshold 41
+  expect_code 1 "$CTX_RC" "40% remaining is below a 41% threshold and must exit 1"
+  pass "fm-context.sh: --threshold exits 1 only strictly below the boundary, 0 at it and above"
+}
+
+test_default_threshold_never_fails() {
+  local world dir
+  world=$(ctx_world no-threshold)
+  dir=$(ctx_transcript_dir "$world" "$world/home")
+  ctx_assistant exhausted-model 100000 0 0 > "$dir/session.jsonl"
+
+  ctx_run "$world" --json --window 100000
+  expect_code 0 "$CTX_RC" "with no --threshold, even zero remaining must report rather than fail"
+  [ "$(ctx_field "$CTX_OUT" 'this session' remaining_percent)" = 0 ] \
+    || fail "fixture must have exhausted the window, got: $CTX_OUT"
+  pass "fm-context.sh: the default threshold reports without ever failing"
+}
+
+test_threshold_reports_every_session_before_failing() {
+  local world dir
+  world=$(ctx_world threshold-fleet)
+  dir=$(ctx_transcript_dir "$world" "$world/home")
+  ctx_assistant roomy-model 10000 0 0 > "$dir/session.jsonl"
+  dir=$(ctx_task "$world" task-tight "$world/wt/tight")
+  ctx_assistant tight-model 95000 0 0 > "$dir/session.jsonl"
+  dir=$(ctx_task "$world" task-roomy "$world/wt/roomy")
+  ctx_assistant spare-model 20000 0 0 > "$dir/session.jsonl"
+
+  ctx_run "$world" --json --window 100000 --threshold 50
+  expect_code 1 "$CTX_RC" "one session below the threshold must fail the whole run"
+  assert_contains "$CTX_OUT" '"label":"task-tight"' "the breaching session must still be reported"
+  assert_contains "$CTX_OUT" '"label":"task-roomy"' "a healthy session after the breach must still be reported"
+  assert_contains "$CTX_OUT" '"label":"this session"' "this session must still be reported"
+  pass "fm-context.sh: a breach fails the run without truncating the report"
+}
+
+# --- refusals ----------------------------------------------------------------
+
+test_bad_invocations_refuse_with_exit_2() {
+  local world
+  world=$(ctx_world refusals)
+
+  ctx_run "$world" --nonsense
+  expect_code 2 "$CTX_RC" "an unknown option must exit 2"
+  assert_contains "$CTX_ERR" "unknown option: --nonsense" "an unknown option must name itself on stderr"
+
+  ctx_run "$world" --window
+  expect_code 2 "$CTX_RC" "--window with no value must exit 2"
+  assert_contains "$CTX_ERR" "--window needs a value" "--window must say what it is missing"
+
+  ctx_run "$world" --threshold
+  expect_code 2 "$CTX_RC" "--threshold with no value must exit 2"
+  assert_contains "$CTX_ERR" "--threshold needs a value" "--threshold must say what it is missing"
+
+  ctx_run "$world" --window 0
+  expect_code 2 "$CTX_RC" "a zero window must exit 2 rather than dividing by it"
+  assert_contains "$CTX_ERR" "--window must be a positive integer" "a zero window must say why"
+
+  ctx_run "$world" --window not-a-number
+  expect_code 2 "$CTX_RC" "a non-numeric window must exit 2"
+  assert_contains "$CTX_ERR" "--window must be a positive integer" "a non-numeric window must say why"
+  pass "fm-context.sh: bad invocations exit 2 with a diagnostic, never a bogus report"
+}
+
+test_missing_jq_refuses_rather_than_reporting_nothing() {
+  local world out rc
+  world=$(ctx_world no-jq)
+  mkdir -p "$world/emptybin"
+  # Absolute interpreter path: the stripped PATH must hide jq from the script,
+  # not hide bash from this test.
+  out=$(PATH="$world/emptybin" CLAUDE_PROJECTS_ROOT="$world/transcripts" \
+    FM_HOME="$world/home" "$BASH_BIN" "$CONTEXT" --json 2>&1)
+  rc=$?
+  expect_code 2 "$rc" "without jq the report must refuse, not print an empty table"
+  assert_contains "$out" "jq is required" "the refusal must name the missing dependency"
+  pass "fm-context.sh: a missing jq is a refusal, not a silently empty report"
+}
+
+test_help_prints_the_usage_contract() {
+  local world
+  world=$(ctx_world help)
+  ctx_run "$world" --help
+  expect_code 0 "$CTX_RC" "--help must exit 0"
+  assert_contains "$CTX_OUT" "Usage: fm-context.sh" "--help must print the usage line"
+  assert_contains "$CTX_OUT" "--threshold" "--help must document --threshold"
+  assert_contains "$CTX_OUT" "--window" "--help must document --window"
+  assert_contains "$CTX_OUT" "--json" "--help must document --json"
+  pass "fm-context.sh: --help prints the usage contract"
+}
+
+test_usage_comes_from_the_last_assistant_record
+test_records_without_usage_do_not_erase_the_figure
+test_newest_transcript_wins_and_session_id_overrides_it
+test_unmapped_directory_is_not_read
+test_no_transcripts_is_not_a_failure
+test_json_row_shape_and_arithmetic
+test_table_prints_both_used_and_remaining
+test_usage_beyond_the_window_clamps_remaining_to_zero
+test_an_unreadable_transcript_does_not_take_down_the_report
+test_crew_tasks_are_reported_from_their_recorded_worktree
+test_task_ids_narrow_the_report_to_the_crew
+test_threshold_fails_only_below_the_boundary
+test_default_threshold_never_fails
+test_threshold_reports_every_session_before_failing
+test_bad_invocations_refuse_with_exit_2
+test_missing_jq_refuses_rather_than_reporting_nothing
+test_help_prints_the_usage_contract
diff --git a/tests/fm-session-lock-ancestry.test.sh b/tests/fm-session-lock-ancestry.test.sh
index d7ac74f3736..dbe87813011 100755
--- a/tests/fm-session-lock-ancestry.test.sh
+++ b/tests/fm-session-lock-ancestry.test.sh
@@ -31,6 +31,34 @@ VERSIONED_CLAUDE="$CLAUDE_VERSION_DIR/2.1.220"
 FAKEBIN=$(fm_fakebin "$TMP_ROOT/harness-bin")
 ln -s /bin/bash "$FAKEBIN/claude"
 NAMED_CLAUDE="$FAKEBIN/claude"
+# A second, DIFFERENT verified harness name, so a case can ask the same question
+# from a session that is not the harness whose marker is in the environment.
+ln -s /bin/bash "$FAKEBIN/codex"
+NAMED_CODEX="$FAKEBIN/codex"
+# A bare interpreter name, so a fixture can be identified as a harness by its
+# script argument alone and by nothing about its own executable.
+ln -s /bin/bash "$FAKEBIN/node"
+NAMED_NODE="$FAKEBIN/node"
+
+# The two ways a REAL Claude Code session's reported command name differs from
+# the bare harness name. Both are the reporter's doing rather than the program's,
+# and both were unidentifiable until the library normalized them, so both are
+# built as real executables here: the name under test is then produced by the
+# kernel and by ps, not by a fixture that was told what to print.
+#
+# Claude Code's installed executable is a single-file Bun build literally named
+# claude.exe, and its background pty worker renames its own task to
+# `claude bg-pty-host`, which the 15-character task-name limit cuts mid-word.
+ln -s /bin/bash "$FAKEBIN/claude.exe"
+SUFFIXED_CLAUDE="$FAKEBIN/claude.exe"
+ln -s /bin/bash "$FAKEBIN/claude bg-pty-host"
+WORKER_CLAUDE="$FAKEBIN/claude bg-pty-host"
+
+# Near misses that differ from a harness name only in ways that normalization
+# must NOT undo, so a widened rule fails here rather than in a real fleet.
+ln -s /bin/bash "$FAKEBIN/claudette"
+ln -s /bin/bash "$FAKEBIN/claude-code"
+ln -s /bin/bash "$FAKEBIN/python3"
 
 # --- unit layer: identity behind a deterministic process table ---------------
 
@@ -134,6 +162,372 @@ SH
   pass "session-lock: ordinary script paths under a harness directory are not harness processes"
 }
 
+# node renames its own main thread, so an npm-installed harness reports
+# `MainThread` and no interpreter name at all. Identity then has to come from
+# the script path in argv - and only from there, by exact basename, so a name any
+# node program can present cannot carry a harness verdict on its own.
+#
+# Every case below pins the `MainThread` branch and nothing else. An interpreter
+# that reports its own name (`node`, `python3`) reaches a separate rule that stops
+# at the first flag in the same way but reads whole path components rather than a
+# basename, and the case after this one pins that rule on its own shapes.
+test_node_main_thread_identity_comes_only_from_the_script_path() {
+  local dir fakebin shape
+  dir="$TMP_ROOT/main-thread"
+  fakebin=$(fm_fakebin "$dir")
+  mkdir -p "$dir/state"
+  cat > "$fakebin/ps" <<'SH'
+#!/usr/bin/env bash
+set -u
+field= pid=
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    -o) field=$2; shift 2 ;;
+    -p) pid=$2; shift 2 ;;
+    *) shift ;;
+  esac
+done
+case "$pid:$field:${FM_TEST_NODE_SHAPE:-harness}" in
+  760:comm=:*) printf '%s\n' MainThread ;;
+  760:args=:harness) printf '%s\n' 'node /home/u/.nvm/versions/node/v24.16.0/bin/codex' ;;
+  760:args=:flagged) printf '%s\n' 'node --enable-source-maps /home/u/.nvm/versions/node/v24.16.0/bin/codex' ;;
+  760:args=:sibling) printf '%s\n' 'node /work/codex-notes/build.js' ;;
+  760:args=:flag) printf '%s\n' 'node /work/tools/run.js --profile codex' ;;
+  760:args=:optionpath) printf '%s\n' 'node /work/tools/run.js --config /etc/codex/config.toml' ;;
+  760:args=:requirepath) printf '%s\n' 'node --require /opt/hooks/claude/instrument.js /srv/app/server.js' ;;
+  760:args=:evalpath) printf '%s\n' 'node -e require("/opt/claude/x")' ;;
+  760:args=:requirejoined) printf '%s\n' 'node --require=/opt/x/claude /srv/app.js' ;;
+  760:args=:loadervalue) printf '%s\n' 'node --loader /opt/tools/pi /srv/app.js' ;;
+  760:args=:shortjoined) printf '%s\n' 'node -r/opt/x/codex /srv/app.js' ;;
+  760:args=:bare) printf '%s\n' 'node' ;;
+  760:ppid=:*) printf '%s\n' 1 ;;
+  *:comm=:*) printf '%s\n' bash ;;
+  *:args=:*) printf '%s\n' 'bash /repo/bin/fm-lock.sh' ;;
+  *:ppid=:*) printf '%s\n' 760 ;;
+esac
+SH
+  chmod +x "$fakebin/ps"
+  printf '760\n' > "$dir/state/.lock"
+
+  # The plain shape is the one a real npm-installed codex reports, and the one
+  # this branch exists for.
+  FM_TEST_NODE_SHAPE=harness lib_eval "$fakebin" 'fm_harness_pid_alive 760' \
+    || fail "an npm-installed harness reporting MainThread was not recognized as a harness at all"
+  FM_TEST_NODE_SHAPE=harness lib_eval "$fakebin" "fm_session_lock_owned_by_self '$dir/state'" \
+    || fail "a MainThread-named harness session could not recognize its own lock"
+
+  # Nothing else in an interpreter's argv may be read as a harness: not a script
+  # merely living beside a harness-shaped name, not a passing argument that
+  # happens to be one whether bare or the value of an option, and above all not
+  # the path-shaped VALUE of an interpreter flag, which can be named anything at
+  # all - `/opt/x/claude` and `/opt/tools/pi` included - and is the interpreter's
+  # own argument rather than the program being run.
+  #
+  # `flagged` is a DELIBERATE refusal, not an oversight: once any flag precedes
+  # the script this branch stops guessing which token is the script, because the
+  # alternative is an allowlist of value-taking interpreter flags that would rot
+  # silently as vendors add them. Do not restore a scan to make it pass; teach it
+  # a shape only from a real release that reports it.
+  for shape in flagged sibling flag optionpath requirepath evalpath requirejoined loadervalue shortjoined bare; do
+    if FM_TEST_NODE_SHAPE="$shape" lib_eval "$fakebin" 'fm_harness_pid_alive 760'; then
+      fail "$shape: a node program reporting MainThread whose script is not the one plain token after the interpreter was treated as a harness"
+    fi
+    if FM_TEST_NODE_SHAPE="$shape" lib_eval "$fakebin" "fm_session_lock_owned_by_self '$dir/state'"; then
+      fail "$shape: a node program reporting MainThread claimed a home's session lock"
+    fi
+  done
+  pass "session-lock: a MainThread-named harness is identified from the one plain script token, and only from there"
+}
+
+# An interpreter that reports its OWN exec name (`node`, `python3`) never reaches
+# the MainThread branch above, so it has its own rule: the argv tokens before the
+# first flag, matched by whole path component. The component rule rather than that
+# branch's exact basename is what identifies a node-hosted harness whose bin entry
+# is not named after the harness, which is the only shape this rule identifies at
+# all.
+#
+# Every negative below was observed classifying as a Claude harness when this rule
+# read the whole argument string instead, so each is a real regression guard.
+test_bare_interpreter_identity_stops_at_the_first_flag() {
+  local dir fakebin shape kind
+  dir="$TMP_ROOT/bare-interpreter"
+  fakebin=$(fm_fakebin "$dir")
+  mkdir -p "$dir/state"
+  cat > "$fakebin/ps" <<'SH'
+#!/usr/bin/env bash
+set -u
+field= pid=
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    -o) field=$2; shift 2 ;;
+    -p) pid=$2; shift 2 ;;
+    *) shift ;;
+  esac
+done
+case "$pid:$field:${FM_TEST_ARGV_SHAPE:-claudecli}" in
+  770:comm=:pyconfig|770:comm=:pisensors) printf '%s\n' python3 ;;
+  770:comm=:*) printf '%s\n' node ;;
+  770:args=:claudecli) printf '%s\n' 'node /path/to/claude/cli.js' ;;
+  770:args=:codexcli) printf '%s\n' 'node /opt/tools/codex/cli.js' ;;
+  770:args=:codexthenclaudearg) printf '%s\n' 'node /opt/tools/codex/cli.js --config /etc/claude/x.toml' ;;
+  770:args=:hookarg) printf '%s\n' 'node /srv/app/server.js --hooks /home/u/.claude/hooks.json' ;;
+  770:args=:transcriptarg) printf '%s\n' 'node /srv/x/server.js --transcript /home/u/.claude/p/t.jsonl' ;;
+  770:args=:requirepath) printf '%s\n' 'node --require /opt/hooks/claude/instrument.js /srv/app.js' ;;
+  770:args=:pyconfig) printf '%s\n' 'python3 /srv/app.py --config /etc/claude/x.toml' ;;
+  770:args=:flagged) printf '%s\n' 'node --experimental-foo /path/to/claude/cli.js' ;;
+  770:args=:dotcomponent) printf '%s\n' 'node /srv/app/server.js /home/u/.claude/hooks.json' ;;
+  770:args=:pihome) printf '%s\n' 'node /home/pi/app.js' ;;
+  770:args=:pisensors) printf '%s\n' 'python3 /home/pi/sensors/read.py' ;;
+  770:args=:piscript) printf '%s\n' 'node /opt/tools/pi' ;;
+  770:args=:bare) printf '%s\n' 'node' ;;
+  770:ppid=:*) printf '%s\n' 1 ;;
+  *:comm=:*) printf '%s\n' bash ;;
+  *:args=:*) printf '%s\n' 'bash /repo/bin/fm-lock.sh' ;;
+  *:ppid=:*) printf '%s\n' 770 ;;
+esac
+SH
+  chmod +x "$fakebin/ps"
+  printf '770\n' > "$dir/state/.lock"
+
+  # A node-hosted harness whose bin entry is `cli.js` is identified by the harness
+  # component of its install path, and by nothing else in this file.
+  for shape in claudecli codexcli codexthenclaudearg; do
+    FM_TEST_ARGV_SHAPE="$shape" lib_eval "$fakebin" 'fm_harness_pid_alive 770' \
+      || fail "$shape: a node-hosted harness under a harness-named install path was not recognized as a harness"
+    FM_TEST_ARGV_SHAPE="$shape" lib_eval "$fakebin" "fm_session_lock_owned_by_self '$dir/state'" \
+      || fail "$shape: a node-hosted harness session could not recognize its own lock"
+  done
+
+  # `pi` and `pi-signed` are anchored names, so they carry a verdict here only as
+  # the token's own basename. `/home/pi` is the Raspberry Pi OS default home, so an
+  # interior-component reading would turn ordinary node and python services into
+  # verified Pi harnesses and wedge a real session out of its own home.
+  FM_TEST_ARGV_SHAPE=piscript lib_eval "$fakebin" 'fm_harness_pid_alive 770' \
+    || fail "a script named exactly pi was not identified as the Pi harness"
+
+  # Identification here never carries the cohort's acceptance decision: an
+  # argument list is data the process was handed, not the program it is running,
+  # so none of these shapes names a harness kind.
+  for shape in claudecli codexcli codexthenclaudearg; do
+    if kind=$(FM_TEST_ARGV_SHAPE="$shape" lib_eval "$fakebin" 'fm_harness_pid_kind 770'); then
+      fail "$shape: a harness named only in an argument list was typed as '$kind' for the cohort's acceptance decision"
+    fi
+  done
+
+  # Nothing at or after the first flag may decide the verdict, because a flag's
+  # value is a path that can be named anything at all, and a component that merely
+  # STARTS with a harness name is not one either - `.claude` is not `claude`.
+  #
+  # `flagged` is a DELIBERATE refusal, not an oversight: once any flag precedes the
+  # script this rule stops guessing which token is the script, because the
+  # alternative is an allowlist of value-taking interpreter flags that would rot
+  # silently as vendors add them. Do not restore a whole-argv match to make it
+  # pass; teach it a shape only from a real release that reports it.
+  for shape in hookarg transcriptarg requirepath pyconfig flagged dotcomponent pihome pisensors bare; do
+    if FM_TEST_ARGV_SHAPE="$shape" lib_eval "$fakebin" 'fm_harness_pid_alive 770'; then
+      fail "$shape: an interpreter argument at or after the first flag carried a harness verdict"
+    fi
+    if FM_TEST_ARGV_SHAPE="$shape" lib_eval "$fakebin" "fm_session_lock_owned_by_self '$dir/state'"; then
+      fail "$shape: an unrelated interpreted program claimed a home's session lock"
+    fi
+    if FM_TEST_ARGV_SHAPE="$shape" lib_eval "$fakebin" 'fm_harness_pid_kind 770'; then
+      fail "$shape: an unrelated interpreted program was named as a harness kind"
+    fi
+  done
+  pass "session-lock: a bare interpreter is identified from the argv path components before the first flag"
+}
+
+# The cohort's acceptance decision is typed from EXECUTABLE identity alone: the
+# reported command name's own basename, or a whole path component of that command
+# name or of argv[0]. A launch marker proves a launch relationship rather than
+# identity, so a codex session started from inside a Claude session carries a
+# truthful CLAUDE_PID naming that holder; the process name is the only thing that
+# separates it from the rehosted Claude session the marker path exists to accept,
+# so an argument list may not decide it.
+#
+# Every shape below is identified for the ancestry walk exactly as it was. What
+# this case pins is which of them may open the marker path.
+test_acceptance_typing_comes_only_from_executable_identity() {
+  local dir fakebin shape kind
+  dir="$TMP_ROOT/acceptance-typing"
+  fakebin=$(fm_fakebin "$dir")
+  mkdir -p "$dir/state"
+  cat > "$fakebin/ps" <<'SH'
+#!/usr/bin/env bash
+set -u
+field= pid=
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    -o) field=$2; shift 2 ;;
+    -p) pid=$2; shift 2 ;;
+    *) shift ;;
+  esac
+done
+case "$pid:$field:${FM_TEST_EXEC_SHAPE:-nativepath}" in
+  780:comm=:nativepath) printf '%s\n' 2.1.220 ;;
+  780:args=:nativepath) printf '%s\n' '/home/u/.local/share/claude/versions/2.1.220 --resume' ;;
+  780:comm=:binentry) printf '%s\n' claude ;;
+  780:args=:binentry) printf '%s\n' '/usr/local/bin/claude' ;;
+  780:comm=:codexname) printf '%s\n' codex ;;
+  780:args=:codexname) printf '%s\n' 'codex' ;;
+  780:comm=:suffixed) printf '%s\n' claude.exe ;;
+  780:args=:suffixed) printf '%s\n' '/home/u/.nvm/versions/node/v24.16.0/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe --resume' ;;
+  780:comm=:worker) printf '%s\n' 'claude bg-pty-h' ;;
+  780:args=:worker) printf '%s\n' '/home/u/.nvm/versions/node/v24.16.0/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe bg-pty-host' ;;
+  780:comm=:npmpath) printf '%s\n' node ;;
+  780:args=:npmpath) printf '%s\n' 'node /home/u/.nvm/versions/node/v24.16.0/lib/node_modules/@anthropic-ai/claude-code/bin/cli.js' ;;
+  780:comm=:nearmiss) printf '%s\n' claude-code ;;
+  780:args=:nearmiss) printf '%s\n' '/opt/vendor/claude-code --serve' ;;
+  780:comm=:lookalike) printf '%s\n' claudette ;;
+  780:args=:lookalike) printf '%s\n' '/opt/claudette/bin/claudette' ;;
+  780:comm=:pylike) printf '%s\n' python3 ;;
+  780:args=:pylike) printf '%s\n' 'python3 /srv/app.py --config /etc/claude/x.toml' ;;
+  780:comm=:mainthread) printf '%s\n' MainThread ;;
+  780:args=:mainthread) printf '%s\n' 'node /home/u/.nvm/versions/node/v24.16.0/bin/codex' ;;
+  780:comm=:*) printf '%s\n' node ;;
+  780:args=:nodehosted) printf '%s\n' 'node /path/to/claude/cli.js' ;;
+  780:args=:positional) printf '%s\n' 'node /srv/app/server.js /opt/claude/agent.json' ;;
+  780:args=:hookflag) printf '%s\n' 'node /srv/app/server.js --hooks /home/u/.claude/hooks.json' ;;
+  780:args=:pihome) printf '%s\n' 'node /home/pi/app.js' ;;
+  780:ppid=:*) printf '%s\n' 1 ;;
+  *:comm=:*) printf '%s\n' bash ;;
+  *:args=:*) printf '%s\n' 'bash /repo/bin/fm-lock.sh' ;;
+  *:ppid=:*) printf '%s\n' 780 ;;
+esac
+SH
+  chmod +x "$fakebin/ps"
+
+  # A harness whose own executable names it may open the marker path: Claude
+  # Code's version-named native install through its install path, and an ordinary
+  # harness-named bin entry through its basename.
+  for shape in nativepath binentry; do
+    kind=$(FM_TEST_EXEC_SHAPE="$shape" lib_eval "$fakebin" 'fm_harness_pid_kind 780' | tr -d '[:space:]')
+    [ "$kind" = claude ] || fail "$shape: a real Claude install typed as '$kind' rather than claude, so its own accept path is closed"
+  done
+  kind=$(FM_TEST_EXEC_SHAPE=codexname lib_eval "$fakebin" 'fm_harness_pid_kind 780' | tr -d '[:space:]')
+  [ "$kind" = codex ] || fail "a codex-named executable typed as '$kind' rather than codex"
+
+  # The command name a real install reports, with the path deliberately unable to
+  # carry the verdict: the npm layout's own directory is `claude-code`, which is
+  # no harness component, so `suffixed` and `worker` can only be typed by the
+  # command name itself. `npmpath` is the same argv with the harness named
+  # nowhere else, and it must stay untyped - that is both the divergence proof
+  # for the two cases above and the node-hosted limit the library states.
+  for shape in suffixed worker; do
+    kind=$(FM_TEST_EXEC_SHAPE="$shape" lib_eval "$fakebin" 'fm_harness_pid_kind 780' | tr -d '[:space:]')
+    [ "$kind" = claude ] || fail "$shape: the command name a real Claude Code install reports typed as '${kind:-nothing}' rather than claude, so its own session start refuses its home and degrades to read-only while it is the only session alive"
+  done
+  if kind=$(FM_TEST_EXEC_SHAPE=npmpath lib_eval "$fakebin" 'fm_harness_pid_kind 780'); then
+    fail "the npm install path alone typed as '$kind', so the two cases above prove nothing about the command name"
+  fi
+
+  # Normalization strips two reporting artifacts before the SAME exact-equality
+  # test; it must never become a prefix rule. Each name below shares a prefix
+  # with a verified harness and is not one.
+  for shape in nearmiss lookalike pylike; do
+    if kind=$(FM_TEST_EXEC_SHAPE="$shape" lib_eval "$fakebin" 'fm_harness_pid_kind 780'); then
+      fail "$shape: a name that merely starts like a harness typed as '$kind', so an unrelated process could be accepted as a session's own harness"
+    fi
+  done
+
+  # A harness named nowhere but in an argument list stays identified, and still
+  # gets no accept path. That is the fail-closed direction and it is deliberate:
+  # the alternative accepts a different harness that merely inherited the marker.
+  for shape in nodehosted mainthread positional; do
+    FM_TEST_EXEC_SHAPE="$shape" lib_eval "$fakebin" 'fm_harness_pid_alive 780' \
+      || fail "$shape: the shape this case is about stopped being identified at all, so it no longer tests the acceptance narrowing"
+    if kind=$(FM_TEST_EXEC_SHAPE="$shape" lib_eval "$fakebin" 'fm_harness_pid_kind 780'); then
+      fail "$shape: a harness named only in an argument list was typed as '$kind', so an inherited launch marker could be believed for it"
+    fi
+  done
+
+  # A shape that is no harness at all names nothing either way.
+  for shape in hookflag pihome; do
+    if FM_TEST_EXEC_SHAPE="$shape" lib_eval "$fakebin" 'fm_harness_pid_kind 780'; then
+      fail "$shape: an unrelated interpreted program was typed for the cohort's acceptance decision"
+    fi
+  done
+  pass "session-lock: cohort acceptance is typed from executable identity and never from an argument list"
+}
+
+# Start a real background process under executable <1> and print its pid once the
+# real ps can see it. The trailing no-op is what stops bash from exec'ing the
+# sleep into its own pid, which would replace the command name this is all about.
+start_named_process() {  # <path>
+  local bin=$1 pid comm i=0
+  "$bin" -c 'while :; do sleep 0.2; done; :' >/dev/null 2>&1 &
+  pid=$!
+  COHORT_PIDS+=("$pid")
+  while [ "$i" -lt 200 ]; do
+    comm=$(ps -o comm= -p "$pid" 2>/dev/null | tr -d '\n')
+    [ -n "$comm" ] && { printf '%s\n' "$pid"; return 0; }
+    sleep 0.05
+    i=$((i + 1))
+  done
+  fail "the fixture process for $bin never became visible to ps"
+}
+
+# The reporter produces the name here, not a fixture. Every case above hands the
+# library a command name a fake ps was told to print, and that is precisely the
+# blind spot that let a real install shape go unidentified: a stub can only report
+# a name someone already thought of, so every fixture in this suite named its
+# executable exactly `claude` and none of them could see a suffixed or truncated
+# name at all. These processes are real, their names come from real executables,
+# and the name under test is read back through the same ps the library calls.
+#
+# Each case drives the two signals apart on purpose: the verdict is asked of the
+# observed command name with NO argument list at all, so the command name is the
+# only thing that can carry it, and the divergence between that name and the bare
+# harness name is asserted first so the case cannot pass vacuously if a platform
+# stops producing the artifact.
+test_real_reported_command_names_are_typed_for_acceptance() {
+  local pid comm base kind name
+  for name in "$SUFFIXED_CLAUDE" "$WORKER_CLAUDE"; do
+    pid=$(start_named_process "$name")
+    comm=$(ps -o comm= -p "$pid" 2>/dev/null | tr -d '\n')
+    base=${comm##*/}
+    [ -n "$base" ] || fail "ps reported no command name at all for the fixture process from $name"
+    [ "$base" != claude ] || fail \
+      "$name was reported as the bare name 'claude', so this platform no longer reproduces the reporting artifact and the case would pass without testing it"
+    kind=$(lib_probe "fm_harness_exec_kind '$base' ''" | tr -d '[:space:]') || kind=
+    [ "$kind" = claude ] || fail \
+      "a real process reporting command name '$comm' typed as '${kind:-nothing}' rather than claude. This is the shape Claude Code actually runs as, so its own session start would refuse its home and degrade to read-only while it is the only session alive."
+    kind=$(lib_probe "fm_harness_pid_kind $pid" | tr -d '[:space:]') || kind=
+    [ "$kind" = claude ] || fail \
+      "the live-pid reading disagreed with the command-name reading for '$comm': it typed as '${kind:-nothing}'"
+    kill "$pid" 2>/dev/null || true
+  done
+
+  # The truncation is a property of the reporter, so pin that it really happened
+  # rather than trusting the length arithmetic: a name the reporter shortened must
+  # still be more than the bare harness name.
+  pid=$(start_named_process "$WORKER_CLAUDE")
+  comm=$(ps -o comm= -p "$pid" 2>/dev/null | tr -d '\n')
+  case "${comm##*/}" in
+    'claude '*) : ;;
+    *) fail "the worker fixture reported '$comm', which is not the multi-word command name this case exists to cover" ;;
+  esac
+  kill "$pid" 2>/dev/null || true
+
+  # Real processes whose names differ from a harness only in ways normalization
+  # must not undo. A widened rule fails here rather than in a real fleet.
+  for name in claudette claude-code node python3; do
+    pid=$(start_named_process "$FAKEBIN/$name")
+    comm=$(ps -o comm= -p "$pid" 2>/dev/null | tr -d '\n')
+    base=${comm##*/}
+    [ "$base" = "$name" ] || fail \
+      "the negative control for $name reported command name '$comm', so it is no longer the name this case means to refuse"
+    if kind=$(lib_probe "fm_harness_exec_kind '$base' ''"); then
+      fail "a real process named '$name' typed as '$kind', so an unrelated process could be accepted as a session's own harness and take over its home"
+    fi
+    if kind=$(lib_probe "fm_harness_pid_kind $pid"); then
+      fail "a real process named '$name' typed as '$kind' through its live pid, so an unrelated process could be accepted as a session's own harness"
+    fi
+    kill "$pid" 2>/dev/null || true
+  done
+  pass "session-lock: the command names a real install reports are typed for acceptance, and near misses still are not"
+}
+
 test_harness_beyond_a_gap_never_owns_the_lock() {
   local dir fakebin got
   dir="$TMP_ROOT/gap"
@@ -259,11 +653,18 @@ make_primary_home() {  # <dir>
   cat > "$dir/session.sh" <<'SH'
 #!/usr/bin/env bash
 if [ "${FM_FIXTURE_ORPHAN_HERE:-0}" = 1 ]; then
+  launcher=${FM_FIXTURE_LAUNCHER:-$(ps -o ppid= -p $$ 2>/dev/null | tr -d ' ')}
+  parent=$launcher
   i=0
-  while [ "$i" -lt 200 ] && [ "$(ps -o ppid= -p $$ 2>/dev/null | tr -d ' ')" != 1 ]; do
+  while [ "$i" -lt 200 ]; do
+    parent=$(ps -o ppid= -p $$ 2>/dev/null | tr -d ' ')
+    if [ -n "$parent" ] && [ "$parent" != "$launcher" ]; then
+      break
+    fi
     sleep 0.05
     i=$((i + 1))
   done
+  printf 'launcher=%s parent=%s\n' "$launcher" "$parent" > "$FM_HOME/state/reparented"
 fi
 printf '%s\n' "$$" > "$FM_HOME/state/session-pid"
 printf '%s\n' "$$" > "$FM_HOME/state/.lock"
@@ -272,11 +673,18 @@ printf '%s\n' "$?" > "$FM_HOME/state/hook.rc"
 SH
   cat > "$dir/daemon.sh" <<'SH'
 #!/usr/bin/env bash
+launcher=${FM_FIXTURE_LAUNCHER:-$(ps -o ppid= -p $$ 2>/dev/null | tr -d ' ')}
+parent=$launcher
 i=0
-while [ "$i" -lt 200 ] && [ "$(ps -o ppid= -p $$ 2>/dev/null | tr -d ' ')" != 1 ]; do
+while [ "$i" -lt 200 ]; do
+  parent=$(ps -o ppid= -p $$ 2>/dev/null | tr -d ' ')
+  if [ -n "$parent" ] && [ "$parent" != "$launcher" ]; then
+    break
+  fi
   sleep 0.05
   i=$((i + 1))
 done
+printf 'launcher=%s parent=%s\n' "$launcher" "$parent" > "$FM_HOME/state/daemon-reparented"
 printf '%s\n' "$$" > "$FM_HOME/state/daemon-pid"
 "$FM_SESSION_BIN" "$FM_HOME/session.sh"
 exit 0
@@ -284,18 +692,36 @@ SH
   chmod +x "$dir/session.sh" "$dir/daemon.sh"
 }
 
+# Assert that a fixture really was reparented away from the launcher that started
+# it, and print the pid it was reparented TO.
+#
+# Comparing against pid 1 is not enough to detect that: on a host with a process
+# subreaper - systemd --user on modern Linux - an orphan is reparented to the
+# subreaper rather than to init, so a fixture that waited for pid 1 waited out its
+# whole timeout and then ran anyway. Each fixture records both pids so the
+# detached shape every case below depends on is asserted rather than assumed.
+assert_reparented() {  # <report> <what>
+  local report=$1 what=$2 text launcher parent
+  text=$(cat "$report" 2>/dev/null || true)
+  launcher=$(printf '%s\n' "$text" | sed -n 's/^launcher=\([0-9]*\) .*$/\1/p')
+  parent=$(printf '%s\n' "$text" | sed -n 's/^.* parent=\([0-9]*\)$/\1/p')
+  [ -n "$launcher" ] && [ -n "$parent" ] && [ "$launcher" != "$parent" ] \
+    || fail "$what was never reparented away from its launcher, so this fixture no longer reproduces a detached session (recorded: ${text:-nothing})"
+  printf '%s\n' "$parent"
+}
+
 # Start the fixture tree detached from this suite's own process tree: the
-# launcher exits immediately, so the tree is reparented to init and the ancestry
+# launcher exits immediately, so the tree is reparented away from it and the ancestry
 # walk terminates inside the fixture. Returns once the hook has recorded its exit
 # code.
 run_fixture_tree() {  # <dir> <session-bin> [<daemon-bin>]
   local dir=$1 session_bin=$2 daemon_bin=${3:-} i
   if [ -n "$daemon_bin" ]; then
     FM_HOME="$dir" FM_SESSION_BIN="$session_bin" FM_FIXTURE_ORPHAN_HERE=0 \
-      bash -c '"$0" "$1" &' "$daemon_bin" "$dir/daemon.sh"
+      bash -c 'FM_FIXTURE_LAUNCHER=$$ "$0" "$1" &' "$daemon_bin" "$dir/daemon.sh"
   else
     FM_HOME="$dir" FM_FIXTURE_ORPHAN_HERE=1 \
-      bash -c '"$0" "$1" &' "$session_bin" "$dir/session.sh"
+      bash -c 'FM_FIXTURE_LAUNCHER=$$ "$0" "$1" &' "$session_bin" "$dir/session.sh"
   fi
   i=0
   while [ "$i" -lt 400 ] && [ ! -s "$dir/state/hook.rc" ]; do
@@ -303,6 +729,11 @@ run_fixture_tree() {  # <dir> <session-bin> [<daemon-bin>]
     i=$((i + 1))
   done
   [ -s "$dir/state/hook.rc" ] || fail "the fixture hook never finished"
+  if [ -n "$daemon_bin" ]; then
+    assert_reparented "$dir/state/daemon-reparented" "the fixture daemon" >/dev/null
+  else
+    assert_reparented "$dir/state/reparented" "the fixture session" >/dev/null
+  fi
 }
 
 hook_rc() {
@@ -356,10 +787,1128 @@ test_e2e_daemon_parented_version_named_session_keeps_its_lock() {
   pass "session-lock e2e: a version-named session under a harness-named daemon keeps its own lock"
 }
 
+
+# --- session-cohort layer: real processes whose tree is not their session ----
+#
+# These cases run real processes and no harness. The shape they reproduce is a
+# harness rehosting a session's work under its own pty: the resulting tree is
+# orphaned away from its launcher and never reaches the pid that holds the lock,
+# so ancestry alone reports one genuine session as two competing ones.
+#
+# Every fixture clears every environment signal the library reads before setting
+# the ones its case means to drive, so a value inherited from the developer's
+# own live session can never decide a verdict here. Each case also asserts the
+# signals it drove APART, so a case whose fixture stopped diverging fails
+# instead of passing on an accident.
+fm_test_clear_signals_argv
+COHORT_ENV_ARGV=("${FM_TEST_CLEAR_SIGNALS_ARGV[@]}")
+
+COHORT_PIDS=()
+COHORT_TMUX_SOCKET="fm-session-lock-cohort-$$"
+cohort_cleanup() {
+  local p
+  for p in "${COHORT_PIDS[@]:-}"; do
+    [ -n "$p" ] || continue
+    kill -CONT "$p" 2>/dev/null || true
+    kill -TERM "$p" 2>/dev/null || true
+  done
+  if command -v tmux >/dev/null 2>&1; then
+    tmux -L "$COHORT_TMUX_SOCKET" kill-server >/dev/null 2>&1 || true
+  fi
+}
+trap 'cohort_cleanup; fm_test_cleanup' EXIT
+trap 'cohort_cleanup; fm_test_cleanup; exit 130' INT
+trap 'cohort_cleanup; fm_test_cleanup; exit 143' TERM
+
+# Build one fixture home. The three scripts are deliberately separate processes:
+# the holder must outlive the check, the session must be able to orphan itself,
+# and the check must run BELOW the session so the ancestry walk starts where a
+# real hook starts.
+make_cohort_fixture() {  # <dir>
+  local dir=$1
+  mkdir -p "$dir/state"
+  # A process a verified-harness name identifies. The trailing no-op keeps bash
+  # from exec'ing the sleep and losing that name.
+  cat > "$dir/holder.sh" <<'SH'
+#!/usr/bin/env bash
+printf '%s\n' "$$" > "$FM_FIX/holder-pid"
+sleep 120
+:
+SH
+  # A harness session. It overwrites the launch marker with its OWN pid for its
+  # children, exactly as a real session does, so the pid that STARTED it
+  # survives only in its exec-time environment and the check below has to reach
+  # it through the ancestry rather than through its own inherited value.
+  cat > "$dir/session.sh" <<'SH'
+#!/usr/bin/env bash
+export CLAUDE_PID=$$
+printf '%s\n' "$$" > "$FM_FIX/session-pid"
+if [ "${FM_FIX_ORPHAN:-0}" = 1 ]; then
+  launcher=${FM_FIXTURE_LAUNCHER:-$(ps -o ppid= -p $$ 2>/dev/null | tr -d ' ')}
+  parent=$launcher
+  i=0
+  while [ "$i" -lt 200 ]; do
+    parent=$(ps -o ppid= -p $$ 2>/dev/null | tr -d ' ')
+    if [ -n "$parent" ] && [ "$parent" != "$launcher" ]; then
+      break
+    fi
+    sleep 0.05
+    i=$((i + 1))
+  done
+  printf 'launcher=%s parent=%s\n' "$launcher" "$parent" > "$FM_FIX/reparented"
+fi
+bash "$FM_FIX/check.sh"
+printf '%s\n' "$?" > "$FM_FIX/check-finished"
+SH
+  # One report of every signal the verdict rests on, so each case can assert the
+  # verdict AND the divergence that produced it.
+  cat > "$dir/check.sh" <<'SH'
+#!/usr/bin/env bash
+set -u
+# shellcheck source=/dev/null
+. "$FM_FIX_LIB"
+{
+  printf 'ancestry=%s\n' "$(fm_harness_ancestry_pids 2>/dev/null | tr '\n' ' ')"
+  printf 'container_self=%s\n' "$(fm_session_container_self 2>/dev/null || printf NONE)"
+  printf 'container_holder=%s\n' "$(fm_session_container_of_pid "$FM_FIX_HOLDER" 2>/dev/null || printf NONE)"
+  printf 'tty_self=%s\n' "$(fm_session_tty_of_pid "$$" 2>/dev/null || printf NONE)"
+  printf 'tty_holder=%s\n' "$(fm_session_tty_of_pid "$FM_FIX_HOLDER" 2>/dev/null || printf NONE)"
+  printf 'launcher_self=%s\n' "$(fm_session_launcher_pid "$$" claude 2>/dev/null || printf NONE)"
+  printf 'kind_self=%s\n' "$(fm_harness_ancestry_pids 2>/dev/null | while IFS= read -r m; do
+    [ -n "$m" ] || continue
+    printf '%s ' "$(fm_harness_pid_kind "$m" 2>/dev/null || printf NONE)"
+  done)"
+  printf 'kind_holder=%s\n' "$(fm_harness_pid_kind "$FM_FIX_HOLDER" 2>/dev/null || printf NONE)"
+  printf 'launcher_ancestry=%s\n' "$(fm_harness_ancestry_pids 2>/dev/null | while IFS= read -r m; do
+    [ -n "$m" ] || continue
+    printf '%s ' "$(fm_session_launcher_pid "$m" claude 2>/dev/null || printf NONE)"
+  done)"
+  printf 'launcher_holder=%s\n' "$(fm_session_launcher_pid "$FM_FIX_HOLDER" claude 2>/dev/null || printf NONE)"
+  if fm_session_lock_owned_by_self "$FM_FIX/state"; then printf 'owned=yes\n'; else printf 'owned=no\n'; fi
+  if fm_session_lock_holder_competes "$FM_FIX_HOLDER"; then printf 'competes=yes\n'; else printf 'competes=no\n'; fi
+} > "$FM_FIX/${FM_FIX_OUT:-check}.out" 2> "$FM_FIX/${FM_FIX_OUT:-check}.err"
+SH
+  chmod +x "$dir/holder.sh" "$dir/session.sh" "$dir/check.sh"
+}
+
+wait_for_file() {  # <path> <what>
+  local path=$1 what=$2 i=0
+  while [ "$i" -lt 400 ] && [ ! -s "$path" ]; do
+    sleep 0.05
+    i=$((i + 1))
+  done
+  [ -s "$path" ] || fail "$what never appeared"
+  tr -d '[:space:]' < "$path"
+}
+
+# Start the holder as an ordinary background child and publish its pid in
+# COHORT_HOLDER_PID. It is deliberately NOT captured through a command
+# substitution: a long-lived background process holds that pipe open for its
+# whole lifetime, and the capture would block instead of returning a pid.
+COHORT_HOLDER_PID=
+start_cohort_holder() {  # <dir> <container-var-assignments...>
+  local dir=$1
+  shift
+  "${COHORT_ENV_ARGV[@]}" FM_FIX="$dir" "$@" "$NAMED_CLAUDE" "$dir/holder.sh" \
+    > "$dir/holder.out" 2>&1 &
+  COHORT_PIDS+=("$!")
+  COHORT_HOLDER_PID=$(wait_for_file "$dir/holder-pid" "the fixture holder pid")
+}
+
+# Start the session detached, so the launcher exits immediately and the tree is
+# reparented onto whatever adopts orphans here: the ancestry walk then terminates
+# inside the fixture and can never reach the live session running this suite.
+run_cohort_session() {  # <dir> <holder-pid> <launch-marker-pid> <env-assignments...>
+  local dir=$1 holder=$2 marker=$3
+  shift 3
+  printf '%s\n' "$holder" > "$dir/state/.lock"
+  "${COHORT_ENV_ARGV[@]}" FM_FIX="$dir" FM_FIX_LIB="$LIB" FM_FIX_HOLDER="$holder" \
+    FM_FIX_ORPHAN=1 CLAUDE_PID="$marker" "$@" \
+    bash -c 'FM_FIXTURE_LAUNCHER=$$ "$0" "$1" &' "$NAMED_CLAUDE" "$dir/session.sh"
+  wait_for_file "$dir/check-finished" "the fixture check result" >/dev/null
+  assert_reparented "$dir/reparented" "the fixture session" >/dev/null
+}
+
+cohort_field() {  # <dir> <key>
+  cohort_field_of "$1" check "$2"
+}
+
+# The same field from one named report, for a case that checks the same fixture
+# more than once.
+cohort_field_of() {  # <dir> <report> <key>
+  sed -n "s/^$3=//p" "$1/$2.out" 2>/dev/null
+}
+
+cohort_report() {  # <dir>
+  cohort_report_of "$1" check
+}
+
+cohort_report_of() {  # <dir> <report>
+  printf '%s' "--- observed signals ($2) ---"$'\n'"$(cat "$1/$2.out" 2>/dev/null)"
+}
+
+# The headline case: the lock names a live harness the process tree cannot
+# reach, and it is nonetheless this session's own. Before the launch marker was
+# consulted, every session start in this shape refused its own home and degraded
+# to read-only while exactly one session existed.
+test_rehosted_session_owns_the_lock_it_cannot_reach() {
+  local dir holder session
+  dir="$TMP_ROOT/cohort-rehosted"
+  make_cohort_fixture "$dir"
+  start_cohort_holder "$dir" HERDR_ENV=1 HERDR_PANE_ID=fixture-pane
+  holder=$COHORT_HOLDER_PID
+  run_cohort_session "$dir" "$holder" "$holder" HERDR_ENV=1 HERDR_PANE_ID=fixture-pane
+  session=$(tr -d '[:space:]' < "$dir/session-pid")
+
+  # Divergence, asserted so this case cannot pass on an accidentally intact tree.
+  assert_not_contains " $(cohort_field "$dir" ancestry)" " $holder " \
+    "the holder was still inside the ancestry, so this fixture no longer reproduces a rehosted session"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" launcher_self)" = "$session" ] || fail \
+    "the session did not overwrite the launch marker for its children, so the ancestry walk was never exercised"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" container_self)" = "herdr=fixture-pane" ] || fail \
+    "the fixture lost its own container signal"$'\n'"$(cohort_report "$dir")"
+
+  [ "$(cohort_field "$dir" owned)" = yes ] || fail \
+    "a session reached only through the launch marker did not recognize its own lock"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" competes)" = no ] || fail \
+    "this session's own lock holder was treated as a competing session"$'\n'"$(cohort_report "$dir")"
+  pass "session-lock: a session rehosted outside its own process tree still owns its lock"
+}
+
+# The mirror of the case above, and the shape ownership converges into: every
+# acquisition rewrites the lock onto the acquiring session's own pid, so once a
+# background session has claimed the home the lock names the session that was
+# STARTED while the attended window session is the one asking whether it still
+# owns its home. The relationship is then only readable in reverse - the holder's
+# own recorded launch marker names this session - and while only the forward
+# direction existed this shape moved the read-only degradation onto the window
+# session for as long as the session it launched kept running.
+test_launching_session_owns_a_lock_naming_the_session_it_started() {
+  local dir window holder reparent
+  dir="$TMP_ROOT/cohort-reverse"
+  make_cohort_fixture "$dir"
+  # The window session. It exports its own pid as the launch marker for
+  # everything it starts, exactly as a real session does, then starts the second
+  # session detached so that session is orphaned away from it and the two are
+  # unreachable from each other's process tree in either direction.
+  cat > "$dir/window.sh" <<'SH'
+#!/usr/bin/env bash
+set -u
+export CLAUDE_PID=$$
+printf '%s\n' "$$" > "$FM_FIX/window-pid"
+launcher=${FM_FIXTURE_LAUNCHER:-$(ps -o ppid= -p $$ 2>/dev/null | tr -d ' ')}
+parent=$launcher
+i=0
+while [ "$i" -lt 200 ]; do
+  parent=$(ps -o ppid= -p $$ 2>/dev/null | tr -d ' ')
+  if [ -n "$parent" ] && [ "$parent" != "$launcher" ]; then
+    break
+  fi
+  sleep 0.05
+  i=$((i + 1))
+done
+printf 'launcher=%s parent=%s\n' "$launcher" "$parent" > "$FM_FIX/window-reparented"
+bash -c '"$0" "$1" &' "$FM_FIX_CLAUDE" "$FM_FIX/holder.sh"
+i=0
+while [ "$i" -lt 400 ] && [ ! -s "$FM_FIX/holder-pid" ]; do
+  sleep 0.05
+  i=$((i + 1))
+done
+holder=$(tr -d '[:space:]' < "$FM_FIX/holder-pid")
+printf '%s\n' "$holder" > "$FM_FIX/state/.lock"
+export FM_FIX_HOLDER="$holder"
+bash "$FM_FIX/check.sh"
+check_rc=$?
+FM_HOME="$FM_FIX" "$FM_FIX_ROOT/bin/fm-lock.sh" > "$FM_FIX/lock.out" 2>&1
+printf '%s\n' "$?" > "$FM_FIX/lock.rc"
+printf '%s\n' "$check_rc" > "$FM_FIX/check-finished"
+SH
+  chmod +x "$dir/window.sh"
+  "${COHORT_ENV_ARGV[@]}" FM_FIX="$dir" FM_FIX_LIB="$LIB" FM_FIX_CLAUDE="$NAMED_CLAUDE" \
+    FM_FIX_ROOT="$ROOT" HERDR_ENV=1 HERDR_PANE_ID=fixture-pane \
+    bash -c 'FM_FIXTURE_LAUNCHER=$$ "$0" "$1" &' "$NAMED_CLAUDE" "$dir/window.sh"
+  window=$(wait_for_file "$dir/window-pid" "the fixture window session pid")
+  holder=$(wait_for_file "$dir/holder-pid" "the pid of the session the window session started")
+  COHORT_PIDS+=("$holder" "$window")
+  wait_for_file "$dir/check-finished" "the fixture check result" >/dev/null
+  reparent=$(assert_reparented "$dir/window-reparented" "the fixture window session")
+  # Whatever adopted the orphan - init, or a subreaper such as systemd --user - is
+  # not a verified harness, so the walk still terminates inside the fixture.
+  assert_not_contains " $(cohort_field "$dir" ancestry) " " $reparent " \
+    "the ancestry walk crossed into the process that adopted the fixture, so it no longer terminates inside the fixture"$'\n'"$(cohort_report "$dir")"
+
+  # Divergence, so the verdict can only be coming from the reverse direction:
+  # the holder is outside the ancestry, and no marker on this side of the pair
+  # names it.
+  assert_contains " $(cohort_field "$dir" ancestry) " " $window " \
+    "the window session was not in its own harness ancestry, so this fixture no longer reproduces the shape"$'\n'"$(cohort_report "$dir")"
+  assert_not_contains " $(cohort_field "$dir" ancestry) " " $holder " \
+    "the launched session was still inside the window session's ancestry, so ancestry alone could have decided this"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" launcher_self)" = "$window" ] || fail \
+    "the window session did not publish its own pid as the launch marker its children inherit"$'\n'"$(cohort_report "$dir")"
+  assert_not_contains " $(cohort_field "$dir" launcher_ancestry) " " $holder " \
+    "a marker on this side of the pair named the holder, so the forward direction was not driven out"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" launcher_holder)" = "$window" ] || fail \
+    "the launched session did not record the window session as its launcher, so nothing was left to relate them"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" container_self)" = "$(cohort_field "$dir" container_holder)" ] || fail \
+    "the fixture lost the co-location the relationship is AND-ed with"$'\n'"$(cohort_report "$dir")"
+
+  [ "$(cohort_field "$dir" owned)" = yes ] || fail \
+    "the window session did not recognize a lock naming the session it started as its own home"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" competes)" = no ] || fail \
+    "the session this one started was treated as a competing session"$'\n'"$(cohort_report "$dir")"
+
+  # And the acquisition that follows says what it did. Converging one session's
+  # own lock onto its own pid is not a home changing hands, and the two members of
+  # a launcher/launched pair print this at each other on every session start.
+  [ "$(tr -d '[:space:]' < "$dir/lock.rc")" = 0 ] || fail \
+    "acquiring the home from inside its own cohort failed: $(cat "$dir/lock.out" 2>/dev/null)"
+  assert_contains "$(cat "$dir/lock.out")" "converged onto this session's own holder pid $holder" \
+    "acquisition did not name the holder it converged onto"
+  assert_not_contains "$(cat "$dir/lock.out")" "not recognised as a harness" \
+    "a live holder in this session's own cohort was reported as unidentified"
+  assert_not_contains "$(cat "$dir/lock.out")" "took over from" \
+    "acquisition told this session it took the home over from itself"
+  pass "session-lock: a session still owns its home once the lock names the session it started"
+}
+
+# A launch marker is an ordinary environment variable, so a harness the captain
+# starts from inside a Claude session inherits CLAUDE_PID naming that session.
+# Believing it would hand a live Claude captain's home to a genuinely separate
+# codex session, which is the one thing the lock exists to refuse, so a marker row
+# is consulted only when the asking session and the holder are both the harness it
+# was verified for.
+#
+# The two cases below run the SAME fixture and differ only in which harness asks,
+# so neither can pass by never reaching the marker path: the codex asker must be
+# refused, and the claude asker must still converge.
+# Called DIRECTLY and never through a command substitution, for the same reason
+# start_cohort_holder is: the holder pid it registers for cleanup would be
+# appended to a subshell copy of COHORT_PIDS and discarded, leaving a live
+# harness-named process behind after the suite exits. The holder pid is published
+# in COHORT_HOLDER_PID rather than printed.
+cross_harness_fixture() {  # <dir> <asker-bin> [<asker-script>]
+  local dir=$1 asker_bin=$2 holder
+  local script=${3:-$dir/asker.sh}
+  make_cohort_fixture "$dir"
+  mkdir -p "$(dirname -- "$script")"
+  # The asker runs the check and then the REAL acquisition as its own children, so
+  # the ancestry walk starts below it exactly as a hook's does. It is started from
+  # this suite, whose shell is not a harness, so its harness ancestry is itself
+  # alone - the shape the cross-harness ask actually has.
+  cat > "$script" <<'SH'
+#!/usr/bin/env bash
+set -u
+printf '%s\n' "$$" > "$FM_FIX/asker-pid"
+bash "$FM_FIX/check.sh"
+FM_HOME="$FM_FIX" "$FM_FIX_ROOT/bin/fm-lock.sh" > "$FM_FIX/lock.out" 2>&1
+printf '%s\n' "$?" > "$FM_FIX/lock.rc"
+SH
+  chmod +x "$script"
+  start_cohort_holder "$dir" HERDR_ENV=1 HERDR_PANE_ID=fixture-pane
+  holder=$COHORT_HOLDER_PID
+  printf '%s\n' "$holder" > "$dir/state/.lock"
+  "${COHORT_ENV_ARGV[@]}" FM_FIX="$dir" FM_FIX_LIB="$LIB" FM_FIX_HOLDER="$holder" \
+    FM_FIX_ROOT="$ROOT" CLAUDE_PID="$holder" HERDR_ENV=1 HERDR_PANE_ID=fixture-pane \
+    "$asker_bin" "$script"
+}
+
+test_a_different_harness_never_believes_an_inherited_launch_marker() {
+  local dir holder asker
+  dir="$TMP_ROOT/cohort-cross-harness"
+  cross_harness_fixture "$dir" "$NAMED_CODEX"
+  holder=$COHORT_HOLDER_PID
+  asker=$(tr -d '[:space:]' < "$dir/asker-pid")
+
+  # Divergence: the marker IS present and DOES name the holder, and co-location
+  # holds, so only the harness scoping can be producing the refusal.
+  [ "$(cohort_field "$dir" launcher_self)" = "$holder" ] || fail \
+    "the fixture did not carry an inherited marker naming the holder, so its refusal proves nothing"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" container_self)" = "$(cohort_field "$dir" container_holder)" ] || fail \
+    "the fixture lost the co-location this case AND-s the relationship with"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" kind_holder)" = claude ] || fail \
+    "the fixture holder did not resolve as a claude harness"$'\n'"$(cohort_report "$dir")"
+  [ "$(printf '%s' "$(cohort_field "$dir" kind_self)" | tr -d '[:space:]')" = codex ] || fail \
+    "the asking session did not resolve as codex alone, so this fixture no longer reproduces a cross-harness ask"$'\n'"$(cohort_report "$dir")"
+
+  [ "$(cohort_field "$dir" owned)" = no ] || fail \
+    "a codex session accepted a live claude session's lock as its own"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" competes)" = yes ] || fail \
+    "a live claude holder was not treated as a competing session by a codex asker"$'\n'"$(cohort_report "$dir")"
+  [ "$(tr -d '[:space:]' < "$dir/lock.rc")" = 1 ] || fail \
+    "acquisition did not refuse: rc=$(cat "$dir/lock.rc") out=$(cat "$dir/lock.out")"
+  assert_contains "$(cat "$dir/lock.out")" "another live firstmate session holds the lock" \
+    "acquisition refused for some reason other than the competing live session"
+  [ "$(tr -d '[:space:]' < "$dir/state/.lock")" = "$holder" ] || fail \
+    "acquisition wrote the codex pid over a live claude holder: got $(cat "$dir/state/.lock"), holder $holder, asker $asker"
+  pass "session-lock: a different harness never believes a launch marker it merely inherited"
+}
+
+# The third asker on the same fixture: a Claude session identified ONLY by its
+# script argument. It is a harness for the ancestry walk and it carries the same
+# inherited marker naming the same live holder, so the only thing refusing it is
+# that its own executable names no harness. This is the fail-closed half of the
+# acceptance narrowing, and the case below shows the identical fixture converging
+# once the asker's own executable does name it.
+test_a_session_named_only_in_argv_gets_no_accept_path() {
+  local dir holder asker
+  dir="$TMP_ROOT/cohort-argv-named"
+  cross_harness_fixture "$dir" "$NAMED_NODE" "$dir/claude/cli.js"
+  holder=$COHORT_HOLDER_PID
+  asker=$(tr -d '[:space:]' < "$dir/asker-pid")
+
+  # Divergence: the asker IS a resolved harness ancestry, the marker IS present
+  # and DOES name the holder, and co-location holds, so the refusal can only come
+  # from the acceptance typing.
+  assert_contains " $(cohort_field "$dir" ancestry)" " $asker " \
+    "the argv-named asker was not identified as a harness at all, so this case tests the ancestry walk rather than the acceptance typing"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" launcher_self)" = "$holder" ] || fail \
+    "the fixture did not carry an inherited marker naming the holder, so its refusal proves nothing"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" container_self)" = "$(cohort_field "$dir" container_holder)" ] || fail \
+    "the fixture lost the co-location this case AND-s the relationship with"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" kind_holder)" = claude ] || fail \
+    "the fixture holder did not resolve as a claude harness"$'\n'"$(cohort_report "$dir")"
+  [ "$(printf '%s' "$(cohort_field "$dir" kind_self)" | tr -d '[:space:]')" = NONE ] || fail \
+    "the argv-named asker was typed for acceptance after all, so this fixture no longer reproduces the narrowing"$'\n'"$(cohort_report "$dir")"
+
+  [ "$(cohort_field "$dir" owned)" = no ] || fail \
+    "a session named only in its argument list opened the marker accept path"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" competes)" = yes ] || fail \
+    "a live claude holder was not treated as a competing session by an argv-named asker"$'\n'"$(cohort_report "$dir")"
+  [ "$(tr -d '[:space:]' < "$dir/lock.rc")" = 1 ] || fail \
+    "acquisition did not refuse: rc=$(cat "$dir/lock.rc") out=$(cat "$dir/lock.out")"
+  assert_contains "$(cat "$dir/lock.out")" "another live firstmate session holds the lock" \
+    "acquisition refused for some reason other than the competing live session"
+  [ "$(tr -d '[:space:]' < "$dir/state/.lock")" = "$holder" ] || fail \
+    "acquisition wrote the argv-named pid over a live claude holder: got $(cat "$dir/state/.lock"), holder $holder, asker $asker"
+  pass "session-lock: a session named only in its argument list gets no launch-marker accept path"
+}
+
+test_the_same_harness_still_converges_on_the_identical_fixture() {
+  local dir holder asker
+  dir="$TMP_ROOT/cohort-same-harness"
+  cross_harness_fixture "$dir" "$NAMED_CLAUDE"
+  holder=$COHORT_HOLDER_PID
+  asker=$(tr -d '[:space:]' < "$dir/asker-pid")
+
+  [ "$(cohort_field "$dir" launcher_self)" = "$holder" ] || fail \
+    "the fixture did not carry the marker this case rests on"$'\n'"$(cohort_report "$dir")"
+  [ "$(printf '%s' "$(cohort_field "$dir" kind_self)" | tr -d '[:space:]')" = claude ] || fail \
+    "the asking session did not resolve as claude, so this case does not diverge from the one above"$'\n'"$(cohort_report "$dir")"
+
+  [ "$(cohort_field "$dir" owned)" = yes ] || fail \
+    "the same-harness cohort stopped recognizing its own holder, which is the authorized fix for the original defect"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" competes)" = no ] || fail \
+    "the same-harness cohort treated its own holder as a competitor"$'\n'"$(cohort_report "$dir")"
+  [ "$(tr -d '[:space:]' < "$dir/lock.rc")" = 0 ] || fail \
+    "acquisition failed for a same-harness cohort: $(cat "$dir/lock.out")"
+  assert_contains "$(cat "$dir/lock.out")" "converged onto this session's own holder pid $holder" \
+    "acquisition did not name the holder it converged onto"
+  [ "$(tr -d '[:space:]' < "$dir/state/.lock")" = "$asker" ] || fail \
+    "acquisition did not converge the lock onto the acquiring session: expected $asker, got $(cat "$dir/state/.lock")"
+  pass "session-lock: the same harness still converges on the identical fixture"
+}
+
+# The property the lock exists for. Same pane, same terminal, same everything a
+# co-location signal can see - and no launch relationship, so it is a second
+# agent started by hand in the captain's seat and must still be refused.
+test_colocated_session_without_a_launch_relationship_is_refused() {
+  local dir holder stranger
+  dir="$TMP_ROOT/cohort-colocated-stranger"
+  make_cohort_fixture "$dir"
+  start_cohort_holder "$dir" HERDR_ENV=1 HERDR_PANE_ID=fixture-pane
+  holder=$COHORT_HOLDER_PID
+  stranger=$(nonexistent_cohort_pid)
+  run_cohort_session "$dir" "$holder" "$stranger" HERDR_ENV=1 HERDR_PANE_ID=fixture-pane
+
+  # Divergence: co-location is fully present, so only the missing relationship
+  # can be producing the refusal.
+  [ "$(cohort_field "$dir" container_self)" = "$(cohort_field "$dir" container_holder)" ] || fail \
+    "the fixture failed to co-locate the stranger, so its refusal proves nothing"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" container_self)" != NONE ] || fail \
+    "the fixture produced no container signal at all, so its refusal proves nothing"$'\n'"$(cohort_report "$dir")"
+
+  [ "$(cohort_field "$dir" owned)" = no ] || fail \
+    "a separate concurrent session sharing one pane was accepted as this session's own"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" competes)" = yes ] || fail \
+    "a separate concurrent session sharing one pane was not treated as a competitor"$'\n'"$(cohort_report "$dir")"
+  pass "session-lock: co-location alone never grants ownership of another session's home"
+}
+
+# The mirror control: the launch relationship alone is not enough either, so a
+# recycled holder pid in an unrelated container cannot be claimed.
+test_related_session_in_another_container_is_refused() {
+  local dir holder
+  dir="$TMP_ROOT/cohort-elsewhere"
+  make_cohort_fixture "$dir"
+  start_cohort_holder "$dir" HERDR_ENV=1 HERDR_PANE_ID=holder-pane
+  holder=$COHORT_HOLDER_PID
+  run_cohort_session "$dir" "$holder" "$holder" HERDR_ENV=1 HERDR_PANE_ID=session-pane
+
+  [ "$(cohort_field "$dir" container_self)" != "$(cohort_field "$dir" container_holder)" ] || fail \
+    "the fixture failed to separate the two containers, so its refusal proves nothing"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" owned)" = no ] || fail \
+    "a launch marker alone granted ownership across two different containers"$'\n'"$(cohort_report "$dir")"
+  pass "session-lock: a launch relationship alone never grants ownership across containers"
+}
+
+nonexistent_cohort_pid() {
+  local pid=999999
+  while kill -0 "$pid" 2>/dev/null; do
+    pid=$((pid + 1))
+  done
+  printf '%s\n' "$pid"
+}
+
+# Evaluate one library expression against the REAL process table, with the same
+# cleared signal environment every fixture uses.
+lib_probe() {  # <expression>
+  "${COHORT_ENV_ARGV[@]}" bash -c ". \"\$0\"; $1" "$LIB"
+}
+
+# The same, asked from a harness-named process, so this session has a resolvable
+# harness ancestry. The marker path requires one on the asking side - ownership is
+# a claim only a harness session can make - so a case that drives the marker path
+# has to ask from a harness rather than from a bare shell, whose ancestry depends
+# on whether the developer happens to be running the suite inside a live session.
+harness_probe() {  # <expression>
+  "${COHORT_ENV_ARGV[@]}" "$NAMED_CLAUDE" -c ". \"\$0\"
+$1
+exit \$?" "$LIB"
+}
+
+cohort_tmux() {
+  tmux -L "$COHORT_TMUX_SOCKET" "$@"
+}
+
+cohort_tmux_ready() {
+  command -v tmux >/dev/null 2>&1 || return 1
+  cohort_tmux has-session -t cohort 2>/dev/null && return 0
+  cohort_tmux new-session -d -s cohort -n control -c "$TMP_ROOT" 2>/dev/null
+}
+
+# A dead or recycled holder pid must never be matched through EITHER direction,
+# so liveness is decided before any recorded identity of the holder is read.
+# Driven with a recorded environment that satisfies every cohort signal at once,
+# behind two pids that differ only in whether they are alive.
+test_liveness_is_decided_before_any_recorded_cohort_signal() {
+  local dir holder dead
+  dir="$TMP_ROOT/cohort-liveness-first"
+  make_cohort_fixture "$dir"
+  start_cohort_holder "$dir"
+  holder=$COHORT_HOLDER_PID
+  dead=$(nonexistent_cohort_pid)
+
+  # Positive control: with the same recorded identity behind a LIVE harness pid,
+  # every signal the cohort proof reads is satisfied and the pid is accepted.
+  cohort_probe_recorded_identity "$dir/proc" "$holder" \
+    || fail "the recorded identity this case drives did not relate a live holder at all, so its refusal below would prove nothing"
+  if cohort_probe_recorded_identity "$dir/proc" "$dead"; then
+    fail "a dead pid whose recorded identity named this session was accepted as its own holder, so a recycled pid can be claimed"
+  fi
+  pass "session-lock: a dead holder pid is refused before its recorded identity is consulted"
+}
+
+# Populate a fabricated proc root with the /proc/<pid>/stat lines the marker
+# ordering reads. `copy` takes a live process's REAL line, so a case can drive
+# the ordering from actual process start times; `write` fabricates one with a
+# chosen start time, for a case whose relationship the real times cannot express.
+# The comm sits in parentheses exactly as the kernel writes it, so the reader
+# under test parses a fabricated line the same way it parses a real one.
+make_stat_tool() {  # <proc-root>
+  local root=$1
+  mkdir -p "$root"
+  cat > "$root/stat-tool.sh" <<'SH'
+#!/usr/bin/env bash
+set -u
+mode=$1
+root=$2
+pid=$3
+mkdir -p "$root/$pid"
+case "$mode" in
+  copy) cat "/proc/$pid/stat" > "$root/$pid/stat" ;;
+  write) printf '%s (claude) S 1 1 1 0 -1 0 0 0 0 0 0 0 0 0 20 0 1 0 %s 0 0\n' "$pid" "$4" > "$root/$pid/stat" ;;
+  *) exit 2 ;;
+esac
+SH
+}
+
+# Ask the cohort question about <pid> with a fabricated recorded environment for
+# it under proc root <root>: a launch marker naming the asking process, plus the
+# container the asking process is in. Both cohort signals are then satisfiable,
+# so only liveness is left to decide the verdict.
+#
+# The recorded start times are fabricated to AGREE with the relationship the
+# environ claims - the asking process launched the holder, so the holder starts
+# one tick later - because the marker path also requires that ordering. The real
+# holder here was started before the probe, so copying its real start time would
+# make this fixture assert an impossible launch and refuse for that reason
+# instead of the one under test. The case below drives that ordering apart on
+# purpose.
+cohort_probe_recorded_identity() {  # <proc-root> <pid>
+  local root=$1 pid=$2
+  mkdir -p "$root/$pid"
+  make_stat_tool "$root"
+  harness_probe "
+    HERDR_ENV=1
+    HERDR_PANE_ID=fixture-pane
+    FM_PROC_ROOT_OVERRIDE='$root'
+    bash '$root/stat-tool.sh' copy '$root' \"\$\$\"
+    bash '$root/stat-tool.sh' write '$root' $pid \$(( \$(fm_session_pid_start_time \"\$\$\") + 1 ))
+    printf 'CLAUDE_PID=%s\0HERDR_ENV=1\0HERDR_PANE_ID=fixture-pane\0' \"\$\$\" > '$root/$pid/environ'
+    fm_session_same_cohort $pid
+  "
+}
+
+# The launch relationship is a number compared against a live pid, so a pid the
+# kernel has recycled onto an unrelated session of the same harness satisfies a
+# stale marker on identity alone. Ordering is what tells the two apart: a
+# launcher necessarily starts before whatever inherited its environment.
+#
+# Both cases below run the SAME fixture, with the SAME marker naming the SAME
+# live claude-typed holder and the same co-location, and differ ONLY in whether
+# the recorded start times can express the launch the marker claims. Neither can
+# pass by never reaching the marker path, because the other one must accept.
+cohort_probe_forward_marker() {  # <dir> real|launched
+  local dir=$1 order=$2 root="$1/proc"
+  mkdir -p "$dir"
+  make_stat_tool "$root"
+  cat > "$dir/probe.sh" <<'SH'
+# Runs INSIDE a claude-named process with the library already sourced, so this
+# process is the asking session and its own start time is the carrier's.
+set -u
+i=0
+# The holder is started HERE, so it genuinely starts after the asking process
+# and cannot be the launcher the marker below claims it is. The pause puts it
+# several clock ticks later rather than one: the ordering rule deliberately
+# accepts an equal tick, because a real launcher and the child it spawns can
+# share one, so a holder started in the same instant would prove nothing.
+sleep 0.3
+# The trailing no-op keeps bash from exec'ing the sleep and losing its name.
+"$FM_FIX_CLAUDE" -c 'printf "%s\n" "$$" > "$1/holder-pid"; sleep 120; :' _ "$FM_FIX_DIR" &
+while [ "$i" -lt 400 ] && [ ! -s "$FM_FIX_DIR/holder-pid" ]; do
+  sleep 0.05
+  i=$((i + 1))
+done
+holder=$(tr -d '[:space:]' < "$FM_FIX_DIR/holder-pid")
+bash "$FM_FIX_ROOT/stat-tool.sh" copy "$FM_FIX_ROOT" "$$"
+case "$FM_FIX_ORDER" in
+  # The holder's REAL line, so its actual start time decides.
+  real) bash "$FM_FIX_ROOT/stat-tool.sh" copy "$FM_FIX_ROOT" "$holder" ;;
+  # A start time that agrees with the claim: our launcher predates us.
+  launched) bash "$FM_FIX_ROOT/stat-tool.sh" write "$FM_FIX_ROOT" "$holder" \
+    $(( $(fm_session_pid_start_time "$$") - 1 )) ;;
+esac
+printf 'HERDR_ENV=1\0HERDR_PANE_ID=fixture-pane\0' > "$FM_FIX_ROOT/$holder/environ"
+printf 'CLAUDE_PID=%s\0HERDR_ENV=1\0HERDR_PANE_ID=fixture-pane\0' "$holder" > "$FM_FIX_ROOT/$$/environ"
+{
+  printf 'holder=%s\n' "$holder"
+  printf 'launcher_self=%s\n' "$(fm_session_launcher_pid "$$" claude 2>/dev/null || printf NONE)"
+  printf 'kind_holder=%s\n' "$(fm_harness_pid_kind "$holder" 2>/dev/null || printf NONE)"
+  printf 'container_self=%s\n' "$(fm_session_container_self 2>/dev/null || printf NONE)"
+  printf 'container_holder=%s\n' "$(fm_session_container_of_pid "$holder" 2>/dev/null || printf NONE)"
+  printf 'start_self=%s\n' "$(fm_session_pid_start_time "$$" 2>/dev/null || printf NONE)"
+  printf 'start_holder=%s\n' "$(fm_session_pid_start_time "$holder" 2>/dev/null || printf NONE)"
+} > "$FM_FIX_DIR/report"
+fm_session_same_cohort "$holder"
+SH
+  harness_probe "
+    HERDR_ENV=1
+    HERDR_PANE_ID=fixture-pane
+    FM_PROC_ROOT_OVERRIDE='$root'
+    FM_FIX_ROOT='$root'
+    FM_FIX_DIR='$dir'
+    FM_FIX_CLAUDE='$NAMED_CLAUDE'
+    FM_FIX_ORDER='$order'
+    . '$dir/probe.sh'
+  "
+}
+
+forward_field() {  # <dir> <key>
+  sed -n "s/^$2=//p" "$1/report"
+}
+
+test_a_recycled_holder_pid_cannot_satisfy_a_stale_launch_marker() {
+  local ok bad
+  ok="$TMP_ROOT/cohort-marker-ordered"
+  bad="$TMP_ROOT/cohort-marker-recycled"
+
+  # Positive control on the identical fixture: with a start time that can express
+  # the launch the marker claims, the relationship is still accepted. Without it
+  # the refusal below could come from anything.
+  cohort_probe_forward_marker "$ok" launched \
+    || fail "a marker naming a holder that predates this process stopped being a launch relationship"$'\n'"$(cat "$ok/report" 2>/dev/null)"
+  COHORT_PIDS+=("$(forward_field "$ok" holder)")
+
+  if cohort_probe_forward_marker "$bad" real; then
+    COHORT_PIDS+=("$(forward_field "$bad" holder)")
+    fail "a live harness holder that started after this process was accepted as the launcher its recycled pid names, so an unrelated session takes this home"$'\n'"$(cat "$bad/report" 2>/dev/null)"
+  fi
+  COHORT_PIDS+=("$(forward_field "$bad" holder)")
+
+  # Divergence: the marker IS present and DOES name a live claude holder, and
+  # co-location holds, so only the ordering can be producing the refusal.
+  [ "$(forward_field "$bad" launcher_self)" = "$(forward_field "$bad" holder)" ] || fail \
+    "the fixture did not carry a marker naming the holder, so its refusal proves nothing"$'\n'"$(cat "$bad/report")"
+  [ "$(forward_field "$bad" kind_holder)" = claude ] || fail \
+    "the fixture holder did not resolve as a claude harness"$'\n'"$(cat "$bad/report")"
+  [ "$(forward_field "$bad" container_self)" = "$(forward_field "$bad" container_holder)" ] || fail \
+    "the fixture lost the co-location the relationship is AND-ed with"$'\n'"$(cat "$bad/report")"
+  # And the two fixtures really did diverge on the one thing under test.
+  [ "$(forward_field "$bad" start_holder)" -gt "$(forward_field "$bad" start_self)" ] || fail \
+    "the refused fixture's holder did not start after the asking process, so it does not reproduce a recycled pid"$'\n'"$(cat "$bad/report")"
+  [ "$(forward_field "$ok" start_holder)" -le "$(forward_field "$ok" start_self)" ] || fail \
+    "the accepted fixture's holder did not predate the asking process, so the pair does not differ on ordering"$'\n'"$(cat "$ok/report")"
+  pass "session-lock: a recycled holder pid cannot satisfy a stale launch marker"
+}
+
+# The reverse direction must survive the same rule, because the invariant is
+# stated about the CARRIER of the marker rather than about the asking side. A
+# blanket "the holder must predate us" rule would silently refuse every session
+# that recognizes a lock naming the session it started, which is the case
+# test_launching_session_owns_a_lock_naming_the_session_it_started pins
+# end-to-end; this asserts the ordering read itself agrees with it.
+test_marker_ordering_reads_both_directions_of_a_real_pair() {
+  local dir parent child
+  dir="$TMP_ROOT/cohort-marker-directions"
+  mkdir -p "$dir"
+  # A real launcher/launched pair: the parent necessarily starts first.
+  "$NAMED_CLAUDE" -c 'printf "%s\n" "$$" > "$1/parent-pid"; sleep 120; :' _ "$dir" &
+  COHORT_PIDS+=("$!")
+  parent=$(wait_for_file "$dir/parent-pid" "the ordering fixture parent pid")
+  "$NAMED_CLAUDE" -c 'printf "%s\n" "$$" > "$1/child-pid"; sleep 120; :' _ "$dir" &
+  COHORT_PIDS+=("$!")
+  child=$(wait_for_file "$dir/child-pid" "the ordering fixture child pid")
+
+  lib_probe "fm_session_marker_ordered $child $parent" \
+    || fail "a marker carried by the later process naming the earlier one was refused, which would break the forward direction"
+  if lib_probe "fm_session_marker_ordered $parent $child"; then
+    fail "a marker carried by the earlier process naming the later one was accepted, so ordering is not being read at all"
+  fi
+  # An unreadable start time refuses rather than accepts, so the marker path
+  # degrades to the ancestry verdict instead of opening up.
+  if lib_probe "fm_session_marker_ordered $child $(nonexistent_cohort_pid)"; then
+    fail "an unreadable start time was accepted, so the ordering check fails open"
+  fi
+  pass "session-lock: marker ordering accepts a launcher that predates its carrier and refuses one that does not"
+}
+
+# The start time is field 22 of /proc/<pid>/stat, and field 2 is the command name
+# in parentheses, which CAN contain spaces. A whole-line field index reads 0 for
+# this task's own truncated worker shape - the earliest start time expressible,
+# which would satisfy every forward comparison and fail open silently on exactly
+# the process this work exists to identify.
+test_start_time_survives_a_command_name_containing_spaces() {
+  local dir spaced plain
+  dir="$TMP_ROOT/cohort-spaced-comm-start"
+  mkdir -p "$dir"
+  "$WORKER_CLAUDE" -c 'printf "%s\n" "$$" > "$1/spaced-pid"; sleep 120; :' _ "$dir" &
+  COHORT_PIDS+=("$!")
+  spaced=$(wait_for_file "$dir/spaced-pid" "the spaced-comm fixture pid")
+  [ "$(ps -o comm= -p "$spaced")" != "$(basename -- "$NAMED_CLAUDE")" ] || fail \
+    "the spaced-comm fixture reported a plain command name, so it no longer reproduces the shape"
+
+  plain=$(lib_probe "fm_session_pid_start_time $spaced") \
+    || fail "the start time of a process whose command name contains spaces could not be read at all"
+  case "$plain" in
+    ''|*[!0-9]*) fail "the start time of a spaced command name did not parse as a number: '$plain'" ;;
+    0) fail "the start time of a spaced command name read as 0, which accepts every ordering comparison and fails open" ;;
+  esac
+  # And it agrees with the ordering rule: this process started before the
+  # fixture, so a marker the fixture carried could not name it as a launcher.
+  if lib_probe "fm_session_marker_ordered $$ $spaced"; then
+    fail "a spaced-comm process that started later was ordered as predating this one, so its start time was misread"
+  fi
+  pass "session-lock: a start time is read correctly when the command name contains spaces"
+}
+
+# Co-location has two providers so that neither is load-bearing alone. These two
+# cases drive them apart with a real pty and assert that each one carries the
+# verdict by itself while the other is provably gone.
+test_container_signal_alone_carries_co_location() {
+  local dir holder
+  if ! cohort_tmux_ready; then
+    printf '# skip: tmux is unavailable, so the diverged-terminal case did not run here\n'
+    return 0
+  fi
+  dir="$TMP_ROOT/cohort-container-only"
+  make_cohort_fixture "$dir"
+  # The holder gets a real controlling terminal that the session cannot share.
+  cohort_tmux new-window -d -t cohort: -n holder -c "$dir" -- \
+    "${COHORT_ENV_ARGV[@]}" FM_FIX="$dir" HERDR_ENV=1 HERDR_PANE_ID=fixture-pane \
+    "$NAMED_CLAUDE" "$dir/holder.sh" \
+    || fail "could not start the fixture holder in a real pty"
+  holder=$(wait_for_file "$dir/holder-pid" "the pty-hosted fixture holder pid")
+  COHORT_PIDS+=("$holder")
+  run_cohort_session "$dir" "$holder" "$holder" HERDR_ENV=1 HERDR_PANE_ID=fixture-pane
+
+  [ "$(cohort_field "$dir" tty_holder)" != NONE ] || fail \
+    "the holder did not get a real controlling terminal, so nothing was driven apart"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" tty_self)" != "$(cohort_field "$dir" tty_holder)" ] || fail \
+    "the terminals did not diverge, so the container signal was not proven sufficient"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" container_self)" = "$(cohort_field "$dir" container_holder)" ] || fail \
+    "the fixture lost the container signal it was meant to isolate"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" owned)" = yes ] || fail \
+    "ownership did not survive losing the terminal signal"$'\n'"$(cohort_report "$dir")"
+  pass "session-lock: the runtime container signal carries co-location with the terminals driven apart"
+}
+
+test_terminal_signal_alone_carries_co_location() {
+  local dir holder
+  if ! cohort_tmux_ready; then
+    printf '# skip: tmux is unavailable, so the diverged-container case did not run here\n'
+    return 0
+  fi
+  dir="$TMP_ROOT/cohort-terminal-only"
+  make_cohort_fixture "$dir"
+  # Holder and session share ONE real pty and carry no container identity at all.
+  cat > "$dir/pane.sh" <<'SH'
+#!/usr/bin/env bash
+"$FM_FIX_CLAUDE" "$FM_FIX/holder.sh" &
+i=0
+while [ "$i" -lt 400 ] && [ ! -s "$FM_FIX/holder-pid" ]; do
+  sleep 0.05
+  i=$((i + 1))
+done
+holder=$(tr -d '[:space:]' < "$FM_FIX/holder-pid")
+printf '%s\n' "$holder" > "$FM_FIX/state/.lock"
+FM_FIX_HOLDER="$holder" FM_FIX_ORPHAN=0 CLAUDE_PID="$holder" "$FM_FIX_CLAUDE" "$FM_FIX/session.sh"
+SH
+  chmod +x "$dir/pane.sh"
+  cohort_tmux new-window -d -t cohort: -n shared -c "$dir" -- \
+    "${COHORT_ENV_ARGV[@]}" FM_FIX="$dir" FM_FIX_LIB="$LIB" FM_FIX_CLAUDE="$NAMED_CLAUDE" \
+    bash "$dir/pane.sh" \
+    || fail "could not start the shared-pty fixture"
+  holder=$(wait_for_file "$dir/holder-pid" "the shared-pty fixture holder pid")
+  COHORT_PIDS+=("$holder")
+  wait_for_file "$dir/check-finished" "the shared-pty fixture check result" >/dev/null
+
+  [ "$(cohort_field "$dir" container_self)" = NONE ] && [ "$(cohort_field "$dir" container_holder)" = NONE ] || fail \
+    "the fixture still carried a container signal, so the terminal signal was not proven sufficient"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" tty_self)" != NONE ] || fail \
+    "the shared-pty fixture had no controlling terminal to share"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" tty_self)" = "$(cohort_field "$dir" tty_holder)" ] || fail \
+    "holder and session did not share one terminal"$'\n'"$(cohort_report "$dir")"
+  [ "$(cohort_field "$dir" owned)" = yes ] || fail \
+    "ownership did not survive losing the container signal"$'\n'"$(cohort_report "$dir")"
+  pass "session-lock: the controlling terminal carries co-location with the containers driven apart"
+}
+
+# Ask the REAL bin/fm-lock.sh what it reports about a home's recorded holder.
+lock_status() {  # <dir>
+  "${COHORT_ENV_ARGV[@]}" FM_HOME="$1" "$ROOT/bin/fm-lock.sh" status 2>&1
+}
+
+wait_for_state() {  # <pid> <T|running> <what>
+  local pid=$1 want=$2 what=$3 i=0 state
+  while [ "$i" -lt 200 ]; do
+    state=$(ps -o state= -p "$pid" 2>/dev/null | tr -d '[:space:]')
+    case "$want:$state" in
+      T:T*) return 0 ;;
+      running:T*) : ;;
+      running:?*) return 0 ;;
+    esac
+    sleep 0.05
+    i=$((i + 1))
+  done
+  fail "$what"
+}
+
+# A stopped holder never released the lock, because kill -0 succeeds on a
+# stopped process. The decision recorded in the library is that a stopped
+# process is not holding: these are the real signals and the real transition.
+test_suspended_holder_releases_and_resumes() {
+  local dir holder
+  dir="$TMP_ROOT/cohort-suspended"
+  make_cohort_fixture "$dir"
+  start_cohort_holder "$dir"
+  holder=$COHORT_HOLDER_PID
+
+  lib_probe "fm_session_lock_holder_competes $holder" \
+    || fail "a running holder in another session was not treated as a competitor"
+  if lib_probe "fm_harness_pid_suspended $holder"; then
+    fail "a running holder was classified as suspended"
+  fi
+
+  kill -STOP "$holder" 2>/dev/null || fail "could not suspend the fixture holder"
+  wait_for_state "$holder" T "the fixture holder never reached the stopped state"
+
+  lib_probe "fm_harness_pid_alive $holder" \
+    || fail "a stopped harness stopped being reported as alive, which is a separate fact from holding"
+  lib_probe "fm_harness_pid_suspended $holder" \
+    || fail "a durably stopped harness was not recognized as suspended"
+
+  # The decision is required to be observable, and status is the other half of
+  # that surface: an operator diagnosing a wedged home must not be told a durably
+  # stopped holder is simply live.
+  printf '%s\n' "$holder" > "$dir/state/.lock"
+  assert_contains "$(lock_status "$dir")" SUSPENDED \
+    "fm-lock.sh status did not report a durably stopped holder as suspended"
+  assert_contains "$(lock_status "$dir")" reclaimable \
+    "fm-lock.sh status did not report a suspended holder as reclaimable"
+  if lib_probe "fm_session_lock_holder_competes $holder"; then
+    fail "a suspended harness still blocked acquisition, which is the lockout this decision removes"
+  fi
+
+  kill -CONT "$holder" 2>/dev/null || fail "could not resume the fixture holder"
+  wait_for_state "$holder" running "the fixture holder never resumed"
+  if lib_probe "fm_harness_pid_suspended $holder"; then
+    fail "a resumed harness was still classified as suspended"
+  fi
+  assert_contains "$(lock_status "$dir")" "held by live harness pid $holder" \
+    "fm-lock.sh status did not go back to reporting a resumed holder as live"
+  lib_probe "fm_session_lock_holder_competes $holder" \
+    || fail "a resumed holder did not go back to being a competitor"
+  pass "session-lock: a suspended holder stops holding and holds again once it resumes"
+}
+
+# The other half of that sentence, through the acquisition path itself: taking a
+# home from a durably stopped session genuinely does change hands, so this one is
+# reported as a takeover and names the pid it came from.
+test_acquisition_names_a_takeover_from_a_suspended_holder() {
+  local dir holder out acquirer
+  dir="$TMP_ROOT/cohort-suspended-takeover"
+  make_cohort_fixture "$dir"
+  start_cohort_holder "$dir"
+  holder=$COHORT_HOLDER_PID
+  printf '%s\n' "$holder" > "$dir/state/.lock"
+  kill -STOP "$holder" 2>/dev/null || fail "could not suspend the fixture holder"
+  wait_for_state "$holder" T "the fixture holder never reached the stopped state"
+
+  # The acquiring session is a harness-named process of its own, so the ancestry
+  # terminates inside the fixture; the explicit exit keeps bash from exec'ing
+  # fm-lock.sh in its place and sending that walk out to the ambient session.
+  out=$("${COHORT_ENV_ARGV[@]}" FM_HOME="$dir" "$NAMED_CLAUDE" \
+    -c 'printf "acquirer=%s\n" "$$"; "$0"; exit $?' "$ROOT/bin/fm-lock.sh" 2>&1)
+  kill -CONT "$holder" 2>/dev/null || true
+  acquirer=$(printf '%s\n' "$out" | sed -n 's/^acquirer=//p')
+
+  [ -n "$acquirer" ] && [ "$acquirer" != "$holder" ] || fail \
+    "the fixture did not produce a distinct acquiring session: acquirer=$acquirer holder=$holder"$'\n'"$out"
+  assert_contains "$out" "took over from suspended harness pid $holder" \
+    "acquisition did not name the suspended holder it took the home from"$'\n'"$out"
+  assert_not_contains "$out" 'converged onto' \
+    "a takeover from a separate suspended session was reported as this session converging its own lock"$'\n'"$out"
+  assert_not_contains "$out" 'not recognised as a harness' \
+    "a live holder the identity rules DID type as a harness was reported as unidentified"$'\n'"$out"
+  [ "$(tr -d '[:space:]' < "$dir/state/.lock")" = "$acquirer" ] || fail \
+    "acquisition did not converge the lock onto the acquiring session: expected $acquirer, got $(cat "$dir/state/.lock")"
+  wait_for_state "$holder" running "the fixture holder never resumed"
+  pass "session-lock: acquisition names a takeover from a suspended holder and converges the lock"
+}
+
+# The suspension verdict is confirmed over several samples on purpose, so a
+# momentary stop - a debugger, a profiler, a job control keystroke immediately
+# undone - is not read as a session that will never let go.
+test_momentary_stop_is_not_a_suspended_holder() {
+  local dir holder
+  dir="$TMP_ROOT/cohort-momentary-stop"
+  make_cohort_fixture "$dir"
+  start_cohort_holder "$dir"
+  holder=$COHORT_HOLDER_PID
+
+  kill -STOP "$holder" 2>/dev/null || fail "could not suspend the fixture holder"
+  wait_for_state "$holder" T "the fixture holder never reached the stopped state"
+  # Positive control first: left stopped, the same sampling settings must say so.
+  lib_probe "FM_SESSION_STOP_SAMPLES=2 FM_SESSION_STOP_SAMPLE_SLEEP=2; fm_harness_pid_suspended $holder" \
+    || fail "the multi-sample confirmation could not recognize a genuinely stopped holder"
+
+  ( sleep 0.2; kill -CONT "$holder" 2>/dev/null ) &
+  COHORT_PIDS+=("$!")
+  if lib_probe "FM_SESSION_STOP_SAMPLES=2 FM_SESSION_STOP_SAMPLE_SLEEP=2; fm_harness_pid_suspended $holder"; then
+    fail "a stop undone during the confirmation window was still classified as a suspended session"
+  fi
+  wait_for_state "$holder" running "the fixture holder never resumed"
+  pass "session-lock: a stop undone during confirmation is not a suspended holder"
+}
+
+# The sampling settings are environment overrides, and an unusable one must not
+# be able to report a live holder as suspended: that is the one verdict that lets
+# an acquisition take over a genuinely separate concurrent session's home.
+test_unusable_stop_sampling_settings_cannot_release_a_live_holder() {
+  local dir holder setting
+  dir="$TMP_ROOT/cohort-unusable-sampling"
+  make_cohort_fixture "$dir"
+  start_cohort_holder "$dir"
+  holder=$COHORT_HOLDER_PID
+
+  for setting in \
+    'FM_SESSION_STOP_SAMPLES=0' \
+    'FM_SESSION_STOP_SAMPLES=abc' \
+    'FM_SESSION_STOP_SAMPLES=-1' \
+    'FM_SESSION_STOP_SAMPLES=' \
+    'FM_SESSION_STOP_SAMPLE_SLEEP=abc' \
+    'FM_SESSION_STOP_SAMPLE_SLEEP=0'
+  do
+    if lib_probe "$setting; fm_harness_pid_suspended $holder"; then
+      fail "$setting: a running holder was classified as suspended, so an ambient setting hands another session's home over"
+    fi
+    lib_probe "$setting; fm_session_lock_holder_competes $holder" \
+      || fail "$setting: a running holder in another session stopped being a competitor"
+  done
+
+  # The fallback is the documented default rather than a blanket refusal, so a
+  # genuinely stopped holder is still recognized under either unusable setting.
+  # A non-numeric gap is the sharper of the two: unvalidated it is handed to
+  # `sleep`, which fails, and the sequence that cannot complete reports a really
+  # stopped holder as live - the permanent lockout this decision removes.
+  kill -STOP "$holder" 2>/dev/null || fail "could not suspend the fixture holder"
+  wait_for_state "$holder" T "the fixture holder never reached the stopped state"
+  lib_probe "FM_SESSION_STOP_SAMPLES=abc; fm_harness_pid_suspended $holder" \
+    || fail "an unusable sample count refused every suspension instead of falling back to the default"
+  lib_probe "FM_SESSION_STOP_SAMPLE_SLEEP=abc; fm_harness_pid_suspended $holder" \
+    || fail "an unusable sample gap made a genuinely stopped holder look live, so its home would never be reclaimable"
+
+  # A zero gap is the other direction: unvalidated, every sample lands inside the
+  # same instant, so the stop below - undone well inside the real confirmation
+  # window - would be read as a suspended session.
+  ( sleep 0.4; kill -CONT "$holder" 2>/dev/null ) &
+  COHORT_PIDS+=("$!")
+  if lib_probe "FM_SESSION_STOP_SAMPLES=20 FM_SESSION_STOP_SAMPLE_SLEEP=0; fm_harness_pid_suspended $holder"; then
+    fail "a zero sample gap collapsed the confirmation window, so a momentary stop was read as a suspended session"
+  fi
+  wait_for_state "$holder" running "the fixture holder never resumed"
+  pass "session-lock: unusable stop-sampling settings fall back to the default and never release a live holder"
+}
+
+# Ask the shared predicate about a recorded holder and print the clause it left
+# behind, so a case can assert what an operator would be told rather than only
+# the verdict. A competing holder prints nothing and exits non-zero, which no
+# case below drives.
+yield_reason() {  # <pid>
+  "${COHORT_ENV_ARGV[@]}" bash -c '. "$0"
+if fm_session_lock_holder_competes "$1"; then exit 1; fi
+printf "%s\n" "$FM_SESSION_HOLDER_YIELD_REASON"' "$LIB" "$1"
+}
+
+# A live process whose reported command name is `node` and whose script argument
+# is an npm `claude-code` layout path. Identification declines it on purpose -
+# the package component is `claude-code` and not `claude` - and the same rule
+# also judges a RECORDED holder, so a lock an older firstmate wrote for a session
+# of exactly this shape is reclaimed while that session is still running. The
+# reclaim is not being changed; it is required to announce itself.
+test_reclaim_of_a_live_unidentified_holder_names_itself() {
+  local dir layout holder out acquirer reason
+  dir="$TMP_ROOT/cohort-unidentified-holder"
+  make_cohort_fixture "$dir"
+  # A real interpreter-named executable, so `node` is produced by the kernel and
+  # by ps rather than by a fixture that was told what to print.
+  layout="$dir/npm/lib/node_modules/@anthropic-ai/claude-code"
+  mkdir -p "$layout" "$dir/npm/bin"
+  cp /bin/bash "$dir/npm/bin/node"
+  cat > "$layout/cli.js" <<'SH'
+printf '%s\n' "$$" > "$FM_FIX/holder-pid"
+sleep 120
+:
+SH
+  "${COHORT_ENV_ARGV[@]}" FM_FIX="$dir" "$dir/npm/bin/node" "$layout/cli.js" \
+    > "$dir/holder.out" 2>&1 &
+  COHORT_PIDS+=("$!")
+  holder=$(wait_for_file "$dir/holder-pid" "the npm-layout fixture holder pid")
+
+  # The case is only about the holder the identity rules decline, so prove they
+  # decline it before asserting anything about the reclaim.
+  if lib_probe "fm_harness_pid_alive $holder"; then
+    fail "the npm-layout fixture was identified as a harness, so this case cannot reach the reclaim it exists to pin"
+  fi
+  kill -0 "$holder" 2>/dev/null || fail "the npm-layout fixture holder was not a live process"
+
+  reason=$(yield_reason "$holder") || fail \
+    "a live but unidentified holder blocked acquisition, which is the read-only lockout this must not introduce"
+  [ -n "$reason" ] || fail "reclaiming a live but unidentified holder stayed silent"
+  assert_contains "$reason" "$holder" \
+    "the reclaim clause did not name the holder pid an operator would have to look up"
+  assert_contains "$reason" 'alive but not recognised as a harness' \
+    "the reclaim clause did not say the holder was alive and unrecognised"
+
+  # The line the captain would actually see, through the real acquisition path.
+  printf '%s\n' "$holder" > "$dir/state/.lock"
+  out=$("${COHORT_ENV_ARGV[@]}" FM_HOME="$dir" "$NAMED_CLAUDE" \
+    -c 'printf "acquirer=%s\n" "$$"; "$0"; exit $?' "$ROOT/bin/fm-lock.sh" 2>&1)
+  acquirer=$(printf '%s\n' "$out" | sed -n 's/^acquirer=//p')
+  [ -n "$acquirer" ] && [ "$acquirer" != "$holder" ] || fail \
+    "the fixture did not produce a distinct acquiring session: acquirer=$acquirer holder=$holder"$'\n'"$out"
+  assert_contains "$out" "lock acquired: harness pid $acquirer" \
+    "acquisition did not succeed against a live but unidentified holder"$'\n'"$out"
+  assert_contains "$out" "alive but not recognised as a harness" \
+    "acquisition reclaimed a visibly live holder without saying so"$'\n'"$out"
+  assert_contains "$out" "$holder" \
+    "acquisition did not name the live holder it reclaimed the home from"$'\n'"$out"
+  assert_not_contains "$out" 'converged onto' \
+    "a reclaim from an unidentified process was reported as this session converging its own lock"$'\n'"$out"
+  assert_not_contains "$out" 'took over from suspended' \
+    "a reclaim from an unidentified process was reported as a takeover from a suspended session"$'\n'"$out"
+  [ "$(tr -d '[:space:]' < "$dir/state/.lock")" = "$acquirer" ] || fail \
+    "acquisition did not converge the lock onto the acquiring session: expected $acquirer, got $(cat "$dir/state/.lock")"
+  kill -0 "$holder" 2>/dev/null || fail \
+    "the unidentified holder died during the case, so the reclaim it pinned may have been the ordinary silent one"
+  pass "session-lock: reclaiming a live but unidentified holder names it instead of moving the lock silently"
+}
+
+# The other side of that distinction, and the common case by far: a holder that
+# is simply gone has always been reclaimed in silence, so an ordinary session
+# start must gain no new line at all.
+test_a_gone_holder_is_reclaimed_silently() {
+  local dir gone out acquirer reason i
+  dir="$TMP_ROOT/cohort-gone-holder"
+  make_cohort_fixture "$dir"
+  "${COHORT_ENV_ARGV[@]}" FM_FIX="$dir" "$NAMED_CLAUDE" \
+    -c 'printf "%s\n" "$$" > "$FM_FIX/gone-pid"' &
+  gone=$!
+  wait "$gone" 2>/dev/null || true
+  gone=$(wait_for_file "$dir/gone-pid" "the exited fixture holder pid")
+  i=0
+  while kill -0 "$gone" 2>/dev/null && [ "$i" -lt 200 ]; do
+    sleep 0.05
+    i=$((i + 1))
+  done
+  if kill -0 "$gone" 2>/dev/null; then
+    fail "the fixture holder never exited, so this case cannot pin the gone reclaim"
+  fi
+
+  reason=$(yield_reason "$gone") || fail "a holder that no longer exists blocked acquisition"
+  [ -z "$reason" ] || fail \
+    "reclaiming a holder that no longer exists announced itself: '$reason'"
+
+  printf '%s\n' "$gone" > "$dir/state/.lock"
+  out=$("${COHORT_ENV_ARGV[@]}" FM_HOME="$dir" "$NAMED_CLAUDE" \
+    -c 'printf "acquirer=%s\n" "$$"; "$0"; exit $?' "$ROOT/bin/fm-lock.sh" 2>&1)
+  acquirer=$(printf '%s\n' "$out" | sed -n 's/^acquirer=//p')
+  [ -n "$acquirer" ] || fail "the fixture did not produce an acquiring session"$'\n'"$out"
+  assert_contains "$out" "lock acquired: harness pid $acquirer" \
+    "acquisition did not succeed against a holder that no longer exists"$'\n'"$out"
+  assert_not_contains "$out" '(' \
+    "reclaiming a holder that no longer exists gained a reason clause, so every ordinary session start now reports one"$'\n'"$out"
+  pass "session-lock: a holder that no longer exists is still reclaimed silently"
+}
+
 test_version_named_session_is_identified_on_both_platforms
 test_ordinary_paths_are_never_harness_processes
+test_node_main_thread_identity_comes_only_from_the_script_path
+test_bare_interpreter_identity_stops_at_the_first_flag
+test_acceptance_typing_comes_only_from_executable_identity
+test_real_reported_command_names_are_typed_for_acceptance
 test_harness_beyond_a_gap_never_owns_the_lock
 test_competing_version_named_session_is_seen_as_live
 test_e2e_version_named_session_claims_the_home
 test_e2e_daemon_parented_session_claims_the_home
 test_e2e_daemon_parented_version_named_session_keeps_its_lock
+test_rehosted_session_owns_the_lock_it_cannot_reach
+test_launching_session_owns_a_lock_naming_the_session_it_started
+test_a_different_harness_never_believes_an_inherited_launch_marker
+test_a_session_named_only_in_argv_gets_no_accept_path
+test_the_same_harness_still_converges_on_the_identical_fixture
+test_colocated_session_without_a_launch_relationship_is_refused
+test_related_session_in_another_container_is_refused
+test_liveness_is_decided_before_any_recorded_cohort_signal
+test_a_recycled_holder_pid_cannot_satisfy_a_stale_launch_marker
+test_marker_ordering_reads_both_directions_of_a_real_pair
+test_start_time_survives_a_command_name_containing_spaces
+test_container_signal_alone_carries_co_location
+test_terminal_signal_alone_carries_co_location
+test_suspended_holder_releases_and_resumes
+test_acquisition_names_a_takeover_from_a_suspended_holder
+test_reclaim_of_a_live_unidentified_holder_names_itself
+test_a_gone_holder_is_reclaimed_silently
+test_momentary_stop_is_not_a_suspended_holder
+test_unusable_stop_sampling_settings_cannot_release_a_live_holder
diff --git a/tests/fm-session-lock-identity-live-e2e.test.sh b/tests/fm-session-lock-identity-live-e2e.test.sh
new file mode 100755
index 00000000000..b528d118e19
--- /dev/null
+++ b/tests/fm-session-lock-identity-live-e2e.test.sh
@@ -0,0 +1,438 @@
+#!/usr/bin/env bash
+# tests/fm-session-lock-identity-live-e2e.test.sh - default-on guard proving
+# every INSTALLED harness is still identified correctly by the session-lock
+# predicates in bin/fm-session-lock-lib.sh.
+#
+# Why this file exists: the whole session-lock verdict is read off things the
+# harness vendor emits - the process name it runs under, the argv it presents,
+# and the process state the kernel reports for it. A stub agent can only confirm
+# the assumption already written into the stub, so the identity of a real
+# release has to be checked against a real release. Claude Code already changed
+# its own process name to a bare version string once, and every session-lock
+# verdict for it was wrong until the classifier was taught the new shape.
+#
+# What it checks per harness, all against a bare launch with no prompt, so it
+# consumes no model tokens:
+#   1. the running harness is recognized as a harness at all;
+#   2. an unrelated process does NOT get to call that harness its own session,
+#      and a running one is treated as a competing holder - the property the
+#      session lock exists for;
+#   3. a stopped harness is recognized as suspended and stops blocking
+#      acquisition, then blocks again once continued.
+#
+# Each harness runs in its own real pty, because several of them exit
+# immediately without a terminal and would be reported as unidentifiable for a
+# reason that has nothing to do with identity.
+#
+# The launch marker that lets a rehosted session recognize its own lock is
+# deliberately NOT a pass/fail here: a harness publishes it to the processes it
+# starts, and a bare launch with no prompt starts none. This guard reports
+# whatever a descendant scan actually finds, with the ambient markers cleared so
+# an inherited value from the session running this suite cannot be mistaken for
+# the harness's own. docs/verification/runtime-backends.md records the
+# per-harness marker evidence and how it was obtained.
+#
+# Standard CI has no harness binaries or credentials, so this real-harness guard
+# runs by default only where a real pty and harness are actually installed.
+# tests/fm-session-lock-ancestry.test.sh pins the same logic in CI with real
+# processes and no harness. Run this guard after any harness upgrade and before
+# trusting refreshed per-harness evidence.
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+fm_live_gate default-on FM_SESSION_LOCK_IDENTITY_LIVE tmux
+
+LIB="$ROOT/bin/fm-session-lock-lib.sh"
+SOCKET="fm-session-lock-identity-$$"
+LAB=
+REAL_TMUX=
+# Every harness this guard launched, so no exit path can leave one behind. A
+# SIGSTOPped process does not act on the SIGHUP that killing the tmux server
+# delivers, so it has to be continued before it can be terminated at all.
+LAUNCHED_PIDS=
+
+cleanup_all() {
+  local p
+  for p in $LAUNCHED_PIDS; do
+    kill -CONT "$p" 2>/dev/null || true
+    kill -TERM "$p" 2>/dev/null || true
+  done
+  [ -n "$REAL_TMUX" ] && "$REAL_TMUX" -L "$SOCKET" kill-server >/dev/null 2>&1
+  [ -n "${LAB:-}" ] && rm -rf "$LAB"
+  return 0
+}
+fail() { printf 'not ok - %s\n' "$1" >&2; cleanup_all; exit 1; }
+pass() { printf 'ok - %s\n' "$1"; }
+note() { printf '# %s\n' "$1"; }
+trap cleanup_all EXIT
+
+REAL_TMUX=$(command -v tmux)
+LAB=$(mktemp -d "${TMPDIR:-/tmp}/fm-session-lock-identity.XXXXXX")
+mkdir -p "$LAB/wt"
+
+# shellcheck source=bin/fm-cursor-lib.sh
+. "$ROOT/bin/fm-cursor-lib.sh"
+
+"$REAL_TMUX" -L "$SOCKET" new-session -d -s identity -n control -c "$LAB/wt" \
+  || fail "could not start the private tmux server"
+
+# The environment signals the library reads, cleared for every launch so no value
+# inherited from the session running this suite can decide a verdict. The list is
+# derived from the library's own tables by its single owner, so a signal added
+# there is cleared here without this guard being edited.
+# shellcheck source=tests/session-signals.sh
+. "$ROOT/tests/session-signals.sh"
+fm_test_clear_signals_argv
+CLEARED=("${FM_TEST_CLEAR_SIGNALS_ARGV[@]}")
+
+# Evaluate one library expression from a process that is NOT related to the
+# harness under test, which is the position every competing session speaks from.
+probe() {  # <expression>
+  "${CLEARED[@]}" bash -c ". \"\$0\"; $1" "$LIB"
+}
+
+# Mirror bin/fm-spawn.sh's own resolution order, so this guard covers the same
+# binary firstmate would actually launch rather than only what is on PATH.
+resolve_harness_binary() {  # <harness>
+  local harness=$1 candidate
+  candidate=$(command -v "$harness" 2>/dev/null || true)
+  if [ -n "$candidate" ] && [ -x "$candidate" ]; then
+    printf '%s\n' "$candidate"
+    return 0
+  fi
+  if [ "$harness" = kimi ] && [ -n "${HOME:-}" ] && [ -x "$HOME/.kimi-code/bin/kimi" ]; then
+    printf '%s\n' "$HOME/.kimi-code/bin/kimi"
+    return 0
+  fi
+  if [ "$harness" = cursor ]; then
+    fm_cursor_resolve_binary 2>/dev/null && return 0
+    return 1
+  fi
+  return 1
+}
+
+wait_for_state() {  # <pid> <T|running>
+  local pid=$1 want=$2 i=0 state
+  while [ "$i" -lt 200 ]; do
+    state=$(ps -o state= -p "$pid" 2>/dev/null | tr -d '[:space:]')
+    case "$want:$state" in
+      T:T*) return 0 ;;
+      running:T*) : ;;
+      running:?*) return 0 ;;
+    esac
+    sleep 0.05
+    i=$((i + 1))
+  done
+  return 1
+}
+
+# Report any launch marker a descendant of <pid> carries that names a process in
+# the harness's own run, from the row belonging to <harness> and no other, which
+# is the same scoping ownership uses. Informational only.
+descendant_marker() {  # <pid> <harness>
+  local root=$1 harness=$2 d m
+  for d in $(ps -eo pid= -o ppid= 2>/dev/null | awk -v r="$root" '$2 == r { print $1 }'); do
+    m=$(probe "fm_session_launcher_pid $d $harness" 2>/dev/null) || continue
+    printf '%s\n' "$m"
+    return 0
+  done
+  return 1
+}
+
+# Launch <2> (plus the optional extra arguments in <3>) in its own real pty
+# window named <1>, reporting the pid of the process running inside it in
+# PROBE_PID and whether the library came to see that process as a harness before
+# it exited in PROBE_IDENTIFIED, so a caller can tell "never started" from "not
+# identified".
+#
+# <4> is how long to keep asking, and it is a correctness setting rather than a
+# speed one. A harness that is running but unidentifiable is drift, and proving
+# that needs the whole window; a control that is SUPPOSED to be unidentifiable
+# would spend that window every time and report nothing new, so it asks only
+# until the process is visible to ps. Pass `visible` for a control.
+#
+# Both results are globals rather than stdout deliberately: a command
+# substitution would run this in a subshell, which loses PROBE_IDENTIFIED and,
+# worse, loses the LAUNCHED_PIDS entry that guarantees cleanup reaches every
+# process this guard started.
+#
+# Each launch runs as a CHILD of the pane's shell, not as the pane process
+# itself. That is the shape a captain's own session has - a harness started from
+# a shell in a pane - and it is the shape the suspended-holder incident was
+# observed in. The trailing no-op is what stops bash from exec'ing the target
+# into the shell's own pid and making it the session leader.
+PROBE_IDENTIFIED=0
+PROBE_PID=
+launch_identity_probe() {  # <window> <binary> [<extra-args>] [identified|visible]
+  local window=$1 target=$2 extra=${3-} until_what=${4:-identified} pane_pid pid='' tracked=''
+  PROBE_IDENTIFIED=0
+  PROBE_PID=
+  # shellcheck disable=SC2086,SC2016  # an empty value must add no argument; the inner shell's $0/$@ are deliberately unexpanded here
+  "$REAL_TMUX" -L "$SOCKET" new-window -d -t identity: -n "$window" -c "$LAB/wt" -- \
+    "${CLEARED[@]}" bash -c '"$0" "$@"; :' "$target" $extra \
+    || fail "could not launch a pty window for the '$window' identity probe of $target"
+  for _ in $(seq 1 300); do
+    pane_pid=$("$REAL_TMUX" -L "$SOCKET" display-message -p -t "identity:$window" '#{pane_pid}' 2>/dev/null | tr -d '[:space:]')
+    case "$pane_pid" in
+      ''|*[!0-9]*) sleep 0.2; continue ;;
+    esac
+    pid=$(ps -eo pid= -o ppid= 2>/dev/null | awk -v r="$pane_pid" '$2 == r { print $1; exit }')
+    case "$pid" in
+      ''|*[!0-9]*) sleep 0.2; continue ;;
+    esac
+    if [ "$pid" != "$tracked" ]; then
+      LAUNCHED_PIDS="$LAUNCHED_PIDS $pid"
+      tracked=$pid
+    fi
+    if probe "fm_harness_pid_alive $pid"; then
+      PROBE_IDENTIFIED=1
+      break
+    fi
+    [ "$until_what" = visible ] && break
+    kill -0 "$pid" 2>/dev/null || break
+    sleep 0.2
+  done
+  PROBE_PID=$pid
+  [ -n "$pid" ] || return 1
+  return 0
+}
+
+CHECKED=0
+SKIPPED=
+UNEXERCISED=
+MARKERS=
+KINDS=
+TYPED=0
+INSTALL_NAMES_CHECKED=0
+
+# Every primary-capable adapter this repo has verified. muse is crewmate-only and
+# never holds a home's session lock, so it is deliberately out of scope here.
+for harness in claude codex opencode pi pi-signed grok kimi cursor; do
+  if ! bin_path=$(resolve_harness_binary "$harness"); then
+    SKIPPED="$SKIPPED $harness"
+    note "skip: $harness is not installed on this machine, so its session-lock identity is unverified here"
+    continue
+  fi
+
+  version=$("$bin_path" --version 2>/dev/null | head -1 | tr -d '\r') || version=
+  [ -n "$version" ] || version="unknown"
+
+  # cursor blocks on a workspace-trust prompt in a directory it has never seen,
+  # which would hang this probe rather than identify anything; --trust is the
+  # same flag fm-spawn passes for the same reason.
+  launch_args=""
+  [ "$harness" = cursor ] && launch_args="--trust"
+  launch_identity_probe "$harness" "$bin_path" "$launch_args" || true
+  pid=$PROBE_PID
+  identified=$PROBE_IDENTIFIED
+
+  # A harness that never stayed running was not exercised. That is a fact about
+  # this machine, not evidence about identity, so report it instead of turning
+  # it into a drift verdict or a silent pass.
+  if [ -z "$pid" ] || ! kill -0 "$pid" 2>/dev/null; then
+    UNEXERCISED="$UNEXERCISED $harness"
+    note "unexercised: $harness $version did not stay running in a bare pty launch here, so its session-lock identity is unverified"
+    "$REAL_TMUX" -L "$SOCKET" kill-window -t "identity:$harness" >/dev/null 2>&1 || true
+    continue
+  fi
+
+  comm=$(ps -o comm= -p "$pid" 2>/dev/null | tr -d '\n')
+  args=$(ps -o args= -p "$pid" 2>/dev/null | cut -c1-120 | tr -d '\n')
+
+  [ "$identified" -eq 1 ] || fail \
+    "SESSION-LOCK IDENTITY DRIFT: $harness $version is running but bin/fm-session-lock-lib.sh does not identify it as a harness. Every session-lock verdict for this harness is therefore wrong: its own session start cannot recognize its lock, and a dead holder of its own kind is never reclaimed. Observed process name '$comm'; observed argv '$args'. Teach fm_harness_process_matches the identity this release actually reports."
+
+  if probe "fm_session_same_cohort $pid"; then
+    fail "SESSION-LOCK SAFETY FAILURE: $harness $version was accepted as an unrelated process's own session, so a separate concurrent session could take over that home. Observed process name '$comm'; observed argv '$args'."
+  fi
+  probe "fm_session_lock_holder_competes $pid" || fail \
+    "SESSION-LOCK SAFETY FAILURE: a running $harness $version holding a home's lock was not treated as a competing session, so another session would acquire that home. Observed process name '$comm'; observed argv '$args'."
+
+  kill -STOP "$pid" 2>/dev/null || fail "$harness $version: could not suspend the launched harness"
+  wait_for_state "$pid" T || fail "$harness $version: the launched harness never reached the stopped state"
+  probe "fm_harness_pid_suspended $pid" || fail \
+    "SESSION-LOCK IDENTITY DRIFT: a stopped $harness $version was not recognized as suspended, so a suspended session of this harness would hold its home forever. Observed process state '$(ps -o state= -p "$pid" 2>/dev/null | tr -d '[:space:]')'."
+  if probe "fm_session_lock_holder_competes $pid"; then
+    kill -CONT "$pid" 2>/dev/null || true
+    fail "SESSION-LOCK IDENTITY DRIFT: a stopped $harness $version still blocked acquisition, which is the permanent lockout the suspended-holder decision removes."
+  fi
+  kill -CONT "$pid" 2>/dev/null || fail "$harness $version: could not resume the launched harness"
+  wait_for_state "$pid" running || fail "$harness $version: the launched harness never resumed"
+  probe "fm_session_lock_holder_competes $pid" || fail \
+    "SESSION-LOCK IDENTITY DRIFT: a resumed $harness $version did not go back to blocking acquisition, so a live session of this harness would lose its own home."
+
+  # The cross-harness refusal rests on one input this guard is the only thing that
+  # can check against a real release: which harness this release's EXECUTABLE
+  # IDENTITY names. A launch marker is consulted only when the asking session and
+  # the holder are both the harness that row was verified for, so two releases
+  # that answer with the SAME kind would reopen the path where one harness
+  # believes another's inherited marker. The refusal decision itself is pinned
+  # portably in tests/fm-session-lock-ancestry.test.sh; what needs a real release
+  # is this.
+  #
+  # An empty answer is not drift. Acceptance typing deliberately reads only the
+  # command name and argv[0], so a release whose harness name appears nowhere but
+  # in its argument list is identified for ancestry and liveness and still has no
+  # accept path, which is the fail-closed outcome the library records as a limit.
+  # Report it, because that is the observation a later fix would need.
+  kind=$(probe "fm_harness_pid_kind $pid" 2>/dev/null | tr -d '[:space:]')
+  if [ -z "$kind" ]; then
+    note "$harness $version: executable identity names no harness, so the launch-marker accept path stays closed for it and its session-lock verdict is decided by process ancestry alone"
+  else
+    # A wrapper legitimately reports its own verified name rather than the label
+    # this loop launched it under - Pi's signed wrapper is exactly that - so a
+    # mismatch here is reported rather than failed. What must hold is that two
+    # DIFFERENT harnesses do not answer with the same kind, because then either
+    # would believe the other's inherited marker.
+    [ "$kind" = "$harness" ] || \
+      note "$harness $version reports harness kind '$kind' rather than '$harness', which is what its launch-marker scoping will use"
+    conflict=
+    for seen in $KINDS; do
+      [ "${seen#*:}" = "$kind" ] || continue
+      # pi and pi-signed are one harness with one engine pid, so they are allowed
+      # to answer alike; any other repeat is two harnesses that cannot be told
+      # apart.
+      case "${seen%%:*} $harness" in
+        "pi pi-signed"|"pi-signed pi") continue ;;
+      esac
+      conflict=${seen%%:*}
+      break
+    done
+    [ -z "$conflict" ] || fail \
+      "SESSION-LOCK IDENTITY DRIFT: $harness $version reports the same harness kind '$kind' as $conflict, so the two cannot be told apart and either would believe a launch marker the other exported. Observed process name '$comm'; observed argv '$args'."
+    KINDS="$KINDS $harness:$kind"
+    TYPED=$((TYPED + 1))
+  fi
+
+  # What the harness is called on PATH is almost never what it is called on
+  # disk: the PATH entry is a symlink named exactly after the harness, so a
+  # launch through it can only ever observe the name this guard already expected.
+  # That blind spot is not hypothetical. Claude Code's installed executable is a
+  # single-file native build named claude.exe, and while the reported name was
+  # compared without normalizing it, every process that exec'd that binary
+  # directly - which is what Claude's own background workers do - was identified
+  # as a harness and yielded no kind at all, so the session's own start refused
+  # its home and degraded to read-only while it was the only session alive. The
+  # only way to see that is to launch what is actually installed.
+  #
+  # A resolved target that is an interpreter SCRIPT is reported rather than
+  # failed, because its own name never reaches a reported command name: the
+  # kernel runs the interpreter named in its `#!` line, so the process is called
+  # after the launcher or the interpreter instead. codex ships exactly that shape.
+  real_path=$(readlink -f "$bin_path" 2>/dev/null) || real_path=$bin_path
+  [ -n "$real_path" ] || real_path=$bin_path
+  if [ "$real_path" = "$bin_path" ]; then
+    note "$harness $version: the launched path is the installed executable, so its own name was already the name under test"
+  elif [ "$(head -c 2 "$real_path" 2>/dev/null)" = '#!' ]; then
+    note "$harness $version: the installed executable ${real_path##*/} is an interpreter script, so its own name never reaches a reported command name and only the launcher name is typed"
+  else
+    launch_identity_probe "$harness-installed" "$real_path" "$launch_args" || true
+    real_pid=$PROBE_PID
+    if [ -z "$real_pid" ] || ! kill -0 "$real_pid" 2>/dev/null; then
+      note "unexercised: $harness $version did not stay running when launched as its installed executable ${real_path##*/}, so that name is unverified"
+    else
+      real_comm=$(ps -o comm= -p "$real_pid" 2>/dev/null | tr -d '\n')
+      real_args=$(ps -o args= -p "$real_pid" 2>/dev/null | cut -c1-120 | tr -d '\n')
+      real_kind=$(probe "fm_harness_pid_kind $real_pid" 2>/dev/null | tr -d '[:space:]')
+      [ -n "$real_kind" ] || fail \
+        "SESSION-LOCK IDENTITY DRIFT: $harness $version run as its own installed executable ${real_path##*/} reports command name '$real_comm' and is typed as no harness at all, while the same release launched through PATH types as '${kind:-nothing}'. Every process that execs that binary directly is then identified as a harness with no kind, the cohort refuses, and this harness's own session start degrades to read-only against its own home while it is the only session alive. Observed argv '$real_args'."
+      if [ -n "$kind" ] && [ "$real_kind" != "$kind" ]; then
+        fail "SESSION-LOCK IDENTITY DRIFT: $harness $version types as '$kind' when launched through PATH but as '$real_kind' when launched as its installed executable ${real_path##*/}, so one release answers to two harness names and either could believe a launch marker the other exported. Observed command name '$real_comm'; observed argv '$real_args'."
+      fi
+      note "$harness $version: installed executable ${real_path##*/} reports comm='$real_comm' acceptance-kind='$real_kind'"
+      INSTALL_NAMES_CHECKED=$((INSTALL_NAMES_CHECKED + 1))
+      kill "$real_pid" 2>/dev/null || true
+    fi
+    "$REAL_TMUX" -L "$SOCKET" kill-window -t "identity:$harness-installed" >/dev/null 2>&1 || true
+  fi
+
+  # The raw observation, recorded for every installed harness rather than only on
+  # failure, because a shape this file's rules do not yet identify is exactly the
+  # evidence a later fix needs and inference is not allowed to stand in for it.
+  note "$harness $version: comm='$comm' argv='$args' acceptance-kind='${kind:-none}'"
+  if marker=$(descendant_marker "$pid" "$harness"); then
+    MARKERS="$MARKERS $harness=$marker"
+    note "$harness $version: a descendant carries this harness's own launch marker naming pid $marker"
+  else
+    note "$harness $version: no descendant of a bare launch carried a launch marker verified for $harness"
+  fi
+
+  "$REAL_TMUX" -L "$SOCKET" kill-window -t "identity:$harness" >/dev/null 2>&1 || true
+  pass "session-lock identity: $harness $version is identified, refuses an unrelated session, and releases while suspended"
+  CHECKED=$((CHECKED + 1))
+done
+
+# The reporter itself, on this machine. Everything above depends on what ps and
+# the kernel here do to a command name, and that differs by platform: procps
+# reports the kernel task name and cuts it at 15 characters, while BSD ps reports
+# argv[0] and does not. So the two artifacts the library normalizes are produced
+# locally, from real executables carrying those exact names, and the names are
+# read back through the same ps the library calls.
+#
+# The near misses matter as much as the acceptances. Normalization strips two
+# artifacts before an unchanged exact-equality test, and this is where a widening
+# into a prefix rule would show up on the real platform rather than in a fleet.
+REPORTER_LAB="$LAB/reporter"
+mkdir -p "$REPORTER_LAB"
+REPORTER_CHECKED=0
+# The two acceptance names are the artifacts a real Claude Code install produces;
+# the four after them differ from a verified harness name only in ways
+# normalization must not undo.
+REPORTER_NAMES=('claude.exe' 'claude bg-pty-host' claudette claude-code node python3)
+for reporter_name in "${REPORTER_NAMES[@]}"; do
+  ln -sf /bin/bash "$REPORTER_LAB/$reporter_name"
+  case "$reporter_name" in
+    'claude.exe'|'claude bg-pty-host') reporter_want=claude ;;
+    *) reporter_want= ;;
+  esac
+  launch_identity_probe "reporter-$REPORTER_CHECKED" "$REPORTER_LAB/$reporter_name" '' visible || true
+  reporter_pid=$PROBE_PID
+  if [ -z "$reporter_pid" ] || ! kill -0 "$reporter_pid" 2>/dev/null; then
+    fail "the reporter control named '$reporter_name' never stayed running, so this machine's command-name reporting is unverified"
+  fi
+  reporter_comm=$(ps -o comm= -p "$reporter_pid" 2>/dev/null | tr -d '\n')
+  reporter_base=${reporter_comm##*/}
+  reporter_kind=$(probe "fm_harness_exec_kind '$reporter_base' ''" 2>/dev/null | tr -d '[:space:]')
+  if [ -n "$reporter_want" ]; then
+    # Divergence first: a control that stopped carrying the artifact would pass
+    # without testing anything, which is the failure this whole guard removes.
+    [ "$reporter_base" != "$reporter_want" ] || fail \
+      "the reporter control '$reporter_name' was reported as the bare name '$reporter_base', so this machine no longer reproduces the artifact and the check below would pass vacuously"
+    [ "$reporter_kind" = "$reporter_want" ] || fail \
+      "SESSION-LOCK IDENTITY DRIFT: a real process reporting command name '$reporter_comm' is typed as '${reporter_kind:-nothing}' rather than $reporter_want on this machine. That is a command name Claude Code actually runs under, so its own session start would refuse its home and degrade to read-only while it is the only session alive."
+  else
+    [ -z "$reporter_kind" ] || fail \
+      "SESSION-LOCK SAFETY FAILURE: a real process named '$reporter_name' is typed as '$reporter_kind' on this machine, so an unrelated process could be accepted as a session's own harness and take over its home."
+  fi
+  note "reporter control '$reporter_name': comm='$reporter_comm' acceptance-kind='${reporter_kind:-none}' (expected ${reporter_want:-none})"
+  kill "$reporter_pid" 2>/dev/null || true
+  "$REAL_TMUX" -L "$SOCKET" kill-window -t "identity:reporter-$REPORTER_CHECKED" >/dev/null 2>&1 || true
+  REPORTER_CHECKED=$((REPORTER_CHECKED + 1))
+done
+[ "$REPORTER_CHECKED" -eq "${#REPORTER_NAMES[@]}" ] || fail \
+  "only $REPORTER_CHECKED of the ${#REPORTER_NAMES[@]} command-name reporter controls ran, so this machine's reporting is only partly verified"
+pass "session-lock identity: this machine's reported command names are typed after the reporter's own artifacts, and near misses still are not"
+
+[ "$CHECKED" -gt 0 ] || fail \
+  "no verified harness was exercised here, so this run proved nothing; install at least one harness that stays running in a bare pty launch before trusting a pass"
+
+# Distinctness needs two acceptance kinds to compare, so say plainly when fewer
+# were available rather than letting that read as having checked it.
+if [ "$TYPED" -ge 2 ]; then
+  pass "session-lock identity: the $TYPED exercised harnesses that name themselves by executable identity each report a distinct harness kind, so neither can believe the other's inherited launch marker"
+else
+  note "unchecked: the cross-harness kind distinctness that scopes launch markers needs two harnesses that name themselves by executable identity, and only $TYPED did here (kinds observed:$KINDS)"
+fi
+
+if [ "$INSTALL_NAMES_CHECKED" -eq 0 ]; then
+  note "unchecked: no installed harness here resolved to a native executable under a different name, so the installed-executable name check had nothing to exercise"
+fi
+[ -z "$SKIPPED" ] || note "unverified on this machine (not installed):$SKIPPED"
+[ -z "$UNEXERCISED" ] || note "unverified on this machine (did not stay running):$UNEXERCISED"
+[ -z "$MARKERS" ] || note "observed launch markers:$MARKERS"
+note "checked $CHECKED installed harness(es)"
+
+cleanup_all
+trap - EXIT
diff --git a/tests/fm-time.test.sh b/tests/fm-time.test.sh
new file mode 100644
index 00000000000..ef04bd9c78d
--- /dev/null
+++ b/tests/fm-time.test.sh
@@ -0,0 +1,495 @@
+#!/usr/bin/env bash
+# Behavior tests for fm-time.sh: propose from synthetic signals, approval
+# (as-is and corrected), retroactive log entries, live start/stop, split, and
+# the month-end report's grouping and after-hours split.
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+FMTIME="$ROOT/bin/fm-time.sh"
+TMP_ROOT=$(fm_test_tmproot fm-time)
+
+make_home() {
+  local name=$1 home
+  home="$TMP_ROOT/$name"
+  mkdir -p "$home/state" "$home/data" "$home/config"
+  printf '%s\n' "$home"
+}
+
+# touch_at <path> <YYYY-MM-DD> <HH:MM>: portable POSIX `touch -t` mtime set.
+touch_at() {
+  local path=$1 date=$2 hm=$3 stamp
+  stamp="${date//-/}${hm/:/}"
+  touch -t "$stamp" "$path"
+}
+
+# ---------------------------------------------------------------- propose
+
+test_propose_clusters_synthetic_status_and_meta_evidence() {
+  local home
+  home=$(make_home propose-basic)
+
+  cat > "$home/state/demo-task.meta" <<EOF
+project=$home/projects/FnO
+kind=ship
+EOF
+  touch_at "$home/state/demo-task.meta" 2026-09-05 18:30
+
+  cat > "$home/state/demo-task.status" <<'EOF'
+working: doing the thing
+done: fixed the widget
+EOF
+  touch_at "$home/state/demo-task.status" 2026-09-05 18:40
+
+  local out
+  out=$(FM_HOME="$home" "$FMTIME" propose --since "2026-09-01 00:00") \
+    || fail "propose failed on synthetic status+meta evidence"
+  assert_contains "$out" "1 proposed window" "close-together meta+status pings did not merge into one window"
+
+  local list
+  list=$(FM_HOME="$home" "$FMTIME" list) || fail "list failed"
+  assert_contains "$list" "[p1]" "proposal id p1 missing from list"
+  assert_contains "$list" "project  FnO" "proposal did not attribute the project from state/<id>.meta"
+  assert_contains "$list" "task     demo-task" "proposal did not attribute the task id"
+  assert_contains "$list" "evidence: " "proposal listed no evidence for the captain to judge"
+  assert_contains "$list" "task record touched" "meta-touch evidence line missing"
+  assert_contains "$list" "done: fixed the widget" "status-line evidence text missing"
+
+  pass "propose clusters close synthetic status+meta pings into one evidenced window"
+}
+
+test_propose_wide_gap_produces_two_windows() {
+  local home
+  home=$(make_home propose-gap)
+
+  cat > "$home/state/demo-task.meta" <<EOF
+project=$home/projects/FnO
+EOF
+  touch_at "$home/state/demo-task.meta" 2026-09-05 09:00
+
+  cat > "$home/state/demo-task.status" <<'EOF'
+done: unrelated later work
+EOF
+  touch_at "$home/state/demo-task.status" 2026-09-05 20:00
+
+  local out
+  out=$(FM_HOME="$home" "$FMTIME" propose --since "2026-09-01 00:00") \
+    || fail "propose failed on wide-gap evidence"
+  assert_contains "$out" "2 proposed window" "pings 11 hours apart (past the default gap) incorrectly merged"
+
+  pass "propose starts a new window once the gap exceeds the configured threshold"
+}
+
+test_propose_refuses_second_batch_without_replace() {
+  local home out err status
+  home=$(make_home propose-pending)
+  cat > "$home/state/demo-task.meta" <<EOF
+project=$home/projects/FnO
+EOF
+  touch_at "$home/state/demo-task.meta" 2026-09-05 09:00
+
+  FM_HOME="$home" "$FMTIME" propose --since "2026-09-01 00:00" >/dev/null \
+    || fail "first propose failed"
+
+  status=0
+  err=$(FM_HOME="$home" "$FMTIME" propose --since "2026-09-01 00:00" 2>&1 >/dev/null) || status=$?
+  expect_code 1 "$status" "propose with a pending batch and no --replace"
+  assert_contains "$err" "--replace" "refusal did not mention the --replace escape hatch"
+
+  out=$(FM_HOME="$home" "$FMTIME" propose --since "2026-09-01 00:00" --replace) \
+    || fail "propose --replace should succeed over a pending batch"
+  assert_contains "$out" "proposed window" "propose --replace did not regenerate a batch"
+
+  pass "propose refuses a second batch while one is pending, unless --replace is given"
+}
+
+test_propose_reads_reported_scout_completions_from_backlog() {
+  local home
+  home=$(make_home propose-reported)
+
+  cat > "$home/data/backlog.md" <<'EOF'
+- [x] carry-scout-example - Diagnose the thing data/carry-scout-example/report.md (repo: FnO) (reported 2026-09-05)
+EOF
+
+  local out
+  out=$(FM_HOME="$home" "$FMTIME" propose --since "2026-09-01 00:00") \
+    || fail "propose failed on a scout-style (reported ...) backlog completion"
+  assert_contains "$out" "1 proposed window" "a (reported ...) backlog completion produced no proposal"
+
+  local list
+  list=$(FM_HOME="$home" "$FMTIME" list) || fail "list failed"
+  assert_contains "$list" "project  FnO" "reported-completion proposal did not attribute the (repo: ...) project"
+  assert_contains "$list" "task     carry-scout-example" "reported-completion proposal did not attribute the task id"
+
+  pass "propose reads (reported YYYY-MM-DD) scout completions from the backlog, not only (done ...)"
+}
+
+test_propose_reads_merged_completions_from_backlog() {
+  local home
+  home=$(make_home propose-merged)
+
+  # tasks-axi writes "(merged YYYY-MM-DD)" instead of "(done ...)" for a task
+  # closed with `done <id> --pr <url>` (verified against a real tasks-axi
+  # binary); without handling this marker, every PR-linked completion is
+  # invisible to propose.
+  cat > "$home/data/backlog.md" <<'EOF'
+- [x] carry-ship-example - Ship the thing https://github.com/o/r/pull/42 (repo: FnO) (merged 2026-09-05)
+EOF
+
+  local out
+  out=$(FM_HOME="$home" "$FMTIME" propose --since "2026-09-01 00:00") \
+    || fail "propose failed on a (merged ...) backlog completion"
+  assert_contains "$out" "1 proposed window" "a (merged ...) backlog completion produced no proposal"
+
+  local list
+  list=$(FM_HOME="$home" "$FMTIME" list) || fail "list failed"
+  assert_contains "$list" "project  FnO" "merged-completion proposal did not attribute the (repo: ...) project"
+  assert_contains "$list" "task     carry-ship-example" "merged-completion proposal did not attribute the task id"
+  assert_not_contains "$list" "merged 2026-09-05" "merged-completion evidence text leaked the raw marker instead of the description"
+
+  pass "propose reads (merged YYYY-MM-DD) PR completions from the backlog, not only (done ...)"
+}
+
+# ---------------------------------------------------------------- approve / correction
+
+test_approve_records_entry_and_advances_cursor() {
+  local home
+  home=$(make_home approve-basic)
+  cat > "$home/state/demo-task.meta" <<EOF
+project=$home/projects/FnO
+EOF
+  touch_at "$home/state/demo-task.meta" 2026-09-05 18:30
+
+  FM_HOME="$home" "$FMTIME" propose --since "2026-09-01 00:00" >/dev/null
+
+  local out
+  out=$(FM_HOME="$home" "$FMTIME" approve p1) || fail "approve p1 failed"
+  assert_contains "$out" "approved p1" "approve did not report success"
+  assert_grep "task=demo-task" "$home/data/time-tracking/entries.md" \
+    "approved entry missing task attribution"
+  assert_present "$home/data/time-tracking/cursor" "approving the only pending proposal did not advance the cursor"
+
+  local list
+  list=$(FM_HOME="$home" "$FMTIME" list) || fail "list after approve failed"
+  assert_contains "$list" "no pending proposals" "approved proposal still shows as pending"
+
+  pass "approve records the window as a durable entry and clears it from pending"
+}
+
+test_approve_correction_overrides_proposed_fields() {
+  local home
+  home=$(make_home approve-correct)
+  cat > "$home/state/demo-task.meta" <<EOF
+project=$home/projects/FnO
+EOF
+  touch_at "$home/state/demo-task.meta" 2026-09-05 18:30
+  cat > "$home/state/demo-task.status" <<'EOF'
+working: first pass
+EOF
+  touch_at "$home/state/demo-task.status" 2026-09-05 18:35
+
+  FM_HOME="$home" "$FMTIME" propose --since "2026-09-01 00:00" >/dev/null
+  FM_HOME="$home" "$FMTIME" approve p1 \
+    --start "2026-09-05 18:00" --end "2026-09-05 19:30" --desc "corrected description" \
+    || fail "corrected approve failed"
+
+  assert_grep "start=2026-09-05 18:00" "$home/data/time-tracking/entries.md" \
+    "corrected start time was not recorded"
+  assert_grep "end=2026-09-05 19:30" "$home/data/time-tracking/entries.md" \
+    "corrected end time was not recorded"
+  assert_grep "desc=corrected description" "$home/data/time-tracking/entries.md" \
+    "corrected description was not recorded"
+
+  pass "approve accepts start/end/desc corrections over the proposed defaults"
+}
+
+test_reject_drops_without_recording() {
+  local home
+  home=$(make_home reject-basic)
+  cat > "$home/state/demo-task.meta" <<EOF
+project=$home/projects/FnO
+EOF
+  touch_at "$home/state/demo-task.meta" 2026-09-05 18:30
+
+  FM_HOME="$home" "$FMTIME" propose --since "2026-09-01 00:00" >/dev/null
+  FM_HOME="$home" "$FMTIME" reject p1 || fail "reject p1 failed"
+
+  if [ -e "$home/data/time-tracking/entries.md" ]; then
+    assert_no_grep "demo-task" "$home/data/time-tracking/entries.md" \
+      "rejected proposal was recorded as an entry anyway"
+  fi
+  pass "reject drops a proposal without recording anything"
+}
+
+test_split_divides_evidence_at_the_boundary() {
+  local home
+  home=$(make_home split-basic)
+  cat > "$home/state/demo-task.meta" <<EOF
+project=$home/projects/FnO
+EOF
+  touch_at "$home/state/demo-task.meta" 2026-09-05 18:00
+  cat > "$home/state/demo-task.status" <<'EOF'
+working: part one
+EOF
+  touch_at "$home/state/demo-task.status" 2026-09-05 18:10
+
+  FM_HOME="$home" "$FMTIME" propose --since "2026-09-01 00:00" >/dev/null
+  FM_HOME="$home" "$FMTIME" split p1 --at "2026-09-05 18:05" || fail "split failed"
+
+  local list
+  list=$(FM_HOME="$home" "$FMTIME" list) || fail "list after split failed"
+  assert_contains "$list" "[p1-a]" "split did not produce the first half"
+  assert_contains "$list" "[p1-b]" "split did not produce the second half"
+  assert_contains "$list" "end      2026-09-05 18:05" "split first half did not end at the boundary"
+  assert_contains "$list" "start    2026-09-05 18:05" "split second half did not start at the boundary"
+
+  FM_HOME="$home" "$FMTIME" approve p1-a --desc first >/dev/null || fail "approve p1-a failed"
+  FM_HOME="$home" "$FMTIME" approve p1-b --desc second >/dev/null || fail "approve p1-b failed"
+  assert_grep "desc=first" "$home/data/time-tracking/entries.md" "first half not recorded"
+  assert_grep "desc=second" "$home/data/time-tracking/entries.md" "second half not recorded"
+
+  pass "split divides a proposal's evidence at the given boundary into two approvable halves"
+}
+
+# ---------------------------------------------------------------- start / stop / log
+
+test_start_stop_records_a_live_session() {
+  local home out
+  home=$(make_home live-session)
+
+  out=$(FM_HOME="$home" FM_TIME_NOW_OVERRIDE=1788800000 "$FMTIME" start --project firstmate --task demo --desc "building") \
+    || fail "start failed"
+  assert_present "$home/data/time-tracking/active" "start did not create an active-session record"
+
+  out=$(FM_HOME="$home" FM_TIME_NOW_OVERRIDE=1788805000 "$FMTIME" stop) || fail "stop failed"
+  assert_contains "$out" "stopped" "stop did not report success"
+  assert_absent "$home/data/time-tracking/active" "stop left the active-session record behind"
+  assert_grep "desc=building" "$home/data/time-tracking/entries.md" "start/stop entry missing its description"
+
+  local status err
+  status=0
+  FM_HOME="$home" FM_TIME_NOW_OVERRIDE=1788810000 "$FMTIME" start --desc again >/dev/null \
+    || fail "second start after a stop should succeed"
+  err=$(FM_HOME="$home" FM_TIME_NOW_OVERRIDE=1788810000 "$FMTIME" start --desc other 2>&1 >/dev/null) \
+    && status=0 || status=$?
+  expect_code 1 "$status" "starting a second live session while one is already running"
+  assert_contains "$err" "already running" "double-start refusal used the wrong message"
+  FM_HOME="$home" FM_TIME_NOW_OVERRIDE=1788810120 "$FMTIME" stop >/dev/null
+
+  pass "start/stop records a live-tracked entry and refuses a concurrent second start"
+}
+
+test_stop_refuses_same_minute_session() {
+  local home out status
+  home=$(make_home live-session-same-minute)
+
+  FM_HOME="$home" FM_TIME_NOW_OVERRIDE=1788800000 "$FMTIME" start --desc "blink" >/dev/null \
+    || fail "start failed"
+
+  status=0
+  out=$(FM_HOME="$home" FM_TIME_NOW_OVERRIDE=1788800000 "$FMTIME" stop 2>&1) || status=$?
+  expect_code 1 "$status" "stop within the same wall-clock minute as start"
+  assert_contains "$out" "wait" "same-minute stop refusal used the wrong message"
+  assert_present "$home/data/time-tracking/active" \
+    "a refused same-minute stop must leave the live session running, not discard it"
+  if [ -e "$home/data/time-tracking/entries.md" ]; then
+    assert_no_grep "blink" "$home/data/time-tracking/entries.md" \
+      "a refused same-minute stop must not record a zero-duration entry"
+  fi
+
+  out=$(FM_HOME="$home" FM_TIME_NOW_OVERRIDE=1788800061 "$FMTIME" stop) \
+    || fail "stop should succeed once a minute has actually elapsed"
+  assert_contains "$out" "stopped" "stop did not report success once past the same-minute window"
+  assert_grep "desc=blink" "$home/data/time-tracking/entries.md" \
+    "session was not recorded once stopped past the same-minute window"
+
+  pass "stop refuses a same-minute session instead of silently recording a lost, zero-duration entry"
+}
+
+test_log_records_a_retroactive_entry() {
+  local home out
+  home=$(make_home retro-log)
+  out=$(FM_HOME="$home" "$FMTIME" log --start "2026-09-04 20:00" --end "2026-09-04 21:30" \
+    --project FnO --task carry-widget-fix --desc "retroactively logged debugging") \
+    || fail "log failed"
+  assert_contains "$out" "logged" "log did not report success"
+  assert_grep "desc=retroactively logged debugging" "$home/data/time-tracking/entries.md" \
+    "retroactive log entry missing its description"
+  assert_grep "task=carry-widget-fix" "$home/data/time-tracking/entries.md" \
+    "retroactive log entry missing its task"
+
+  pass "log records a retroactive entry directly, with no proposal step"
+}
+
+test_log_without_project_or_task_is_not_blocked() {
+  local home out
+  home=$(make_home retro-log-no-task)
+  out=$(FM_HOME="$home" "$FMTIME" log --start "2026-09-04 20:00" --end "2026-09-04 20:30" \
+    --desc "quick email reply, no task tied to it") \
+    || fail "log without --project/--task should not be blocked"
+  assert_contains "$out" "logged" "log did not report success"
+
+  out=$(FM_HOME="$home" "$FMTIME" report --month 2026-09) || fail "report failed"
+  assert_contains "$out" "(unattributed)" "report did not render a missing project/task as readable prose"
+  assert_contains "$out" "quick email reply" "unattributed entry's description is missing from the report"
+
+  pass "a missing task id never blocks recording, and the report renders it as readable prose"
+}
+
+test_log_refuses_end_before_start() {
+  local home status
+  home=$(make_home retro-log-bad)
+  status=0
+  FM_HOME="$home" "$FMTIME" log --start "2026-09-04 21:00" --end "2026-09-04 20:00" \
+    --desc bad >/dev/null 2>/tmp/fm-time-test-err3 || status=$?
+  expect_code 1 "$status" "log with end before start"
+  assert_contains "$(cat /tmp/fm-time-test-err3)" "after" "end-before-start refusal used the wrong message"
+  rm -f /tmp/fm-time-test-err3
+  pass "log refuses an entry whose end is not after its start"
+}
+
+# ---------------------------------------------------------------- own lock
+
+test_lock_blocks_while_owner_process_is_still_alive() {
+  local home lock_dir sleeper_pid status err elapsed start_s
+  home=$(make_home lock-live-owner)
+  mkdir -p "$home/data/time-tracking"
+  lock_dir="$home/data/time-tracking/.lock"
+  mkdir "$lock_dir"
+
+  sleep 60 &
+  sleeper_pid=$!
+  printf '%s\n' "$sleeper_pid" > "$lock_dir/pid"
+  # A far-past mtime: an age-only staleness check (the pre-fix behavior)
+  # would treat this as abandoned and steal it even though its recorded
+  # owner is still running.
+  touch -t 202001010000 "$lock_dir"
+
+  status=0
+  start_s=$SECONDS
+  err=$(FM_HOME="$home" "$FMTIME" log --start "2026-09-04 20:00" --end "2026-09-04 20:30" --desc x 2>&1) \
+    || status=$?
+  elapsed=$((SECONDS - start_s))
+
+  kill "$sleeper_pid" 2>/dev/null
+  wait "$sleeper_pid" 2>/dev/null
+
+  expect_code 1 "$status" "log against a lock recorded as held by a still-alive owner"
+  assert_contains "$err" "appears to be running" "a live lock owner's hold was stolen instead of respected"
+  [ "$elapsed" -ge 5 ] || fail "the lock was released far too quickly for a live owner to have been respected (waited ${elapsed}s)"
+
+  pass "tt_lock never reclaims a lock whose recorded owner process is still alive, no matter its age"
+}
+
+test_lock_reclaimed_promptly_from_a_dead_owner() {
+  local home lock_dir dead_pid status out elapsed start_s
+  home=$(make_home lock-dead-owner)
+  mkdir -p "$home/data/time-tracking"
+  lock_dir="$home/data/time-tracking/.lock"
+  mkdir "$lock_dir"
+
+  ( exit 0 ) &
+  dead_pid=$!
+  wait "$dead_pid" 2>/dev/null
+  printf '%s\n' "$dead_pid" > "$lock_dir/pid"
+  # Deliberately fresh mtime: an age-only staleness check would refuse to
+  # reclaim this for LOCK_STALE_SECS even though the recorded owner is
+  # already dead; liveness must decide this, not age.
+
+  start_s=$SECONDS
+  out=$(FM_HOME="$home" "$FMTIME" log --start "2026-09-04 20:00" --end "2026-09-04 20:30" --desc reclaimed 2>&1)
+  status=$?
+  elapsed=$((SECONDS - start_s))
+
+  expect_code 0 "$status" "log against a lock abandoned by a dead owner"
+  assert_contains "$out" "logged" "log did not succeed once the dead owner's lock was reclaimed"
+  [ "$elapsed" -lt 5 ] || fail "a lock with a dead recorded owner should reclaim immediately, not wait out a staleness timer (took ${elapsed}s)"
+
+  pass "tt_lock reclaims a lock immediately once its recorded owner is confirmed dead, even when the lock is fresh"
+}
+
+# ---------------------------------------------------------------- report
+
+test_report_groups_by_month_and_splits_after_hours() {
+  local home
+  home=$(make_home report-basic)
+
+  # After-hours: a weekday evening entry (2026-09-02 is a Wednesday).
+  FM_HOME="$home" "$FMTIME" log --start "2026-09-02 19:00" --end "2026-09-02 20:00" \
+    --project FnO --task widget-fix --desc "evening fix" >/dev/null
+  # Business hours: same day, mid-afternoon.
+  FM_HOME="$home" "$FMTIME" log --start "2026-09-02 14:00" --end "2026-09-02 15:00" \
+    --project FnO --task widget-fix --desc "afternoon follow-up" >/dev/null
+  # A different month entirely, must not appear in the September report.
+  FM_HOME="$home" "$FMTIME" log --start "2026-08-15 10:00" --end "2026-08-15 11:00" \
+    --project FnO --task widget-fix --desc "august work" >/dev/null
+
+  local out
+  out=$(FM_HOME="$home" "$FMTIME" report --month 2026-09) || fail "report failed"
+  assert_contains "$out" "2026-09" "report header missing the requested month"
+  assert_contains "$out" "total: 2h00m" "report total did not sum both September entries"
+  assert_contains "$out" "after hours" "report did not label after-hours time"
+  assert_contains "$out" "1h00m" "report is missing the 1-hour after-hours contribution"
+  assert_not_contains "$out" "august work" "August entry leaked into the September report"
+
+  pass "report sums entries for the requested month only and separates after-hours time"
+}
+
+test_report_month_boundary_uses_entry_start_date() {
+  local home out
+  home=$(make_home report-boundary)
+  FM_HOME="$home" "$FMTIME" log --start "2026-08-31 23:00" --end "2026-09-01 01:00" \
+    --project FnO --task overnight --desc "crossed midnight into September" >/dev/null
+
+  out=$(FM_HOME="$home" "$FMTIME" report --month 2026-08) || fail "august report failed"
+  assert_contains "$out" "total: 2h00m" "an entry starting in August was not counted in the August report"
+
+  out=$(FM_HOME="$home" "$FMTIME" report --month 2026-09) || fail "september report failed"
+  assert_contains "$out" "no entries recorded" "an entry that only ENDS in September was wrongly counted there too"
+
+  pass "report attributes a midnight-crossing entry to its start month, not its end month"
+}
+
+test_time_tracking_never_writes_supervision_state() {
+  local home before_lock before_wake
+  home=$(make_home no-supervision-touch)
+  printf 'pid-marker\n' > "$home/state/.lock"
+  printf '111\t1\tcheck\tk\tp\n' > "$home/state/.wake-queue"
+  before_lock=$(cat "$home/state/.lock")
+  before_wake=$(cat "$home/state/.wake-queue")
+
+  cat > "$home/state/demo-task.meta" <<EOF
+project=$home/projects/FnO
+EOF
+  touch_at "$home/state/demo-task.meta" 2026-09-05 18:30
+
+  FM_HOME="$home" "$FMTIME" propose --since "2026-09-01 00:00" >/dev/null
+  FM_HOME="$home" "$FMTIME" approve p1 >/dev/null
+  FM_HOME="$home" "$FMTIME" report --month 2026-09 >/dev/null
+
+  [ "$(cat "$home/state/.lock")" = "$before_lock" ] || fail "fm-time.sh modified the session lock file"
+  [ "$(cat "$home/state/.wake-queue")" = "$before_wake" ] || fail "fm-time.sh modified the durable wake queue"
+
+  pass "propose/approve/report only read state/.lock and state/.wake-queue, never write them"
+}
+
+test_propose_clusters_synthetic_status_and_meta_evidence
+test_propose_wide_gap_produces_two_windows
+test_propose_refuses_second_batch_without_replace
+test_propose_reads_reported_scout_completions_from_backlog
+test_propose_reads_merged_completions_from_backlog
+test_approve_records_entry_and_advances_cursor
+test_approve_correction_overrides_proposed_fields
+test_reject_drops_without_recording
+test_split_divides_evidence_at_the_boundary
+test_start_stop_records_a_live_session
+test_stop_refuses_same_minute_session
+test_log_records_a_retroactive_entry
+test_log_without_project_or_task_is_not_blocked
+test_log_refuses_end_before_start
+test_lock_blocks_while_owner_process_is_still_alive
+test_lock_reclaimed_promptly_from_a_dead_owner
+test_report_groups_by_month_and_splits_after_hours
+test_report_month_boundary_uses_entry_start_date
+test_time_tracking_never_writes_supervision_state
diff --git a/tests/fm-turnend-guard.test.sh b/tests/fm-turnend-guard.test.sh
index 5fb6310204f..31bcd6be46c 100755
--- a/tests/fm-turnend-guard.test.sh
+++ b/tests/fm-turnend-guard.test.sh
@@ -1695,17 +1695,38 @@ test_hook_claude_mode_stale_rewake_epoch_blocks() {
   pass "fm-turnend-guard --claude: stale rewake epoch does not allow a blind stop"
 }
 
-test_hook_claude_mode_budget_without_verified_failure_keeps_blocking() {
+# An auto-arm that never ran records no failure episode to verify, so the
+# exhausted-episode proof can never cover the case where supervision could not
+# start at all. Before this was the second fail-open condition, this fixture -
+# in-flight work, no watcher, no auto-arm evidence whatsoever - blocked every
+# stop indefinitely, and the only thing that ended the turn was Claude Code's
+# hard 8-consecutive-block override. The bound is what makes it safe: the valve
+# stays shut for the whole block budget and opens exactly once.
+test_hook_claude_mode_absent_autoarm_reaches_the_bounded_fail_open() {
   local dir out status i
-  dir=$(make_primary_dir "$TMP_ROOT/hook-claude-budget")
+  dir=$(make_primary_dir "$TMP_ROOT/hook-claude-absent-autoarm")
   : > "$dir/state/task1.meta"
-  for i in 1 2 3 4; do
+  assert_absent "$dir/state/.claude-autoarm-epoch" "fixture must start with no auto-arm evidence at all"
+  for i in 1 2 3; do
     out=$(FM_CLAUDE_AUTOARM_SYNC_WAIT_MS=100 run_hook_claude "$dir" false); status=$?
     expect_code 2 "$status" "--claude block $i must exit 2 within the budget"
+    assert_not_contains "$out" 'systemMessage' "block $i failed open before the budget was exhausted"
+    assert_absent "$dir/state/.claude-autoarm-failure-alarmed" "block $i recorded an attended alarm inside the budget"
   done
-  assert_not_contains "$out" 'systemMessage' "budget exhaustion without verified auto-arm failure must not fail open"
-  assert_absent "$dir/state/.claude-autoarm-failure-alarmed" "unverified budget exhaustion recorded an attended alarm"
-  pass "fm-turnend-guard --claude: budget exhaustion alone cannot permit a blind stop"
+
+  out=$(FM_CLAUDE_AUTOARM_SYNC_WAIT_MS=100 run_hook_claude "$dir" false); status=$?
+  expect_code 0 "$status" "an absent auto-arm with an exhausted budget must reach the bounded attended fail-open"
+  assert_contains "$out" 'FIRSTMATE SUPERVISION IS GENUINELY DOWN' "absent-auto-arm fail-open was not unmistakable"
+  assert_contains "$out" 'never claimed this home at all' "absent-auto-arm fail-open did not name the real condition"
+  assert_not_contains "$out" 'last recorded an attempt' "a home with no ledger at all was reported as having recorded an attempt"
+  assert_contains "$out" 'Keep this session attended' "absent-auto-arm fail-open omitted the attended-session action"
+  assert_not_contains "$out" 'fm-watch-arm.sh' "absent-auto-arm fail-open assigned a manual watcher launch"
+  assert_present "$dir/state/.claude-autoarm-failure-alarmed" "absent-auto-arm fail-open did not consume the episode alarm"
+
+  out=$(FM_CLAUDE_AUTOARM_SYNC_WAIT_MS=100 run_hook_claude "$dir" false); status=$?
+  expect_code 2 "$status" "a consumed attended alarm must make later unhealthy stops block again"
+  assert_not_contains "$out" 'FIRSTMATE SUPERVISION IS GENUINELY DOWN' "absent-auto-arm alarm repeated in one episode"
+  pass "fm-turnend-guard --claude: an auto-arm that never claimed still reaches one bounded attended fail-open"
 }
 
 test_hook_claude_mode_verified_failure_alarm_is_loud_and_once() {
@@ -1727,23 +1748,68 @@ test_hook_claude_mode_verified_failure_alarm_is_loud_and_once() {
   pass "fm-turnend-guard --claude: verified fail-open is loud, bounded, attended, and non-repeating"
 }
 
-test_hook_claude_mode_fail_open_requires_notice_and_failure_epoch() {
-  local no_notice notice_only out status
-  no_notice=$(make_primary_dir "$TMP_ROOT/hook-claude-alarm-no-notice")
-  : > "$no_notice/state/task1.meta"
-  printf 'epoch=3 owner_pid=999 outcome=failed-suppressed updated_at=1\n' > "$no_notice/state/.claude-autoarm-epoch"
-  touch -t 202001010000 "$no_notice/state/.claude-autoarm-epoch"
-  seed_claude_budget "$no_notice" 3
-  out=$(FM_CLAUDE_AUTOARM_SYNC_WAIT_MS=100 run_hook_claude "$no_notice" true); status=$?
-  expect_code 2 "$status" "an exhausted failure epoch without the consumed notice must remain blocking"
-
-  notice_only=$(make_primary_dir "$TMP_ROOT/hook-claude-alarm-no-epoch")
-  : > "$notice_only/state/task1.meta"
-  : > "$notice_only/state/.claude-autoarm-failure-notified"
-  seed_claude_budget "$notice_only" 3
-  out=$(FM_CLAUDE_AUTOARM_SYNC_WAIT_MS=100 run_hook_claude "$notice_only" true); status=$?
-  expect_code 2 "$status" "a consumed notice without an exhausted failure epoch must remain blocking"
-  pass "fm-turnend-guard --claude: fail-open requires both exhausted retries and consumed notice"
+# The two conditions that open the valve are deliberately narrow, and these are
+# the boundaries that keep them narrow. A FRESH auto-arm entry means the
+# mechanism is running this event and must still be given the block, however
+# exhausted the budget is; and an exhausted budget alone never opens the valve
+# while the auto-arm is still establishing.
+test_hook_claude_mode_fail_open_refused_while_autoarm_is_establishing() {
+  local dir out status
+  dir=$(make_primary_dir "$TMP_ROOT/hook-claude-alarm-establishing")
+  : > "$dir/state/task1.meta"
+  printf 'epoch=4 owner_pid=%s outcome=arming updated_at=%s\n' "$(nonexistent_pid)" "$(date +%s)" \
+    > "$dir/state/.claude-autoarm-epoch"
+  seed_claude_budget "$dir" 3
+  out=$(FM_CLAUDE_AUTOARM_SYNC_WAIT_MS=100 run_hook_claude "$dir" true); status=$?
+  expect_code 2 "$status" "a fresh auto-arm entry must still block even with the budget exhausted"
+  assert_not_contains "$out" 'FIRSTMATE SUPERVISION IS GENUINELY DOWN' "an establishing auto-arm was treated as an absent one"
+  assert_absent "$dir/state/.claude-autoarm-failure-alarmed" "an establishing auto-arm consumed the attended alarm"
+  pass "fm-turnend-guard --claude: a fresh auto-arm entry keeps the fail-open shut"
+}
+
+# The exhausted-episode path waits for the HANDOFF, not just for the outcome: it
+# requires the auto-arm's one failure notice to have been consumed as well as an
+# exhausted-failure ledger. This is the state between those two events - a fresh
+# failed-suppressed epoch with no notice yet - and it must still block, because
+# the auto-arm has not finished reporting. A fresh ledger is what keeps the
+# absent/stale path out of it, so this case can only be decided by the notice
+# precondition, and deleting that precondition flips it to a fail-open one block
+# early.
+test_hook_claude_mode_exhausted_episode_without_a_consumed_notice_blocks() {
+  local dir out status
+  dir=$(make_primary_dir "$TMP_ROOT/hook-claude-alarm-no-notice")
+  : > "$dir/state/task1.meta"
+  printf 'epoch=4 owner_pid=%s outcome=failed-suppressed updated_at=%s\n' "$(nonexistent_pid)" "$(date +%s)" \
+    > "$dir/state/.claude-autoarm-epoch"
+  assert_absent "$dir/state/.claude-autoarm-failure-notified" "fixture must start with no consumed failure notice"
+  seed_claude_budget "$dir" 3
+  out=$(FM_CLAUDE_AUTOARM_SYNC_WAIT_MS=100 run_hook_claude "$dir" true); status=$?
+  expect_code 2 "$status" "an exhausted-failure ledger whose notice is not yet consumed must still block"
+  assert_not_contains "$out" 'FIRSTMATE SUPERVISION IS GENUINELY DOWN' "the fail-open fired before the auto-arm's failure notice was consumed"
+  assert_absent "$dir/state/.claude-autoarm-failure-alarmed" "a fail-open with no consumed notice consumed the attended alarm"
+  pass "fm-turnend-guard --claude: an exhausted episode without its consumed notice keeps blocking"
+}
+
+# A stale auto-arm entry is the same unrepairable condition as no entry at all:
+# the mechanism ran at some point and is not running now. It reaches the valve
+# through the absent path rather than needing a matching consumed notice, which
+# is precisely what an auto-arm that stopped running cannot produce. It is a
+# different FACT though, and the notice has to say which one it verified: an
+# attempt IS on record here, so reporting none would send a captain to the hook
+# wiring instead of to the outcome sitting in the ledger.
+test_hook_claude_mode_stale_autoarm_evidence_reaches_the_fail_open() {
+  local dir out status
+  dir=$(make_primary_dir "$TMP_ROOT/hook-claude-alarm-stale")
+  : > "$dir/state/task1.meta"
+  printf 'epoch=3 owner_pid=999 outcome=failed-suppressed updated_at=1\n' > "$dir/state/.claude-autoarm-epoch"
+  touch -t 202001010000 "$dir/state/.claude-autoarm-epoch"
+  seed_claude_budget "$dir" 3
+  out=$(FM_CLAUDE_AUTOARM_SYNC_WAIT_MS=100 run_hook_claude "$dir" true); status=$?
+  expect_code 0 "$status" "a stale auto-arm entry with an exhausted budget must reach the bounded attended fail-open"
+  assert_contains "$out" 'last recorded an attempt more than one event epoch ago' "a stale auto-arm entry did not report the stale condition it actually is"
+  assert_not_contains "$out" 'never claimed this home at all' "a stale auto-arm entry with a recorded attempt was reported as having left no attempt on record"
+  assert_present "$dir/state/.claude-autoarm-failure-alarmed" "the stale-evidence fail-open did not consume the episode alarm"
+  pass "fm-turnend-guard --claude: stale auto-arm evidence reaches the same bounded fail-open"
 }
 
 test_hook_claude_mode_away_mode_never_uses_stop_autoarm_fail_open() {
@@ -2138,9 +2204,11 @@ test_hook_claude_mode_integrated_monotonic_fail_open
 test_hook_claude_mode_recovery_contention_is_not_ordinary_allow
 test_hook_claude_mode_concurrent_recovery_resets_are_idempotent
 test_hook_claude_mode_stale_rewake_epoch_blocks
-test_hook_claude_mode_budget_without_verified_failure_keeps_blocking
+test_hook_claude_mode_absent_autoarm_reaches_the_bounded_fail_open
 test_hook_claude_mode_verified_failure_alarm_is_loud_and_once
-test_hook_claude_mode_fail_open_requires_notice_and_failure_epoch
+test_hook_claude_mode_fail_open_refused_while_autoarm_is_establishing
+test_hook_claude_mode_stale_autoarm_evidence_reaches_the_fail_open
+test_hook_claude_mode_exhausted_episode_without_a_consumed_notice_blocks
 test_hook_claude_mode_away_mode_never_uses_stop_autoarm_fail_open
 test_hook_claude_mode_allow_resets_budget
 test_hook_claude_mode_waits_for_late_claim
diff --git a/tests/lib.sh b/tests/lib.sh
index e42945de19f..66a3d679b11 100644
--- a/tests/lib.sh
+++ b/tests/lib.sh
@@ -398,6 +398,14 @@ SH
   chmod +x "$fakebin/$tool"
 }
 
+# --- session-lock cohort signals --------------------------------------------
+#
+# tests/session-signals.sh owns the list and derives it from the library's own
+# tables; it is a separate file because the opt-in live guards need it without
+# any of this file's source-time side effects.
+# shellcheck source=tests/session-signals.sh
+. "$(dirname "${BASH_SOURCE[0]}")/session-signals.sh"
+
 # --- deterministic git identity and fixtures --------------------------------
 
 # fm_git_identity [name] [email]: export a fixed author/committer identity so
diff --git a/tests/session-signals.sh b/tests/session-signals.sh
new file mode 100644
index 00000000000..491ac73b833
--- /dev/null
+++ b/tests/session-signals.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# tests/session-signals.sh - the one owner of the session-cohort signal list.
+#
+# Every environment variable the session-lock cohort proof reads: the launch
+# markers in FM_SESSION_LAUNCH_MARKERS, and the container guards and pane ids in
+# FM_SESSION_CONTAINERS (bin/fm-session-lock-lib.sh owns both tables). Both are
+# row-per-line tables whose first column is the harness or provider that owns the
+# row, so both are read the same way and only the variable columns are emitted.
+#
+# A fixture that starts a harness-named process MUST clear all of them, or that
+# process inherits the captain session's own launch marker and pane id, is
+# genuinely in the cohort of the process asking about it, and a control that
+# reads as "a separate concurrent session" silently becomes "this session's own
+# holder".
+#
+# The list is DERIVED from those tables rather than transcribed, so a verified row
+# added to FM_SESSION_CONTAINERS - zellij and orca are named there as pending -
+# or a second launch marker is cleared by every suite at once. Three consumers
+# read it: tests/lib.sh for the portable suites, and the two opt-in live guards
+# directly, because they must not source tests/lib.sh (it arms EXIT traps,
+# exports FM_GATE_REFUSE_BYPASS, and reaps orphan fixture roots on source).
+#
+# This file is sourced and has no side effects beyond the two names below. The
+# derivation runs in a subshell, so the library's own functions and tables do not
+# leak into a suite that never asked for them.
+
+FM_TEST_SESSION_SIGNAL_VARS=$(
+  lib="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/bin/fm-session-lock-lib.sh"
+  # shellcheck source=bin/fm-session-lock-lib.sh
+  . "$lib" || exit 1
+  while read -r _ var; do
+    [ -n "$var" ] || continue
+    printf '%s\n' "$var"
+  done <<MARKERS
+$FM_SESSION_LAUNCH_MARKERS
+MARKERS
+  while read -r _ guard panevar; do
+    [ -n "$guard" ] || continue
+    printf '%s\n%s\n' "$guard" "$panevar"
+  done <<TABLE
+$FM_SESSION_CONTAINERS
+TABLE
+) || FM_TEST_SESSION_SIGNAL_VARS=
+FM_TEST_SESSION_SIGNAL_VARS=$(printf '%s' "$FM_TEST_SESSION_SIGNAL_VARS" | tr '\n' ' ')
+
+case "$FM_TEST_SESSION_SIGNAL_VARS" in
+  *CLAUDE_PID*) : ;;
+  *)
+    printf 'session-signals: cannot derive the cohort signal list from bin/fm-session-lock-lib.sh\n' >&2
+    exit 1
+    ;;
+esac
+
+# Populate FM_TEST_CLEAR_SIGNALS_ARGV with an `env -u ...` prefix that clears
+# every one of them. Bash 3.2 has no namerefs, so the array is the return value.
+FM_TEST_CLEAR_SIGNALS_ARGV=()
+fm_test_clear_signals_argv() {
+  local var
+  FM_TEST_CLEAR_SIGNALS_ARGV=(env)
+  for var in $FM_TEST_SESSION_SIGNAL_VARS; do
+    FM_TEST_CLEAR_SIGNALS_ARGV+=(-u "$var")
+  done
+}