fix(bin): keep supervisor status closes from waking the same home

[tiago-peixoto]

Intent

The developer wanted to fix upstream firstmate issue 3745, which the maintainer labeled ready-for-pr. After a clean first inheritance of shared-captain config, editing only the authoritative shared-captain source makes convergence report drift and quarantine the destination copy, even though nobody touched that copy. This happens because convergence compares only the current source hash with the current destination hash. The required fix must tell apart a destination that has not changed since its last successful inheritance from one that was really edited. It must still keep recovery copies and still refuse to converge when the destination has truly diverged or a publish was interrupted. The issue's scratch controls are the reproduction: a first copy stays quiet, an unchanged copy stays quiet, and a source-only edit wrongly triggers the false drift. The transcript itself is only nested pipeline prompts (intent phase, then PR phase for branch fm/firstmate-issue3745-shared-captain-false-drift), so this goal comes from the embedded intent text rather than from a direct conversation.

What Changed

• fm_wake_status_append_self_announced in bin/fm-wake-lib.sh now takes several lines, appends them together, and advances the watcher's seen marker in two cases. The first is when the watcher already classified every earlier byte. The second is when the OPEN DECISIONS fold cursor reaches the pre-append size and every line the watcher has not classified yet is a keyed needs-decision or blocked line.
  Before committing the marker, it runs the watcher's span classifier from its classified offset to the new end of the file. Any unlisted line the fold read, such as a worker's failed:, paused:, working: or resolved line, a verb-less line, or a captain-held line, still wakes the home, and so does any foreign write that lands in between. This covers issue 4767: a session-start drain that listed the decisions without writing a watcher seen marker no longer gets woken by its own close.
• fm-send --resolve-key and fm-captain-hold.sh complete now send all of one command's resolved or captain-held lines through a single guarded append instead of one append per key. So one answer covering several decisions no longer produces a wake per key. If the batched append fails, fm-send prints one manual printf command covering every close line. If a key is still open after the append, it prints the manual command for that key alone.
• docs/architecture.md now describes the new rule for when the guarded append counts earlier bytes as already seen. New tests cover the fold-then-close path, a multi-key close after a fold, and worker or secondmate lines inside the folded span that must still wake (tests/fm-watch-triage.test.sh, tests/fm-wake-queue.test.sh, tests/fm-send-resolve-key.test.sh).

🤖 Generated with Claude Code

Risk Assessment

⚠️ Medium: The change edits the core rule that decides when a status append may skip waking the supervisor, so a hole would silently hide a worker's signal. I traced each changed path (the fast path, the path through the OPEN DECISIONS fold cursor, the post-append classifier, and the batched multi-key closes in fm-send and captain-hold) and found no defect under the rule you accepted: anything not provably read still wakes. The known leftover gap, separate answers still waking, is tracked in #4885.

Testing

I drove ten scenarios end-to-end on both HEAD and base. Each ran in a throwaway home with the real watcher, drain, fm-send and captain-hold scripts; only tmux and fm-crew-state were stubbed, because no crew pane exists here. On HEAD the watcher stayed quiet for three full poll cycles after each of these closes: a single-key close following a session-start OPEN DECISIONS drain, a two-key close from one answer, a two-key captain-held transfer, and a close in the normal watcher-wakes-then-drain loop. A later worker blocked: line still woke it. On base, the three drain-first closes (single-key, two-key and captain-held) woke the supervisor, and the drain annotation was its own resolved or captain-held line, which is the issue's symptom. Every adversarial worker-line scenario woke on HEAD, as on base. When the append itself failed, HEAD printed one manual close command covering both keys, and running it closed both. Base printed a command for the first key only, which left the second key open. The targeted existing tests for the changed code paths all passed. I did not run the full suite. This is a CLI/watcher change with no rendered UI, so the evidence is CLI transcripts rather than screenshots. Two harness notes. First, fm-send and captain-hold ran with the documented test-harness bypass FM_GATE_REFUSE_BYPASS=1, because every home was a temp dir. Second, the self-announce moves only the watcher's seen marker, not the drain's reading position, so when a later genuine worker wake arrives the drain still shows the supervisor's earlier close as an unread annotation line. That is context on a real wake, not a wake of its own. The worktree is clean and all temp homes were removed.

• Live validation: ✅ go - 11 of 11 scenarios driven live against the product

Scenario	Result	Live	Evidence
The session-start drain lists a decision, the supervisor answers with fm-send --resolve-key, and the watcher then starts: it does not wake the supervisor to read its own resolved line	✅ pass	live	e2e-head-transcript.txt fold_single: QUIET after 3 full poll cycles. On base (e2e-base-transcript.txt) the watcher woke, and the drain annotation was resolved [key=api-shape]: answered: go with REST…
A worker line written after a quiet self-close (blocked: need staging credentials) still wakes the supervisor	✅ pass	live	e2e-head-transcript.txt fold_single and watcher_loop: WOKE: signal: state/t1.status, and the drain showed the blocked line
Normal loop: the watcher surfaces a decision, the supervisor drains and acks, answers with --resolve-key, and restarts the watcher: it stays quiet	✅ pass	live	e2e-head-transcript.txt watcher_loop: QUIET after 3 cycles (quiet on base too, so this is a regression check)
Two decisions listed by the drain are closed by one fm-send --resolve-key budget --resolve-key vendor answer: no wake, and OPEN DECISIONS is empty afterwards	✅ pass	live	e2e-head-transcript.txt fold_multi: QUIET after 3 cycles, and the next drain lists no open decisions. On base the watcher woke with both of the supervisor's resolved lines.
fm-captain-hold complete moves two drain-listed decisions to the captain-held task: the two captain-held lines do not wake the supervisor	✅ pass	live	e2e-head-transcript.txt hold_transfer: QUIET after 3 cycles. On base the watcher woke, and the drain annotated captain-held [key=access]: tracked by route-call.
Adversarial: a worker appends blocked: vendor portal is down after the drain but before the supervisor's close: the watcher still wakes	✅ pass	live	e2e-head-transcript.txt late_worker: WOKE, and the drain shows the blocked line as an open decision
Adversarial: while the watcher is down, a ship worker writes working: after the decision the drain listed; after the supervisor's close the watcher still wakes	✅ pass	live	e2e-head-transcript.txt folded_working: WOKE: signal: state/t1.status
Adversarial: a secondmate relays failed: and working: lines that the drain read but did not list; the supervisor's close does not hide them	✅ pass	live	e2e-head-transcript.txt sm_failed: WOKE: signal: state/mate.status (crew stubbed as provably working)
Adversarial: a secondmate paused: line that the drain read but did not list still wakes after the supervisor's close	✅ pass	live	e2e-head-transcript.txt sm_paused: WOKE: signal: state/mate.status
Adversarial: a decision that a secondmate raised and resolved itself (never listed by the drain) still wakes after the supervisor's unrelated close	✅ pass	live	e2e-head-transcript.txt sm_selfresolved: WOKE: signal: state/mate.status
Adversarial: the status file cannot be appended to during a two-key answer: fm-send exits nonzero and prints one manual close command, and running that command closes both keys	✅ pass	live	e2e-head-transcript.txt append_fail: rc=1, the stderr names 'budget vendor', eval of the printed command appended both resolved lines, and the next drain lists nothing open. On base the printed comman…

Evidence: End-to-end driver script (real watcher, drain, fm-send and captain-hold in throwaway homes)

Source: End-to-end driver script (real watcher, drain, fm-send and captain-hold in throwaway homes)

#!/usr/bin/env bash
# End-to-end driver for issue 4767 (supervisor's own status close must not wake
# the same home; worker lines still must). Runs the REAL product scripts from
# <root>: bin/fm-watch.sh (watcher), bin/fm-wake-drain.sh (drain / OPEN
# DECISIONS), bin/fm-send.sh --resolve-key (answer + close), and
# bin/fm-captain-hold.sh complete (captain-held transfer). Only tmux and
# fm-crew-state are stubbed, because there is no live tmux session / crew pane.
#
# usage: e2e-4767.sh <root> <label> [case...]
# fm-send/fm-captain-hold run with FM_GATE_REFUSE_BYPASS=1 (the documented
# test-harness escape hatch) because every home here is a throwaway temp dir.
set -u
ROOT=$1; LABEL=$2; shift 2
CASES=${*:-"fold_single watcher_loop fold_multi late_worker folded_working sm_failed sm_paused sm_selfresolved hold_transfer append_fail"}
WORK=$(mktemp -d "${TMPDIR:-/tmp}/fm4767-$LABEL.XXXXXX")
say() { printf '%s\n' "$*"; }
hr() { printf -- '---- %s\n' "$*"; }

make_fakebins() {  # <dir>
  local d=$1
  mkdir -p "$d/sendbin" "$d/watchbin"
  # fm-send: accept typed input, report an empty composer so submit confirms.
  cat > "$d/sendbin/tmux" <<'SH'
#!/usr/bin/env bash
case "${1:-}" in
  send-keys) exit 0 ;;
  display-message) for a in "$@"; do case "$a" in *cursor_y*) echo 1; exit 0 ;; esac; done; echo fakepane; exit 0 ;;
  capture-pane) printf '╭────╮\n│    │\n╰────╯\n'; exit 0 ;;
  list-windows) printf '%s\n' fm-t1 fm-mate fm-origin; exit 0 ;;
esac
exit 0
SH
  printf '#!/usr/bin/env bash\nexit 0\n' > "$d/sendbin/sleep"
  # watcher: the crew pane is actively working (its output keeps changing), so
  # the pane-stale path never fires and only status signals can wake.
  cat > "$d/watchbin/tmux" <<'SH'
#!/usr/bin/env bash
[ "${1:-}" = list-windows ] && exit 0
[ "${1:-}" = capture-pane ] && { printf 'compiling step %s\n' "$RANDOM$RANDOM"; exit 0; }
exit 1
SH
  cat > "$d/watchbin/fm-crew-state.sh" <<'SH'
#!/usr/bin/env bash
printf '%s\n' "${FM_FAKE_CREW_STATE:-state: unknown · source: none · idle worker}"
SH
  chmod +x "$d"/sendbin/* "$d"/watchbin/*
}

new_home() {  # <name> -> sets HOME_DIR STATE_DIR BIN
  HOME_DIR="$WORK/$1"; STATE_DIR="$HOME_DIR/state"; BIN="$HOME_DIR"
  mkdir -p "$STATE_DIR" "$HOME_DIR/data" "$HOME_DIR/config"
  make_fakebins "$HOME_DIR"
}

ship_meta() { printf 'window=sess:fm-%s\nkind=ship\n' "$1" > "$STATE_DIR/$1.meta"; }
mate_meta() {
  printf '%s\n' "window=sess:fm-$1" "endpoint_task_id=$1" "worktree=$HOME_DIR" "project=$HOME_DIR" \
    "harness=echo" "kind=secondmate" "mode=secondmate" "yolo=off" "home=$HOME_DIR" "projects=alpha" \
    > "$STATE_DIR/$1.meta"
}

drain() {  # supervisor drains; acks any presented wake rows like the real loop
  local out err seq gen
  out=$(FM_STATE_OVERRIDE="$STATE_DIR" "$ROOT/bin/fm-wake-drain.sh" 2>"$HOME_DIR/drain.err")
  printf '%s\n' "$out" | sed 's/^/  drain| /'
  seq=$(sed -n 's/^WAKE_ACK_REQUIRED:.*--ack-through \([0-9][0-9]*\) --recovery-generation.*/\1/p' "$HOME_DIR/drain.err")
  gen=$(sed -n 's/^WAKE_ACK_REQUIRED:.*--recovery-generation \([A-Za-z0-9._-]*\)$/\1/p' "$HOME_DIR/drain.err")
  if [ -n "$seq" ] && [ -n "$gen" ]; then
    FM_STATE_OVERRIDE="$STATE_DIR" "$ROOT/bin/fm-wake-drain.sh" --ack-through "$seq" --recovery-generation "$gen" >/dev/null 2>&1
    say "  drain| (acked through $seq)"
  fi
}

send() {  # fm-send.sh <args...>; then the worker reads the answer (the
  # documented worker contract: mv each handled record into <id>.inbox/handled/)
  local rc=0 d
  env FM_GATE_REFUSE_BYPASS=1 PATH="$HOME_DIR/sendbin:$PATH" FM_ROOT_OVERRIDE="$HOME_DIR" FM_HOME="$HOME_DIR" \
    FM_SEND_LOG=/dev/null FM_SEND_SETTLE=0 "$ROOT/bin/fm-send.sh" "$@" || rc=$?
  for d in "$STATE_DIR"/*.inbox; do
    [ -d "$d" ] || continue
    mkdir -p "$d/handled"; mv "$d"/*.msg "$d/handled/" 2>/dev/null || true
  done
  return "$rc"
}

WPID=
watch_start() {
  : > "$HOME_DIR/watch.out"
  PATH="$HOME_DIR/watchbin:$PATH" FM_STATE_OVERRIDE="$STATE_DIR" \
    FM_CREW_STATE_BIN="$HOME_DIR/watchbin/fm-crew-state.sh" \
    FM_POLL=1 FM_SIGNAL_GRACE=1 FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 \
    "$ROOT/bin/fm-watch.sh" > "$HOME_DIR/watch.out" 2>"$HOME_DIR/watch.err" &
  WPID=$!
}
beat() { stat -f %m "$STATE_DIR/.last-watcher-beat" 2>/dev/null; }
# Watch for <cycles> full poll cycles. Prints QUIET (alive, no output, empty queue)
# or WOKE: <output> (watcher exited with a wake).
watch_verdict() {  # <cycles>
  local want=${1:-3} seen=0 last='' now i=0
  rm -f "$STATE_DIR/.last-watcher-beat"
  while [ "$i" -lt 250 ]; do
    if ! kill -0 "$WPID" 2>/dev/null; then
      wait "$WPID" 2>/dev/null
      say "  watch| WOKE: $(tr '\n' ' ' < "$HOME_DIR/watch.out")"; WPID=
      say "  (supervisor drains the wake it was handed)"; drain; return 1
    fi
    now=$(beat)
    if [ -n "$now" ] && [ "$now" != "$last" ]; then seen=$((seen + 1)); last=$now; fi
    [ "$seen" -gt "$want" ] && break
    sleep 0.1; i=$((i + 1))
  done
  if [ -s "$HOME_DIR/watch.out" ] || [ -s "$STATE_DIR/.wake-queue" ]; then
    say "  watch| WOKE(queued): $(tr '\n' ' ' < "$HOME_DIR/watch.out")"
    kill "$WPID" 2>/dev/null; wait "$WPID" 2>/dev/null; WPID=; return 1
  fi
  say "  watch| QUIET after $want full poll cycles (no output, empty wake queue)"
  return 0
}
watch_stop() { [ -n "$WPID" ] && { kill "$WPID" 2>/dev/null; wait "$WPID" 2>/dev/null; }; WPID=; }
watch_wait_wake() {  # watcher must exit with a wake within ~15s
  local i=0
  while [ "$i" -lt 150 ] && kill -0 "$WPID" 2>/dev/null; do sleep 0.1; i=$((i + 1)); done
  if kill -0 "$WPID" 2>/dev/null; then say "  watch| NO WAKE within 15s"; watch_stop; return 1; fi
  wait "$WPID" 2>/dev/null; WPID=
  say "  watch| WOKE: $(tr '\n' ' ' < "$HOME_DIR/watch.out")"
  say "  (supervisor drains the wake it was handed)"; drain
}
worker() { printf '%s\n' "$2" >> "$STATE_DIR/$1.status"; say "  worker($1)| $2"; }
showfile() { sed 's/^/  file| /' "$STATE_DIR/$1.status"; }
# Let the real watcher surface the current file once, then drain+ack it, so the
# watcher's seen marker covers everything so far (the normal supervision loop).
announce_via_watcher() {
  say "  (watcher up: it surfaces the decision; supervisor drains and acks)"
  watch_start
  watch_wait_wake
}

case_fold_single() {
  hr "fold_single: session-start drain lists the decision, supervisor answers with --resolve-key, watcher starts"
  new_home fold_single; ship_meta t1
  worker t1 'needs-decision [key=api-shape]: pick REST or RPC'
  drain
  send t1 --resolve-key api-shape "go with REST"; say "  send| rc=$?"
  showfile t1
  watch_start
  if watch_verdict 3; then
    worker t1 'blocked: need staging credentials'
    watch_wait_wake
  fi
}

case_watcher_loop() {
  hr "watcher_loop: watcher surfaces the decision, supervisor drains, answers, restarts watcher"
  new_home watcher_loop; ship_meta t1
  worker t1 'needs-decision [key=db]: postgres or sqlite?'
  announce_via_watcher
  send t1 --resolve-key db "postgres"; say "  send| rc=$?"
  watch_start
  if watch_verdict 3; then
    worker t1 'blocked: migration needs a superuser'
    watch_wait_wake
  fi
}

case_fold_multi() {
  hr "fold_multi: drain lists two decisions, ONE answer closes both keys"
  new_home fold_multi; ship_meta t1
  worker t1 'needs-decision [key=budget]: approve spend?'
  worker t1 'needs-decision [key=vendor]: pick a vendor'
  drain
  send t1 --resolve-key budget --resolve-key vendor "approve spend, pick acme"; say "  send| rc=$?"
  showfile t1
  watch_start
  watch_verdict 3 && { watch_stop; drain; }
}

case_late_worker() {
  hr "late_worker (adversarial): worker appends after the drain, before the supervisor's close"
  new_home late_worker; ship_meta t1
  worker t1 'needs-decision [key=region]: us-east or eu-west?'
  drain
  worker t1 'blocked: vendor portal is down'
  send t1 --resolve-key region "eu-west"; say "  send| rc=$?"
  watch_start
  watch_verdict 3 || true
}

case_folded_working() {
  hr "folded_working (adversarial): ship worker changes course while watcher is down; drain folds past it; supervisor closes"
  new_home folded_working; ship_meta t1
  : > "$STATE_DIR/t1.status"
  worker t1 'needs-decision [key=budget]: approve spend?'
  announce_via_watcher
  worker t1 'working: abandoned the migration, rewriting the schema by hand'
  drain
  send t1 --resolve-key budget "approved"; say "  send| rc=$?"
  watch_start
  watch_verdict 3 || true
}

case_sm_common() {  # <lagging lines...>
  new_home "$CASE_NAME"; mate_meta mate
  : > "$STATE_DIR/mate.status"
  worker mate 'needs-decision [key=budget]: approve spend?'
  FM_FAKE_CREW_STATE='state: working · source: pane · harness busy' announce_via_watcher
  local l; for l in "$@"; do worker mate "$l"; done
  drain
  send fm-mate --resolve-key budget "approved"; say "  send| rc=$?"
  export FM_FAKE_CREW_STATE='state: working · source: pane · harness busy'
  watch_start
  watch_verdict 3 || true
  unset FM_FAKE_CREW_STATE
}
case_sm_failed() {
  hr "sm_failed (adversarial): secondmate relays a crew failure while watcher is down; drain folds; supervisor closes"
  CASE_NAME=sm_failed case_sm_common 'failed: crew c3 hit an unrecoverable migration error' \
    'working: retrying c3 in a fresh worktree'
}
case_sm_paused() {
  hr "sm_paused (adversarial): secondmate pauses while watcher is down; drain folds; supervisor closes"
  CASE_NAME=sm_paused case_sm_common 'paused: waiting on vendor quote'
}
case_sm_selfresolved() {
  hr "sm_selfresolved (adversarial): secondmate raises and self-resolves a decision while watcher is down"
  CASE_NAME=sm_selfresolved case_sm_common 'needs-decision [key=vendor]: vendor A or B?' \
    'resolved [key=vendor]: picked vendor B myself, cheaper'
}

case_hold_transfer() {
  hr "hold_transfer: investigation with two open decisions; drain folds; captain-hold complete transfers both"
  command -v tasks-axi >/dev/null || { say "  SKIP: tasks-axi missing"; return; }
  new_home hold_transfer
  cp "$ROOT/.tasks.toml" "$HOME_DIR/.tasks.toml"
  printf '## In flight\n\n## Queued\n\n## Done\n' > "$HOME_DIR/data/backlog.md"
  local id=sample-review hold_env
  (cd "$HOME_DIR" && tasks-axi add "$id" "Investigate sample" --kind scout --repo sample --start >/dev/null)
  printf 'window=sess:fm-origin\nkind=scout\n' > "$STATE_DIR/$id.meta"
  mkdir -p "$HOME_DIR/data/$id"; printf '# report\n' > "$HOME_DIR/data/$id/report.md"
  worker "$id" 'needs-decision [key=route]: route north or south'
  worker "$id" 'needs-decision [key=access]: open or restricted access'
  drain
  hold() {
    FM_GATE_REFUSE_BYPASS=1 PATH="$HOME_DIR/sendbin:$PATH" REAL_TASKS_AXI="$(command -v tasks-axi)" FM_HOME="$HOME_DIR" \
      FM_STATE_OVERRIDE="$STATE_DIR" FM_DATA_OVERRIDE="$HOME_DIR/data" FM_CONFIG_OVERRIDE="$HOME_DIR/config" \
      "$ROOT/bin/fm-captain-hold.sh" "$@"
  }
  hold hold route-call --title "Choose route and access" --reason "captain choices pending" \
    --repo sample --origin "$id" >/dev/null 2>&1; say "  hold| hold rc=$?"
  hold complete "$id" route-call 2>&1 | sed 's/^/  hold| /'
  showfile "$id"
  watch_start
  watch_verdict 3 || true
}

case_append_fail() {
  hr "append_fail (adversarial): the status file cannot be appended; two-key answer must fail loudly with a usable manual close"
  new_home append_fail; ship_meta t1
  worker t1 'needs-decision [key=budget]: approve spend?'
  worker t1 'needs-decision [key=vendor]: pick a vendor'
  drain >/dev/null
  chmod 444 "$STATE_DIR/t1.status"
  send t1 --resolve-key budget --resolve-key vendor "approve spend, pick acme" 2>"$HOME_DIR/send.err"
  say "  send| rc=$?"; sed 's/^/  send.err| /' "$HOME_DIR/send.err"
  chmod 644 "$STATE_DIR/t1.status"
  local cmd; cmd=$(perl -0ne 'print $1 if /Close it manually with: (.*) - do not resend the answer\./s' "$HOME_DIR/send.err")
  say "  operator runs: $cmd"
  eval "$cmd"
  showfile t1
  drain
}

say "== ROOT=$ROOT ($LABEL) commit=$(git -C "$ROOT" rev-parse --short HEAD 2>/dev/null || echo base-archive)"
for c in $CASES; do "case_$c"; watch_stop; done
rm -rf "$WORK"

Evidence: HEAD (0eefdaf) full CLI transcript of all scenarios

Source: HEAD (0eefdaf3) full CLI transcript of all scenarios

== ROOT=~/.no-mistakes/worktrees/bbb16e1f0808/01M2VQP2JTKE99QCC959RA4X8T (head) commit=0eefdaf3
---- fold_single: session-start drain lists the decision, supervisor answers with --resolve-key, watcher starts
  worker(t1)| needs-decision [key=api-shape]: pick REST or RPC
  drain| OPEN DECISIONS (still open, folded from the durable status logs - not just the latest line):
  drain| t1 [key=api-shape] needs-decision: pick REST or RPC
  drain| OPEN DECISIONS: close one by answering it: bin/fm-send.sh <task> --resolve-key <key> '<answer>'
WARNING: watcher still down (same stale episode; last beat: never, grace 300s) - full banner already printed this episode.
  send| rc=0
  file| needs-decision [key=api-shape]: pick REST or RPC
  file| resolved [key=api-shape]: answered: go with REST
  watch| QUIET after 3 full poll cycles (no output, empty wake queue)
  worker(t1)| blocked: need staging credentials
  watch| WOKE: signal: /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/fold_single/state/t1.status 
  (supervisor drains the wake it was handed)
  drain| 1789786028	2	signal	t1.status	signal: /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/fold_single/state/t1.status
  drain| wake annotation: unread wake-EVENT since last drain, not current state: t1.status: needs-decision [key=api-shape]: pick REST or RPC
  drain| wake annotation: unread wake-EVENT since last drain, not current state: t1.status: resolved [key=api-shape]: answered: go with REST
  drain| wake annotation: latest wake-EVENT observed at drain, not current state: t1.status: blocked: need staging credentials
  drain| OPEN DECISIONS (still open, folded from the durable status logs - not just the latest line):
  drain| t1 blocked: need staging credentials
  drain| OPEN DECISIONS: close one by answering it: bin/fm-send.sh <task> --resolve-key <key> '<answer>'
  drain| (acked through 2)
---- watcher_loop: watcher surfaces the decision, supervisor drains, answers, restarts watcher
  worker(t1)| needs-decision [key=db]: postgres or sqlite?
  (watcher up: it surfaces the decision; supervisor drains and acks)
  watch| WOKE: signal: /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/watcher_loop/state/t1.status 
  (supervisor drains the wake it was handed)
  drain| 1789786032	2	signal	t1.status	needs-decision: /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/watcher_loop/state/t1.status
  drain| wake annotation: latest wake-EVENT observed at drain, not current state: t1.status: needs-decision [key=db]: postgres or sqlite?
  drain| OPEN DECISIONS (still open, folded from the durable status logs - not just the latest line):
  drain| t1 [key=db] needs-decision: postgres or sqlite?
  drain| OPEN DECISIONS: close one by answering it: bin/fm-send.sh <task> --resolve-key <key> '<answer>'
  drain| (acked through 2)
  send| rc=0
  watch| QUIET after 3 full poll cycles (no output, empty wake queue)
  worker(t1)| blocked: migration needs a superuser
  watch| WOKE: signal: /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/watcher_loop/state/t1.status 
  (supervisor drains the wake it was handed)
  drain| 1789786043	4	signal	t1.status	signal: /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/watcher_loop/state/t1.status
  drain| wake annotation: unread wake-EVENT since last drain, not current state: t1.status: resolved [key=db]: answered: postgres
  drain| wake annotation: latest wake-EVENT observed at drain, not current state: t1.status: blocked: migration needs a superuser
  drain| OPEN DECISIONS (still open, folded from the durable status logs - not just the latest line):
  drain| t1 blocked: migration needs a superuser
  drain| OPEN DECISIONS: close one by answering it: bin/fm-send.sh <task> --resolve-key <key> '<answer>'
  drain| (acked through 4)
---- fold_multi: drain lists two decisions, ONE answer closes both keys
  worker(t1)| needs-decision [key=budget]: approve spend?
  worker(t1)| needs-decision [key=vendor]: pick a vendor
  drain| OPEN DECISIONS (still open, folded from the durable status logs - not just the latest line):
  drain| t1 [key=budget] needs-decision: approve spend?
  drain| t1 [key=vendor] needs-decision: pick a vendor
  drain| OPEN DECISIONS: close one by answering it: bin/fm-send.sh <task> --resolve-key <key> '<answer>'
WARNING: watcher still down (same stale episode; last beat: never, grace 300s) - full banner already printed this episode.
  send| rc=0
  file| needs-decision [key=budget]: approve spend?
  file| needs-decision [key=vendor]: pick a vendor
  file| resolved [key=budget]: answered: approve spend, pick acme
  file| resolved [key=vendor]: answered: approve spend, pick acme
  watch| QUIET after 3 full poll cycles (no output, empty wake queue)
  drain| 
  drain| (acked through 0)
---- late_worker (adversarial): worker appends after the drain, before the supervisor's close
  worker(t1)| needs-decision [key=region]: us-east or eu-west?
  drain| OPEN DECISIONS (still open, folded from the durable status logs - not just the latest line):
  drain| t1 [key=region] needs-decision: us-east or eu-west?
  drain| OPEN DECISIONS: close one by answering it: bin/fm-send.sh <task> --resolve-key <key> '<answer>'
  worker(t1)| blocked: vendor portal is down
WARNING: watcher still down (same stale episode; last beat: never, grace 300s) - full banner already printed this episode.
  send| rc=0
  watch| WOKE: signal: /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/late_worker/state/t1.status 
  (supervisor drains the wake it was handed)
  drain| 1789786063	2	signal	t1.status	signal: /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/late_worker/state/t1.status
  drain| wake annotation: unread wake-EVENT since last drain, not current state: t1.status: needs-decision [key=region]: us-east or eu-west?
  drain| wake annotation: unread wake-EVENT since last drain, not current state: t1.status: blocked: vendor portal is down
  drain| wake annotation: latest wake-EVENT observed at drain, not current state: t1.status: resolved [key=region]: answered: eu-west
  drain| OPEN DECISIONS (still open, folded from the durable status logs - not just the latest line):
  drain| t1 blocked: vendor portal is down
  drain| OPEN DECISIONS: close one by answering it: bin/fm-send.sh <task> --resolve-key <key> '<answer>'
  drain| (acked through 2)
---- folded_working (adversarial): ship worker changes course while watcher is down; drain folds past it; supervisor closes
  worker(t1)| needs-decision [key=budget]: approve spend?
  (watcher up: it surfaces the decision; supervisor drains and acks)
  watch| WOKE: signal: /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/folded_working/state/t1.status 
  (supervisor drains the wake it was handed)
  drain| 1789786069	2	signal	t1.status	needs-decision: /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/folded_working/state/t1.status
  drain| wake annotation: latest wake-EVENT observed at drain, not current state: t1.status: needs-decision [key=budget]: approve spend?
  drain| OPEN DECISIONS (still open, folded from the durable status logs - not just the latest line):
  drain| t1 [key=budget] needs-decision: approve spend?
  drain| OPEN DECISIONS: close one by answering it: bin/fm-send.sh <task> --resolve-key <key> '<answer>'
  drain| (acked through 2)
  worker(t1)| working: abandoned the migration, rewriting the schema by hand
  drain| OPEN DECISIONS (still open, folded from the durable status logs - not just the latest line):
  drain| t1 [key=budget] needs-decision: approve spend?
  drain| OPEN DECISIONS: close one by answering it: bin/fm-send.sh <task> --resolve-key <key> '<answer>'
  send| rc=0
  watch| WOKE: signal: /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/folded_working/state/t1.status 
  (supervisor drains the wake it was handed)
  drain| 1789786076	4	signal	t1.status	signal: /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/folded_working/state/t1.status
  drain| wake annotation: unread wake-EVENT since last drain, not cur

... [1001 bytes truncated] ...

 the durable status logs - not just the latest line):
  drain| mate [key=budget] needs-decision: approve spend?
  drain| OPEN DECISIONS: close one by answering it: bin/fm-send.sh <task> --resolve-key <key> '<answer>'
  drain| (acked through 2)
  worker(mate)| failed: crew c3 hit an unrecoverable migration error
  worker(mate)| working: retrying c3 in a fresh worktree
  drain| OPEN DECISIONS (still open, folded from the durable status logs - not just the latest line):
  drain| mate [key=budget] needs-decision: approve spend?
  drain| OPEN DECISIONS: close one by answering it: bin/fm-send.sh <task> --resolve-key <key> '<answer>'
  send| rc=0
  watch| WOKE: signal: /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/sm_failed/state/mate.status 
  (supervisor drains the wake it was handed)
  drain| 1789786086	4	signal	mate.status	signal: /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/sm_failed/state/mate.status
  drain| wake annotation: unread wake-EVENT since last drain, not current state: mate.status: failed: crew c3 hit an unrecoverable migration error
  drain| wake annotation: unread wake-EVENT since last drain, not current state: mate.status: working: retrying c3 in a fresh worktree
  drain| wake annotation: latest wake-EVENT observed at drain, not current state: mate.status: resolved [key=budget]: answered: approved
  drain| (acked through 4)
---- sm_paused (adversarial): secondmate pauses while watcher is down; drain folds; supervisor closes
  worker(mate)| needs-decision [key=budget]: approve spend?
  (watcher up: it surfaces the decision; supervisor drains and acks)
  watch| WOKE: signal: /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/sm_paused/state/mate.status 
  (supervisor drains the wake it was handed)
  drain| 1789786091	2	signal	mate.status	needs-decision: /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/sm_paused/state/mate.status
  drain| wake annotation: latest wake-EVENT observed at drain, not current state: mate.status: needs-decision [key=budget]: approve spend?
  drain| OPEN DECISIONS (still open, folded from the durable status logs - not just the latest line):
  drain| mate [key=budget] needs-decision: approve spend?
  drain| OPEN DECISIONS: close one by answering it: bin/fm-send.sh <task> --resolve-key <key> '<answer>'
  drain| (acked through 2)
  worker(mate)| paused: waiting on vendor quote
  drain| OPEN DECISIONS (still open, folded from the durable status logs - not just the latest line):
  drain| mate [key=budget] needs-decision: approve spend?
  drain| OPEN DECISIONS: close one by answering it: bin/fm-send.sh <task> --resolve-key <key> '<answer>'
  send| rc=0
  watch| WOKE: signal: /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/sm_paused/state/mate.status 
  (supervisor drains the wake it was handed)
  drain| 1789786099	4	signal	mate.status	signal: /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/sm_paused/state/mate.status
  drain| wake annotation: unread wake-EVENT since last drain, not current state: mate.status: paused: waiting on vendor quote
  drain| wake annotation: latest wake-EVENT observed at drain, not current state: mate.status: resolved [key=budget]: answered: approved
  drain| (acked through 4)
---- sm_selfresolved (adversarial): secondmate raises and self-resolves a decision while watcher is down
  worker(mate)| needs-decision [key=budget]: approve spend?
  (watcher up: it surfaces the decision; supervisor drains and acks)
  watch| WOKE: signal: /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/sm_selfresolved/state/mate.status 
  (supervisor drains the wake it was handed)
  drain| 1789786104	2	signal	mate.status	needs-decision: /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/sm_selfresolved/state/mate.status
  drain| wake annotation: latest wake-EVENT observed at drain, not current state: mate.status: needs-decision [key=budget]: approve spend?
  drain| OPEN DECISIONS (still open, folded from the durable status logs - not just the latest line):
  drain| mate [key=budget] needs-decision: approve spend?
  drain| OPEN DECISIONS: close one by answering it: bin/fm-send.sh <task> --resolve-key <key> '<answer>'
  drain| (acked through 2)
  worker(mate)| needs-decision [key=vendor]: vendor A or B?
  worker(mate)| resolved [key=vendor]: picked vendor B myself, cheaper
  drain| OPEN DECISIONS (still open, folded from the durable status logs - not just the latest line):
  drain| mate [key=budget] needs-decision: approve spend?
  drain| OPEN DECISIONS: close one by answering it: bin/fm-send.sh <task> --resolve-key <key> '<answer>'
  send| rc=0
  watch| WOKE: signal: /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/sm_selfresolved/state/mate.status 
  (supervisor drains the wake it was handed)
  drain| 1789786112	4	signal	mate.status	signal: /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/sm_selfresolved/state/mate.status
  drain| wake annotation: unread wake-EVENT since last drain, not current state: mate.status: needs-decision [key=vendor]: vendor A or B?
  drain| wake annotation: unread wake-EVENT since last drain, not current state: mate.status: resolved [key=vendor]: picked vendor B myself, cheaper
  drain| wake annotation: latest wake-EVENT observed at drain, not current state: mate.status: resolved [key=budget]: answered: approved
  drain| (acked through 4)
---- hold_transfer: investigation with two open decisions; drain folds; captain-hold complete transfers both
  worker(sample-review)| needs-decision [key=route]: route north or south
  worker(sample-review)| needs-decision [key=access]: open or restricted access
  drain| OPEN DECISIONS (still open, folded from the durable status logs - not just the latest line):
  drain| sample-review [key=route] needs-decision: route north or south
  drain| sample-review [key=access] needs-decision: open or restricted access
  drain| OPEN DECISIONS: close one by answering it: bin/fm-send.sh <task> --resolve-key <key> '<answer>'
  hold| hold rc=0
  hold| complete: sample-review captain-call inventory reviewed (route-call)
  file| needs-decision [key=route]: route north or south
  file| needs-decision [key=access]: open or restricted access
  file| captain-held [key=route]: tracked by route-call
  file| captain-held [key=access]: tracked by route-call
  watch| QUIET after 3 full poll cycles (no output, empty wake queue)
---- append_fail (adversarial): the status file cannot be appended; two-key answer must fail loudly with a usable manual close
  worker(t1)| needs-decision [key=budget]: approve spend?
  worker(t1)| needs-decision [key=vendor]: pick a vendor
  send| rc=1
  send.err| WARNING: watcher still down (same stale episode; last beat: never, grace 300s) - full banner already printed this episode.
  send.err| ~/.no-mistakes/worktrees/bbb16e1f0808/01M2VQP2JTKE99QCC959RA4X8T/bin/fm-wake-lib.sh: line 2199: /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/append_fail/state/t1.status: Permission denied
  send.err| error: the answer was delivered to sess:fm-t1, but the close for decision key(s) 'budget vendor' could not be appended to /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/append_fail/state/t1.status. Close it manually with: printf '%s
  send.err| ' resolved\ \[key=budget\]:\ answered:\ approve\ spend\,\ pick\ acme resolved\ \[key=vendor\]:\ answered:\ approve\ spend\,\ pick\ acme >> /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/append_fail/state/t1.status - do not resend the answer.
  operator runs: printf '%s
' resolved\ \[key=budget\]:\ answered:\ approve\ spend\,\ pick\ acme resolved\ \[key=vendor\]:\ answered:\ approve\ spend\,\ pick\ acme >> /var/folders/r8/cylyt7xd7t50y9x5wc05my380000gn/T//fm4767-head.isnEup/append_fail/state/t1.status
  file| needs-decision [key=budget]: approve spend?
  file| needs-decision [key=vendor]: pick a vendor
  file| resolved [key=budget]: answered: approve spend, pick acme
  file| resolved [key=vendor]: answered: approve spend, pick acme
  drain| 

• Evidence: Base (1bb72cc5) full CLI transcript of the same scenarios (reproduces the bug)

Evidence: HEAD vs base verdict summary per scenario

Source: HEAD vs base verdict summary per scenario

Issue 4767 end-to-end: real fm-watch.sh / fm-wake-drain.sh / fm-send.sh / fm-captain-hold.sh in throwaway homes.
HEAD=0eefdaf3  BASE=1bb72cc5. Full transcripts: e2e-head-transcript.txt, e2e-base-transcript.txt. Driver: e2e-4767.sh

#### head
---- fold_single: session-start drain lists the decision, supervisor answers with --resolve-key, watcher starts
  send| rc=0
  watch| QUIET after 3 full poll cycles (no output, empty wake queue)
  watch| WOKE: signal: state/t1.status 
---- watcher_loop: watcher surfaces the decision, supervisor drains, answers, restarts watcher
  watch| WOKE: signal: state/t1.status 
  send| rc=0
  watch| QUIET after 3 full poll cycles (no output, empty wake queue)
  watch| WOKE: signal: state/t1.status 
---- fold_multi: drain lists two decisions, ONE answer closes both keys
  send| rc=0
  watch| QUIET after 3 full poll cycles (no output, empty wake queue)
---- late_worker (adversarial): worker appends after the drain, before the supervisor's close
  send| rc=0
  watch| WOKE: signal: state/t1.status 
---- folded_working (adversarial): ship worker changes course while watcher is down; drain folds past it; supervisor closes
  watch| WOKE: signal: state/t1.status 
  send| rc=0
  watch| WOKE: signal: state/t1.status 
---- sm_failed (adversarial): secondmate relays a crew failure while watcher is down; drain folds; supervisor closes
  watch| WOKE: signal: state/mate.status 
  send| rc=0
  watch| WOKE: signal: state/mate.status 
---- sm_paused (adversarial): secondmate pauses while watcher is down; drain folds; supervisor closes
  watch| WOKE: signal: state/mate.status 
  send| rc=0
  watch| WOKE: signal: state/mate.status 
---- sm_selfresolved (adversarial): secondmate raises and self-resolves a decision while watcher is down
  watch| WOKE: signal: state/mate.status 
  send| rc=0
  watch| WOKE: signal: state/mate.status 
---- hold_transfer: investigation with two open decisions; drain folds; captain-hold complete transfers both
  hold| complete: sample-review captain-call inventory reviewed (route-call)
  watch| QUIET after 3 full poll cycles (no output, empty wake queue)
---- append_fail (adversarial): the status file cannot be appended; two-key answer must fail loudly with a usable manual close
  send| rc=1

#### base
---- fold_single: session-start drain lists the decision, supervisor answers with --resolve-key, watcher starts
  send| rc=0
  watch| WOKE: signal: state/t1.status 
---- watcher_loop: watcher surfaces the decision, supervisor drains, answers, restarts watcher
  watch| WOKE: signal: state/t1.status 
  send| rc=0
  watch| QUIET after 3 full poll cycles (no output, empty wake queue)
  watch| WOKE: signal: state/t1.status 
---- fold_multi: drain lists two decisions, ONE answer closes both keys
  send| rc=0
  watch| WOKE: signal: state/t1.status 
---- late_worker (adversarial): worker appends after the drain, before the supervisor's close
  send| rc=0
  watch| WOKE: signal: state/t1.status 
---- folded_working (adversarial): ship worker changes course while watcher is down; drain folds past it; supervisor closes
  watch| WOKE: signal: state/t1.status 
  send| rc=0
  watch| WOKE: signal: state/t1.status 
---- sm_failed (adversarial): secondmate relays a crew failure while watcher is down; drain folds; supervisor closes
  watch| WOKE: signal: state/mate.status 
  send| rc=0
  watch| WOKE: signal: state/mate.status 
---- sm_paused (adversarial): secondmate pauses while watcher is down; drain folds; supervisor closes
  watch| WOKE: signal: state/mate.status 
  send| rc=0
  watch| WOKE: signal: state/mate.status 
---- sm_selfresolved (adversarial): secondmate raises and self-resolves a decision while watcher is down
  watch| WOKE: signal: state/mate.status 
  send| rc=0
  watch| WOKE: signal: state/mate.status 
---- hold_transfer: investigation with two open decisions; drain folds; captain-hold complete transfers both
  hold| complete: sample-review captain-call inventory reviewed (route-call)
  watch| WOKE: signal: state/sample-review.status 
---- append_fail (adversarial): the status file cannot be appended; two-key answer must fail loudly with a usable manual close
  send| rc=1

Evidence: fold_single: base wakes the supervisor with its own close; HEAD stays quiet

BASE: send| rc=0
watch| WOKE: signal: state/t1.status
drain| wake annotation: latest wake-EVENT observed at drain, not current state: t1.status: resolved [key=api-shape]: answered: go with REST

HEAD: send| rc=0
watch| QUIET after 3 full poll cycles (no output, empty wake queue)
worker(t1)| blocked: need staging credentials
watch| WOKE: signal: state/t1.status

- Outcome: ⚠️ 1 info across 1 run (18m15s)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

⚠️ **Review** - medium risk

✅ No issues found.

⚠️ **Test** - 1 info

• ℹ️ bin/fm-send.sh:682 - This is cosmetic and was already on base; this change did not cause it. When fm-send cannot append a close, its error message prints a manual close command built with printf -v ... "printf '%%s\\n'...". That makes the \n a real newline inside the quoted format, so the message breaks in the middle of the command (printf '%s on one line, ' resolved\ ... on the next). Copy-pasting the two lines still works: I ran the printed command with eval and it closed both keys. But on a terminal it reads like two separate lines. Base has the same pattern in its single-key message. The fix is to emit a literal \n in the format so the command fits on one line.
• Live validation: ✅ go - 11 of 11 scenarios driven live against the product

Scenario	Result	Live	Evidence
The session-start drain lists a decision, the supervisor answers with fm-send --resolve-key, and the watcher then starts: it does not wake the supervisor to read its own resolved line	✅ pass	live	e2e-head-transcript.txt fold_single: QUIET after 3 full poll cycles. On base (e2e-base-transcript.txt) the watcher woke, and the drain annotation was resolved [key=api-shape]: answered: go with REST…
A worker line written after a quiet self-close (blocked: need staging credentials) still wakes the supervisor	✅ pass	live	e2e-head-transcript.txt fold_single and watcher_loop: WOKE: signal: state/t1.status, and the drain showed the blocked line
Normal loop: the watcher surfaces a decision, the supervisor drains and acks, answers with --resolve-key, and restarts the watcher: it stays quiet	✅ pass	live	e2e-head-transcript.txt watcher_loop: QUIET after 3 cycles (quiet on base too, so this is a regression check)
Two decisions listed by the drain are closed by one fm-send --resolve-key budget --resolve-key vendor answer: no wake, and OPEN DECISIONS is empty afterwards	✅ pass	live	e2e-head-transcript.txt fold_multi: QUIET after 3 cycles, and the next drain lists no open decisions. On base the watcher woke with both of the supervisor's resolved lines.
fm-captain-hold complete moves two drain-listed decisions to the captain-held task: the two captain-held lines do not wake the supervisor	✅ pass	live	e2e-head-transcript.txt hold_transfer: QUIET after 3 cycles. On base the watcher woke, and the drain annotated captain-held [key=access]: tracked by route-call.
Adversarial: a worker appends blocked: vendor portal is down after the drain but before the supervisor's close: the watcher still wakes	✅ pass	live	e2e-head-transcript.txt late_worker: WOKE, and the drain shows the blocked line as an open decision
Adversarial: while the watcher is down, a ship worker writes working: after the decision the drain listed; after the supervisor's close the watcher still wakes	✅ pass	live	e2e-head-transcript.txt folded_working: WOKE: signal: state/t1.status
Adversarial: a secondmate relays failed: and working: lines that the drain read but did not list; the supervisor's close does not hide them	✅ pass	live	e2e-head-transcript.txt sm_failed: WOKE: signal: state/mate.status (crew stubbed as provably working)
Adversarial: a secondmate paused: line that the drain read but did not list still wakes after the supervisor's close	✅ pass	live	e2e-head-transcript.txt sm_paused: WOKE: signal: state/mate.status
Adversarial: a decision that a secondmate raised and resolved itself (never listed by the drain) still wakes after the supervisor's unrelated close	✅ pass	live	e2e-head-transcript.txt sm_selfresolved: WOKE: signal: state/mate.status
Adversarial: the status file cannot be appended to during a two-key answer: fm-send exits nonzero and prints one manual close command, and running that command closes both keys	✅ pass	live	e2e-head-transcript.txt append_fail: rc=1, the stderr names 'budget vendor', eval of the printed command appended both resolved lines, and the next drain lists nothing open. On base the printed comman…

• e2e-4767.sh <HEAD worktree> head - my driver script. For each scenario it creates a throwaway home and runs the real bin/fm-watch.sh, bin/fm-wake-drain.sh (with the ack step), bin/fm-send.sh --resolve-key and bin/fm-captain-hold.sh hold/complete. Only tmux and fm-crew-state are stubbed.
• git archive 1bb72cc5 | tar -x then e2e-4767.sh <base tree> base - the same scenarios on the base commit, to reproduce the bug and compare
• Scenarios driven: fold_single, watcher_loop, fold_multi, hold_transfer, late_worker, folded_working, sm_failed, sm_paused, sm_selfresolved, append_fail. After each wake the driver drains, so the transcripts show exactly what the supervisor is handed.
• append_fail: made the status file read-only, sent a two-key answer, then ran (eval) the manual close command printed on stderr and checked with a drain that no decision is left open
• bash tests/fm-send-resolve-key.test.sh (whole file, all 21 ok)
• tests/fm-watch-triage.test.sh, selected tests only: test_self_announced_close_does_not_rewake_but_next_note_does, test_self_announced_close_after_open_decisions_fold_does_not_rewake, test_self_announced_close_after_fold_still_surfaces_folded_worker_failure, test_self_announced_close_after_fold_still_surfaces_folded_secondmate_lines (all ok)
• tests/fm-wake-queue.test.sh, selected: test_self_announced_append_guards (ok)
• tests/fm-captain-hold-lifecycle.test.sh, selected: test_completion_gate_attests_and_transfers (ok)
• tests/fm-pending-reply.test.sh, selected: test_second_missed_turn_escalates_once_and_stays_durable (ok; this covers the other caller of the self-announce function, whose signature changed)

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

[jasonlgong]

Nice — this handles the folded-decision-close self-wake cleanly. Heads up there's a second, independent self-wake on the same issue this PR doesn't touch: when a --resolve-key self-close lands during the watcher's signal grace window and the seen-marker commits mid-grace, the watcher folds its first scan back in and re-wakes. That path is in fm-watch.sh's grace rescan — separate file from the append helper here, no overlap — so the two fixes look complementary, both needed to fully close the self-wakes. I've got a small companion fix for the grace-window case ready and validated locally; happy to raise it as a separate PR that stacks with this one rather than stepping on it. Let me know if you'd sooner fold it in.

[kunchenguid]

Speaking as Kun's firstmate: this is merged. Thank you @tiago-peixoto — really appreciate you taking the time on this.

Contract-class restore (OPEN DECISIONS fold + guarded self-announced append so the supervisor's own resolved/captain-held closes do not re-wake the same home; fail-toward-wake on foreign/unread bytes). Attestation MATCH. CI + no-mistakes green. Complementary to #4929 (grace-window path in fm-watch.sh); that companion stays open.