fix(bin): stop this home's own --resolve-key closes from re-waking the supervisor - #5008

########## BASE 1b1b6e0 (before the fix) ##########
checkout under test: /tmp/fm-base-1b1b6e0.hrZQQi
throwaway FM_HOME:   /tmp/fm-live-race.sSvxaW/home
crew-probe hold:     8s

=== step 1: the worker's decision wakes the supervisor (the legitimate wake)
PASS  woken: signal: /tmp/fm-live-race.sSvxaW/home/state/t1.status
PASS  wake acknowledged

=== step 2: the worker keeps working (routine growth the watcher will classify)
status size before the answer: 92 bytes

=== step 3: the watcher enters its slow crew-evidence check
PASS  watcher is inside the crew-state probe with its endpoint already captured

=== step 4: the supervisor answers the decision INSIDE that window
PASS  answer sent while the watcher was mid-check
status size after the answer: 144 bytes

=== step 5: the watcher commits the endpoint it captured before the answer
PASS  watcher's classified offset regressed to 92, behind the answer's bytes - the race reproduced

=== step 6 (the question): is the supervisor woken by its own answer?
FAIL  the supervisor was WOKEN by its own --resolve-key answer: signal: /tmp/fm-live-race.sSvxaW/home/state/t1.status

=== step 7 (guard): the worker's turn ends - the owned close must still be annotated
FAIL  the watcher was already gone before the turn-end guard

=== step 8 (adversarial): a real worker line must still wake
FAIL  a real worker line after the owned answer was swallowed: check: rearm-resurface

=== step 9 (guard): the answer is still on the captain-facing surface
1789878685	4	signal	t1.status	signal: /tmp/fm-live-race.sSvxaW/home/state/t1.status
wake annotation: unread wake-EVENT since last drain, not current state: t1.status: working: still refactoring the adapter
wake annotation: unread wake-EVENT since last drain, not current state: t1.status: resolved [key=budget]: answered: approved, go ahead
wake annotation: latest wake-EVENT observed at drain, not current state: t1.status: blocked: need staging credentials to continue
OPEN DECISIONS (still open, folded from the durable status logs - not just the latest line):
t1 blocked: need staging credentials to continue
OPEN DECISIONS: close one by answering it: bin/fm-send.sh <task> --resolve-key <key> '<answer>'
PASS  the worker's blocker is presented to the captain

===========================
RESULT: at least one live scenario FAILED
base EXIT=1

########## TARGET a3624c9 (with the fix) ##########
checkout under test: ~/.no-mistakes/worktrees/42fe67ed39fa/01M2YF86AG8VETDN9HQKHA0P9N
throwaway FM_HOME:   /tmp/fm-live-race.CVBoZv/home
crew-probe hold:     8s

=== step 1: the worker's decision wakes the supervisor (the legitimate wake)
PASS  woken: signal: /tmp/fm-live-race.CVBoZv/home/state/t1.status
PASS  wake acknowledged

=== step 2: the worker keeps working (routine growth the watcher will classify)
status size before the answer: 92 bytes

=== step 3: the watcher enters its slow crew-evidence check
PASS  watcher is inside the crew-state probe with its endpoint already captured

=== step 4: the supervisor answers the decision INSIDE that window
PASS  answer sent while the watcher was mid-check
status size after the answer: 144 bytes

=== step 5: the watcher commits the endpoint it captured before the answer
PASS  watcher's classified offset regressed to 92, behind the answer's bytes - the race reproduced

=== step 6 (the question): is the supervisor woken by its own answer?
PASS  the watcher stayed asleep: this home's own answer did not wake it

=== step 7 (guard): the worker's turn ends - the owned close must still be annotated
PASS  the worker's turn end woke the supervisor: signal: /tmp/fm-live-race.CVBoZv/home/state/t1.turn-ended
1789878738	4	signal	t1.turn-ended	signal: /tmp/fm-live-race.CVBoZv/home/state/t1.turn-ended
wake annotation: unread wake-EVENT since last drain, not current state; historical / not necessarily the triggering event: t1.status: working: still refactoring the adapter
wake annotation: latest wake-EVENT observed at drain, not current state; historical / not necessarily the triggering event: t1.status: resolved [key=budget]: answered: approved, go ahead
PASS  the turn-ended annotation still presents this home's own close

=== step 8 (adversarial): a real worker line must still wake
PASS  the worker's blocked: line woke the supervisor: signal: /tmp/fm-live-race.CVBoZv/home/state/t1.status

=== step 9 (guard): the answer is still on the captain-facing surface
1789878749	6	signal	t1.status	signal: /tmp/fm-live-race.CVBoZv/home/state/t1.status
wake annotation: unread wake-EVENT since last drain, not current state: t1.status: working: still refactoring the adapter
wake annotation: unread wake-EVENT since last drain, not current state: t1.status: resolved [key=budget]: answered: approved, go ahead
wake annotation: latest wake-EVENT observed at drain, not current state: t1.status: blocked: need staging credentials to continue
OPEN DECISIONS (still open, folded from the durable status logs - not just the latest line):
t1 blocked: need staging credentials to continue
OPEN DECISIONS: close one by answering it: bin/fm-send.sh <task> --resolve-key <key> '<answer>'
PASS  the worker's blocker is presented to the captain

===========================
RESULT: all live scenarios passed
target EXIT=0

#!/usr/bin/env bash
# Live reproduction of the failure PR #4907 fixes, driven through the REAL
# watcher process (bin/fm-watch.sh) and the REAL answer command (bin/fm-send.sh).
#
# The race, which happens in ordinary operation: the watcher captures a status
# file's classified endpoint at the top of a poll, then spends real time on its
# "is the crew provably working?" evidence check (a bounded no-mistakes call).
# If the supervisor answers a decision with --resolve-key inside that window,
# the watcher afterwards commits the endpoint it captured BEFORE the answer. The
# watcher's seen marker no longer vouches for the answer's own bytes, so on the
# next poll the supervisor is woken - by nothing but its own bookkeeping close.
#
# This driver forces that window deterministically by making the crew-state
# probe slow, which is exactly what the real probe is (a subprocess call), and
# then asks the only question that matters to a user: does the watcher exit?
set -u

ROOT=${FM_LIVE_ROOT:?set FM_LIVE_ROOT to the checkout under test}
HOLD=${FM_RACE_HOLD:-8}
WORK=$(mktemp -d "${TMPDIR:-/tmp}/fm-live-race.XXXXXX")
HOMEDIR="$WORK/home"; STATE="$HOMEDIR/state"; FAKEBIN="$WORK/fakebin"
mkdir -p "$STATE" "$FAKEBIN" "$WORK/notangle"
STATUS="$STATE/t1.status"
MODE="$WORK/crew-mode"; MARKER="$WORK/crew-held"
FAILED=0
say() { printf '\n=== %s\n' "$*"; }
ok()  { printf 'PASS  %s\n' "$*"; }
bad() { printf 'FAIL  %s\n' "$*"; FAILED=1; }

cat > "$FAKEBIN/tmux" <<'SH'
#!/usr/bin/env bash
set -u
case "${1:-}" in
  send-keys)
    shift; literal=0
    while [ $# -gt 0 ]; do
      case "$1" in
        -t) shift 2 ;;
        -l) literal=1; shift ;;
        *) break ;;
      esac
    done
    [ "$literal" = 1 ] && printf '%s' "${1:-}" >> "${FM_SEND_LOG:-/dev/null}"
    exit 0 ;;
  display-message)
    for a in "$@"; do case "$a" in *cursor_y*) printf '1\n'; exit 0 ;; esac; done
    printf 'fakepane\n'; exit 0 ;;
  capture-pane)
    # A live pane: its content changes on every capture, so the unrelated
    # stale-pane supervision layer never fires and this driver observes only
    # the status SIGNAL path, which is the layer the ledger touches.
    n=$(cat "${FM_RACE_PANE_COUNTER:-/dev/null}" 2>/dev/null || printf 0)
    [ -n "${FM_RACE_PANE_COUNTER:-}" ] && printf '%s\n' "$((n + 1))" > "$FM_RACE_PANE_COUNTER"
    printf '╭────╮\n│ %s │\n╰────╯\n' "$((n + 1))"
    exit 0 ;;
  list-windows)
    printf '%s\n' fm-t1; exit 0 ;;
esac
exit 0
SH
# The crew-state probe: a real subprocess, deliberately slow in "hold" mode so
# the watcher's evidence check spans the moment the answer is written.
cat > "$FAKEBIN/fm-crew-state.sh" <<'SH'
#!/usr/bin/env bash
mode=$(cat "$FM_RACE_MODE" 2>/dev/null || printf idle)
case "$mode" in
  hold)
    printf 'held\n' >> "$FM_RACE_MARKER"
    /bin/sleep "${FM_RACE_HOLD:-8}"
    printf 'state: working · source: run-step · mid no-mistakes step\n' ;;
  working) printf 'state: working · source: run-step · mid no-mistakes step\n' ;;
  *) printf 'state: unknown · source: none · idle worker\n' ;;
esac
exit 0
SH
printf '#!/usr/bin/env bash\nexit 0\n' > "$WORK/wedge-rec"
chmod +x "$FAKEBIN/tmux" "$FAKEBIN/fm-crew-state.sh" "$WORK/wedge-rec"
export FM_WEDGE_ALARM_EXEC="$WORK/wedge-rec"
export FM_ROOT_OVERRIDE="$WORK/notangle"
export FM_RACE_MODE="$MODE" FM_RACE_MARKER="$MARKER" FM_RACE_HOLD="$HOLD"

DRAIN="$ROOT/bin/fm-wake-drain.sh"; WATCH="$ROOT/bin/fm-watch.sh"; SEND="$ROOT/bin/fm-send.sh"
size_of() { LC_ALL=C wc -c < "$1" | tr -d '[:space:]'; }
classified_offset() {
  FM_STATE_OVERRIDE="$STATE" bash -c '. "$1"; fm_wake_signal_seen_size "$2" "$3"' \
    _ "$ROOT/bin/fm-wake-lib.sh" "$STATE" "$STATUS"
}
ack_cycle() {
  local err seq gen; err="$WORK/ack.err"
  FM_STATE_OVERRIDE="$STATE" "$DRAIN" >/dev/null 2>"$err" || return 1
  seq=$(sed -n 's/^WAKE_ACK_REQUIRED:.*--ack-through \([0-9][0-9]*\) --recovery-generation [A-Za-z0-9._-][A-Za-z0-9._-]*$/\1/p' "$err")
  gen=$(sed -n 's/^WAKE_ACK_REQUIRED:.*--ack-through [0-9][0-9]* --recovery-generation \([A-Za-z0-9._-][A-Za-z0-9._-]*\)$/\1/p' "$err")
  [ -n "$seq" ] && [ -n "$gen" ] || return 1
  FM_STATE_OVERRIDE="$STATE" "$DRAIN" --ack-through "$seq" --recovery-generation "$gen"
}
watch_bg() {
  PATH="$FAKEBIN:$PATH" FM_STATE_OVERRIDE="$STATE" FM_CREW_STATE_BIN="$FAKEBIN/fm-crew-state.sh" \
    FM_RACE_PANE_COUNTER="$WORK/pane-counter" \
    FM_POLL=1 FM_SIGNAL_GRACE=1 FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 \
    "$WATCH" > "$1" 2>"$1.err" &
}
wait_for_exit() { local pid=$1 limit=$2 i=0
  while [ "$i" -lt "$limit" ]; do kill -0 "$pid" 2>/dev/null || return 0; sleep 0.1; i=$((i+1)); done
  return 1; }
reap() { kill "$1" 2>/dev/null || true; wait "$1" 2>/dev/null || true; }
send() {
  env -u NO_MISTAKES_GATE PATH="$FAKEBIN:$PATH" FM_GATE_REFUSE_BYPASS=1 \
    FM_ROOT_OVERRIDE="$HOMEDIR" FM_HOME="$HOMEDIR" FM_SEND_LOG="$WORK/send.log" FM_SEND_SETTLE=0 \
    "$SEND" t1 --resolve-key "$1" "$2"
}

printf 'checkout under test: %s\n' "$ROOT"
printf 'throwaway FM_HOME:   %s\n' "$HOMEDIR"
printf 'crew-probe hold:     %ss\n' "$HOLD"

printf idle > "$MODE"
printf 'window=sess:fm-t1\nkind=ship\n' > "$STATE/t1.meta"
printf 'needs-decision [key=budget]: approve the $400 spend?\n' > "$STATUS"

say "step 1: the worker's decision wakes the supervisor (the legitimate wake)"
watch_bg "$WORK/w1.out"; W1=$!
wait_for_exit "$W1" 150 && grep -qF "signal: $STATUS" "$WORK/w1.out" \
  && ok "woken: $(cat "$WORK/w1.out")" || bad "the decision never woke the supervisor"
reap "$W1"
ack_cycle && ok "wake acknowledged" || bad "could not acknowledge the wake"

say "step 2: the worker keeps working (routine growth the watcher will classify)"
printf 'working: still refactoring the adapter\n' >> "$STATUS"
SIZE2=$(size_of "$STATUS")
printf 'status size before the answer: %s bytes\n' "$SIZE2"

say "step 3: the watcher enters its slow crew-evidence check"
printf hold > "$MODE"
watch_bg "$WORK/w2.out"; W2=$!
i=0; while [ "$i" -lt 300 ] && [ ! -s "$MARKER" ]; do sleep 0.1; i=$((i+1)); done
[ -s "$MARKER" ] && ok "watcher is inside the crew-state probe with its endpoint already captured" \
  || bad "the watcher never reached the crew-evidence check"

say "step 4: the supervisor answers the decision INSIDE that window"
send budget "approved, go ahead" && ok "answer sent while the watcher was mid-check" || bad "the --resolve-key send failed"
printf 'status size after the answer: %s bytes\n' "$(size_of "$STATUS")"

say "step 5: the watcher commits the endpoint it captured before the answer"
printf working > "$MODE"
i=0
while [ "$i" -lt $(( (HOLD + 12) * 10 )) ]; do
  [ "$(classified_offset)" = "$SIZE2" ] && break
  kill -0 "$W2" 2>/dev/null || break
  sleep 0.1; i=$((i+1))
done
if [ "$(classified_offset)" = "$SIZE2" ]; then
  ok "watcher's classified offset regressed to $SIZE2, behind the answer's bytes - the race reproduced"
else
  bad "the race did not reproduce (classified offset is $(classified_offset), wanted $SIZE2); raise FM_RACE_HOLD and retry"
fi

say "step 6 (the question): is the supervisor woken by its own answer?"
printf idle > "$MODE"
if wait_for_exit "$W2" 200; then
  bad "the supervisor was WOKEN by its own --resolve-key answer: $(cat "$WORK/w2.out")"
else
  ok "the watcher stayed asleep: this home's own answer did not wake it"
fi

say "step 7 (guard): the worker's turn ends - the owned close must still be annotated"
# The wake is suppressed, but presentation must not be. A turn-ended wake row is
# the captain-facing surface the owned-append ledger is forbidden to touch.
if kill -0 "$W2" 2>/dev/null; then
  : > "$STATE/t1.turn-ended"
  if wait_for_exit "$W2" 200; then
    ok "the worker's turn end woke the supervisor: $(grep -F 'signal:' "$WORK/w2.out" | tail -n 1)"
  else
    bad "the turn-end marker did not wake the supervisor"
  fi
  reap "$W2"
  FM_STATE_OVERRIDE="$STATE" "$DRAIN" > "$WORK/drain-turnend.out" 2>"$WORK/drain-turnend.err" || true
  cat "$WORK/drain-turnend.out"
  grep -qF 'resolved [key=budget]: answered: approved, go ahead' "$WORK/drain-turnend.out" \
    && ok "the turn-ended annotation still presents this home's own close" \
    || bad "the ledger hid the owned close from the turn-ended annotation"
  ack_cycle >/dev/null 2>&1 || true
else
  bad "the watcher was already gone before the turn-end guard"
fi

say "step 8 (adversarial): a real worker line must still wake"
printf 'blocked: need staging credentials to continue\n' >> "$STATUS"
watch_bg "$WORK/w3.out"; W3=$!
wait_for_exit "$W3" 250 && grep -qF "signal: $STATUS" "$WORK/w3.out" \
  && ok "the worker's blocked: line woke the supervisor: $(grep -F 'signal:' "$WORK/w3.out" | tail -n 1)" \
  || bad "a real worker line after the owned answer was swallowed: $(cat "$WORK/w3.out")"
reap "$W3" 2>/dev/null || true

say "step 9 (guard): the answer is still on the captain-facing surface"
FM_STATE_OVERRIDE="$STATE" "$DRAIN" > "$WORK/drain.out" 2>"$WORK/drain.err" || true
cat "$WORK/drain.out"
grep -qF 'blocked: need staging credentials' "$WORK/drain.out" \
  && ok "the worker's blocker is presented to the captain" \
  || bad "the worker's blocker was not presented"

printf '\n===========================\n'
[ "$FAILED" -eq 0 ] && printf 'RESULT: all live scenarios passed\n' || printf 'RESULT: at least one live scenario FAILED\n'
exit "$FAILED"

checkout under test: ~/.no-mistakes/worktrees/42fe67ed39fa/01M2YF86AG8VETDN9HQKHA0P9N (a3624c9)
throwaway FM_HOME:   /tmp/fm-live-4907.zPzfqz/home

=== setup: a ship worker opens two captain decisions on task t1
needs-decision [key=budget]: approve the $400 spend?
needs-decision [key=vendor]: vendor A or vendor B?

=== scenario 1: the worker's two decisions wake the supervisor once
PASS  watcher exited and woke the supervisor: signal: /tmp/fm-live-4907.zPzfqz/home/state/t1.status

=== scenario 2: the supervisor sees both decisions and acknowledges the wake
1789878172	2	signal	t1.status	needs-decision: /tmp/fm-live-4907.zPzfqz/home/state/t1.status
wake annotation: unread wake-EVENT since last drain, not current state: t1.status: needs-decision [key=budget]: approve the $400 spend?
wake annotation: latest wake-EVENT observed at drain, not current state: t1.status: needs-decision [key=vendor]: vendor A or vendor B?
OPEN DECISIONS (still open, folded from the durable status logs - not just the latest line):
t1 [key=budget] needs-decision: approve the $400 spend?
t1 [key=vendor] needs-decision: vendor A or vendor B?
OPEN DECISIONS: close one by answering it: bin/fm-send.sh <task> --resolve-key <key> '<answer>'
PASS  both open decisions presented to the captain
PASS  wake acknowledged; queue is empty

=== scenario 3: the supervisor answers BOTH decisions with two --resolve-key sends
PASS  first answer sent (key=budget)
PASS  second answer sent (key=vendor)
--- status log after both answers ---
needs-decision [key=budget]: approve the $400 spend?
needs-decision [key=vendor]: vendor A or vendor B?
resolved [key=budget]: answered: approved, go ahead
resolved [key=vendor]: answered: go with vendor B

=== scenario 4 (the fix): neither of this home's own answers wakes the supervisor again
PASS  watcher stayed asleep through a full poll cycle: no wake reason, empty wake queue

=== scenario 5 (adversarial): a later worker line on the same task still wakes
PASS  the worker's blocked: line woke the supervisor: signal: /tmp/fm-live-4907.zPzfqz/home/state/t1.status

=== scenario 6 (guard): the answers are still shown to the captain, not hidden
1789878183	4	signal	t1.status	signal: /tmp/fm-live-4907.zPzfqz/home/state/t1.status
wake annotation: unread wake-EVENT since last drain, not current state: t1.status: resolved [key=budget]: answered: approved, go ahead
wake annotation: unread wake-EVENT since last drain, not current state: t1.status: resolved [key=vendor]: answered: go with vendor B
wake annotation: latest wake-EVENT observed at drain, not current state: t1.status: blocked: need staging credentials to continue
OPEN DECISIONS (still open, folded from the durable status logs - not just the latest line):
t1 blocked: need staging credentials to continue
OPEN DECISIONS: close one by answering it: bin/fm-send.sh <task> --resolve-key <key> '<answer>'
PASS  both owned closes still printed on the captain-facing surface
PASS  the worker's blocker is presented too

=== scenario 7 (adversarial): a real fm-teardown.sh leaves no orphaned ledger state
PASS  precondition: the answered task carries a live home-appends ledger
.task-x1.home-appends
fm-teardown.sh exit=0
==> /tmp/fm-live-4907.zPzfqz/td.out <==
teardown task-x1 complete (window firstmate:fm-task-x1, worktree /tmp/fm-live-4907.zPzfqz/td/wt)
Backlog: task-x1 just finished (this home keeps no markdown backlog at /tmp/fm-live-4907.zPzfqz/td/data/backlog.md). Update /tmp/fm-live-4907.zPzfqz/td/data/backlog.md - move task-x1 to Done, keep Done to the 10 most recent, then re-scan Queued and dispatch only work whose blockers are gone and date is due.

==> /tmp/fm-live-4907.zPzfqz/td.err <==
PASS  real fm-teardown.sh removed the per-task ledger and its stale lock
remaining task-x1 state: none

===========================
RESULT: all live scenarios passed
artifacts under /tmp/fm-live-4907.zPzfqz

#!/usr/bin/env bash
# Live end-to-end driver for PR #4907's intent:
# "stop this home's own --resolve-key answers from each waking the supervisor".
#
# Drives the REAL product executables in a throwaway FM_HOME:
#   bin/fm-watch.sh       the watcher that wakes the supervisor (exits on an
#                         actionable wake, printing its reason)
#   bin/fm-send.sh        the supervisor answering a decision with --resolve-key
#   bin/fm-wake-drain.sh  the captain-facing presentation of that wake
#
# Nothing here reads the implementation source. Every assertion is on observable
# product behaviour: whether the watcher process exits (= the supervisor is
# woken), what the durable wake queue holds, and what the drain prints.
set -u

ROOT=${FM_LIVE_ROOT:?set FM_LIVE_ROOT to the checkout under test}
WORK=$(mktemp -d "${TMPDIR:-/tmp}/fm-live-4907.XXXXXX")
HOMEDIR="$WORK/home"; STATE="$HOMEDIR/state"; FAKEBIN="$WORK/fakebin"
mkdir -p "$STATE" "$FAKEBIN" "$WORK/notangle"
STATUS="$STATE/t1.status"

step=0
say() { printf '\n=== %s\n' "$*"; }
ok()  { printf 'PASS  %s\n' "$*"; }
bad() { printf 'FAIL  %s\n' "$*"; FAILED=1; }
FAILED=0

# --- stubs: the backend pane transport and the crew-state reader -------------
# These stand in for a real terminal multiplexer and a real no-mistakes run
# probe. Everything under test (watcher triage, ledger, drain) is the real code.
cat > "$FAKEBIN/tmux" <<'SH'
#!/usr/bin/env bash
set -u
case "${1:-}" in
  send-keys)
    shift; literal=0
    while [ $# -gt 0 ]; do
      case "$1" in
        -t) shift 2 ;;
        -l) literal=1; shift ;;
        *) break ;;
      esac
    done
    [ "$literal" = 1 ] && printf '%s' "${1:-}" >> "${FM_SEND_LOG:-/dev/null}"
    exit 0 ;;
  display-message)
    for a in "$@"; do case "$a" in *cursor_y*) printf '1\n'; exit 0 ;; esac; done
    printf 'fakepane\n'; exit 0 ;;
  capture-pane) printf '╭────╮\n│    │\n╰────╯\n'; exit 0 ;;
  list-windows) printf '%s\n' fm-t1; exit 0 ;;
esac
exit 0
SH
cat > "$FAKEBIN/fm-crew-state.sh" <<'SH'
#!/usr/bin/env bash
printf 'state: unknown · source: none · idle worker\n'
exit 0
SH
cat > "$FAKEBIN/sleep" <<'SH'
#!/usr/bin/env bash
exit 0
SH
cat > "$WORK/wedge-rec" <<'SH'
#!/usr/bin/env bash
exit 0
SH
chmod +x "$FAKEBIN/tmux" "$FAKEBIN/fm-crew-state.sh" "$FAKEBIN/sleep" "$WORK/wedge-rec"

export FM_WEDGE_ALARM_EXEC="$WORK/wedge-rec"
export FM_ROOT_OVERRIDE="$WORK/notangle"

DRAIN="$ROOT/bin/fm-wake-drain.sh"
WATCH="$ROOT/bin/fm-watch.sh"
SEND="$ROOT/bin/fm-send.sh"

drain() { FM_STATE_OVERRIDE="$STATE" "$DRAIN" "$@"; }

ack_cycle() {  # drain, then acknowledge whatever it demands
  local err seq gen
  err="$WORK/ack.err"
  FM_STATE_OVERRIDE="$STATE" "$DRAIN" >/dev/null 2>"$err" || return 1
  seq=$(sed -n 's/^WAKE_ACK_REQUIRED:.*--ack-through \([0-9][0-9]*\) --recovery-generation [A-Za-z0-9._-][A-Za-z0-9._-]*$/\1/p' "$err")
  gen=$(sed -n 's/^WAKE_ACK_REQUIRED:.*--ack-through [0-9][0-9]* --recovery-generation \([A-Za-z0-9._-][A-Za-z0-9._-]*\)$/\1/p' "$err")
  [ -n "$seq" ] && [ -n "$gen" ] || return 1
  FM_STATE_OVERRIDE="$STATE" "$DRAIN" --ack-through "$seq" --recovery-generation "$gen"
}

watch_bg() {  # <stdout-file>
  PATH="$FAKEBIN:$PATH" FM_STATE_OVERRIDE="$STATE" \
    FM_CREW_STATE_BIN="$FAKEBIN/fm-crew-state.sh" \
    FM_POLL=1 FM_SIGNAL_GRACE=1 FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 \
    "$WATCH" > "$1" 2>"$1.err" &
}

wait_for_exit() {  # <pid> <ticks>
  local pid=$1 limit=$2 i=0
  while [ "$i" -lt "$limit" ]; do
    kill -0 "$pid" 2>/dev/null || return 0
    sleep 0.1; i=$((i + 1))
  done
  kill "$pid" 2>/dev/null; wait "$pid" 2>/dev/null; return 1
}

wait_poll_cycle() {  # <pid>; 0 = alive through a whole poll cycle
  local pid=$1 limit=300 beat first now i=0
  beat="$STATE/.last-watcher-beat"; rm -f "$beat"; first=""
  while [ "$i" -lt "$limit" ]; do
    kill -0 "$pid" 2>/dev/null || return 1
    first=$(stat -c %Y "$beat" 2>/dev/null); [ -n "$first" ] && break
    sleep 0.1; i=$((i + 1))
  done
  while [ "$i" -lt "$limit" ]; do
    kill -0 "$pid" 2>/dev/null || return 1
    now=$(stat -c %Y "$beat" 2>/dev/null)
    [ -n "$now" ] && [ "$now" != "$first" ] && return 0
    sleep 0.1; i=$((i + 1))
  done
  return 1
}

reap() { kill "$1" 2>/dev/null || true; wait "$1" 2>/dev/null || true; }

send() {  # <resolve-key> <answer>
  # FM_GATE_REFUSE_BYPASS=1 is the harness seam fm-gate-refuse-lib.sh documents
  # for driving real fleet commands from a test context; without it fm-send
  # refuses because this validation runs inside a no-mistakes gate worktree.
  env -u NO_MISTAKES_GATE PATH="$FAKEBIN:$PATH" FM_GATE_REFUSE_BYPASS=1 \
    FM_ROOT_OVERRIDE="$HOMEDIR" FM_HOME="$HOMEDIR" \
    FM_SEND_LOG="$WORK/send.log" FM_SEND_SETTLE=0 \
    "$SEND" t1 --resolve-key "$1" "$2"
}

# ---------------------------------------------------------------------------
printf 'checkout under test: %s (%s)\n' "$ROOT" "$(git -C "$ROOT" rev-parse --short HEAD 2>/dev/null || echo '?')"
printf 'throwaway FM_HOME:   %s\n' "$HOMEDIR"

say "setup: a ship worker opens two captain decisions on task t1"
{
  printf 'window=sess:fm-t1\n'
  printf 'kind=ship\n'
} > "$STATE/t1.meta"
{
  printf 'needs-decision [key=budget]: approve the $400 spend?\n'
  printf 'needs-decision [key=vendor]: vendor A or vendor B?\n'
} > "$STATUS"
cat "$STATUS"

say "scenario 1: the worker's two decisions wake the supervisor once"
watch_bg "$WORK/watch1.out"; W1=$!
if wait_for_exit "$W1" 150; then
  if grep -qF "signal: $STATUS" "$WORK/watch1.out"; then
    ok "watcher exited and woke the supervisor: $(cat "$WORK/watch1.out")"
  else
    bad "watcher exited without naming the status signal: $(cat "$WORK/watch1.out")"
  fi
else
  bad "the worker's decisions never woke the supervisor"
fi

say "scenario 2: the supervisor sees both decisions and acknowledges the wake"
drain > "$WORK/drain1.out" 2>"$WORK/drain1.err" || true
cat "$WORK/drain1.out"
grep -qF '[key=budget]' "$WORK/drain1.out" && grep -qF '[key=vendor]' "$WORK/drain1.out" \
  && ok "both open decisions presented to the captain" \
  || bad "the drain did not present both open decisions"
ack_cycle && ok "wake acknowledged; queue is $( [ -s "$STATE/.wake-queue" ] && echo 'NOT empty' || echo empty)" \
  || bad "could not acknowledge the wake"

say "scenario 3: the supervisor answers BOTH decisions with two --resolve-key sends"
send budget "approved, go ahead" && ok "first answer sent (key=budget)" || bad "first --resolve-key send failed"
send vendor "go with vendor B"  && ok "second answer sent (key=vendor)" || bad "second --resolve-key send failed"
printf -- '--- status log after both answers ---\n'; cat "$STATUS"

say "scenario 4 (the fix): neither of this home's own answers wakes the supervisor again"
: > "$WORK/watch2.out"
watch_bg "$WORK/watch2.out"; W2=$!
if wait_poll_cycle "$W2"; then
  if [ -s "$WORK/watch2.out" ]; then
    bad "the home's own answers re-woke the supervisor: $(cat "$WORK/watch2.out")"
  elif [ -s "$STATE/.wake-queue" ]; then
    bad "the home's own answers queued a durable wake: $(cat "$STATE/.wake-queue")"
  else
    ok "watcher stayed asleep through a full poll cycle: no wake reason, empty wake queue"
  fi
else
  bad "the watcher EXITED on this home's own --resolve-key answers: $(cat "$WORK/watch2.out")"
fi

say "scenario 5 (adversarial): a later worker line on the same task still wakes"
printf 'blocked: need staging credentials to continue\n' >> "$STATUS"
if wait_for_exit "$W2" 150; then
  grep -qF "signal: $STATUS" "$WORK/watch2.out" \
    && ok "the worker's blocked: line woke the supervisor: $(cat "$WORK/watch2.out")" \
    || bad "the worker's blocked: line did not name the status signal: $(cat "$WORK/watch2.out")"
else
  bad "a worker line after two owned answers was SWALLOWED"
fi
reap "$W2" 2>/dev/null || true

say "scenario 6 (guard): the answers are still shown to the captain, not hidden"
drain > "$WORK/drain2.out" 2>"$WORK/drain2.err" || true
cat "$WORK/drain2.out"
if grep -qF 'resolved [key=budget]: answered: approved, go ahead' "$WORK/drain2.out" \
  && grep -qF 'resolved [key=vendor]: answered: go with vendor B' "$WORK/drain2.out"; then
  ok "both owned closes still printed on the captain-facing surface"
else
  bad "the ledger hid this home's own closes from the captain-facing surface"
fi
grep -qF 'blocked: need staging credentials' "$WORK/drain2.out" \
  && ok "the worker's blocker is presented too" || bad "the worker's blocker was not presented"

say "scenario 7 (adversarial): a real fm-teardown.sh leaves no orphaned ledger state"
# Stand up the fixtures the real teardown executable needs (a project clone with
# an origin, a task worktree with nothing unlanded, and the backend/PR probes it
# shells out to), then run bin/fm-teardown.sh itself on a task whose status log
# carries this home's own --resolve-key closes, i.e. a live ledger.
TD="$WORK/td"; TDSTATE="$TD/state"; TDBIN="$TD/fakebin"
mkdir -p "$TDSTATE" "$TD/config" "$TD/data" "$TDBIN"
for stub in treehouse tmux; do printf '#!/usr/bin/env bash\nexit 0\n' > "$TDBIN/$stub"; done
cat > "$TDBIN/gh-axi" <<'SH'
#!/usr/bin/env bash
case "${1:-} ${2:-}" in
  "pr list") printf '%s\n' "count: 0 (showing first 0)" "pull_requests[]: []"; exit 0 ;;
  "pr view") echo "error: pull request not found" >&2; exit 1 ;;
esac
exit 0
SH
cp "$TDBIN/gh-axi" "$TDBIN/gh"
printf '#!/usr/bin/env bash\nexit 0\n' > "$TDBIN/no-mistakes"
chmod +x "$TDBIN"/*
git init -q --bare "$TD/origin.git"
git -C "$TD/origin.git" symbolic-ref HEAD refs/heads/main
git clone -q "$TD/origin.git" "$TD/_seed" 2>/dev/null
git -C "$TD/_seed" -c user.email=t@t -c user.name=t commit -q --allow-empty -m baseline
git -C "$TD/_seed" push -q origin main
rm -rf "$TD/_seed"
git clone -q "$TD/origin.git" "$TD/project"
git -C "$TD/project" remote set-head origin main 2>/dev/null || true
git -C "$TD/project" worktree add -q -b fm/task-x1 "$TD/wt" main
touch "$TDSTATE/.last-watcher-beat"
{
  printf 'window=firstmate:fm-task-x1\n'
  printf 'endpoint_task_id=task-x1\n'
  printf 'worktree=%s\n' "$TD/wt"
  printf 'project=%s\n' "$TD/project"
  printf 'kind=ship\nmode=local-only\nspawn_gen=live-4907\n'
} > "$TDSTATE/task-x1.meta"
printf 'needs-decision [key=budget]: approve the spend?\n' > "$TDSTATE/task-x1.status"
env -u NO_MISTAKES_GATE PATH="$TDBIN:$PATH" FM_GATE_REFUSE_BYPASS=1 \
  FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$TDSTATE" FM_HOME="$TD" \
  FM_SEND_LOG="$WORK/send2.log" FM_SEND_SETTLE=0 \
  "$SEND" task-x1 --resolve-key budget "approved" >/dev/null 2>&1 || true
if [ -s "$TDSTATE/.task-x1.home-appends" ]; then
  ok "precondition: the answered task carries a live home-appends ledger"
  ls -a "$TDSTATE" | grep -F home-appends
else
  bad "precondition: no ledger was written, so teardown has nothing to retire"
fi
mkdir -p "$TDSTATE/.task-x1.home-appends.lock"
printf '%s\n' 2147483646 > "$TDSTATE/.task-x1.home-appends.lock/pid"
env -u NO_MISTAKES_GATE FM_GATE_REFUSE_BYPASS=1 FM_ROOT_OVERRIDE="$ROOT" \
  FM_STATE_OVERRIDE="$TDSTATE" FM_DATA_OVERRIDE="$TD/data" FM_CONFIG_OVERRIDE="$TD/config" \
  PATH="$TDBIN:$PATH" "$ROOT/bin/fm-teardown.sh" task-x1 > "$WORK/td.out" 2> "$WORK/td.err"
TDRC=$?
printf 'fm-teardown.sh exit=%s\n' "$TDRC"
tail -n 5 "$WORK/td.out" "$WORK/td.err"
if [ "$TDRC" -ne 0 ]; then
  bad "the real teardown refused, so the ledger-retirement path was not exercised"
elif ls -a "$TDSTATE" | grep -qF 'home-appends'; then
  bad "teardown left ledger state behind: $(ls -a "$TDSTATE" | grep -F home-appends)"
else
  ok "real fm-teardown.sh removed the per-task ledger and its stale lock"
  printf 'remaining task-x1 state: %s\n' "$(ls -a "$TDSTATE" | grep -F task-x1 || echo none)"
fi

printf '\n===========================\n'
if [ "$FAILED" -eq 0 ]; then printf 'RESULT: all live scenarios passed\n'; else printf 'RESULT: at least one live scenario FAILED\n'; fi
printf 'artifacts under %s\n' "$WORK"
exit "$FAILED"

=== every send either closed its key exactly once or refused loudly
12 closed, 0 refused, out of 12 concurrent answers
PASS no close was silently lost or duplicated
PASS no torn or interleaved line in the status log

=== the ledger is well formed: ascending, non-overlapping, byte-accurate ranges
v1
ident=strong:33:7288885:2026-09-20 04:28:36.700591186 +0000
498 960
PASS ranges are ascending and non-overlapping
PASS no range runs past the log's 960 bytes

PASS every landed close is presented on the captain-facing surface
PASS exactly the 0 refused answers are still listed as open decisions

# The new regression test, run against BASE 1b1b6e0 (change reverted, test copied in)
$ tests/fm-send-resolve-key.test.sh
ok - fm-send --resolve-key: the answer send itself closes the open decision
ok - fm-send --resolve-key: the close never re-wakes its own home, later lines still do
not ok - the first --resolve-key answer was left to re-wake this home