fix(bin): reclaim dead checkpoint session locks

[maruthiprithivi]

Intent

Restore checkpoint supervision when the recorded session-lock owner is provably dead, while preserving exclusion of live owners and safe handling of uncertain lock state.

What Changed

• Added Codex checkpoint recovery for a provably dead session-lock owner, delegating reclaim through fm-lock.sh before supervision host activation.
• Preserved existing safety boundaries so checkpoints leave live foreign owners, owned locks, malformed locks, and absent locks untouched.
• Documented the arm-owner reclaim behavior and added checkpoint regression coverage for dead-owner reclaim, live-owner refusal, and unchanged owned/absent locks.

Risk Assessment

✅ Low: The change is narrowly scoped to Codex checkpoint stale-lock recovery, delegates mutation to the existing lock owner, preserves live-owner and absent/malformed-lock behavior, and the added tests exercise observable checkpoint behavior rather than source text.

Testing

Ran the targeted fm-watch-checkpoint product-level test script against isolated disposable homes, covering dead-owner reclaim, live-owner no-steal, absent/owned-lock no-op behavior, and existing supervision-host checkpoint behavior; all scenarios passed and the worktree stayed clean.

• Live validation: ✅ go - 4 of 4 scenarios driven live against the product

Scenario	Result	Live	Evidence
A replacement Codex checkpoint finds a dead recorded session-lock owner, reclaims through the real lock writer, and runs a bounded supervision-host park instead of standing down.	✅ pass	live	tests/fm-watch-checkpoint.test.sh in fm-watch-checkpoint-targeted.log: ok - checkpoint: a replacement session reclaims a provably dead session-lock owner
A checkpoint encountering a live foreign harness owner leaves the lock byte-identical and reports the supervision-host stand-down.	✅ pass	live	tests/fm-watch-checkpoint.test.sh in fm-watch-checkpoint-targeted.log: ok - checkpoint: a live session-lock owner is never reclaimed by the checkpoint
A checkpoint with an already-owned lock or no lock does not rewrite ownership or claim an uncertain home.	✅ pass	live	tests/fm-watch-checkpoint.test.sh in fm-watch-checkpoint-targeted.log: ok - checkpoint: an owned or absent session lock is never rewritten or claimed
Existing checkpoint host behavior still bounds real host parks, preserves watcher environments, passes handbacks, and honors supervision-host opt-in/off controls.	✅ pass	live	tests/fm-watch-checkpoint.test.sh in fm-watch-checkpoint-targeted.log: existing host checkpoint cases remained green

Evidence: Focused fm-watch-checkpoint test transcript

Source: Focused fm-watch-checkpoint test transcript

ok - quiet checkpoint exits 124 with a clean checkpoint line and no live lock
ok - checkpoint passes through a real watcher wake and leaves the queue for drain
ok - checkpoint preserves watcher environment for registered custom checks
ok - checkpoint rejects an existing watcher singleton as unowned
ok - checkpoint: an opted-in home runs the host for the checkpoint's bound, raised only while away
ok - checkpoint: a handed-back wake passes through, and a host stand-down is a failure
ok - checkpoint: a Codex home without config/supervision-host, or with an off file, never runs the host
ok - checkpoint: the real host ends its park at the checkpoint bound as a quiet checkpoint
ok - checkpoint: a replacement session reclaims a provably dead session-lock owner
ok - checkpoint: a live session-lock owner is never reclaimed by the checkpoint
ok - checkpoint: an owned or absent session lock is never rewritten or claimed

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 1 issue found → auto-fixed ✅

• 🚨 bin/fm-watch-checkpoint.sh:75 - The checkpoint now unconditionally sources fm-session-lock-lib.sh, but the host fixture used by the existing make_host_home tests only copies fm-watch-checkpoint.sh and fm-supervision-engine-lib.sh into its fake root. A concrete run of test_host_checkpoint_bounds_the_park_by_posture uses $hometask-local-workspace; before it can invoke the stub host, line 75 sources a file that is absent in that fixture root, so the test harness exits before exercising the behavior it is meant to cover. The same fixture affects test_host_checkpoint_passes_a_handback_and_reports_a_stand_down and test_host_checkpoint_needs_the_file_and_honors_off in tests/fm-watch-checkpoint.test.sh:96. Copy the new sourced lock helper and its direct dependency, or keep the fixture using the repository script root for shared libs.

🔧 Fix applied.
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• Live validation: ✅ go - 4 of 4 scenarios driven live against the product

Scenario	Result	Live	Evidence
A replacement Codex checkpoint finds a dead recorded session-lock owner, reclaims through the real lock writer, and runs a bounded supervision-host park instead of standing down.	✅ pass	live	tests/fm-watch-checkpoint.test.sh in fm-watch-checkpoint-targeted.log: ok - checkpoint: a replacement session reclaims a provably dead session-lock owner
A checkpoint encountering a live foreign harness owner leaves the lock byte-identical and reports the supervision-host stand-down.	✅ pass	live	tests/fm-watch-checkpoint.test.sh in fm-watch-checkpoint-targeted.log: ok - checkpoint: a live session-lock owner is never reclaimed by the checkpoint
A checkpoint with an already-owned lock or no lock does not rewrite ownership or claim an uncertain home.	✅ pass	live	tests/fm-watch-checkpoint.test.sh in fm-watch-checkpoint-targeted.log: ok - checkpoint: an owned or absent session lock is never rewritten or claimed
Existing checkpoint host behavior still bounds real host parks, preserves watcher environments, passes handbacks, and honors supervision-host opt-in/off controls.	✅ pass	live	tests/fm-watch-checkpoint.test.sh in fm-watch-checkpoint-targeted.log: existing host checkpoint cases remained green

• mkdir -p ~/.no-mistakes/evidence/validation-run && tests/fm-watch-checkpoint.test.sh | tee ~/.no-mistakes/evidence/validation-run/fm-watch-checkpoint-targeted.log
• git status --short

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

[greptile-apps]

Confidence Score: 5/5

[High risk] Adds session lock reclamation to checkpoint supervision.

The PR appears safe to merge, with a non-blocking correction needed to the arm-owner documentation.

_{Reviews (2) · Last reviewed commit: "no-mistakes(ci): Fixed ci-1/ci-2. `fm-wa..."}

[greptile-apps]

Unknown lock behavior misstated If a lock records a live non-harness PID, this paragraph says Claude Stop and Cursor leave it untouched. Both hooks instead pass any numeric PID that is not a live verified harness to fm-lock.sh, which can reclaim the lock. Codex does leave it untouched. This difference matters when operators diagnose ownership or decide whether an unknown lock is safe from takeover.