@zerwiz/ymir 0.1.4 → 0.1.5

package/.agents/tests/fm-classify-decision-key.test.sh

@@ -0,0 +1,340 @@
+#!/usr/bin/env bash
+# tests/fm-classify-decision-key.test.sh - decision-key position tolerance in
+# the open-decisions fold (bin/fm-classify-lib.sh). A "[key=<slug>]" token is
+# documented between the verb and the colon (needs-decision [key=x]: note), but
+# workers commonly write the colon first (needs-decision: [key=x] note); that
+# stated key must be honored, never silently folded into the shared "default"
+# bucket where an answer can close the wrong record (issue #2109). Also covers
+# status_line_verb's bracket-tag stripping: a remote secondmate reply prepends
+# a "[corr=...]" correlation tag before (or without) "[key=...]", and every
+# such tag before the colon must be stripped so the leading word is the bare
+# verb, regardless of order or count. These tests drive the REAL
+# status_line_verb / status_open_decisions / status_open_decisions_incremental
+# functions over crafted status files and assert their folded output, never the
+# fold's own source text. Also covers status_key_closing_verb, which reports how
+# the status side currently reads one key so a consumer can tell a settled key
+# from one handed to a durable captain-held task (bin/fm-captain-hold.sh
+# diverged). Cross-drain cursor persistence and the incremental
+# cost bound live in tests/fm-wake-drain-open-decisions-cursor.test.sh; the
+# drain wiring lives in tests/fm-wake-drain-open-decisions.test.sh.
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+# shellcheck source=bin/fm-classify-lib.sh
+. "$ROOT/bin/fm-classify-lib.sh"
+
+TMP_ROOT=$(fm_test_tmproot fm-classify-decision-key-tests)
+
+# Fresh per-case dir so each case's incremental cursor sidecar cannot leak into
+# another case.
+case_dir() {  # <name>
+  local d="$TMP_ROOT/$1"
+  mkdir -p "$d"
+  printf '%s' "$d"
+}
+
+# Assert the whole-file fold of <status-file> equals <expected>, and that the
+# incremental fold agrees with it on the exact same input - the two consumption
+# strategies must never diverge on what is open.
+assert_fold() {  # <status-file> <expected> <label>
+  local f=$1 expected=$2 label=$3 full incr
+  full=$(status_open_decisions "$f")
+  incr=$(status_open_decisions_incremental "$f")
+  [ "$full" = "$expected" ] \
+    || fail "$label: full fold mismatch: got '$full' want '$expected'"
+  [ "$incr" = "$full" ] \
+    || fail "$label: incremental fold diverged from the full fold: got '$incr' want '$full'"
+}
+
+test_stated_key_is_honored_in_both_positions() {
+  local dir before after expected
+  dir=$(case_dir positions)
+  printf 'needs-decision [key=api-shape]: pick REST or RPC\n' > "$dir/before.status"
+  printf 'needs-decision: [key=api-shape] pick REST or RPC\n' > "$dir/after.status"
+  expected=$(printf 'api-shape\tneeds-decision\tpick REST or RPC\n')
+
+  assert_fold "$dir/before.status" "$expected" "documented before-colon form"
+  assert_fold "$dir/after.status" "$expected" "colon-first form"
+
+  # Equivalence is byte-for-byte: both positions yield the same key AND the
+  # same note (a consumed note-head token is key metadata, not note text).
+  before=$(status_open_decisions "$dir/before.status")
+  after=$(status_open_decisions "$dir/after.status")
+  [ "$before" = "$after" ] \
+    || fail "the two key positions folded to different records: '$before' vs '$after'"
+  pass "a stated [key=X] opens X whether it precedes or follows the verb colon"
+}
+
+test_bare_keyless_line_still_folds_to_default() {
+  local dir
+  dir=$(case_dir keyless)
+  printf 'needs-decision: which color\n' > "$dir/bare.status"
+  assert_fold "$dir/bare.status" "$(printf 'default\tneeds-decision\twhich color\n')" \
+    "bare keyless line"
+
+  # And a bare keyless resolution still closes it - the historical
+  # one-open-decision-per-task behavior is unchanged.
+  printf 'resolved: went with blue\n' >> "$dir/bare.status"
+  assert_fold "$dir/bare.status" "" "bare keyless resolution"
+  pass "a keyless needs-decision still opens and closes the default key"
+}
+
+test_resolution_closes_across_positions() {
+  local dir
+  dir=$(case_dir cross-close)
+  # Opened colon-first, closed in the documented form (what fm-send's
+  # --resolve-key writes): the exact failure from issue #2109.
+  printf 'needs-decision: [key=seam-max-bound] pick the bound\n' > "$dir/a.status"
+  printf 'resolved [key=seam-max-bound]: answered: use 4\n' >> "$dir/a.status"
+  assert_fold "$dir/a.status" "" "documented resolution closing a colon-first open"
+
+  # And the mirror: opened documented, closed colon-first.
+  printf 'needs-decision [key=seam-max-bound]: pick the bound\n' > "$dir/b.status"
+  printf 'resolved: [key=seam-max-bound] answered: use 4\n' >> "$dir/b.status"
+  assert_fold "$dir/b.status" "" "colon-first resolution closing a documented open"
+  pass "a resolution closes its decision regardless of either line's key position"
+}
+
+test_blocked_is_position_tolerant_like_needs_decision() {
+  local dir expected
+  dir=$(case_dir blocked)
+  expected=$(printf 'creds\tblocked\twaiting on the deploy token\n')
+  printf 'blocked [key=creds]: waiting on the deploy token\n' > "$dir/before.status"
+  printf 'blocked: [key=creds] waiting on the deploy token\n' > "$dir/after.status"
+  assert_fold "$dir/before.status" "$expected" "documented blocked form"
+  assert_fold "$dir/after.status" "$expected" "colon-first blocked form"
+  pass "blocked [key=X] opens X in both key positions"
+}
+
+test_two_colon_form_decisions_stay_distinct() {
+  local dir expected
+  dir=$(case_dir distinct)
+  # The concrete hazard behind the silent collapse: two colon-form decisions on
+  # one task used to share the default bucket, so answering one could close the
+  # other. They must stay independently open and independently closable.
+  printf 'needs-decision: [key=alpha] first question\n' > "$dir/t.status"
+  printf 'needs-decision: [key=beta] second question\n' >> "$dir/t.status"
+  expected=$(printf 'alpha\tneeds-decision\tfirst question\nbeta\tneeds-decision\tsecond question\n')
+  assert_fold "$dir/t.status" "$expected" "two colon-form decisions"
+
+  printf 'resolved [key=alpha]: answered: yes\n' >> "$dir/t.status"
+  assert_fold "$dir/t.status" "$(printf 'beta\tneeds-decision\tsecond question\n')" \
+    "closing one of two colon-form decisions"
+  pass "two colon-form keyed decisions never collapse into one shared bucket"
+}
+
+test_mid_note_prose_mention_is_not_a_stated_key() {
+  local dir
+  dir=$(case_dir prose)
+  # Only a token at the head of the note states a key; a summary merely
+  # mentioning "[key=x]" deeper in must neither open nor close that key.
+  printf 'needs-decision: pick a [key=red] or [key=blue] theme\n' > "$dir/t.status"
+  assert_fold "$dir/t.status" \
+    "$(printf 'default\tneeds-decision\tpick a [key=red] or [key=blue] theme\n')" \
+    "mid-note prose mention"
+
+  printf 'needs-decision [key=red]: which shade\n' >> "$dir/t.status"
+  printf 'working: still thinking about [key=red] here\n' >> "$dir/t.status"
+  assert_fold "$dir/t.status" \
+    "$(printf 'default\tneeds-decision\tpick a [key=red] or [key=blue] theme\nred\tneeds-decision\twhich shade\n')" \
+    "prose mention leaves the open set untouched"
+  pass "a [key=x] mentioned mid-note is prose, never an opened or closed key"
+}
+
+test_malformed_stated_key_never_collapses_to_default() {
+  local dir
+  dir=$(case_dir malformed)
+  # A stated-but-invalid slug is rejected in BOTH positions - identically,
+  # and never rewritten into the shared default bucket.
+  printf 'needs-decision [key=bad key]: before-colon malformed\n' > "$dir/before.status"
+  printf 'needs-decision: [key=bad key] colon-first malformed\n' > "$dir/after.status"
+  assert_fold "$dir/before.status" "" "malformed before-colon key"
+  assert_fold "$dir/after.status" "" "malformed colon-first key"
+  pass "a malformed stated key is rejected in both positions, never folded as default"
+}
+
+# A remote secondmate reply routinely prepends a "[corr=<hex>]" correlation
+# tag ahead of "[key=...]" (issue: a remote reply's "needs-decision
+# [corr=d448ea86afa4bf67] [key=x]: ..." folded to no open decision at all,
+# because the verb parser only stripped a leading "[key=...]" token and left
+# the corr tag glued onto the returned verb word). These cases drive the real
+# status_line_verb directly, over every bracket-tag shape that precedes the
+# colon, to pin the general fix: strip EVERY "[name=value]" tag there, not
+# just "[key=...]", regardless of order or count.
+test_status_line_verb_strips_every_bracket_tag_before_colon() {
+  local v
+
+  v=$(status_line_verb 'needs-decision [corr=d448ea86afa4bf67] [key=loan-installment-cadence-amount]: fill in the terms')
+  [ "$v" = "needs-decision" ] || fail "corr-then-key tag order: got '$v'"
+
+  v=$(status_line_verb 'needs-decision [key=loan-installment-cadence-amount] [corr=d448ea86afa4bf67]: fill in the terms')
+  [ "$v" = "needs-decision" ] || fail "key-then-corr tag order: got '$v'"
+
+  v=$(status_line_verb 'needs-decision [corr=d448ea86afa4bf67]: fill in the terms')
+  [ "$v" = "needs-decision" ] || fail "corr-only tag: got '$v'"
+
+  v=$(status_line_verb 'blocked [corr=aaaa1111bbbb2222] [key=creds]: waiting on the deploy token')
+  [ "$v" = "blocked" ] || fail "blocked with corr+key: got '$v'"
+
+  v=$(status_line_verb 'resolved [corr=aaaa1111bbbb2222] [key=creds]: answered: rotated')
+  [ "$v" = "resolved" ] || fail "resolved with corr+key: got '$v'"
+
+  pass "status_line_verb strips every bracket tag before the colon, in any order, and recovers the bare verb"
+}
+
+test_corr_and_key_tags_open_and_close_under_the_stated_key() {
+  local dir expected
+  dir=$(case_dir corr-and-key)
+  printf 'needs-decision [corr=d448ea86afa4bf67] [key=loan-installment-cadence-amount]: pick the cadence\n' \
+    > "$dir/t.status"
+  expected=$(printf 'loan-installment-cadence-amount\tneeds-decision\tpick the cadence\n')
+  assert_fold "$dir/t.status" "$expected" "corr-then-key opens under the stated key"
+
+  printf 'resolved [corr=d448ea86afa4bf67] [key=loan-installment-cadence-amount]: answered: monthly\n' \
+    >> "$dir/t.status"
+  assert_fold "$dir/t.status" "" "corr-then-key resolution closes the same stated key"
+  pass "a [corr=...] tag ahead of [key=...] no longer swallows the verb: opens and closes under the stated key"
+}
+
+test_corr_only_tag_opens_as_default_like_a_bare_line() {
+  local dir bare corred
+  dir=$(case_dir corr-only)
+  printf 'needs-decision: which vendor\n' > "$dir/bare.status"
+  printf 'needs-decision [corr=d448ea86afa4bf67]: which vendor\n' > "$dir/corred.status"
+
+  bare=$(status_open_decisions "$dir/bare.status")
+  corred=$(status_open_decisions "$dir/corred.status")
+  [ "$corred" = "$bare" ] \
+    || fail "a corr-only tag folded differently than the bare line: '$corred' vs '$bare'"
+  assert_fold "$dir/corred.status" "$(printf 'default\tneeds-decision\twhich vendor\n')" "corr-only tag"
+  pass "a [corr=...] tag with no stated key opens under 'default', exactly like a bare needs-decision line"
+}
+
+test_key_only_before_colon_still_opens_no_regression() {
+  local dir
+  dir=$(case_dir key-only-no-corr)
+  printf 'needs-decision [key=loan-installment-cadence-amount]: pick the cadence\n' > "$dir/t.status"
+  assert_fold "$dir/t.status" \
+    "$(printf 'loan-installment-cadence-amount\tneeds-decision\tpick the cadence\n')" \
+    "key-only before colon, no corr tag"
+  pass "a [key=x] tag alone (no corr tag) still opens x - no regression from the tag-stripping fix"
+}
+
+test_blocked_and_resolved_are_tag_order_independent() {
+  local dir
+  dir=$(case_dir blocked-tag-order)
+  printf 'blocked [corr=aaaa1111bbbb2222] [key=creds]: waiting on the deploy token\n' > "$dir/a.status"
+  assert_fold "$dir/a.status" "$(printf 'creds\tblocked\twaiting on the deploy token\n')" \
+    "blocked corr-then-key"
+
+  printf 'blocked [key=creds] [corr=aaaa1111bbbb2222]: waiting on the deploy token\n' > "$dir/b.status"
+  assert_fold "$dir/b.status" "$(printf 'creds\tblocked\twaiting on the deploy token\n')" \
+    "blocked key-then-corr"
+
+  printf 'blocked [corr=aaaa1111bbbb2222] [key=creds]: waiting on the deploy token\n' > "$dir/c.status"
+  printf 'resolved [corr=aaaa1111bbbb2222] [key=creds]: answered: rotated\n' >> "$dir/c.status"
+  assert_fold "$dir/c.status" "" "blocked/resolved corr+key close together regardless of tag order"
+  pass "blocked/resolved parse their bare verb with any bracket-tag order preceding the colon"
+}
+
+test_incremental_agrees_with_full_fold_across_appends() {
+  local dir f expected
+  dir=$(case_dir incremental)
+  f="$dir/t.status"
+  # assert_fold already pins incremental==full per snapshot; this case pins the
+  # agreement ACROSS appends, where the incremental path folds only the new
+  # bytes on top of its persisted open set while the full fold re-reads
+  # everything from scratch.
+  printf 'needs-decision: [key=seam-max-bound] pick the bound\n' > "$f"
+  expected=$(printf 'seam-max-bound\tneeds-decision\tpick the bound\n')
+  assert_fold "$f" "$expected" "colon-first open, first read"
+
+  printf 'working: routine progress note\n' >> "$f"
+  printf 'needs-decision: [key=other] a second colon-form question\n' >> "$f"
+  expected=$(printf 'seam-max-bound\tneeds-decision\tpick the bound\nother\tneeds-decision\ta second colon-form question\n')
+  assert_fold "$f" "$expected" "colon-first opens buried under later appends"
+
+  printf 'resolved [key=seam-max-bound]: answered: use 4\n' >> "$f"
+  printf 'resolved: [key=other] cleared on its own\n' >> "$f"
+  assert_fold "$f" "" "cross-position resolutions close both"
+  pass "the incremental fold matches the full fold across appends in both key positions"
+}
+
+test_stated_key_is_honored_in_both_positions
+test_bare_keyless_line_still_folds_to_default
+test_resolution_closes_across_positions
+test_blocked_is_position_tolerant_like_needs_decision
+test_two_colon_form_decisions_stay_distinct
+test_mid_note_prose_mention_is_not_a_stated_key
+test_malformed_stated_key_never_collapses_to_default
+test_status_line_verb_strips_every_bracket_tag_before_colon
+test_corr_and_key_tags_open_and_close_under_the_stated_key
+test_corr_only_tag_opens_as_default_like_a_bare_line
+test_key_only_before_colon_still_opens_no_regression
+test_blocked_and_resolved_are_tag_order_independent
+test_incremental_agrees_with_full_fold_across_appends
+
+# status_key_closing_verb reports HOW the status side currently reads one key,
+# which is what lets a consumer tell a settled key from a key handed to a
+# durable captain-held task. The two closing verbs must stay distinguishable:
+# `resolved` claims the question is settled outright, while `captain-held` is
+# the verified transfer to that task, so treating them alike would either lose
+# the record-divergence signal or invent one on every correct transfer.
+test_closing_verb_separates_resolution_from_durable_transfer() {
+  local dir f
+  dir=$(case_dir closing-verb)
+  f="$dir/a.status"
+  cat > "$f" <<'EOF'
+working: started
+needs-decision [key=route]: north or south
+resolved [key=route]: answered: north
+needs-decision [key=access]: open or restricted
+captain-held [key=access]: tracked by sample-access-call
+blocked [key=creds]: need the deploy token
+done: everything else shipped
+EOF
+  [ "$(status_key_closing_verb "$f" route)" = resolved ] \
+    || fail "a resolved key did not report the resolve verb: '$(status_key_closing_verb "$f" route)'"
+  [ "$(status_key_closing_verb "$f" access)" = captain-held ] \
+    || fail "a durable-transfer close reported the wrong verb: '$(status_key_closing_verb "$f" access)'"
+  [ "$(status_key_closing_verb "$f" creds)" = blocked ] \
+    || fail "a still-open key must report its opening verb: '$(status_key_closing_verb "$f" creds)'"
+  [ -z "$(status_key_closing_verb "$f" never-mentioned)" ] \
+    || fail "a key with no transition line reported a verb"
+  [ -z "$(status_key_closing_verb "$dir/absent.status" route)" ] \
+    || fail "an absent status file reported a verb"
+  pass "status_key_closing_verb separates resolution, durable transfer, and still-open"
+}
+
+# The reported verb is the LAST transition, read through the same fold rule as
+# everything else: the colon-first key position counts, a re-opened key reports
+# open again, and a prose mention is never a transition.
+test_closing_verb_tracks_the_last_transition_in_both_positions() {
+  local dir f
+  dir=$(case_dir closing-verb-last)
+  f="$dir/a.status"
+  cat > "$f" <<'EOF'
+needs-decision: [key=route] colon-first open
+resolved: [key=route] colon-first close
+EOF
+  [ "$(status_key_closing_verb "$f" route)" = resolved ] \
+    || fail "a colon-first resolution was not seen: '$(status_key_closing_verb "$f" route)'"
+
+  printf 'needs-decision [key=route]: re-opened after a bad answer\n' >> "$f"
+  [ "$(status_key_closing_verb "$f" route)" = needs-decision ] \
+    || fail "a re-opened key still reported closed: '$(status_key_closing_verb "$f" route)'"
+
+  printf 'resolved [key=route]: answered: south after all\n' >> "$f"
+  [ "$(status_key_closing_verb "$f" route)" = resolved ] \
+    || fail "the last of several transitions was not reported: '$(status_key_closing_verb "$f" route)'"
+
+  printf 'working: a later append that only mentions [key=route] as prose\n' >> "$f"
+  [ "$(status_key_closing_verb "$f" route)" = resolved ] \
+    || fail "a prose mention changed the reported verb: '$(status_key_closing_verb "$f" route)'"
+  pass "status_key_closing_verb reports the last real transition, in either key position"
+}
+
+test_closing_verb_separates_resolution_from_durable_transfer
+test_closing_verb_tracks_the_last_transition_in_both_positions

package/.agents/tests/fm-claude-stop-autoarm-live-e2e.test.sh

@@ -0,0 +1,164 @@
+#!/usr/bin/env bash
+# Opt-in credentialed Claude live regression for the Stop-owned auto-arm
+# (bin/fm-claude-stop-autoarm.sh + bin/fm-turnend-guard.sh --claude).
+# Proves, against the real installed Claude Code and the real tracked hook
+# registration: a fresh session with in-flight work, no watcher, and a stale
+# session lock can run fm-session-start.sh first; session start reclaims the
+# dead owner; at least two tokenless auto-arm and rewake cycles then complete
+# with zero model-issued arm commands; and the cooperative guard consumes no
+# forced continuation while the hook's launch is healthy.
+# The project and FM_HOME are isolated; Claude keeps using its existing managed
+# authentication. No live fleet home, worktree, or session is touched.
+# shellcheck disable=SC2016 # the model, not this test shell, reads the prompt text
+set -u
+
+if [ "${FM_CLAUDE_LIVE_E2E:-0}" != 1 ]; then
+  echo "skip: set FM_CLAUDE_LIVE_E2E=1 to run the Claude Stop auto-arm regression"
+  exit 0
+fi
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+fail() {
+  printf 'not ok - %s\n' "$1" >&2
+  exit 1
+}
+
+command -v claude >/dev/null 2>&1 || fail "claude not found"
+
+LAB="$ROOT/.claude-autoarm-live-e2e.$$"
+PROJECT="$LAB/project"
+HOME_DIR="$LAB/fmhome"
+LIVE_OWNER_HOME="$LAB/live-owner-home"
+TRANSCRIPT="$LAB/claude.jsonl"
+CLAUDE_VERSION=$(claude --version)
+
+cleanup() {
+  rm -rf "$LAB"
+}
+trap cleanup EXIT
+
+mkdir -p "$LAB"
+# git clone of this worktree carries only committed state, so copy the
+# working-tree surfaces under test (same pattern as the continuity live E2E).
+git clone -q "$ROOT" "$PROJECT"
+cp -R "$ROOT/bin/." "$PROJECT/bin/"
+cp "$ROOT/.claude/settings.json" "$PROJECT/.claude/settings.json"
+# The lab keeps the real tracked .claude/settings.json SessionStart nudge,
+# Stop guard, and asyncRewake auto-arm registration.
+# The only local hook records model-issued Bash calls without acquiring the
+# session lock or otherwise changing lifecycle behavior.
+cat > "$PROJECT/.claude/settings.local.json" <<'JSON'
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          { "type": "command", "command": "\"$CLAUDE_PROJECT_DIR\"/bin/tool-logger.sh" }
+        ]
+      }
+    ]
+  }
+}
+JSON
+
+cat > "$PROJECT/bin/tool-logger.sh" <<'SH'
+#!/usr/bin/env bash
+P=$(cat 2>/dev/null || true)
+printf '%s\n' "$P" | jq -r '.tool_input.command // "unknown"' >> "$FM_HOME/state/tool-calls.log" 2>/dev/null
+exit 0
+SH
+chmod +x "$PROJECT/bin/tool-logger.sh"
+
+mkdir -p "$HOME_DIR/state" "$HOME_DIR/config" "$HOME_DIR/data"
+printf 'project=fixture\nwindow=fixture\nbackend=tmux\n' > "$HOME_DIR/state/task.meta"
+# A numeric pid above the supported OS pid range is a demonstrably dead prior
+# harness owner under fm_harness_pid_alive, matching the reproduced incident.
+printf '9999999\n' > "$HOME_DIR/state/.lock"
+
+# Rapid-death arm fixture: started plus an immediate actionable reason, the
+# exact spent-Stop edge shape. Runs 1-2 close actionable; run 3 closes clean so
+# a misbehaving session can never loop forever.
+cat > "$PROJECT/bin/fm-watch-arm.sh" <<'SH'
+#!/usr/bin/env bash
+N=$(cat "$FM_HOME/state/arm-count" 2>/dev/null || echo 0); N=$((N+1)); echo "$N" > "$FM_HOME/state/arm-count"
+echo "arm-run=$N pid=$$" >> "$FM_HOME/state/arm-ran"
+if [ "$N" -ge 3 ]; then
+  rm -f "$FM_HOME/state/task.meta"
+  printf 'watcher: attached pid=%s (beacon 2s)\n' "$$"
+  exit 0
+fi
+printf 'watcher: started pid=%s (beacon fresh)\n' "$$"
+printf 'stale: fixture-rapid-%s\n' "$N"
+exit 0
+SH
+# Drain fixture: session start invokes it once, then the model invokes it once
+# per rewake. The third total drain ends the in-flight need after two complete
+# Stop-owned cycles.
+cat > "$PROJECT/bin/fm-wake-drain.sh" <<'SH'
+#!/usr/bin/env bash
+N=$(cat "$FM_HOME/state/drain-count" 2>/dev/null || echo 0); N=$((N+1)); echo "$N" > "$FM_HOME/state/drain-count"
+echo "drain-run=$N" >> "$FM_HOME/state/drain-ran"
+if [ "$N" -ge 3 ]; then
+  rm -f "$FM_HOME/state/task.meta"
+fi
+printf 'stale: fixture-rapid drained\n'
+SH
+chmod +x "$PROJECT/bin/fm-watch-arm.sh" "$PROJECT/bin/fm-wake-drain.sh"
+
+PROMPT='Run exactly `bin/fm-session-start.sh` with Bash as your first tool call. After reading its complete digest, reply with exactly CYCLE0 and stop. Whenever a Stop hook feedback message wakes you, run exactly `bin/fm-wake-drain.sh` once with Bash, then reply with exactly ACK and stop. Never run bin/fm-watch-arm.sh or any other arm command, and never use any other tool.'
+
+(
+  cd "$PROJECT" || exit 1
+  FM_HOME="$HOME_DIR" CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false \
+    claude -p "$PROMPT" --dangerously-skip-permissions --effort low --output-format stream-json --verbose
+) > "$TRANSCRIPT" 2>&1 || fail "Claude credentialed auto-arm session failed: $(tail -20 "$TRANSCRIPT")"
+
+ARM_RUNS=$(wc -l < "$HOME_DIR/state/arm-ran" 2>/dev/null | tr -d ' ')
+[ "$ARM_RUNS" = 2 ] || fail "expected exactly 2 hook-owned arm cycles, got $ARM_RUNS: $(cat "$HOME_DIR/state/arm-ran" 2>/dev/null)"
+DRAIN_RUNS=$(wc -l < "$HOME_DIR/state/drain-ran" 2>/dev/null | tr -d ' ')
+[ "$DRAIN_RUNS" = 3 ] || fail "expected one session-start drain plus two model wake drains, got $DRAIN_RUNS drains"
+REWAKES=$(grep -c 'Stop hook feedback' "$TRANSCRIPT" 2>/dev/null || true)
+[ "$REWAKES" -ge 2 ] || fail "expected at least 2 exit-2 rewake deliveries, got $REWAKES"
+grep -q 'stale: fixture-rapid-1' "$TRANSCRIPT" || fail "first rapid rewake reason missing from the transcript"
+grep -q 'stale: fixture-rapid-2' "$TRANSCRIPT" || fail "second rapid rewake reason missing from the transcript"
+[ "$(sed -n '1p' "$HOME_DIR/state/tool-calls.log" 2>/dev/null)" = 'bin/fm-session-start.sh' ] \
+  || fail "fresh Claude session did not run session start first: $(cat "$HOME_DIR/state/tool-calls.log" 2>/dev/null)"
+[ "$(cat "$HOME_DIR/state/.lock" 2>/dev/null)" != 9999999 ] \
+  || fail "session start did not reclaim the stale dead-owner lock"
+if [ -f "$HOME_DIR/state/tool-calls.log" ]; then
+  ! grep -q 'fm-watch-arm.sh' "$HOME_DIR/state/tool-calls.log" \
+    || fail "model issued an arm command despite Stop-owned continuity: $(cat "$HOME_DIR/state/tool-calls.log")"
+  ! grep -q '&' "$HOME_DIR/state/tool-calls.log" \
+    || fail "model used a shell ampersand: $(cat "$HOME_DIR/state/tool-calls.log")"
+fi
+! grep -q 'TURN WOULD END BLIND' "$TRANSCRIPT" \
+  || fail "cooperative guard consumed a forced continuation while the auto-arm launch was healthy"
+[ "$(sed -n 's/^.*outcome=\([a-z][a-z]*\) .*$/\1/p' "$HOME_DIR/state/.claude-autoarm-epoch" 2>/dev/null)" = rewake ] \
+  || fail "auto-arm epoch ledger must record the rewake outcome"
+[ ! -e "$HOME_DIR/state/.claude-autoarm.lock" ] || fail "auto-arm owner lock was left behind"
+
+# Live-owner negative control: a separate supported-harness process owns a
+# second isolated home while another Stop hook fires from the same primary
+# project. The competing hook must not replace the session lock, arm, write an
+# epoch, or rewake.
+FAKE_CLAUDE="$LAB/claude"
+ln -s /bin/bash "$FAKE_CLAUDE"
+mkdir -p "$LIVE_OWNER_HOME/state" "$LIVE_OWNER_HOME/config"
+printf 'project=fixture\n' > "$LIVE_OWNER_HOME/state/task.meta"
+"$FAKE_CLAUDE" -c 'sleep 3; :' &
+LIVE_OWNER_PID=$!
+printf '%s\n' "$LIVE_OWNER_PID" > "$LIVE_OWNER_HOME/state/.lock"
+LIVE_OWNER_RC=0
+printf '%s\n' '{"session_id":"live-owner-control"}' \
+  | FM_HOME="$LIVE_OWNER_HOME" FM_ROOT_OVERRIDE="$PROJECT" "$FAKE_CLAUDE" -c '"$FM_ROOT_OVERRIDE/bin/fm-claude-stop-autoarm.sh"' \
+      >"$LAB/live-owner.out" 2>"$LAB/live-owner.err" || LIVE_OWNER_RC=$?
+[ "$LIVE_OWNER_RC" -eq 0 ] || fail "competing Stop hook returned $LIVE_OWNER_RC while another live session owned the home"
+[ "$(cat "$LIVE_OWNER_HOME/state/.lock")" = "$LIVE_OWNER_PID" ] || fail "competing Stop hook replaced the live session owner"
+[ ! -e "$LIVE_OWNER_HOME/state/arm-ran" ] || fail "competing Stop hook armed while another live session owned the home"
+[ ! -e "$LIVE_OWNER_HOME/state/.claude-autoarm-epoch" ] || fail "competing Stop hook wrote an epoch while another live session owned the home"
+[ ! -s "$LAB/live-owner.out" ] && [ ! -s "$LAB/live-owner.err" ] || fail "competing Stop hook produced a rewake while another live session owned the home"
+wait "$LIVE_OWNER_PID"
+
+printf 'ok - Claude %s live E2E reclaimed a stale session lock through session start, completed two tokenless Stop-owned rewake cycles, and preserved the competing-live-owner boundary\n' "$CLAUDE_VERSION"