From dcd2303f4be27d694e9f3f4072a62f6b65d0d2be Mon Sep 17 00:00:00 2001
From: Ivan Li <ivan@withally.com>
Date: Tue, 8 Sep 2026 08:15:08 +0800
Subject: [PATCH 1/3] fix(tests): reap hostile watcher fixtures

---
 bin/fm-test-run.sh                  |  28 ++-
 tests/fm-pi-watch-extension.test.sh | 309 ++++++++++++++++++++--------
 tests/fm-test-run.test.sh           |  70 +++++++
 tests/lib.sh                        | 221 +++++++++++++++++++-
 4 files changed, 529 insertions(+), 99 deletions(-)

diff --git a/bin/fm-test-run.sh b/bin/fm-test-run.sh
index 649b807bb90..b3d520d1634 100755
--- a/bin/fm-test-run.sh
+++ b/bin/fm-test-run.sh
@@ -2080,25 +2080,27 @@ record_script_result() {
 # because an unbounded suite is what silently outruns its caller's budget.
 run_script_bounded() {  # <script> <out> <stream> <id>
   local script=$1 out=$2 stream=$3 id=$4
-  local rc
-  : "$id"
+  local rc cleanup_rc registry="$RUN_TMP/owned.$id"
+  mkdir -p "$registry"
   set +e
   if [ "$stream" -eq 1 ]; then
     if [ "$PER_SCRIPT_TIMEOUT_SECS" -gt 0 ]; then
       # Expansion is intentionally deferred to the child bash passed to -c.
       # shellcheck disable=SC2016
       fm_run_timed "$PER_SCRIPT_TIMEOUT_SECS" bash -c \
-        'bash "$1" 2>&1 | tee "$2"; exit "${PIPESTATUS[0]}"' _ "$script" "$out"
+        'FM_TEST_OWNED_CHILD_REGISTRY=$1 bash "$2" 2>&1 | tee "$3"; exit "${PIPESTATUS[0]}"' \
+        _ "$registry" "$script" "$out"
       rc=$?
     else
-      bash "$script" 2>&1 | tee "$out"
+      FM_TEST_OWNED_CHILD_REGISTRY="$registry" bash "$script" 2>&1 | tee "$out"
       rc=${PIPESTATUS[0]}
     fi
   elif [ "$PER_SCRIPT_TIMEOUT_SECS" -gt 0 ]; then
-    fm_run_timed "$PER_SCRIPT_TIMEOUT_SECS" bash "$script" >"$out" 2>&1
+    fm_run_timed "$PER_SCRIPT_TIMEOUT_SECS" env \
+      FM_TEST_OWNED_CHILD_REGISTRY="$registry" bash "$script" >"$out" 2>&1
     rc=$?
   else
-    bash "$script" >"$out" 2>&1
+    FM_TEST_OWNED_CHILD_REGISTRY="$registry" bash "$script" >"$out" 2>&1
     rc=$?
   fi
   if [ "$PER_SCRIPT_TIMEOUT_SECS" -gt 0 ] && [ "$rc" -eq 124 ]; then
@@ -2106,6 +2108,20 @@ run_script_bounded() {  # <script> <out> <stream> <id>
       "$script" "$PER_SCRIPT_TIMEOUT_SECS" >>"$out"
     [ "$stream" -eq 1 ] && tail -1 "$out"
   fi
+  if [ -r "$ROOT/tests/lib.sh" ]; then
+    bash "$ROOT/tests/lib.sh" owned-children-cleanup "$registry" >>"$out" 2>&1
+    cleanup_rc=$?
+  elif compgen -G "$registry/child.*" >/dev/null; then
+    printf 'fm-test: owned-child registry is populated but tests/lib.sh is unavailable\n' >>"$out"
+    cleanup_rc=1
+  else
+    cleanup_rc=0
+  fi
+  if [ "$cleanup_rc" -ne 0 ]; then
+    printf 'not ok - %s left a registered fixture process or process group alive\n' "$script" >>"$out"
+    [ "$stream" -eq 1 ] && tail -1 "$out"
+    [ "$rc" -ne 0 ] || rc=1
+  fi
   return "$rc"
 }
 
diff --git a/tests/fm-pi-watch-extension.test.sh b/tests/fm-pi-watch-extension.test.sh
index da38a3604a5..6e4aaf62551 100755
--- a/tests/fm-pi-watch-extension.test.sh
+++ b/tests/fm-pi-watch-extension.test.sh
@@ -6,6 +6,29 @@ set -u
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 TMP_ROOT=$(fm_test_tmproot fm-pi-watch-extension)
+[ -z "${FM_TEST_TMP_ROOT_REPORT:-}" ] || printf '%s\n' "$TMP_ROOT" > "$FM_TEST_TMP_ROOT_REPORT"
+export FM_TEST_FIXTURE_ROOT="$TMP_ROOT"
+export FM_TEST_LONG_LIVED_FIXTURE_HELPER="$TMP_ROOT/long-lived-fixture.sh"
+[ "${FM_TEST_INJECT_UNRETIRED_FAILURE:-0}" != 1 ] || : > "$TMP_ROOT/inject-unretired-failure"
+cat > "$FM_TEST_LONG_LIVED_FIXTURE_HELPER" <<'SH'
+fm_fixture_init() {
+  bash "${FM_TEST_LIB:?}" owned-child-register \
+    "${FM_TEST_OWNED_CHILD_REGISTRY:?}" "$$" "${FM_TEST_FIXTURE_ROOT:?}" "$@" || exit 97
+  FM_FIXTURE_DEADLINE=$((SECONDS + 15))
+}
+
+fm_fixture_waiting() {
+  local control=${1:-} mode=${2:-stop} parent
+  [ -d "$FM_TEST_FIXTURE_ROOT" ] || return 1
+  [ "$SECONDS" -lt "$FM_FIXTURE_DEADLINE" ] || return 1
+  [ -n "$control" ] || return 0
+  parent=${control%/*}
+  [ "$parent" != "$control" ] || parent=.
+  [ -d "$parent" ] || return 1
+  [ "$mode" != observe ] || return 0
+  [ ! -e "$control" ]
+}
+SH
 EXT="$ROOT/.pi/extensions/fm-primary-pi-watch.ts"
 # Node 24 warns when these test-only dynamic imports load tracked ESM plugins
 # from a clean checkout with no tracked .opencode/package.json. The warning is
@@ -84,7 +107,7 @@ test_pi_extension_reports_external_healthy_watcher() {
 printf 'watcher: healthy pid=1 (beacon 0s)\n'
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -162,7 +185,7 @@ test_pi_tool_returns_agent_tool_result() {
 exit 0
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -226,10 +249,12 @@ test_pi_redundant_tool_call_is_owned_noop() {
 printf 'arm\n' >> "${FM_ARM_LOG:?}"
 printf 'watcher: started pid=%s (beacon fresh)\n' "$$"
 trap 'exit 0' TERM INT
-while [ ! -e "$FM_STOP_FILE" ]; do sleep 0.02; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_STOP_FILE"
+while fm_fixture_waiting "$FM_STOP_FILE"; do sleep 0.02; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_STOP_FILE="$stop" node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_STOP_FILE="$stop" fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -289,7 +314,7 @@ printf 'arm\n' >> "${FM_ARM_LOG:?}"
 exit 0
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_WATCH_REARM_RETRY_BASE_MS=10000 FM_WATCH_REARM_RETRY_MAX_MS=10000 node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_WATCH_REARM_RETRY_BASE_MS=10000 FM_WATCH_REARM_RETRY_MAX_MS=10000 fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -356,10 +381,12 @@ if [ "$count" -eq 1 ]; then
 fi
 printf 'watcher: started pid=%s (beacon fresh) recovery-generation=fixture-generation\n' "$$"
 trap 'exit 0' TERM INT
-while [ ! -e "$FM_STOP_FILE" ]; do sleep 0.02; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_STOP_FILE"
+while fm_fixture_waiting "$FM_STOP_FILE"; do sleep 0.02; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_STOP_FILE="$stop" node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_STOP_FILE="$stop" fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -447,10 +474,12 @@ if [ "$count" -eq 1 ]; then
 fi
 printf 'watcher: started pid=%s (beacon fresh) recovery-generation=fixture-generation\n' "$$"
 trap 'exit 0' TERM INT
-while [ ! -e "$FM_STOP_FILE" ]; do sleep 0.02; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_STOP_FILE"
+while fm_fixture_waiting "$FM_STOP_FILE"; do sleep 0.02; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_STOP_FILE="$stop" node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_STOP_FILE="$stop" fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -559,13 +588,15 @@ if [ "$count" -eq 1 ]; then
 fi
 printf 'watcher: started pid=%s (beacon fresh) recovery-generation=fixture-generation\n' "$$"
 trap 'exit 0' TERM INT
-while [ ! -e "$FM_STOP_FILE" ]; do sleep 0.02; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_STOP_FILE"
+while fm_fixture_waiting "$FM_STOP_FILE"; do sleep 0.02; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
   # A bare heartbeat is the real wake emitted after the cheap bash scan flags
   # a fleet pass as possibly captain-relevant. It has no task-scoped queue row,
   # so branch eligibility must remain independent of project resolution.
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_STOP_FILE="$stop" node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_STOP_FILE="$stop" fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -641,10 +672,12 @@ if [ "$count" -eq 1 ]; then
 fi
 printf 'watcher: started pid=%s (beacon fresh) recovery-generation=fixture-generation\n' "$$"
 trap 'exit 0' TERM INT
-while [ ! -e "$FM_STOP_FILE" ]; do sleep 0.02; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_STOP_FILE"
+while fm_fixture_waiting "$FM_STOP_FILE"; do sleep 0.02; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_STOP_FILE="$stop" node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_STOP_FILE="$stop" fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -734,7 +767,9 @@ if [ "$count" -eq 1 ]; then
 fi
 printf 'watcher: started pid=%s (beacon fresh) recovery-generation=fixture-generation\n' "$$"
 trap 'exit 0' TERM INT
-while [ ! -e "$FM_STOP_FILE" ]; do sleep 0.02; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_STOP_FILE"
+while fm_fixture_waiting "$FM_STOP_FILE"; do sleep 0.02; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
   while IFS='|' read -r label reason; do
@@ -742,7 +777,7 @@ SH
     log="$TMP_ROOT/pi-main-only-check-$label.log"
     stop="$TMP_ROOT/pi-main-only-check-$label.stop"
     out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_STOP_FILE="$stop" \
-      FM_TEST_REASON="$reason" node --input-type=module 2>&1 <<'EOF'
+      FM_TEST_REASON="$reason" fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -830,7 +865,7 @@ printf 'synthetic successor startup failure\n' >&2
 exit 1
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -903,7 +938,7 @@ SH
   # (docs/pi-supervision-branch.md), and default-on eligibility must not
   # change that. A live, always-accepting bus listener proves the negative:
   # even with an acceptor present, a watcher-failure close is never offered.
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -980,10 +1015,12 @@ if [ "$count" -eq 1 ]; then
 fi
 printf 'watcher: started pid=%s (beacon fresh) recovery-generation=fixture-generation\n' "$$"
 trap 'exit 0' TERM INT
-while [ ! -e "$FM_STOP_FILE" ]; do sleep 0.02; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_STOP_FILE"
+while fm_fixture_waiting "$FM_STOP_FILE"; do sleep 0.02; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_STOP_FILE="$stop" node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_STOP_FILE="$stop" fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -1047,10 +1084,12 @@ if [ "$count" -eq 1 ]; then
   exit 0
 fi
 trap 'exit 0' TERM INT
-while :; do sleep 0.02; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init
+while fm_fixture_waiting; do sleep 0.02; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_PI_ARM_READY_TIMEOUT_MS="$ARM_READY_TIMEOUT_MS" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_PI_ARM_READY_TIMEOUT_MS="$ARM_READY_TIMEOUT_MS" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -1098,11 +1137,12 @@ EOF
 }
 
 test_pi_unretired_successor_falls_back_without_retry() {
-  local repo home plugin log release out status
+  local repo home plugin log release closed out status
   repo="$TMP_ROOT/pi-unretired-successor-root"
   home="$TMP_ROOT/pi-unretired-successor-home"
   log="$TMP_ROOT/pi-unretired-successor.log"
   release="$TMP_ROOT/pi-unretired-successor.release"
+  closed="$TMP_ROOT/pi-unretired-successor.closed"
   mkdir -p "$repo/bin" "$home/state" "$home/config"
   install_pi_watch_extension_fixture "$repo"
   plugin="$repo/.pi/extensions/fm-primary-pi-watch.ts"
@@ -1119,12 +1159,17 @@ if [ "$count" -eq 0 ]; then
   printf 'signal: synthetic wake\n'
   exit 0
 fi
-trap '' TERM INT
+fm_fixture_terms=0
+trap 'fm_fixture_terms=$((fm_fixture_terms + 1)); [ "$fm_fixture_terms" -eq 1 ] || exit 0' TERM
+trap 'exit 0' INT
+trap 'printf "closed\n" > "${FM_CLOSE_FILE:?}"' EXIT
 printf 'arm=%s\n' "$$" >> "${FM_ARM_LOG:?}"
-while [ ! -e "$FM_RELEASE_FILE" ]; do sleep 0.1; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_RELEASE_FILE"
+while fm_fixture_waiting "$FM_RELEASE_FILE"; do sleep 0.1; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_RELEASE_FILE="$release" FM_PI_ARM_READY_TIMEOUT_MS="$ARM_READY_TIMEOUT_MS" FM_WATCH_ARM_RETIRE_TIMEOUT_MS=20 FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_RELEASE_FILE="$release" FM_CLOSE_FILE="$closed" FM_TEST_INJECT_FILE="$TMP_ROOT/inject-unretired-failure" FM_PI_ARM_READY_TIMEOUT_MS="$ARM_READY_TIMEOUT_MS" FM_WATCH_ARM_RETIRE_TIMEOUT_MS=20 FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -1158,8 +1203,14 @@ if (rows.length !== 2) throw new Error(`unretired arm overlapped a retry: ${rows
 if (rowsAtPrompt !== 2) throw new Error(`wake arrived after an overlapping retry (${rowsAtPrompt} arm rows)`);
 if (!prompt.includes("signal: synthetic wake")) throw new Error(`original wake was lost: ${prompt}`);
 if (!prompt.includes("unready successor arm did not exit within 20ms")) throw new Error(`missing unretired-arm failure: ${prompt}`);
+if (existsSync(process.env.FM_TEST_INJECT_FILE)) {
+  throw new Error("injected failure after hostile unretired-successor assertions");
+}
 writeFileSync(process.env.FM_RELEASE_FILE, "release\n");
-await new Promise((resolve) => setTimeout(resolve, 80));
+for (let i = 0; i < 250 && !existsSync(process.env.FM_CLOSE_FILE); i += 1) {
+  await new Promise((resolve) => setTimeout(resolve, 20));
+}
+if (!existsSync(process.env.FM_CLOSE_FILE)) throw new Error("unretired successor did not acknowledge close");
 EOF
 )
   status=$?
@@ -1168,6 +1219,25 @@ EOF
   pass "Pi unretired successor falls back without an overlapping retry"
 }
 
+test_pi_unretired_successor_failure_cleanup() {
+  local registry root_report child_root out status
+  registry="$TMP_ROOT/pi-unretired-failure-registry"
+  root_report="$TMP_ROOT/pi-unretired-failure-root"
+  mkdir -p "$registry"
+  out=$(FM_TEST_OWNED_CHILD_REGISTRY="$registry" \
+    FM_TEST_ONLY_PI_UNRETIRED_SUCCESSOR=1 \
+    FM_TEST_INJECT_UNRETIRED_FAILURE=1 \
+    FM_TEST_TMP_ROOT_REPORT="$root_report" \
+    bash "$0" 2>&1)
+  status=$?
+  expect_code 1 "$status" "injected hostile fixture failure must fail its nested suite"
+  child_root=$(cat "$root_report")
+  [ ! -e "$child_root" ] || fail "injected hostile fixture failure left its temp root: $child_root"
+  bash "$FM_TEST_LIB" owned-children-assert-zero "$registry" \
+    || fail "injected hostile fixture failure left a registered process or group: $out"
+  pass "Pi hostile unretired successor is reaped on the failure path"
+}
+
 test_pi_late_unretired_close_resumes_supervision() {
   local kind repo home plugin log ready retired release stop out status
   for kind in actionable non-actionable; do
@@ -1193,16 +1263,20 @@ fi
 if [ "$count" -eq 2 ]; then
   trap 'printf "retired\\n" > "${FM_UNRETIRED_RETIRE_FILE:?}"' TERM INT
   printf 'ready\n' > "${FM_UNRETIRED_READY_FILE:?}"
-  while [ ! -e "$FM_RELEASE_FILE" ]; do sleep 0.02; done
+  . "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_RELEASE_FILE"
+while fm_fixture_waiting "$FM_RELEASE_FILE"; do sleep 0.02; done
   [ "$FM_LATE_KIND" = actionable ] && printf 'signal: late wake\n'
   exit 0
 fi
 printf 'watcher: started pid=%s (beacon fresh)\n' "$$"
 trap 'exit 0' TERM INT
-while [ ! -e "$FM_STOP_FILE" ]; do sleep 0.02; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_STOP_FILE"
+while fm_fixture_waiting "$FM_STOP_FILE"; do sleep 0.02; done
 SH
     chmod +x "$repo/bin/fm-watch-arm.sh"
-    out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_UNRETIRED_READY_FILE="$ready" FM_UNRETIRED_RETIRE_FILE="$retired" FM_RELEASE_FILE="$release" FM_STOP_FILE="$stop" FM_LATE_KIND="$kind" FM_PI_ARM_READY_TIMEOUT_MS="$ARM_READY_TIMEOUT_MS" FM_WATCH_ARM_RETIRE_TIMEOUT_MS=20 FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node --input-type=module 2>&1 <<'EOF'
+    out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_UNRETIRED_READY_FILE="$ready" FM_UNRETIRED_RETIRE_FILE="$retired" FM_RELEASE_FILE="$release" FM_STOP_FILE="$stop" FM_LATE_KIND="$kind" FM_PI_ARM_READY_TIMEOUT_MS="$ARM_READY_TIMEOUT_MS" FM_WATCH_ARM_RETIRE_TIMEOUT_MS=20 FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -1285,10 +1359,12 @@ count=$(wc -l < "$FM_ARM_LOG" | tr -d '[:space:]')
 if [ "$count" -eq 1 ]; then exit 0; fi
 printf 'watcher: started pid=%s (beacon fresh)\n' "$$"
 trap 'exit 0' TERM INT
-while [ ! -e "$FM_STOP_FILE" ]; do sleep 0.02; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_STOP_FILE"
+while fm_fixture_waiting "$FM_STOP_FILE"; do sleep 0.02; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_STOP_FILE="$stop" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_STOP_FILE="$stop" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -1343,7 +1419,7 @@ printf 'watcher: started pid=%s (beacon fresh)\n' "$$"
 exit 0
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -1391,12 +1467,14 @@ test_pi_actionable_close_rechecks_session_lock() {
   cat > "$repo/bin/fm-watch-arm.sh" <<'SH'
 #!/usr/bin/env bash
 printf 'arm=%s\n' "$$" >> "${FM_ARM_LOG:?}"
-while [ ! -e "$FM_RELEASE_FILE" ]; do sleep 0.02; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_RELEASE_FILE"
+while fm_fixture_waiting "$FM_RELEASE_FILE"; do sleep 0.02; done
 printf 'signal: lock handoff\n'
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_RELEASE_FILE="$release" node --input-type=module 2>&1 <<'EOF'
-import { spawn } from "node:child_process";
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_RELEASE_FILE="$release" fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
+import { spawn, spawnSync } from "node:child_process";
 import { readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -1418,6 +1496,14 @@ const mod = await import(pathToFileURL(process.env.PLUGIN).href);
 mod.default(pi);
 await tool.execute("tool-call-lock-close", {}, undefined, undefined, {});
 const other = spawn(process.execPath, ["-e", "setInterval(() => {}, 1000)"], { stdio: "ignore" });
+const registered = spawnSync("bash", [
+  process.env.FM_TEST_LIB,
+  "owned-child-register",
+  process.env.FM_TEST_OWNED_CHILD_REGISTRY,
+  String(other.pid),
+  process.env.FM_TEST_FIXTURE_ROOT,
+]);
+if (registered.status !== 0) throw new Error(`could not register lock-holder fixture pid ${other.pid}`);
 try {
   writeFileSync(lock, `${other.pid}\n`);
   writeFileSync(process.env.FM_RELEASE_FILE, "release\n");
@@ -1451,9 +1537,9 @@ test_pi_arm_distinguishes_session_lock_ownership() {
 printf 'arm\n' >> "${FM_ARM_LOG:?}"
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { existsSync, unlinkSync, writeFileSync } from "node:fs";
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
 
 let tool = null;
@@ -1490,6 +1576,14 @@ writeFileSync(lock, "999999\n");
 assertMissingLock(await callArm(), "dead lock holder");
 
 const other = spawn(process.execPath, ["-e", "setInterval(() => {}, 1000)"], { stdio: "ignore" });
+const registered = spawnSync("bash", [
+  process.env.FM_TEST_LIB,
+  "owned-child-register",
+  process.env.FM_TEST_OWNED_CHILD_REGISTRY,
+  String(other.pid),
+  process.env.FM_TEST_FIXTURE_ROOT,
+]);
+if (registered.status !== 0) throw new Error(`could not register lock-holder fixture pid ${other.pid}`);
 try {
   writeFileSync(lock, `${other.pid}\n`);
   const liveOther = await callArm();
@@ -1541,10 +1635,12 @@ printf 'watcher: started pid=%s\n' "$$"
 printf '%s\n' "$$" > "${FM_CHILD_PID_FILE:?}"
 printf '%s\n' "$marker" > "${FM_CHILD_MARKER_FILE:?}"
 printf 'arm pid=%s marker=%s\n' "$$" "$marker" >> "${FM_ARM_LOG:?}"
-while :; do sleep 0.2; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init
+while fm_fixture_waiting; do sleep 0.2; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_CHILD_PID_FILE="$child_pid_file" FM_CHILD_MARKER_FILE="$child_marker_file" FM_MARKER_ROOT="$marker_root" FM_ARM_LOG="$arm_log" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_CHILD_PID_FILE="$child_pid_file" FM_CHILD_MARKER_FILE="$child_marker_file" FM_MARKER_ROOT="$marker_root" FM_ARM_LOG="$arm_log" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -1737,7 +1833,9 @@ trap cleanup EXIT
 trap 'exit 0' TERM INT
 printf 'arm pid=%s marker=%s\n' "$$" "$marker" >> "${FM_ARM_LOG:?}"
 printf 'watcher: started pid=%s (beacon fresh) recovery-generation=replacement-fixture\n' "$$"
-while :; do
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_STOP_FILE"
+while fm_fixture_waiting "$FM_STOP_FILE"; do
   if [ -e "$FM_TRIGGER_FILE" ]; then
     outcome=$(cat "$FM_TRIGGER_FILE")
     rm -f "$FM_TRIGGER_FILE"
@@ -1751,7 +1849,7 @@ while :; do
 done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_MARKER_ROOT="$marker_root" FM_TRIGGER_FILE="$trigger" FM_STOP_FILE="$stop" node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_MARKER_ROOT="$marker_root" FM_TRIGGER_FILE="$trigger" FM_STOP_FILE="$stop" fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -1918,7 +2016,9 @@ test_pi_streaming_followup_is_replayed_after_replacement() {
 #!/usr/bin/env bash
 trap 'exit 0' TERM INT
 printf 'watcher: started pid=%s\n' "$$"
-while :; do
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_TRIGGER_FILE"
+while fm_fixture_waiting "$FM_TRIGGER_FILE" observe; do
   if [ -e "$FM_TRIGGER_FILE" ]; then
     rm -f "$FM_TRIGGER_FILE"
     printf 'signal: streaming queued actionable outcome\n'
@@ -1928,7 +2028,7 @@ while :; do
 done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_TRIGGER_FILE="$trigger" node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_TRIGGER_FILE="$trigger" fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -2037,12 +2137,14 @@ printf 'arm=%s\n' "$$" >> "${FM_ARM_LOG:?}"
 count=$(grep -c '^arm=' "$FM_ARM_LOG")
 printf 'watcher: started pid=%s (beacon fresh) recovery-generation=chain-%s\n' "$$" "$count"
 trap 'exit 0' TERM INT
-while [ ! -e "$FM_TRIGGER_FILE.$count" ]; do sleep 0.02; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_TRIGGER_FILE.$count"
+while fm_fixture_waiting "$FM_TRIGGER_FILE.$count"; do sleep 0.02; done
 printf 'signal: streaming chain wake %s\n' "$count"
 exit 0
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_TRIGGER_FILE="$trigger" node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_TRIGGER_FILE="$trigger" fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -2156,10 +2258,12 @@ if [ "$count" -eq 2 ]; then
   exit 3
 fi
 trap 'exit 0' TERM INT
-while [ ! -e "$FM_STOP_FILE" ]; do sleep 0.02; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_STOP_FILE"
+while fm_fixture_waiting "$FM_STOP_FILE"; do sleep 0.02; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_STOP_FILE="$stop" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_LOG="$log" FM_STOP_FILE="$stop" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -2246,10 +2350,12 @@ late_close() {
 }
 trap late_close TERM INT
 printf 'watcher: started pid=%s\n' "$$"
-while :; do sleep 0.02; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init
+while fm_fixture_waiting; do sleep 0.02; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_COUNT="$count" FM_WATCH_ARM_RETIRE_TIMEOUT_MS=20 node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_COUNT="$count" FM_WATCH_ARM_RETIRE_TIMEOUT_MS=20 fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -2351,10 +2457,12 @@ late_close() {
 }
 trap late_close TERM INT
 printf 'watcher: started pid=%s\n' "$$"
-while :; do sleep 0.02; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init
+while fm_fixture_waiting; do sleep 0.02; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_COUNT="$count" FM_WATCH_ARM_RETIRE_TIMEOUT_MS=10 node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_COUNT="$count" FM_WATCH_ARM_RETIRE_TIMEOUT_MS=10 fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -2443,10 +2551,12 @@ trap cleanup EXIT
 trap 'exit 0' TERM INT
 printf '%s\n' "$$" > "$FM_CHILD_MARKER"
 printf 'watcher: started pid=%s\n' "$$"
-while :; do sleep 0.02; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init
+while fm_fixture_waiting; do sleep 0.02; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_COUNT="$count" FM_CHILD_MARKER="$marker" node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_ARM_COUNT="$count" FM_CHILD_MARKER="$marker" fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { existsSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -2523,7 +2633,7 @@ test_pi_process_exit_cleanup_listener_lifecycle() {
   plugin="$repo/.pi/extensions/fm-primary-pi-watch.ts"
   : > "$repo/bin/fm-watch-arm.sh"
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { pathToFileURL } from "node:url";
 
 const handlers = new Map();
@@ -2570,10 +2680,12 @@ test_pi_process_exit_cleanup_stops_arm_child() {
 #!/usr/bin/env bash
 trap 'printf "%s\n" "$$" >> "$FM_CLEANUP_LOG"; exit 0' TERM
 printf '%s\n' "$$" > "$FM_CHILD_PID_FILE"
-while :; do sleep 1; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init
+while fm_fixture_waiting; do sleep 1; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_CLEANUP_LOG="$cleanup_log" FM_CHILD_PID_FILE="$pid_file" node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" FM_HOME="$home" FM_ROOT_OVERRIDE="$repo" FM_CLEANUP_LOG="$cleanup_log" FM_CHILD_PID_FILE="$pid_file" fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -2638,7 +2750,7 @@ test_opencode_plugin_package_boundary_is_explicit_esm() {
   cp "$ROOT/.opencode/plugins/package.json" "$fixture/plugins/package.json"
   cp "$ROOT/.opencode/plugins/fm-primary-watch-arm.js" "$plugin"
   cp "$ROOT/.opencode/plugins/lib/fm-operational-input.js" "$fixture/plugins/lib/fm-operational-input.js"
-  out=$(PLUGIN="$plugin" node --input-type=module 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" fm_test_in_owned_process_group node --input-type=module 2>&1 <<'EOF'
 import { pathToFileURL } from "node:url";
 await import(pathToFileURL(process.env.PLUGIN).href);
 EOF
@@ -2665,7 +2777,7 @@ printf 'home=%s root=%s\n' "${FM_HOME:-}" "${FM_ROOT_OVERRIDE:-}" >> "${FM_ARM_L
 printf 'watcher: healthy pid=1 (beacon 0s)\n'
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" node 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" fm_test_in_owned_process_group node 2>&1 <<'EOF'
 import { existsSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -2715,7 +2827,7 @@ printf 'poll=%s\n' "${FM_POLL:-missing}" >> "${FM_ARM_LOG:?}"
 printf 'watcher: healthy pid=1 (beacon 0s)\n'
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" node 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" fm_test_in_owned_process_group node 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -2764,7 +2876,7 @@ printf 'arm\n' >> "${FM_ARM_LOG:?}"
 printf 'watcher: healthy pid=1 (beacon 0s)\n'
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" node 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" fm_test_in_owned_process_group node 2>&1 <<'EOF'
 import { existsSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -2826,7 +2938,7 @@ printf 'arm\n' >> "${FM_ARM_LOG:?}"
 printf 'watcher: healthy pid=1 (beacon 0s)\n'
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" node 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" fm_test_in_owned_process_group node 2>&1 <<'EOF'
 import { existsSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -2882,10 +2994,12 @@ if [ "$count" -eq 1 ]; then
 fi
 printf 'watcher: started pid=%s (beacon fresh) recovery-generation=fixture-generation\n' "$$"
 trap 'exit 0' TERM INT
-while [ ! -e "$FM_STOP_FILE" ]; do sleep 0.02; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_STOP_FILE"
+while fm_fixture_waiting "$FM_STOP_FILE"; do sleep 0.02; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_STOP_FILE="$stop" node 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_STOP_FILE="$stop" fm_test_in_owned_process_group node 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -2974,15 +3088,19 @@ fi
 if [ "$count" -eq 2 ]; then
   printf 'signal: pre-ready successor wake\n'
   trap 'printf "retired\\n" > "${FM_PRE_READY_RETIRED_FILE:?}"; exit 0' TERM INT
-  while [ ! -e "$FM_PRE_READY_RELEASE_FILE" ]; do sleep 0.02; done
+  . "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_PRE_READY_RELEASE_FILE"
+while fm_fixture_waiting "$FM_PRE_READY_RELEASE_FILE"; do sleep 0.02; done
   exit 0
 fi
 printf 'watcher: started pid=%s (beacon fresh)\n' "$$"
 trap 'exit 0' TERM INT
-while [ ! -e "$FM_STOP_FILE" ]; do sleep 0.02; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_STOP_FILE"
+while fm_fixture_waiting "$FM_STOP_FILE"; do sleep 0.02; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_PRE_READY_RELEASE_FILE="$release" FM_PRE_READY_RETIRED_FILE="$retired" FM_STOP_FILE="$stop" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_PRE_READY_RELEASE_FILE="$release" FM_PRE_READY_RETIRED_FILE="$retired" FM_STOP_FILE="$stop" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 fm_test_in_owned_process_group node 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -3052,10 +3170,12 @@ if [ "$count" -eq 1 ]; then
   exit 0
 fi
 trap 'exit 0' TERM INT
-while :; do sleep 0.02; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init
+while fm_fixture_waiting; do sleep 0.02; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_OPENCODE_ARM_READY_TIMEOUT_MS="$ARM_READY_TIMEOUT_MS" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_OPENCODE_ARM_READY_TIMEOUT_MS="$ARM_READY_TIMEOUT_MS" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 fm_test_in_owned_process_group node 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -3103,12 +3223,13 @@ EOF
 }
 
 test_opencode_unretired_successor_falls_back_without_retry() {
-  local plugin repo home log release out status
+  local plugin repo home log release closed out status
   plugin="$ROOT/.opencode/plugins/fm-primary-watch-arm.js"
   repo="$TMP_ROOT/opencode-unretired-successor-root"
   home="$TMP_ROOT/opencode-unretired-successor-home"
   log="$TMP_ROOT/opencode-unretired-successor.log"
   release="$TMP_ROOT/opencode-unretired-successor.release"
+  closed="$TMP_ROOT/opencode-unretired-successor.closed"
   mkdir -p "$repo/bin" "$home/state" "$home/config"
   git init -q "$repo"
   : > "$repo/AGENTS.md"
@@ -3126,12 +3247,17 @@ if [ "$count" -eq 0 ]; then
   printf 'signal: synthetic wake\n'
   exit 0
 fi
-trap '' TERM INT
+fm_fixture_terms=0
+trap 'fm_fixture_terms=$((fm_fixture_terms + 1)); [ "$fm_fixture_terms" -eq 1 ] || exit 0' TERM
+trap 'exit 0' INT
+trap 'printf "closed\n" > "${FM_CLOSE_FILE:?}"' EXIT
 printf 'arm=%s\n' "$$" >> "${FM_ARM_LOG:?}"
-while [ ! -e "$FM_RELEASE_FILE" ]; do sleep 0.1; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_RELEASE_FILE"
+while fm_fixture_waiting "$FM_RELEASE_FILE"; do sleep 0.1; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_RELEASE_FILE="$release" FM_OPENCODE_ARM_READY_TIMEOUT_MS="$ARM_READY_TIMEOUT_MS" FM_WATCH_ARM_RETIRE_TIMEOUT_MS=20 FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_RELEASE_FILE="$release" FM_CLOSE_FILE="$closed" FM_OPENCODE_ARM_READY_TIMEOUT_MS="$ARM_READY_TIMEOUT_MS" FM_WATCH_ARM_RETIRE_TIMEOUT_MS=20 FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 fm_test_in_owned_process_group node 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -3166,7 +3292,10 @@ if (rowsAtPrompt !== 2) throw new Error(`wake arrived after an overlapping retry
 if (!prompt.includes("signal: synthetic wake")) throw new Error(`original wake was lost: ${prompt}`);
 if (!prompt.includes("unready successor arm did not exit within 20ms")) throw new Error(`missing unretired-arm failure: ${prompt}`);
 writeFileSync(process.env.FM_RELEASE_FILE, "release\n");
-await new Promise((resolve) => setTimeout(resolve, 80));
+for (let i = 0; i < 250 && !existsSync(process.env.FM_CLOSE_FILE); i += 1) {
+  await new Promise((resolve) => setTimeout(resolve, 20));
+}
+if (!existsSync(process.env.FM_CLOSE_FILE)) throw new Error("unretired successor did not acknowledge close");
 EOF
 )
   status=$?
@@ -3202,16 +3331,20 @@ fi
 if [ "$count" -eq 2 ]; then
   trap 'printf "retired\\n" > "${FM_UNRETIRED_RETIRE_FILE:?}"' TERM INT
   printf 'ready\n' > "${FM_UNRETIRED_READY_FILE:?}"
-  while [ ! -e "$FM_RELEASE_FILE" ]; do sleep 0.02; done
+  . "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_RELEASE_FILE"
+while fm_fixture_waiting "$FM_RELEASE_FILE"; do sleep 0.02; done
   [ "$FM_LATE_KIND" = actionable ] && printf 'signal: late wake\n'
   exit 0
 fi
 printf 'watcher: started pid=%s (beacon fresh)\n' "$$"
 trap 'exit 0' TERM INT
-while [ ! -e "$FM_STOP_FILE" ]; do sleep 0.02; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_STOP_FILE"
+while fm_fixture_waiting "$FM_STOP_FILE"; do sleep 0.02; done
 SH
     chmod +x "$repo/bin/fm-watch-arm.sh"
-    out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_UNRETIRED_READY_FILE="$ready" FM_UNRETIRED_RETIRE_FILE="$retired" FM_RELEASE_FILE="$release" FM_STOP_FILE="$stop" FM_LATE_KIND="$kind" FM_OPENCODE_ARM_READY_TIMEOUT_MS="$ARM_READY_TIMEOUT_MS" FM_WATCH_ARM_RETIRE_TIMEOUT_MS=20 FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node 2>&1 <<'EOF'
+    out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_UNRETIRED_READY_FILE="$ready" FM_UNRETIRED_RETIRE_FILE="$retired" FM_RELEASE_FILE="$release" FM_STOP_FILE="$stop" FM_LATE_KIND="$kind" FM_OPENCODE_ARM_READY_TIMEOUT_MS="$ARM_READY_TIMEOUT_MS" FM_WATCH_ARM_RETIRE_TIMEOUT_MS=20 FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 fm_test_in_owned_process_group node 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -3292,10 +3425,12 @@ count=$(wc -l < "$FM_ARM_LOG" | tr -d '[:space:]')
 if [ "$count" -eq 1 ]; then exit 0; fi
 printf 'watcher: started pid=%s (beacon fresh)\n' "$$"
 trap 'exit 0' TERM INT
-while [ ! -e "$FM_STOP_FILE" ]; do sleep 0.02; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_STOP_FILE"
+while fm_fixture_waiting "$FM_STOP_FILE"; do sleep 0.02; done
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_STOP_FILE="$stop" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_STOP_FILE="$stop" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 fm_test_in_owned_process_group node 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -3351,7 +3486,7 @@ printf 'watcher: started pid=%s (beacon fresh)\n' "$$"
 exit 0
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 node 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_WATCH_REARM_RETRY_BASE_MS=5 FM_WATCH_REARM_RETRY_MAX_MS=10 FM_WATCH_REARM_RETRY_LIMIT=2 fm_test_in_owned_process_group node 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -3401,11 +3536,13 @@ test_opencode_actionable_close_rechecks_session_lock() {
   cat > "$repo/bin/fm-watch-arm.sh" <<'SH'
 #!/usr/bin/env bash
 printf 'arm=%s\n' "$$" >> "${FM_ARM_LOG:?}"
-while [ ! -e "$FM_RELEASE_FILE" ]; do sleep 0.02; done
+. "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
+fm_fixture_init "$FM_RELEASE_FILE"
+while fm_fixture_waiting "$FM_RELEASE_FILE"; do sleep 0.02; done
 printf 'signal: lock handoff\n'
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
-  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_RELEASE_FILE="$release" node 2>&1 <<'EOF'
+  out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_RELEASE_FILE="$release" fm_test_in_owned_process_group node 2>&1 <<'EOF'
 import { spawn } from "node:child_process";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
@@ -3476,7 +3613,7 @@ printf 'guard should not run\n' >&2
 exit 2
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh" "$repo/bin/fm-turnend-guard.sh"
-  out=$(ARM_PLUGIN="$arm_plugin" GUARD_PLUGIN="$guard_plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_GUARD_LOG="$guard_log" node 2>&1 <<'EOF'
+  out=$(ARM_PLUGIN="$arm_plugin" GUARD_PLUGIN="$guard_plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_GUARD_LOG="$guard_log" fm_test_in_owned_process_group node 2>&1 <<'EOF'
 import { existsSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -3549,7 +3686,7 @@ printf 'guard ran after external healthy watcher\n' >&2
 exit 2
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh" "$repo/bin/fm-turnend-guard.sh"
-  out=$(ARM_PLUGIN="$arm_plugin" GUARD_PLUGIN="$guard_plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_GUARD_LOG="$guard_log" node 2>&1 <<'EOF'
+  out=$(ARM_PLUGIN="$arm_plugin" GUARD_PLUGIN="$guard_plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_GUARD_LOG="$guard_log" fm_test_in_owned_process_group node 2>&1 <<'EOF'
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -3602,6 +3739,11 @@ EOF
   pass "OpenCode healthy arm output does not suppress the turn-end guard"
 }
 
+if [ "${FM_TEST_ONLY_PI_UNRETIRED_SUCCESSOR:-0}" = 1 ]; then
+  test_pi_unretired_successor_falls_back_without_retry
+  exit 0
+fi
+
 test_pi_extension_reports_external_healthy_watcher
 test_pi_tool_returns_agent_tool_result
 test_pi_redundant_tool_call_is_owned_noop
@@ -3616,6 +3758,7 @@ test_pi_watcher_failure_never_offered_to_branch
 test_pi_handling_delivery_failure_is_typed_once
 test_pi_hung_successor_falls_back_to_typed_wake
 test_pi_unretired_successor_falls_back_without_retry
+test_pi_unretired_successor_failure_cleanup
 test_pi_late_unretired_close_resumes_supervision
 test_pi_empty_close_retries_instead_of_disappearing
 test_pi_established_empty_close_honors_retry_limit
diff --git a/tests/fm-test-run.test.sh b/tests/fm-test-run.test.sh
index 38bb7b5efc9..5777664d70f 100755
--- a/tests/fm-test-run.test.sh
+++ b/tests/fm-test-run.test.sh
@@ -1098,6 +1098,75 @@ SH
   pass "--per-script-timeout-secs turns a hung script into a bounded failure"
 }
 
+test_runner_reaps_registered_fixture_groups_after_failure_and_timeout() {
+  local tmp repo runner fixture mode rc pid pgid expected_exit
+  tmp=$(mktemp -d "${TMPDIR:-/tmp}/fm-test-run-owned-child.XXXXXX")
+  repo="$tmp/repo"
+  runner="$repo/bin/fm-test-run.sh"
+  fixture=tests/fm-owned-child-fixture.test.sh
+  mkdir -p "$repo/bin" "$repo/tests"
+  cp "$RUNNER" "$runner"
+  cp "$ROOT/bin/fm-timeout-lib.sh" "$ROOT/bin/fm-wake-lib.sh" "$repo/bin/"
+  cp "$ROOT/tests/lib.sh" "$repo/tests/lib.sh"
+  cat > "$repo/$fixture" <<'SH'
+#!/usr/bin/env bash
+set -u
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+root=$(fm_test_tmproot fm-owned-child-fixture)
+stop="$root/stop"
+cat > "$root/child.sh" <<'CHILD'
+#!/usr/bin/env bash
+set -u
+controls=()
+[ "$FM_FIXTURE_MODE" != fail ] || controls+=("$FM_STOP_FILE")
+bash "$FM_TEST_LIB" owned-child-register \
+  "$FM_TEST_OWNED_CHILD_REGISTRY" "$$" "$FM_TEST_FIXTURE_ROOT" "${controls[@]+"${controls[@]}"}" || exit 97
+pgid=$(ps -o pgid= -p "$$" | tr -d '[:space:]')
+printf '%s %s\n' "$$" "$pgid" > "$FM_PID_REPORT"
+terms=0
+trap 'terms=$((terms + 1)); [ "$terms" -eq 1 ] || exit 0' TERM
+trap 'exit 0' INT
+deadline=$((SECONDS + 15))
+while [ -d "$FM_TEST_FIXTURE_ROOT" ] && [ "$SECONDS" -lt "$deadline" ]; do
+  [ "$FM_FIXTURE_MODE" != fail ] || [ ! -e "$FM_STOP_FILE" ] || exit 0
+  sleep 0.1
+done
+CHILD
+chmod +x "$root/child.sh"
+FM_TEST_FIXTURE_ROOT="$root" FM_STOP_FILE="$stop" \
+  fm_test_in_owned_process_group "$root/child.sh" >/dev/null 2>&1 &
+for _ in 1 2 3 4 5 6 7 8 9 10; do
+  [ -s "$FM_PID_REPORT" ] && break
+  sleep 0.05
+done
+[ -s "$FM_PID_REPORT" ] || exit 2
+trap - EXIT INT TERM
+[ "$FM_FIXTURE_MODE" != fail ] || exit 1
+sleep 600
+SH
+  chmod +x "$runner" "$repo/$fixture"
+
+  for mode in fail timeout; do
+    set +e
+    FM_FIXTURE_MODE="$mode" FM_PID_REPORT="$tmp/$mode.pid" \
+      "$runner" --per-script-timeout-secs 2 "$fixture" >"$tmp/$mode.out" 2>"$tmp/$mode.err"
+    rc=$?
+    set -e
+    [ "$rc" -eq 1 ] || fail "$mode fixture run returned $rc instead of a bounded failure"
+    read -r pid pgid < "$tmp/$mode.pid"
+    ! kill -0 "$pid" 2>/dev/null || fail "$mode fixture left registered pid $pid alive"
+    ! kill -0 -- "-$pgid" 2>/dev/null || fail "$mode fixture left registered process group $pgid alive"
+    if [ "$mode" = fail ]; then expected_exit=1; else expected_exit=124; fi
+    grep -Eq "FM_TEST_END .* exit=$expected_exit " "$tmp/$mode.out" \
+      || fail "$mode fixture did not preserve its expected test result: $(cat "$tmp/$mode.out")"
+    ! grep -Fq 'left a registered fixture process' "$tmp/$mode.out" \
+      || fail "$mode fixture failed the outer zero-live assertion: $(cat "$tmp/$mode.out")"
+  done
+
+  rm -rf "$tmp"
+  pass "the outer runner reaps registered fixture groups after failed and timed-out files"
+}
+
 # The duration regression this guard exists for: a suite whose scripts are all
 # green but whose wall clock outgrew its caller's invocation budget. The caller
 # gets killed mid-run and retries invisibly, so an over-budget run has to be a
@@ -1395,6 +1464,7 @@ test_jobs_admits_a_concurrent_safe_family
 test_unmapped_new_test_never_inherits_family_concurrency
 test_concurrent_runs_are_ordered_longest_first
 test_per_script_timeout_bounds_a_hang
+test_runner_reaps_registered_fixture_groups_after_failure_and_timeout
 test_max_wall_ms_is_a_result_not_advice
 test_jobs_parallel_scheduler_and_failure_propagation
 test_herdr_ci_family_run_has_a_step_timeout
diff --git a/tests/lib.sh b/tests/lib.sh
index 11ee73513ff..1884c11546c 100644
--- a/tests/lib.sh
+++ b/tests/lib.sh
@@ -48,6 +48,183 @@ export FM_TELEMETRY_FSEVENTSD_DISABLE=1
 # shellcheck disable=SC2034
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 
+fm_test_pid_identity() {
+  local pid=$1
+  FM_STATE_OVERRIDE="${TMPDIR:-/tmp}" bash -c \
+    '. "$1"; fm_pid_identity "$2"' _ "$ROOT/bin/fm-wake-lib.sh" "$pid"
+}
+
+# --- owned fixture processes -----------------------------------------------
+#
+# A long-lived fixture process registers one durable record through
+# `bash tests/lib.sh owned-child-register ...`. The test runner supplies the
+# registry directory when it owns the outer execution boundary; direct test
+# invocations get a private registry below. Records carry enough identity to
+# release and, if necessary, terminate only the exact process group a fixture
+# created. Never substitute pathname or command-line discovery here.
+
+fm_test_process_pgid() {
+  local pid=$1 pgid
+  pgid=$(LC_ALL=C ps -o pgid= -p "$pid" 2>/dev/null) || return 1
+  pgid=$(printf '%s' "$pgid" | tr -d '[:space:]')
+  case "$pgid" in ''|*[!0-9]*|0|1) return 1 ;; esac
+  printf '%s\n' "$pgid"
+}
+
+fm_test_owned_group_live() {
+  kill -0 -- "-$1" 2>/dev/null
+}
+
+fm_test_owned_child_register() { # <registry> <pid> <root> [release-or-stop-control...]
+  local registry=$1 pid=$2 root=$3 pgid identity record tmp control
+  shift 3
+  case "$pid" in ''|*[!0-9]*) return 1 ;; esac
+  [ -d "$registry" ] || return 1
+  [ -d "$root" ] || return 1
+  root=$(cd -P -- "$root" && pwd -P) || return 1
+  pgid=$(fm_test_process_pgid "$pid") || return 1
+  identity=$(fm_test_pid_identity "$pid") || return 1
+  record="$registry/child.$pid"
+  tmp="$registry/.child.$pid.$$"
+  umask 077
+  {
+    printf '%s\n' "$pid" "$pgid" "$root" "$identity"
+    for control in "$@"; do
+      [ -n "$control" ] && printf '%s\n' "$control"
+    done
+  } > "$tmp" || return 1
+  mv "$tmp" "$record"
+}
+
+fm_test_owned_group_wait_closed() { # <pgid> <iterations>
+  local pgid=$1 iterations=$2 i=0
+  while fm_test_owned_group_live "$pgid" && [ "$i" -lt "$iterations" ]; do
+    sleep 0.02
+    i=$((i + 1))
+  done
+  ! fm_test_owned_group_live "$pgid"
+}
+
+fm_test_owned_child_cleanup_record() { # <record>
+  local record=$1 pid pgid root identity current current_pgid own_pgid control parent peer peer_pid peer_pgid peer_identity peer_current
+  pid=$(sed -n '1p' "$record" 2>/dev/null) || return 1
+  pgid=$(sed -n '2p' "$record" 2>/dev/null) || return 1
+  root=$(sed -n '3p' "$record" 2>/dev/null) || return 1
+  identity=$(sed -n '4p' "$record" 2>/dev/null) || return 1
+  case "$pid:$pgid" in *[!0-9:]*) return 1 ;; esac
+  [ -n "$identity" ] || return 1
+
+  if [ -d "$root" ]; then
+    while IFS= read -r control; do
+      [ -n "$control" ] || continue
+      parent=${control%/*}
+      [ "$parent" != "$control" ] || parent=.
+      [ -d "$parent" ] && : > "$control"
+    done < <(sed -n '5,$p' "$record" 2>/dev/null)
+  fi
+
+  if fm_test_owned_group_wait_closed "$pgid" 150; then
+    rm -f "$record"
+    return 0
+  fi
+
+  current=$(fm_test_pid_identity "$pid" 2>/dev/null) || current=
+  current_pgid=$(fm_test_process_pgid "$pid" 2>/dev/null) || current_pgid=
+  if [ -z "$current" ] && fm_test_owned_group_live "$pgid"; then
+    for peer in "${record%/*}"/child.*; do
+      [ "$peer" != "$record" ] || continue
+      [ -f "$peer" ] || continue
+      peer_pid=$(sed -n '1p' "$peer" 2>/dev/null) || continue
+      peer_pgid=$(sed -n '2p' "$peer" 2>/dev/null) || continue
+      [ "$peer_pgid" = "$pgid" ] || continue
+      peer_identity=$(sed -n '4p' "$peer" 2>/dev/null) || continue
+      peer_current=$(fm_test_pid_identity "$peer_pid" 2>/dev/null) || continue
+      if [ "$peer_current" = "$peer_identity" ]; then
+        rm -f "$record"
+        return 0
+      fi
+    done
+  fi
+  own_pgid=$(fm_test_process_pgid "$$" 2>/dev/null) || own_pgid=
+  if [ "$current" != "$identity" ] || [ "$current_pgid" != "$pgid" ] || [ "$pgid" = "$own_pgid" ]; then
+    printf 'fm-test: refusing ambiguous owned fixture group pid=%s pgid=%s root=%s\n' \
+      "$pid" "$pgid" "$root" >&2
+    return 1
+  fi
+
+  kill -TERM -- "-$pgid" 2>/dev/null || true
+  if fm_test_owned_group_wait_closed "$pgid" 50; then
+    rm -f "$record"
+    return 0
+  fi
+
+  # The identity and membership above authorize this one bounded teardown
+  # transaction. Escalation stays scoped to that already-proven group.
+  kill -KILL -- "-$pgid" 2>/dev/null || true
+  if fm_test_owned_group_wait_closed "$pgid" 50; then
+    rm -f "$record"
+    return 0
+  fi
+  printf 'fm-test: owned fixture group survived KILL pid=%s pgid=%s root=%s\n' \
+    "$pid" "$pgid" "$root" >&2
+  return 1
+}
+
+fm_test_owned_children_cleanup() { # <registry> [root]
+  local registry=$1 only_root=${2:-} record root failed=0
+  [ -d "$registry" ] || return 0
+  for record in "$registry"/child.*; do
+    [ -f "$record" ] || continue
+    root=$(sed -n '3p' "$record" 2>/dev/null) || root=
+    [ -z "$only_root" ] || [ "$root" = "$only_root" ] || continue
+    fm_test_owned_child_cleanup_record "$record" || failed=1
+  done
+  [ "$failed" -eq 0 ]
+}
+
+fm_test_owned_children_assert_zero() { # <registry>
+  local registry=$1 record pid pgid
+  [ -d "$registry" ] || return 0
+  for record in "$registry"/child.*; do
+    [ -f "$record" ] || continue
+    pid=$(sed -n '1p' "$record" 2>/dev/null) || pid=unknown
+    pgid=$(sed -n '2p' "$record" 2>/dev/null) || pgid=unknown
+    printf 'fm-test: registered fixture process remains pid=%s pgid=%s\n' "$pid" "$pgid" >&2
+    return 1
+  done
+  return 0
+}
+
+fm_test_in_owned_process_group() {
+  perl -MPOSIX -e '
+    POSIX::setsid() >= 0 or die "setsid failed: $!\n";
+    exec {$ARGV[0]} @ARGV or die "exec $ARGV[0] failed: $!\n";
+  ' "$@"
+}
+
+if [ "${BASH_SOURCE[0]}" = "$0" ]; then
+  command=${1:-}
+  shift || true
+  case "$command" in
+    owned-child-register)
+      fm_test_owned_child_register "$@"
+      exit $?
+      ;;
+    owned-children-cleanup)
+      fm_test_owned_children_cleanup "$@" && fm_test_owned_children_assert_zero "$@"
+      exit $?
+      ;;
+    owned-children-assert-zero)
+      fm_test_owned_children_assert_zero "$@"
+      exit $?
+      ;;
+    *)
+      printf 'usage: bash tests/lib.sh owned-child-register|owned-children-cleanup|owned-children-assert-zero ...\n' >&2
+      exit 2
+      ;;
+  esac
+fi
+
 # --- reporters --------------------------------------------------------------
 
 fail() {
@@ -79,12 +256,13 @@ pass() {
 
 FM_TEST_CLEANUP_DIRS=()
 FM_TEST_CLEANUP_REGISTRY=$(mktemp "${TMPDIR:-/tmp}/.fm-test-cleanup.$$.XXXXXX") || return 1
-
-fm_test_pid_identity() {
-  local pid=$1
-  FM_STATE_OVERRIDE="${TMPDIR:-/tmp}" bash -c \
-    '. "$1"; fm_pid_identity "$2"' _ "$ROOT/bin/fm-wake-lib.sh" "$pid"
-}
+FM_TEST_OWNED_CHILD_REGISTRY_OWNED=0
+if [ -z "${FM_TEST_OWNED_CHILD_REGISTRY:-}" ]; then
+  FM_TEST_OWNED_CHILD_REGISTRY=$(mktemp -d "${TMPDIR:-/tmp}/.fm-test-owned.$$.XXXXXX") || return 1
+  FM_TEST_OWNED_CHILD_REGISTRY_OWNED=1
+fi
+export FM_TEST_OWNED_CHILD_REGISTRY
+export FM_TEST_LIB="$ROOT/tests/lib.sh"
 
 FM_TEST_OWNER_IDENTITY=$(fm_test_pid_identity "$$") || {
   rm -f "$FM_TEST_CLEANUP_REGISTRY"
@@ -92,16 +270,32 @@ FM_TEST_OWNER_IDENTITY=$(fm_test_pid_identity "$$") || {
 }
 
 fm_test_cleanup() {
-  local d
+  local d failed=0
   for d in "${FM_TEST_CLEANUP_DIRS[@]:-}"; do
-    [ -n "$d" ] && rm -rf "$d"
+    [ -n "$d" ] || continue
+    if fm_test_owned_children_cleanup "$FM_TEST_OWNED_CHILD_REGISTRY" "$d"; then
+      rm -rf "$d"
+    else
+      failed=1
+    fi
   done
   if [ -f "$FM_TEST_CLEANUP_REGISTRY" ]; then
     while IFS= read -r d; do
-      [ -n "$d" ] && rm -rf "$d"
+      [ -n "$d" ] || continue
+      if fm_test_owned_children_cleanup "$FM_TEST_OWNED_CHILD_REGISTRY" "$d"; then
+        rm -rf "$d"
+      else
+        failed=1
+      fi
     done < "$FM_TEST_CLEANUP_REGISTRY"
     rm -f "$FM_TEST_CLEANUP_REGISTRY"
   fi
+  fm_test_owned_children_assert_zero "$FM_TEST_OWNED_CHILD_REGISTRY" || failed=1
+  if [ "$FM_TEST_OWNED_CHILD_REGISTRY_OWNED" -eq 1 ] && [ "$failed" -eq 0 ] \
+    && [ -d "$FM_TEST_OWNED_CHILD_REGISTRY" ]; then
+    rmdir "$FM_TEST_OWNED_CHILD_REGISTRY" 2>/dev/null || failed=1
+  fi
+  [ "$failed" -eq 0 ]
 }
 
 fm_test_tmproot() {
@@ -118,7 +312,14 @@ fm_test_tmproot() {
   printf '%s\n' "$root"
 }
 
-trap fm_test_cleanup EXIT
+fm_test_cleanup_on_exit() {
+  local status=$?
+  trap - EXIT
+  fm_test_cleanup || status=1
+  exit "$status"
+}
+
+trap fm_test_cleanup_on_exit EXIT
 trap 'fm_test_cleanup; exit 130' INT
 trap 'fm_test_cleanup; exit 143' TERM
 

From c903f3b53a3ec486e3e27fee808ca01dd5acd6b3 Mon Sep 17 00:00:00 2001
From: Ivan Li <ivan@withally.com>
Date: Tue, 8 Sep 2026 10:45:16 +0800
Subject: [PATCH 2/3] no-mistakes(review): Captain: harden fixture cleanup
 ownership and regression coverage

---
 bin/fm-test-run.sh                  |  14 ++-
 tests/fm-pi-watch-extension.test.sh | 141 +++++++++++++++++++++++-----
 tests/fm-test-run.test.sh           |  22 +++--
 tests/lib.sh                        |  50 ++++++++--
 4 files changed, 184 insertions(+), 43 deletions(-)

diff --git a/bin/fm-test-run.sh b/bin/fm-test-run.sh
index b3d520d1634..c9a09e6a1b2 100755
--- a/bin/fm-test-run.sh
+++ b/bin/fm-test-run.sh
@@ -1997,12 +1997,19 @@ declare -a WORKER_SCRIPTS=()
 # Invoked indirectly by the EXIT trap below.
 # shellcheck disable=SC2329
 cleanup_run() {
+  if [ "$RUN_CLEANUP_FAILED" -eq 1 ] ||
+    compgen -G "$RUN_TMP/cleanup-failed.*" >/dev/null 2>&1 ||
+    compgen -G "$RUN_TMP/owned.*/child.*" >/dev/null 2>&1; then
+    log "preserving owned-child cleanup evidence at $RUN_TMP"
+    return 0
+  fi
   rm -rf "$RUN_TMP"
 }
 
 trap cleanup_run EXIT
 
 RUN_ID="fm-test-run-${RUN_STARTED_MS}-$$"
+RUN_CLEANUP_FAILED=0
 TOTAL=0
 FAILED=0
 SKIPPED_GATE=0
@@ -2081,7 +2088,10 @@ record_script_result() {
 run_script_bounded() {  # <script> <out> <stream> <id>
   local script=$1 out=$2 stream=$3 id=$4
   local rc cleanup_rc registry="$RUN_TMP/owned.$id"
-  mkdir -p "$registry"
+  if ! mkdir -p "$registry"; then
+    printf 'not ok - %s could not create its owned-child registry\n' "$script" >>"$out"
+    return 1
+  fi
   set +e
   if [ "$stream" -eq 1 ]; then
     if [ "$PER_SCRIPT_TIMEOUT_SECS" -gt 0 ]; then
@@ -2118,6 +2128,8 @@ run_script_bounded() {  # <script> <out> <stream> <id>
     cleanup_rc=0
   fi
   if [ "$cleanup_rc" -ne 0 ]; then
+    RUN_CLEANUP_FAILED=1
+    : > "$RUN_TMP/cleanup-failed.$id"
     printf 'not ok - %s left a registered fixture process or process group alive\n' "$script" >>"$out"
     [ "$stream" -eq 1 ] && tail -1 "$out"
     [ "$rc" -ne 0 ] || rc=1
diff --git a/tests/fm-pi-watch-extension.test.sh b/tests/fm-pi-watch-extension.test.sh
index 6e4aaf62551..d136abbeecf 100755
--- a/tests/fm-pi-watch-extension.test.sh
+++ b/tests/fm-pi-watch-extension.test.sh
@@ -12,6 +12,13 @@ export FM_TEST_LONG_LIVED_FIXTURE_HELPER="$TMP_ROOT/long-lived-fixture.sh"
 [ "${FM_TEST_INJECT_UNRETIRED_FAILURE:-0}" != 1 ] || : > "$TMP_ROOT/inject-unretired-failure"
 cat > "$FM_TEST_LONG_LIVED_FIXTURE_HELPER" <<'SH'
 fm_fixture_init() {
+  if [ "${FM_TEST_LEGACY_UNRETIRED_FIXTURE:-0}" = 1 ]; then
+    if [ -n "${FM_TEST_LEGACY_PID_REPORT:-}" ]; then
+      fm_fixture_pgid=$(ps -o pgid= -p "$$" 2>/dev/null | tr -d '[:space:]') || exit 97
+      printf '%s %s\n' "$$" "$fm_fixture_pgid" > "$FM_TEST_LEGACY_PID_REPORT" || exit 97
+    fi
+    return 0
+  fi
   bash "${FM_TEST_LIB:?}" owned-child-register \
     "${FM_TEST_OWNED_CHILD_REGISTRY:?}" "$$" "${FM_TEST_FIXTURE_ROOT:?}" "$@" || exit 97
   FM_FIXTURE_DEADLINE=$((SECONDS + 15))
@@ -19,14 +26,38 @@ fm_fixture_init() {
 
 fm_fixture_waiting() {
   local control=${1:-} mode=${2:-stop} parent
-  [ -d "$FM_TEST_FIXTURE_ROOT" ] || return 1
-  [ "$SECONDS" -lt "$FM_FIXTURE_DEADLINE" ] || return 1
+  FM_FIXTURE_WAIT_REASON=waiting
+  if [ "${FM_TEST_LEGACY_UNRETIRED_FIXTURE:-0}" = 1 ]; then
+    [ -n "$control" ] || return 0
+    if [ -e "$control" ]; then
+      FM_FIXTURE_WAIT_REASON=control
+      return 1
+    fi
+    return 0
+  fi
+  if [ ! -d "$FM_TEST_FIXTURE_ROOT" ]; then
+    FM_FIXTURE_WAIT_REASON=fixture-root
+    return 1
+  fi
+  if [ "$SECONDS" -ge "$FM_FIXTURE_DEADLINE" ]; then
+    FM_FIXTURE_WAIT_REASON=deadline
+    return 1
+  fi
   [ -n "$control" ] || return 0
   parent=${control%/*}
   [ "$parent" != "$control" ] || parent=.
-  [ -d "$parent" ] || return 1
-  [ "$mode" != observe ] || return 0
-  [ ! -e "$control" ]
+  if [ ! -d "$parent" ]; then
+    FM_FIXTURE_WAIT_REASON=control-parent
+    return 1
+  fi
+  if [ "$mode" = observe ]; then
+    return 0
+  fi
+  if [ -e "$control" ]; then
+    FM_FIXTURE_WAIT_REASON=control
+    return 1
+  fi
+  return 0
 }
 SH
 EXT="$ROOT/.pi/extensions/fm-primary-pi-watch.ts"
@@ -1159,10 +1190,14 @@ if [ "$count" -eq 0 ]; then
   printf 'signal: synthetic wake\n'
   exit 0
 fi
-fm_fixture_terms=0
-trap 'fm_fixture_terms=$((fm_fixture_terms + 1)); [ "$fm_fixture_terms" -eq 1 ] || exit 0' TERM
-trap 'exit 0' INT
-trap 'printf "closed\n" > "${FM_CLOSE_FILE:?}"' EXIT
+if [ "${FM_TEST_LEGACY_UNRETIRED_FIXTURE:-0}" = 1 ]; then
+  trap '' TERM INT
+else
+  fm_fixture_terms=0
+  trap 'fm_fixture_terms=$((fm_fixture_terms + 1)); [ "$fm_fixture_terms" -eq 1 ] || exit 0' TERM
+  trap 'exit 0' INT
+  trap 'printf "closed\n" > "${FM_CLOSE_FILE:?}"' EXIT
+fi
 printf 'arm=%s\n' "$$" >> "${FM_ARM_LOG:?}"
 . "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
 fm_fixture_init "$FM_RELEASE_FILE"
@@ -1220,22 +1255,63 @@ EOF
 }
 
 test_pi_unretired_successor_failure_cleanup() {
-  local registry root_report child_root out status
-  registry="$TMP_ROOT/pi-unretired-failure-registry"
-  root_report="$TMP_ROOT/pi-unretired-failure-root"
-  mkdir -p "$registry"
-  out=$(FM_TEST_OWNED_CHILD_REGISTRY="$registry" \
+  local old_registry old_root_report old_pid_report old_out fixed_registry fixed_root_report fixed_out
+  local old_status fixed_status child_root old_pid old_pgid old_leaked waited
+  old_registry="$TMP_ROOT/pi-unretired-legacy-registry"
+  old_root_report="$TMP_ROOT/pi-unretired-legacy-root"
+  old_pid_report="$TMP_ROOT/pi-unretired-legacy-pid"
+  fixed_registry="$TMP_ROOT/pi-unretired-fixed-registry"
+  fixed_root_report="$TMP_ROOT/pi-unretired-fixed-root"
+  mkdir -p "$old_registry" "$fixed_registry"
+  old_out=$(FM_TEST_OWNED_CHILD_REGISTRY="$old_registry" \
     FM_TEST_ONLY_PI_UNRETIRED_SUCCESSOR=1 \
     FM_TEST_INJECT_UNRETIRED_FAILURE=1 \
-    FM_TEST_TMP_ROOT_REPORT="$root_report" \
+    FM_TEST_LEGACY_UNRETIRED_FIXTURE=1 \
+    FM_TEST_TMP_ROOT_REPORT="$old_root_report" \
+    FM_TEST_LEGACY_PID_REPORT="$old_pid_report" \
     bash "$0" 2>&1)
-  status=$?
-  expect_code 1 "$status" "injected hostile fixture failure must fail its nested suite"
-  child_root=$(cat "$root_report")
-  [ ! -e "$child_root" ] || fail "injected hostile fixture failure left its temp root: $child_root"
-  bash "$FM_TEST_LIB" owned-children-assert-zero "$registry" \
-    || fail "injected hostile fixture failure left a registered process or group: $out"
-  pass "Pi hostile unretired successor is reaped on the failure path"
+  old_status=$?
+  expect_code 1 "$old_status" "legacy hostile fixture failure must fail its nested suite"
+  child_root=$(cat "$old_root_report")
+  [ ! -e "$child_root" ] || fail "legacy hostile fixture failure did not delete its temp root: $child_root"
+  for _ in 1 2 3 4 5 6 7 8 9 10; do
+    [ -s "$old_pid_report" ] && break
+    sleep 0.05
+  done
+  old_pid=
+  old_pgid=
+  if [ -s "$old_pid_report" ]; then
+    read -r old_pid old_pgid < "$old_pid_report"
+  fi
+  old_leaked=0
+  if [ -n "$old_pid" ] && kill -0 "$old_pid" 2>/dev/null &&
+    kill -0 -- "-$old_pgid" 2>/dev/null; then
+    old_leaked=1
+    kill -TERM -- "-$old_pgid" 2>/dev/null || true
+    waited=0
+    while kill -0 -- "-$old_pgid" 2>/dev/null && [ "$waited" -lt 20 ]; do
+      sleep 0.05
+      waited=$((waited + 1))
+    done
+    if kill -0 -- "-$old_pgid" 2>/dev/null; then
+      kill -KILL -- "-$old_pgid" 2>/dev/null || true
+    fi
+  fi
+  [ "$old_leaked" -eq 1 ] || fail "legacy hostile fixture did not remain live after root deletion: $old_out"
+
+  fixed_out=$(FM_TEST_OWNED_CHILD_REGISTRY="$fixed_registry" \
+    FM_TEST_ONLY_PI_UNRETIRED_SUCCESSOR=1 \
+    FM_TEST_INJECT_UNRETIRED_FAILURE=1 \
+    FM_TEST_LEGACY_UNRETIRED_FIXTURE=0 \
+    FM_TEST_TMP_ROOT_REPORT="$fixed_root_report" \
+    bash "$0" 2>&1)
+  fixed_status=$?
+  expect_code 1 "$fixed_status" "injected repaired fixture failure must fail its nested suite"
+  child_root=$(cat "$fixed_root_report")
+  [ ! -e "$child_root" ] || fail "repaired hostile fixture failure left its temp root: $child_root"
+  bash "$FM_TEST_LIB" owned-children-assert-zero "$fixed_registry" \
+    || fail "repaired hostile fixture failure left a registered process or group: $fixed_out"
+  pass "Pi hostile unretired fixture distinguishes legacy leak from repaired cleanup"
 }
 
 test_pi_late_unretired_close_resumes_supervision() {
@@ -1266,7 +1342,9 @@ if [ "$count" -eq 2 ]; then
   . "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
 fm_fixture_init "$FM_RELEASE_FILE"
 while fm_fixture_waiting "$FM_RELEASE_FILE"; do sleep 0.02; done
-  [ "$FM_LATE_KIND" = actionable ] && printf 'signal: late wake\n'
+  if [ "$FM_FIXTURE_WAIT_REASON" = control ] && [ "$FM_LATE_KIND" = actionable ]; then
+    printf 'signal: late wake\n'
+  fi
   exit 0
 fi
 printf 'watcher: started pid=%s (beacon fresh)\n' "$$"
@@ -1470,6 +1548,7 @@ printf 'arm=%s\n' "$$" >> "${FM_ARM_LOG:?}"
 . "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
 fm_fixture_init "$FM_RELEASE_FILE"
 while fm_fixture_waiting "$FM_RELEASE_FILE"; do sleep 0.02; done
+[ "$FM_FIXTURE_WAIT_REASON" = control ] || exit 0
 printf 'signal: lock handoff\n'
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
@@ -2140,6 +2219,7 @@ trap 'exit 0' TERM INT
 . "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
 fm_fixture_init "$FM_TRIGGER_FILE.$count"
 while fm_fixture_waiting "$FM_TRIGGER_FILE.$count"; do sleep 0.02; done
+[ "$FM_FIXTURE_WAIT_REASON" = control ] || exit 0
 printf 'signal: streaming chain wake %s\n' "$count"
 exit 0
 SH
@@ -3334,7 +3414,9 @@ if [ "$count" -eq 2 ]; then
   . "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
 fm_fixture_init "$FM_RELEASE_FILE"
 while fm_fixture_waiting "$FM_RELEASE_FILE"; do sleep 0.02; done
-  [ "$FM_LATE_KIND" = actionable ] && printf 'signal: late wake\n'
+  if [ "$FM_FIXTURE_WAIT_REASON" = control ] && [ "$FM_LATE_KIND" = actionable ]; then
+    printf 'signal: late wake\n'
+  fi
   exit 0
 fi
 printf 'watcher: started pid=%s (beacon fresh)\n' "$$"
@@ -3539,11 +3621,12 @@ printf 'arm=%s\n' "$$" >> "${FM_ARM_LOG:?}"
 . "$FM_TEST_LONG_LIVED_FIXTURE_HELPER"
 fm_fixture_init "$FM_RELEASE_FILE"
 while fm_fixture_waiting "$FM_RELEASE_FILE"; do sleep 0.02; done
+[ "$FM_FIXTURE_WAIT_REASON" = control ] || exit 0
 printf 'signal: lock handoff\n'
 SH
   chmod +x "$repo/bin/fm-watch-arm.sh"
   out=$(PLUGIN="$plugin" WORKTREE="$repo" FM_HOME="$home" FM_ARM_LOG="$log" FM_RELEASE_FILE="$release" fm_test_in_owned_process_group node 2>&1 <<'EOF'
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
@@ -3569,6 +3652,14 @@ for (let i = 0; i < 250 && !existsSync(process.env.FM_ARM_LOG); i += 1) {
 }
 const other = spawn(process.execPath, ["-e", "setInterval(() => {}, 1000)"], { stdio: "ignore" });
 try {
+  const registered = spawnSync("bash", [
+    process.env.FM_TEST_LIB,
+    "owned-child-register",
+    process.env.FM_TEST_OWNED_CHILD_REGISTRY,
+    String(other.pid),
+    process.env.FM_TEST_FIXTURE_ROOT,
+  ]);
+  if (registered.status !== 0) throw new Error(`could not register lock-holder fixture pid ${other.pid}`);
   writeFileSync(lock, `${other.pid}\n`);
   writeFileSync(process.env.FM_RELEASE_FILE, "release\n");
   await eventPromise;
diff --git a/tests/fm-test-run.test.sh b/tests/fm-test-run.test.sh
index 5777664d70f..beda4d1bc86 100755
--- a/tests/fm-test-run.test.sh
+++ b/tests/fm-test-run.test.sh
@@ -1099,7 +1099,7 @@ SH
 }
 
 test_runner_reaps_registered_fixture_groups_after_failure_and_timeout() {
-  local tmp repo runner fixture mode rc pid pgid expected_exit
+  local tmp repo runner fixture mode rc pid pgid expected_exit expected_rc fixture_root
   tmp=$(mktemp -d "${TMPDIR:-/tmp}/fm-test-run-owned-child.XXXXXX")
   repo="$tmp/repo"
   runner="$repo/bin/fm-test-run.sh"
@@ -1114,6 +1114,7 @@ set -u
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 root=$(fm_test_tmproot fm-owned-child-fixture)
 stop="$root/stop"
+printf '%s\n' "$root" > "$FM_ROOT_REPORT"
 cat > "$root/child.sh" <<'CHILD'
 #!/usr/bin/env bash
 set -u
@@ -1141,22 +1142,29 @@ for _ in 1 2 3 4 5 6 7 8 9 10; do
 done
 [ -s "$FM_PID_REPORT" ] || exit 2
 trap - EXIT INT TERM
-[ "$FM_FIXTURE_MODE" != fail ] || exit 1
-sleep 600
+case "$FM_FIXTURE_MODE" in
+  success) exit 0 ;;
+  fail) exit 1 ;;
+  timeout) sleep 600 ;;
+  *) exit 2 ;;
+esac
 SH
   chmod +x "$runner" "$repo/$fixture"
 
-  for mode in fail timeout; do
+  for mode in success fail timeout; do
     set +e
-    FM_FIXTURE_MODE="$mode" FM_PID_REPORT="$tmp/$mode.pid" \
+    FM_FIXTURE_MODE="$mode" FM_PID_REPORT="$tmp/$mode.pid" FM_ROOT_REPORT="$tmp/$mode.root" \
       "$runner" --per-script-timeout-secs 2 "$fixture" >"$tmp/$mode.out" 2>"$tmp/$mode.err"
     rc=$?
     set -e
-    [ "$rc" -eq 1 ] || fail "$mode fixture run returned $rc instead of a bounded failure"
+    if [ "$mode" = success ]; then expected_rc=0; else expected_rc=1; fi
+    [ "$rc" -eq "$expected_rc" ] || fail "$mode fixture run returned $rc instead of $expected_rc"
     read -r pid pgid < "$tmp/$mode.pid"
     ! kill -0 "$pid" 2>/dev/null || fail "$mode fixture left registered pid $pid alive"
     ! kill -0 -- "-$pgid" 2>/dev/null || fail "$mode fixture left registered process group $pgid alive"
-    if [ "$mode" = fail ]; then expected_exit=1; else expected_exit=124; fi
+    fixture_root=$(cat "$tmp/$mode.root")
+    [ ! -e "$fixture_root" ] || fail "$mode fixture left its recorded temp root: $fixture_root"
+    if [ "$mode" = success ]; then expected_exit=0; elif [ "$mode" = fail ]; then expected_exit=1; else expected_exit=124; fi
     grep -Eq "FM_TEST_END .* exit=$expected_exit " "$tmp/$mode.out" \
       || fail "$mode fixture did not preserve its expected test result: $(cat "$tmp/$mode.out")"
     ! grep -Fq 'left a registered fixture process' "$tmp/$mode.out" \
diff --git a/tests/lib.sh b/tests/lib.sh
index 1884c11546c..b41d833d739 100644
--- a/tests/lib.sh
+++ b/tests/lib.sh
@@ -76,7 +76,7 @@ fm_test_owned_group_live() {
 }
 
 fm_test_owned_child_register() { # <registry> <pid> <root> [release-or-stop-control...]
-  local registry=$1 pid=$2 root=$3 pgid identity record tmp control
+  local registry=$1 pid=$2 root=$3 pgid identity record tmp tmp_name control
   shift 3
   case "$pid" in ''|*[!0-9]*) return 1 ;; esac
   [ -d "$registry" ] || return 1
@@ -84,16 +84,24 @@ fm_test_owned_child_register() { # <registry> <pid> <root> [release-or-stop-cont
   root=$(cd -P -- "$root" && pwd -P) || return 1
   pgid=$(fm_test_process_pgid "$pid") || return 1
   identity=$(fm_test_pid_identity "$pid") || return 1
-  record="$registry/child.$pid"
-  tmp="$registry/.child.$pid.$$"
   umask 077
-  {
+  tmp=$(mktemp "$registry/.child.$pid.XXXXXX") || return 1
+  tmp_name=${tmp##*/}
+  record="$registry/${tmp_name#.}"
+  if ! {
     printf '%s\n' "$pid" "$pgid" "$root" "$identity"
     for control in "$@"; do
       [ -n "$control" ] && printf '%s\n' "$control"
     done
-  } > "$tmp" || return 1
-  mv "$tmp" "$record"
+  } > "$tmp"; then
+    rm -f "$tmp"
+    return 1
+  fi
+  if ! ln "$tmp" "$record"; then
+    rm -f "$tmp"
+    return 1
+  fi
+  rm -f "$tmp"
 }
 
 fm_test_owned_group_wait_closed() { # <pgid> <iterations>
@@ -105,6 +113,28 @@ fm_test_owned_group_wait_closed() { # <pgid> <iterations>
   ! fm_test_owned_group_live "$pgid"
 }
 
+fm_test_owned_root_cleanup_if_unreferenced() {
+  local record=$1 root=$2 peer peer_root
+  [ -n "$root" ] || return 1
+  [ "$root" != "/" ] || return 1
+  for peer in "${record%/*}"/child.*; do
+    [ -f "$peer" ] || continue
+    [ "$peer" != "$record" ] || continue
+    peer_root=$(sed -n '3p' "$peer" 2>/dev/null) || peer_root=
+    [ "$peer_root" = "$root" ] && return 0
+  done
+  [ -e "$root" ] || return 0
+  [ -d "$root" ] || return 1
+  [ -f "$root/.fm-test-fixture" ] || return 1
+  rm -rf "$root" && [ ! -e "$root" ]
+}
+
+fm_test_owned_child_retire_record() {
+  local record=$1 root=$2
+  fm_test_owned_root_cleanup_if_unreferenced "$record" "$root" || return 1
+  rm -f "$record"
+}
+
 fm_test_owned_child_cleanup_record() { # <record>
   local record=$1 pid pgid root identity current current_pgid own_pgid control parent peer peer_pid peer_pgid peer_identity peer_current
   pid=$(sed -n '1p' "$record" 2>/dev/null) || return 1
@@ -124,7 +154,7 @@ fm_test_owned_child_cleanup_record() { # <record>
   fi
 
   if fm_test_owned_group_wait_closed "$pgid" 150; then
-    rm -f "$record"
+    fm_test_owned_child_retire_record "$record" "$root" || return 1
     return 0
   fi
 
@@ -140,7 +170,7 @@ fm_test_owned_child_cleanup_record() { # <record>
       peer_identity=$(sed -n '4p' "$peer" 2>/dev/null) || continue
       peer_current=$(fm_test_pid_identity "$peer_pid" 2>/dev/null) || continue
       if [ "$peer_current" = "$peer_identity" ]; then
-        rm -f "$record"
+        fm_test_owned_child_retire_record "$record" "$root" || return 1
         return 0
       fi
     done
@@ -154,7 +184,7 @@ fm_test_owned_child_cleanup_record() { # <record>
 
   kill -TERM -- "-$pgid" 2>/dev/null || true
   if fm_test_owned_group_wait_closed "$pgid" 50; then
-    rm -f "$record"
+    fm_test_owned_child_retire_record "$record" "$root" || return 1
     return 0
   fi
 
@@ -162,7 +192,7 @@ fm_test_owned_child_cleanup_record() { # <record>
   # transaction. Escalation stays scoped to that already-proven group.
   kill -KILL -- "-$pgid" 2>/dev/null || true
   if fm_test_owned_group_wait_closed "$pgid" 50; then
-    rm -f "$record"
+    fm_test_owned_child_retire_record "$record" "$root" || return 1
     return 0
   fi
   printf 'fm-test: owned fixture group survived KILL pid=%s pgid=%s root=%s\n' \

From 4bc34b7fc13f1108b07dd65e762103ab5a6e8a8f Mon Sep 17 00:00:00 2001
From: Ivan Li <ivan@withally.com>
Date: Tue, 8 Sep 2026 13:55:02 +0800
Subject: [PATCH 3/3] no-mistakes(document): Document owned-fixture cleanup
 behavior

---
 CONTRIBUTING.md    |  4 ++--
 bin/fm-test-run.sh |  6 +++++-
 docs/scripts.md    |  2 +-
 tests/lib.sh       | 15 +++++++++------
 4 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 3f952226695..45848367cc5 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -106,7 +106,7 @@ EOF
 tmp=$(mktemp -d) && printf 'done: smoke\n' > "$tmp/smoke.status" && FM_STATE_OVERRIDE="$tmp" FM_SIGNAL_GRACE=1 FM_POLL=1 FM_HEARTBEAT=999999 bin/fm-watch-arm.sh  # watcher re-arm smoke test (prints arm status, then an actionable signal)
 ```
 
-`bin/fm-test-run.sh` is the single owner of behavior-suite selection, portable CI lane composition, bounded concurrency admission, per-script timing markers, family totals, the coverage guard, and the optional JSON timing artifact.
+`bin/fm-test-run.sh` is the single owner of behavior-suite selection, portable CI lane composition, bounded concurrency admission, owned-fixture cleanup, per-script timing markers, family totals, the coverage guard, and the optional JSON timing artifact.
 Its header and `--help` own the flags, family labels, lanes, and changed-file map; this section only documents the entry points.
 `bin/fm-test-isolation-proof.sh` remains the single owner of the portable candidate proof and reusable family proof harness; see `docs/fm-test-isolation-proof.md`.
 Portable shard balance evidence lives in `docs/fm-test-portable-shards.md`.
@@ -119,7 +119,7 @@ Those sleeps look like recoverable overhead - `fm-watch-triage.test.sh` alone is
 Sampling less often does not remove that wait, it only delays detection: raising the interval to 0.5s and charging each sample proportionally measured `fm-watch-triage.test.sh` at 435s and 440s against 390s and 393s for the unchanged script, back to back on 2026-09-03, because each of its ~40 poll-cycle waits and ~73 process-exit waits paid up to half a second more.
 Some of those loops are also catching a transient rather than waiting for a settled condition, so a coarser sample can step over the state they assert on.
 Discover tests by listing `tests/*.test.sh`: each is a self-contained bash script named `<subject>.test.sh`, and its header comment describes what it covers, so pass one to `bin/fm-test-run.sh` to focus on a subject with canonical timing output.
-Shared test helpers live in `tests/lib.sh` (reporters, temp roots, git fixtures), `tests/fixtures.sh` (fake toolchain and spawn-world builders), `tests/wake-helpers.sh`, and `tests/secondmate-helpers.sh`.
+Shared test helpers live in `tests/lib.sh` (reporters, temp roots, owned-fixture cleanup, git fixtures), `tests/fixtures.sh` (fake toolchain and spawn-world builders), `tests/wake-helpers.sh`, and `tests/secondmate-helpers.sh`.
 Source those instead of copying a fake toolchain into a new suite.
 A fixture may shorten a production timeout to keep a failure path prompt, but never below what the real work inside that window costs on a loaded machine: a fork, an exec, a lock acquisition, a beacon publication, or a first-poll check.
 Where a case's assertion is not about the timeout itself, give that window headroom over the measured loaded cost, and bound the test's own waiting with iteration-counted poll loops, which stretch under load where a wall-clock budget does not.
diff --git a/bin/fm-test-run.sh b/bin/fm-test-run.sh
index c9a09e6a1b2..23e6cd392ca 100755
--- a/bin/fm-test-run.sh
+++ b/bin/fm-test-run.sh
@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 # fm-test-run.sh - single owner of Firstmate's behavior-test runner, lane
 # composition for portable CI shards, local --jobs for proven-concurrent work,
-# timing markers, and the complete-regression coverage guard.
+# owned-fixture cleanup, timing markers, and the complete-regression coverage
+# guard.
 #
 # Selection modes (exactly one of: --all, --family, --changed, --lane,
 # --proven-isolated, or script paths):
@@ -2085,6 +2086,9 @@ record_script_result() {
 # positive, a script that outruns it is terminated and reported as exit 124: a
 # hung script must become a bounded failure rather than an unbounded suite,
 # because an unbounded suite is what silently outruns its caller's budget.
+# Each script also receives a private owned-child registry, which is cleaned
+# after the script exits; an ambiguous or surviving registered group fails the
+# script and keeps the run directory as evidence for a safe follow-up.
 run_script_bounded() {  # <script> <out> <stream> <id>
   local script=$1 out=$2 stream=$3 id=$4
   local rc cleanup_rc registry="$RUN_TMP/owned.$id"
diff --git a/docs/scripts.md b/docs/scripts.md
index a46a20bb326..6fe215ea957 100644
--- a/docs/scripts.md
+++ b/docs/scripts.md
@@ -38,7 +38,7 @@ The shared no-mistakes gate refusal for fleet lifecycle entrypoints is summarize
 | `fm-install-herdr.sh`    | Install CI's exact-version Herdr pin with official asset URL, SHA-256, and protocol checks |
 | `fm-install-treehouse.sh`| Install CI's exact-version Treehouse pin for real-Herdr E2E that needs spawn worktrees |
 | `fm-herdr-ci-cleanup.sh` | Snapshot and tear down only job-owned `fm-lab-*` sessions in the Herdr CI lane       |
-| `fm-test-run.sh`         | Behavior-test runner: selection, portable lanes, bounded concurrency, budgets, coverage guard, timing/JSON |
+| `fm-test-run.sh`         | Behavior-test runner: selection, portable lanes, bounded concurrency, budgets, owned-fixture cleanup, coverage guard, timing/JSON |
 | `fm-test-isolation-proof.sh` | Concurrent isolation harness and portable candidate set owner |
 | `fm-ensure-agents-md.sh` | Ensure a project's real `AGENTS.md`, its `CLAUDE.md` `@AGENTS.md` pointer, and the canonical self-governance section |
 | `fm-guard.sh`            | Warn on primary-checkout tangles, main-session pending wakes, and unhealthy supervision |
diff --git a/tests/lib.sh b/tests/lib.sh
index b41d833d739..b500695babc 100644
--- a/tests/lib.sh
+++ b/tests/lib.sh
@@ -6,9 +6,10 @@
 #   . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 #
 # It provides the boilerplate every test file used to re-roll: ok/not-ok
-# reporters, a self-cleaning temp root, fakebin/PATH-shim helpers, deterministic
-# git identity and fixture builders, state/<id>.meta writers, and the common
-# string/exit-code/file assertions. Shared fake-toolchain and spawn-world
+# reporters, fail-closed temp-root and owned-fixture-process cleanup,
+# fakebin/PATH-shim helpers, deterministic git identity and fixture builders,
+# state/<id>.meta writers, and the common string/exit-code/file assertions.
+# Shared fake-toolchain and spawn-world
 # builders live in tests/fixtures.sh; wake-queue mocks in wake-helpers.sh;
 # secondmate-lifecycle mocks in secondmate-helpers.sh. Suite-specific fakes
 # that encode a single test's terminal or lifecycle assumptions still belong
@@ -269,9 +270,11 @@ pass() {
 # --- self-cleaning temp root ------------------------------------------------
 #
 # fm_test_tmproot <prefix> echoes a fresh temp dir and registers it for removal
-# on EXIT/INT/TERM. A test file that needs extra teardown (e.g. killing a
-# daemon) should define its own EXIT trap and call fm_test_cleanup from inside
-# it so registered dirs are still removed.
+# after its owned fixture processes have closed on EXIT/INT/TERM. A test file
+# that needs extra teardown (e.g. killing a daemon) should define its own EXIT
+# trap and call fm_test_cleanup from inside it so registered dirs are still
+# removed. Ambiguous or surviving owned groups fail closed and preserve their
+# cleanup evidence instead of deleting a root that may still be in use.
 #
 # The call site is almost always `TMP_ROOT=$(fm_test_tmproot prefix)`, which
 # forks a subshell to capture stdout. Anything that function does to the