fix(lock): bound stale lock recovery with a non-recursive steal mutex

bin/fm-afk-return.sh

@@ -228,7 +228,7 @@ main() {
   . "$SCRIPT_DIR/fm-classify-lib.sh"
 
   mkdir -p "$STATE" || return 1
-  fm_lock_acquire_wait "$LOCK"
+  fm_lock_acquire_wait "$LOCK" || return 1
   trap 'fm_lock_release "$LOCK"' EXIT
   write_pending_seed || { fm_lock_release "$LOCK"; trap - EXIT; return 1; }
   return_reconcile

bin/fm-backlog-handoff.sh

@@ -444,14 +444,24 @@ with_remote_route_locks() { # <secondmate-id> <function> <args...>
   shift 2
   case "$id" in ''|*[!A-Za-z0-9._-]*) echo "error: unsafe remote handoff id: $id" >&2; return 1 ;; esac
   ACTIVE_REGISTRY_LOCK=$(secondmate_registry_lock_path "$STATE")
-  fm_lock_acquire_wait "$ACTIVE_REGISTRY_LOCK"
+  if ! fm_lock_acquire_wait "$ACTIVE_REGISTRY_LOCK"; then
+    echo "error: could not lock the secondmate registry for $id" >&2
+    ACTIVE_REGISTRY_LOCK=
+    release_remote_locks
+    return 1
+  fi
   if [ "$(secondmate_registry_field "$REG" "$id" remote 2>/dev/null || true)" != 1 ]; then
     echo "error: pending outbox has no matching remote secondmate route: $id" >&2
     release_remote_locks
     return 1
   fi
   ACTIVE_HANDOFF_LOCK="$STATE/.backlog-handoff-$id.lock"
-  fm_lock_acquire_wait "$ACTIVE_HANDOFF_LOCK"
+  if ! fm_lock_acquire_wait "$ACTIVE_HANDOFF_LOCK"; then
+    echo "error: could not lock the pending handoff outbox for $id" >&2
+    ACTIVE_HANDOFF_LOCK=
+    release_remote_locks
+    return 1
+  fi
   if "$operation" "$@"; then rc=0; else rc=$?; fi
   release_remote_locks
   return "$rc"

bin/fm-captain-hold.sh

@@ -775,7 +775,7 @@ command_complete() {
   [ -f "$meta" ] && has_meta=1
   if [ "$has_meta" = 1 ]; then
     CAPTAIN_META_LOCK=$(fm_meta_lock_path "$meta") || fail "could not resolve task metadata lock"
-    fm_lock_acquire_wait "$CAPTAIN_META_LOCK"
+    fm_lock_acquire_wait "$CAPTAIN_META_LOCK" || fail "could not lock task metadata"
     CAPTAIN_META_LOCK_HELD=1
     [ -f "$meta" ] || fail "task metadata disappeared while recording completion"
   fi

bin/fm-lock.sh

@@ -73,7 +73,7 @@ if ! fm_lock_try_acquire "$CLAIM_LOCK"; then
     echo "error: the prior session's bounded startup sweep is finishing; operate read-only until it releases the fleet lock" >&2
     exit 1
   fi
-  fm_lock_acquire_wait "$CLAIM_LOCK"
+  fm_lock_acquire_wait "$CLAIM_LOCK" || exit 1
 fi
 CLAIM_LOCK_HELD=1
 

bin/fm-remote-secondmate-control.sh

@@ -94,16 +94,41 @@ retired_mktemp_suffix_valid() { # <suffix>
   return 1
 }
 
-# A lock owner directory holds only the files bin/fm-wake-lib.sh's owner
-# contract writes and cleans.
-retired_lock_owner_dir_valid() { # <path>
+# A stale-recovery serialization marker bin/fm-wake-lib.sh leaves inside a lock
+# owner directory: a directory whose only entry is the reclaimer's pid file.
+retired_lock_reclaim_marker_valid() { # <path>
   local dir=$1 entry
   [ -d "$dir" ] && [ ! -L "$dir" ] || return 1
   for entry in "$dir"/* "$dir"/.[!.]* "$dir"/..?*; do
     [ -e "$entry" ] || [ -L "$entry" ] || continue
+    [ "${entry##*/}" = pid ] || return 1
     retired_plain_file "$entry" || return 1
+  done
+  return 0
+}
+
+# A lock owner directory holds only the files bin/fm-wake-lib.sh's owner
+# contract writes and cleans, plus the reclaim markers its stale-recovery path
+# creates there.
+retired_lock_owner_dir_valid() { # <path>
+  local dir=$1 entry suffix
+  [ -d "$dir" ] && [ ! -L "$dir" ] || return 1
+  for entry in "$dir"/* "$dir"/.[!.]* "$dir"/..?*; do
+    [ -e "$entry" ] || [ -L "$entry" ] || continue
     case "${entry##*/}" in
-      pid|fm-home|pid-identity|role|watcher-path) ;;
+      pid|fm-home|pid-identity|role|watcher-path)
+        retired_plain_file "$entry" || return 1
+        ;;
+      reclaim)
+        retired_lock_reclaim_marker_valid "$entry" || return 1
+        ;;
+      reclaim.dead.*)
+        suffix=${entry##*.}
+        case "$suffix" in
+          ''|*[!0-9]*) return 1 ;;
+        esac
+        retired_lock_reclaim_marker_valid "$entry" || return 1
+        ;;
       *) return 1 ;;
     esac
   done

bin/fm-spawn.sh

@@ -2820,7 +2820,7 @@ fi
 spawn_record_traceparent() {
   local meta="$STATE/$ID.meta" tmp status=0
   SPAWN_META_LOCK=$(fm_meta_lock_path "$meta") || return 1
-  fm_lock_acquire_wait "$SPAWN_META_LOCK"
+  fm_lock_acquire_wait "$SPAWN_META_LOCK" || return 1
   SPAWN_META_LOCK_HELD=1
   SPAWN_META_TMP="$STATE/.$ID.meta.trace.${BASHPID:-$$}"
   if [ ! -f "$meta" ] || [ ! -w "$meta" ] \

bin/fm-startup-network.sh

@@ -200,7 +200,7 @@ cmd_start() {  # <locked> <harvest-pid>
     return 1
   fi
 
-  fm_lock_acquire_wait "$PUBLISH_LOCK"
+  fm_lock_acquire_wait "$PUBLISH_LOCK" || return 1
   if [ "$(status_get state)" = running ] && worker_alive \
     && { [ "$locked" != 1 ] || [ "$(status_get lock_pid)" = "$lock_pid" ]; }; then
     # A worker from this or a previous session is still going. Starting a second
@@ -299,7 +299,7 @@ await_delivery() {  # <generation> <state>
   limit=$(( $(delivery_budget) * 10 ))
   while [ "$waited" -lt "$limit" ]; do
     claim_live=0
-    fm_lock_acquire_wait "$PUBLISH_LOCK"
+    fm_lock_acquire_wait "$PUBLISH_LOCK" || return 1
     if [ "$(status_get generation)" != "$generation" ]; then
       fm_lock_release "$PUBLISH_LOCK"
       return 0
@@ -332,7 +332,7 @@ EOF
     sleep 0.1
     waited=$((waited + 1))
   done
-  fm_lock_acquire_wait "$PUBLISH_LOCK"
+  fm_lock_acquire_wait "$PUBLISH_LOCK" || return 1
   if [ "$(status_get generation)" != "$generation" ] || [ -f "$DELIVERED_FILE" ]; then
     fm_lock_release "$PUBLISH_LOCK"
     return 0
@@ -345,7 +345,7 @@ EOF
 
 publish() {  # <generation> <state> <phases> <locked> <started> <rc> <output-file> <timing-file>
   local generation=$1 state=$2 phases=$3 locked=$4 started=$5 rc=$6 out=$7 timings=${8:-} report_published=1
-  fm_lock_acquire_wait "$PUBLISH_LOCK"
+  fm_lock_acquire_wait "$PUBLISH_LOCK" || return 1
   if [ "$(status_get generation)" != "$generation" ]; then
     fm_lock_release "$PUBLISH_LOCK"
     return 0
@@ -387,7 +387,7 @@ cmd_run() {  # <locked> <lock-pid> <generation>
   budget=$(stage_budget)
   phases=probe
   if [ -n "$generation" ]; then
-    fm_lock_acquire_wait "$PUBLISH_LOCK"
+    fm_lock_acquire_wait "$PUBLISH_LOCK" || return 1
     if [ "$(status_get generation)" = "$generation" ] && [ "$(status_get pid)" = "$$" ]; then
       internal=1
       started=$(status_get started)
@@ -410,7 +410,7 @@ cmd_run() {  # <locked> <lock-pid> <generation>
 
   if [ "$internal" -eq 0 ]; then
     generation="$(now).$$.manual"
-    fm_lock_acquire_wait "$PUBLISH_LOCK"
+    fm_lock_acquire_wait "$PUBLISH_LOCK" || return 1
     if [ "$(status_get state)" = running ] && worker_alive; then
       fm_lock_release "$PUBLISH_LOCK"
       return 1
@@ -438,7 +438,7 @@ EOF
   stage_started=$(fm_timing_now_ms)
   rc=0
   if [ "$sweep_locked" -eq 1 ]; then
-    fm_lock_acquire_wait "$STATE/.lock.acquire"
+    fm_lock_acquire_wait "$STATE/.lock.acquire" || return 1
     lease_held=1
     if ! lock_unchanged "$lock_pid"; then
       sweep_locked=0
@@ -544,7 +544,7 @@ print_state() {
 
 cmd_harvest() {  # <pid>
   local pid=$1 generation state claim_record claim_generation claim_pid
-  fm_lock_acquire_wait "$PUBLISH_LOCK"
+  fm_lock_acquire_wait "$PUBLISH_LOCK" || return 1
   generation=$(status_get generation)
   # Another session's live claim is left alone; the worker reaps a dead one.
   if [ -f "$CLAIM_FILE" ]; then

bin/fm-wake-drain.sh

@@ -278,7 +278,7 @@ trap cleanup EXIT
 trap 'exit 130' INT
 trap 'exit 143' TERM
 
-fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK"
+fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK" || exit 1
 DRAIN_LOCK_HELD=true
 
 if [ -n "$ACK_THROUGH" ]; then
@@ -291,7 +291,7 @@ if [ -n "$ACK_THROUGH" ]; then
     echo "wake drain: inactive outcome receipt could not be recorded safely" >&2
     exit 1
   fi
-  fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK"
+  fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK" || exit 1
   DRAIN_LOCK_HELD=true
   DRAIN_TMP=$(mktemp "$STATE/.wake-queue.ack.XXXXXX") || exit 1
   chmod 0600 "$DRAIN_TMP" || exit 1