From a6776710316d276f5bc8fe0dc9b560282b4bafaf Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 14 Oct 2026 14:44:52 +0000
Subject: [PATCH 1/4] fix(lock): reap tickets close the stale-takeover race;
 one shared lock in _common.sh

A dead holder's line X is now reaped under tickets <lock>.reap.<cksum X>.<N>,
written aside and ln'ed (exclusive, never empty). Ticket N+1 is allowed only
when ticket N's pid is dead, never by age. Only the highest ticket's holder
may rm X, and only while the lock still holds exactly X. A new holder clears
other keys' tickets. Lock lines gain a nonce= field. exec.sh and
test-scratch.sh call mxtk_lock_take/mxtk_lock_release; both stop with the
sync remedy on an older _common.sh.

bench-lock-race.sh, 200 rounds x 10 contenders, Linux:
  old block (master d16f578): 13 overlaps in 6 rounds, 12 stolen locks
  reap tickets: 0 overlaps, 0 stolen, 0 starved, 0 probe failures

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                  |   1 +
 project-bin/_common.sh                        | 188 ++++++++++++++++
 project-bin/exec.sh                           | 100 ++-------
 project-bin/test-scratch.sh                   |  82 ++-----
 tests/wave2/bench-lock-race.sh                | 163 ++++++++++++++
 .../fixtures/mxtest-guard/exec-lock-block.sh  |   6 +-
 tests/wave2/test-lock-reap.sh                 | 211 ++++++++++++++++++
 tests/wave2/test-shared-lock-takeover.sh      |  57 ++---
 tests/wave2/test-test-scratch.sh              |  42 ++--
 9 files changed, 650 insertions(+), 200 deletions(-)
 create mode 100755 tests/wave2/bench-lock-race.sh
 create mode 100755 tests/wave2/test-lock-reap.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ff60ea83..706dc5ab 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are. Named m
 
 ## Unreleased
 
+- fix(lock): **reap tickets close the stale-takeover race; one shared lock in `_common.sh`.** The old takeover serialised reaping through one `<lock>.takeover` file that went stale by pid or age and was moved aside and put back with `ln`; a contender creating a new one in that gap put two contenders inside the takeover, and one's compare-then-rm deleted the other's fresh lock. Now a dead holder's line X is reaped under tickets `<lock>.reap.<cksum X>.<N>` (written aside, then `ln`ed: exclusive, never empty); ticket N+1 is allowed only when ticket N's pid is dead, never by age; only the highest ticket's holder may `rm` X, and only while the lock still holds exactly X; the new holder clears other keys' tickets. Lock lines gain a `nonce=` field, so a line never comes back. `mxtk_lock_take` / `mxtk_lock_release` / `mxtk_lock_live` replace exec.sh's `exec_lock_*` and test-scratch.sh's `take_over`/`holder_live` copies; both scripts stop with the sync remedy on an older `_common.sh`. The lock path, line format and liveness rule stay readable by the old code, and a live old-style `.takeover` is waited on, so mixed versions do not deadlock. New `tests/wave2/bench-lock-race.sh` (SIGKILLs at test anchors and at random 0–50 ms; `MXTK_LOCK_TEST_PAUSE` hook, no-op unset) and `test-lock-reap.sh`; `test-shared-lock-takeover.sh` and `test-test-scratch.sh` source `_common.sh` instead of awk-lifting the code. Field evidence: none yet; needs one macOS and one Git Bash harness run. — r-eng-backlog item 1, MendixMau
 - process(build): **Stage 5 drafts the ready set in parallel and applies serially.** The runbook dispatch row said "sequential within a module", which serialised drafting even for independent scripts; it now points to `iterative-build-loop.md` → Gate cost, the single statement of the rule. The unit is the build-plan row: every `BUILD` row whose "Depends on" rows are all applied, minus overlapping writers (two rows that replace, alter or drop+create the same document never share a ready set, and no row is drafted while it overlaps a queued unapplied one; `brd-to-build-plan.md` has Produces name every document a row writes), runs at once, its scripts in order, one `mdl-agent` per script. Applies stay one at a time through `bin/exec.sh`, and the ready set is recomputed after each. A queued draft made before a sibling apply landed is re-checked with `mxcli diff --format struct` (preflight STOP rule 23); any removal line (checked against `describe` per BUG-146) or STOP rule 21 target means re-draft, never patch, because a stale restatement of a shared document is exactly rule 21's silent seed-call loss and passes `check --references`. Report `ready set N, drafted N, applied k`; the `mdl-agent` template says a drafter never applies and never depends on an unapplied draft. Field evidence: none yet. — MendixMau
 - fix(platform-link): **CLI commits now show their changed documents in Studio Pro History.** Studio Pro's History → Model changes pane reads a `ModelChanges` array from the commit's `refs/notes/mx_metadata` note. Trap 6c's hand-written template set it to `[]`, so every mxcli/agent commit showed "Model changes 0" (field project: 270 of 270 notes empty). New `project-bin/mx-metadata-note.py` (stdlib only) computes the array from the commit's changed `.mxunit` files, in Studio Pro's entry shape: Status, UnitID, UnitType, UnitName and Module (walked up the `.mpr` Unit tree). It has `changes` / `write` / `backfill` / `sync <remote>` subcommands. `install-project-hooks.sh` now also installs post-commit and post-rewrite hooks that write the note and never block, and `--check` covers them, so `sync-project.sh` rolls them out to wired projects. Notes are published with `mx-metadata-note.py sync <remote>` after the branch push. Push config is never touched. With mxcli v0.26+ in the project root the hooks call `mxcli git note --write` instead (mendixlabs/mxcli#1337); the Python script is the fallback for older pins, and on 160 field commits both wrote the same 3,594 entries. Trap 6c rewritten. Measured against Studio Pro's own notes, 51 commits in 5 apps: 3387/3389 entries exact on all five fields. Field run on a 357-commit Mendix 11.15.0 app: 158 notes backfilled and pushed, and Studio Pro History lists the documents per revision. Review fixes: an earlier revision added `HEAD` + the notes ref to `remote.<r>.push`. It was dropped because any push refspec replaces `push.default`. A branch tracking a differently named upstream got a new same-named branch on Team Server where `simple` refuses, a missing local notes ref failed the whole push, and nobody knows whether Studio Pro's own push reads that config. The installer now only fetches the remote's notes (non-forced). It removes that exact `HEAD` + notes pair if present, and leaves and reports any other entry. `sync` handles a remote with no notes ref (it used to exit 1) and retries a rejected push once after re-merging. A note that already lists changes (Studio Pro's) is never overwritten by `write`/`backfill` without `--force`, and `sync` keeps a colleague's non-empty note over ours. The mxcli probe greps `git note --help` for `--write`. Hooks and docs call the script through `resolve_py`. Fixture `tests/wave2/test-mx-metadata-note.sh` (40 cases, over real captured template units; single- and two-tree layouts, amend, backfill and `--force`, push exit codes identical to a no-hooks clone, leftover-refspec cleanup, sync to an empty remote and its retry, notes fetch at install, a diverged notes merge; green under `init.defaultBranch` master and main). — field project (Mendix 11.15 app), MendixMau
 - learn(fixture-seeding): **explore the data structure first, choose rows by use case, scan actions for resets before any run.** Two seeding runs on public template apps: seeding raised journey passes 33 -> 58 and 20 -> 51 of the same sets (FAIL 93 -> 68, 163 -> 132; INVALID unchanged), and a "Reset all demodata" journey wiped accounts so 104 of 127 journeys reported `The username or password you entered is incorrect`, identical on empty and seeded databases. Skill gains three questions a seed must answer, a use-case checklist, a destructive-action scan, a generic traps table with symptoms, measured expectations and a denominator checklist; routing trigger now fires on seed/test/demo data and empty pages. Independent review fixes: object ids follow the Mendix bigint pattern with a business-key guard (no uuids), associations are seeded where the page's path stores them, four new traps (enum names, inheritance chain, calculated attributes, view/external entities), and the port-offset and container-label traps moved to `harness-architecture.md`. — MendixMau
diff --git a/project-bin/_common.sh b/project-bin/_common.sh
index 48113307..cdc351c0 100755
--- a/project-bin/_common.sh
+++ b/project-bin/_common.sh
@@ -915,3 +915,191 @@ EOF_ARGS
   done
   return 1
 }
+
+# ---------------------------------------------------------------------------
+# The shared lock: mxtk_lock_take / mxtk_lock_release / mxtk_lock_live (+ mxtk_lock_fields)
+#
+# One implementation for exec.sh (the per-project .mpr-snapshots/.exec.lock) and test-scratch.sh
+# (the same file, plus the machine-wide test-port lock). Bash 3.2, POSIX tools, no flock (macOS and
+# Git Bash ship none). It replaces two "keep in step" copies (exec_lock_* / take_over).
+#
+# The lock file holds one line, "<pid> <epoch> <label> nonce=<n>". The nonce makes every line ever
+# written unique, so a line that has left the file never comes back; a line from the pre-nonce code
+# ("<pid> <epoch> <label>", or a bare pid) reads the same way. The holder is LIVE while its pid is
+# alive, not a zombie, and (where `ps -o args=` can say) an exec.sh or test-scratch.sh — the rule the
+# old code used, so a holder written by either version is respected by both.
+#
+# A dead holder's line X is REAPED under a ticket, never by age:
+#   1. reap tickets are files <lock>.reap.<cksum of X>.<N>, holding "<pid> <nonce>", each created
+#      exclusively and never empty (written to <lock>.tmp.<pid>, then `ln`ed into place);
+#   2. ticket N+1 may be taken only when ticket N's pid is dead (same liveness rule) — a live
+#      reaper is never overtaken, however long it takes;
+#   3. only the holder of the highest ticket for X re-reads the lock and removes it, and only if it
+#      still holds exactly X. Then it creates its own lock exclusively, like anyone else;
+#   4. a new holder deletes the tickets of every other key (X is gone for good once replaced).
+# WHY (r-eng-backlog item 1, 2026-10-14): the previous protocol serialised reaping through one
+# `<lock>.takeover` file that went stale by pid OR age and was moved aside and put back with `ln`.
+# While it was moved aside a third contender created a fresh one, the `ln` failed, and two
+# contenders were inside the takeover at once: E read the stale line, D removed it and took a fresh
+# lock, then E's `rm` deleted D's lock — two holders. Re-checking just before the `rm` (a rejected
+# attempt) only narrowed that window. Under tickets the compare and the `rm` belong to one live
+# process per X, and X cannot reappear, so the compare-then-rm cannot hit a fresh lock.
+# Proof: tests/wave2/bench-lock-race.sh reproduces the double holder on the old block and finds
+# none here; tests/wave2/test-lock-reap.sh covers each rule.
+#
+# Mixed versions (a project bin/ older than another session's): the lock file, its line and the
+# liveness rule are unchanged, so neither version deadlocks the other. This code also backs off
+# while a live old-style <lock>.takeover exists (pid alive and under 10 s old, or empty and under
+# a minute — the old code's own rule) and clears a stale one once it holds the lock.
+#
+# ANCHOR(lock-test): MXTK_LOCK_TEST_PAUSE, when set, names a command run as `<cmd> <anchor> <pid>`
+# at: ticket-taken (right after a reap ticket is created), compare (before the re-read of the
+# lock), rm (after the compare matched, before the rm) and created (right after a lock is taken).
+# The race harness pauses there or SIGKILLs <pid>. Unset = no-op. MXTK_LOCK_RETRY_SLEEP (default 1
+# s) is the pause between attempts.
+# ---------------------------------------------------------------------------
+_mxtk_lock_anchor() { [ -z "${MXTK_LOCK_TEST_PAUSE:-}" ] || "$MXTK_LOCK_TEST_PAUSE" "$1" "$$" || true; }
+
+# mxtk_lock_live <pid> — 0 iff that process is alive, not a zombie, and plausibly a lock holder.
+mxtk_lock_live() {
+  local a
+  [ -n "${1:-}" ] || return 1
+  case "$1" in *[!0-9]*) return 1 ;; esac
+  kill -0 "$1" 2>/dev/null || return 1
+  # Linux: an unreaped zombie still answers kill -0; /proc/<pid>/stat says Z after the "(comm) ".
+  case "$(sed 's/.*) //' "/proc/$1/stat" 2>/dev/null | cut -d' ' -f1)" in Z) return 1 ;; esac
+  # A pid reused by an unrelated process is dead to us; where ps cannot show args (Git Bash),
+  # kill -0 alone decides. test-scratch.sh holds the exec lock while it copies the model.
+  a="$(ps -o args= -p "$1" 2>/dev/null || true)"
+  case "$a" in ""|*exec.sh*|*test-scratch.sh*) return 0 ;; esac
+  return 1
+}
+
+# mxtk_lock_fields "<line>" — sets MXTK_LOCK_HPID, MXTK_LOCK_HSINCE (epoch or "") and
+# MXTK_LOCK_HLABEL ("?" for a bare-pid line), the nonce left out. For messages only.
+mxtk_lock_fields() {
+  local l="${1% nonce=*}" rest
+  MXTK_LOCK_HPID="${l%% *}"; MXTK_LOCK_HSINCE=""; MXTK_LOCK_HLABEL="?"
+  rest="${l#* }"; [ "$rest" = "$l" ] && return 0
+  MXTK_LOCK_HSINCE="${rest%% *}"
+  [ "${rest#* }" = "$rest" ] || MXTK_LOCK_HLABEL="${rest#* }"
+  case "$MXTK_LOCK_HSINCE" in ''|*[!0-9]*) MXTK_LOCK_HSINCE="" ;; esac
+  return 0
+}
+
+_mxtk_lock_key() { printf '%s' "$1" | cksum | awk '{print $1 "-" $2}'; }
+
+# _mxtk_lock_excl <lock> <target> <content> — create <target> holding <content>, exclusively and
+# never empty: written to <lock>.tmp.<pid>, then hard-linked (ln fails when <target> exists). On a
+# filesystem without hard links (FAT/exFAT, some shares) ln fails with <target> absent; then an
+# O_EXCL create (noclobber) is used, which has the old written-after-create window.
+_mxtk_lock_excl() {
+  local tmp="$1.tmp.$$" rc=1
+  printf '%s\n' "$3" > "$tmp" 2>/dev/null || return 1
+  if ln "$tmp" "$2" 2>/dev/null; then rc=0
+  elif [ ! -e "$2" ] && [ -e "$tmp" ]; then
+    ( set -o noclobber; printf '%s\n' "$3" > "$2" ) 2>/dev/null && rc=0
+  fi
+  rm -f "$tmp"
+  return "$rc"
+}
+
+# _mxtk_lock_legacy_busy <lock> — 0 while an old-style <lock>.takeover is live by the old rule.
+_mxtk_lock_legacy_busy() {
+  local t since
+  [ -e "$1.takeover" ] || return 1
+  t="$(head -1 "$1.takeover" 2>/dev/null || true)"
+  if [ -z "$t" ]; then [ -z "$(find "$1.takeover" -mmin +1 2>/dev/null)" ]; return; fi
+  since="${t#* }"; since="${since%% *}"; case "$since" in ''|*[!0-9]*) since=0 ;; esac
+  kill -0 "${t%% *}" 2>/dev/null && [ $(( $(date +%s) - since )) -le 10 ]
+}
+
+# _mxtk_lock_reap <lock> <stale line X> — 0 when the lock no longer holds X (we removed it, or it
+# had changed: X never comes back, try to take the lock again at once); 1 when another live reaper
+# holds the highest ticket for X (or an old-style takeover is live) — wait and look again.
+_mxtk_lock_reap() {
+  local L="$1" X="$2" key max=0 n f t
+  _mxtk_lock_legacy_busy "$L" && return 1
+  key="$(_mxtk_lock_key "$X")"
+  for f in "$L.reap.$key".*; do
+    n="${f##*.}"; case "$n" in ''|*[!0-9]*) continue ;; esac
+    [ "$n" -gt "$max" ] && max="$n"
+  done
+  if [ "$max" -gt 0 ]; then
+    f="$L.reap.$key.$max"; t="$(head -1 "$f" 2>/dev/null || true)"
+    if [ -n "$t" ]; then mxtk_lock_live "${t%% *}" && return 1
+    # Empty: only the no-hard-link fallback writes after the create. Its creator is mid-write.
+    elif [ -e "$f" ] && [ -z "$(find "$f" -mmin +1 2>/dev/null)" ]; then return 1; fi
+  fi
+  n=$((max + 1)); f="$L.reap.$key.$n"
+  _mxtk_lock_excl "$L" "$f" "$$ $_MXTK_LOCK_NONCE" || return 1   # another reaper took N first
+  _mxtk_lock_anchor ticket-taken
+  # Ours is the highest: N+1 needs our pid dead. Checked anyway — the rule, not an inference.
+  [ -e "$L.reap.$key.$((n + 1))" ] && return 1
+  _mxtk_lock_anchor compare
+  if [ -e "$L" ] && [ "$(head -1 "$L" 2>/dev/null || true)" = "$X" ]; then
+    _mxtk_lock_anchor rm
+    rm -f "$L"
+    MXTK_LOCK_REAPED="$X"
+    return 0   # the ticket stays until the next holder clears it
+  fi
+  rm -f "$f"   # X is gone for good; our ticket is litter
+  return 0
+}
+
+# _mxtk_lock_gc <lock> <our line> — run by a new holder: tickets of every other key, temp files of
+# dead pids, and a stale old-style takeover file.
+_mxtk_lock_gc() {
+  local L="$1" mine f
+  mine="$(_mxtk_lock_key "$2")"
+  for f in "$L".reap.*; do
+    case "$f" in "$L.reap.$mine."*) continue ;; esac
+    rm -f "$f"
+  done
+  for f in "$L".tmp.*; do
+    [ -e "$f" ] || continue
+    mxtk_lock_live "${f##*.tmp.}" || rm -f "$f"
+  done
+  _mxtk_lock_legacy_busy "$L" || rm -f "$L.takeover"
+  return 0
+}
+
+# mxtk_lock_take <lockfile> <label> [tries=6] — 0 taken (MXTK_LOCK_REAPED = the dead holder's line
+# when we reaped one, else ""); 1 a live holder has it (MXTK_LOCK_HELD = its line); 2 gave up after
+# <tries> attempts (others kept taking it). Call it directly, not in $( ): it sets variables.
+mxtk_lock_take() {
+  local L="$1" label="$2" tries="${3:-6}" i=0 held line slp="${MXTK_LOCK_RETRY_SLEEP:-1}"
+  MXTK_LOCK_HELD=""; MXTK_LOCK_REAPED=""
+  [ -n "${_MXTK_LOCK_NONCE:-}" ] || _MXTK_LOCK_NONCE="$$$RANDOM$RANDOM$(date +%s)"
+  line="$$ $(date +%s) $label nonce=$_MXTK_LOCK_NONCE"
+  while [ "$i" -lt "$tries" ]; do
+    i=$((i + 1))
+    if _mxtk_lock_excl "$L" "$L" "$line"; then
+      _mxtk_lock_anchor created
+      _mxtk_lock_gc "$L" "$line"
+      return 0
+    fi
+    held="$(head -1 "$L" 2>/dev/null || true)"
+    if [ -z "$held" ]; then
+      [ -e "$L" ] || continue   # released between our create and our read
+      # Empty: the pre-ticket code writes after its O_EXCL create — wait, unless it is over a
+      # minute old (its writer died between the two) and so a stale line like any other.
+      if [ -z "$(find "$L" -mmin +1 2>/dev/null)" ]; then sleep "$slp"; continue; fi
+    elif mxtk_lock_live "${held%% *}"; then
+      MXTK_LOCK_HELD="$held"; return 1
+    fi
+    _mxtk_lock_reap "$L" "$held" && continue
+    sleep "$slp"   # another live reaper is on it; see who won
+  done
+  MXTK_LOCK_HELD="$(head -1 "$L" 2>/dev/null || true)"
+  return 2
+}
+
+# mxtk_lock_release <lockfile> — remove it only while it holds our own line (pid AND nonce).
+mxtk_lock_release() {
+  local own
+  [ -n "${_MXTK_LOCK_NONCE:-}" ] || return 0
+  own="$(head -1 "$1" 2>/dev/null || true)"
+  case "$own" in "$$ "*" nonce=$_MXTK_LOCK_NONCE") rm -f "$1" ;; esac
+  return 0
+}
diff --git a/project-bin/exec.sh b/project-bin/exec.sh
index b85dde08..134bc97d 100755
--- a/project-bin/exec.sh
+++ b/project-bin/exec.sh
@@ -508,8 +508,8 @@ fi
 # 2. One exec.sh at a time on THIS project (e.g. a second agent session on the same model).
 #
 #    The lock is per project — $PROJECT_ROOT/.mpr-snapshots/.exec.lock — and holds
-#    "<pid> <epoch> <script>". It is taken atomically (noclobber: O_EXCL, bash 3.2 / Git Bash /
-#    macOS alike; no flock, which macOS and Git Bash do not ship), so two sessions starting in
+#    "<pid> <epoch> <script> nonce=<n>". It is created exclusively (written aside, then `ln`;
+#    no flock, which macOS and Git Bash do not ship), so two sessions starting in
 #    the same second cannot both win. A lock whose pid is dead is STALE — a SIGKILL, a crash or
 #    a closed terminal never runs the EXIT trap — and is taken over with a printed note; a
 #    guard that needs a manual `rm` to recover blocks its own remedy (CLAUDE.md, instrument
@@ -517,90 +517,26 @@ fi
 #    pid was reused by an unrelated process and the lock is stale too; where it cannot (Git
 #    Bash), `kill -0` alone decides. A lock file in the pre-2026-10-13 format (a bare pid) reads
 #    the same way.
-exec_lock_live() {  # $1 = pid from the lock; 0 iff that process is alive and plausibly exec.sh
-  [ -n "$1" ] || return 1
-  case "$1" in *[!0-9]*) return 1 ;; esac
-  kill -0 "$1" 2>/dev/null || return 1
-  # Linux: an unreaped zombie still answers kill -0; /proc/<pid>/stat says Z after the "(comm) ".
-  case "$(sed 's/.*) //' "/proc/$1/stat" 2>/dev/null | cut -d' ' -f1)" in Z) return 1 ;; esac
-  _args="$(ps -o args= -p "$1" 2>/dev/null || true)"
-  case "$_args" in ""|*exec.sh*|*test-scratch.sh*) return 0 ;; esac   # test-scratch.sh holds it while copying
-  return 1
-}
-exec_lock_try() { ( set -o noclobber; printf '%s %s %s\n' "$$" "$(date +%s)" "$LOG_NAME" > "$LOCK" ) 2>/dev/null; }
-exec_lock_release() {  # the trap: remove the lock only while it is still ours
-  _own="$(cat "$LOCK" 2>/dev/null || true)"
-  [ "${_own%% *}" = "$$" ] && rm -f "$LOCK"
-  return 0
-}
-# Taking over a stale lock is serialised through a second O_EXCL file, $LOCK.takeover. Under
-# it the lock is re-read and removed ONLY if it still holds exactly the stale line judged above;
-# nothing else ever removes a lock that is not its own, so the compare-then-rm cannot hit a
-# fresh lock. WHY (independent review of #304): the old takeover moved the lock aside and put
-# it back with `mv -f` when it found a fresh one there — check-then-act. With 3+ contenders, B
-# moved A's fresh lock aside, C's noclobber write landed in the gap, B saw a lock and deleted
-# A's: 12 contenders gave up to 3 holders at once (tests/wave2/test-exec-lock-watch.sh).
-# A takeover file left by a holder killed inside those few microseconds is stale once its pid is
-# dead or it is older than 10 s (an EMPTY one once it is over a minute old — `find -mmin +1`;
-# `+0` matched a file created a second ago, so a live contender's fresh takeover file was judged
-# stale and a third contender got in: review of #324). It is moved aside, and put back with `ln`
-# (never clobbers; left on disk if that fails) if what was moved is not the one judged stale.
-# The holder removes the takeover file only while it still holds the line it wrote.
-exec_lock_takeover() {  # $1 = the stale lock line; 0 iff it was removed (or already gone)
-  _tk="$LOCK.takeover"; _mine="$$ $(date +%s)"
-  if ! ( set -o noclobber; printf '%s\n' "$_mine" > "$_tk" ) 2>/dev/null; then
-    _t="$(head -1 "$_tk" 2>/dev/null || true)"; _tpid="${_t%% *}"; _tsince="${_t#* }"
-    case "$_tsince" in ''|*[!0-9]*) _tsince=0 ;; esac
-    _tstale=0
-    if [ -n "$_t" ]; then
-      { ! kill -0 "$_tpid" 2>/dev/null || [ $(( $(date +%s) - _tsince )) -gt 10 ]; } && _tstale=1
-    elif [ -n "$(find "$_tk" -mmin +1 2>/dev/null)" ]; then
-      _tstale=1   # empty for over a minute: its creator died between the create and the write
-    fi
-    if [ "$_tstale" = 1 ]; then
-      if mv "$_tk" "$_tk.stale.$$" 2>/dev/null; then
-        # Remove what was moved ONLY if it is what was judged stale; anything else is someone's
-        # live takeover file: put it back (ln never clobbers), and if that fails leave it be.
-        # Same body as test-scratch.sh's take_over() — keep the two in step (PR #322).
-        if [ "$(head -1 "$_tk.stale.$$" 2>/dev/null || true)" = "$_t" ]; then rm -f "$_tk.stale.$$"
-        else ln "$_tk.stale.$$" "$_tk" 2>/dev/null && rm -f "$_tk.stale.$$"; fi
-      fi
-    fi
-    return 1
-  fi
-  _now="$(head -1 "$LOCK" 2>/dev/null || true)"
-  [ "$_now" = "$1" ] && rm -f "$LOCK"
-  [ "$(head -1 "$_tk" 2>/dev/null || true)" = "$_mine" ] && rm -f "$_tk"   # only our own takeover file
-  return 0
-}
-LOCK_TAKEN=0
-for _try in 1 2 3 4 5 6; do
-  if exec_lock_try; then LOCK_TAKEN=1; break; fi
-  _held="$(head -1 "$LOCK" 2>/dev/null || true)"
-  if [ -z "$_held" ] && [ "$_try" -lt 3 ]; then sleep 1; continue; fi   # being written right now
-  _hpid="${_held%% *}"
-  if exec_lock_live "$_hpid"; then
-    _hrest="${_held#* }"; _hsince="${_hrest%% *}"; _hscript="${_hrest#* }"
-    _age=""
-    case "$_hsince" in ''|*[!0-9]*) ;; *) _age=" for $(( $(date +%s) - _hsince ))s" ;; esac
-    [ "$_hrest" = "$_held" ] && _hscript="?"
-    echo "✗ Another session holds this project's exec lock (PID $_hpid, running$_age, script: $_hscript)."
-    echo "  → Wait for it to finish, then re-run. Nothing was written."
-    echo "    (A dead holder is detected and taken over automatically — no manual rm is ever needed.)"
-    exit 1
-  fi
-  if exec_lock_takeover "$_held"; then
-    echo "  (stale exec lock from PID ${_hpid:-?}, which is not running — taking it over)"
-  else
-    sleep 1   # another contender is taking it over right now; look again
-  fi
-done
-if [ "$LOCK_TAKEN" != 1 ]; then
+#    The lock code is _common.sh's mxtk_lock_take / mxtk_lock_release, shared with test-scratch.sh;
+#    a dead holder is reaped under a ticket, never by age (see the block header there).
+command -v mxtk_lock_take >/dev/null 2>&1 || {
+  echo "exec.sh: bin/_common.sh is older than this script (no mxtk_lock_take)." >&2
+  echo "  → <toolkit>/bin/sync-project.sh $PROJECT_ROOT --upgrade-bin _common.sh   (backs up a hand-edited copy first)" >&2; exit 2; }
+_lrc=0; mxtk_lock_take "$LOCK" "$LOG_NAME" 6 || _lrc=$?
+if [ "$_lrc" = 1 ]; then
+  mxtk_lock_fields "$MXTK_LOCK_HELD"; _age=""
+  [ -n "$MXTK_LOCK_HSINCE" ] && _age=" for $(( $(date +%s) - MXTK_LOCK_HSINCE ))s"
+  echo "✗ Another session holds this project's exec lock (PID $MXTK_LOCK_HPID, running$_age, script: $MXTK_LOCK_HLABEL)."
+  echo "  → Wait for it to finish, then re-run. Nothing was written."
+  echo "    (A dead holder is detected and taken over automatically — no manual rm is ever needed.)"
+  exit 1
+elif [ "$_lrc" != 0 ]; then
   echo "✗ Could not take the exec lock $LOCK after 6 attempts — another session keeps re-taking it."
   echo "  → Wait for the other exec to finish, then re-run. Nothing was written."
   exit 1
 fi
-trap 'exec_lock_release' EXIT
+[ -z "$MXTK_LOCK_REAPED" ] || echo "  (stale exec lock from PID ${MXTK_LOCK_REAPED%% *}, which is not running — taking it over)"
+trap 'mxtk_lock_release "$LOCK"' EXIT
 
 # 3. A raw `mxcli exec` elsewhere on the machine is NOT this project's business. The old guard
 #    here (`pgrep -fl "mxcli exec"`) matched every exec on the machine, so a test run on a
diff --git a/project-bin/test-scratch.sh b/project-bin/test-scratch.sh
index d20192cf..c87a28fe 100755
--- a/project-bin/test-scratch.sh
+++ b/project-bin/test-scratch.sh
@@ -155,75 +155,25 @@ if mxtest_left "$MODEL_DIR" "$MODEL_DIR/$MPR_NAME"; then
   exit 3
 fi
 
-# Same liveness rule as exec.sh's lock: alive, not a zombie, and (where ps can say) one of ours.
-holder_live() {
-  [ -n "${1:-}" ] || return 1
-  case "$1" in *[!0-9]*) return 1 ;; esac
-  kill -0 "$1" 2>/dev/null || return 1
-  case "$(sed 's/.*) //' "/proc/$1/stat" 2>/dev/null | cut -d' ' -f1)" in Z) return 1 ;; esac
-  _args="$(ps -o args= -p "$1" 2>/dev/null || true)"
-  case "$_args" in ""|*exec.sh*|*test-scratch.sh*) return 0 ;; esac
-  return 1
-}
-# Taking over a stale lock is serialised through a second O_EXCL file, <lock>.takeover — the SAME
-# file name and protocol as exec.sh's exec_lock_takeover (this script shares .exec.lock with it, so
-# the two must exclude each other; keep the bodies in step). Under it the lock is re-read and
-# removed ONLY if it still holds exactly the stale line judged; nothing else ever removes a lock
-# that is not its own. WHY (independent review of #304): the old takeover here moved the lock
-# aside with `mv -f` — check-then-act — so two runs that judged the same dead holder could both
-# end up holding it. A takeover file left by a holder killed mid-takeover is stale once its pid is
-# dead or it is older than 10 s (an EMPTY one once it is over a minute old: find -mmin +1); it is moved aside, and put
-# back with `ln` (fails if a new one exists — never clobbers) if what was moved is not the one
-# judged stale. The machine-wide port lock uses the same protocol.
-take_over() {  # $1 = lock file, $2 = the stale lock line. 0 iff it was removed (or already gone)
-  local _tk="$1.takeover" _t _tpid _tsince _tstale _now _mine
-  _mine="$$ $(date +%s)"
-  if ! ( set -o noclobber; printf '%s\n' "$_mine" > "$_tk" ) 2>/dev/null; then
-    _t="$(head -1 "$_tk" 2>/dev/null || true)"; _tpid="${_t%% *}"; _tsince="${_t#* }"
-    case "$_tsince" in ''|*[!0-9]*) _tsince=0 ;; esac
-    _tstale=0
-    if [ -n "$_t" ]; then
-      { ! kill -0 "$_tpid" 2>/dev/null || [ $(( $(date +%s) - _tsince )) -gt 10 ]; } && _tstale=1
-    elif [ -n "$(find "$_tk" -mmin +1 2>/dev/null)" ]; then
-      # -mmin +1, not +0: GNU find counts a 0-2 s old file as "+0" (and BSD rounds up), so +0 made a
-      # FRESH empty takeover file — its creator between the create and the write — stale at once.
-      _tstale=1   # empty for over a minute: its creator died between the create and the write
-    fi
-    if [ "$_tstale" = 1 ]; then
-      if mv "$_tk" "$_tk.stale.$$" 2>/dev/null; then
-        # Remove what was moved ONLY if it is what was judged stale; anything else is someone's
-        # live takeover file: put it back (ln never clobbers), and if that fails leave it be.
-        if [ "$(head -1 "$_tk.stale.$$" 2>/dev/null || true)" = "$_t" ]; then rm -f "$_tk.stale.$$"
-        else ln "$_tk.stale.$$" "$_tk" 2>/dev/null && rm -f "$_tk.stale.$$"; fi
-      fi
-    fi
-    return 1
-  fi
-  _now="$(head -1 "$1" 2>/dev/null || true)"
-  [ "$_now" = "$2" ] && rm -f "$1"
-  [ "$(head -1 "$_tk" 2>/dev/null || true)" = "$_mine" ] && rm -f "$_tk"   # only our own takeover file
-  return 0
-}
+# Both locks are _common.sh's mxtk_lock_take / mxtk_lock_release — the same code exec.sh uses on
+# .exec.lock, so the two scripts exclude each other by construction. A dead holder is reaped
+# under a ticket, never by age (see the block header in _common.sh).
+command -v mxtk_lock_take >/dev/null 2>&1 || {
+  echo "test-scratch: bin/_common.sh is older than this script (no mxtk_lock_take)." >&2
+  echo "  → <toolkit>/bin/sync-project.sh $PROJECT_ROOT --upgrade-bin _common.sh   (backs up a hand-edited copy first)" >&2; exit 2; }
 take_lock() {  # $1 = lock file, $2 = what it guards (for messages). 0 = taken, 1 = live holder
-  local f="$1" held hpid i
-  for i in 1 2 3 4 5 6 7 8; do
-    if ( set -o noclobber; printf '%s %s %s\n' "$$" "$(date +%s)" "test-scratch.sh" > "$f" ) 2>/dev/null; then return 0; fi
-    held="$(head -1 "$f" 2>/dev/null || true)"
-    if [ -z "$held" ] && [ "$i" -lt 3 ]; then sleep 1; continue; fi
-    hpid="${held%% *}"
-    if holder_live "$hpid"; then
-      echo "✗ test-scratch: $2 is held by PID $hpid ($(printf '%s' "$held" | cut -d' ' -f3-)) — wait for it to finish." >&2
-      return 1
-    fi
-    if take_over "$f" "$held"; then
-      echo "  (stale lock on $2 from PID ${hpid:-?}, not running — taking it over)"
-    else
-      sleep 1   # another run is taking the same stale lock over; see who won
-    fi
-  done
+  local rc=0
+  mxtk_lock_take "$1" "test-scratch.sh" 8 || rc=$?
+  case "$rc" in
+    0) [ -z "$MXTK_LOCK_REAPED" ] || echo "  (stale lock on $2 from PID ${MXTK_LOCK_REAPED%% *}, not running — taking it over)"
+       return 0 ;;
+    1) mxtk_lock_fields "$MXTK_LOCK_HELD"
+       echo "✗ test-scratch: $2 is held by PID $MXTK_LOCK_HPID ($MXTK_LOCK_HLABEL) — wait for it to finish." >&2
+       return 1 ;;
+  esac
   echo "✗ test-scratch: could not take the lock on $2 after 8 attempts." >&2; return 1
 }
-release() { local f="$1" own; own="$(head -1 "$f" 2>/dev/null || true)"; [ "${own%% *}" = "$$" ] && rm -f "$f"; return 0; }
+release() { mxtk_lock_release "$1"; }
 
 EXEC_LOCK="$PROJECT_ROOT/.mpr-snapshots/.exec.lock"
 PORT_LOCK="${TMPDIR:-/tmp}/mxtk-test-ports-$(printf '%s' "$PORTS" | tr -c '0-9' '-').lock"
diff --git a/tests/wave2/bench-lock-race.sh b/tests/wave2/bench-lock-race.sh
new file mode 100755
index 00000000..2f85dced
--- /dev/null
+++ b/tests/wave2/bench-lock-race.sh
@@ -0,0 +1,163 @@
+#!/usr/bin/env bash
+# bench-lock-race.sh — race harness for the shared lock (_common.sh mxtk_lock_take): rounds of
+# contenders start together on a lock whose holder is dead, are SIGKILLed at the lock code's test
+# anchors and at random 0–50 ms offsets, and every holder checks for a second live holder.
+#
+# Usage: bash tests/wave2/bench-lock-race.sh [--rounds N] [--contenders M] [--common <_common.sh>]
+#                                            [--old [<file holding the pre-ticket exec.sh lock block>]]
+#   default subject: project-bin/_common.sh (the reap-ticket lock)
+#   --old: the pre-ticket protocol (`<lock>.takeover`, mv aside, ln back); default file
+#          tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh, a verbatim copy of master d16f578's
+#          exec.sh block. Anchors are sed-injected at the same points: after its takeover file is
+#          created (ticket-taken, compare), before its rm (rm), after its lock is created (created),
+#          plus the two steps the new code no longer has: after a takeover file is judged stale
+#          (judged) and after it is moved aside, before the compare and `ln` back (aside).
+# Exit 0 iff no overlapping holders, every contender that was not killed acquired the lock before
+# its deadline, and a probe after each round acquired it within PROBE_SECS. Last line:
+#   RESULT subject=<new|old> rounds=R contenders=M overlaps=<events> overlap_rounds=<n> starved=<n> probe_fail=<n> kills=<n> acquired=<n>
+#
+# Knobs (env): KILL_AT (anchors where a contender may be SIGKILLed, default "ticket-taken compare
+# rm"; every anchor also pauses 0–39 ms), KILL_PCT (chance per such anchor, default 25),
+# RANDOM_KILL_PCT (chance a contender is also SIGKILLed at a random 0–50 ms offset, default 10),
+# HOLD_SECS (default 0.05), RETRY_SECS (pause between attempts, default 0.02), DEADLINE (per
+# contender, default 30 s), PROBE_SECS (default 15).
+# Two signals, both must stay 0: an OVERLAP (a holder sees another live holder's mark) and a
+# STOLEN lock (a live holder finds the lock file no longer names it — someone removed it).
+# WHY: r-eng-backlog item 1 (2026-10-14). The harness must show the double holder on the old
+# code before its silence on the new code means anything.
+set -uo pipefail
+TOOLKIT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ROUNDS=200; NC=10; COMMON="$TOOLKIT/project-bin/_common.sh"; OLD=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --rounds) shift; ROUNDS="$1" ;;
+    --contenders) shift; NC="$1" ;;
+    --common) shift; COMMON="$1" ;;
+    --old) if [ $# -gt 1 ] && [ -f "$2" ]; then shift; OLD="$1"
+           else OLD="$TOOLKIT/tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh"; fi ;;
+    -h|--help) sed -n '2,20p' "$0"; exit 0 ;;
+    *) echo "unknown argument: $1" >&2; exit 2 ;;
+  esac
+  shift
+done
+KILL_PCT="${KILL_PCT:-25}"; RANDOM_KILL_PCT="${RANDOM_KILL_PCT:-10}"; HOLD_SECS="${HOLD_SECS:-0.05}"
+DEADLINE="${DEADLINE:-30}"; PROBE_SECS="${PROBE_SECS:-15}"
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/lockrace.XXXXXX")" || exit 2
+WORK="$(cd "$WORK" && pwd -P)"
+BG=""
+trap 'for p in $BG; do kill -KILL "$p" 2>/dev/null; done; rm -rf "$WORK"' EXIT
+LOCK="$WORK/.exec.lock"; HOLD="$WORK/holding"; mkdir -p "$HOLD"
+
+# The implementation under test exposes ctake (0 = holding) and crelease.
+if [ -n "$OLD" ]; then
+  SUBJECT=old
+  { echo 'LOG_NAME="old.mdl"'
+    echo '_hk() { [ -z "${MXTK_LOCK_TEST_PAUSE:-}" ] || "$MXTK_LOCK_TEST_PAUSE" "$1" "$$" || true; }'
+    echo 'ctake() {'
+    grep -v '^#' "$OLD" | sed \
+      -e 's/^  _now="\$(head -1 "\$LOCK" 2>\/dev\/null || true)"$/  _hk ticket-taken; _hk compare; &/' \
+      -e 's/^  \[ "\$_now" = "\$1" \] && rm -f "\$LOCK"$/  [ "$_now" = "$1" ] \&\& { _hk rm; rm -f "$LOCK"; }/' \
+      -e 's/^  if exec_lock_try; then LOCK_TAKEN=1; break; fi$/  if exec_lock_try; then LOCK_TAKEN=1; _hk created; break; fi/' \
+      -e 's/^    if \[ "\$_tstale" = 1 \]; then$/    _hk judged; &/' \
+      -e 's/^      if mv "\$_tk" "\$_tk.stale.\$\$" 2>\/dev\/null; then$/&  _hk aside;/' \
+      -e 's/sleep 1/sleep "$RETRY"/' -e 's/^    exit 1$/    return 1/' -e 's/^  exit 1$/  return 2/'
+    echo '}'
+    echo 'crelease() { exec_lock_release; }'
+  } > "$WORK/impl.sh"
+  for a in 'ticket-taken' '_hk rm' '_hk created' '_hk judged' '_hk aside' 'return 1' 'return 2' 'sleep "$RETRY"'; do
+    grep -qF -- "$a" "$WORK/impl.sh" || { echo "setup: could not inject '$a' into the old block ($OLD)" >&2; exit 2; }
+  done
+else
+  SUBJECT=new
+  { printf 'PROJECT_ROOT=%q; . %q\n' "$WORK" "$COMMON"
+    echo 'ctake() { mxtk_lock_take "$LOCK" "contender" 3; }'
+    echo 'crelease() { mxtk_lock_release "$LOCK"; }'
+  } > "$WORK/impl.sh"
+  grep -q '^mxtk_lock_take() {' "$COMMON" || { echo "setup: no mxtk_lock_take in $COMMON" >&2; exit 2; }
+fi
+
+# The hook run at each anchor: SIGKILL the contender KILL_PCT% of the time, else pause 0–39 ms.
+cat > "$WORK/pause.sh" <<'P'
+#!/usr/bin/env bash
+case " ${KILL_AT:-$1} " in *" $1 "*) ;; *) KILL_PCT=0 ;; esac
+if [ $((RANDOM % 100)) -lt "$KILL_PCT" ]; then echo "$1 $2" >> "$WORK/kills"; kill -KILL "$2"; exit 0; fi
+sleep "0.0$((RANDOM % 4))$((RANDOM % 10))"
+P
+chmod +x "$WORK/pause.sh"
+
+# A contender: its name contains "exec.sh", so the liveness rule (old and new) counts it as a holder.
+cat > "$WORK/contender-exec.sh" <<'C'
+LOCK="$1"; ROUND="$2"; RETRY="$RETRY_SECS"; MXTK_LOCK_RETRY_SLEEP="$RETRY_SECS"
+. "$WORK/impl.sh"
+alive() {  # same rule as the lock: alive, not a zombie, one of ours
+  kill -0 "$1" 2>/dev/null || return 1
+  case "$(sed 's/.*) //' "/proc/$1/stat" 2>/dev/null | cut -d' ' -f1)" in Z) return 1 ;; esac
+  case "$(ps -o args= -p "$1" 2>/dev/null || true)" in *contender-exec.sh*) return 0 ;; esac
+  return 1
+}
+check() {
+  local m p
+  for m in "$HOLD"/*; do
+    [ -e "$m" ] || continue; p="${m##*/}"; [ "$p" = "$$" ] && continue
+    alive "$p" && echo "round $ROUND: $$ holds while $p holds" >> "$WORK/overlaps"
+  done
+}
+while [ ! -e "$WORK/go.$ROUND" ]; do sleep 0.01; done
+end=$(( $(date +%s) + DEADLINE )); got=0
+while [ "$(date +%s)" -lt "$end" ]; do
+  if ctake >/dev/null 2>&1; then got=1; break; fi
+  sleep "0.0$((RANDOM % 5 + 1))"
+done
+if [ "$got" != 1 ]; then case "$ROUND" in probe*) ;; *) echo "$$" >> "$WORK/starved" ;; esac; exit 1; fi
+echo "$$" >> "$WORK/acquired"
+mine() {  # the lock must still name us while we hold it; anything else means another took it
+  [ "$(head -1 "$LOCK" 2>/dev/null | cut -d' ' -f1)" = "$$" ] || echo "round $ROUND: $$ lost its lock while holding it (now: $(head -1 "$LOCK" 2>/dev/null))" >> "$WORK/stolen"
+}
+touch "$HOLD/$$"; check; mine; sleep "$HOLD_SECS"; check; mine; rm -f "$HOLD/$$"
+crelease
+C
+
+dead_pid() { sleep 0 & local p=$!; wait "$p" 2>/dev/null; echo "$p"; }
+RETRY_SECS="${RETRY_SECS:-0.02}"; KILL_AT="${KILL_AT:-ticket-taken compare rm}"
+export WORK HOLD KILL_PCT HOLD_SECS DEADLINE RETRY_SECS KILL_AT
+PROBE_FAIL=0; ROUNDS_WITH_OVERLAP=0
+T0=$(date +%s)
+for r in $(seq 1 "$ROUNDS"); do
+  rm -f "$HOLD"/*
+  if [ $((r % 2)) = 1 ]; then printf '%s %s old.mdl\n' "$(dead_pid)" "$(date +%s)" > "$LOCK"   # pre-nonce line
+  else printf '%s %s old.mdl nonce=round%s\n' "$(dead_pid)" "$(date +%s)" "$r" > "$LOCK"; fi
+  [ -n "$OLD" ] && rm -f "$LOCK.takeover"   # the old harness's own reset; tickets are left as litter
+  before="$(cat "$WORK/overlaps" 2>/dev/null | wc -l | tr -d ' ')"
+  PIDS=""
+  for c in $(seq 1 "$NC"); do
+    MXTK_LOCK_TEST_PAUSE="$WORK/pause.sh" bash "$WORK/contender-exec.sh" "$LOCK" "$r" >/dev/null 2>&1 &
+    PIDS="$PIDS $!"
+  done
+  BG="$PIDS"
+  : > "$WORK/go.$r"
+  for p in $PIDS; do   # random SIGKILLs at 0–50 ms
+    if [ $((RANDOM % 100)) -lt "$RANDOM_KILL_PCT" ]; then
+      ( sleep "0.0$((RANDOM % 5))$((RANDOM % 10))"; kill -KILL "$p" 2>/dev/null && echo "random $p" >> "$WORK/kills" ) &
+    fi
+  done
+  for p in $PIDS; do wait "$p" 2>/dev/null; done
+  wait 2>/dev/null
+  after="$(cat "$WORK/overlaps" 2>/dev/null | wc -l | tr -d ' ')"
+  [ "$after" -gt "$before" ] && ROUNDS_WITH_OVERLAP=$((ROUNDS_WITH_OVERLAP + 1))
+  # Probe: no hooks, no kills — whatever the round left (a dead holder, dead tickets), it gets the lock.
+  rm -f "$HOLD"/*
+  ( cd "$WORK" && : > "$WORK/go.probe$r"; DEADLINE="$PROBE_SECS" bash "$WORK/contender-exec.sh" "$LOCK" "probe$r" ) >/dev/null 2>&1 \
+    || { PROBE_FAIL=$((PROBE_FAIL + 1)); echo "  round $r: probe could not take the lock within ${PROBE_SECS}s ($(head -1 "$LOCK" 2>/dev/null))"; }
+done
+T1=$(date +%s)
+OV="$(cat "$WORK/overlaps" 2>/dev/null | wc -l | tr -d ' ')"
+ST="$(cat "$WORK/starved" 2>/dev/null | wc -l | tr -d ' ')"
+KL="$(cat "$WORK/kills" 2>/dev/null | wc -l | tr -d ' ')"
+AQ="$(cat "$WORK/acquired" 2>/dev/null | wc -l | tr -d ' ')"
+SL="$(cat "$WORK/stolen" 2>/dev/null | wc -l | tr -d ' ')"
+[ "$OV" -gt 0 ] && { echo "  first overlaps:"; head -5 "$WORK/overlaps" | sed 's/^/    /'; }
+[ "$SL" -gt 0 ] && { echo "  first locks lost by a live holder:"; head -5 "$WORK/stolen" | sed 's/^/    /'; }
+LITTER="$(ls -a "$WORK" | grep -c '^\.exec\.lock\.' || true)"
+echo "  $((T1 - T0)) s; lock-side files left at the end: $LITTER"
+echo "RESULT subject=$SUBJECT rounds=$ROUNDS contenders=$NC overlaps=$OV overlap_rounds=$ROUNDS_WITH_OVERLAP stolen=$SL starved=$ST probe_fail=$PROBE_FAIL kills=$KL acquired=$AQ"
+[ "$OV" -eq 0 ] && [ "$SL" -eq 0 ] && [ "$ST" -eq 0 ] && [ "$PROBE_FAIL" -eq 0 ]
diff --git a/tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh b/tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh
index b14b13a8..4ab196e0 100644
--- a/tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh
+++ b/tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh
@@ -1,7 +1,7 @@
 # exec-lock-block.sh — VERBATIM copy of project-bin/exec.sh's lock block (exec_lock_live .. the
-# LOCK_TAKEN check) from PR #324, branch fix/exec-followups @ 79de404. Used by
-# test-shared-lock-takeover.sh until #324 is merged; that fixture prefers the real exec.sh's block
-# once it carries exec_lock_takeover. Do not edit by hand — re-copy.
+# LOCK_TAKEN check) as on master d16f578 (first from PR #324 @ 79de404): the pre-ticket protocol.
+# The OLD code for tests/wave2/bench-lock-race.sh --old (which must reproduce its double holder) and
+# for test-lock-reap.sh's mixed-version case. Do not edit by hand.
 exec_lock_live() {  # $1 = pid from the lock; 0 iff that process is alive and plausibly exec.sh
   [ -n "$1" ] || return 1
   case "$1" in *[!0-9]*) return 1 ;; esac
diff --git a/tests/wave2/test-lock-reap.sh b/tests/wave2/test-lock-reap.sh
new file mode 100755
index 00000000..de1efb66
--- /dev/null
+++ b/tests/wave2/test-lock-reap.sh
@@ -0,0 +1,211 @@
+#!/usr/bin/env bash
+# test-lock-reap.sh — the shared lock in _common.sh (mxtk_lock_take / mxtk_lock_release): each
+# reap-ticket rule on its own, the compatibility with lines and takeover files the pre-ticket code
+# wrote, and a short run of the race harness.
+#
+# Usage: bash tests/wave2/test-lock-reap.sh [path-to-_common.sh]
+#   LOCK_REAP_ROUNDS (default 15) sets the harness run; 0 skips it. The full proof is
+#   tests/wave2/bench-lock-race.sh (200 rounds x 10, and --old for the old code's failure count).
+#
+# WHY (r-eng-backlog item 1, 2026-10-14): the old stale-lock takeover moved its `.takeover` file
+# aside and put it back with `ln`; a third contender could create a new one in between, two
+# contenders were then inside the takeover, and one's compare-then-rm deleted the other's fresh
+# lock. Reap tickets replace it: a ticket per stale line, the next only when the previous one's pid
+# is dead (never by age), and only the highest ticket's holder may remove the line it judged.
+#
+# Cases use the lock code's test anchors (MXTK_LOCK_TEST_PAUSE) to act at an exact point.
+set -uo pipefail
+TOOLKIT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+COMMON="${1:-$TOOLKIT/project-bin/_common.sh}"
+case "$COMMON" in /*) ;; *) COMMON="$PWD/$COMMON" ;; esac
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/lockreap.XXXXXX")" || exit 2
+WORK="$(cd "$WORK" && pwd -P)"
+BG=""
+trap 'for p in $BG; do kill -KILL "$p" 2>/dev/null; done; rm -rf "$WORK"' EXIT
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; }
+echo "== subject: $COMMON"
+grep -q '^mxtk_lock_take() {' "$COMMON" && ok "[setup] mxtk_lock_take present" || { bad "[setup] no mxtk_lock_take in $COMMON"; echo "PASS=$PASS FAIL=$FAIL"; exit 1; }
+
+L="$WORK/.exec.lock"
+# lk <snippet> — run a snippet in a fresh shell named like an exec.sh (the liveness rule needs it),
+# with _common.sh sourced, fast retries, and the lock path in $L.
+cat > "$WORK/lk-exec.sh" <<'S'
+PROJECT_ROOT="$WORK"; . "$COMMON"; MXTK_LOCK_RETRY_SLEEP=0.05
+eval "$1"
+S
+lk() { WORK="$WORK" COMMON="$COMMON" L="$L" bash "$WORK/lk-exec.sh" "$1" 2>&1; }
+live_holder() { bash -c 'exec -a "bash ./bin/exec.sh mdlsource/x.mdl" sleep 120' & LP=$!; BG="$BG $LP"; sleep 0.2; }
+dead_pid() { sleep 0 & local p=$!; wait "$p" 2>/dev/null; echo "$p"; }
+key() { printf '%s' "$1" | cksum | awk '{print $1 "-" $2}'; }
+reset() { rm -f "$L" "$L".reap.* "$L".tmp.* "$L.takeover"; }
+left() { ls -a "$WORK" | grep -E '^\.exec\.lock\.(reap|tmp)\.' | tr '\n' ' '; }
+
+echo "-- a free lock: taken, released, nothing left beside it"
+OUT="$(lk 'mxtk_lock_take "$L" "patch: a.mdl" 3; echo "rc=$?"; head -1 "$L"; mxtk_lock_release "$L"; [ -e "$L" ] && echo still-there')"
+case "$OUT" in *rc=0*) ok "taken (rc 0)" ;; *) bad "not taken: $OUT" ;; esac
+printf '%s\n' "$OUT" | grep -qE '^[0-9]+ [0-9]+ patch: a\.mdl nonce=[0-9]+$' && ok "line is '<pid> <epoch> <label> nonce=<n>'" || bad "line format: $OUT"
+case "$OUT" in *still-there*) bad "release left the lock" ;; *) ok "release removed it" ;; esac
+[ -z "$(left)" ] && ok "no ticket or temp file left" || bad "left: $(left)"
+
+echo "-- release removes only our own line (same pid, other nonce = not ours)"
+OUT="$(lk 'mxtk_lock_take "$L" x 3; printf "%s 1 x nonce=999\n" "$$" > "$L"; mxtk_lock_release "$L"; [ -e "$L" ] && echo kept')"
+case "$OUT" in *kept*) ok "a line with our pid but another nonce is kept" ;; *) bad "release removed a line that was not ours" ;; esac
+reset
+
+echo "-- a live holder refuses, untouched, no ticket taken"
+live_holder; printf '%s %s mdlsource/x.mdl nonce=1\n' "$LP" "$(date +%s)" > "$L"
+OUT="$(lk 'mxtk_lock_take "$L" me 3; echo "rc=$? held=$MXTK_LOCK_HELD"')"
+case "$OUT" in *"rc=1 held=$LP "*) ok "rc 1, MXTK_LOCK_HELD names the holder" ;; *) bad "$OUT" ;; esac
+[ "$(cut -d' ' -f1 "$L")" = "$LP" ] && ok "the lock still names the live holder" || bad "lock changed: $(cat "$L")"
+[ -z "$(left)" ] && ok "no ticket taken against a live holder" || bad "left: $(left)"
+kill -KILL "$LP" 2>/dev/null; wait "$LP" 2>/dev/null; reset
+
+echo "-- a dead holder is reaped: every line format the old and new code write"
+D="$(dead_pid)"
+for X in "$D $(date +%s) mdlsource/x.mdl nonce=42" "$D $(date +%s) patch: y.mdl" "$D"; do
+  printf '%s\n' "$X" > "$L"
+  OUT="$(lk 'mxtk_lock_take "$L" me 3; echo "rc=$?"; echo "reaped=$MXTK_LOCK_REAPED"; head -1 "$L"; mxtk_lock_release "$L"')"
+  case "$OUT" in *rc=0*"reaped=$X"*) ok "reaped '$X'" ;; *) bad "'$X' not reaped: $OUT" ;; esac
+  [ -z "$(left)" ] && ok "  its ticket cleared by the new holder" || bad "  left: $(left)"
+done
+reset
+
+echo "-- ticket N+1 only when ticket N's pid is dead — never by age"
+D="$(dead_pid)"; X="$D 1700000000 old.mdl nonce=7"; K="$(key "$X")"; printf '%s\n' "$X" > "$L"
+live_holder; printf '%s 1\n' "$LP" > "$L.reap.$K.1"; touch -t 200001010000 "$L.reap.$K.1"
+OUT="$(lk 'mxtk_lock_take "$L" me 3; echo "rc=$?"')"
+case "$OUT" in *rc=2*) ok "a live reaper's ticket (dated 2000) blocks: gave up (rc 2)" ;; *) bad "an old live ticket was overtaken: $OUT" ;; esac
+[ "$(cat "$L")" = "$X" ] && ok "the stale line was left to the live reaper" || bad "lock changed: $(cat "$L")"
+[ ! -e "$L.reap.$K.2" ] && ok "no ticket 2 taken while ticket 1 lives" || bad "ticket 2 taken over a live ticket 1"
+kill -KILL "$LP" 2>/dev/null; wait "$LP" 2>/dev/null
+printf '%s 1\n' "$(dead_pid)" > "$L.reap.$K.2"
+cat > "$WORK/seen.sh" <<'H'
+#!/usr/bin/env bash
+[ "$1" = ticket-taken ] && ls -a "$(dirname "$L")" | grep '\.reap\.' > "$WORK/seen"
+exit 0
+H
+chmod +x "$WORK/seen.sh"
+OUT="$(MXTK_LOCK_TEST_PAUSE="$WORK/seen.sh" lk 'export L WORK; mxtk_lock_take "$L" me 3; echo "rc=$?"; mxtk_lock_release "$L"')"
+case "$OUT" in *rc=0*) ok "tickets 1 and 2 dead → taken" ;; *) bad "$OUT" ;; esac
+grep -qx "\.exec\.lock\.reap\.$K\.3" "$WORK/seen" 2>/dev/null && ok "  as ticket 3 (the next after the highest)" || bad "  tickets seen: $(tr '\n' ' ' < "$WORK/seen" 2>/dev/null)"
+[ -z "$(left)" ] && ok "  and every ticket of that line cleared after" || bad "  left: $(left)"
+reset
+
+echo "-- the line changed under the ticket (compare anchor): nothing removed"
+D="$(dead_pid)"; printf '%s 1 old.mdl nonce=8\n' "$D" > "$L"; live_holder
+cat > "$WORK/swap.sh" <<'H'
+#!/usr/bin/env bash
+[ "$1" = compare ] && printf '%s %s fresh.mdl nonce=9\n' "$LP" "$(date +%s)" > "$L"
+exit 0
+H
+chmod +x "$WORK/swap.sh"
+OUT="$(LP="$LP" MXTK_LOCK_TEST_PAUSE="$WORK/swap.sh" lk 'export L LP; mxtk_lock_take "$L" me 3; echo "rc=$?"')"
+case "$OUT" in *rc=1*) ok "the new live line is respected (rc 1)" ;; *) bad "$OUT" ;; esac
+[ "$(cut -d' ' -f1 "$L")" = "$LP" ] && ok "the fresh lock survives" || bad "the fresh lock was removed: $(cat "$L" 2>/dev/null)"
+[ -z "$(left)" ] && ok "the reaper's ticket is gone (its line can never come back)" || bad "left: $(left)"
+kill -KILL "$LP" 2>/dev/null; wait "$LP" 2>/dev/null; reset
+
+echo "-- only the highest ticket may remove: a ticket N+1 appearing after ours stops the rm"
+D="$(dead_pid)"; X="$D 1 old.mdl nonce=10"; K="$(key "$X")"; printf '%s\n' "$X" > "$L"
+cat > "$WORK/over.sh" <<'H'
+#!/usr/bin/env bash
+[ "$1" = ticket-taken ] && [ ! -e "$WORK/over.done" ] && { : > "$WORK/over.done"; printf '999999 x\n' > "$L.reap.$K.2"; }
+exit 0
+H
+chmod +x "$WORK/over.sh"
+OUT="$(K="$K" MXTK_LOCK_TEST_PAUSE="$WORK/over.sh" lk 'export L K WORK; mxtk_lock_take "$L" me 1; echo "rc=$?"')"
+[ "$(cat "$L" 2>/dev/null)" = "$X" ] && ok "the stale line was not removed by a lower ticket" || bad "removed under a higher ticket: $OUT"
+reset; rm -f "$WORK/over.done"
+
+echo "-- a reaper SIGKILLed at its rm anchor does not block the next (instrument rule 7)"
+D="$(dead_pid)"; printf '%s 1 old.mdl nonce=11\n' "$D" > "$L"
+cat > "$WORK/die.sh" <<'H'
+#!/usr/bin/env bash
+[ "$1" = rm ] && kill -KILL "$2"
+exit 0
+H
+chmod +x "$WORK/die.sh"
+( MXTK_LOCK_TEST_PAUSE="$WORK/die.sh" lk 'mxtk_lock_take "$L" me 3' ) >/dev/null 2>&1
+[ -n "$(left)" ] && ok "[setup] the killed reaper left its ticket" || bad "[setup] no ticket left — case proves nothing"
+OUT="$(lk 'mxtk_lock_take "$L" me 3; echo "rc=$?"; mxtk_lock_release "$L"')"
+case "$OUT" in *rc=0*) ok "the next contender takes it at once" ;; *) bad "blocked by a dead reaper: $OUT" ;; esac
+[ -z "$(left)" ] && ok "and clears the dead ticket" || bad "left: $(left)"
+reset
+
+echo "-- the new holder clears tickets of other lines and temp files of dead pids"
+printf '1 x\n' > "$L.reap.123-45.1"; printf 'junk\n' > "$L.tmp.$(dead_pid)"
+OUT="$(lk 'mxtk_lock_take "$L" me 3; echo "rc=$?"; mxtk_lock_release "$L"')"
+[ -z "$(left)" ] && ok "cleared" || bad "left: $(left)"
+reset
+
+echo "-- an empty lock: fresh = being written (wait); over a minute old = stale"
+: > "$L"
+OUT="$(lk 'mxtk_lock_take "$L" me 2; echo "rc=$?"')"
+case "$OUT" in *rc=2*) ok "a fresh empty lock is waited on, not reaped" ;; *) bad "$OUT" ;; esac
+[ -e "$L" ] && [ ! -s "$L" ] && ok "  and left alone" || bad "  the fresh empty lock was touched"
+touch -t 200001010000 "$L"
+OUT="$(lk 'mxtk_lock_take "$L" me 2; echo "rc=$?"; mxtk_lock_release "$L"')"
+case "$OUT" in *rc=0*) ok "an empty lock over a minute old is reaped" ;; *) bad "$OUT" ;; esac
+reset
+
+echo "-- mixed versions: an old-style <lock>.takeover"
+D="$(dead_pid)"; printf '%s 1 old.mdl\n' "$D" > "$L"; live_holder
+printf '%s %s\n' "$LP" "$(date +%s)" > "$L.takeover"
+OUT="$(lk 'mxtk_lock_take "$L" me 2; echo "rc=$?"')"
+case "$OUT" in *rc=2*) ok "a live old takeover in progress: we back off" ;; *) bad "$OUT" ;; esac
+[ "$(cat "$L")" = "$D 1 old.mdl" ] && ok "  the stale line is left to it" || bad "  lock changed"
+kill -KILL "$LP" 2>/dev/null; wait "$LP" 2>/dev/null
+OUT="$(lk 'mxtk_lock_take "$L" me 2; echo "rc=$?"; mxtk_lock_release "$L"')"
+case "$OUT" in *rc=0*) ok "its pid dead: reaped" ;; *) bad "$OUT" ;; esac
+[ ! -e "$L.takeover" ] && ok "  and the dead takeover file cleared by the new holder" || bad "  takeover file left"
+printf '%s 1 old.mdl\n' "$D" > "$L"; : > "$L.takeover"
+OUT="$(lk 'mxtk_lock_take "$L" me 2; echo "rc=$?"')"
+case "$OUT" in *rc=2*) ok "a fresh EMPTY takeover file (old code between create and write) is respected" ;; *) bad "$OUT" ;; esac
+touch -t 200001010000 "$L.takeover"
+OUT="$(lk 'mxtk_lock_take "$L" me 2; echo "rc=$?"; mxtk_lock_release "$L"')"
+case "$OUT" in *rc=0*) ok "an empty one over a minute old is not" ;; *) bad "$OUT" ;; esac
+reset
+
+echo "-- mxtk_lock_fields"
+OUT="$(lk 'for x in "12 1700 patch: a.mdl nonce=9" "12 1700 a.mdl" "12"; do mxtk_lock_fields "$x"; echo "[$MXTK_LOCK_HPID|$MXTK_LOCK_HSINCE|$MXTK_LOCK_HLABEL]"; done')"
+[ "$OUT" = "[12|1700|patch: a.mdl]
+[12|1700|a.mdl]
+[12||?]" ] && ok "new, old and bare-pid lines parse; the nonce is never shown" || bad "$OUT"
+
+echo "-- mixed versions do not deadlock: old-block and new contenders on one dead holder"
+OLDB="$TOOLKIT/tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh"
+{ echo 'LOG_NAME=old.mdl'; echo 'ctake() {'; grep -v '^#' "$OLDB" | sed -e 's/sleep 1/sleep 0.05/' -e 's/^    exit 1$/    return 1/' -e 's/^  exit 1$/  return 2/'; echo '}'
+  echo 'crelease() { exec_lock_release; }'; } > "$WORK/old-impl.sh"
+printf 'PROJECT_ROOT="$WORK"; . "$COMMON"; MXTK_LOCK_RETRY_SLEEP=0.05\nctake() { mxtk_lock_take "$L" new 3; }\ncrelease() { mxtk_lock_release "$L"; }\n' > "$WORK/new-impl.sh"
+cat > "$WORK/mix-exec.sh" <<'M'
+LOCK="$L"; . "$IMPL"; end=$(( $(date +%s) + 20 ))
+while [ "$(date +%s)" -lt "$end" ]; do ctake >/dev/null 2>&1 && { echo got >> "$WORK/mixgot"; sleep 0.05; crelease; exit 0; }; sleep 0.02; done
+exit 1
+M
+MIXFAIL=0
+for r in 1 2 3; do
+  printf '%s 1 old.mdl\n' "$(dead_pid)" > "$L"; PIDS=""
+  for i in 1 2 3; do
+    WORK="$WORK" COMMON="$COMMON" L="$L" IMPL="$WORK/old-impl.sh" bash "$WORK/mix-exec.sh" & PIDS="$PIDS $!"
+    WORK="$WORK" COMMON="$COMMON" L="$L" IMPL="$WORK/new-impl.sh" bash "$WORK/mix-exec.sh" & PIDS="$PIDS $!"
+  done
+  for p in $PIDS; do wait "$p" || MIXFAIL=$((MIXFAIL + 1)); done
+  rm -f "$L.takeover"
+done
+[ "$MIXFAIL" -eq 0 ] && [ "$(wc -l < "$WORK/mixgot" | tr -d ' ')" -eq 18 ] && ok "all 18 contenders (9 old, 9 new) got the lock within 20 s" \
+  || bad "$MIXFAIL contenders never got the lock; $(wc -l < "$WORK/mixgot" 2>/dev/null | tr -d ' ') acquisitions of 18"
+reset
+
+ROUNDS="${LOCK_REAP_ROUNDS:-15}"
+if [ "$ROUNDS" -gt 0 ]; then
+  echo "-- race harness: $ROUNDS rounds x 10 contenders, SIGKILLs at every anchor and at random"
+  OUT="$(KILL_AT="ticket-taken compare rm created" bash "$TOOLKIT/tests/wave2/bench-lock-race.sh" --rounds "$ROUNDS" --common "$COMMON" 2>&1)"
+  R="$(printf '%s\n' "$OUT" | grep '^RESULT' | tail -1)"
+  case "$R" in *" overlaps=0 "*" stolen=0 starved=0 probe_fail=0 "*) ok "no overlap, no stolen lock, no starvation: $R" ;; *) bad "harness: $(printf '%s' "$OUT" | tail -6)" ;; esac
+fi
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-shared-lock-takeover.sh b/tests/wave2/test-shared-lock-takeover.sh
index 83a8ef07..3e65e13b 100644
--- a/tests/wave2/test-shared-lock-takeover.sh
+++ b/tests/wave2/test-shared-lock-takeover.sh
@@ -5,38 +5,37 @@
 # Usage: bash tests/wave2/test-shared-lock-takeover.sh [path-to-test-scratch.sh] [path-to-exec.sh]
 #
 # WHY (review of #304, PR #324): both scripts take the same per-project lock and both take over a dead
-# holder's lock. Each was made safe on its own by a serialised takeover (an O_EXCL `<lock>.takeover`,
-# re-read, remove only the exact stale line). Two private protocols would not exclude EACH OTHER: the
-# takeover file name and the compare-then-remove rule must be the same in both scripts.
+# holder's lock. Two private protocols would not exclude EACH OTHER. Since the reap-ticket change the
+# lock code lives once, in _common.sh (mxtk_lock_take / mxtk_lock_release), so the old awk-lifted
+# "keep in step" copies are gone.
 #
-# How: the lock code is lifted from each script (exec.sh: exec_lock_live .. the LOCK_TAKEN check;
-# test-scratch.sh: holder_live .. take_lock) into two small contender scripts whose names contain
-# "exec.sh" / "test-scratch.sh", so each script's liveness check recognises the other as a holder.
-# Rounds of 5 + 5 contenders start together on a lock whose holder pid is dead; each holder marks
-# itself in a shared dir while it holds the lock. Two marks at once = two holders = FAIL.
-# When the given exec.sh has no exec_lock_takeover yet (PR #324 unmerged), its block comes from the
-# verbatim copy in fixtures/mxtest-guard/exec-lock-block.sh, and says so.
+# How: checks that both scripts call the shared code on .mpr-snapshots/.exec.lock and keep no private
+# lock code, then races it as each script calls it (label, attempts) — two contender scripts whose
+# names contain "exec.sh" / "test-scratch.sh", so the liveness rule recognises each as a holder,
+# sourcing the _common.sh beside the given test-scratch.sh. Rounds of 5 + 5 contenders start together
+# on a lock whose holder pid is dead; each holder marks itself in a shared dir while it holds the
+# lock. Two marks at once = two holders = FAIL. The protocol itself: test-lock-reap.sh and
+# bench-lock-race.sh.
 set -uo pipefail
 TOOLKIT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 TS="${1:-$TOOLKIT/project-bin/test-scratch.sh}"; EX="${2:-$TOOLKIT/project-bin/exec.sh}"
+COMMON="$(cd "$(dirname "$TS")" && pwd)/_common.sh"
 PASS=0; FAIL=0
 ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
 bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; }
 WORK="$(mktemp -d "${TMPDIR:-/tmp}/sharedlock.XXXXXX")" || exit 2
 trap 'rm -rf "$WORK"' EXIT
 echo "== test-scratch: $TS"
+echo "== exec.sh: $EX"
+echo "== _common.sh: $COMMON"
 
-BLOCK="$WORK/exec-block.sh"
-awk '/^exec_lock_live\(\) \{/ {p=1} p {print} p && /^if \[ "\$LOCK_TAKEN" != 1 \]; then$/ {e=1} e && /^fi$/ {exit}' "$EX" > "$BLOCK"
-if grep -q '^exec_lock_takeover() {' "$BLOCK"; then echo "== exec.sh lock block: $EX"
-else
-  sed '1,4d' \
-    "$TOOLKIT/tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh"  > "$BLOCK"
-  echo "== exec.sh lock block: verbatim copy from PR #324 ($EX has no exec_lock_takeover yet)"
-fi
-grep -q '^exec_lock_takeover() {' "$BLOCK" && ok "[setup] exec.sh lock block lifted" || { bad "[setup] no exec.sh lock block"; echo "PASS=$PASS FAIL=$FAIL"; exit 1; }
-awk '/^holder_live\(\) \{/ {p=1} /^release\(\) \{/ {p=0} p' "$TS" > "$WORK/ts-block.sh"
-grep -q '^take_lock() {' "$WORK/ts-block.sh" && ok "[setup] test-scratch take_lock lifted" || { bad "[setup] no take_lock in $TS"; echo "PASS=$PASS FAIL=$FAIL"; exit 1; }
+grep -q '^mxtk_lock_take() {' "$COMMON" && ok "[setup] _common.sh has the shared lock" || { bad "[setup] no mxtk_lock_take in $COMMON"; echo "PASS=$PASS FAIL=$FAIL"; exit 1; }
+for f in "$EX" "$TS"; do
+  n="$(basename "$f")"
+  grep -q 'mxtk_lock_take "\$' "$f" && grep -q 'mxtk_lock_release "\$' "$f" && ok "$n takes and releases through _common.sh" || bad "$n does not call mxtk_lock_take/mxtk_lock_release"
+  grep -qE '^(exec_lock_(live|try|takeover|release)|holder_live|take_over)\(\)' "$f" && bad "$n still defines its own lock code" || ok "$n keeps no private lock code"
+  grep -q '\.mpr-snapshots/\.exec\.lock' "$f" && ok "$n locks .mpr-snapshots/.exec.lock" || bad "$n names another lock file"
+done
 
 LOCK="$WORK/.exec.lock"; HOLD="$WORK/holding"; mkdir -p "$HOLD"
 hold() {  # body shared by both contenders: mark, look for another mark, unmark
@@ -46,16 +45,17 @@ touch "$HOLD/$$"; n=$(ls "$HOLD" | wc -l | tr -d ' ')
 echo "$ROLE $$" >> "$WORK/holders"; sleep 0.3; rm -f "$HOLD/$$"
 H
 }
-{ echo 'LOCK="$1"; LOG_NAME="exec-contender"; ROLE=exec'; cat "$BLOCK"; hold
-  echo '_own="$(head -1 "$LOCK" 2>/dev/null)"; [ "${_own%% *}" = "$$" ] && rm -f "$LOCK"'; } > "$WORK/contender-exec.sh"
-{ echo 'LOCK="$1"; ROLE=scratch'; cat "$WORK/ts-block.sh"
-  echo 'take_lock "$LOCK" "the exec lock" >/dev/null 2>&1 || exit 1'; hold
-  echo '_own="$(head -1 "$LOCK" 2>/dev/null)"; [ "${_own%% *}" = "$$" ] && rm -f "$LOCK"'; } > "$WORK/contender-test-scratch.sh"
+{ printf 'LOCK="$1"; ROLE=exec; PROJECT_ROOT=%q; . %q\n' "$WORK" "$COMMON"
+  echo 'mxtk_lock_take "$LOCK" "exec-contender.mdl" 6 >/dev/null 2>&1 || exit 1'; hold
+  echo 'mxtk_lock_release "$LOCK"'; } > "$WORK/contender-exec.sh"
+{ printf 'LOCK="$1"; ROLE=scratch; PROJECT_ROOT=%q; . %q\n' "$WORK" "$COMMON"
+  echo 'mxtk_lock_take "$LOCK" "test-scratch.sh" 8 >/dev/null 2>&1 || exit 1'; hold
+  echo 'mxtk_lock_release "$LOCK"'; } > "$WORK/contender-test-scratch.sh"
 
 sleep 0 & DEAD=$!; wait "$DEAD"   # a pid that is certainly not running now
 ROUNDS=4
 for r in $(seq 1 "$ROUNDS"); do
-  printf '%s %s exec.sh\n' "$DEAD" "$(date +%s)" > "$LOCK"; rm -f "$LOCK.takeover"
+  printf '%s %s exec.sh\n' "$DEAD" "$(date +%s)" > "$LOCK"
   PIDS=""
   for i in 1 2 3 4 5; do
     WORK="$WORK" HOLD="$HOLD" bash "$WORK/contender-exec.sh" "$LOCK" >/dev/null 2>&1 & PIDS="$PIDS $!"
@@ -68,7 +68,8 @@ N="$(wc -l < "$WORK/holders" 2>/dev/null | tr -d ' ')"
 grep -q '^exec ' "$WORK/holders" 2>/dev/null && grep -q '^scratch ' "$WORK/holders" 2>/dev/null \
   && ok "both scripts won the lock at some point (they really contended)" || echo "  note: one script won every round: $(cut -d' ' -f1 "$WORK/holders" 2>/dev/null | sort | uniq -c | tr '\n' ' ')"
 if [ -s "$WORK/overlaps" ]; then bad "two holders at once: $(head -3 "$WORK/overlaps" | tr '\n' ' ')"; else ok "never two holders at once"; fi
-[ -e "$LOCK.takeover" ] && bad "takeover file left behind" || ok "no takeover file left behind"
+LEFT="$(ls -a "$WORK" | grep -E '^\.exec\.lock\.' | tr '\n' ' ')"
+[ -n "$LEFT" ] && bad "files left beside the lock: $LEFT" || ok "no ticket, temp or takeover file left behind"
 
 echo ""
 echo "PASS=$PASS FAIL=$FAIL"
diff --git a/tests/wave2/test-test-scratch.sh b/tests/wave2/test-test-scratch.sh
index 19db6b92..68a24727 100755
--- a/tests/wave2/test-test-scratch.sh
+++ b/tests/wave2/test-test-scratch.sh
@@ -93,42 +93,42 @@ OUT="$(run h -- tests/a.test.mdl -p Other.mpr)"; RC=$?
 
 
 echo "-- #304 review: a stale-lock takeover never removes a lock another run took meanwhile"
-# Deterministic replay of the race: the functions are lifted from the subject, and holder_live
-# is wrapped so that, while this run judges the dead holder, a second run completes its own
-# takeover and writes a live lock. The old code then `mv -f`'d that live lock away and took
-# the lock too — two holders. Taking over must re-read and leave a changed lock alone.
-H="$WORK/harness.sh"; L="$WORK/race.lock"
-awk '/^holder_live\(\) \{/ {p=1} /^release\(\) \{/ {p=0} p' "$SUBJECT" > "$H"
-grep -q '^take_lock() {' "$H" && ok "[setup] lifted holder_live..take_lock from the subject" || bad "[setup] could not lift take_lock"
+# Deterministic replay of the race, through the shared lock code test-scratch.sh calls
+# (_common.sh mxtk_lock_take, sourced from beside the subject): mxtk_lock_live is wrapped so that,
+# while this run judges the dead holder, a second run completes its own takeover and writes a live
+# lock. The pre-#304 code then `mv -f`'d that live lock away and took the lock too — two holders.
+# Taking over must re-read and leave a changed lock alone. Reap tickets: test-lock-reap.sh.
+H="$(cd "$(dirname "$SUBJECT")" && pwd)/_common.sh"; L="$WORK/race.lock"
+grep -q '^mxtk_lock_take() {' "$H" && grep -q 'mxtk_lock_take "\$1" "test-scratch.sh"' "$SUBJECT" \
+  && ok "[setup] the subject takes its locks through _common.sh's mxtk_lock_take" || bad "[setup] no shared mxtk_lock_take call in the subject"
 sleep 300 & LIVE=$!; BG="$BG $LIVE"
-OUT="$( L="$L" LIVE="$LIVE" bash -c '
+OUT="$( L="$L" LIVE="$LIVE" PROJECT_ROOT="$P" bash -c '
   . "$1"
-  eval "orig_$(declare -f holder_live)"
-  holder_live() {   # the dead holder is being judged: another run finishes ITS takeover now
+  eval "orig_$(declare -f mxtk_lock_live)"
+  mxtk_lock_live() {   # the dead holder is being judged: another run finishes ITS takeover now
     [ "$1" = 999999 ] && printf "%s %s %s\n" "$LIVE" "$(date +%s)" "test-scratch.sh" > "$L"
     [ "$1" = "$LIVE" ]
   }
   printf "999999 1 test-scratch.sh\n" > "$L"
-  take_lock "$L" "race lock"; echo "rc=$?"
+  mxtk_lock_take "$L" "test-scratch.sh" 8; echo "rc=$?"
 ' _ "$H" 2>&1 )"
 has "the second taker is refused (the live lock survives)" "$OUT" "rc=1"
 [ "$(cut -d' ' -f1 "$L" 2>/dev/null)" = "$LIVE" ] && ok "the lock still names the live holder" || bad "the live holder's lock was replaced: $(cat "$L" 2>/dev/null)"
-[ -e "$L.takeover" ] && bad "takeover marker left behind" || ok "takeover marker cleared"
-echo "-- a takeover marker whose pid is dead (a takeover that died midway) is cleared"
+ls -a "$WORK" | grep -qE '^race\.lock\.(reap|tmp)\.' && bad "reap ticket left behind" || ok "no reap ticket left behind"
+echo "-- an old-style takeover file whose pid is dead (pre-ticket code died midway) is cleared"
 printf '999999 1 test-scratch.sh\n' > "$L"; printf '999998 1\n' > "$L.takeover"
-OUT="$( L="$L" bash -c '. "$1"; holder_live() { return 1; }; take_lock "$L" "race lock"; echo "rc=$?"' _ "$H" 2>&1 )"
-has "taken after clearing the dead marker" "$OUT" "rc=0"
+OUT="$( L="$L" PROJECT_ROOT="$P" bash -c '. "$1"; mxtk_lock_live() { return 1; }; mxtk_lock_take "$L" "test-scratch.sh" 8; echo "rc=$?"' _ "$H" 2>&1 )"
+has "taken past the dead takeover file" "$OUT" "rc=0"
 [ "$(cut -d' ' -f1 "$L" 2>/dev/null)" != 999999 ] && ok "the stale line is gone" || bad "stale line still there"
-echo "-- #324 review: a FRESH empty takeover file (its creator between create and write) is not stale"
-# find -mmin +0 counted a 0-2 s old file as old (GNU; BSD rounds up), so a takeover in progress was
-# treated as dead and two contenders could both take over. +1 = empty for over a minute.
+[ -e "$L.takeover" ] && bad "dead takeover file left behind" || ok "and the dead takeover file is cleared"
+echo "-- #324 review: a FRESH empty takeover file (old code between create and write) is respected"
 printf '999999 1 test-scratch.sh\n' > "$L"; : > "$L.takeover"
-OUT="$( L="$L" bash -c '. "$1"; holder_live() { return 1; }; take_lock "$L" "race lock"; echo "rc=$?"' _ "$H" 2>&1 )"
-has "not taken while a fresh empty takeover file exists" "$OUT" "rc=1"
+OUT="$( L="$L" PROJECT_ROOT="$P" MXTK_LOCK_RETRY_SLEEP=0.05 bash -c '. "$1"; mxtk_lock_live() { return 1; }; mxtk_lock_take "$L" "test-scratch.sh" 8; echo "rc=$?"' _ "$H" 2>&1 )"
+has "not taken while a fresh empty takeover file exists" "$OUT" "rc=2"
 [ -e "$L.takeover" ] && [ ! -s "$L.takeover" ] && ok "the fresh takeover file was left alone" || bad "the fresh takeover file was removed or replaced"
 [ "$(cut -d' ' -f1 "$L" 2>/dev/null)" = 999999 ] && ok "the lock was not touched" || bad "the lock was taken over under a live takeover"
 touch -t 200001010000 "$L.takeover"
-OUT="$( L="$L" bash -c '. "$1"; holder_live() { return 1; }; take_lock "$L" "race lock"; echo "rc=$?"' _ "$H" 2>&1 )"
+OUT="$( L="$L" PROJECT_ROOT="$P" bash -c '. "$1"; mxtk_lock_live() { return 1; }; mxtk_lock_take "$L" "test-scratch.sh" 8; echo "rc=$?"' _ "$H" 2>&1 )"
 has "an empty takeover file over a minute old is stale → taken" "$OUT" "rc=0"
 [ -e "$L.takeover" ] && bad "takeover file left behind" || ok "and no takeover file is left behind"
 kill -KILL "$LIVE" 2>/dev/null; wait "$LIVE" 2>/dev/null

From 81981f2356861ea413035bb57ff38c9c80325230 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 14 Oct 2026 15:09:16 +0000
Subject: [PATCH 2/4] =?UTF-8?q?fix(lock):=20review=20of=20#379=20=E2=80=94?=
 =?UTF-8?q?=20empty=20stale=20line=20re-checked=20before=20rm;=20name=20a?=
 =?UTF-8?q?=20blocking=20reaper?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

1. An empty X is not unique: the old code (and the no-hard-link fallback)
   creates its lock empty and writes after, so a fresh empty lock could
   replace the stale one while a reaper sat between compare and rm. Before
   the rm, an empty X must still be over a minute old (find -mmin +1).
   test-lock-reap.sh swaps one in at the compare anchor; the case fails on
   a677671 and passes here.
2. When mxtk_lock_take gives up because a live reaper's ticket (or a live
   old-style .takeover) never finished, MXTK_LOCK_BLOCKER names the pid and
   file, and mxtk_lock_blocked_text says to resume (kill -CONT) or end it.
   exec.sh and test-scratch.sh print it on rc 2.

Bench, 60 rounds x 10 (Linux): default anchors 0 overlaps / 0 stolen /
0 starved / 0 probe failures; all four anchors the same.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                  |  2 +-
 project-bin/_common.sh        | 39 ++++++++++++++++++++++++++++++-----
 project-bin/exec.sh           |  8 +++++--
 project-bin/test-scratch.sh   |  3 ++-
 tests/wave2/test-lock-reap.sh | 19 ++++++++++++++++-
 5 files changed, 61 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 706dc5ab..11cd080c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,7 +19,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are. Named m
 
 ## Unreleased
 
-- fix(lock): **reap tickets close the stale-takeover race; one shared lock in `_common.sh`.** The old takeover serialised reaping through one `<lock>.takeover` file that went stale by pid or age and was moved aside and put back with `ln`; a contender creating a new one in that gap put two contenders inside the takeover, and one's compare-then-rm deleted the other's fresh lock. Now a dead holder's line X is reaped under tickets `<lock>.reap.<cksum X>.<N>` (written aside, then `ln`ed: exclusive, never empty); ticket N+1 is allowed only when ticket N's pid is dead, never by age; only the highest ticket's holder may `rm` X, and only while the lock still holds exactly X; the new holder clears other keys' tickets. Lock lines gain a `nonce=` field, so a line never comes back. `mxtk_lock_take` / `mxtk_lock_release` / `mxtk_lock_live` replace exec.sh's `exec_lock_*` and test-scratch.sh's `take_over`/`holder_live` copies; both scripts stop with the sync remedy on an older `_common.sh`. The lock path, line format and liveness rule stay readable by the old code, and a live old-style `.takeover` is waited on, so mixed versions do not deadlock. New `tests/wave2/bench-lock-race.sh` (SIGKILLs at test anchors and at random 0–50 ms; `MXTK_LOCK_TEST_PAUSE` hook, no-op unset) and `test-lock-reap.sh`; `test-shared-lock-takeover.sh` and `test-test-scratch.sh` source `_common.sh` instead of awk-lifting the code. Field evidence: none yet; needs one macOS and one Git Bash harness run. — r-eng-backlog item 1, MendixMau
+- fix(lock): **reap tickets close the stale-takeover race; one shared lock in `_common.sh`.** The old takeover serialised reaping through one `<lock>.takeover` file that went stale by pid or age and was moved aside and put back with `ln`; a contender creating a new one in that gap put two contenders inside the takeover, and one's compare-then-rm deleted the other's fresh lock. Now a dead holder's line X is reaped under tickets `<lock>.reap.<cksum X>.<N>` (written aside, then `ln`ed: exclusive, never empty); ticket N+1 is allowed only when ticket N's pid is dead, never by age; only the highest ticket's holder may `rm` X, and only while the lock still holds exactly X; the new holder clears other keys' tickets. Lock lines gain a `nonce=` field, so a line never comes back. `mxtk_lock_take` / `mxtk_lock_release` / `mxtk_lock_live` replace exec.sh's `exec_lock_*` and test-scratch.sh's `take_over`/`holder_live` copies; both scripts stop with the sync remedy on an older `_common.sh`. The lock path, line format and liveness rule stay readable by the old code, and a live old-style `.takeover` is waited on, so mixed versions do not deadlock. New `tests/wave2/bench-lock-race.sh` (SIGKILLs at test anchors and at random 0–50 ms; `MXTK_LOCK_TEST_PAUSE` hook, no-op unset) and `test-lock-reap.sh`; `test-shared-lock-takeover.sh` and `test-test-scratch.sh` source `_common.sh` instead of awk-lifting the code. An empty stale lock is removed only while it is still over a minute old (an empty line is not unique), and a give-up caused by a live reaper names its pid and ticket file and says to resume or end it (review of #379). Field evidence: none yet; needs one macOS and one Git Bash harness run. — r-eng-backlog item 1, MendixMau
 - process(build): **Stage 5 drafts the ready set in parallel and applies serially.** The runbook dispatch row said "sequential within a module", which serialised drafting even for independent scripts; it now points to `iterative-build-loop.md` → Gate cost, the single statement of the rule. The unit is the build-plan row: every `BUILD` row whose "Depends on" rows are all applied, minus overlapping writers (two rows that replace, alter or drop+create the same document never share a ready set, and no row is drafted while it overlaps a queued unapplied one; `brd-to-build-plan.md` has Produces name every document a row writes), runs at once, its scripts in order, one `mdl-agent` per script. Applies stay one at a time through `bin/exec.sh`, and the ready set is recomputed after each. A queued draft made before a sibling apply landed is re-checked with `mxcli diff --format struct` (preflight STOP rule 23); any removal line (checked against `describe` per BUG-146) or STOP rule 21 target means re-draft, never patch, because a stale restatement of a shared document is exactly rule 21's silent seed-call loss and passes `check --references`. Report `ready set N, drafted N, applied k`; the `mdl-agent` template says a drafter never applies and never depends on an unapplied draft. Field evidence: none yet. — MendixMau
 - fix(platform-link): **CLI commits now show their changed documents in Studio Pro History.** Studio Pro's History → Model changes pane reads a `ModelChanges` array from the commit's `refs/notes/mx_metadata` note. Trap 6c's hand-written template set it to `[]`, so every mxcli/agent commit showed "Model changes 0" (field project: 270 of 270 notes empty). New `project-bin/mx-metadata-note.py` (stdlib only) computes the array from the commit's changed `.mxunit` files, in Studio Pro's entry shape: Status, UnitID, UnitType, UnitName and Module (walked up the `.mpr` Unit tree). It has `changes` / `write` / `backfill` / `sync <remote>` subcommands. `install-project-hooks.sh` now also installs post-commit and post-rewrite hooks that write the note and never block, and `--check` covers them, so `sync-project.sh` rolls them out to wired projects. Notes are published with `mx-metadata-note.py sync <remote>` after the branch push. Push config is never touched. With mxcli v0.26+ in the project root the hooks call `mxcli git note --write` instead (mendixlabs/mxcli#1337); the Python script is the fallback for older pins, and on 160 field commits both wrote the same 3,594 entries. Trap 6c rewritten. Measured against Studio Pro's own notes, 51 commits in 5 apps: 3387/3389 entries exact on all five fields. Field run on a 357-commit Mendix 11.15.0 app: 158 notes backfilled and pushed, and Studio Pro History lists the documents per revision. Review fixes: an earlier revision added `HEAD` + the notes ref to `remote.<r>.push`. It was dropped because any push refspec replaces `push.default`. A branch tracking a differently named upstream got a new same-named branch on Team Server where `simple` refuses, a missing local notes ref failed the whole push, and nobody knows whether Studio Pro's own push reads that config. The installer now only fetches the remote's notes (non-forced). It removes that exact `HEAD` + notes pair if present, and leaves and reports any other entry. `sync` handles a remote with no notes ref (it used to exit 1) and retries a rejected push once after re-merging. A note that already lists changes (Studio Pro's) is never overwritten by `write`/`backfill` without `--force`, and `sync` keeps a colleague's non-empty note over ours. The mxcli probe greps `git note --help` for `--write`. Hooks and docs call the script through `resolve_py`. Fixture `tests/wave2/test-mx-metadata-note.sh` (40 cases, over real captured template units; single- and two-tree layouts, amend, backfill and `--force`, push exit codes identical to a no-hooks clone, leftover-refspec cleanup, sync to an empty remote and its retry, notes fetch at install, a diverged notes merge; green under `init.defaultBranch` master and main). — field project (Mendix 11.15 app), MendixMau
 - learn(fixture-seeding): **explore the data structure first, choose rows by use case, scan actions for resets before any run.** Two seeding runs on public template apps: seeding raised journey passes 33 -> 58 and 20 -> 51 of the same sets (FAIL 93 -> 68, 163 -> 132; INVALID unchanged), and a "Reset all demodata" journey wiped accounts so 104 of 127 journeys reported `The username or password you entered is incorrect`, identical on empty and seeded databases. Skill gains three questions a seed must answer, a use-case checklist, a destructive-action scan, a generic traps table with symptoms, measured expectations and a denominator checklist; routing trigger now fires on seed/test/demo data and empty pages. Independent review fixes: object ids follow the Mendix bigint pattern with a business-key guard (no uuids), associations are seeded where the page's path stores them, four new traps (enum names, inheritance chain, calculated attributes, view/external entities), and the port-offset and container-label traps moved to `harness-architecture.md`. — MendixMau
diff --git a/project-bin/_common.sh b/project-bin/_common.sh
index cdc351c0..3623358b 100755
--- a/project-bin/_common.sh
+++ b/project-bin/_common.sh
@@ -1019,7 +1019,9 @@ _mxtk_lock_legacy_busy() {
 # holds the highest ticket for X (or an old-style takeover is live) — wait and look again.
 _mxtk_lock_reap() {
   local L="$1" X="$2" key max=0 n f t
-  _mxtk_lock_legacy_busy "$L" && return 1
+  if _mxtk_lock_legacy_busy "$L"; then
+    MXTK_LOCK_BLOCKER="$(head -1 "$L.takeover" 2>/dev/null | cut -d' ' -f1) $L.takeover"; return 1
+  fi
   key="$(_mxtk_lock_key "$X")"
   for f in "$L.reap.$key".*; do
     n="${f##*.}"; case "$n" in ''|*[!0-9]*) continue ;; esac
@@ -1027,9 +1029,10 @@ _mxtk_lock_reap() {
   done
   if [ "$max" -gt 0 ]; then
     f="$L.reap.$key.$max"; t="$(head -1 "$f" 2>/dev/null || true)"
-    if [ -n "$t" ]; then mxtk_lock_live "${t%% *}" && return 1
+    if [ -n "$t" ]; then
+      mxtk_lock_live "${t%% *}" && { MXTK_LOCK_BLOCKER="${t%% *} $f"; return 1; }
     # Empty: only the no-hard-link fallback writes after the create. Its creator is mid-write.
-    elif [ -e "$f" ] && [ -z "$(find "$f" -mmin +1 2>/dev/null)" ]; then return 1; fi
+    elif [ -e "$f" ] && [ -z "$(find "$f" -mmin +1 2>/dev/null)" ]; then MXTK_LOCK_BLOCKER="? $f"; return 1; fi
   fi
   n=$((max + 1)); f="$L.reap.$key.$n"
   _mxtk_lock_excl "$L" "$f" "$$ $_MXTK_LOCK_NONCE" || return 1   # another reaper took N first
@@ -1039,6 +1042,12 @@ _mxtk_lock_reap() {
   _mxtk_lock_anchor compare
   if [ -e "$L" ] && [ "$(head -1 "$L" 2>/dev/null || true)" = "$X" ]; then
     _mxtk_lock_anchor rm
+    # An EMPTY X is not unique: the old code (and the no-hard-link fallback) creates its lock empty
+    # and writes after, so a fresh empty lock can replace the stale one under us. The stale one is
+    # over a minute old (mxtk_lock_take judged it so); a replacement is seconds old. Review of #379.
+    if [ -z "$X" ] && { [ -s "$L" ] || [ -z "$(find "$L" -mmin +1 2>/dev/null)" ]; }; then
+      rm -f "$f"; return 0
+    fi
     rm -f "$L"
     MXTK_LOCK_REAPED="$X"
     return 0   # the ticket stays until the next holder clears it
@@ -1066,10 +1075,12 @@ _mxtk_lock_gc() {
 
 # mxtk_lock_take <lockfile> <label> [tries=6] — 0 taken (MXTK_LOCK_REAPED = the dead holder's line
 # when we reaped one, else ""); 1 a live holder has it (MXTK_LOCK_HELD = its line); 2 gave up after
-# <tries> attempts (others kept taking it). Call it directly, not in $( ): it sets variables.
+# <tries> attempts (others kept taking it, or MXTK_LOCK_BLOCKER = "<pid> <file>": a live reaper's
+# ticket, or an old-style takeover file, that never finished — mxtk_lock_blocked_text says what to
+# do). Call it directly, not in $( ): it sets variables.
 mxtk_lock_take() {
   local L="$1" label="$2" tries="${3:-6}" i=0 held line slp="${MXTK_LOCK_RETRY_SLEEP:-1}"
-  MXTK_LOCK_HELD=""; MXTK_LOCK_REAPED=""
+  MXTK_LOCK_HELD=""; MXTK_LOCK_REAPED=""; MXTK_LOCK_BLOCKER=""
   [ -n "${_MXTK_LOCK_NONCE:-}" ] || _MXTK_LOCK_NONCE="$$$RANDOM$RANDOM$(date +%s)"
   line="$$ $(date +%s) $label nonce=$_MXTK_LOCK_NONCE"
   while [ "$i" -lt "$tries" ]; do
@@ -1088,6 +1099,7 @@ mxtk_lock_take() {
     elif mxtk_lock_live "${held%% *}"; then
       MXTK_LOCK_HELD="$held"; return 1
     fi
+    MXTK_LOCK_BLOCKER=""
     _mxtk_lock_reap "$L" "$held" && continue
     sleep "$slp"   # another live reaper is on it; see who won
   done
@@ -1095,6 +1107,23 @@ mxtk_lock_take() {
   return 2
 }
 
+# mxtk_lock_blocked_text — after rc 2, when a live reaper blocked the reap: which pid and which file,
+# and what to do. A reaper normally holds its ticket for milliseconds; one that does not is stopped
+# (Ctrl+Z / SIGSTOP), hung, or a dead reaper's pid reused by another exec.sh-named process where
+# `ps -o args=` cannot tell them apart (Git Bash). Prints nothing when MXTK_LOCK_BLOCKER is empty.
+mxtk_lock_blocked_text() {
+  local p="${MXTK_LOCK_BLOCKER%% *}" f="${MXTK_LOCK_BLOCKER#* }"
+  [ -n "${MXTK_LOCK_BLOCKER:-}" ] || return 0
+  echo "  The dead holder's lock is being reaped by PID $p, which is alive but has not finished:"
+  echo "    $f"
+  if [ "$p" = "?" ]; then
+    echo "  → Its creator died mid-write; it stops counting a minute after it was created. Re-run then."
+  else
+    echo "  → If PID $p is stopped (Ctrl+Z), resume it: kill -CONT $p (or fg in its terminal)."
+    echo "    If it is hung, or not an exec.sh / test-scratch.sh at all (a reused pid), end it: kill $p — then re-run."
+  fi
+}
+
 # mxtk_lock_release <lockfile> — remove it only while it holds our own line (pid AND nonce).
 mxtk_lock_release() {
   local own
diff --git a/project-bin/exec.sh b/project-bin/exec.sh
index 134bc97d..0d1badf4 100755
--- a/project-bin/exec.sh
+++ b/project-bin/exec.sh
@@ -531,8 +531,12 @@ if [ "$_lrc" = 1 ]; then
   echo "    (A dead holder is detected and taken over automatically — no manual rm is ever needed.)"
   exit 1
 elif [ "$_lrc" != 0 ]; then
-  echo "✗ Could not take the exec lock $LOCK after 6 attempts — another session keeps re-taking it."
-  echo "  → Wait for the other exec to finish, then re-run. Nothing was written."
+  if [ -n "$MXTK_LOCK_BLOCKER" ]; then
+    echo "✗ Could not take the exec lock $LOCK after 6 attempts. Nothing was written."; mxtk_lock_blocked_text
+  else
+    echo "✗ Could not take the exec lock $LOCK after 6 attempts — another session keeps re-taking it."
+    echo "  → Wait for the other exec to finish, then re-run. Nothing was written."
+  fi
   exit 1
 fi
 [ -z "$MXTK_LOCK_REAPED" ] || echo "  (stale exec lock from PID ${MXTK_LOCK_REAPED%% *}, which is not running — taking it over)"
diff --git a/project-bin/test-scratch.sh b/project-bin/test-scratch.sh
index c87a28fe..4b2edd9b 100755
--- a/project-bin/test-scratch.sh
+++ b/project-bin/test-scratch.sh
@@ -171,7 +171,8 @@ take_lock() {  # $1 = lock file, $2 = what it guards (for messages). 0 = taken,
        echo "✗ test-scratch: $2 is held by PID $MXTK_LOCK_HPID ($MXTK_LOCK_HLABEL) — wait for it to finish." >&2
        return 1 ;;
   esac
-  echo "✗ test-scratch: could not take the lock on $2 after 8 attempts." >&2; return 1
+  echo "✗ test-scratch: could not take the lock on $2 after 8 attempts." >&2
+  mxtk_lock_blocked_text >&2; return 1
 }
 release() { mxtk_lock_release "$1"; }
 
diff --git a/tests/wave2/test-lock-reap.sh b/tests/wave2/test-lock-reap.sh
index de1efb66..a1768dac 100755
--- a/tests/wave2/test-lock-reap.sh
+++ b/tests/wave2/test-lock-reap.sh
@@ -75,8 +75,10 @@ reset
 echo "-- ticket N+1 only when ticket N's pid is dead — never by age"
 D="$(dead_pid)"; X="$D 1700000000 old.mdl nonce=7"; K="$(key "$X")"; printf '%s\n' "$X" > "$L"
 live_holder; printf '%s 1\n' "$LP" > "$L.reap.$K.1"; touch -t 200001010000 "$L.reap.$K.1"
-OUT="$(lk 'mxtk_lock_take "$L" me 3; echo "rc=$?"')"
+OUT="$(lk 'mxtk_lock_take "$L" me 3; echo "rc=$? blocker=$MXTK_LOCK_BLOCKER"; mxtk_lock_blocked_text')"
 case "$OUT" in *rc=2*) ok "a live reaper's ticket (dated 2000) blocks: gave up (rc 2)" ;; *) bad "an old live ticket was overtaken: $OUT" ;; esac
+case "$OUT" in *"blocker=$LP $L.reap.$K.1"*) ok "  MXTK_LOCK_BLOCKER names the reaper's pid and ticket file" ;; *) bad "  blocker not named: $OUT" ;; esac
+case "$OUT" in *"kill -CONT $LP"*"kill $LP"*) ok "  and the message says to resume or end that pid (review of #379)" ;; *) bad "  no remedy in: $OUT" ;; esac
 [ "$(cat "$L")" = "$X" ] && ok "the stale line was left to the live reaper" || bad "lock changed: $(cat "$L")"
 [ ! -e "$L.reap.$K.2" ] && ok "no ticket 2 taken while ticket 1 lives" || bad "ticket 2 taken over a live ticket 1"
 kill -KILL "$LP" 2>/dev/null; wait "$LP" 2>/dev/null
@@ -150,6 +152,21 @@ OUT="$(lk 'mxtk_lock_take "$L" me 2; echo "rc=$?"; mxtk_lock_release "$L"')"
 case "$OUT" in *rc=0*) ok "an empty lock over a minute old is reaped" ;; *) bad "$OUT" ;; esac
 reset
 
+echo "-- an EMPTY stale lock replaced mid-reap by a fresh empty one is not removed (review of #379)"
+# An empty line is not unique: the old code creates its lock empty and writes after. A reaper of an
+# old empty lock, paused at compare while that lock is replaced by a fresh empty one, must not rm it.
+: > "$L"; touch -t 200001010000 "$L"
+cat > "$WORK/empty-swap.sh" <<'H'
+#!/usr/bin/env bash
+[ "$1" = compare ] && { rm -f "$L"; : > "$L"; }
+exit 0
+H
+chmod +x "$WORK/empty-swap.sh"
+OUT="$(MXTK_LOCK_TEST_PAUSE="$WORK/empty-swap.sh" lk 'export L; mxtk_lock_take "$L" me 1; echo "rc=$?"')"
+[ -e "$L" ] && [ ! -s "$L" ] && [ -z "$(find "$L" -mmin +1 2>/dev/null)" ] && ok "the fresh empty lock survives" || bad "the fresh empty lock was removed: $OUT"
+[ -z "$(left)" ] && ok "  and the reaper's ticket is gone" || bad "  left: $(left)"
+reset
+
 echo "-- mixed versions: an old-style <lock>.takeover"
 D="$(dead_pid)"; printf '%s 1 old.mdl\n' "$D" > "$L"; live_holder
 printf '%s %s\n' "$LP" "$(date +%s)" > "$L.takeover"

From c932fa1bc532a50a35bb3ddcca2aab83ff0a613c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 15 Oct 2026 04:34:31 +0000
Subject: [PATCH 3/4] fix(lock): clear MXTK_LOCK_BLOCKER at the start of every
 take attempt

Review nit on #379: it described a blocker from an earlier attempt when the
last attempt ended for another reason (a fresh empty lock being written).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 project-bin/_common.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/project-bin/_common.sh b/project-bin/_common.sh
index 039ea9b8..879096d4 100755
--- a/project-bin/_common.sh
+++ b/project-bin/_common.sh
@@ -1100,7 +1100,7 @@ mxtk_lock_take() {
   [ -n "${_MXTK_LOCK_NONCE:-}" ] || _MXTK_LOCK_NONCE="$$$RANDOM$RANDOM$(date +%s)"
   line="$$ $(date +%s) $label nonce=$_MXTK_LOCK_NONCE"
   while [ "$i" -lt "$tries" ]; do
-    i=$((i + 1))
+    i=$((i + 1)); MXTK_LOCK_BLOCKER=""   # describes the LAST attempt only
     if _mxtk_lock_excl "$L" "$L" "$line"; then
       _mxtk_lock_anchor created
       _mxtk_lock_gc "$L" "$line"
@@ -1115,7 +1115,6 @@ mxtk_lock_take() {
     elif mxtk_lock_live "${held%% *}"; then
       MXTK_LOCK_HELD="$held"; return 1
     fi
-    MXTK_LOCK_BLOCKER=""
     _mxtk_lock_reap "$L" "$held" && continue
     sleep "$slp"   # another live reaper is on it; see who won
   done

From 91398419c4886c1fdf03640189686729beebad73 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 15 Oct 2026 06:02:34 +0000
Subject: [PATCH 4/4] fix(lock): older-_common.sh remedy uses --only-bin (#396)

exec.sh and test-scratch.sh told users to run sync-project.sh with
--upgrade-bin _common.sh alone, which runs a full sync. They now give
--only-bin _common.sh --upgrade-bin _common.sh, matching test-scratch.sh's
mxtest guard on master. app-restart.sh is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 project-bin/exec.sh         | 2 +-
 project-bin/test-scratch.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/project-bin/exec.sh b/project-bin/exec.sh
index ae311702..5884487a 100755
--- a/project-bin/exec.sh
+++ b/project-bin/exec.sh
@@ -576,7 +576,7 @@ fi
 #    a dead holder is reaped under a ticket, never by age (see the block header there).
 command -v mxtk_lock_take >/dev/null 2>&1 || {
   echo "exec.sh: bin/_common.sh is older than this script (no mxtk_lock_take)." >&2
-  echo "  → <toolkit>/bin/sync-project.sh $PROJECT_ROOT --upgrade-bin _common.sh   (backs up a hand-edited copy first)" >&2; exit 2; }
+  echo "  → <toolkit>/bin/sync-project.sh $PROJECT_ROOT --only-bin _common.sh --upgrade-bin _common.sh   (installs just that file; backs up a hand-edited copy first)" >&2; exit 2; }
 _lrc=0; mxtk_lock_take "$LOCK" "$LOG_NAME" 6 || _lrc=$?
 if [ "$_lrc" = 1 ]; then
   mxtk_lock_fields "$MXTK_LOCK_HELD"; _age=""
diff --git a/project-bin/test-scratch.sh b/project-bin/test-scratch.sh
index 1fed2bef..a3208fb8 100755
--- a/project-bin/test-scratch.sh
+++ b/project-bin/test-scratch.sh
@@ -82,7 +82,7 @@ fi
 # under a ticket, never by age (see the block header in _common.sh).
 command -v mxtk_lock_take >/dev/null 2>&1 || {
   echo "test-scratch: bin/_common.sh is older than this script (no mxtk_lock_take)." >&2
-  echo "  → <toolkit>/bin/sync-project.sh $PROJECT_ROOT --upgrade-bin _common.sh   (backs up a hand-edited copy first)" >&2; exit 2; }
+  echo "  → <toolkit>/bin/sync-project.sh $PROJECT_ROOT --only-bin _common.sh --upgrade-bin _common.sh   (installs just that file; backs up a hand-edited copy first)" >&2; exit 2; }
 take_lock() {  # $1 = lock file, $2 = what it guards (for messages). 0 = taken, 1 = live holder
   local rc=0
   mxtk_lock_take "$1" "test-scratch.sh" 8 || rc=$?