diff --git a/CHANGELOG.md b/CHANGELOG.md
index 07ed1ea4..a1ad3d57 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are. Named m
 
 ## Unreleased
 
+- fix(lock): **reap tickets close the stale-takeover race; one shared lock in `_common.sh`.** The old takeover serialised reaping through one `<lock>.takeover` file that went stale by pid or age and was moved aside and put back with `ln`; a contender creating a new one in that gap put two contenders inside the takeover, and one's compare-then-rm deleted the other's fresh lock. Now a dead holder's line X is reaped under tickets `<lock>.reap.<cksum X>.<N>` (written aside, then `ln`ed: exclusive, never empty); ticket N+1 is allowed only when ticket N's pid is dead, never by age; only the highest ticket's holder may `rm` X, and only while the lock still holds exactly X; the new holder clears other keys' tickets. Lock lines gain a `nonce=` field, so a line never comes back. `mxtk_lock_take` / `mxtk_lock_release` / `mxtk_lock_live` replace exec.sh's `exec_lock_*` and test-scratch.sh's `take_over`/`holder_live` copies; both scripts stop with the sync remedy on an older `_common.sh`. The lock path, line format and liveness rule stay readable by the old code, and a live old-style `.takeover` is waited on, so mixed versions do not deadlock. New `tests/wave2/bench-lock-race.sh` (SIGKILLs at test anchors and at random 0–50 ms; `MXTK_LOCK_TEST_PAUSE` hook, no-op unset) and `test-lock-reap.sh`; `test-shared-lock-takeover.sh` and `test-test-scratch.sh` source `_common.sh` instead of awk-lifting the code. An empty stale lock is removed only while it is still over a minute old (an empty line is not unique), and a give-up caused by a live reaper names its pid and ticket file and keeps two remedies apart: a stopped or hung exec.sh / test-scratch.sh reaper is resumed or ended, a pid that is not one (reused) is never killed — its ticket is deleted (`rm -- "<ticket>"`); a give-up on an empty lock file under a minute old says so (a crashed take: re-run in a minute or delete it) instead of "another session keeps re-taking it"; the bench's own liveness check counts an empty `ps -o args=` as alive, like the lock, so on Git Bash `--old` can show its overlaps; an uncontended take skips the ticket cksum when no ticket exists (reviews of #379). Field evidence: `bench-lock-race.sh` 200 rounds × 10 contenders on macOS 26.6 arm64 / bash 3.2.57 PASS (0 overlaps, 0 stolen; `--old` 21 overlaps, 18 stolen; #390); the Git Bash run is still owed. Brought current with master 2026-11-03: the shared lock reads the clock as `${EPOCHSECONDS:-$(date +%s)}`, like exec.sh since #590, and exec.sh's EXIT trap keeps the `MXTK_PROFILE` report. — r-eng-backlog item 1, MendixMau
 - fix(exec): **a write no longer leaves units that changed only in XPath whitespace for the reviewer to read.** mxcli v0.27.0's `alter entity … rename attribute` rewrote 135 units in 20 unrelated modules that way (mendixlabs/mxcli#1596; fixed upstream in v0.29.0, ako/mxcli#1506, so this is insurance for projects on v0.27–v0.28). `exec.sh` now runs `model-scope.py restore` after the write (MDL and `--patch`) and before the mxbuild gate, so the gate checks the final model; it prints the real changes per module and puts a `scope:` note in the BUILD-LOG row. It never blocks: a failure is a warning, `MXTK_NO_SCOPE=1` skips it, and it is skipped when `FORCE_EXEC` let the write run over uncommitted model changes. No pre-commit refusal (maintainer decision on #593): `model-scope.py check --staged` stays available to run by hand. Fixture `tests/wave2/test-model-scope.sh` section F. Ported from #593 onto current master — saingge
 - learn(demo): **`skills/live-demo-autopilot.md` — run the demo live, not as a video**: Playwright drives the real app through scripted scenes, captions carry a WHY line, a control panel lets the presenter pause and take over, redo or skip; plus the traps that each broke a run (trial licence stops the runtime 2–4 h after start, 6-session cap and proving a logout freed its slot by the `System.Session` count, demo sign-in tiles kept out of any deployed build, focus-stealing panel pausing the run, SIGTERM closing the browser before sign-out). Field: a desktop+phone offline manufacturing demo (4/4 scenes) and a three-app process-hub demo (28/28 with an app killed mid-run and an 11 min pause), 2026-10 — Maurits Visser
 - docs(bug-ledger): **32 ledger entries now say what mxcli v0.22–v0.29 changed about them, before anyone re-runs an old workaround**: 22 are fixed upstream per the mxcli changelog or source (among them BUG-121 terminators, BUG-141 workflow PersistentId, BUG-151 `rest call body $Var`, BUG-100 shared Docker stack, BUG-94 role visibility, BUG-128 module-role idempotence) and 10 changed shape or are partly fixed (BUG-154; BUG-04 no automatic module role since v0.27, BUG-WF04/WF05 named call arguments since v0.25, BUG-130/131 vs the v0.27 `exec` rollback). Each gets an "Upstream status" line naming the version, the issue and what to retest; none is closed or archived, because none was retested — the ledger archives only after a retest. Also corrects `BUG-DRAFT-audit-member-access-ce0066`: commit `2455ee9f` first shipped in v0.23.0, not v0.22. Source: mxcli v0.29 compatibility audit 2026-10-30
diff --git a/project-bin/_common.sh b/project-bin/_common.sh
index 551e0956..724a7618 100755
--- a/project-bin/_common.sh
+++ b/project-bin/_common.sh
@@ -1406,6 +1406,236 @@ EOF_ARGS
   return 1
 }
 
+# ---------------------------------------------------------------------------
+# The shared lock: mxtk_lock_take / mxtk_lock_release / mxtk_lock_live (+ mxtk_lock_fields)
+#
+# One implementation for exec.sh (the per-project .mpr-snapshots/.exec.lock) and test-scratch.sh
+# (the same file, plus the machine-wide test-port lock). Bash 3.2, POSIX tools, no flock (macOS and
+# Git Bash ship none). It replaces two "keep in step" copies (exec_lock_* / take_over).
+#
+# The lock file holds one line, "<pid> <epoch> <label> nonce=<n>". The nonce makes every line ever
+# written unique, so a line that has left the file never comes back; a line from the pre-nonce code
+# ("<pid> <epoch> <label>", or a bare pid) reads the same way. The holder is LIVE while its pid is
+# alive, not a zombie, and (where `ps -o args=` can say) an exec.sh or test-scratch.sh — the rule the
+# old code used, so a holder written by either version is respected by both.
+#
+# A dead holder's line X is REAPED under a ticket, never by age:
+#   1. reap tickets are files <lock>.reap.<cksum of X>.<N>, holding "<pid> <nonce>", each created
+#      exclusively and never empty (written to <lock>.tmp.<pid>, then `ln`ed into place);
+#   2. ticket N+1 may be taken only when ticket N's pid is dead (same liveness rule) — a live
+#      reaper is never overtaken, however long it takes;
+#   3. only the holder of the highest ticket for X re-reads the lock and removes it, and only if it
+#      still holds exactly X. Then it creates its own lock exclusively, like anyone else;
+#   4. a new holder deletes the tickets of every other key (X is gone for good once replaced).
+# WHY (r-eng-backlog item 1, 2026-10-14): the previous protocol serialised reaping through one
+# `<lock>.takeover` file that went stale by pid OR age and was moved aside and put back with `ln`.
+# While it was moved aside a third contender created a fresh one, the `ln` failed, and two
+# contenders were inside the takeover at once: E read the stale line, D removed it and took a fresh
+# lock, then E's `rm` deleted D's lock — two holders. Re-checking just before the `rm` (a rejected
+# attempt) only narrowed that window. Under tickets the compare and the `rm` belong to one live
+# process per X, and X cannot reappear, so the compare-then-rm cannot hit a fresh lock.
+# Proof: tests/wave2/bench-lock-race.sh reproduces the double holder on the old block and finds
+# none here; tests/wave2/test-lock-reap.sh covers each rule.
+#
+# Mixed versions (a project bin/ older than another session's): the lock file, its line and the
+# liveness rule are unchanged, so neither version deadlocks the other. This code also backs off
+# while a live old-style <lock>.takeover exists (pid alive and under 10 s old, or empty and under
+# a minute — the old code's own rule) and clears a stale one once it holds the lock.
+#
+# ANCHOR(lock-test): MXTK_LOCK_TEST_PAUSE, when set, names a command run as `<cmd> <anchor> <pid>`
+# at: ticket-taken (right after a reap ticket is created), compare (before the re-read of the
+# lock), rm (after the compare matched, before the rm) and created (right after a lock is taken).
+# The race harness pauses there or SIGKILLs <pid>. Unset = no-op. MXTK_LOCK_RETRY_SLEEP (default 1
+# s) is the pause between attempts.
+# ---------------------------------------------------------------------------
+_mxtk_lock_anchor() { [ -z "${MXTK_LOCK_TEST_PAUSE:-}" ] || "$MXTK_LOCK_TEST_PAUSE" "$1" "$$" || true; }
+
+# mxtk_lock_live <pid> — 0 iff that process is alive, not a zombie, and plausibly a lock holder.
+mxtk_lock_live() {
+  local a
+  [ -n "${1:-}" ] || return 1
+  case "$1" in *[!0-9]*) return 1 ;; esac
+  kill -0 "$1" 2>/dev/null || return 1
+  # Linux: an unreaped zombie still answers kill -0; /proc/<pid>/stat says Z after the "(comm) ".
+  case "$(sed 's/.*) //' "/proc/$1/stat" 2>/dev/null | cut -d' ' -f1)" in Z) return 1 ;; esac
+  # A pid reused by an unrelated process is dead to us; where ps cannot show args (Git Bash),
+  # kill -0 alone decides. test-scratch.sh holds the exec lock while it copies the model.
+  a="$(ps -o args= -p "$1" 2>/dev/null || true)"
+  case "$a" in ""|*exec.sh*|*test-scratch.sh*) return 0 ;; esac
+  return 1
+}
+
+# mxtk_lock_fields "<line>" — sets MXTK_LOCK_HPID, MXTK_LOCK_HSINCE (epoch or "") and
+# MXTK_LOCK_HLABEL ("?" for a bare-pid line), the nonce left out. For messages only.
+mxtk_lock_fields() {
+  local l="${1% nonce=*}" rest
+  MXTK_LOCK_HPID="${l%% *}"; MXTK_LOCK_HSINCE=""; MXTK_LOCK_HLABEL="?"
+  rest="${l#* }"; [ "$rest" = "$l" ] && return 0
+  MXTK_LOCK_HSINCE="${rest%% *}"
+  [ "${rest#* }" = "$rest" ] || MXTK_LOCK_HLABEL="${rest#* }"
+  case "$MXTK_LOCK_HSINCE" in ''|*[!0-9]*) MXTK_LOCK_HSINCE="" ;; esac
+  return 0
+}
+
+_mxtk_lock_key() { printf '%s' "$1" | cksum | awk '{print $1 "-" $2}'; }
+
+# _mxtk_lock_excl <lock> <target> <content> — create <target> holding <content>, exclusively and
+# never empty: written to <lock>.tmp.<pid>, then hard-linked (ln fails when <target> exists). On a
+# filesystem without hard links (FAT/exFAT, some shares) ln fails with <target> absent; then an
+# O_EXCL create (noclobber) is used, which has the old written-after-create window.
+_mxtk_lock_excl() {
+  local tmp="$1.tmp.$$" rc=1
+  printf '%s\n' "$3" > "$tmp" 2>/dev/null || return 1
+  if ln "$tmp" "$2" 2>/dev/null; then rc=0
+  elif [ ! -e "$2" ] && [ -e "$tmp" ]; then
+    ( set -o noclobber; printf '%s\n' "$3" > "$2" ) 2>/dev/null && rc=0
+  fi
+  rm -f "$tmp"
+  return "$rc"
+}
+
+# _mxtk_lock_legacy_busy <lock> — 0 while an old-style <lock>.takeover is live by the old rule.
+_mxtk_lock_legacy_busy() {
+  local t since
+  [ -e "$1.takeover" ] || return 1
+  t="$(head -1 "$1.takeover" 2>/dev/null || true)"
+  if [ -z "$t" ]; then [ -z "$(find "$1.takeover" -mmin +1 2>/dev/null)" ]; return; fi
+  since="${t#* }"; since="${since%% *}"; case "$since" in ''|*[!0-9]*) since=0 ;; esac
+  kill -0 "${t%% *}" 2>/dev/null && [ $(( ${EPOCHSECONDS:-$(date +%s)} - since )) -le 10 ]
+}
+
+# _mxtk_lock_reap <lock> <stale line X> — 0 when the lock no longer holds X (we removed it, or it
+# had changed: X never comes back, try to take the lock again at once); 1 when another live reaper
+# holds the highest ticket for X (or an old-style takeover is live) — wait and look again.
+_mxtk_lock_reap() {
+  local L="$1" X="$2" key max=0 n f t
+  if _mxtk_lock_legacy_busy "$L"; then
+    MXTK_LOCK_BLOCKER="$(head -1 "$L.takeover" 2>/dev/null | cut -d' ' -f1) $L.takeover"; return 1
+  fi
+  key="$(_mxtk_lock_key "$X")"
+  for f in "$L.reap.$key".*; do
+    n="${f##*.}"; case "$n" in ''|*[!0-9]*) continue ;; esac
+    [ "$n" -gt "$max" ] && max="$n"
+  done
+  if [ "$max" -gt 0 ]; then
+    f="$L.reap.$key.$max"; t="$(head -1 "$f" 2>/dev/null || true)"
+    if [ -n "$t" ]; then
+      mxtk_lock_live "${t%% *}" && { MXTK_LOCK_BLOCKER="${t%% *} $f"; return 1; }
+    # Empty: only the no-hard-link fallback writes after the create. Its creator is mid-write.
+    elif [ -e "$f" ] && [ -z "$(find "$f" -mmin +1 2>/dev/null)" ]; then MXTK_LOCK_BLOCKER="? $f"; return 1; fi
+  fi
+  n=$((max + 1)); f="$L.reap.$key.$n"
+  _mxtk_lock_excl "$L" "$f" "$$ $_MXTK_LOCK_NONCE" || return 1   # another reaper took N first
+  _mxtk_lock_anchor ticket-taken
+  # Ours is the highest: N+1 needs our pid dead. Checked anyway — the rule, not an inference.
+  [ -e "$L.reap.$key.$((n + 1))" ] && return 1
+  _mxtk_lock_anchor compare
+  if [ -e "$L" ] && [ "$(head -1 "$L" 2>/dev/null || true)" = "$X" ]; then
+    _mxtk_lock_anchor rm
+    # An EMPTY X is not unique: the old code (and the no-hard-link fallback) creates its lock empty
+    # and writes after, so a fresh empty lock can replace the stale one under us. The stale one is
+    # over a minute old (mxtk_lock_take judged it so); a replacement is seconds old. Review of #379.
+    if [ -z "$X" ] && { [ -s "$L" ] || [ -z "$(find "$L" -mmin +1 2>/dev/null)" ]; }; then
+      rm -f "$f"; return 0
+    fi
+    rm -f "$L"
+    MXTK_LOCK_REAPED="$X"
+    return 0   # the ticket stays until the next holder clears it
+  fi
+  rm -f "$f"   # X is gone for good; our ticket is litter
+  return 0
+}
+
+# _mxtk_lock_gc <lock> <our line> — run by a new holder: tickets of every other key, temp files of
+# dead pids, and a stale old-style takeover file. The uncontended take has no tickets: a glob test
+# sees that without starting a process, and the cksum/awk key is computed only when one exists.
+_mxtk_lock_gc() {
+  local L="$1" mine="" f
+  for f in "$L".reap.*; do
+    [ -e "$f" ] || continue
+    [ -n "$mine" ] || mine="$(_mxtk_lock_key "$2")"
+    case "$f" in "$L.reap.$mine."*) continue ;; esac
+    rm -f "$f"
+  done
+  for f in "$L".tmp.*; do
+    [ -e "$f" ] || continue
+    mxtk_lock_live "${f##*.tmp.}" || rm -f "$f"
+  done
+  _mxtk_lock_legacy_busy "$L" || rm -f "$L.takeover"
+  return 0
+}
+
+# mxtk_lock_take <lockfile> <label> [tries=6] — 0 taken (MXTK_LOCK_REAPED = the dead holder's line
+# when we reaped one, else ""); 1 a live holder has it (MXTK_LOCK_HELD = its line); 2 gave up after
+# <tries> attempts (others kept taking it, or MXTK_LOCK_BLOCKER = "<pid> <file>": a live reaper's
+# ticket, or an old-style takeover file, that never finished; "empty <lock>": the lock file itself
+# was empty and under a minute old — mxtk_lock_blocked_text says what to do). Call it directly, not
+# in $( ): it sets variables.
+mxtk_lock_take() {
+  local L="$1" label="$2" tries="${3:-6}" i=0 held line slp="${MXTK_LOCK_RETRY_SLEEP:-1}"
+  MXTK_LOCK_HELD=""; MXTK_LOCK_REAPED=""; MXTK_LOCK_BLOCKER=""
+  [ -n "${_MXTK_LOCK_NONCE:-}" ] || _MXTK_LOCK_NONCE="$$$RANDOM$RANDOM${EPOCHSECONDS:-$(date +%s)}"
+  line="$$ ${EPOCHSECONDS:-$(date +%s)} $label nonce=$_MXTK_LOCK_NONCE"
+  while [ "$i" -lt "$tries" ]; do
+    i=$((i + 1)); MXTK_LOCK_BLOCKER=""   # describes the LAST attempt only
+    if _mxtk_lock_excl "$L" "$L" "$line"; then
+      _mxtk_lock_anchor created
+      _mxtk_lock_gc "$L" "$line"
+      return 0
+    fi
+    held="$(head -1 "$L" 2>/dev/null || true)"
+    if [ -z "$held" ]; then
+      [ -e "$L" ] || continue   # released between our create and our read
+      # Empty: the pre-ticket code writes after its O_EXCL create — wait, unless it is over a
+      # minute old (its writer died between the two) and so a stale line like any other.
+      if [ -z "$(find "$L" -mmin +1 2>/dev/null)" ]; then MXTK_LOCK_BLOCKER="empty $L"; sleep "$slp"; continue; fi
+    elif mxtk_lock_live "${held%% *}"; then
+      MXTK_LOCK_HELD="$held"; return 1
+    fi
+    _mxtk_lock_reap "$L" "$held" && continue
+    sleep "$slp"   # another live reaper is on it; see who won
+  done
+  MXTK_LOCK_HELD="$(head -1 "$L" 2>/dev/null || true)"
+  return 2
+}
+
+# mxtk_lock_blocked_text — after rc 2, when something blocked the take: which pid and which file,
+# and what to do. A reaper normally holds its ticket for milliseconds; one that does not is stopped
+# (Ctrl+Z / SIGSTOP), hung, or a dead reaper whose pid the OS gave to another process where
+# `ps -o args=` cannot tell them apart (Git Bash). The two get different remedies: a stopped or hung
+# exec.sh / test-scratch.sh is resumed or ended; a reused pid is never killed (it is someone else's
+# process) — its ticket file is deleted instead. Prints nothing when MXTK_LOCK_BLOCKER is empty.
+mxtk_lock_blocked_text() {
+  local p="${MXTK_LOCK_BLOCKER%% *}" f="${MXTK_LOCK_BLOCKER#* }"
+  [ -n "${MXTK_LOCK_BLOCKER:-}" ] || return 0
+  if [ "$p" = "empty" ]; then
+    echo "  The lock file is empty: a take that crashed between creating it and writing its line:"
+    echo "    $f"
+    echo "  → It counts as stale once it is a minute old: re-run in a minute, or delete it now: rm -- \"$f\""
+    return 0
+  fi
+  echo "  The dead holder's lock is being reaped by PID $p, which is alive but has not finished:"
+  echo "    $f"
+  if [ "$p" = "?" ]; then
+    echo "  → Its creator died mid-write; it stops counting a minute after it was created. Re-run then."
+    return 0
+  fi
+  echo "  → First check what PID $p is: ps -o args= -p $p   (Git Bash: ps -p $p; Windows: Task Manager)"
+  echo "    a) It IS an exec.sh / test-scratch.sh (a stopped or hung reaper) — leave its ticket alone:"
+  echo "       stopped (Ctrl+Z): resume it: kill -CONT $p (or fg in its terminal); hung: end it: kill $p — then re-run."
+  echo "    b) It is NOT an exec.sh / test-scratch.sh (the dead reaper's pid was reused) — do not kill it;"
+  echo "       delete the dead reaper's ticket instead: rm -- \"$f\" — then re-run."
+}
+
+# mxtk_lock_release <lockfile> — remove it only while it holds our own line (pid AND nonce).
+mxtk_lock_release() {
+  local own
+  [ -n "${_MXTK_LOCK_NONCE:-}" ] || return 0
+  own="$(head -1 "$1" 2>/dev/null || true)"
+  case "$own" in "$$ "*" nonce=$_MXTK_LOCK_NONCE") rm -f "$1" ;; esac
+  return 0
+}
+
 # ---------------------------------------------------------------------------
 # mxcli run / test identity — shared by app-restart.sh and test-scratch.sh (one copy each until
 # 2026-10-14; they had drifted only in a branch test-scratch never took). A caller whose installed
diff --git a/project-bin/exec.sh b/project-bin/exec.sh
index 9ec344bd..d215a504 100755
--- a/project-bin/exec.sh
+++ b/project-bin/exec.sh
@@ -750,8 +750,8 @@ fi
 # 2. One exec.sh at a time on THIS project (e.g. a second agent session on the same model).
 #
 #    The lock is per project — $PROJECT_ROOT/.mpr-snapshots/.exec.lock — and holds
-#    "<pid> <epoch> <script>". It is taken atomically (noclobber: O_EXCL, bash 3.2 / Git Bash /
-#    macOS alike; no flock, which macOS and Git Bash do not ship), so two sessions starting in
+#    "<pid> <epoch> <script> nonce=<n>". It is created exclusively (written aside, then `ln`;
+#    no flock, which macOS and Git Bash do not ship), so two sessions starting in
 #    the same second cannot both win. A lock whose pid is dead is STALE — a SIGKILL, a crash or
 #    a closed terminal never runs the EXIT trap — and is taken over with a printed note; a
 #    guard that needs a manual `rm` to recover blocks its own remedy (CLAUDE.md, instrument
@@ -759,90 +759,30 @@ fi
 #    pid was reused by an unrelated process and the lock is stale too; where it cannot (Git
 #    Bash), `kill -0` alone decides. A lock file in the pre-2026-10-13 format (a bare pid) reads
 #    the same way.
-exec_lock_live() {  # $1 = pid from the lock; 0 iff that process is alive and plausibly exec.sh
-  [ -n "$1" ] || return 1
-  case "$1" in *[!0-9]*) return 1 ;; esac
-  kill -0 "$1" 2>/dev/null || return 1
-  # Linux: an unreaped zombie still answers kill -0; /proc/<pid>/stat says Z after the "(comm) ".
-  case "$(sed 's/.*) //' "/proc/$1/stat" 2>/dev/null | cut -d' ' -f1)" in Z) return 1 ;; esac
-  _args="$(ps -o args= -p "$1" 2>/dev/null || true)"
-  case "$_args" in ""|*exec.sh*|*test-scratch.sh*) return 0 ;; esac   # test-scratch.sh holds it while copying
-  return 1
-}
-exec_lock_try() { ( set -o noclobber; printf '%s %s %s\n' "$$" "${EPOCHSECONDS:-$(date +%s)}" "$LOG_NAME" > "$LOCK" ) 2>/dev/null; }
-exec_lock_release() {  # the trap: remove the lock only while it is still ours
-  _own="$(cat "$LOCK" 2>/dev/null || true)"
-  [ "${_own%% *}" = "$$" ] && rm -f "$LOCK"
-  return 0
-}
-# Taking over a stale lock is serialised through a second O_EXCL file, $LOCK.takeover. Under
-# it the lock is re-read and removed ONLY if it still holds exactly the stale line judged above;
-# nothing else ever removes a lock that is not its own, so the compare-then-rm cannot hit a
-# fresh lock. WHY (independent review of #304): the old takeover moved the lock aside and put
-# it back with `mv -f` when it found a fresh one there — check-then-act. With 3+ contenders, B
-# moved A's fresh lock aside, C's noclobber write landed in the gap, B saw a lock and deleted
-# A's: 12 contenders gave up to 3 holders at once (tests/wave2/test-exec-lock-watch.sh).
-# A takeover file left by a holder killed inside those few microseconds is stale once its pid is
-# dead or it is older than 10 s (an EMPTY one once it is over a minute old — `find -mmin +1`;
-# `+0` matched a file created a second ago, so a live contender's fresh takeover file was judged
-# stale and a third contender got in: review of #324). It is moved aside, and put back with `ln`
-# (never clobbers; left on disk if that fails) if what was moved is not the one judged stale.
-# The holder removes the takeover file only while it still holds the line it wrote.
-exec_lock_takeover() {  # $1 = the stale lock line; 0 iff it was removed (or already gone)
-  _tk="$LOCK.takeover"; _mine="$$ ${EPOCHSECONDS:-$(date +%s)}"
-  if ! ( set -o noclobber; printf '%s\n' "$_mine" > "$_tk" ) 2>/dev/null; then
-    _t="$(head -1 "$_tk" 2>/dev/null || true)"; _tpid="${_t%% *}"; _tsince="${_t#* }"
-    case "$_tsince" in ''|*[!0-9]*) _tsince=0 ;; esac
-    _tstale=0
-    if [ -n "$_t" ]; then
-      { ! kill -0 "$_tpid" 2>/dev/null || [ $(( ${EPOCHSECONDS:-$(date +%s)} - _tsince )) -gt 10 ]; } && _tstale=1
-    elif [ -n "$(find "$_tk" -mmin +1 2>/dev/null)" ]; then
-      _tstale=1   # empty for over a minute: its creator died between the create and the write
-    fi
-    if [ "$_tstale" = 1 ]; then
-      if mv "$_tk" "$_tk.stale.$$" 2>/dev/null; then
-        # Remove what was moved ONLY if it is what was judged stale; anything else is someone's
-        # live takeover file: put it back (ln never clobbers), and if that fails leave it be.
-        # Same body as test-scratch.sh's take_over() — keep the two in step (PR #322).
-        if [ "$(head -1 "$_tk.stale.$$" 2>/dev/null || true)" = "$_t" ]; then rm -f "$_tk.stale.$$"
-        else ln "$_tk.stale.$$" "$_tk" 2>/dev/null && rm -f "$_tk.stale.$$"; fi
-      fi
-    fi
-    return 1
-  fi
-  _now="$(head -1 "$LOCK" 2>/dev/null || true)"
-  [ "$_now" = "$1" ] && rm -f "$LOCK"
-  [ "$(head -1 "$_tk" 2>/dev/null || true)" = "$_mine" ] && rm -f "$_tk"   # only our own takeover file
-  return 0
-}
-LOCK_TAKEN=0
-for _try in 1 2 3 4 5 6; do
-  if exec_lock_try; then LOCK_TAKEN=1; break; fi
-  _held="$(head -1 "$LOCK" 2>/dev/null || true)"
-  if [ -z "$_held" ] && [ "$_try" -lt 3 ]; then sleep 1; continue; fi   # being written right now
-  _hpid="${_held%% *}"
-  if exec_lock_live "$_hpid"; then
-    _hrest="${_held#* }"; _hsince="${_hrest%% *}"; _hscript="${_hrest#* }"
-    _age=""
-    case "$_hsince" in ''|*[!0-9]*) ;; *) _age=" for $(( ${EPOCHSECONDS:-$(date +%s)} - _hsince ))s" ;; esac
-    [ "$_hrest" = "$_held" ] && _hscript="?"
-    echo "✗ Another session holds this project's exec lock (PID $_hpid, running$_age, script: $_hscript)."
-    echo "  → Wait for it to finish, then re-run. Nothing was written."
-    echo "    (A dead holder is detected and taken over automatically — no manual rm is ever needed.)"
-    exit 1
-  fi
-  if exec_lock_takeover "$_held"; then
-    echo "  (stale exec lock from PID ${_hpid:-?}, which is not running — taking it over)"
+#    The lock code is _common.sh's mxtk_lock_take / mxtk_lock_release, shared with test-scratch.sh;
+#    a dead holder is reaped under a ticket, never by age (see the block header there).
+command -v mxtk_lock_take >/dev/null 2>&1 || {
+  echo "exec.sh: bin/_common.sh is older than this script (no mxtk_lock_take)." >&2
+  echo "  → <toolkit>/bin/sync-project.sh $PROJECT_ROOT --only-bin _common.sh --upgrade-bin _common.sh   (installs just that file; backs up a hand-edited copy first)" >&2; exit 2; }
+_lrc=0; mxtk_lock_take "$LOCK" "$LOG_NAME" 6 || _lrc=$?
+if [ "$_lrc" = 1 ]; then
+  mxtk_lock_fields "$MXTK_LOCK_HELD"; _age=""
+  [ -n "$MXTK_LOCK_HSINCE" ] && _age=" for $(( ${EPOCHSECONDS:-$(date +%s)} - MXTK_LOCK_HSINCE ))s"
+  echo "✗ Another session holds this project's exec lock (PID $MXTK_LOCK_HPID, running$_age, script: $MXTK_LOCK_HLABEL)."
+  echo "  → Wait for it to finish, then re-run. Nothing was written."
+  echo "    (A dead holder is detected and taken over automatically — no manual rm is ever needed.)"
+  exit 1
+elif [ "$_lrc" != 0 ]; then
+  if [ -n "$MXTK_LOCK_BLOCKER" ]; then
+    echo "✗ Could not take the exec lock $LOCK after 6 attempts. Nothing was written."; mxtk_lock_blocked_text
   else
-    sleep 1   # another contender is taking it over right now; look again
+    echo "✗ Could not take the exec lock $LOCK after 6 attempts — another session keeps re-taking it."
+    echo "  → Wait for the other exec to finish, then re-run. Nothing was written."
   fi
-done
-if [ "$LOCK_TAKEN" != 1 ]; then
-  echo "✗ Could not take the exec lock $LOCK after 6 attempts — another session keeps re-taking it."
-  echo "  → Wait for the other exec to finish, then re-run. Nothing was written."
   exit 1
 fi
-trap 'mxtk_resume_watchers; exec_lock_release; [ "$_PROFILING" != 1 ] || _prof_report' EXIT
+[ -z "$MXTK_LOCK_REAPED" ] || echo "  (stale exec lock from PID ${MXTK_LOCK_REAPED%% *}, which is not running — taking it over)"
+trap 'mxtk_resume_watchers; mxtk_lock_release "$LOCK"; [ "$_PROFILING" != 1 ] || _prof_report' EXIT
 mxtk_resume_leftover "$PROJECT_ROOT"   # a watcher an earlier, SIGKILLed exec.sh left stopped
 
 # 3. A raw `mxcli exec` elsewhere on the machine is NOT this project's business. The old guard
diff --git a/project-bin/test-scratch.sh b/project-bin/test-scratch.sh
index 9b1b5663..a3208fb8 100755
--- a/project-bin/test-scratch.sh
+++ b/project-bin/test-scratch.sh
@@ -77,75 +77,26 @@ if mxtest_left "$MODEL_DIR" "$MODEL_DIR/$MPR_NAME"; then
   exit 3
 fi
 
-# Same liveness rule as exec.sh's lock: alive, not a zombie, and (where ps can say) one of ours.
-holder_live() {
-  [ -n "${1:-}" ] || return 1
-  case "$1" in *[!0-9]*) return 1 ;; esac
-  kill -0 "$1" 2>/dev/null || return 1
-  case "$(sed 's/.*) //' "/proc/$1/stat" 2>/dev/null | cut -d' ' -f1)" in Z) return 1 ;; esac
-  _args="$(ps -o args= -p "$1" 2>/dev/null || true)"
-  case "$_args" in ""|*exec.sh*|*test-scratch.sh*) return 0 ;; esac
-  return 1
-}
-# Taking over a stale lock is serialised through a second O_EXCL file, <lock>.takeover — the SAME
-# file name and protocol as exec.sh's exec_lock_takeover (this script shares .exec.lock with it, so
-# the two must exclude each other; keep the bodies in step). Under it the lock is re-read and
-# removed ONLY if it still holds exactly the stale line judged; nothing else ever removes a lock
-# that is not its own. WHY (independent review of #304): the old takeover here moved the lock
-# aside with `mv -f` — check-then-act — so two runs that judged the same dead holder could both
-# end up holding it. A takeover file left by a holder killed mid-takeover is stale once its pid is
-# dead or it is older than 10 s (an EMPTY one once it is over a minute old: find -mmin +1); it is moved aside, and put
-# back with `ln` (fails if a new one exists — never clobbers) if what was moved is not the one
-# judged stale. The machine-wide port lock uses the same protocol.
-take_over() {  # $1 = lock file, $2 = the stale lock line. 0 iff it was removed (or already gone)
-  local _tk="$1.takeover" _t _tpid _tsince _tstale _now _mine
-  _mine="$$ $(date +%s)"
-  if ! ( set -o noclobber; printf '%s\n' "$_mine" > "$_tk" ) 2>/dev/null; then
-    _t="$(head -1 "$_tk" 2>/dev/null || true)"; _tpid="${_t%% *}"; _tsince="${_t#* }"
-    case "$_tsince" in ''|*[!0-9]*) _tsince=0 ;; esac
-    _tstale=0
-    if [ -n "$_t" ]; then
-      { ! kill -0 "$_tpid" 2>/dev/null || [ $(( $(date +%s) - _tsince )) -gt 10 ]; } && _tstale=1
-    elif [ -n "$(find "$_tk" -mmin +1 2>/dev/null)" ]; then
-      # -mmin +1, not +0: GNU find counts a 0-2 s old file as "+0" (and BSD rounds up), so +0 made a
-      # FRESH empty takeover file — its creator between the create and the write — stale at once.
-      _tstale=1   # empty for over a minute: its creator died between the create and the write
-    fi
-    if [ "$_tstale" = 1 ]; then
-      if mv "$_tk" "$_tk.stale.$$" 2>/dev/null; then
-        # Remove what was moved ONLY if it is what was judged stale; anything else is someone's
-        # live takeover file: put it back (ln never clobbers), and if that fails leave it be.
-        if [ "$(head -1 "$_tk.stale.$$" 2>/dev/null || true)" = "$_t" ]; then rm -f "$_tk.stale.$$"
-        else ln "$_tk.stale.$$" "$_tk" 2>/dev/null && rm -f "$_tk.stale.$$"; fi
-      fi
-    fi
-    return 1
-  fi
-  _now="$(head -1 "$1" 2>/dev/null || true)"
-  [ "$_now" = "$2" ] && rm -f "$1"
-  [ "$(head -1 "$_tk" 2>/dev/null || true)" = "$_mine" ] && rm -f "$_tk"   # only our own takeover file
-  return 0
-}
+# Both locks are _common.sh's mxtk_lock_take / mxtk_lock_release — the same code exec.sh uses on
+# .exec.lock, so the two scripts exclude each other by construction. A dead holder is reaped
+# under a ticket, never by age (see the block header in _common.sh).
+command -v mxtk_lock_take >/dev/null 2>&1 || {
+  echo "test-scratch: bin/_common.sh is older than this script (no mxtk_lock_take)." >&2
+  echo "  → <toolkit>/bin/sync-project.sh $PROJECT_ROOT --only-bin _common.sh --upgrade-bin _common.sh   (installs just that file; backs up a hand-edited copy first)" >&2; exit 2; }
 take_lock() {  # $1 = lock file, $2 = what it guards (for messages). 0 = taken, 1 = live holder
-  local f="$1" held hpid i
-  for i in 1 2 3 4 5 6 7 8; do
-    if ( set -o noclobber; printf '%s %s %s\n' "$$" "$(date +%s)" "test-scratch.sh" > "$f" ) 2>/dev/null; then return 0; fi
-    held="$(head -1 "$f" 2>/dev/null || true)"
-    if [ -z "$held" ] && [ "$i" -lt 3 ]; then sleep 1; continue; fi
-    hpid="${held%% *}"
-    if holder_live "$hpid"; then
-      echo "✗ test-scratch: $2 is held by PID $hpid ($(printf '%s' "$held" | cut -d' ' -f3-)) — wait for it to finish." >&2
-      return 1
-    fi
-    if take_over "$f" "$held"; then
-      echo "  (stale lock on $2 from PID ${hpid:-?}, not running — taking it over)"
-    else
-      sleep 1   # another run is taking the same stale lock over; see who won
-    fi
-  done
-  echo "✗ test-scratch: could not take the lock on $2 after 8 attempts." >&2; return 1
+  local rc=0
+  mxtk_lock_take "$1" "test-scratch.sh" 8 || rc=$?
+  case "$rc" in
+    0) [ -z "$MXTK_LOCK_REAPED" ] || echo "  (stale lock on $2 from PID ${MXTK_LOCK_REAPED%% *}, not running — taking it over)"
+       return 0 ;;
+    1) mxtk_lock_fields "$MXTK_LOCK_HELD"
+       echo "✗ test-scratch: $2 is held by PID $MXTK_LOCK_HPID ($MXTK_LOCK_HLABEL) — wait for it to finish." >&2
+       return 1 ;;
+  esac
+  echo "✗ test-scratch: could not take the lock on $2 after 8 attempts." >&2
+  mxtk_lock_blocked_text >&2; return 1
 }
-release() { local f="$1" own; own="$(head -1 "$f" 2>/dev/null || true)"; [ "${own%% *}" = "$$" ] && rm -f "$f"; return 0; }
+release() { mxtk_lock_release "$1"; }
 
 EXEC_LOCK="$PROJECT_ROOT/.mpr-snapshots/.exec.lock"
 PORT_LOCK="${TMPDIR:-/tmp}/mxtk-test-ports-$(printf '%s' "$PORTS" | tr -c '0-9' '-').lock"
diff --git a/tests/wave2/bench-lock-race.sh b/tests/wave2/bench-lock-race.sh
new file mode 100755
index 00000000..aaa87dae
--- /dev/null
+++ b/tests/wave2/bench-lock-race.sh
@@ -0,0 +1,166 @@
+#!/usr/bin/env bash
+# bench-lock-race.sh — race harness for the shared lock (_common.sh mxtk_lock_take): rounds of
+# contenders start together on a lock whose holder is dead, are SIGKILLed at the lock code's test
+# anchors and at random 0–50 ms offsets, and every holder checks for a second live holder.
+#
+# Usage: bash tests/wave2/bench-lock-race.sh [--rounds N] [--contenders M] [--common <_common.sh>]
+#                                            [--old [<file holding the pre-ticket exec.sh lock block>]]
+#   default subject: project-bin/_common.sh (the reap-ticket lock)
+#   --old: the pre-ticket protocol (`<lock>.takeover`, mv aside, ln back); default file
+#          tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh, a verbatim copy of master d16f578's
+#          exec.sh block. Anchors are sed-injected at the same points: after its takeover file is
+#          created (ticket-taken, compare), before its rm (rm), after its lock is created (created),
+#          plus the two steps the new code no longer has: after a takeover file is judged stale
+#          (judged) and after it is moved aside, before the compare and `ln` back (aside).
+# Exit 0 iff no overlapping holders, every contender that was not killed acquired the lock before
+# its deadline, and a probe after each round acquired it within PROBE_SECS. Last line:
+#   RESULT subject=<new|old> rounds=R contenders=M overlaps=<events> overlap_rounds=<n> starved=<n> probe_fail=<n> kills=<n> acquired=<n>
+#
+# Knobs (env): KILL_AT (anchors where a contender may be SIGKILLed, default "ticket-taken compare
+# rm"; every anchor also pauses 0–39 ms), KILL_PCT (chance per such anchor, default 25),
+# RANDOM_KILL_PCT (chance a contender is also SIGKILLed at a random 0–50 ms offset, default 10),
+# HOLD_SECS (default 0.05), RETRY_SECS (pause between attempts, default 0.02), DEADLINE (per
+# contender, default 30 s), PROBE_SECS (default 15).
+# Two signals, both must stay 0: an OVERLAP (a holder sees another live holder's mark) and a
+# STOLEN lock (a live holder finds the lock file no longer names it — someone removed it).
+# WHY: r-eng-backlog item 1 (2026-10-14). The harness must show the double holder on the old
+# code before its silence on the new code means anything.
+set -uo pipefail
+TOOLKIT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ROUNDS=200; NC=10; COMMON="$TOOLKIT/project-bin/_common.sh"; OLD=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --rounds) shift; ROUNDS="$1" ;;
+    --contenders) shift; NC="$1" ;;
+    --common) shift; COMMON="$1" ;;
+    --old) if [ $# -gt 1 ] && [ -f "$2" ]; then shift; OLD="$1"
+           else OLD="$TOOLKIT/tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh"; fi ;;
+    -h|--help) sed -n '2,20p' "$0"; exit 0 ;;
+    *) echo "unknown argument: $1" >&2; exit 2 ;;
+  esac
+  shift
+done
+case "$COMMON" in /*) ;; *) COMMON="$PWD/$COMMON" ;; esac   # contenders run from $WORK
+KILL_PCT="${KILL_PCT:-25}"; RANDOM_KILL_PCT="${RANDOM_KILL_PCT:-10}"; HOLD_SECS="${HOLD_SECS:-0.05}"
+DEADLINE="${DEADLINE:-30}"; PROBE_SECS="${PROBE_SECS:-15}"
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/lockrace.XXXXXX")" || exit 2
+WORK="$(cd "$WORK" && pwd -P)"
+BG=""
+trap 'for p in $BG; do kill -KILL "$p" 2>/dev/null; done; rm -rf "$WORK"' EXIT
+LOCK="$WORK/.exec.lock"; HOLD="$WORK/holding"; mkdir -p "$HOLD"
+
+# The implementation under test exposes ctake (0 = holding) and crelease.
+if [ -n "$OLD" ]; then
+  SUBJECT=old
+  { echo 'LOG_NAME="old.mdl"'
+    echo '_hk() { [ -z "${MXTK_LOCK_TEST_PAUSE:-}" ] || "$MXTK_LOCK_TEST_PAUSE" "$1" "$$" || true; }'
+    echo 'ctake() {'
+    grep -v '^#' "$OLD" | sed \
+      -e 's/^  _now="\$(head -1 "\$LOCK" 2>\/dev\/null || true)"$/  _hk ticket-taken; _hk compare; &/' \
+      -e 's/^  \[ "\$_now" = "\$1" \] && rm -f "\$LOCK"$/  [ "$_now" = "$1" ] \&\& { _hk rm; rm -f "$LOCK"; }/' \
+      -e 's/^  if exec_lock_try; then LOCK_TAKEN=1; break; fi$/  if exec_lock_try; then LOCK_TAKEN=1; _hk created; break; fi/' \
+      -e 's/^    if \[ "\$_tstale" = 1 \]; then$/    _hk judged; &/' \
+      -e 's/^      if mv "\$_tk" "\$_tk.stale.\$\$" 2>\/dev\/null; then$/&  _hk aside;/' \
+      -e 's/sleep 1/sleep "$RETRY"/' -e 's/^    exit 1$/    return 1/' -e 's/^  exit 1$/  return 2/'
+    echo '}'
+    echo 'crelease() { exec_lock_release; }'
+  } > "$WORK/impl.sh"
+  for a in 'ticket-taken' '_hk rm' '_hk created' '_hk judged' '_hk aside' 'return 1' 'return 2' 'sleep "$RETRY"'; do
+    grep -qF -- "$a" "$WORK/impl.sh" || { echo "setup: could not inject '$a' into the old block ($OLD)" >&2; exit 2; }
+  done
+else
+  SUBJECT=new
+  { printf 'PROJECT_ROOT=%q; . %q\n' "$WORK" "$COMMON"
+    echo 'ctake() { mxtk_lock_take "$LOCK" "contender" 3; }'
+    echo 'crelease() { mxtk_lock_release "$LOCK"; }'
+  } > "$WORK/impl.sh"
+  grep -q '^mxtk_lock_take() {' "$COMMON" || { echo "setup: no mxtk_lock_take in $COMMON" >&2; exit 2; }
+fi
+
+# The hook run at each anchor: SIGKILL the contender KILL_PCT% of the time, else pause 0–39 ms.
+cat > "$WORK/pause.sh" <<'P'
+#!/usr/bin/env bash
+case " ${KILL_AT:-$1} " in *" $1 "*) ;; *) KILL_PCT=0 ;; esac
+if [ $((RANDOM % 100)) -lt "$KILL_PCT" ]; then echo "$1 $2" >> "$WORK/kills"; kill -KILL "$2"; exit 0; fi
+sleep "0.0$((RANDOM % 4))$((RANDOM % 10))"
+P
+chmod +x "$WORK/pause.sh"
+
+# A contender: its name contains "exec.sh", so the liveness rule (old and new) counts it as a holder.
+cat > "$WORK/contender-exec.sh" <<'C'
+LOCK="$1"; ROUND="$2"; RETRY="$RETRY_SECS"; MXTK_LOCK_RETRY_SLEEP="$RETRY_SECS"
+. "$WORK/impl.sh"
+alive() {  # same rule as the lock: alive, not a zombie, one of ours — and where `ps -o args=`
+  # says nothing (Git Bash) kill -0 alone decides, as in mxtk_lock_live; treating empty as dead
+  # there would make every overlap invisible (review of #379).
+  kill -0 "$1" 2>/dev/null || return 1
+  case "$(sed 's/.*) //' "/proc/$1/stat" 2>/dev/null | cut -d' ' -f1)" in Z) return 1 ;; esac
+  case "$(ps -o args= -p "$1" 2>/dev/null || true)" in ""|*contender-exec.sh*) return 0 ;; esac
+  return 1
+}
+check() {
+  local m p
+  for m in "$HOLD"/*; do
+    [ -e "$m" ] || continue; p="${m##*/}"; [ "$p" = "$$" ] && continue
+    alive "$p" && echo "round $ROUND: $$ holds while $p holds" >> "$WORK/overlaps"
+  done
+}
+while [ ! -e "$WORK/go.$ROUND" ]; do sleep 0.01; done
+end=$(( $(date +%s) + DEADLINE )); got=0
+while [ "$(date +%s)" -lt "$end" ]; do
+  if ctake >/dev/null 2>&1; then got=1; break; fi
+  sleep "0.0$((RANDOM % 5 + 1))"
+done
+if [ "$got" != 1 ]; then case "$ROUND" in probe*) ;; *) echo "$$" >> "$WORK/starved" ;; esac; exit 1; fi
+echo "$$" >> "$WORK/acquired"
+mine() {  # the lock must still name us while we hold it; anything else means another took it
+  [ "$(head -1 "$LOCK" 2>/dev/null | cut -d' ' -f1)" = "$$" ] || echo "round $ROUND: $$ lost its lock while holding it (now: $(head -1 "$LOCK" 2>/dev/null))" >> "$WORK/stolen"
+}
+touch "$HOLD/$$"; check; mine; sleep "$HOLD_SECS"; check; mine; rm -f "$HOLD/$$"
+crelease
+C
+
+dead_pid() { sleep 0 & local p=$!; wait "$p" 2>/dev/null; echo "$p"; }
+RETRY_SECS="${RETRY_SECS:-0.02}"; KILL_AT="${KILL_AT:-ticket-taken compare rm}"
+export WORK HOLD KILL_PCT HOLD_SECS DEADLINE RETRY_SECS KILL_AT
+PROBE_FAIL=0; ROUNDS_WITH_OVERLAP=0
+T0=$(date +%s)
+for r in $(seq 1 "$ROUNDS"); do
+  rm -f "$HOLD"/*
+  if [ $((r % 2)) = 1 ]; then printf '%s %s old.mdl\n' "$(dead_pid)" "$(date +%s)" > "$LOCK"   # pre-nonce line
+  else printf '%s %s old.mdl nonce=round%s\n' "$(dead_pid)" "$(date +%s)" "$r" > "$LOCK"; fi
+  [ -n "$OLD" ] && rm -f "$LOCK.takeover"   # the old harness's own reset; tickets are left as litter
+  before="$(cat "$WORK/overlaps" 2>/dev/null | wc -l | tr -d ' ')"
+  PIDS=""
+  for c in $(seq 1 "$NC"); do
+    MXTK_LOCK_TEST_PAUSE="$WORK/pause.sh" bash "$WORK/contender-exec.sh" "$LOCK" "$r" >/dev/null 2>&1 &
+    PIDS="$PIDS $!"
+  done
+  BG="$PIDS"
+  : > "$WORK/go.$r"
+  for p in $PIDS; do   # random SIGKILLs at 0–50 ms
+    if [ $((RANDOM % 100)) -lt "$RANDOM_KILL_PCT" ]; then
+      ( sleep "0.0$((RANDOM % 5))$((RANDOM % 10))"; kill -KILL "$p" 2>/dev/null && echo "random $p" >> "$WORK/kills" ) &
+    fi
+  done
+  for p in $PIDS; do wait "$p" 2>/dev/null; done
+  wait 2>/dev/null
+  after="$(cat "$WORK/overlaps" 2>/dev/null | wc -l | tr -d ' ')"
+  [ "$after" -gt "$before" ] && ROUNDS_WITH_OVERLAP=$((ROUNDS_WITH_OVERLAP + 1))
+  # Probe: no hooks, no kills — whatever the round left (a dead holder, dead tickets), it gets the lock.
+  rm -f "$HOLD"/*
+  ( cd "$WORK" && : > "$WORK/go.probe$r"; DEADLINE="$PROBE_SECS" bash "$WORK/contender-exec.sh" "$LOCK" "probe$r" ) >/dev/null 2>&1 \
+    || { PROBE_FAIL=$((PROBE_FAIL + 1)); echo "  round $r: probe could not take the lock within ${PROBE_SECS}s ($(head -1 "$LOCK" 2>/dev/null))"; }
+done
+T1=$(date +%s)
+OV="$(cat "$WORK/overlaps" 2>/dev/null | wc -l | tr -d ' ')"
+ST="$(cat "$WORK/starved" 2>/dev/null | wc -l | tr -d ' ')"
+KL="$(cat "$WORK/kills" 2>/dev/null | wc -l | tr -d ' ')"
+AQ="$(cat "$WORK/acquired" 2>/dev/null | wc -l | tr -d ' ')"
+SL="$(cat "$WORK/stolen" 2>/dev/null | wc -l | tr -d ' ')"
+[ "$OV" -gt 0 ] && { echo "  first overlaps:"; head -5 "$WORK/overlaps" | sed 's/^/    /'; }
+[ "$SL" -gt 0 ] && { echo "  first locks lost by a live holder:"; head -5 "$WORK/stolen" | sed 's/^/    /'; }
+LITTER="$(ls -a "$WORK" | grep -c '^\.exec\.lock\.' || true)"
+echo "  $((T1 - T0)) s; lock-side files left at the end: $LITTER"
+echo "RESULT subject=$SUBJECT rounds=$ROUNDS contenders=$NC overlaps=$OV overlap_rounds=$ROUNDS_WITH_OVERLAP stolen=$SL starved=$ST probe_fail=$PROBE_FAIL kills=$KL acquired=$AQ"
+[ "$OV" -eq 0 ] && [ "$SL" -eq 0 ] && [ "$ST" -eq 0 ] && [ "$PROBE_FAIL" -eq 0 ]
diff --git a/tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh b/tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh
index b14b13a8..4ab196e0 100644
--- a/tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh
+++ b/tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh
@@ -1,7 +1,7 @@
 # exec-lock-block.sh — VERBATIM copy of project-bin/exec.sh's lock block (exec_lock_live .. the
-# LOCK_TAKEN check) from PR #324, branch fix/exec-followups @ 79de404. Used by
-# test-shared-lock-takeover.sh until #324 is merged; that fixture prefers the real exec.sh's block
-# once it carries exec_lock_takeover. Do not edit by hand — re-copy.
+# LOCK_TAKEN check) as on master d16f578 (first from PR #324 @ 79de404): the pre-ticket protocol.
+# The OLD code for tests/wave2/bench-lock-race.sh --old (which must reproduce its double holder) and
+# for test-lock-reap.sh's mixed-version case. Do not edit by hand.
 exec_lock_live() {  # $1 = pid from the lock; 0 iff that process is alive and plausibly exec.sh
   [ -n "$1" ] || return 1
   case "$1" in *[!0-9]*) return 1 ;; esac
diff --git a/tests/wave2/test-exec-lock-watch.sh b/tests/wave2/test-exec-lock-watch.sh
index 0ceb6a7c..6588613c 100755
--- a/tests/wave2/test-exec-lock-watch.sh
+++ b/tests/wave2/test-exec-lock-watch.sh
@@ -174,6 +174,16 @@ dead_pid > "$LOCK"
 OUT="$(run "$P" mdlsource/test.mdl)"; RC=$?
 [ "$RC" -eq 0 ] && has "pre-change lock format taken over" "$OUT" "taking it over" || bad "old-format stale lock blocked (rc $RC)"
 
+echo "-- lock: an empty lock file under a minute old (a crashed take) — said so, not 'keeps re-taking it'"
+: > "$LOCK"
+OUT="$(MXTK_LOCK_RETRY_SLEEP=0.05 run "$P" mdlsource/test.mdl)"; RC=$?
+[ "$RC" -ne 0 ] && ok "a fresh empty lock refuses (rc $RC)" || bad "a fresh empty lock was taken over (rc 0)"
+has  "  the refusal says the lock file is empty" "$OUT" "lock file is empty"
+has  "  and names the remedy: re-run in a minute, or delete it" "$OUT" "rm -- \"$LOCK\""
+hasnt "  not the misleading 'keeps re-taking it'" "$OUT" "keeps re-taking it"
+hasnt "  and it did not execute" "$OUT" "fake mxcli exec"
+rm -f "$LOCK"
+
 echo "-- lock: pid reused by an unrelated live process"
 sleep 30 & S=$!; BG_PIDS="$BG_PIDS $S"
 if [ -n "$(ps -o args= -p "$S" 2>/dev/null)" ]; then
diff --git a/tests/wave2/test-lock-reap.sh b/tests/wave2/test-lock-reap.sh
new file mode 100755
index 00000000..3649621a
--- /dev/null
+++ b/tests/wave2/test-lock-reap.sh
@@ -0,0 +1,240 @@
+#!/usr/bin/env bash
+# test-lock-reap.sh — the shared lock in _common.sh (mxtk_lock_take / mxtk_lock_release): each
+# reap-ticket rule on its own, the compatibility with lines and takeover files the pre-ticket code
+# wrote, and a short run of the race harness.
+#
+# Usage: bash tests/wave2/test-lock-reap.sh [path-to-_common.sh]
+#   LOCK_REAP_ROUNDS (default 15) sets the harness run; 0 skips it. The full proof is
+#   tests/wave2/bench-lock-race.sh (200 rounds x 10, and --old for the old code's failure count).
+#
+# WHY (r-eng-backlog item 1, 2026-10-14): the old stale-lock takeover moved its `.takeover` file
+# aside and put it back with `ln`; a third contender could create a new one in between, two
+# contenders were then inside the takeover, and one's compare-then-rm deleted the other's fresh
+# lock. Reap tickets replace it: a ticket per stale line, the next only when the previous one's pid
+# is dead (never by age), and only the highest ticket's holder may remove the line it judged.
+#
+# Cases use the lock code's test anchors (MXTK_LOCK_TEST_PAUSE) to act at an exact point.
+set -uo pipefail
+TOOLKIT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+COMMON="${1:-$TOOLKIT/project-bin/_common.sh}"
+case "$COMMON" in /*) ;; *) COMMON="$PWD/$COMMON" ;; esac
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/lockreap.XXXXXX")" || exit 2
+WORK="$(cd "$WORK" && pwd -P)"
+BG=""
+trap 'for p in $BG; do kill -KILL "$p" 2>/dev/null; done; rm -rf "$WORK"' EXIT
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; }
+echo "== subject: $COMMON"
+grep -q '^mxtk_lock_take() {' "$COMMON" && ok "[setup] mxtk_lock_take present" || { bad "[setup] no mxtk_lock_take in $COMMON"; echo "PASS=$PASS FAIL=$FAIL"; exit 1; }
+
+L="$WORK/.exec.lock"
+# lk <snippet> — run a snippet in a fresh shell named like an exec.sh (the liveness rule needs it),
+# with _common.sh sourced, fast retries, and the lock path in $L.
+cat > "$WORK/lk-exec.sh" <<'S'
+PROJECT_ROOT="$WORK"; . "$COMMON"; MXTK_LOCK_RETRY_SLEEP=0.05
+eval "$1"
+S
+lk() { WORK="$WORK" COMMON="$COMMON" L="$L" bash "$WORK/lk-exec.sh" "$1" 2>&1; }
+live_holder() { bash -c 'exec -a "bash ./bin/exec.sh mdlsource/x.mdl" sleep 120' & LP=$!; BG="$BG $LP"; sleep 0.2; }
+dead_pid() { sleep 0 & local p=$!; wait "$p" 2>/dev/null; echo "$p"; }
+key() { printf '%s' "$1" | cksum | awk '{print $1 "-" $2}'; }
+reset() { rm -f "$L" "$L".reap.* "$L".tmp.* "$L.takeover"; }
+left() { ls -a "$WORK" | grep -E '^\.exec\.lock\.(reap|tmp)\.' | tr '\n' ' '; }
+
+echo "-- a free lock: taken, released, nothing left beside it"
+OUT="$(lk 'mxtk_lock_take "$L" "patch: a.mdl" 3; echo "rc=$?"; head -1 "$L"; mxtk_lock_release "$L"; [ -e "$L" ] && echo still-there')"
+case "$OUT" in *rc=0*) ok "taken (rc 0)" ;; *) bad "not taken: $OUT" ;; esac
+printf '%s\n' "$OUT" | grep -qE '^[0-9]+ [0-9]+ patch: a\.mdl nonce=[0-9]+$' && ok "line is '<pid> <epoch> <label> nonce=<n>'" || bad "line format: $OUT"
+case "$OUT" in *still-there*) bad "release left the lock" ;; *) ok "release removed it" ;; esac
+[ -z "$(left)" ] && ok "no ticket or temp file left" || bad "left: $(left)"
+
+echo "-- release removes only our own line (same pid, other nonce = not ours)"
+OUT="$(lk 'mxtk_lock_take "$L" x 3; printf "%s 1 x nonce=999\n" "$$" > "$L"; mxtk_lock_release "$L"; [ -e "$L" ] && echo kept')"
+case "$OUT" in *kept*) ok "a line with our pid but another nonce is kept" ;; *) bad "release removed a line that was not ours" ;; esac
+reset
+
+echo "-- a live holder refuses, untouched, no ticket taken"
+live_holder; printf '%s %s mdlsource/x.mdl nonce=1\n' "$LP" "$(date +%s)" > "$L"
+OUT="$(lk 'mxtk_lock_take "$L" me 3; echo "rc=$? held=$MXTK_LOCK_HELD"')"
+case "$OUT" in *"rc=1 held=$LP "*) ok "rc 1, MXTK_LOCK_HELD names the holder" ;; *) bad "$OUT" ;; esac
+[ "$(cut -d' ' -f1 "$L")" = "$LP" ] && ok "the lock still names the live holder" || bad "lock changed: $(cat "$L")"
+[ -z "$(left)" ] && ok "no ticket taken against a live holder" || bad "left: $(left)"
+kill -KILL "$LP" 2>/dev/null; wait "$LP" 2>/dev/null; reset
+
+echo "-- a dead holder is reaped: every line format the old and new code write"
+D="$(dead_pid)"
+for X in "$D $(date +%s) mdlsource/x.mdl nonce=42" "$D $(date +%s) patch: y.mdl" "$D"; do
+  printf '%s\n' "$X" > "$L"
+  OUT="$(lk 'mxtk_lock_take "$L" me 3; echo "rc=$?"; echo "reaped=$MXTK_LOCK_REAPED"; head -1 "$L"; mxtk_lock_release "$L"')"
+  case "$OUT" in *rc=0*"reaped=$X"*) ok "reaped '$X'" ;; *) bad "'$X' not reaped: $OUT" ;; esac
+  [ -z "$(left)" ] && ok "  its ticket cleared by the new holder" || bad "  left: $(left)"
+done
+reset
+
+echo "-- ticket N+1 only when ticket N's pid is dead — never by age"
+D="$(dead_pid)"; X="$D 1700000000 old.mdl nonce=7"; K="$(key "$X")"; printf '%s\n' "$X" > "$L"
+live_holder; printf '%s 1\n' "$LP" > "$L.reap.$K.1"; touch -t 200001010000 "$L.reap.$K.1"
+OUT="$(lk 'mxtk_lock_take "$L" me 3; echo "rc=$? blocker=$MXTK_LOCK_BLOCKER"; mxtk_lock_blocked_text')"
+case "$OUT" in *rc=2*) ok "a live reaper's ticket (dated 2000) blocks: gave up (rc 2)" ;; *) bad "an old live ticket was overtaken: $OUT" ;; esac
+case "$OUT" in *"blocker=$LP $L.reap.$K.1"*) ok "  MXTK_LOCK_BLOCKER names the reaper's pid and ticket file" ;; *) bad "  blocker not named: $OUT" ;; esac
+case "$OUT" in *"kill -CONT $LP"*"kill $LP"*) ok "  and the message says to resume or end that pid (review of #379)" ;; *) bad "  no remedy in: $OUT" ;; esac
+# A reused pid belongs to an unrelated process: the remedy for it is deleting the ticket, never a
+# kill; and the kill is offered only for a pid that IS a reaper (2nd review of #379).
+KL="$(printf '%s\n' "$OUT" | grep -n "kill $LP" | head -1 | cut -d: -f1)"
+NL="$(printf '%s\n' "$OUT" | grep -n 'NOT an exec.sh / test-scratch.sh' | head -1 | cut -d: -f1)"
+RL="$(printf '%s\n' "$OUT" | grep -nF "rm -- \"$L.reap.$K.1\"" | head -1 | cut -d: -f1)"
+[ -n "$RL" ] && ok "  a reused pid's remedy names the ticket: rm -- \"<ticket>\"" || bad "  no rm of the ticket in: $OUT"
+[ -n "$KL" ] && [ -n "$NL" ] && [ -n "$RL" ] && [ "$KL" -lt "$NL" ] && [ "$NL" -le "$RL" ] \
+  && ok "  the kill sits under 'is an exec.sh' and the rm under 'is NOT' — two separate cases" || bad "  cases mixed (kill@$KL not@$NL rm@$RL): $OUT"
+printf '%s\n' "$OUT" | grep -i 'reused' | grep -q "kill $LP" && bad "  a reused pid is still told to be killed: $OUT" || ok "  a reused pid is never told to be killed"
+[ "$(cat "$L")" = "$X" ] && ok "the stale line was left to the live reaper" || bad "lock changed: $(cat "$L")"
+[ ! -e "$L.reap.$K.2" ] && ok "no ticket 2 taken while ticket 1 lives" || bad "ticket 2 taken over a live ticket 1"
+kill -KILL "$LP" 2>/dev/null; wait "$LP" 2>/dev/null
+printf '%s 1\n' "$(dead_pid)" > "$L.reap.$K.2"
+cat > "$WORK/seen.sh" <<'H'
+#!/usr/bin/env bash
+[ "$1" = ticket-taken ] && ls -a "$(dirname "$L")" | grep '\.reap\.' > "$WORK/seen"
+exit 0
+H
+chmod +x "$WORK/seen.sh"
+OUT="$(MXTK_LOCK_TEST_PAUSE="$WORK/seen.sh" lk 'export L WORK; mxtk_lock_take "$L" me 3; echo "rc=$?"; mxtk_lock_release "$L"')"
+case "$OUT" in *rc=0*) ok "tickets 1 and 2 dead → taken" ;; *) bad "$OUT" ;; esac
+grep -qx "\.exec\.lock\.reap\.$K\.3" "$WORK/seen" 2>/dev/null && ok "  as ticket 3 (the next after the highest)" || bad "  tickets seen: $(tr '\n' ' ' < "$WORK/seen" 2>/dev/null)"
+[ -z "$(left)" ] && ok "  and every ticket of that line cleared after" || bad "  left: $(left)"
+reset
+
+echo "-- the line changed under the ticket (compare anchor): nothing removed"
+D="$(dead_pid)"; printf '%s 1 old.mdl nonce=8\n' "$D" > "$L"; live_holder
+cat > "$WORK/swap.sh" <<'H'
+#!/usr/bin/env bash
+[ "$1" = compare ] && printf '%s %s fresh.mdl nonce=9\n' "$LP" "$(date +%s)" > "$L"
+exit 0
+H
+chmod +x "$WORK/swap.sh"
+OUT="$(LP="$LP" MXTK_LOCK_TEST_PAUSE="$WORK/swap.sh" lk 'export L LP; mxtk_lock_take "$L" me 3; echo "rc=$?"')"
+case "$OUT" in *rc=1*) ok "the new live line is respected (rc 1)" ;; *) bad "$OUT" ;; esac
+[ "$(cut -d' ' -f1 "$L")" = "$LP" ] && ok "the fresh lock survives" || bad "the fresh lock was removed: $(cat "$L" 2>/dev/null)"
+[ -z "$(left)" ] && ok "the reaper's ticket is gone (its line can never come back)" || bad "left: $(left)"
+kill -KILL "$LP" 2>/dev/null; wait "$LP" 2>/dev/null; reset
+
+echo "-- only the highest ticket may remove: a ticket N+1 appearing after ours stops the rm"
+D="$(dead_pid)"; X="$D 1 old.mdl nonce=10"; K="$(key "$X")"; printf '%s\n' "$X" > "$L"
+cat > "$WORK/over.sh" <<'H'
+#!/usr/bin/env bash
+[ "$1" = ticket-taken ] && [ ! -e "$WORK/over.done" ] && { : > "$WORK/over.done"; printf '999999 x\n' > "$L.reap.$K.2"; }
+exit 0
+H
+chmod +x "$WORK/over.sh"
+OUT="$(K="$K" MXTK_LOCK_TEST_PAUSE="$WORK/over.sh" lk 'export L K WORK; mxtk_lock_take "$L" me 1; echo "rc=$?"')"
+[ "$(cat "$L" 2>/dev/null)" = "$X" ] && ok "the stale line was not removed by a lower ticket" || bad "removed under a higher ticket: $OUT"
+reset; rm -f "$WORK/over.done"
+
+echo "-- a reaper SIGKILLed at its rm anchor does not block the next (instrument rule 7)"
+D="$(dead_pid)"; printf '%s 1 old.mdl nonce=11\n' "$D" > "$L"
+cat > "$WORK/die.sh" <<'H'
+#!/usr/bin/env bash
+[ "$1" = rm ] && kill -KILL "$2"
+exit 0
+H
+chmod +x "$WORK/die.sh"
+( MXTK_LOCK_TEST_PAUSE="$WORK/die.sh" lk 'mxtk_lock_take "$L" me 3' ) >/dev/null 2>&1
+[ -n "$(left)" ] && ok "[setup] the killed reaper left its ticket" || bad "[setup] no ticket left — case proves nothing"
+OUT="$(lk 'mxtk_lock_take "$L" me 3; echo "rc=$?"; mxtk_lock_release "$L"')"
+case "$OUT" in *rc=0*) ok "the next contender takes it at once" ;; *) bad "blocked by a dead reaper: $OUT" ;; esac
+[ -z "$(left)" ] && ok "and clears the dead ticket" || bad "left: $(left)"
+reset
+
+echo "-- the new holder clears tickets of other lines and temp files of dead pids"
+printf '1 x\n' > "$L.reap.123-45.1"; printf 'junk\n' > "$L.tmp.$(dead_pid)"
+OUT="$(lk 'mxtk_lock_take "$L" me 3; echo "rc=$?"; mxtk_lock_release "$L"')"
+[ -z "$(left)" ] && ok "cleared" || bad "left: $(left)"
+reset
+
+echo "-- an empty lock: fresh = being written (wait); over a minute old = stale"
+: > "$L"
+OUT="$(lk 'mxtk_lock_take "$L" me 2; echo "rc=$? blocker=$MXTK_LOCK_BLOCKER"; mxtk_lock_blocked_text')"
+case "$OUT" in *rc=2*) ok "a fresh empty lock is waited on, not reaped" ;; *) bad "$OUT" ;; esac
+[ -e "$L" ] && [ ! -s "$L" ] && ok "  and left alone" || bad "  the fresh empty lock was touched"
+# The give-up must say why: an empty lock file (a crashed take), not "someone keeps re-taking it".
+case "$OUT" in *"blocker=empty $L"*) ok "  MXTK_LOCK_BLOCKER says the lock file is empty (2nd review of #379)" ;; *) bad "  blocker not set: $OUT" ;; esac
+case "$OUT" in *"lock file is empty"*"re-run in a minute"*"rm -- \"$L\""*) ok "  and the message says: re-run in a minute, or rm -- \"<lock>\"" ;; *) bad "  no empty-lock remedy in: $OUT" ;; esac
+touch -t 200001010000 "$L"
+OUT="$(lk 'mxtk_lock_take "$L" me 2; echo "rc=$?"; mxtk_lock_release "$L"')"
+case "$OUT" in *rc=0*) ok "an empty lock over a minute old is reaped" ;; *) bad "$OUT" ;; esac
+reset
+
+echo "-- an EMPTY stale lock replaced mid-reap by a fresh empty one is not removed (review of #379)"
+# An empty line is not unique: the old code creates its lock empty and writes after. A reaper of an
+# old empty lock, paused at compare while that lock is replaced by a fresh empty one, must not rm it.
+: > "$L"; touch -t 200001010000 "$L"
+cat > "$WORK/empty-swap.sh" <<'H'
+#!/usr/bin/env bash
+[ "$1" = compare ] && { rm -f "$L"; : > "$L"; }
+exit 0
+H
+chmod +x "$WORK/empty-swap.sh"
+OUT="$(MXTK_LOCK_TEST_PAUSE="$WORK/empty-swap.sh" lk 'export L; mxtk_lock_take "$L" me 1; echo "rc=$?"')"
+[ -e "$L" ] && [ ! -s "$L" ] && [ -z "$(find "$L" -mmin +1 2>/dev/null)" ] && ok "the fresh empty lock survives" || bad "the fresh empty lock was removed: $OUT"
+[ -z "$(left)" ] && ok "  and the reaper's ticket is gone" || bad "  left: $(left)"
+reset
+
+echo "-- mixed versions: an old-style <lock>.takeover"
+D="$(dead_pid)"; printf '%s 1 old.mdl\n' "$D" > "$L"; live_holder
+printf '%s %s\n' "$LP" "$(date +%s)" > "$L.takeover"
+OUT="$(lk 'mxtk_lock_take "$L" me 2; echo "rc=$?"')"
+case "$OUT" in *rc=2*) ok "a live old takeover in progress: we back off" ;; *) bad "$OUT" ;; esac
+[ "$(cat "$L")" = "$D 1 old.mdl" ] && ok "  the stale line is left to it" || bad "  lock changed"
+kill -KILL "$LP" 2>/dev/null; wait "$LP" 2>/dev/null
+OUT="$(lk 'mxtk_lock_take "$L" me 2; echo "rc=$?"; mxtk_lock_release "$L"')"
+case "$OUT" in *rc=0*) ok "its pid dead: reaped" ;; *) bad "$OUT" ;; esac
+[ ! -e "$L.takeover" ] && ok "  and the dead takeover file cleared by the new holder" || bad "  takeover file left"
+printf '%s 1 old.mdl\n' "$D" > "$L"; : > "$L.takeover"
+OUT="$(lk 'mxtk_lock_take "$L" me 2; echo "rc=$?"')"
+case "$OUT" in *rc=2*) ok "a fresh EMPTY takeover file (old code between create and write) is respected" ;; *) bad "$OUT" ;; esac
+touch -t 200001010000 "$L.takeover"
+OUT="$(lk 'mxtk_lock_take "$L" me 2; echo "rc=$?"; mxtk_lock_release "$L"')"
+case "$OUT" in *rc=0*) ok "an empty one over a minute old is not" ;; *) bad "$OUT" ;; esac
+reset
+
+echo "-- mxtk_lock_fields"
+OUT="$(lk 'for x in "12 1700 patch: a.mdl nonce=9" "12 1700 a.mdl" "12"; do mxtk_lock_fields "$x"; echo "[$MXTK_LOCK_HPID|$MXTK_LOCK_HSINCE|$MXTK_LOCK_HLABEL]"; done')"
+[ "$OUT" = "[12|1700|patch: a.mdl]
+[12|1700|a.mdl]
+[12||?]" ] && ok "new, old and bare-pid lines parse; the nonce is never shown" || bad "$OUT"
+
+echo "-- mixed versions do not deadlock: old-block and new contenders on one dead holder"
+OLDB="$TOOLKIT/tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh"
+{ echo 'LOG_NAME=old.mdl'; echo 'ctake() {'; grep -v '^#' "$OLDB" | sed -e 's/sleep 1/sleep 0.05/' -e 's/^    exit 1$/    return 1/' -e 's/^  exit 1$/  return 2/'; echo '}'
+  echo 'crelease() { exec_lock_release; }'; } > "$WORK/old-impl.sh"
+printf 'PROJECT_ROOT="$WORK"; . "$COMMON"; MXTK_LOCK_RETRY_SLEEP=0.05\nctake() { mxtk_lock_take "$L" new 3; }\ncrelease() { mxtk_lock_release "$L"; }\n' > "$WORK/new-impl.sh"
+cat > "$WORK/mix-exec.sh" <<'M'
+LOCK="$L"; . "$IMPL"; end=$(( $(date +%s) + 20 ))
+while [ "$(date +%s)" -lt "$end" ]; do ctake >/dev/null 2>&1 && { echo got >> "$WORK/mixgot"; sleep 0.05; crelease; exit 0; }; sleep 0.02; done
+exit 1
+M
+MIXFAIL=0
+for r in 1 2 3; do
+  printf '%s 1 old.mdl\n' "$(dead_pid)" > "$L"; PIDS=""
+  for i in 1 2 3; do
+    WORK="$WORK" COMMON="$COMMON" L="$L" IMPL="$WORK/old-impl.sh" bash "$WORK/mix-exec.sh" & PIDS="$PIDS $!"
+    WORK="$WORK" COMMON="$COMMON" L="$L" IMPL="$WORK/new-impl.sh" bash "$WORK/mix-exec.sh" & PIDS="$PIDS $!"
+  done
+  for p in $PIDS; do wait "$p" || MIXFAIL=$((MIXFAIL + 1)); done
+  rm -f "$L.takeover"
+done
+[ "$MIXFAIL" -eq 0 ] && [ "$(wc -l < "$WORK/mixgot" | tr -d ' ')" -eq 18 ] && ok "all 18 contenders (9 old, 9 new) got the lock within 20 s" \
+  || bad "$MIXFAIL contenders never got the lock; $(wc -l < "$WORK/mixgot" 2>/dev/null | tr -d ' ') acquisitions of 18"
+reset
+
+ROUNDS="${LOCK_REAP_ROUNDS:-15}"
+if [ "$ROUNDS" -gt 0 ]; then
+  echo "-- race harness: $ROUNDS rounds x 10 contenders, SIGKILLs at every anchor and at random"
+  OUT="$(KILL_AT="ticket-taken compare rm created" bash "$TOOLKIT/tests/wave2/bench-lock-race.sh" --rounds "$ROUNDS" --common "$COMMON" 2>&1)"
+  R="$(printf '%s\n' "$OUT" | grep '^RESULT' | tail -1)"
+  case "$R" in *" overlaps=0 "*" stolen=0 starved=0 probe_fail=0 "*) ok "no overlap, no stolen lock, no starvation: $R" ;; *) bad "harness: $(printf '%s' "$OUT" | tail -6)" ;; esac
+fi
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-shared-lock-takeover.sh b/tests/wave2/test-shared-lock-takeover.sh
index 83a8ef07..3e65e13b 100644
--- a/tests/wave2/test-shared-lock-takeover.sh
+++ b/tests/wave2/test-shared-lock-takeover.sh
@@ -5,38 +5,37 @@
 # Usage: bash tests/wave2/test-shared-lock-takeover.sh [path-to-test-scratch.sh] [path-to-exec.sh]
 #
 # WHY (review of #304, PR #324): both scripts take the same per-project lock and both take over a dead
-# holder's lock. Each was made safe on its own by a serialised takeover (an O_EXCL `<lock>.takeover`,
-# re-read, remove only the exact stale line). Two private protocols would not exclude EACH OTHER: the
-# takeover file name and the compare-then-remove rule must be the same in both scripts.
+# holder's lock. Two private protocols would not exclude EACH OTHER. Since the reap-ticket change the
+# lock code lives once, in _common.sh (mxtk_lock_take / mxtk_lock_release), so the old awk-lifted
+# "keep in step" copies are gone.
 #
-# How: the lock code is lifted from each script (exec.sh: exec_lock_live .. the LOCK_TAKEN check;
-# test-scratch.sh: holder_live .. take_lock) into two small contender scripts whose names contain
-# "exec.sh" / "test-scratch.sh", so each script's liveness check recognises the other as a holder.
-# Rounds of 5 + 5 contenders start together on a lock whose holder pid is dead; each holder marks
-# itself in a shared dir while it holds the lock. Two marks at once = two holders = FAIL.
-# When the given exec.sh has no exec_lock_takeover yet (PR #324 unmerged), its block comes from the
-# verbatim copy in fixtures/mxtest-guard/exec-lock-block.sh, and says so.
+# How: checks that both scripts call the shared code on .mpr-snapshots/.exec.lock and keep no private
+# lock code, then races it as each script calls it (label, attempts) — two contender scripts whose
+# names contain "exec.sh" / "test-scratch.sh", so the liveness rule recognises each as a holder,
+# sourcing the _common.sh beside the given test-scratch.sh. Rounds of 5 + 5 contenders start together
+# on a lock whose holder pid is dead; each holder marks itself in a shared dir while it holds the
+# lock. Two marks at once = two holders = FAIL. The protocol itself: test-lock-reap.sh and
+# bench-lock-race.sh.
 set -uo pipefail
 TOOLKIT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 TS="${1:-$TOOLKIT/project-bin/test-scratch.sh}"; EX="${2:-$TOOLKIT/project-bin/exec.sh}"
+COMMON="$(cd "$(dirname "$TS")" && pwd)/_common.sh"
 PASS=0; FAIL=0
 ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
 bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; }
 WORK="$(mktemp -d "${TMPDIR:-/tmp}/sharedlock.XXXXXX")" || exit 2
 trap 'rm -rf "$WORK"' EXIT
 echo "== test-scratch: $TS"
+echo "== exec.sh: $EX"
+echo "== _common.sh: $COMMON"
 
-BLOCK="$WORK/exec-block.sh"
-awk '/^exec_lock_live\(\) \{/ {p=1} p {print} p && /^if \[ "\$LOCK_TAKEN" != 1 \]; then$/ {e=1} e && /^fi$/ {exit}' "$EX" > "$BLOCK"
-if grep -q '^exec_lock_takeover() {' "$BLOCK"; then echo "== exec.sh lock block: $EX"
-else
-  sed '1,4d' \
-    "$TOOLKIT/tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh"  > "$BLOCK"
-  echo "== exec.sh lock block: verbatim copy from PR #324 ($EX has no exec_lock_takeover yet)"
-fi
-grep -q '^exec_lock_takeover() {' "$BLOCK" && ok "[setup] exec.sh lock block lifted" || { bad "[setup] no exec.sh lock block"; echo "PASS=$PASS FAIL=$FAIL"; exit 1; }
-awk '/^holder_live\(\) \{/ {p=1} /^release\(\) \{/ {p=0} p' "$TS" > "$WORK/ts-block.sh"
-grep -q '^take_lock() {' "$WORK/ts-block.sh" && ok "[setup] test-scratch take_lock lifted" || { bad "[setup] no take_lock in $TS"; echo "PASS=$PASS FAIL=$FAIL"; exit 1; }
+grep -q '^mxtk_lock_take() {' "$COMMON" && ok "[setup] _common.sh has the shared lock" || { bad "[setup] no mxtk_lock_take in $COMMON"; echo "PASS=$PASS FAIL=$FAIL"; exit 1; }
+for f in "$EX" "$TS"; do
+  n="$(basename "$f")"
+  grep -q 'mxtk_lock_take "\$' "$f" && grep -q 'mxtk_lock_release "\$' "$f" && ok "$n takes and releases through _common.sh" || bad "$n does not call mxtk_lock_take/mxtk_lock_release"
+  grep -qE '^(exec_lock_(live|try|takeover|release)|holder_live|take_over)\(\)' "$f" && bad "$n still defines its own lock code" || ok "$n keeps no private lock code"
+  grep -q '\.mpr-snapshots/\.exec\.lock' "$f" && ok "$n locks .mpr-snapshots/.exec.lock" || bad "$n names another lock file"
+done
 
 LOCK="$WORK/.exec.lock"; HOLD="$WORK/holding"; mkdir -p "$HOLD"
 hold() {  # body shared by both contenders: mark, look for another mark, unmark
@@ -46,16 +45,17 @@ touch "$HOLD/$$"; n=$(ls "$HOLD" | wc -l | tr -d ' ')
 echo "$ROLE $$" >> "$WORK/holders"; sleep 0.3; rm -f "$HOLD/$$"
 H
 }
-{ echo 'LOCK="$1"; LOG_NAME="exec-contender"; ROLE=exec'; cat "$BLOCK"; hold
-  echo '_own="$(head -1 "$LOCK" 2>/dev/null)"; [ "${_own%% *}" = "$$" ] && rm -f "$LOCK"'; } > "$WORK/contender-exec.sh"
-{ echo 'LOCK="$1"; ROLE=scratch'; cat "$WORK/ts-block.sh"
-  echo 'take_lock "$LOCK" "the exec lock" >/dev/null 2>&1 || exit 1'; hold
-  echo '_own="$(head -1 "$LOCK" 2>/dev/null)"; [ "${_own%% *}" = "$$" ] && rm -f "$LOCK"'; } > "$WORK/contender-test-scratch.sh"
+{ printf 'LOCK="$1"; ROLE=exec; PROJECT_ROOT=%q; . %q\n' "$WORK" "$COMMON"
+  echo 'mxtk_lock_take "$LOCK" "exec-contender.mdl" 6 >/dev/null 2>&1 || exit 1'; hold
+  echo 'mxtk_lock_release "$LOCK"'; } > "$WORK/contender-exec.sh"
+{ printf 'LOCK="$1"; ROLE=scratch; PROJECT_ROOT=%q; . %q\n' "$WORK" "$COMMON"
+  echo 'mxtk_lock_take "$LOCK" "test-scratch.sh" 8 >/dev/null 2>&1 || exit 1'; hold
+  echo 'mxtk_lock_release "$LOCK"'; } > "$WORK/contender-test-scratch.sh"
 
 sleep 0 & DEAD=$!; wait "$DEAD"   # a pid that is certainly not running now
 ROUNDS=4
 for r in $(seq 1 "$ROUNDS"); do
-  printf '%s %s exec.sh\n' "$DEAD" "$(date +%s)" > "$LOCK"; rm -f "$LOCK.takeover"
+  printf '%s %s exec.sh\n' "$DEAD" "$(date +%s)" > "$LOCK"
   PIDS=""
   for i in 1 2 3 4 5; do
     WORK="$WORK" HOLD="$HOLD" bash "$WORK/contender-exec.sh" "$LOCK" >/dev/null 2>&1 & PIDS="$PIDS $!"
@@ -68,7 +68,8 @@ N="$(wc -l < "$WORK/holders" 2>/dev/null | tr -d ' ')"
 grep -q '^exec ' "$WORK/holders" 2>/dev/null && grep -q '^scratch ' "$WORK/holders" 2>/dev/null \
   && ok "both scripts won the lock at some point (they really contended)" || echo "  note: one script won every round: $(cut -d' ' -f1 "$WORK/holders" 2>/dev/null | sort | uniq -c | tr '\n' ' ')"
 if [ -s "$WORK/overlaps" ]; then bad "two holders at once: $(head -3 "$WORK/overlaps" | tr '\n' ' ')"; else ok "never two holders at once"; fi
-[ -e "$LOCK.takeover" ] && bad "takeover file left behind" || ok "no takeover file left behind"
+LEFT="$(ls -a "$WORK" | grep -E '^\.exec\.lock\.' | tr '\n' ' ')"
+[ -n "$LEFT" ] && bad "files left beside the lock: $LEFT" || ok "no ticket, temp or takeover file left behind"
 
 echo ""
 echo "PASS=$PASS FAIL=$FAIL"
diff --git a/tests/wave2/test-test-scratch.sh b/tests/wave2/test-test-scratch.sh
index 927fc60c..5819b55f 100755
--- a/tests/wave2/test-test-scratch.sh
+++ b/tests/wave2/test-test-scratch.sh
@@ -105,42 +105,42 @@ case "$OUT" in *"command not found"*) bad "died on command not found" ;; *) ok "
 
 
 echo "-- #304 review: a stale-lock takeover never removes a lock another run took meanwhile"
-# Deterministic replay of the race: the functions are lifted from the subject, and holder_live
-# is wrapped so that, while this run judges the dead holder, a second run completes its own
-# takeover and writes a live lock. The old code then `mv -f`'d that live lock away and took
-# the lock too — two holders. Taking over must re-read and leave a changed lock alone.
-H="$WORK/harness.sh"; L="$WORK/race.lock"
-awk '/^holder_live\(\) \{/ {p=1} /^release\(\) \{/ {p=0} p' "$SUBJECT" > "$H"
-grep -q '^take_lock() {' "$H" && ok "[setup] lifted holder_live..take_lock from the subject" || bad "[setup] could not lift take_lock"
+# Deterministic replay of the race, through the shared lock code test-scratch.sh calls
+# (_common.sh mxtk_lock_take, sourced from beside the subject): mxtk_lock_live is wrapped so that,
+# while this run judges the dead holder, a second run completes its own takeover and writes a live
+# lock. The pre-#304 code then `mv -f`'d that live lock away and took the lock too — two holders.
+# Taking over must re-read and leave a changed lock alone. Reap tickets: test-lock-reap.sh.
+H="$(cd "$(dirname "$SUBJECT")" && pwd)/_common.sh"; L="$WORK/race.lock"
+grep -q '^mxtk_lock_take() {' "$H" && grep -q 'mxtk_lock_take "\$1" "test-scratch.sh"' "$SUBJECT" \
+  && ok "[setup] the subject takes its locks through _common.sh's mxtk_lock_take" || bad "[setup] no shared mxtk_lock_take call in the subject"
 sleep 300 & LIVE=$!; BG="$BG $LIVE"
-OUT="$( L="$L" LIVE="$LIVE" bash -c '
+OUT="$( L="$L" LIVE="$LIVE" PROJECT_ROOT="$P" bash -c '
   . "$1"
-  eval "orig_$(declare -f holder_live)"
-  holder_live() {   # the dead holder is being judged: another run finishes ITS takeover now
+  eval "orig_$(declare -f mxtk_lock_live)"
+  mxtk_lock_live() {   # the dead holder is being judged: another run finishes ITS takeover now
     [ "$1" = 999999 ] && printf "%s %s %s\n" "$LIVE" "$(date +%s)" "test-scratch.sh" > "$L"
     [ "$1" = "$LIVE" ]
   }
   printf "999999 1 test-scratch.sh\n" > "$L"
-  take_lock "$L" "race lock"; echo "rc=$?"
+  mxtk_lock_take "$L" "test-scratch.sh" 8; echo "rc=$?"
 ' _ "$H" 2>&1 )"
 has "the second taker is refused (the live lock survives)" "$OUT" "rc=1"
 [ "$(cut -d' ' -f1 "$L" 2>/dev/null)" = "$LIVE" ] && ok "the lock still names the live holder" || bad "the live holder's lock was replaced: $(cat "$L" 2>/dev/null)"
-[ -e "$L.takeover" ] && bad "takeover marker left behind" || ok "takeover marker cleared"
-echo "-- a takeover marker whose pid is dead (a takeover that died midway) is cleared"
+ls -a "$WORK" | grep -qE '^race\.lock\.(reap|tmp)\.' && bad "reap ticket left behind" || ok "no reap ticket left behind"
+echo "-- an old-style takeover file whose pid is dead (pre-ticket code died midway) is cleared"
 printf '999999 1 test-scratch.sh\n' > "$L"; printf '999998 1\n' > "$L.takeover"
-OUT="$( L="$L" bash -c '. "$1"; holder_live() { return 1; }; take_lock "$L" "race lock"; echo "rc=$?"' _ "$H" 2>&1 )"
-has "taken after clearing the dead marker" "$OUT" "rc=0"
+OUT="$( L="$L" PROJECT_ROOT="$P" bash -c '. "$1"; mxtk_lock_live() { return 1; }; mxtk_lock_take "$L" "test-scratch.sh" 8; echo "rc=$?"' _ "$H" 2>&1 )"
+has "taken past the dead takeover file" "$OUT" "rc=0"
 [ "$(cut -d' ' -f1 "$L" 2>/dev/null)" != 999999 ] && ok "the stale line is gone" || bad "stale line still there"
-echo "-- #324 review: a FRESH empty takeover file (its creator between create and write) is not stale"
-# find -mmin +0 counted a 0-2 s old file as old (GNU; BSD rounds up), so a takeover in progress was
-# treated as dead and two contenders could both take over. +1 = empty for over a minute.
+[ -e "$L.takeover" ] && bad "dead takeover file left behind" || ok "and the dead takeover file is cleared"
+echo "-- #324 review: a FRESH empty takeover file (old code between create and write) is respected"
 printf '999999 1 test-scratch.sh\n' > "$L"; : > "$L.takeover"
-OUT="$( L="$L" bash -c '. "$1"; holder_live() { return 1; }; take_lock "$L" "race lock"; echo "rc=$?"' _ "$H" 2>&1 )"
-has "not taken while a fresh empty takeover file exists" "$OUT" "rc=1"
+OUT="$( L="$L" PROJECT_ROOT="$P" MXTK_LOCK_RETRY_SLEEP=0.05 bash -c '. "$1"; mxtk_lock_live() { return 1; }; mxtk_lock_take "$L" "test-scratch.sh" 8; echo "rc=$?"' _ "$H" 2>&1 )"
+has "not taken while a fresh empty takeover file exists" "$OUT" "rc=2"
 [ -e "$L.takeover" ] && [ ! -s "$L.takeover" ] && ok "the fresh takeover file was left alone" || bad "the fresh takeover file was removed or replaced"
 [ "$(cut -d' ' -f1 "$L" 2>/dev/null)" = 999999 ] && ok "the lock was not touched" || bad "the lock was taken over under a live takeover"
 touch -t 200001010000 "$L.takeover"
-OUT="$( L="$L" bash -c '. "$1"; holder_live() { return 1; }; take_lock "$L" "race lock"; echo "rc=$?"' _ "$H" 2>&1 )"
+OUT="$( L="$L" PROJECT_ROOT="$P" bash -c '. "$1"; mxtk_lock_live() { return 1; }; mxtk_lock_take "$L" "test-scratch.sh" 8; echo "rc=$?"' _ "$H" 2>&1 )"
 has "an empty takeover file over a minute old is stale → taken" "$OUT" "rc=0"
 [ -e "$L.takeover" ] && bad "takeover file left behind" || ok "and no takeover file is left behind"
 kill -KILL "$LIVE" 2>/dev/null; wait "$LIVE" 2>/dev/null