diff --git a/README.md b/README.md
index ea321a8f8cf..864e499d904 100644
--- a/README.md
+++ b/README.md
@@ -204,6 +204,7 @@ Firstmate's skills live in two separate places with different audiences:
 - [docs/calm.md](docs/calm.md) - current Pi `/calm` behavior and supported presentation limits.
 - [docs/voice-relay.md](docs/voice-relay.md) - the optional spoken interface: setup on both machines, measured round-trip cost, what a spoken answer may read, and what this build does not do yet.
 - [docs/wedge-alarm.md](docs/wedge-alarm.md) - configure the active alert for an away-mode escalation delivery that gets stuck.
+- [docs/bitwarden-rollout.md](docs/bitwarden-rollout.md) - the staged, gate-approved path to organization-owned Bitwarden custody for production and team credentials.
 - [docs/tmux-backend.md](docs/tmux-backend.md) - current setup and limits for the tmux reference backend.
 - [docs/herdr-backend.md](docs/herdr-backend.md) - current setup, safety boundaries, and limits for the experimental Herdr backend.
 - [docs/zellij-backend.md](docs/zellij-backend.md) - current setup and limits for the experimental Zellij backend.
diff --git a/bin/fm-bitwarden-ceremony.sh b/bin/fm-bitwarden-ceremony.sh
new file mode 100755
index 00000000000..2cabf09410c
--- /dev/null
+++ b/bin/fm-bitwarden-ceremony.sh
@@ -0,0 +1,459 @@
+#!/usr/bin/env bash
+# fm-bitwarden-ceremony.sh - structure/status validator for Bitwarden migration
+# ceremony records (docs/bitwarden-rollout.md owns the ceremony itself).
+#
+# Usage:
+#   bin/fm-bitwarden-ceremony.sh init <batch-id>
+#   bin/fm-bitwarden-ceremony.sh add-item <batch-id> <item-label> --owner <label> --collection <label>
+#   bin/fm-bitwarden-ceremony.sh mark <batch-id> <step> [--approved-by <label>]
+#   bin/fm-bitwarden-ceremony.sh status <batch-id>
+#   bin/fm-bitwarden-ceremony.sh check <batch-id>
+#   bin/fm-bitwarden-ceremony.sh --help
+#
+# One record per migration batch at $FM_HOME/data/bitwarden/<batch-id>.ceremony
+# (FM_HOME defaults to the repo root; FM_DATA_OVERRIDE overrides the data root
+# for tests). The record is the auditable no-secret completion evidence for one
+# batch of the phased migration ceremony in docs/bitwarden-rollout.md.
+#
+# HARD SAFETY CONTRACT - this tool never touches secrets:
+#   - It never reads from, writes to, or talks to Bitwarden, Automic Vault, or
+#     any credential store. It validates a local text record, nothing else.
+#   - Every free-text argument is a short reference LABEL (an item name, a
+#     person, a collection). Values that look like secret material - wrong
+#     charset, excessive length, long hex runs, or well-known token prefixes -
+#     are refused, and the refusal message never echoes the offending value,
+#     so a mistakenly pasted secret is neither persisted nor logged.
+#   - A structurally invalid record line is reported by line number only,
+#     never by content, for the same reason.
+#
+# Record format (v1, line-based, append-only):
+#   fm-bitwarden-ceremony v1
+#   batch: <batch-id>
+#   created: <YYYY-MM-DD>
+#   item: <label> owner=<label> collection=<label>
+#   step: <name> date=<YYYY-MM-DD> [approved-by=<label>]
+# The batch and created headers appear exactly once each, before any item or
+# step line, and the batch header must name the batch being read - a record
+# copied or renamed to another batch id is refused rather than reported as that
+# batch's evidence. Every line must carry exactly the fields shown above, every
+# label value must be a valid reference label, and every date must be a real
+# YYYY-MM-DD calendar date that is not in the future, no earlier than the
+# created header, and no earlier than the previous step's date, so the record
+# cannot certify a history the ceremony could not have produced. The accepted
+# dates are exactly the ones this tool can stamp, so it never appends a line
+# its own readers would then refuse. Every line ends with a newline; a record
+# whose final line does not is treated as truncated and refused, because
+# appending to it would fuse two record lines into one. An item label may be
+# registered at most once and never after the moved step, and the moved step
+# requires at least one item already registered - the same rules `add-item`
+# and `mark` apply when they write.
+#
+# Steps are batch-level and strictly ordered:
+#   preflight -> approval -> moved -> verified -> retired
+# Every command that reads a record requires its recorded steps to be exactly
+# that order with nothing skipped, repeated, or added after `retired`, so a
+# hand-edited or tampered history is refused by `check` and `status` instead of
+# being reported as progress. A refused record is corrected back to its last
+# valid prefix, or quarantined and replaced by a new batch, per the recovery
+# procedure in docs/bitwarden-rollout.md; this tool never normalizes one.
+# Further gates on `mark`:
+#   - approval requires --approved-by (the captain's recorded identity label);
+#     no other step accepts it.
+#   - moved requires at least one registered item, so a batch cannot be
+#     "moved" with no recorded per-item ownership/collection target.
+#   - retired is the destructive gate: it is refused unless verified is marked
+#     AND an approval line with approved-by exists, so old-custody retirement
+#     can never be recorded before post-move verification and captain approval.
+# Replaying a command with the same arguments is idempotent: re-running init on
+# an initialized batch, re-adding an identical item, or re-marking a recorded
+# step is a no-op success, so an interrupted ceremony can be resumed by
+# replaying commands. A replay whose arguments contradict the record - another
+# owner or collection for a registered item, another --approved-by for a
+# recorded approval - is refused naming the conflicting field instead, so a
+# replay is never reported as success while the evidence says something else.
+# `check` re-validates any partial record and prints the next required step,
+# which is the recovery entry point after an interruption.
+set -eu
+
+SELF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+FM_ROOT="$(cd "$SELF_DIR/.." && pwd)"
+FM_HOME="${FM_HOME:-$FM_ROOT}"
+DATA="${FM_DATA_OVERRIDE:-$FM_HOME/data}"
+RECORD_DIR="$DATA/bitwarden"
+
+STEPS="preflight approval moved verified retired"
+
+is_step() {  # <name> - exact whole-word membership in $STEPS
+  local s
+  for s in $STEPS; do
+    if [ "$s" = "$1" ]; then return 0; fi
+  done
+  return 1
+}
+
+die() { printf 'fm-bitwarden-ceremony: %s\n' "$*" >&2; exit 1; }
+note() { printf 'fm-bitwarden-ceremony: %s\n' "$*"; }
+
+RECOVERY_HINT='correct the record back to its last valid prefix, or quarantine it and start a new batch (see docs/bitwarden-rollout.md); this tool never repairs a record for you'
+
+# $1=batch $2=line-number $3=reason. Names the line and the expected shape,
+# never the line content (see the safety contract above).
+corrupt() {
+  die "record for batch '$1' is corrupt at line $2 ($3; content withheld in case it holds secret material); $RECOVERY_HINT"
+}
+
+usage() {
+  awk 'NR == 1 { next } /^#/ { sub(/^# ?/, ""); print; next } { exit }' "${BASH_SOURCE[0]}"
+}
+
+# Prints why $1 looks like secret material and returns 0; returns 1 when it
+# does not. The reason never contains the value (see the safety contract).
+secret_shape_defect() {
+  case $1 in
+    ghp_*|github_pat_*|sk-*|xox*|AKIA*|glpat-*|eyJ*) printf 'matches a well-known credential shape'; return 0 ;;
+  esac
+  if printf '%s' "$1" | grep -Eq -- '[A-Fa-f0-9]{32}'; then
+    printf 'contains a long hexadecimal run'
+    return 0
+  fi
+  return 1
+}
+
+# Prints why $1 is not a usable reference label and returns 0; returns 1 when it
+# is one. Sole definition of a label, shared by the arguments this tool accepts
+# and the values it reads back out of a record.
+label_defect() {
+  case $1 in
+    '') printf 'is empty'; return 0 ;;
+  esac
+  if [ ${#1} -gt 64 ]; then
+    printf 'is too long for a reference label (max 64)'
+    return 0
+  fi
+  case $1 in
+    *[!A-Za-z0-9._@/-]*) printf 'contains characters outside A-Za-z0-9 . _ @ / -'; return 0 ;;
+  esac
+  secret_shape_defect "$1"
+}
+
+is_leap_year() {  # <yyyy>
+  if [ $(($1 % 400)) -eq 0 ]; then return 0; fi
+  if [ $(($1 % 100)) -eq 0 ]; then return 1; fi
+  [ $(($1 % 4)) -eq 0 ]
+}
+
+is_date() {  # <value> - a real YYYY-MM-DD calendar date
+  local year day last_day
+  case $1 in
+    [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]) ;;
+    *) return 1 ;;
+  esac
+  year=$((10#${1:0:4}))
+  [ "$year" -ne 0 ] || return 1
+  case ${1:5:2} in
+    01|03|05|07|08|10|12) last_day=31 ;;
+    04|06|09|11) last_day=30 ;;
+    02) if is_leap_year "$year"; then last_day=29; else last_day=28; fi ;;
+    *) return 1 ;;
+  esac
+  day=$((10#${1:8:2}))
+  [ "$day" -ge 1 ] && [ "$day" -le "$last_day" ]
+}
+
+# Secret-shape refusals shared by every free-text argument. $1=field-name
+# $2=value; on refusal, dies naming only the field, never the value.
+refuse_secret_shape() {
+  local field=$1 defect
+  if defect=$(secret_shape_defect "$2"); then
+    die "refused: value for $field $defect; secret values must never be passed to this tool"
+  fi
+}
+
+# A batch id is a filename component; anything else risks path traversal.
+valid_batch_id() {
+  case $1 in
+    *[!a-z0-9-]*|-*|'') return 1 ;;
+  esac
+  [ ${#1} -le 64 ]
+}
+
+# A batch id is persisted as a filename and echoed in progress messages, so it
+# faces the same secret-shape refusals as a label.
+require_batch_id() {
+  valid_batch_id "$1" || die "refused: batch id must match [a-z0-9][a-z0-9-]* (max 64 chars)"
+  refuse_secret_shape 'batch id' "$1"
+}
+
+# Labels are short human references. Refuse anything shaped like secret
+# material WITHOUT echoing it (see the safety contract above).
+# $1=field-name $2=value; on refusal, dies naming only the field.
+require_label() {
+  local field=$1 value=$2 defect
+  if defect=$(label_defect "$value"); then
+    [ -n "$value" ] || die "refused: $field is empty; pass a short reference label"
+    die "refused: value for $field $defect; secret values must never be passed to this tool"
+  fi
+}
+
+record_path() { printf '%s/%s.ceremony' "$RECORD_DIR" "$1"; }
+
+today() { date -u +%Y-%m-%d; }
+
+# Parse and validate a record. Populates:
+#   PARSED_ITEMS   - newline list of item labels
+#   PARSED_ITEM_COUNT - how many item labels that list holds
+#   PARSED_STEPS   - space list of recorded step names, record order
+#   PARSED_APPROVED_BY - approver label when the approval step is recorded
+# The record must name the batch being read, carry each header exactly once
+# ahead of the body, register no item after the moved step, and record steps as
+# an ordered prefix of $STEPS with no repeat, gap, or trailing step, so every
+# reader refuses a tampered or misfiled record rather than reporting progress
+# from it.
+# Dies with a line NUMBER (never content) on any malformed line.
+parse_record() {
+  local path=$1 batch=$2 lineno=0 line rest name pending=$STEPS expected
+  local fields owner collection date_value approver='' defect
+  local seen_batch=0 seen_created=0 in_body=0 moved_seen=0 unterminated=0
+  local created_date='' prev_step_date='' today_date
+  today_date=$(today)
+  PARSED_ITEMS=""
+  PARSED_ITEM_COUNT=0
+  PARSED_STEPS=""
+  PARSED_APPROVED_BY=""
+  [ -f "$path" ] || die "no ceremony record for batch '$batch'; run init first"
+  while IFS= read -r line || { [ -n "$line" ] && unterminated=1; }; do
+    lineno=$((lineno + 1))
+    [ "$unterminated" -eq 0 ] || corrupt "$batch" "$lineno" 'final line has no terminating newline, so the record is truncated'
+    if [ "$lineno" -eq 1 ]; then
+      [ "$line" = 'fm-bitwarden-ceremony v1' ] || die "record for batch '$batch' is not a v1 ceremony record (line 1); $RECOVERY_HINT"
+      continue
+    fi
+    case $line in
+      'batch: '*)
+        [ "$in_body" -eq 0 ] || corrupt "$batch" "$lineno" 'batch header after the record body'
+        [ "$seen_batch" -eq 0 ] || corrupt "$batch" "$lineno" 'repeated batch header'
+        seen_batch=1
+        [ "${line#batch: }" = "$batch" ] || corrupt "$batch" "$lineno" "batch header names a different batch, so this record is not evidence for '$batch'"
+        ;;
+      'created: '*)
+        [ "$in_body" -eq 0 ] || corrupt "$batch" "$lineno" 'created header after the record body'
+        [ "$seen_created" -eq 0 ] || corrupt "$batch" "$lineno" 'repeated created header'
+        seen_created=1
+        created_date=${line#created: }
+        is_date "$created_date" || corrupt "$batch" "$lineno" 'created header is not a YYYY-MM-DD calendar date'
+        if [[ $created_date > $today_date ]]; then
+          corrupt "$batch" "$lineno" 'created header is dated in the future, so the batch cannot have been created yet'
+        fi
+        ;;
+      'item: '*)
+        in_body=1
+        [ "$moved_seen" -eq 0 ] || corrupt "$batch" "$lineno" 'item registered after the batch was marked moved'
+        rest=${line#item: }
+        name=${rest%% *}
+        if defect=$(label_defect "$name"); then corrupt "$batch" "$lineno" "item label $defect"; fi
+        fields=${rest#"$name" }
+        owner=${fields#owner=}
+        owner=${owner%% *}
+        collection=${fields##*collection=}
+        [ "$line" = "item: $name owner=$owner collection=$collection" ] || corrupt "$batch" "$lineno" 'malformed item line'
+        if defect=$(label_defect "$owner"); then corrupt "$batch" "$lineno" "item owner $defect"; fi
+        if defect=$(label_defect "$collection"); then corrupt "$batch" "$lineno" "item collection $defect"; fi
+        case $'\n'"$PARSED_ITEMS" in
+          *$'\n'"$name"$'\n'*) corrupt "$batch" "$lineno" 'item label already registered on an earlier line' ;;
+        esac
+        PARSED_ITEMS="$PARSED_ITEMS$name"$'\n'
+        PARSED_ITEM_COUNT=$((PARSED_ITEM_COUNT + 1))
+        ;;
+      'step: '*)
+        in_body=1
+        rest=${line#step: }
+        name=${rest%% *}
+        is_step "$name" || corrupt "$batch" "$lineno" 'unknown step'
+        fields=${rest#"$name" }
+        date_value=${fields#date=}
+        date_value=${date_value%% *}
+        if [ "$name" = approval ]; then
+          approver=${fields##* approved-by=}
+          [ "$line" = "step: $name date=$date_value approved-by=$approver" ] || corrupt "$batch" "$lineno" 'malformed approval step line'
+        else
+          [ "$line" = "step: $name date=$date_value" ] || corrupt "$batch" "$lineno" 'malformed step line'
+        fi
+        is_date "$date_value" || corrupt "$batch" "$lineno" 'step date is not a YYYY-MM-DD calendar date'
+        if [[ $date_value > $today_date ]]; then
+          corrupt "$batch" "$lineno" 'step date is in the future, so the ceremony cannot have reached it'
+        fi
+        if [[ $date_value < $created_date ]]; then
+          corrupt "$batch" "$lineno" 'step date is earlier than the created header, so the step predates the batch'
+        fi
+        if [ -n "$prev_step_date" ] && [[ $date_value < $prev_step_date ]]; then
+          corrupt "$batch" "$lineno" 'step date is earlier than the previous step, so the recorded history runs backwards'
+        fi
+        prev_step_date=$date_value
+        expected=${pending%% *}
+        [ -n "$expected" ] || corrupt "$batch" "$lineno" 'step recorded after the ceremony is already complete'
+        [ "$name" = "$expected" ] || corrupt "$batch" "$lineno" "steps out of order, expected '$expected' at this point"
+        case $pending in
+          *' '*) pending=${pending#* } ;;
+          *) pending='' ;;
+        esac
+        if [ "$name" = approval ]; then
+          if defect=$(label_defect "$approver"); then corrupt "$batch" "$lineno" "approval approved-by $defect"; fi
+          PARSED_APPROVED_BY=$approver
+        fi
+        if [ "$name" = moved ]; then
+          [ "$PARSED_ITEM_COUNT" -gt 0 ] || corrupt "$batch" "$lineno" 'batch marked moved with no registered item, so the record names no ownership or collection target'
+          moved_seen=1
+        fi
+        PARSED_STEPS="$PARSED_STEPS$name "
+        ;;
+      *) corrupt "$batch" "$lineno" 'unrecognized line' ;;
+    esac
+  done < "$path"
+  [ "$seen_batch" -eq 1 ] || die "record for batch '$batch' has no batch header naming the batch it is evidence for; $RECOVERY_HINT"
+  [ "$seen_created" -eq 1 ] || die "record for batch '$batch' has no created header; $RECOVERY_HINT"
+}
+
+step_recorded() {  # <step> - against PARSED_STEPS
+  case " $PARSED_STEPS" in
+    *" $1 "*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+next_step() {  # first unrecorded step in order, or nothing when complete
+  local s
+  for s in $STEPS; do
+    if ! step_recorded "$s"; then printf '%s' "$s"; return 0; fi
+  done
+  return 1
+}
+
+report_next() {
+  local n
+  if n=$(next_step); then printf 'next: %s\n' "$n"; else printf 'next: complete\n'; fi
+}
+
+cmd_init() {
+  local batch=$1 path
+  require_batch_id "$batch"
+  path=$(record_path "$batch")
+  if [ -f "$path" ]; then
+    parse_record "$path" "$batch"
+    note "batch '$batch' already initialized; nothing to do"
+    return 0
+  fi
+  mkdir -p "$RECORD_DIR"
+  {
+    printf 'fm-bitwarden-ceremony v1\n'
+    printf 'batch: %s\n' "$batch"
+    printf 'created: %s\n' "$(today)"
+  } > "$path"
+  note "batch '$batch' initialized at $path"
+}
+
+cmd_add_item() {
+  local batch=$1 label=$2 owner='' collection='' path
+  shift 2
+  while [ $# -gt 0 ]; do
+    case $1 in
+      --owner) owner=${2:?}; shift 2 ;;
+      --collection) collection=${2:?}; shift 2 ;;
+      *) die "unknown add-item argument (see --help)" ;;
+    esac
+  done
+  require_batch_id "$batch"
+  require_label 'item label' "$label"
+  require_label '--owner' "$owner"
+  require_label '--collection' "$collection"
+  path=$(record_path "$batch")
+  parse_record "$path" "$batch"
+  local line="item: $label owner=$owner collection=$collection"
+  if grep -Fqx -- "$line" "$path"; then
+    note "batch '$batch': item '$label' already recorded; nothing to do"
+    return 0
+  fi
+  case $'\n'"$PARSED_ITEMS" in
+    *$'\n'"$label"$'\n'*)
+      die "batch '$batch': item '$label' already recorded with a different owner/collection; resolve the conflict in the record before continuing" ;;
+  esac
+  if step_recorded moved; then
+    die "batch '$batch': items cannot be added after the batch is marked moved; start a new batch"
+  fi
+  printf '%s\n' "$line" >> "$path"
+  note "batch '$batch': item '$label' registered (owner=$owner collection=$collection)"
+}
+
+cmd_mark() {
+  local batch=$1 step=$2 approved_by='' path expected
+  shift 2
+  while [ $# -gt 0 ]; do
+    case $1 in
+      --approved-by) approved_by=${2:?}; shift 2 ;;
+      *) die "unknown mark argument (see --help)" ;;
+    esac
+  done
+  require_batch_id "$batch"
+  is_step "$step" || die "unknown step; steps in order are: $STEPS"
+  if [ "$step" = approval ]; then
+    [ -n "$approved_by" ] || die "refused: approval requires --approved-by with the captain's recorded identity label"
+    require_label '--approved-by' "$approved_by"
+  else
+    [ -z "$approved_by" ] || die "--approved-by is only valid for the approval step"
+  fi
+  path=$(record_path "$batch")
+  parse_record "$path" "$batch"
+  if step_recorded "$step"; then
+    if [ "$step" = approval ] && [ "$approved_by" != "$PARSED_APPROVED_BY" ]; then
+      die "batch '$batch': approval is already recorded for a different approver; resolve the conflict in the record before continuing"
+    fi
+    note "batch '$batch': step '$step' already recorded; nothing to do"
+    return 0
+  fi
+  if [ "$step" = moved ] && [ "$PARSED_ITEM_COUNT" -eq 0 ]; then
+    die "batch '$batch': refused to mark moved with no registered items; every moved credential needs a recorded owner/collection target"
+  fi
+  if [ "$step" = retired ]; then
+    step_recorded verified || die "batch '$batch': refused to record retirement before post-move verification"
+    [ -n "$PARSED_APPROVED_BY" ] || die "batch '$batch': refused to record retirement without a recorded captain approval"
+  fi
+  expected=$(next_step) || die "batch '$batch' is already complete"
+  [ "$step" = "$expected" ] || die "batch '$batch': next required step is '$expected', not '$step' (steps in order are: $STEPS)"
+  if [ "$step" = approval ]; then
+    printf 'step: %s date=%s approved-by=%s\n' "$step" "$(today)" "$approved_by" >> "$path"
+  else
+    printf 'step: %s date=%s\n' "$step" "$(today)" >> "$path"
+  fi
+  note "batch '$batch': step '$step' recorded ($(today))"
+}
+
+cmd_status() {
+  local batch=$1 path s marker
+  require_batch_id "$batch"
+  path=$(record_path "$batch")
+  parse_record "$path" "$batch"
+  printf 'batch: %s\n' "$batch"
+  printf 'record: %s\n' "$path"
+  printf 'items: %s\n' "$PARSED_ITEM_COUNT"
+  for s in $STEPS; do
+    if step_recorded "$s"; then marker='x'; else marker=' '; fi
+    printf '  [%s] %s\n' "$marker" "$s"
+  done
+  report_next
+}
+
+cmd_check() {
+  local batch=$1
+  require_batch_id "$batch"
+  parse_record "$(record_path "$batch")" "$batch"
+  report_next
+}
+
+case ${1:-} in
+  -h|--help|help|'') usage; exit 0 ;;
+  init) [ $# -eq 2 ] || die "usage: init <batch-id>"; cmd_init "$2" ;;
+  add-item) [ $# -ge 3 ] || die "usage: add-item <batch-id> <item-label> --owner <label> --collection <label>"; shift; cmd_add_item "$@" ;;
+  mark) [ $# -ge 3 ] || die "usage: mark <batch-id> <step> [--approved-by <label>]"; shift; cmd_mark "$@" ;;
+  status) [ $# -eq 2 ] || die "usage: status <batch-id>"; cmd_status "$2" ;;
+  check) [ $# -eq 2 ] || die "usage: check <batch-id>"; cmd_check "$2" ;;
+  *) die "unknown command; commands are: init add-item mark status check --help" ;;
+esac
diff --git a/docs/bitwarden-rollout.md b/docs/bitwarden-rollout.md
new file mode 100644
index 00000000000..d75ebdf53c4
--- /dev/null
+++ b/docs/bitwarden-rollout.md
@@ -0,0 +1,125 @@
+# Bitwarden rollout for production and team credentials
+
+This runbook is the staged path from temporary local-only credential custody to organization-owned Bitwarden custody for production and team credentials.
+It is written for a normal operator: every routine action is a short checklist step, and engineering is only needed when a step says so.
+Current access is preserved throughout: nothing is retired, rotated, or moved until the specific migration batch holding it is approved and verified.
+
+## Custody boundaries this rollout does not change
+
+- Local secrets stay in the hardened local vault (Automic Vault).
+  This rollout covers production and team credentials only; it never weakens, duplicates, or replaces hardened local access.
+- Machine and unattended secrets are out of the initial migration.
+  Bitwarden Password Manager (human and team credentials) and Bitwarden Secrets Manager (machine and unattended access) are separate custody models with separate consequences.
+  Secrets Manager is deliberately not selected or enabled here; see the open decisions below.
+- No secret value ever appears in this repo, in ceremony records, in task reports, or in chat.
+  Every record names credentials by label, owner, and collection only.
+
+## Roles
+
+- **Owner (captain)**: approves phase gates, migration batches, and retirements; holds one organization owner account.
+- **Second owner/admin**: an independent person or independently held account that can recover the organization if the captain's account is lost.
+- **Batch operator**: runs a migration batch's checklist; may be the captain or a delegate; never approves their own batch when dual control applies.
+
+## Open decisions the captain must make before phase 1
+
+These are recorded here because the rollout cannot choose them on anyone's behalf:
+
+1. **Subscription and plan**: which Bitwarden plan and billing arrangement, chosen and purchased by the captain.
+2. **Owner identities**: which two (or more) independent people or independently held accounts hold owner/admin recovery, so no single person is a recovery dependency.
+3. **Retention and compliance**: any legal or contractual retention requirements that constrain export retention and deletion evidence.
+4. **Machine-access architecture**: whether machine and unattended secrets later adopt Bitwarden Secrets Manager (bringing service accounts and access tokens that themselves become credentials to custody), stay on their current mechanisms, or use another store.
+   Until this is decided, machine and unattended secrets remain on their current access paths, and nothing in the interim may copy them into Password Manager items as a workaround.
+
+## Credential class inventory
+
+Inventory classes and owners before the first batch; never enumerate or record secret values while doing it.
+
+| Class | Examples | Initial migration? | Why |
+| --- | --- | --- | --- |
+| Human interactive | a person's own logins to production consoles and forges | yes | core Password Manager fit |
+| Shared team | credentials several people legitimately share | yes | collections give least-privilege sharing |
+| Production service | database and service passwords humans hold today | yes, human copies only | the human-held copy moves; the deployed configuration is untouched |
+| CI/CD tokens | pipeline and deploy tokens | deferred | machine-access decision above owns their target |
+| Break-glass | emergency access used when normal paths fail | yes, last batch, dual control | highest blast radius; migrate only after the process is proven on lower-risk batches |
+| Local development | developer-machine secrets | no | stays in the hardened local vault |
+| Machine/unattended | service-to-service secrets no human types | no | Secrets Manager decision not made |
+
+## Phases and gates
+
+Each phase has an entry gate; do not start a phase until the previous phase's exit condition is met and the captain has approved moving on.
+
+### Phase 0 - decisions and inventory (no Bitwarden footprint)
+
+- Captain resolves the open decisions above.
+- Inventory the credential classes and owners (labels only).
+- Exit: decisions recorded, inventory exists, captain approves phase 1.
+
+### Phase 1 - organization hardening (no credentials migrated)
+
+- Captain creates the organization on the chosen plan.
+- Both owner/admin recovery paths are established and independently tested: each owner proves they can sign in, and account recovery (or an equivalent second path) is confirmed before any credential arrives.
+- Hardware-backed MFA is enrolled on every privileged account, with a documented MFA-loss recovery that does not depend on a single person.
+- Collections and groups are created least-privilege: one collection per team or system boundary, no default all-access group, admin roles held only by the named owners.
+- Joiner/mover/leaver procedure is written into the organization's own documentation: joiners get group membership only, movers change groups not items, leavers lose access by group removal and trigger rotation of anything they could have exported.
+- Exit: a second owner has demonstrated recovery access, MFA is verified on all privileged accounts, and the captain approves the pilot.
+
+### Phase 2 - pilot batch (lowest-risk shared team credentials)
+
+- Run one full migration ceremony (below) on a small, low-risk batch.
+- Run one full recovery drill (below) while the stakes are low.
+- Exit: pilot batch verified, drill passed, captain approves production batches.
+
+### Phase 3 - production batches
+
+- Migrate remaining in-scope classes in captain-approved batches, riskiest last.
+- Break-glass credentials move only under dual control: one person moves, a different person verifies, the captain approves.
+- Exit: all in-scope classes migrated or explicitly deferred with a recorded reason.
+
+### Phase 4 - routine operation
+
+- Joiner/mover/leaver runs as written; drills run on the recovery cadence below; deferred classes wait on their owning decision.
+
+## Migration ceremony (per batch)
+
+Every batch follows the same ordered ceremony, and its auditable no-secret record is kept with `bin/fm-bitwarden-ceremony.sh` (its `--help` owns the record format and step gates; the tool validates structure and status only and must never be given a secret value):
+
+1. **Init and plan**: initialize the batch record; register every item as label, owner, and target collection.
+2. **Preflight**: confirm each item's current custody still works, its target collection exists with the right group access, and its owner is available for verification.
+3. **Captain approval**: the captain approves this exact batch; the approval is recorded with the approver's identity.
+4. **Move**: the owner (or batch operator, with the owner for dual control) creates each item in Bitwarden by signing into both sides directly; values pass through no intermediate file, chat, or tool.
+5. **Verify**: each item's intended users prove real access through Bitwarden (an actual sign-in or connection using the migrated item), and anyone who should not see it confirms they cannot.
+6. **Rollback point**: if verification fails, the old custody is still intact; fix or remove the Bitwarden item and re-verify - nothing has been lost.
+7. **Retire old custody**: only after verification, delete or invalidate the old copy; where exposure during handling is suspected, rotate instead of merely deleting.
+8. **Record**: the completed batch record (labels, owners, collections, dates, approver - never values) is the completion evidence.
+
+The record tool refuses to mark retirement before verification and recorded approval, so a batch cannot skip its own safety order.
+It also refuses to read any record it cannot fully validate - a hand-edited, truncated, or misfiled history is never reported as progress - and its `--help` owns the exact record rules.
+When a record is refused, correct it back to its last valid prefix (delete only the trailing lines that are not yet true) or quarantine it outside the record directory and start a new batch; never edit it into a shape that merely satisfies the tool.
+
+## Encrypted export and recovery drills
+
+Design only until phase 2; no export is created outside a drill or the operational cadence.
+
+- **What**: the organization's encrypted export (password-protected, account-independent format), never a plaintext export, with no plaintext staging step at any point.
+- **Custody**: stored offline on dedicated media, at least two copies in separate physical locations.
+- **Split ownership**: the export file and its encryption passphrase are held by different people, so neither holder can read it alone; the passphrase itself is written down once per holder and stored with their personal recovery material, not in any vault the export is meant to recover.
+- **Restore verification**: a drill is passed only when a restore into a scratch client proves a sampled item actually opens; an unverified export is treated as no export.
+- **Rotation after exposure**: if an export or passphrase may have been exposed, rotate the credentials it contained, not just the export.
+- **Cadence**: refresh the export and run a restore drill at least quarterly, and immediately after any owner/admin change.
+- **Retention and deletion**: superseded exports are destroyed (media erased or physically destroyed), and the drill evidence records export date, holders, restore result, and destruction of the superseded copy - never contents.
+
+Drill evidence template (copy per drill, no secret values):
+
+```
+drill: <YYYY-MM-DD>
+export-created: <YYYY-MM-DD> by <label>
+copies: <location-label-1>, <location-label-2>
+passphrase-holder: <label> (distinct from export holder: <label>)
+restore-verified: <YYYY-MM-DD> by <label>, sampled item opened: yes/no
+superseded-copy-destroyed: <YYYY-MM-DD> by <label>
+notes: <free text, labels only>
+```
+
+## What this runbook never authorizes
+
+Creating accounts or organizations, choosing or purchasing a plan, inviting users, changing billing, reading or moving secret values, changing production access, rotating credentials, or retiring old custody all require the captain's direct participation or explicit approval at the gate that names them.
diff --git a/docs/documentation-audiences.json b/docs/documentation-audiences.json
index bceee95935c..7d9c72ecd8a 100644
--- a/docs/documentation-audiences.json
+++ b/docs/documentation-audiences.json
@@ -228,6 +228,10 @@
       "path": "docs/arm-pretool-check.md",
       "audience": "maintainer-architecture"
     },
+    {
+      "path": "docs/bitwarden-rollout.md",
+      "audience": "operator-current"
+    },
     {
       "path": "docs/calm-mode-feasibility.md",
       "audience": "maintainer-verification"
diff --git a/docs/scripts.md b/docs/scripts.md
index 6304e91e063..38758fa024f 100644
--- a/docs/scripts.md
+++ b/docs/scripts.md
@@ -130,6 +130,7 @@ The shared no-mistakes gate refusal for fleet lifecycle entrypoints is summarize
 | `fm-public-followup.sh`  | Reconcile and deliver typed public commitments, then rechain or explicitly retire their retained loops |
 | `fm-public-followup-emit.sh` | Report one typed terminal work result into the home that owes the public reply    |
 | `fm-inbox.sh`            | The captain's out-of-band capture surface: queue a note, dictate one, read status, ask a side question |
+| `fm-bitwarden-ceremony.sh` | No-secret structure/status validator for Bitwarden migration-batch ceremony records ([bitwarden-rollout.md](bitwarden-rollout.md)) |
 | `fm-voice-relay.py`      | Hold the spoken conversation on this host, answer from the records, and hand real work to `fm-inbox.sh` ([voice-relay.md](voice-relay.md)) |
 | `fm-voice-client.py`     | The laptop end of the spoken interface: capture, playback, and turn timing over SSH; audio devices unverified |
 | `fm_voice_frame.py`      | The wire format both machines share, copied to the laptop beside the client          |
diff --git a/tests/fm-bitwarden-ceremony.test.sh b/tests/fm-bitwarden-ceremony.test.sh
new file mode 100644
index 00000000000..e89cf0f8c3f
--- /dev/null
+++ b/tests/fm-bitwarden-ceremony.test.sh
@@ -0,0 +1,623 @@
+#!/usr/bin/env bash
+# Behavior tests for fm-bitwarden-ceremony.sh, the no-secret structure/status
+# validator for Bitwarden migration ceremony records.
+#
+# The safety contract under test: the tool refuses secret-shaped input without
+# echoing or persisting it, refuses malicious batch ids that could escape the
+# record directory, enforces the strict step order that keeps old-custody
+# retirement behind post-move verification and captain approval, stays
+# idempotent so an interrupted ceremony can be replayed, and reports a corrupt
+# record by line number only, never by content.
+set -u
+
+# shellcheck source=tests/lib.sh disable=SC1091
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+TMP_ROOT=$(fm_test_tmproot fm-bitwarden-ceremony-tests)
+CEREMONY="$ROOT/bin/fm-bitwarden-ceremony.sh"
+export FM_DATA_OVERRIDE="$TMP_ROOT/data"
+RECORDS="$FM_DATA_OVERRIDE/bitwarden"
+
+run() {  # <expected-exit> <label> <args...>
+  local expected=$1 label=$2 rc=0
+  shift 2
+  OUT=$("$CEREMONY" "$@" 2>&1) || rc=$?
+  [ "$rc" -eq "$expected" ] || fail "$label: expected exit $expected, got $rc"$'\n'"--- output ---"$'\n'"$OUT"
+}
+
+# --- init and malicious batch ids -------------------------------------------
+
+run 0 'init creates a record' init batch-a
+[ -f "$RECORDS/batch-a.ceremony" ] || fail 'init did not create the record file'
+
+run 0 'init is an idempotent no-op' init batch-a
+assert_contains "$OUT" 'already initialized' 'repeat init reports no-op'
+
+# shellcheck disable=SC2016  # the literal '$(touch x)' string is the attack input
+for bad in '../evil' 'a/b' 'a b' 'UPPER' '-lead' '' '$(touch x)'; do
+  rc=0
+  OUT=$("$CEREMONY" init "$bad" 2>&1) || rc=$?
+  [ "$rc" -ne 0 ] || fail "malicious batch id was accepted: '$bad'"
+done
+# A secret-shaped batch id faces the same refusals as a label: it is persisted
+# as a filename and echoed in progress messages.
+SECRET_BATCH_IDS=(
+  'glpat-xxxxxxxxxxxxxxxxxxxx'
+  'sk-proj-abcdef'
+  'xoxb-1234-abcd'
+  'deadbeefdeadbeefdeadbeefdeadbeef'
+)
+for secret in "${SECRET_BATCH_IDS[@]}"; do
+  for cmd in init status check; do
+    rc=0
+    OUT=$("$CEREMONY" "$cmd" "$secret" 2>&1) || rc=$?
+    [ "$rc" -ne 0 ] || fail "secret-shaped batch id was accepted by $cmd: shape $(printf '%.4s' "$secret")..."
+    case $OUT in
+      *"$secret"*) fail "$cmd refusal output echoed the secret-shaped batch id" ;;
+    esac
+    assert_contains "$OUT" 'refused' "$cmd refuses a secret-shaped batch id with a redacted message"
+  done
+  rc=0
+  OUT=$("$CEREMONY" add-item "$secret" item-x --owner ops --collection team 2>&1) || rc=$?
+  [ "$rc" -ne 0 ] || fail 'secret-shaped batch id was accepted by add-item'
+  case $OUT in
+    *"$secret"*) fail 'add-item refusal output echoed the secret-shaped batch id' ;;
+  esac
+  assert_absent "$RECORDS/$secret.ceremony" 'a refused secret-shaped batch id created a record file'
+done
+
+# The dispatcher must not log an argument it has not validated.
+rc=0
+OUT=$("$CEREMONY" 'ghp_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' 2>&1) || rc=$?
+[ "$rc" -ne 0 ] || fail 'unknown command was accepted'
+case $OUT in
+  *ghp_*) fail 'unknown-command diagnostic echoed the raw argument' ;;
+esac
+
+[ ! -e "$TMP_ROOT/data/evil.ceremony" ] || fail 'traversal id escaped the record dir'
+[ ! -e "$RECORDS/x" ] || fail 'metacharacter id executed or created a file'
+found=$(find "$TMP_ROOT" -name '*.ceremony' | wc -l | tr -d ' ')
+[ "$found" = 1 ] || fail "malicious ids created records (found $found)"
+
+# --- secret-shaped input is refused, redacted, and never persisted ----------
+
+SECRETS=(
+  'ghp_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
+  'github_pat_11ABCDEFG'
+  'sk-proj-abcdef'
+  'xoxb-1234-abcd'
+  'AKIAIOSFODNN7EXAMPLE'
+  'glpat-xxxxxxxxxxxxxxxxxxxx'
+  'eyJhbGciOiJIUzI1NiJ9.payload.sig'
+  'deadbeefdeadbeefdeadbeefdeadbeef'
+  'p4ssw0rd with spaces'
+  'has"quote'
+)
+for secret in "${SECRETS[@]}"; do
+  rc=0
+  OUT=$("$CEREMONY" add-item batch-a item-x --owner "$secret" --collection team 2>&1) || rc=$?
+  [ "$rc" -ne 0 ] || fail "secret-shaped owner was accepted: shape $(printf '%.4s' "$secret")..."
+  case $OUT in
+    *"$secret"*) fail 'refusal output echoed the secret-shaped value' ;;
+  esac
+  assert_contains "$OUT" 'refused' 'secret-shaped value is refused with a redacted message'
+done
+overlong=$(printf 'a%.0s' $(seq 1 80))
+run 1 'over-long label is refused' add-item batch-a "$overlong" --owner ops --collection team
+case $OUT in *"$overlong"*) fail 'refusal output echoed the over-long value' ;; esac
+for secret in "${SECRETS[@]}"; do
+  ! grep -Fq "$secret" "$RECORDS/batch-a.ceremony" || fail 'a refused secret-shaped value was persisted to the record'
+done
+
+# --- ordering, retirement gates, and idempotent replay ----------------------
+
+run 0 'item registers with owner and collection' add-item batch-a prod-db --owner ops-team --collection prod-infra
+run 0 'identical add-item is an idempotent no-op' add-item batch-a prod-db --owner ops-team --collection prod-infra
+[ "$(grep -c '^item: prod-db ' "$RECORDS/batch-a.ceremony")" = 1 ] || fail 'idempotent add-item duplicated the item line'
+run 1 'conflicting re-add of the same label is refused' add-item batch-a prod-db --owner other --collection prod-infra
+
+# A leading-dash label must reach the conflict guard as a pattern, not as
+# options to the command that implements it.
+run 0 'dash-leading batch initializes' init batch-dash
+run 0 'dash-leading item registers' add-item batch-dash -dash-item --owner ops --collection team
+assert_not_contains "$OUT" 'grep:' 'dash-leading label was parsed as command options'
+run 0 'identical dash-leading re-add is an idempotent no-op' add-item batch-dash -dash-item --owner ops --collection team
+run 1 'conflicting dash-leading re-add is refused' add-item batch-dash -dash-item --owner other --collection team
+assert_contains "$OUT" 'different owner/collection' 'dash-leading conflict names the reason'
+[ "$(grep -Fc -- 'item: -dash-item ' "$RECORDS/batch-dash.ceremony")" = 1 ] || fail 'conflicting dash-leading item was appended anyway'
+run 0 'dash-leading batch status counts one item' status batch-dash
+assert_contains "$OUT" 'items: 1' 'dash-leading batch reports one registered item'
+
+run 1 'retirement is refused before any earlier step' mark batch-a retired
+assert_contains "$OUT" 'before post-move verification' 'retirement refusal names the verification gate, not generic ordering'
+! grep -q '^step: retired' "$RECORDS/batch-a.ceremony" || fail 'refused retirement was recorded anyway'
+run 1 'verification cannot be recorded before the move' mark batch-a verified
+assert_contains "$OUT" "next required step is 'preflight'" 'out-of-turn step names the required step'
+run 1 'approval requires --approved-by' mark batch-a approval
+assert_contains "$OUT" 'approval requires --approved-by' 'approval refusal names the missing approver, not generic ordering'
+
+run 0 'preflight records' mark batch-a preflight
+run 0 'preflight re-mark is an idempotent no-op' mark batch-a preflight
+[ "$(grep -c '^step: preflight' "$RECORDS/batch-a.ceremony")" = 1 ] || fail 'idempotent re-mark duplicated the step line'
+run 1 'skipping ahead to moved is refused' mark batch-a moved
+assert_contains "$OUT" "next required step is 'approval'" 'skip-ahead refusal names the required step'
+# With preflight recorded, approval is the next step, so this reaches the
+# --approved-by gate rather than the ordering check ahead of it.
+run 1 'approval at its own turn still requires --approved-by' mark batch-a approval
+assert_contains "$OUT" 'approval requires --approved-by' 'in-turn approval refusal names the missing approver'
+! grep -q '^step: approval' "$RECORDS/batch-a.ceremony" || fail 'refused approval was recorded anyway'
+run 1 '--approved-by is rejected for a non-approval step' mark batch-a moved --approved-by captain
+assert_contains "$OUT" 'only valid for the approval step' 'misplaced --approved-by names the reason'
+run 0 'approval records with approver' mark batch-a approval --approved-by captain
+grep -q '^step: approval date=.* approved-by=captain$' "$RECORDS/batch-a.ceremony" || fail 'approval line missing approver'
+
+# A replay must be judged against the arguments the operator actually passed:
+# identical is a no-op, conflicting is a refusal, invalid is refused either way.
+run 0 'replaying approval with the same approver stays a no-op' mark batch-a approval --approved-by captain
+assert_contains "$OUT" 'already recorded' 'identical approval replay is idempotent'
+run 1 'replaying approval with a different approver is refused' mark batch-a approval --approved-by someone-else
+assert_contains "$OUT" 'different approver' 'conflicting approval replay names the conflict'
+grep -q '^step: approval date=.* approved-by=captain$' "$RECORDS/batch-a.ceremony" || fail 'a conflicting replay changed the recorded approver'
+[ "$(grep -c '^step: approval' "$RECORDS/batch-a.ceremony")" = 1 ] || fail 'a conflicting replay appended a second approval line'
+run 1 'replaying approval with a secret-shaped approver is refused' mark batch-a approval --approved-by ghp_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+assert_contains "$OUT" 'refused' 'a secret-shaped approver is refused even on a recorded step'
+assert_not_contains "$OUT" 'ghp_' 'the refusal echoed the secret-shaped approver'
+run 1 '--approved-by is refused on an already-recorded non-approval step' mark batch-a preflight --approved-by captain
+assert_contains "$OUT" 'only valid for the approval step' 'misplaced --approved-by is refused on a replay too'
+run 1 'retirement is still refused before verification' mark batch-a retired
+assert_contains "$OUT" 'before post-move verification' 'retirement refusal after approval still names the verification gate'
+run 0 'moved records' mark batch-a moved
+run 1 'items cannot be added after the move' add-item batch-a late-item --owner ops --collection team
+run 1 'retirement is refused before post-move verification' mark batch-a retired
+assert_contains "$OUT" 'before post-move verification' 'post-move retirement refusal names the verification gate'
+! grep -q '^step: retired' "$RECORDS/batch-a.ceremony" || fail 'refused retirement was recorded after the move'
+run 0 'verified records' mark batch-a verified
+run 0 'retirement is allowed only after verification and approval' mark batch-a retired
+run 0 'status renders the complete batch' status batch-a
+assert_contains "$OUT" 'next: complete' 'complete batch reports next: complete'
+
+# A batch with no registered items can never be marked moved.
+run 0 'empty batch initializes' init batch-empty
+run 0 'empty batch preflight' mark batch-empty preflight
+run 0 'empty batch approval' mark batch-empty approval --approved-by captain
+run 1 'moved is refused with no registered items' mark batch-empty moved
+assert_contains "$OUT" 'no registered items' 'itemless move refusal names the reason'
+
+# --- partial ceremony recovery ----------------------------------------------
+
+run 0 'partial batch initializes' init batch-part
+run 0 'partial batch item' add-item batch-part svc-token --owner ci-owner --collection ci
+run 0 'partial batch preflight' mark batch-part preflight
+run 0 'check reports the next required step on a partial record' check batch-part
+assert_contains "$OUT" 'next: approval' 'check names the resume point'
+run 0 'replaying the completed step still succeeds' mark batch-part preflight
+run 0 'ceremony resumes from the reported step' mark batch-part approval --approved-by captain
+run 0 'check advances with the record' check batch-part
+assert_contains "$OUT" 'next: moved' 'check reflects recorded progress'
+
+# --- tampered step histories are refused by every reader --------------------
+
+# The record file is this tool's own append-only text contract (see its --help),
+# so a hand-edited history is written here and then read back through the
+# commands, exactly as a tampered record would reach an auditor.
+write_record() {  # <batch> <step-lines...>
+  local batch=$1
+  shift
+  {
+    printf 'fm-bitwarden-ceremony v1\n'
+    printf 'batch: %s\n' "$batch"
+    printf 'created: 2026-01-01\n'
+    printf 'item: prod-db owner=ops-team collection=prod-infra\n'
+    printf '%s\n' "$@"
+  } > "$RECORDS/$batch.ceremony"
+}
+
+# retired written before approval and verified: the exact history the ceremony
+# exists to make impossible.
+write_record tamper-order \
+  'step: preflight date=2026-01-01' \
+  'step: moved date=2026-01-01' \
+  'step: retired date=2026-01-01'
+for cmd in check status; do
+  run 1 "$cmd refuses a record whose steps are out of order" "$cmd" tamper-order
+  assert_contains "$OUT" 'corrupt at line 6' 'out-of-order record is reported by line number'
+  assert_contains "$OUT" "expected 'approval' at this point" 'out-of-order refusal names the expected transition'
+  assert_not_contains "$OUT" 'step: moved' 'out-of-order refusal echoed record content'
+  assert_contains "$OUT" 'last valid prefix' 'refusal explains the recovery path'
+  assert_not_contains "$OUT" 'next:' "$cmd reported progress from a tampered record"
+done
+run 1 'mark refuses to append to an out-of-order record' mark tamper-order approval --approved-by captain
+[ "$(grep -c '^step: ' "$RECORDS/tamper-order.ceremony")" = 3 ] || fail 'a refused record was appended to'
+
+# A skipped prerequisite is refused at the line that skips it.
+write_record tamper-skip \
+  'step: preflight date=2026-01-01' \
+  'step: approval date=2026-01-01 approved-by=captain' \
+  'step: verified date=2026-01-01'
+run 1 'check refuses a record with a skipped step' check tamper-skip
+assert_contains "$OUT" "expected 'moved' at this point" 'skipped-step refusal names the expected transition'
+
+# A repeated step is refused even though every name is individually valid.
+write_record tamper-dup \
+  'step: preflight date=2026-01-01' \
+  'step: preflight date=2026-01-01'
+run 1 'check refuses a duplicated step' check tamper-dup
+assert_contains "$OUT" 'corrupt at line 6' 'duplicate step is reported by line number'
+
+# Nothing may follow a complete ceremony.
+write_record tamper-trailing \
+  'step: preflight date=2026-01-01' \
+  'step: approval date=2026-01-01 approved-by=captain' \
+  'step: moved date=2026-01-01' \
+  'step: verified date=2026-01-01' \
+  'step: retired date=2026-01-01' \
+  'step: retired date=2026-01-01'
+run 1 'check refuses a step recorded after completion' check tamper-trailing
+assert_contains "$OUT" 'already complete' 'trailing step refusal names the reason'
+
+# An approval line with no approver is not a recorded approval.
+write_record tamper-approver \
+  'step: preflight date=2026-01-01' \
+  'step: approval date=2026-01-01 approved-by=' \
+  'step: moved date=2026-01-01' \
+  'step: verified date=2026-01-01'
+run 1 'check refuses an approval with an empty approver' check tamper-approver
+assert_contains "$OUT" 'approved-by is empty' 'empty-approver refusal names the reason'
+run 1 'mark refuses to append to a record whose approval has no approver' mark tamper-approver retired
+assert_contains "$OUT" 'approved-by is empty' 'the empty-approver record is refused when read, before any gate on the step itself'
+! grep -q '^step: retired' "$RECORDS/tamper-approver.ceremony" || fail 'retirement was recorded against an empty approver'
+
+# A hand-edited duplicate item line would double-count the auditable evidence.
+{
+  printf 'fm-bitwarden-ceremony v1\n'
+  printf 'batch: tamper-item\n'
+  printf 'created: 2026-01-01\n'
+  printf 'item: prod-db owner=ops-team collection=prod-infra\n'
+  printf 'item: prod-db owner=other collection=prod-infra\n'
+} > "$RECORDS/tamper-item.ceremony"
+run 1 'status refuses a record with a duplicated item label' status tamper-item
+assert_contains "$OUT" 'corrupt at line 5' 'duplicate item is reported by line number'
+assert_not_contains "$OUT" 'items:' 'status counted items from a tampered record'
+
+# A record that is a valid prefix - the shape a corrected record is restored to
+# - stays fully usable, so the validation never blocks legitimate recovery.
+write_record tamper-fixed \
+  'step: preflight date=2026-01-01' \
+  'step: approval date=2026-01-01 approved-by=captain'
+run 0 'a corrected record resumes from its last valid prefix' check tamper-fixed
+assert_contains "$OUT" 'next: moved' 'corrected record reports the true resume point'
+run 0 'the corrected record accepts the next real step' mark tamper-fixed moved
+
+# Refusals never echo secret-shaped content from the record itself.
+{
+  printf 'fm-bitwarden-ceremony v1\n'
+  printf 'batch: tamper-secret\n'
+  printf 'created: 2026-01-01\n'
+  printf 'step: preflight date=2026-01-01\n'
+  printf 'step: retired date=2026-01-01 note=ghp_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n'
+} > "$RECORDS/tamper-secret.ceremony"
+run 1 'a tampered record holding secret material is refused' check tamper-secret
+assert_not_contains "$OUT" 'ghp_' 'refusal echoed secret-shaped record content'
+
+# --- a record is evidence for exactly one batch ------------------------------
+
+# Completing a batch and copying its record to another batch id is an ordinary
+# operator slip; the copy must not be certified as the second batch's evidence.
+run 0 'source batch for the copy initializes' init copy-src
+run 0 'source batch item' add-item copy-src prod-db --owner ops-team --collection prod-infra
+run 0 'source batch preflight' mark copy-src preflight
+run 0 'source batch approval' mark copy-src approval --approved-by captain
+run 0 'source batch moved' mark copy-src moved
+run 0 'source batch verified' mark copy-src verified
+run 0 'source batch retired' mark copy-src retired
+cp "$RECORDS/copy-src.ceremony" "$RECORDS/copy-dst.ceremony"
+for cmd in init check status; do
+  run 1 "$cmd refuses a record copied from another batch" "$cmd" copy-dst
+  assert_contains "$OUT" 'names a different batch' 'wrong-batch refusal names the reason'
+  assert_contains "$OUT" 'corrupt at line 2' 'wrong-batch record is reported by line number'
+  assert_not_contains "$OUT" 'copy-src' 'wrong-batch refusal echoed the record content'
+  assert_not_contains "$OUT" 'next:' "$cmd reported progress from another batch's record"
+done
+run 1 'mark refuses a record copied from another batch' mark copy-dst preflight
+[ "$(grep -c '^step: ' "$RECORDS/copy-dst.ceremony")" = 5 ] || fail 'a wrong-batch record was appended to'
+run 0 'the source batch is unaffected' check copy-src
+assert_contains "$OUT" 'next: complete' 'the original record still reports its own completion'
+
+# Conflicting or repeated headers leave the record ambiguous about what it is.
+printf 'fm-bitwarden-ceremony v1\nbatch: hdr-dup\nbatch: hdr-dup\ncreated: 2026-01-01\n' > "$RECORDS/hdr-dup.ceremony"
+run 1 'check refuses a repeated batch header' check hdr-dup
+assert_contains "$OUT" 'corrupt at line 3' 'repeated batch header is reported by line number'
+printf 'fm-bitwarden-ceremony v1\nbatch: hdr-created\ncreated: 2026-01-01\ncreated: 2025-01-01\n' > "$RECORDS/hdr-created.ceremony"
+run 1 'check refuses a repeated created header' check hdr-created
+assert_contains "$OUT" 'corrupt at line 4' 'repeated created header is reported by line number'
+printf 'fm-bitwarden-ceremony v1\ncreated: 2026-01-01\nitem: db owner=ops collection=prod\n' > "$RECORDS/hdr-none.ceremony"
+run 1 'check refuses a record with no batch header' check hdr-none
+assert_contains "$OUT" 'no batch header' 'missing batch header names the reason'
+printf 'fm-bitwarden-ceremony v1\nbatch: hdr-late\ncreated: 2026-01-01\nitem: db owner=ops collection=prod\nbatch: hdr-late\n' > "$RECORDS/hdr-late.ceremony"
+run 1 'check refuses a header line after the record body' check hdr-late
+assert_contains "$OUT" 'corrupt at line 5' 'misplaced header is reported by line number'
+
+# --- items may not be registered after the credential has moved --------------
+
+# add-item refuses this on the write path; a hand-edited record must not make
+# a post-move registration look like a pre-move ownership target.
+{
+  printf 'fm-bitwarden-ceremony v1\n'
+  printf 'batch: item-late\n'
+  printf 'created: 2026-01-01\n'
+  printf 'item: prod-db owner=ops-team collection=prod-infra\n'
+  printf 'step: preflight date=2026-01-01\n'
+  printf 'step: approval date=2026-01-01 approved-by=captain\n'
+  printf 'step: moved date=2026-01-01\n'
+  printf 'item: added-after-move owner=ops collection=prod-infra\n'
+} > "$RECORDS/item-late.ceremony"
+for cmd in check status; do
+  run 1 "$cmd refuses an item registered after the move" "$cmd" item-late
+  assert_contains "$OUT" 'corrupt at line 8' 'post-move item is reported by line number'
+  assert_contains "$OUT" 'after the batch was marked moved' 'post-move item refusal names the reason'
+  assert_not_contains "$OUT" 'added-after-move' 'post-move refusal echoed record content'
+done
+run 1 'mark refuses to advance a record with a post-move item' mark item-late verified
+! grep -q '^step: verified' "$RECORDS/item-late.ceremony" || fail 'a record with a post-move item was appended to'
+
+# Registering an item after an earlier step is still legitimate, so the rule
+# must not break the flow add-item actually permits.
+run 0 'batch for a mid-ceremony item initializes' init item-mid
+run 0 'mid-ceremony preflight' mark item-mid preflight
+run 0 'an item may still be registered before the move' add-item item-mid late-but-legal --owner ops --collection prod-infra
+run 0 'the record with a post-preflight item stays readable' status item-mid
+assert_contains "$OUT" 'items: 1' 'a pre-move item registered after preflight is counted'
+
+# --- a step argument is matched as a whole word ------------------------------
+
+run 1 'a multi-word step argument is not a step' mark item-mid 'preflight approval'
+assert_contains "$OUT" 'unknown step' 'a run of step names is refused as a step name'
+
+# --- a moved batch must name what it moved -----------------------------------
+
+# mark refuses to record moved with no registered item; a hand-edited record
+# must not turn that into a completed ceremony that names no credential.
+{
+  printf 'fm-bitwarden-ceremony v1\n'
+  printf 'batch: moved-bare\n'
+  printf 'created: 2026-01-01\n'
+  printf 'step: preflight date=2026-01-01\n'
+  printf 'step: approval date=2026-01-01 approved-by=captain\n'
+  printf 'step: moved date=2026-01-01\n'
+} > "$RECORDS/moved-bare.ceremony"
+for cmd in check status; do
+  run 1 "$cmd refuses a move recorded with no registered item" "$cmd" moved-bare
+  assert_contains "$OUT" 'corrupt at line 6' 'itemless move is reported by line number'
+  assert_contains "$OUT" 'no registered item' 'itemless move refusal names the reason'
+  assert_not_contains "$OUT" 'next:' "$cmd reported progress from a move that names nothing"
+done
+run 1 'mark refuses to advance a move that names no item' mark moved-bare verified
+! grep -q '^step: verified' "$RECORDS/moved-bare.ceremony" || fail 'an itemless moved record was advanced'
+
+# --- item and step fields must carry real values -----------------------------
+
+# An empty label made the item count and the moved gate disagree about the same
+# record: status reported items: 0 while mark moved succeeded.
+{
+  printf 'fm-bitwarden-ceremony v1\n'
+  printf 'batch: empty-label\n'
+  printf 'created: 2026-01-01\n'
+  printf 'item:  owner=ops-team collection=prod-infra\n'
+  printf 'step: preflight date=2026-01-01\n'
+  printf 'step: approval date=2026-01-01 approved-by=captain\n'
+} > "$RECORDS/empty-label.ceremony"
+run 1 'status refuses an item line with no label' status empty-label
+assert_contains "$OUT" 'corrupt at line 4' 'empty item label is reported by line number'
+assert_contains "$OUT" 'item label is empty' 'empty item label refusal names the field'
+assert_not_contains "$OUT" 'items:' 'status counted items from a record with an unlabelled item'
+run 1 'mark refuses to record a move against an unlabelled item' mark empty-label moved
+! grep -q '^step: moved' "$RECORDS/empty-label.ceremony" || fail 'a move was recorded against an unlabelled item'
+
+# An item with no owner or collection is not the ownership target the ceremony
+# requires, so it must not carry a batch through to retirement.
+{
+  printf 'fm-bitwarden-ceremony v1\n'
+  printf 'batch: empty-fields\n'
+  printf 'created: 2026-01-01\n'
+  printf 'item: prod-db owner= collection=\n'
+  printf 'step: preflight date=2026-01-01\n'
+} > "$RECORDS/empty-fields.ceremony"
+run 1 'check refuses an item with no owner' check empty-fields
+assert_contains "$OUT" 'item owner is empty' 'empty owner refusal names the field'
+printf 'fm-bitwarden-ceremony v1\nbatch: empty-coll\ncreated: 2026-01-01\nitem: prod-db owner=ops-team collection=\n' > "$RECORDS/empty-coll.ceremony"
+run 1 'check refuses an item with no collection' check empty-coll
+assert_contains "$OUT" 'item collection is empty' 'empty collection refusal names the field'
+
+# A record value that is secret-shaped is refused by the same rule the
+# arguments face, and the refusal still withholds the content.
+printf 'fm-bitwarden-ceremony v1\nbatch: item-secret\ncreated: 2026-01-01\nitem: prod-db owner=ghp_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA collection=prod-infra\n' > "$RECORDS/item-secret.ceremony"
+run 1 'check refuses a secret-shaped owner recorded in the record' check item-secret
+assert_contains "$OUT" 'credential shape' 'secret-shaped record value refusal names the reason'
+assert_not_contains "$OUT" 'ghp_' 'refusal echoed the secret-shaped record value'
+
+# Stray content on a line is not silently ignored.
+printf 'fm-bitwarden-ceremony v1\nbatch: item-extra\ncreated: 2026-01-01\nitem: prod-db owner=ops-team extra=x collection=prod-infra\n' > "$RECORDS/item-extra.ceremony"
+run 1 'check refuses an item line carrying unknown fields' check item-extra
+assert_contains "$OUT" 'malformed item line' 'unknown item field is refused as malformed'
+
+# Dates are the record's own evidence of when each gate was passed.
+printf 'fm-bitwarden-ceremony v1\nbatch: no-date\ncreated: 2026-01-01\nitem: prod-db owner=ops-team collection=prod-infra\nstep: preflight date=\n' > "$RECORDS/no-date.ceremony"
+run 1 'check refuses a step with an empty date' check no-date
+assert_contains "$OUT" 'not a YYYY-MM-DD calendar date' 'empty step date refusal names the expected shape'
+printf 'fm-bitwarden-ceremony v1\nbatch: bad-created\ncreated: sometime\n' > "$RECORDS/bad-created.ceremony"
+run 1 'check refuses a created header that is not a date' check bad-created
+assert_contains "$OUT" 'corrupt at line 3' 'malformed created header is reported by line number'
+
+# The records this tool writes itself stay readable throughout.
+run 0 'a tool-written batch initializes' init fields-ok
+run 0 'a tool-written item registers' add-item fields-ok prod-db --owner ops-team --collection prod-infra
+run 0 'a tool-written batch reaches the move' mark fields-ok preflight
+run 0 'a tool-written approval records' mark fields-ok approval --approved-by captain
+run 0 'a tool-written move records' mark fields-ok moved
+run 0 'a tool-written record still reads back' status fields-ok
+assert_contains "$OUT" 'items: 1' 'the tool-written record reports its registered item'
+assert_contains "$OUT" 'next: verified' 'the tool-written record reports its true resume point'
+
+# --- a record with no final newline is truncated, not appendable -------------
+
+# The record is an append-only line-based file (see the script's --help), so a
+# final line with no newline means the last line may be incomplete; appending
+# to it would fuse two record lines into one.
+printf 'fm-bitwarden-ceremony v1\nbatch: no-newline\ncreated: 2026-01-01\nitem: prod-db owner=ops-team collection=prod-infra' > "$RECORDS/no-newline.ceremony"
+before=$(cat "$RECORDS/no-newline.ceremony")
+for cmd in check status; do
+  run 1 "$cmd refuses a record with no final newline" "$cmd" no-newline
+  assert_contains "$OUT" 'corrupt at line 4' 'truncated record is reported by line number'
+  assert_contains "$OUT" 'no terminating newline' 'truncated record refusal names the reason'
+  assert_not_contains "$OUT" 'next:' "$cmd reported progress from a truncated record"
+done
+run 1 'mark refuses to append to a record with no final newline' mark no-newline preflight
+run 1 'add-item refuses to append to a record with no final newline' add-item no-newline web --owner ops-team --collection prod-infra
+[ "$(cat "$RECORDS/no-newline.ceremony")" = "$before" ] || fail 'a truncated record was modified instead of refused'
+grep -q 'collection=prod-infra$' "$RECORDS/no-newline.ceremony" || fail 'the truncated record lost its recorded collection target'
+
+# --- recorded dates must be real and must not run backwards ------------------
+
+printf 'fm-bitwarden-ceremony v1\nbatch: date-range\ncreated: 9999-99-99\n' > "$RECORDS/date-range.ceremony"
+run 1 'check refuses an out-of-range created date' check date-range
+assert_contains "$OUT" 'corrupt at line 3' 'out-of-range created date is reported by line number'
+printf 'fm-bitwarden-ceremony v1\nbatch: step-range\ncreated: 2026-01-01\nitem: prod-db owner=ops-team collection=prod-infra\nstep: preflight date=0000-00-00\n' > "$RECORDS/step-range.ceremony"
+run 1 'check refuses an out-of-range step date' check step-range
+assert_contains "$OUT" 'not a YYYY-MM-DD calendar date' 'out-of-range step date names the expected shape'
+
+# A day that never occurred is not evidence of when a gate was passed.
+for bad_date in 2026-02-30 2026-04-31 2025-02-29 2026-00-10 2026-13-01 0000-01-01; do
+  printf 'fm-bitwarden-ceremony v1\nbatch: cal-bad\ncreated: %s\n' "$bad_date" > "$RECORDS/cal-bad.ceremony"
+  run 1 "check refuses the impossible date $bad_date" check cal-bad
+  assert_contains "$OUT" 'not a YYYY-MM-DD calendar date' "the impossible date $bad_date is refused as a calendar date"
+done
+# Leap days that did occur stay valid, as does the last day of a short month.
+for good_date in 2024-02-29 2024-02-28 2024-04-30 2024-12-31; do
+  printf 'fm-bitwarden-ceremony v1\nbatch: cal-ok\ncreated: %s\nitem: prod-db owner=ops-team collection=prod-infra\nstep: preflight date=%s\n' "$good_date" "$good_date" > "$RECORDS/cal-ok.ceremony"
+  run 0 "check accepts the real date $good_date" check cal-ok
+  assert_contains "$OUT" 'next: approval' "the record dated $good_date reports its resume point"
+done
+
+# A step cannot have happened before the batch it belongs to was created.
+printf 'fm-bitwarden-ceremony v1\nbatch: date-early\ncreated: 2025-06-01\nitem: prod-db owner=ops-team collection=prod-infra\nstep: preflight date=2025-01-01\n' > "$RECORDS/date-early.ceremony"
+run 1 'check refuses a step dated before the batch was created' check date-early
+assert_contains "$OUT" 'earlier than the created header' 'pre-creation step refusal names the reason'
+
+# Each gate is passed after the one before it, so the dates cannot decrease.
+{
+  printf 'fm-bitwarden-ceremony v1\n'
+  printf 'batch: date-back\n'
+  printf 'created: 2024-01-01\n'
+  printf 'item: prod-db owner=ops-team collection=prod-infra\n'
+  printf 'step: preflight date=2025-06-01\n'
+  printf 'step: approval date=2025-01-01 approved-by=captain\n'
+} > "$RECORDS/date-back.ceremony"
+for cmd in check status; do
+  run 1 "$cmd refuses a history whose dates run backwards" "$cmd" date-back
+  assert_contains "$OUT" 'corrupt at line 6' 'backwards date is reported by line number'
+  assert_contains "$OUT" 'runs backwards' 'backwards date refusal names the reason'
+  assert_not_contains "$OUT" 'next:' "$cmd reported progress from a backwards history"
+done
+run 1 'mark refuses to advance a backwards history' mark date-back moved
+! grep -q '^step: moved' "$RECORDS/date-back.ceremony" || fail 'a backwards-dated record was appended to'
+
+# A date this tool could not have stamped is not evidence. mark stamps today,
+# so appending to a future-dated record would write a line its own readers then
+# refuse - the record must be refused before that happens.
+{
+  printf 'fm-bitwarden-ceremony v1\n'
+  printf 'batch: date-future\n'
+  printf 'created: 2026-01-01\n'
+  printf 'item: prod-db owner=ops-team collection=prod-infra\n'
+  printf 'step: preflight date=2099-12-31\n'
+} > "$RECORDS/date-future.ceremony"
+future_before=$(cat "$RECORDS/date-future.ceremony")
+for cmd in check status; do
+  run 1 "$cmd refuses a step dated in the future" "$cmd" date-future
+  assert_contains "$OUT" 'corrupt at line 5' 'future step date is reported by line number'
+  assert_contains "$OUT" 'in the future' 'future step date refusal names the reason'
+  assert_not_contains "$OUT" 'next:' "$cmd reported progress from a future-dated record"
+done
+run 1 'mark refuses to append to a future-dated record' mark date-future approval --approved-by captain
+[ "$(cat "$RECORDS/date-future.ceremony")" = "$future_before" ] || fail 'mark modified a future-dated record instead of refusing it'
+
+printf 'fm-bitwarden-ceremony v1\nbatch: created-future\ncreated: 2099-12-31\n' > "$RECORDS/created-future.ceremony"
+created_before=$(cat "$RECORDS/created-future.ceremony")
+run 1 'check refuses a created header dated in the future' check created-future
+assert_contains "$OUT" 'in the future' 'future created header refusal names the reason'
+run 1 'mark refuses to append under a future created header' mark created-future preflight
+[ "$(cat "$RECORDS/created-future.ceremony")" = "$created_before" ] || fail 'mark modified a record with a future created header'
+
+# A ceremony cannot have been completed on a day that has not happened.
+{
+  printf 'fm-bitwarden-ceremony v1\n'
+  printf 'batch: all-future\n'
+  printf 'created: 2099-12-31\n'
+  printf 'item: prod-db owner=ops-team collection=prod-infra\n'
+  printf 'step: preflight date=2099-12-31\n'
+  printf 'step: approval date=2099-12-31 approved-by=captain\n'
+  printf 'step: moved date=2099-12-31\n'
+  printf 'step: verified date=2099-12-31\n'
+  printf 'step: retired date=2099-12-31\n'
+} > "$RECORDS/all-future.ceremony"
+run 1 'status refuses an entirely future-dated completion record' status all-future
+assert_not_contains "$OUT" 'next: complete' 'a future-dated ceremony was certified as complete'
+
+# A record the tool wrote today is readable by the same rules that refuse the
+# future, so the accepted set is exactly what the writer can produce.
+run 0 'a batch stamped today initializes' init dated-today
+run 0 'a step stamped today records' mark dated-today preflight
+run 0 'a record stamped today reads back' check dated-today
+assert_contains "$OUT" 'next: approval' "today's own stamp is not treated as future"
+
+# Repeated dates are legitimate: a whole batch can run within one day.
+{
+  printf 'fm-bitwarden-ceremony v1\n'
+  printf 'batch: date-same\n'
+  printf 'created: 2026-01-01\n'
+  printf 'item: prod-db owner=ops-team collection=prod-infra\n'
+  printf 'step: preflight date=2026-01-01\n'
+  printf 'step: approval date=2026-01-01 approved-by=captain\n'
+  printf 'step: moved date=2026-01-01\n'
+} > "$RECORDS/date-same.ceremony"
+run 0 'a same-day ceremony is valid' check date-same
+assert_contains "$OUT" 'next: verified' 'the same-day record reports its true resume point'
+run 0 'a same-day ceremony still advances' mark date-same verified
+
+# --- the item count is the number of registered items ------------------------
+
+run 0 'multi-item batch initializes' init count-many
+run 0 'first item registers' add-item count-many prod-db --owner ops-team --collection prod-infra
+run 0 'second item registers' add-item count-many prod-cache --owner ops-team --collection prod-infra
+run 0 'third item registers' add-item count-many prod-queue --owner ops-team --collection prod-infra
+run 0 'multi-item status reports the count' status count-many
+assert_contains "$OUT" 'items: 3' 'every registered item is counted'
+run 0 'an itemless batch initializes' init count-zero
+run 0 'itemless status reports zero' status count-zero
+assert_contains "$OUT" 'items: 0' 'a batch with no items counts zero'
+
+# --- corrupt records are reported by line number, content withheld ----------
+
+printf 'password=hunter2-super-secret\n' >> "$RECORDS/batch-part.ceremony"
+run 1 'corrupt record fails check' check batch-part
+assert_contains "$OUT" 'corrupt at line 7' 'corruption is reported by line number'
+case $OUT in
+  *hunter2*) fail 'corrupt-line diagnostic echoed the line content' ;;
+esac
+run 1 'corrupt record refuses further marks' mark batch-part moved
+
+# A record with a foreign first line is rejected as not-a-ceremony-record.
+printf 'something else\n' > "$RECORDS/batch-alien.ceremony"
+run 1 'foreign file is not treated as a ceremony record' check batch-alien
+run 1 'missing record demands init' check batch-none
+assert_contains "$OUT" 'run init first' 'missing record points at init'
+
+# --- --help publishes the record-format contract, not shell source ----------
+
+run 0 'help renders the header contract' --help
+assert_contains "$OUT" 'Record format (v1, line-based, append-only):' 'help publishes the record format'
+assert_contains "$OUT" 'preflight -> approval -> moved -> verified -> retired' 'help publishes the ordered steps'
+assert_not_contains "$OUT" 'set -eu' 'help leaked shell source past the header'
+[ "$(printf '%s\n' "$OUT" | tail -n 1)" = 'which is the recovery entry point after an interruption.' ] || fail 'help output does not end with the final header sentence'
+
+pass 'fm-bitwarden-ceremony behavior'
diff --git a/tests/fm-public-followup.test.sh b/tests/fm-public-followup.test.sh
index d394a32ab53..03de8c1dbb0 100755
--- a/tests/fm-public-followup.test.sh
+++ b/tests/fm-public-followup.test.sh
@@ -106,6 +106,11 @@ tasks_in() {  # <home> <tasks-axi args...>
   (cd "$home" && tasks-axi "$@")
 }
 
+# iso_at <epoch> - epoch seconds as a UTC ISO-8601 stamp, on BSD and GNU date.
+iso_at() {
+  date -u -r "$1" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -d "@$1" +%Y-%m-%dT%H:%M:%SZ
+}
+
 # seed_commitment <home> <obligation> <request> <platform> <work-home> <work-id>
 # Simulates the intake half that already works today: the relay mention arrives,
 # the typed obligation is created with its opaque thread binding, the work is
@@ -128,7 +133,8 @@ seed_commitment() {
 
   tasks_in "$home" public-followup add "$obligation" \
     --request-context-file "$home/request.json" --purpose promised-final \
-    --expected-final-file "$home/expected.json" --expires-at 2026-10-01T00:00:00Z >/dev/null \
+    --expected-final-file "$home/expected.json" \
+    --expires-at "$(iso_at $(( $(date +%s) + 2592000 )))" >/dev/null \
     || fail "could not create the public commitment"
   tasks_in "$home" public-followup bind-work "$obligation" \
     --relation-file "$home/relation.json" >/dev/null \
@@ -152,15 +158,25 @@ seed_commitment() {
 }
 
 # The pi-rearm shape: a report-ready promised-final bound to a secondmate.
+# The reply window is derived from the run's own clock instead of pinned to an
+# absolute date, so the fixture stays a live, unexpired thread on every future
+# calendar day. REPRO_EXPIRES_EPOCH exposes the seeded deadline to the tests that
+# drive expiry through FMX_NOW_OVERRIDE.
+REPRO_WINDOW_SECONDS=604800
+REPRO_EXPIRES_EPOCH=0
 seed_repro_commitment() {   # <home> <obligation> <request> <work-home> <work-id>
-  local home=$1 obligation=$2 request=$3 work_home=$4 work_id=$5
+  local home=$1 obligation=$2 request=$3 work_home=$4 work_id=$5 now
+  now=$(date +%s)
+  REPRO_EXPIRES_EPOCH=$((now + REPRO_WINDOW_SECONDS))
   jq -n --arg r "$request" \
+    --arg received "$(iso_at $((now - REPRO_WINDOW_SECONDS)))" \
+    --arg expires "$(iso_at "$REPRO_EXPIRES_EPOCH")" \
     '{request_id:$r, platform:"discord",
       context_binding:{version:"ctx1", value:("ctx1_" + $r)},
       public_safe_summary:"reproduce a Pi recovery notification loop",
-      received_at:"2026-08-21T01:12:00Z",
-      followup_expires_at:"2026-08-28T01:12:00Z",
-      reservation_expires_at:"2026-08-28T01:12:00Z"}' > "$home/request.json"
+      received_at:$received,
+      followup_expires_at:$expires,
+      reservation_expires_at:$expires}' > "$home/request.json"
   jq -n '{type:"report-ready", project:"firstmate",
           required_deliverables:["report_path"], completion_policy:"all-required"}' \
     > "$home/expected.json"
@@ -169,7 +185,7 @@ seed_repro_commitment() {   # <home> <obligation> <request> <work-home> <work-id
       role:"fulfills", required:true, generation:1}' > "$home/relation.json"
   tasks_in "$home" public-followup add "$obligation" --request-context-file "$home/request.json" \
     --purpose promised-final --expected-final-file "$home/expected.json" \
-    --expires-at 2026-10-01T00:00:00Z >/dev/null || fail "add failed"
+    --expires-at "$(iso_at $((now + 2592000)))" >/dev/null || fail "add failed"
   tasks_in "$home" public-followup bind-work "$obligation" --relation-file "$home/relation.json" >/dev/null \
     || fail "bind-work failed"
   FM_HOME="$home" bash -c \
@@ -1837,7 +1853,8 @@ test_rechain_refuses_unclaimed_existing_destination() {
   tasks_in "$home" public-followup add public-final-existing-b \
     --request-context-file "$home/request.json" --purpose promised-final \
     --expected-final-file "$home/collision-expected.json" \
-    --expires-at 2026-08-28T01:12:00Z >/dev/null || fail "could not seed destination collision"
+    --expires-at "$(iso_at "$REPRO_EXPIRES_EPOCH")" >/dev/null \
+    || fail "could not seed destination collision"
 
   expect_failure "a first rechain must not adopt an unrelated existing obligation" \
     run_pf "$home" rechain public-final-existing-b --from public-final-existing-a \
@@ -2015,8 +2032,7 @@ test_expiry_escalation_uses_now_override() {
   local home out exp now_closing now_expired registry tmp
   home=$(make_home expiry-window)
   seed_repro_commitment "$home" pf-exp req-exp main work-exp
-  exp=$(date -u -j -f '%Y-%m-%dT%H:%M:%SZ' '2026-08-28T01:12:00Z' +%s 2>/dev/null) \
-    || exp=$(date -u -d '2026-08-28T01:12:00Z' +%s)
+  exp=$REPRO_EXPIRES_EPOCH
   now_closing=$((exp - 3600))
   now_expired=$((exp + 60))
   out=$(FMX_NOW_OVERRIDE="$now_expired" run_pf "$home" pending)