diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 652e768c25..87a130647d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,9 +27,10 @@ jobs:
   tests:
     name: Behavior tests
     runs-on: ubuntu-latest
-    # The pre-cutover suite reached 25m35s, and the exhaustive Bridge crash
-    # matrix adds bounded work. Keep enough margin without masking a real hang.
-    timeout-minutes: 45
+    # The serial suite now includes the bounded direct-account recovery matrix
+    # as well as the exhaustive Bridge crash matrix. Keep enough margin for both
+    # without masking a real hang.
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@v6
         with:
diff --git a/AGENTS.md b/AGENTS.md
index 0b6959e1e7..23ecac170a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -108,6 +108,7 @@ state/               volatile runtime signals; gitignored
   <id>.meta          written by fm-spawn: window=, worktree=, project=, harness=, model=, effort=, kind=, mode=, yolo=, tasktmp=, generation_id=, report_required=
   Direct ship and scout launches also own account_home=, worktree_git_dir=, worktree_git_dir_identity=, and exactly one authoritative final-state field: worktree_git_ref= for an attached branch or worktree_git_head= for an intentional detached HEAD. Their metadata may temporarily carry worktree_git_setup_ref= and worktree_git_setup_head= while the brief's required `fm/<id>` branch transition is pending; recovery accepts only that exact setup state or the authoritative `fm/<id>` ref and removes the setup fields after adoption.
   Direct recovery validates the canonical worktree path, exact physical Git-dir identity, and authoritative final state before account preparation and again immediately before endpoint creation; any drift fails closed without launching.
+  Automatic account-scoped capacity rescue appends capacity_rescue_attempts=, repeated capacity_rescue_exhausted_account= entries, per-attempt audit/result fields, and an optional capacity_rescue_stopped= terminal reason; Codex model capacity writes none of them, and docs/account-capacity-rescue.md owns the full routing, transaction, and retry boundary.
   If endpoint removal after a failed new direct spawn cannot be confirmed, direct_spawn_cleanup=pending and rollback_pending=1 retain the endpoint and worktree identity for explicit teardown.
   A failed new direct spawn that never created an endpoint records direct_spawn_endpoint=not-created and an empty window= so teardown skips endpoint quiescence without skipping worktree safety.
   Secondmate Agent Fleet routing and legacy managed recovery own account_pool=, account_profile=, account_task=, account_attempt=, and provider_session_id= (docs/configuration.md "Agent Fleet account routing").
@@ -585,6 +586,8 @@ The emitted block is the only per-harness operating recipe in the session contex
 Do not substitute another harness's command shape for it.
 **Always-on wake triage (absorb only when provably working).**
 `bin/fm-watch.sh` classifies every wake in bash and absorbs the benign majority without waking you: crewmates with positive working evidence (an actively-running no-mistakes step for their branch, or a busy pane read via `bin/fm-crew-state.sh`) unless the separate permission-stall no-progress threshold has expired, a declared `paused:` external wait until its bounded recheck cadence, and no-change heartbeats.
+Before ordinary stale classification, it recognizes empirically verified provider-capacity chrome only on an idle endpoint: account-scoped Claude exhaustion enters guarded direct-account recovery, while Codex model capacity surfaces once without endpoint removal, account rotation, or rescue metadata.
+Account rescue is lifecycle-serialized, attempt-capped, and durably stopped with one blocked wake when no unused eligible account remains; `docs/account-capacity-rescue.md` owns the signatures, routing, audit fields, and failure contract.
 It never absorbs a crewmate that stopped without that evidence - whatever its stale status log claims - and only an actionable wake is queued durably and ends the supervision wait, so you resume the emitted protocol exactly once per actionable event.
 A `paused:` status is a deliberate external wait, not `blocked:`; its initial signal still surfaces once, and a forgotten pause re-surfaces for a recheck once per window.
 Repeated unchanged wedge or permission-stall escalations eventually add `demand-deep-inspection` to the wake reason so they are not mistaken for another routine validation wait.
diff --git a/bin/backends/herdr.sh b/bin/backends/herdr.sh
index 238669a7e8..693f8fb250 100644
--- a/bin/backends/herdr.sh
+++ b/bin/backends/herdr.sh
@@ -2654,20 +2654,20 @@ fm_backend_herdr_expected_label_matches() {  # <target> [expected-label]
 #
 # Reading a pane or sending keys to it does not care how the server was
 # launched - the pane already exists and the server is up. It only needs the
-# server to be running and adapter-owned (this HOME's own certificate names the
-# live pid), which fm_backend_herdr_server_adapter_owned proves without the
-# closed-shell launch certification. This is what keeps peek/steer working when
-# FirstMate itself runs INSIDE the herdr session it manages (HERDR_ENV=1): that
-# server was not launched through the crewmate adapter's own closed-shell path, so
-# closed_shell_environment_ready is false and the full ensure would try to
-# restart+recertify - impossible while the session is occupied by live crewmates and
-# FirstMate itself. The SPAWN path deliberately keeps the strict ensure so a new
-# crewmate still launches only in a certified closed-shell server.
+# server to be running. During the legacy certificate lifecycle it must also be
+# adapter-owned (this HOME's certificate names the live pid), which
+# fm_backend_herdr_server_adapter_owned proves without requiring the current
+# release's closed-shell launch certification. Native-agent production no longer
+# requires that legacy server certificate; pane isolation is applied directly by
+# `agent start --env`, so read/steer follows server ensure's native cutover and
+# accepts a reachable server. Certificate-enforcing tests retain the stricter
+# ownership proof.
 fm_backend_herdr_server_reachable_for_readsteer() {  # <session>
   local session=$1 running
   running=$(fm_backend_herdr_cli "$session" status --json 2>/dev/null \
     | fm_backend_herdr_control_jq -r '.server.running // false' 2>/dev/null)
   [ "$running" = true ] || return 1
+  fm_backend_herdr_server_certificate_required || return 0
   fm_backend_herdr_server_adapter_owned "$session"
 }
 
@@ -3013,9 +3013,10 @@ fm_backend_herdr_send_text_submit() {  # <target> <text> <retries> <enter-sleep>
 # tmux-kill-window's `|| true` contract). Verified: closing a tab's only pane
 # closes the tab too, so a separate tab close is unnecessary.
 fm_backend_herdr_kill() {  # <target> [backend-id] [expected-label]
-  if ! fm_backend_herdr_target_ready "$1" "${3:-}"; then
-    [ -z "${3:-}" ] && return 0
-    return 1
+  if [ -n "${3:-}" ]; then
+    fm_backend_herdr_target_ready "$1" "$3" || return 1
+  else
+    fm_backend_herdr_parse_target "$1" || return 0
   fi
   fm_backend_herdr_cli "$FM_BACKEND_HERDR_SESSION" pane close "$FM_BACKEND_HERDR_PANE" >/dev/null 2>&1 || true
 }
diff --git a/bin/backends/orca.sh b/bin/backends/orca.sh
index 7f6bc1b1ee..4f7766ad0f 100644
--- a/bin/backends/orca.sh
+++ b/bin/backends/orca.sh
@@ -58,7 +58,7 @@ fm_backend_orca_authority_capabilities_check() {
   return 1
 }
 
-fm_backend_orca_json_get() {  # <field> ; fields: worktree-id worktree-path terminal-handle terminal-title worktree-terminal-handle repo-id
+fm_backend_orca_json_get() {  # <field> ; fields: worktree-id worktree-path worktree-name terminal-handle terminal-title worktree-terminal-handle repo-id
   # Terminal handles are accepted only from verified terminal result shapes:
   # result.terminal or a root terminal object with .handle. Undocumented
   # result.id and result.worktree.terminal shapes are ignored until a real Orca
@@ -88,6 +88,7 @@ function handle(obj) {
 let v = "";
 if (field === "worktree-id") v = wt.id || wt.worktreeId || r.worktreeId || "";
 if (field === "worktree-path") v = wt.path || (wt.git && wt.git.path) || r.path || "";
+if (field === "worktree-name") v = scalar(wt.name) || scalar(wt.title) || scalar(r.worktreeName) || "";
 if (field === "terminal-handle") v = handle(explicitTerm || r) || "";
 if (field === "terminal-title") v = scalar((explicitTerm || r).title) || scalar((explicitTerm || r).name) || "";
 if (field === "worktree-terminal-handle") v = handle(explicitTerm) || "";
@@ -141,7 +142,7 @@ fm_backend_orca_repo_ensure() {  # <project-path>
 }
 
 fm_backend_orca_worktree_create() {  # <project-path> <name>
-  local project=$1 name=$2 repo_id out wt_id wt_path terminal status proof
+  local project=$1 name=$2 repo_id out wt_id wt_path wt_name terminal status proof
   repo_id=$(fm_backend_orca_repo_ensure "$project") || return 1
   if out=$(orca worktree create --repo "id:$repo_id" --name "$name" --no-parent --setup skip --json); then
     status=0
@@ -151,10 +152,11 @@ fm_backend_orca_worktree_create() {  # <project-path> <name>
   wt_id=$(printf '%s' "$out" | fm_backend_orca_json_get worktree-id 2>/dev/null || true)
   terminal=$(printf '%s' "$out" | fm_backend_orca_json_get worktree-terminal-handle 2>/dev/null || true)
   wt_path=$(printf '%s' "$out" | fm_backend_orca_json_get worktree-path 2>/dev/null || true)
+  wt_name=$(printf '%s' "$out" | fm_backend_orca_json_get worktree-name 2>/dev/null || true)
   proof=unproven
   [ -z "$terminal" ] || proof=recorded
-  printf '%s\t%s\t%s\t%s\t%s' "$wt_id" "$wt_path" "$terminal" "$proof" "$repo_id"
-  if [ "$status" -ne 0 ] || [ -z "$wt_id" ] || [ -z "$wt_path" ]; then
+  printf '%s\t%s\t%s\t%s\t%s\t%s' "$wt_id" "$wt_path" "$terminal" "$proof" "$repo_id" "$wt_name"
+  if [ "$status" -ne 0 ] || [ -z "$wt_id" ] || [ -z "$wt_path" ] || [ -z "$wt_name" ]; then
     echo "error: orca worktree create returned incomplete or unsuccessful authority for $name" >&2
     return 2
   fi
diff --git a/bin/fm-account-directory.sh b/bin/fm-account-directory.sh
index 3ba66b5462..209fce2b60 100755
--- a/bin/fm-account-directory.sh
+++ b/bin/fm-account-directory.sh
@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
 # Select and prepare direct Claude or Codex account-directory launches.
 # Usage:
-#   fm-account-directory.sh select <claude|codex>
+#   fm-account-directory.sh select <claude|codex> [excluded-account-home...]
 #   fm-account-directory.sh install-herdr-hook <claude|codex> <account-home>
-#   fm-account-directory.sh prepare <claude|codex>
+#   fm-account-directory.sh prepare <claude|codex> [excluded-account-home...]
 #
 # This header is the single owner of the direct account-directory contract.
 # FM_ACCOUNT_DIRECTORY_CUTOVER: direct-observe-passwd-home-v2
@@ -12,13 +12,15 @@
 # Codex selection removes that account's quota-axi window cache immediately
 # before every read, sets CODEX_HOME plus the account-isolated XDG_CACHE_HOME,
 # accepts only a fresh result with at least one numeric five_hour or weekly
-# window, and picks the account with the highest minimum remaining percentage.
+# window, skips excluded and zero-capacity accounts, and picks the remaining
+# account with the highest minimum remaining percentage.
 # A Codex account with no such freshly readable window is skipped as unhealthy.
 # Claude quota is not currently distinguishable per config directory because
 # quota-axi cannot non-interactively resolve Claude's config-dir-specific macOS
 # Keychain credential.
 # Claude therefore never treats a missing usage window as account failure and
-# selects the first real account directory in stable bytewise sort order.
+# selects the first non-excluded real account directory in stable bytewise sort
+# order.
 # Selection prints only the chosen absolute account home on stdout and logs
 # health, fallback, and choice diagnostics on stderr.
 # prepare selects the account and idempotently runs Herdr's own integration
@@ -203,8 +205,18 @@ valid_account_home() { # <vendor-dir> <candidate>
   esac
 }
 
-first_account_home() { # <vendor>
+account_home_is_excluded() { # <candidate> [excluded-account-home...]
+  local candidate=$1 excluded
+  shift
+  for excluded in "$@"; do
+    [ "$candidate" != "$excluded" ] || return 0
+  done
+  return 1
+}
+
+first_account_home() { # <vendor> [excluded-account-home...]
   local vendor=$1 root vendor_dir candidate
+  shift
   root=$(account_root) || return 1
   vendor_dir=$root/$vendor
   [ -d "$vendor_dir" ] && [ ! -L "$vendor_dir" ] || {
@@ -215,10 +227,14 @@ first_account_home() { # <vendor>
   export LC_ALL
   for candidate in "$vendor_dir"/*; do
     valid_account_home "$vendor_dir" "$candidate" || continue
+    if account_home_is_excluded "$candidate" "$@"; then
+      log "$vendor account $candidate skipped: exhausted by this task"
+      continue
+    fi
     printf '%s\n' "$candidate"
     return 0
   done
-  echo "error: no account directories found for $vendor under $vendor_dir" >&2
+  echo "CAPACITY_UNAVAILABLE: no unused $vendor account directories remain under $vendor_dir" >&2
   return 1
 }
 
@@ -279,7 +295,7 @@ $1
 EOF
 }
 
-select_codex() {
+select_codex() { # [excluded-account-home...]
   local root vendor_dir quota_bin candidate usage score
   local best_home='' best_score=''
   root=$(account_root) || return 1
@@ -297,12 +313,20 @@ select_codex() {
   export LC_ALL
   for candidate in "$vendor_dir"/*; do
     valid_account_home "$vendor_dir" "$candidate" || continue
+    if account_home_is_excluded "$candidate" "$@"; then
+      log "codex account $candidate skipped: exhausted by this task"
+      continue
+    fi
     usage=$(fresh_codex_usage_json "$candidate" "$quota_bin") || usage=
     score=$(codex_score "$usage") || score=
     if [ -z "$score" ]; then
       log "codex account $candidate skipped: no freshly readable usage window"
       continue
     fi
+    if ! awk -v candidate_score="$score" 'BEGIN { exit !(candidate_score > 0) }'; then
+      log "codex account $candidate skipped: fresh remaining score=$score has no capacity"
+      continue
+    fi
     log "codex account $candidate fresh remaining score=$score"
     if [ -z "$best_home" ] || awk -v candidate_score="$score" -v current_score="$best_score" \
       'BEGIN { exit !(candidate_score > current_score) }'; then
@@ -311,26 +335,28 @@ select_codex() {
     fi
   done
   [ -n "$best_home" ] || {
-    echo "error: no healthy Codex account has a freshly readable usage window" >&2
+    echo "CAPACITY_UNAVAILABLE: no unused Codex account has a freshly readable positive usage window" >&2
     return 1
   }
   log "selected codex account $best_home with fresh remaining score=$best_score"
   printf '%s\n' "$best_home"
 }
 
-select_claude() {
+select_claude() { # [excluded-account-home...]
   local selected
-  selected=$(first_account_home claude) || return 1
+  selected=$(first_account_home claude "$@") || return 1
   log "CLAUDE USAGE UNREADABLE: quota-axi cannot non-interactively resolve Claude's config-dir-specific macOS Keychain credential today; selecting the first account directory by stable sort: $selected"
   printf '%s\n' "$selected"
 }
 
-select_account() { # <vendor>
-  case "$1" in
-    codex) select_codex ;;
-    claude) select_claude ;;
+select_account() { # <vendor> [excluded-account-home...]
+  local vendor=$1
+  shift
+  case "$vendor" in
+    codex) select_codex "$@" ;;
+    claude) select_claude "$@" ;;
     *)
-      echo "error: direct account-directory selection supports only claude or codex, not '$1'" >&2
+      echo "error: direct account-directory selection supports only claude or codex, not '$vendor'" >&2
       return 1
       ;;
   esac
@@ -378,17 +404,21 @@ case "${1:-}" in
     exit 0
     ;;
   select)
-    [ "$#" -eq 2 ] || { usage; exit 2; }
-    select_account "$2"
+    [ "$#" -ge 2 ] || { usage; exit 2; }
+    vendor=$2
+    shift 2
+    select_account "$vendor" "$@"
     ;;
   install-herdr-hook)
     [ "$#" -eq 3 ] || { usage; exit 2; }
     install_herdr_hook "$2" "$3"
     ;;
   prepare)
-    [ "$#" -eq 2 ] || { usage; exit 2; }
-    selected_home=$(select_account "$2") || exit 1
-    install_herdr_hook "$2" "$selected_home" || exit 1
+    [ "$#" -ge 2 ] || { usage; exit 2; }
+    vendor=$2
+    shift 2
+    selected_home=$(select_account "$vendor" "$@") || exit 1
+    install_herdr_hook "$vendor" "$selected_home" || exit 1
     printf '%s\n' "$selected_home"
     ;;
   *)
diff --git a/bin/fm-checkout-refresh.sh b/bin/fm-checkout-refresh.sh
index 91af403fb6..acfc40e7f4 100755
--- a/bin/fm-checkout-refresh.sh
+++ b/bin/fm-checkout-refresh.sh
@@ -1869,7 +1869,7 @@ record_alert() {
 
 record_reinspection_failure() {
   local checkout=$1 key alert output
-  key=$(checkout_key "$checkout") || {
+  key=$(fm_checkout_hash_value "$checkout" 24) || {
     printf '%s: skipped: covered checkout lock identity cannot be resolved\n' "$checkout"
     return 1
   }
diff --git a/bin/fm-classify-lib.sh b/bin/fm-classify-lib.sh
index b3465c4a04..1b0412f892 100755
--- a/bin/fm-classify-lib.sh
+++ b/bin/fm-classify-lib.sh
@@ -64,6 +64,59 @@ FM_PAUSE_RESURFACE_SECS_DEFAULT=3600
 # this is the one owner of the verb literal, overridable via FM_CLASSIFY_RESOLVE_VERB.
 FM_CLASSIFY_RESOLVE_VERB_DEFAULT='resolved'
 
+# Classify a provider-owned capacity failure from the bounded pane capture of a
+# known harness. Prints a stable failure token and returns 0 on a verified shape;
+# prints nothing and returns 1 otherwise.
+#
+# These match complete TUI chrome, not capacity-like prose. Codex requires its
+# standalone warning glyph and exact line. Claude requires either its tool-result
+# glyph plus exact session-limit sentence or the complete usage-limit choice
+# dialog. This prevents a task discussing "usage limits", quoting one sentence,
+# or printing ordinary API rate-limit output from being mistaken for an exhausted
+# harness account. Empirical captures and versions are recorded in
+# docs/account-capacity-rescue.md.
+provider_capacity_failure_kind() {  # <harness> <tail40>
+  local harness=$1 tail40=$2 prompt_tail
+  prompt_tail=$(printf '%s\n' "$tail40" | tail -18)
+  case "$harness" in
+    codex)
+      if printf '%s\n' "$prompt_tail" \
+        | grep -Eq '^[[:space:]]*⚠[[:space:]]+Selected model is at capacity\. Please try a different model\.[[:space:]]*$'; then
+        printf 'codex-model-capacity'
+        return 0
+      fi
+      ;;
+    claude)
+      if printf '%s\n' "$prompt_tail" \
+        | grep -Eq "^[[:space:]]*⎿.*You've hit your session limit · resets .+[[:space:]]*$"; then
+        printf 'claude-session-limit'
+        return 0
+      fi
+      if printf '%s\n' "$prompt_tail" | grep -Fq 'What do you want to do?' \
+        && printf '%s\n' "$prompt_tail" | grep -Eq '1\. Stop and wait for limit to reset[[:space:]]*$' \
+        && printf '%s\n' "$prompt_tail" | grep -Eq '2\. Switch to usage credits[[:space:]]*$' \
+        && printf '%s\n' "$prompt_tail" | grep -Eq '3\. Switch to Team plan[[:space:]]*$' \
+        && printf '%s\n' "$prompt_tail" | grep -Eq 'Enter to confirm.*Esc to cancel'; then
+        printf 'claude-usage-limit-dialog'
+        return 0
+      fi
+      ;;
+  esac
+  return 1
+}
+
+provider_credential_failure_kind() {  # <harness> <tail40>
+  local harness=$1 tail40=$2 prompt_tail
+  [ "$harness" = claude ] || return 1
+  prompt_tail=$(printf '%s\n' "$tail40" | tail -18)
+  if printf '%s\n' "$prompt_tail" \
+    | grep -Eq '^[[:space:]]*Not logged in - Please run /login[[:space:]]*$'; then
+    printf 'claude-not-logged-in'
+    return 0
+  fi
+  return 1
+}
+
 # Return the last non-blank line of a status file (empty if missing/blank).
 last_status_line() {
   local f=$1
diff --git a/bin/fm-home-seed.sh b/bin/fm-home-seed.sh
index eac1c90072..8dbe270f8a 100755
--- a/bin/fm-home-seed.sh
+++ b/bin/fm-home-seed.sh
@@ -929,6 +929,33 @@ seed_home() {
   SEED_CHARTER_EXISTED=0
   SEED_MARKER_EXISTED=0
   trap seed_exit_cleanup EXIT
+  if [ ! -f "$SEED_PARENT_BRIEF" ]; then
+    [ -n "${FM_SECONDMATE_CHARTER:-}" ] || {
+      echo "error: no filled secondmate charter brief at $SEED_PARENT_BRIEF; set FM_SECONDMATE_CHARTER or scaffold one and replace {TASK}" >&2
+      return 1
+    }
+    [ -d "$DATA/$id" ] || SEED_PARENT_BRIEF_DIR_CREATED=1
+    if [ "$no_projects" -eq 1 ]; then
+      "$FM_ROOT/bin/fm-brief.sh" "$id" --secondmate --no-projects
+    else
+      "$FM_ROOT/bin/fm-brief.sh" "$id" --secondmate "$@"
+    fi
+    SEED_PARENT_BRIEF_CREATED=1
+  fi
+  if grep -F '{TASK}' "$SEED_PARENT_BRIEF" >/dev/null 2>&1; then
+    echo "error: secondmate charter brief at $SEED_PARENT_BRIEF still contains {TASK}; fill it before seeding" >&2
+    return 1
+  fi
+  charter_summary=$(registry_summary_for_brief "$SEED_PARENT_BRIEF")
+  [ -n "$charter_summary" ] || {
+    echo "error: secondmate charter brief at $SEED_PARENT_BRIEF has an empty Charter section; fill it before seeding" >&2
+    return 1
+  }
+  charter_scope=$(registry_scope_for_brief "$SEED_PARENT_BRIEF")
+  [ -n "$charter_scope" ] || {
+    echo "error: secondmate charter brief at $SEED_PARENT_BRIEF has an empty Routing scope section; fill it before seeding" >&2
+    return 1
+  }
   SEED_PARENT_HOME_LIFECYCLE_LOCK=$(fm_secondmate_home_lifecycle_lock_acquire "$CHECKOUT_LOCK_ROOT" "$FM_HOME") || return 1
   fm_checkout_trusted_dir "$FM_HOME" >/dev/null || {
     echo "error: active firstmate home was removed or redirected while seed waited for lifecycle ownership" >&2
@@ -946,6 +973,7 @@ seed_home() {
     home=$(acquire_treehouse_home "$id")
     SEED_HOME="$home"
     SEED_HOME_RETAINED=1
+    refuse_active_home_path "$home" || return 1
     SEED_HOME_LIFECYCLE_LOCK=$(fm_secondmate_home_lifecycle_lock_acquire "$CHECKOUT_LOCK_ROOT" "$home") || return 1
     freshness_status=0
     "$SCRIPT_DIR/fm-checkout-refresh.sh" verify-worktree "$home" "$FM_ROOT" || freshness_status=$?
@@ -965,6 +993,10 @@ seed_home() {
     SEED_HOME="$requested_abs"
     [ -e "$requested_abs" ] || SEED_HOME_CREATED=1
     home=$(ensure_home "$id" "$requested_abs")
+    if [ "$no_projects" -eq 1 ]; then
+      refuse_populated_projectless_home "$home" || return 1
+      refuse_projectful_projectless_charter "$id" "$SEED_PARENT_BRIEF" || return 1
+    fi
     "$SCRIPT_DIR/fm-checkout-refresh.sh" preflight "$home" || {
       echo "error: refusing explicit secondmate home whose default branch cannot be refreshed safely" >&2
       return 1
@@ -1000,34 +1032,6 @@ seed_home() {
   fi
   SEED_HOME_BACKED_UP=1
 
-  if [ ! -f "$SEED_PARENT_BRIEF" ]; then
-    [ -n "${FM_SECONDMATE_CHARTER:-}" ] || {
-      echo "error: no filled secondmate charter brief at $SEED_PARENT_BRIEF; set FM_SECONDMATE_CHARTER or scaffold one and replace {TASK}" >&2
-      return 1
-    }
-    [ -d "$DATA/$id" ] || SEED_PARENT_BRIEF_DIR_CREATED=1
-    if [ "$no_projects" -eq 1 ]; then
-      "$FM_ROOT/bin/fm-brief.sh" "$id" --secondmate --no-projects
-    else
-      "$FM_ROOT/bin/fm-brief.sh" "$id" --secondmate "$@"
-    fi
-    SEED_PARENT_BRIEF_CREATED=1
-  fi
-  if grep -F '{TASK}' "$SEED_PARENT_BRIEF" >/dev/null 2>&1; then
-    echo "error: secondmate charter brief at $SEED_PARENT_BRIEF still contains {TASK}; fill it before seeding" >&2
-    return 1
-  fi
-  charter_summary=$(registry_summary_for_brief "$SEED_PARENT_BRIEF")
-  [ -n "$charter_summary" ] || {
-    echo "error: secondmate charter brief at $SEED_PARENT_BRIEF has an empty Charter section; fill it before seeding" >&2
-    return 1
-  }
-  charter_scope=$(registry_scope_for_brief "$SEED_PARENT_BRIEF")
-  [ -n "$charter_scope" ] || {
-    echo "error: secondmate charter brief at $SEED_PARENT_BRIEF has an empty Routing scope section; fill it before seeding" >&2
-    return 1
-  }
-
   for project in "$@"; do
     project_dst=$(validate_project_destination "$home" "$project") || return 1
     [ -e "$project_dst" ] || printf '%s\n' "$project_dst" >> "$SEED_CREATED_PROJECTS_FILE"
diff --git a/bin/fm-report-contract-lib.sh b/bin/fm-report-contract-lib.sh
index 5b46fe9265..7d49ce31c9 100644
--- a/bin/fm-report-contract-lib.sh
+++ b/bin/fm-report-contract-lib.sh
@@ -5,10 +5,12 @@
 
 fm_completion_report_contract() {  # <data-dir> <task-id>
   local data=$1 task=$2
+  # The literal markdown examples intentionally use backticks without shell expansion.
+  # shellcheck disable=SC2016
   printf '%s\n' \
     '# Completion report' \
     "Before the final \`done:\` status, write \`$data/$task/completion.md\` with these six sections, each as a LEVEL-TWO markdown heading spelled exactly: \`## Summary\`, \`## What changed\`, \`## Verification\`, \`## Visual evidence\`, \`## Artifacts\`, \`## Follow-ups\`." \
-    "Publication rejects the report if any of those headings is missing, spelled differently, or written at another level - a level-one \`# Summary\` fails. Each section needs substantive prose directly under it; if you use sub-headings inside a section, make them \`###\` so they nest rather than ending the section." \
+    'Publication rejects the report if any of those headings is missing, spelled differently, or written at another level - a level-one `# Summary` fails. Each section needs substantive prose directly under it; if you use sub-headings inside a section, make them `###` so they nest rather than ending the section.' \
     'When a section genuinely does not apply, say so in a sentence under the heading rather than omitting the heading.' \
     'Make it stand alone for the captain: explain the outcome, name important files or links, record the validation performed, and call out remaining risk or decisions.' \
     "Put screenshots, diagrams, or other visual artifacts under \`$data/$task/visuals/\` and reference them from the report when they materially help review." \
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index e66d231827..d0484efd66 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -76,6 +76,10 @@
 #   project, worktree, harness, backend, model, effort, mode, yolo, and report
 #   requirements from metadata, selects a fresh account directory, and creates
 #   only a replacement endpoint in the recorded worktree.
+#   The watcher sets FM_CAPACITY_RESCUE_RECOVERY=account-exhaustion-v1 for an
+#   automatic exhaustion handoff. That scoped mode excludes the recorded account
+#   plus every capacity_rescue_exhausted_account= extension in task metadata, so
+#   a rescue can never bounce straight back onto a known-exhausted account.
 #   A --secondmate spawn also propagates the primary's declared inheritable config
 #   into the secondmate home's config/, so the secondmate's OWN crewmates,
 #   dispatch profiles, and backlog backend inherit the primary's settings
@@ -986,6 +990,7 @@ ACCOUNT_NATIVE_LAUNCH_GO=
 ACCOUNT_NATIVE_LAUNCH_DIR=
 DIRECT_ACCOUNT_ROUTING=0
 DIRECT_ACCOUNT_HOME=
+DIRECT_ACCOUNT_EXCLUDES=()
 # Environment delivered natively by `herdr agent start --env KEY=VALUE` (one
 # repeated flag per entry). Empty for every other backend, which has no native
 # env channel and keeps using command-scoped shell prefixes instead.
@@ -1042,9 +1047,10 @@ parse_orca_worktree_result() {
   ORCA_TERMINAL_PROOF=${rest%%$'\t'*}
   [ "$rest" != "$ORCA_TERMINAL_PROOF" ] || return 1
   rest=${rest#*$'\t'}
-  ORCA_REPO_ID=$rest
-  case "$ORCA_REPO_ID" in *$'\t'*) return 1 ;; esac
-  ORCA_PROVIDER_TASK=
+  ORCA_REPO_ID=${rest%%$'\t'*}
+  [ "$rest" != "$ORCA_REPO_ID" ] || return 1
+  ORCA_PROVIDER_TASK=${rest#*$'\t'}
+  case "$ORCA_PROVIDER_TASK" in *$'\t'*) return 1 ;; esac
 }
 
 persist_orca_cleanup_quarantine() {
@@ -1426,21 +1432,33 @@ cleanup_continuation_launch_transport() {
 }
 
 spawn_return_created_worktree() {
-  local return_output return_status
+  local return_output return_status current_tip
   [ "$WORKTREE_CREATED" = 1 ] || return 0
   [ "${BACKEND:-tmux}" != orca ] || return 0
   [ -n "${WT:-}" ] && [ -d "$WT" ] || return 0
+  current_tip=$(git -C "$WT" rev-parse HEAD 2>/dev/null) || current_tip=
+  if [ -n "$WORKTREE_EXPECTED_TIP" ] && [ -n "$current_tip" ] \
+    && [ "$current_tip" != "$WORKTREE_EXPECTED_TIP" ]; then
+    echo "error: acquired worktree changed from expected detached tip $WORKTREE_EXPECTED_TIP to $current_tip; retain it for manual recovery" >&2
+    echo "warning: retained acquired worktree $WT because repository identity and its expected detached tip could not be re-proven" >&2
+    return 1
+  fi
   if [ "$WORKTREE_RETAIN_ON_ABORT" = 1 ]; then
-    echo "warning: retained unsafe acquired worktree $WT for manual recovery" >&2
+    echo "warning: retained unsafe acquired worktree $WT because repository identity or its expected detached tip could not be re-proven; inspect it manually" >&2
     return 1
   fi
-  if [ -z "$WORKTREE_EXPECTED_TIP" ] \
-    || ! "$SCRIPT_DIR/fm-checkout-refresh.sh" verify-returnable "$WT" "$PROJ_ABS" "$WORKTREE_EXPECTED_TIP"; then
+  if [ -n "$WORKTREE_EXPECTED_TIP" ] && [ "$current_tip" != "$WORKTREE_EXPECTED_TIP" ]; then
+    echo "error: acquired worktree changed from expected detached tip $WORKTREE_EXPECTED_TIP to $current_tip; retain it for manual recovery" >&2
     echo "warning: retained acquired worktree $WT because repository identity and its expected detached tip could not be re-proven" >&2
     return 1
   fi
   rm -f "$WT/.claude/settings.local.json" "$WT/.opencode/plugins/fm-turn-end.js" "$WT/.fm-grok-turnend"
-  if ! "$SCRIPT_DIR/fm-checkout-refresh.sh" verify-returnable "$WT" "$PROJ_ABS" "$WORKTREE_EXPECTED_TIP"; then
+  if [ -z "$WORKTREE_EXPECTED_TIP" ] \
+    || ! "$SCRIPT_DIR/fm-checkout-refresh.sh" verify-returnable "$WT" "${PROJ_ABS_REAL:-$PROJ_ABS}" "$WORKTREE_EXPECTED_TIP"; then
+    echo "warning: retained acquired worktree $WT because repository identity and its expected detached tip could not be re-proven" >&2
+    return 1
+  fi
+  if ! "$SCRIPT_DIR/fm-checkout-refresh.sh" verify-returnable "$WT" "${PROJ_ABS_REAL:-$PROJ_ABS}" "$WORKTREE_EXPECTED_TIP"; then
     echo "warning: retained acquired worktree $WT because post-cleanup repository safety could not be re-proven" >&2
     return 1
   fi
@@ -1981,6 +1999,13 @@ if [ "$RECOVERY_ACCOUNT" = 1 ]; then
       exit 1
     }
     [ -n "$RECORDED_ACCOUNT_HOME" ] || { echo "error: direct account recovery metadata has no account_home for $ID" >&2; exit 1; }
+    if [ "${FM_CAPACITY_RESCUE_RECOVERY:-}" = account-exhaustion-v1 ]; then
+      while IFS= read -r exhausted_account; do
+        [ -n "$exhausted_account" ] || continue
+        DIRECT_ACCOUNT_EXCLUDES+=("$exhausted_account")
+      done < <(sed -n 's/^capacity_rescue_exhausted_account=//p' "$RESUME_META")
+      DIRECT_ACCOUNT_EXCLUDES+=("$RECORDED_ACCOUNT_HOME")
+    fi
     [ -z "$(fm_meta_get "$RESUME_META" account_profile)" ] || { echo "error: direct account recovery cannot replace legacy account_profile metadata for $ID" >&2; exit 1; }
     [ -z "$(fm_meta_get "$RESUME_META" account_rollback_cleanup)" ] || { echo "error: direct account recovery cannot bypass pending legacy rollback cleanup for $ID" >&2; exit 1; }
     [ -n "$RECORDED_PROJECT" ] || { echo "error: direct account recovery metadata has no project for $ID" >&2; exit 1; }
@@ -2701,7 +2726,7 @@ if [ "$KIND" = secondmate ]; then
   fi
   if [ "$ACCOUNT_EFFECTIVE_MODE" = enforce ]; then
     if ! secondmate_home_supports_account_routing "$PROJ_ABS"; then
-      echo "error: refusing account-routed secondmate launch for $PROJ_ABS: the home lacks Agent Fleet routing support. Fast-forward or otherwise reconcile the home to this Firstmate revision, run bin/fm-config-push.sh, and retry." >&2
+      echo "error: refusing account-routed secondmate launch for $ID at $PROJ_ABS: the home lacks Agent Fleet routing support. Fast-forward or otherwise reconcile the home to this Firstmate revision, run bin/fm-config-push.sh, and retry." >&2
       exit 1
     fi
   elif ! secondmate_home_supports_account_routing "$PROJ_ABS"; then
@@ -2751,7 +2776,7 @@ real_path_or_raw() {  # <path>
 # and resets the selected clean pool worktree from that remote-tracking ref.
 # The post-acquisition verification below is the fail-closed freshness proof.
 if [ "$KIND" != secondmate ] && [ "$BACKEND" != orca ] && [ "$RECOVERY_ACCOUNT" != 1 ]; then
-  if CHECKOUT_PREFLIGHT_OUT=$("$SCRIPT_DIR/fm-checkout-refresh.sh" preflight "$PROJ_ABS" 2>&1); then
+  if CHECKOUT_PREFLIGHT_OUT=$("$SCRIPT_DIR/fm-checkout-refresh.sh" preflight "$PROJ_ABS_REAL" 2>&1); then
     CHECKOUT_PREFLIGHT_STATUS=0
   else
     CHECKOUT_PREFLIGHT_STATUS=$?
@@ -2786,7 +2811,11 @@ validate_spawn_worktree() {  # <source> <inspect-target>
     exit 1
   fi
   fm_checkout_validate_git_metadata "$wt_real" >/dev/null || {
-    echo "error: $source returned redirected or unprovable Git metadata at $wt_real" >&2
+    if [ "$source" = "recorded direct account recovery" ]; then
+      echo "error: recorded direct account recovery worktree '$WT' does not belong to recorded project '$PROJ_ABS' because its Git metadata is redirected or unprovable; refusing endpoint creation" >&2
+    else
+      echo "error: $source returned redirected or unprovable Git metadata at $wt_real" >&2
+    fi
     exit 1
   }
   fm_checkout_validate_git_metadata "$proj_real" >/dev/null || {
@@ -2839,12 +2868,12 @@ if [ "$DIRECT_ACCOUNT_RECOVERY" = 1 ]; then
 fi
 
 if [ "$KIND" != secondmate ] && [ "$BACKEND" != orca ] && [ "$RECOVERY_ACCOUNT" != 1 ]; then
-  "$SCRIPT_DIR/fm-checkout-refresh.sh" pool-preflight "$PROJ_ABS" || {
+  "$SCRIPT_DIR/fm-checkout-refresh.sh" pool-preflight "$PROJ_ABS_REAL" || {
     echo "error: refusing Treehouse acquisition because pool safety could not be inspected for $PROJ_ABS" >&2
     exit 1
   }
   acquire_status=0
-  WT=$("$SCRIPT_DIR/fm-checkout-refresh.sh" acquire-worktree "$PROJ_ABS" "firstmate-$ID") || acquire_status=$?
+  WT=$("$SCRIPT_DIR/fm-checkout-refresh.sh" acquire-worktree "$PROJ_ABS_REAL" "firstmate-$ID") || acquire_status=$?
   if [ "$acquire_status" -ne 0 ]; then
     if [ "$acquire_status" -eq 124 ]; then
       echo "error: refusing to spawn $ID after the bounded Treehouse acquisition timed out" >&2
@@ -2861,7 +2890,7 @@ if [ "$KIND" != secondmate ] && [ "$BACKEND" != orca ] && [ "$RECOVERY_ACCOUNT"
   WORKTREE_RETAIN_ON_ABORT=1
   validate_spawn_worktree "treehouse get --lease" "$PROJ_ABS"
   freshness_status=0
-  "$SCRIPT_DIR/fm-checkout-refresh.sh" verify-worktree "$WT" "$PROJ_ABS" || freshness_status=$?
+  "$SCRIPT_DIR/fm-checkout-refresh.sh" verify-worktree "$WT" "$PROJ_ABS_REAL" || freshness_status=$?
   if [ "$freshness_status" -ne 0 ]; then
     echo "error: refusing to launch fm-$ID from a leased worktree whose repository identity, cleanliness, or default-tip freshness could not be proved" >&2
     exit 1
@@ -2884,7 +2913,11 @@ if [ "$DIRECT_ACCOUNT_RECOVERY" = 1 ]; then
 fi
 
 if [ "$DIRECT_ACCOUNT_PREPARE_DEFERRED" = 1 ]; then
-  DIRECT_ACCOUNT_HOME=$("$SCRIPT_DIR/fm-account-directory.sh" prepare "$HARNESS") || exit 1
+  if [ "${FM_CAPACITY_RESCUE_RECOVERY:-}" = account-exhaustion-v1 ]; then
+    DIRECT_ACCOUNT_HOME=$("$SCRIPT_DIR/fm-account-directory.sh" prepare "$HARNESS" "${DIRECT_ACCOUNT_EXCLUDES[@]}") || exit 1
+  else
+    DIRECT_ACCOUNT_HOME=$("$SCRIPT_DIR/fm-account-directory.sh" prepare "$HARNESS") || exit 1
+  fi
   echo "fm-spawn: selected direct $HARNESS account home $DIRECT_ACCOUNT_HOME" >&2
   DIRECT_ACCOUNT_PREPARE_DEFERRED=0
 fi
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index ea03eda10b..c086b28654 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -302,7 +302,7 @@ fi
 
 managed_endpoint_is_gone() {  # <backend> <target> <expected-label> [probe-home] [recorded-scoped-target]
   local backend=$1 target=$2 expected=$3 probe_home=${4:-} recorded_scoped_target=${5:-}
-  local attempt state agent_state last=unknown
+  local attempt state last=unknown
   [ -n "$target" ] || return 2
   for attempt in 1 2 3 4 5 6 7 8 9 10; do
     if [ -n "$probe_home" ]; then
@@ -312,17 +312,7 @@ managed_endpoint_is_gone() {  # <backend> <target> <expected-label> [probe-home]
     fi
     case "$state" in
       absent) return 0 ;;
-      present)
-        if [ -n "$probe_home" ]; then
-          agent_state=$(unset FM_ROOT_OVERRIDE; FM_HOME="$probe_home" FM_ROOT="$probe_home" fm_backend_agent_alive "$backend" "$target" "$expected" "$recorded_scoped_target" 2>/dev/null)
-        else
-          agent_state=$(fm_backend_agent_alive "$backend" "$target" "$expected" "$recorded_scoped_target" 2>/dev/null)
-        fi
-        case "$agent_state" in
-          dead|alive) last=present ;;
-          *) last=unknown ;;
-        esac
-        ;;
+      present) return 1 ;;
       unknown) last=unknown ;;
       *) last=unknown ;;
     esac
@@ -1052,9 +1042,30 @@ require_treehouse_return_authority() {
 }
 
 validate_teardown_target_identity() {
-  local project_root worktree_root project_common worktree_common
+  local project_root worktree_root project_common worktree_common project_git
   [ "$KIND" != secondmate ] || return 0
   require_safe_task_metadata || return 1
+  if [ "$BACKEND" != orca ] && [ ! -d "$WT" ]; then
+    project_root=$(canonical_existing_dir "$PROJ") || {
+      echo "error: teardown project metadata is not an exact inspectable repository root: ${PROJ:-<missing>}" >&2
+      return 1
+    }
+    [ "$(git -C "$project_root" rev-parse --show-toplevel 2>/dev/null)" = "$project_root" ] || {
+      echo "error: teardown project metadata is not an exact inspectable repository root: ${PROJ:-<missing>}" >&2
+      return 1
+    }
+    project_git=$(git -C "$project_root" rev-parse --absolute-git-dir 2>/dev/null) || return 1
+    [ "$project_git" = "$project_root/.git" ] && [ -d "$project_git" ] && [ ! -L "$project_git" ] || {
+      echo "error: teardown project metadata is not an exact inspectable repository root: ${PROJ:-<missing>}" >&2
+      return 1
+    }
+    worktree_registered_for_project "$project_root" "$WT" || {
+      echo "error: absent teardown worktree is not registered to the recorded project: ${WT:-<missing>}" >&2
+      return 1
+    }
+    require_treehouse_task_lease "$WT" "firstmate-$ID"
+    return $?
+  fi
   project_root=$(exact_git_worktree_root "$PROJ") || {
     echo "error: teardown project metadata is not an exact inspectable repository root: ${PROJ:-<missing>}" >&2
     return 1
@@ -1849,6 +1860,7 @@ if not stat.S_ISDIR(os.lstat(base).st_mode):
 print(base)
 PY
   ) || return 1
+  [ -e "$base/fm-$ID" ] || [ -L "$base/fm-$ID" ] || return 0
   removal_tree_operation "$base/fm-$ID" "task temp root" remove
 }
 
@@ -2330,7 +2342,7 @@ def confined(path):
     except ValueError:
         return False
 
-def retain(path, expected_directory):
+def retain(path, expected_directory, keep_open=False):
     metadata = os.lstat(path)
     if stat.S_ISLNK(metadata.st_mode):
         raise OSError(f"redirected object storage entry: {path}")
@@ -2363,49 +2375,58 @@ def retain(path, expected_directory):
     if confined(os.path.realpath(path)):
         os.close(descriptor)
         raise OSError(f"object storage depends on retiring home: {path}")
-    held.append((path, descriptor, expected))
-    return descriptor, opened
+    held.append((path, expected))
+    if keep_open:
+        return descriptor, opened
+    os.close(descriptor)
+    return None, opened
 
 def inspect(objects):
     objects = os.path.normpath(objects)
-    directory, metadata = retain(objects, True)
-    identity = (metadata.st_dev, metadata.st_ino)
-    if identity in visited:
-        return
-    visited.add(identity)
-    object_device = metadata.st_dev
-    for name in sorted(os.listdir(directory)):
-        path = os.path.join(objects, name)
-        item = os.stat(name, dir_fd=directory, follow_symlinks=False)
-        if item.st_dev != object_device:
-            raise OSError(f"object storage crosses a filesystem boundary: {path}")
-        if stat.S_ISLNK(item.st_mode):
-            raise OSError(f"redirected object storage entry: {path}")
-        if stat.S_ISDIR(item.st_mode):
-            inspect(path)
-        elif stat.S_ISREG(item.st_mode):
-            retain(path, False)
-        else:
-            raise OSError(f"unsafe object storage entry: {path}")
-    alternates = os.path.join(objects, "info", "alternates")
-    http_alternates = os.path.join(objects, "info", "http-alternates")
-    if os.path.lexists(http_alternates):
-        raise OSError(f"HTTP alternates are not durable proof: {http_alternates}")
-    if not os.path.lexists(alternates):
-        return
-    alternate_fd, _ = retain(alternates, False)
-    with os.fdopen(os.dup(alternate_fd), "r", encoding="utf-8") as stream:
-        entries = [line.rstrip("\n") for line in stream]
-    if not entries or any(not entry or "\x00" in entry for entry in entries):
-        raise OSError(f"malformed alternates file: {alternates}")
-    for entry in entries:
-        if entry.startswith('"') or entry.endswith('"'):
-            raise OSError(f"quoted alternates are ambiguous: {alternates}")
-        candidate = entry if os.path.isabs(entry) else os.path.join(objects, entry)
-        inspect(os.path.realpath(candidate))
+    directory, metadata = retain(objects, True, True)
+    try:
+        identity = (metadata.st_dev, metadata.st_ino)
+        if identity in visited:
+            return
+        visited.add(identity)
+        object_device = metadata.st_dev
+        for name in sorted(os.listdir(directory)):
+            path = os.path.join(objects, name)
+            item = os.stat(name, dir_fd=directory, follow_symlinks=False)
+            if item.st_dev != object_device:
+                raise OSError(f"object storage crosses a filesystem boundary: {path}")
+            if stat.S_ISLNK(item.st_mode):
+                raise OSError(f"redirected object storage entry: {path}")
+            if stat.S_ISDIR(item.st_mode):
+                inspect(path)
+            elif stat.S_ISREG(item.st_mode):
+                retain(path, False)
+            else:
+                raise OSError(f"unsafe object storage entry: {path}")
+        alternates = os.path.join(objects, "info", "alternates")
+        http_alternates = os.path.join(objects, "info", "http-alternates")
+        if os.path.lexists(http_alternates):
+            raise OSError(f"HTTP alternates are not durable proof: {http_alternates}")
+        if not os.path.lexists(alternates):
+            return
+        alternate_fd, _ = retain(alternates, False, True)
+        try:
+            with os.fdopen(os.dup(alternate_fd), "r", encoding="utf-8") as stream:
+                entries = [line.rstrip("\n") for line in stream]
+        finally:
+            os.close(alternate_fd)
+        if not entries or any(not entry or "\x00" in entry for entry in entries):
+            raise OSError(f"malformed alternates file: {alternates}")
+        for entry in entries:
+            if entry.startswith('"') or entry.endswith('"'):
+                raise OSError(f"quoted alternates are ambiguous: {alternates}")
+            candidate = entry if os.path.isabs(entry) else os.path.join(objects, entry)
+            inspect(os.path.realpath(candidate))
+    finally:
+        os.close(directory)
 
 def verify_retained():
-    for path, descriptor, expected in held:
+    for path, expected in held:
         metadata = os.lstat(path)
         current = (
             metadata.st_dev,
@@ -2413,14 +2434,34 @@ def verify_retained():
             stat.S_IFMT(metadata.st_mode),
             metadata.st_size,
         )
-        opened = os.fstat(descriptor)
-        retained = (
-            opened.st_dev,
-            opened.st_ino,
-            stat.S_IFMT(opened.st_mode),
-            opened.st_size,
-        )
-        if current != expected or retained != expected or stat.S_ISLNK(metadata.st_mode):
+        if (
+            current != expected
+            or stat.S_ISLNK(metadata.st_mode)
+            or confined(os.path.realpath(path))
+        ):
+            raise OSError(f"object storage identity changed during graph proof: {path}")
+        flags = os.O_RDONLY
+        if expected[2] == stat.S_IFDIR:
+            flags |= os.O_DIRECTORY
+        if hasattr(os, "O_NOFOLLOW"):
+            flags |= os.O_NOFOLLOW
+        try:
+            descriptor = os.open(path, flags)
+            try:
+                opened = os.fstat(descriptor)
+                retained = (
+                    opened.st_dev,
+                    opened.st_ino,
+                    stat.S_IFMT(opened.st_mode),
+                    opened.st_size,
+                )
+            finally:
+                os.close(descriptor)
+        except OSError as error:
+            raise OSError(
+                f"object storage identity changed during graph proof: {path}"
+            ) from error
+        if retained != expected:
             raise OSError(f"object storage identity changed during graph proof: {path}")
 
 def run(arguments, input_data=None):
@@ -2503,9 +2544,6 @@ try:
 except (OSError, UnicodeError, subprocess.SubprocessError) as error:
     print(f"REFUSED: {label} complete object graph is unavailable: {error}", file=sys.stderr)
     raise SystemExit(1)
-finally:
-    for _, descriptor, _ in reversed(held):
-        os.close(descriptor)
 PY
 }
 
diff --git a/bin/fm-watch.sh b/bin/fm-watch.sh
index 9b4495edb6..8d950205bc 100755
--- a/bin/fm-watch.sh
+++ b/bin/fm-watch.sh
@@ -36,6 +36,11 @@
 #                          status, or turn-end progress surfaces after
 #                          FM_PERMISSION_STALL_ESCALATE_SECS as a possible macOS
 #                          permission/system-dialog block. Unless afk is active.
+#                          A verified Claude/Codex account-capacity pane bypasses
+#                          stale timing: the watcher removes the exhausted
+#                          endpoint and hands the same brief/worktree to a fresh
+#                          direct account automatically. Attempts and exhausted
+#                          accounts are recorded in meta and bounded per task.
 #   check: <script>: <out> per-task check output, always actionable
 #   heartbeat              fleet-scan backstop found an unsurfaced captain-relevant
 #                          status, unless afk is active
@@ -72,6 +77,11 @@ mkdir -p "$STATE"
 # backstop. See bin/fm-backend.sh and docs/herdr-backend.md.
 # shellcheck source=bin/fm-backend.sh
 . "$SCRIPT_DIR/fm-backend.sh"
+# Direct-account recovery serialization and atomic metadata locks. The watcher
+# uses the same task lifecycle lock as spawn/teardown, then hands ownership to
+# fm-spawn.sh for the replacement endpoint.
+# shellcheck source=bin/fm-account-routing-lib.sh
+. "$SCRIPT_DIR/fm-account-routing-lib.sh"
 # Shared normalized-transition accessors and the single-owner status->action
 # policy table, so the event-wait splice reads transition records the same way
 # the herdr subscriber writes them (bin/fm-transition-lib.sh).
@@ -156,6 +166,10 @@ esac
 # it re-surfaces once for a recheck every PAUSE_RESURFACE_SECS - far longer than the
 # wedge threshold, but finite so a forgotten pause cannot rot invisibly.
 PAUSE_RESURFACE_SECS=${FM_PAUSE_RESURFACE_SECS:-$FM_PAUSE_RESURFACE_SECS_DEFAULT}
+CAPACITY_RESCUE_MAX_ATTEMPTS=${FM_CAPACITY_RESCUE_MAX_ATTEMPTS:-5}
+case "$CAPACITY_RESCUE_MAX_ATTEMPTS" in
+  ''|*[!0-9]*|0) CAPACITY_RESCUE_MAX_ATTEMPTS=5 ;;
+esac
 TRIAGE_LOG="$STATE/.watch-triage.log"
 TRIAGE_LOG_MAX_BYTES=${FM_WATCH_TRIAGE_LOG_MAX_BYTES:-262144}
 # Consecutive event-path failures (fm_backend_wait_transition returning 2 -
@@ -422,6 +436,407 @@ surface_nonterminal_stale() {  # <window> <hash>
   wake "stale: $win"
 }
 
+# Resolve the spawn entrypoint for an automatic capacity handoff. The override
+# exists only for the hermetic watcher tests; production always invokes the
+# sibling fm-spawn.sh.
+capacity_rescue_spawn_bin() {
+  if [ "${FM_CAPACITY_RESCUE_TEST_LAB:-}" = firstmate-capacity-rescue-test-lab-v1 ] \
+    && [ -n "${FM_CAPACITY_RESCUE_SPAWN_BIN:-}" ]; then
+    printf '%s' "$FM_CAPACITY_RESCUE_SPAWN_BIN"
+  else
+    printf '%s' "$SCRIPT_DIR/fm-spawn.sh"
+  fi
+}
+
+capacity_rescue_meta_begin() {  # <task> <attempt> <harness> <account-home> <failure-kind>
+  local task=$1 attempt=$2 harness=$3 account_home=$4 failure_kind=$5
+  local meta="$STATE/$task.meta" lock tmp timestamp attempt_key
+  lock=$(fm_account_meta_lock_acquire "$STATE" "$task") || return 1
+  tmp=$(mktemp "$STATE/.$task.meta.capacity-rescue.XXXXXX") || {
+    fm_account_meta_lock_release "$lock" >/dev/null 2>&1 || true
+    return 1
+  }
+  timestamp=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
+  attempt_key="capacity_rescue_attempt_$attempt="
+  if ! awk -v attempt_key="$attempt_key" '
+    index($0, "capacity_rescue_attempts=") == 1 { next }
+    index($0, attempt_key) == 1 { next }
+    { print }
+  ' "$meta" > "$tmp"; then
+    rm -f "$tmp"
+    fm_account_meta_lock_release "$lock" >/dev/null 2>&1 || true
+    return 1
+  fi
+  if ! printf 'capacity_rescue_attempts=%s\n' "$attempt" >> "$tmp"; then
+    rm -f "$tmp"
+    fm_account_meta_lock_release "$lock" >/dev/null 2>&1 || true
+    return 1
+  fi
+  if ! grep -Fqx "capacity_rescue_exhausted_account=$account_home" "$tmp" \
+    && ! printf 'capacity_rescue_exhausted_account=%s\n' "$account_home" >> "$tmp"; then
+    rm -f "$tmp"
+    fm_account_meta_lock_release "$lock" >/dev/null 2>&1 || true
+    return 1
+  fi
+  if ! printf 'capacity_rescue_attempt_%s=%s|harness=%s|account=%s|failure=%s\n' \
+    "$attempt" "$timestamp" "$harness" "$account_home" "$failure_kind" >> "$tmp" \
+    || ! fm_account_safe_file_destination "$meta" \
+    || ! mv "$tmp" "$meta"; then
+    rm -f "$tmp"
+    fm_account_meta_lock_release "$lock" >/dev/null 2>&1 || true
+    return 1
+  fi
+  fm_account_meta_lock_release "$lock"
+}
+
+capacity_rescue_meta_result() {  # <task> <attempt> <result>
+  local task=$1 attempt=$2 result=$3
+  local meta="$STATE/$task.meta" lock tmp result_key
+  lock=$(fm_account_meta_lock_acquire "$STATE" "$task") || return 1
+  tmp=$(mktemp "$STATE/.$task.meta.capacity-result.XXXXXX") || {
+    fm_account_meta_lock_release "$lock" >/dev/null 2>&1 || true
+    return 1
+  }
+  result_key="capacity_rescue_result_$attempt="
+  if ! awk -v result_key="$result_key" '
+      index($0, result_key) == 1 { next }
+      { print }
+    ' "$meta" > "$tmp" \
+    || ! printf 'capacity_rescue_result_%s=%s\n' "$attempt" "$result" >> "$tmp" \
+    || ! fm_account_safe_file_destination "$meta" \
+    || ! mv "$tmp" "$meta"; then
+    rm -f "$tmp"
+    fm_account_meta_lock_release "$lock" >/dev/null 2>&1 || true
+    return 1
+  fi
+  fm_account_meta_lock_release "$lock"
+}
+
+capacity_rescue_meta_stop() {  # <task> <reason>
+  local task=$1 reason=$2
+  local meta="$STATE/$task.meta" lock tmp
+  lock=$(fm_account_meta_lock_acquire "$STATE" "$task") || return 1
+  tmp=$(mktemp "$STATE/.$task.meta.capacity-stop.XXXXXX") || {
+    fm_account_meta_lock_release "$lock" >/dev/null 2>&1 || true
+    return 1
+  }
+  if ! awk 'index($0, "capacity_rescue_stopped=") != 1 { print }' "$meta" > "$tmp" \
+    || ! printf 'capacity_rescue_stopped=%s\n' "$reason" >> "$tmp" \
+    || ! fm_account_safe_file_destination "$meta" \
+    || ! mv "$tmp" "$meta"; then
+    rm -f "$tmp"
+    fm_account_meta_lock_release "$lock" >/dev/null 2>&1 || true
+    return 1
+  fi
+  fm_account_meta_lock_release "$lock"
+}
+
+capacity_rescue_append_blocked() {  # <task> <note>
+  local task=$1 note=$2
+  local statusf="$STATE/$task.status"
+  [ ! -L "$statusf" ] && { [ ! -e "$statusf" ] || [ -f "$statusf" ]; } || return 1
+  if [ -f "$statusf" ] \
+    && status_open_decisions "$statusf" | grep -Fq $'capacity-rescue\t'; then
+    return 0
+  fi
+  printf 'blocked [key=capacity-rescue]: %s\n' "$note" >> "$statusf"
+}
+
+model_capacity_append_blocked() {  # <task> <note>
+  local task=$1 note=$2
+  local statusf="$STATE/$task.status"
+  [ ! -L "$statusf" ] && { [ ! -e "$statusf" ] || [ -f "$statusf" ]; } || return 1
+  if [ -f "$statusf" ] \
+    && status_open_decisions "$statusf" | grep -Fq $'model-capacity\t'; then
+    return 1
+  fi
+  printf 'blocked [key=model-capacity]: %s\n' "$note" >> "$statusf"
+}
+
+capacity_rescue_release_lifecycle() {  # <lock>
+  local lock=$1
+  [ -n "$lock" ] || return 0
+  if fm_account_lifecycle_lock_owned "$lock" 2>/dev/null; then
+    fm_account_lifecycle_lock_release "$lock" >/dev/null 2>&1 || true
+  fi
+}
+
+capacity_rescue_remove_endpoint() {  # <meta> <task>
+  local meta=$1 task=$2 backend target tab scoped endpoint_state
+  backend=$(fm_backend_of_meta "$meta")
+  target=$(fm_backend_target_of_meta "$meta")
+  tab=$(fm_meta_get "$meta" zellij_tab_id)
+  scoped=$(fm_meta_get "$meta" tmux_session_target)
+  [ -n "$target" ] || return 1
+  fm_backend_kill "$backend" "$target" "$tab" "fm-$task" "$scoped" >/dev/null 2>&1 || true
+  endpoint_state=$(fm_backend_target_state "$backend" "$target" "fm-$task" "$scoped" 2>/dev/null)
+  [ "$endpoint_state" = absent ]
+}
+
+# Reconcile one attempt whose watcher stopped after the durable attempt write but
+# before its terminal stop/result transaction completed. This scans metadata, not
+# live windows, so an interruption after endpoint removal cannot disappear from
+# supervision merely because there is no pane left to classify.
+capacity_rescue_reconcile_terminal_attempt() {
+  local meta task attempts result stopped lock reason note
+  for meta in "$STATE"/*.meta; do
+    [ -f "$meta" ] && [ ! -L "$meta" ] || continue
+    grep -q '^capacity_rescue_attempts=' "$meta" || continue
+    task=${meta##*/}
+    task=${task%.meta}
+    fm_account_valid_id "$task" || continue
+    attempts=$(fm_meta_get "$meta" capacity_rescue_attempts)
+    case "$attempts" in
+      ''|0|*[!0-9]*) continue ;;
+    esac
+    stopped=$(fm_meta_get "$meta" capacity_rescue_stopped)
+    [ -z "$stopped" ] || continue
+    result=$(fm_meta_get "$meta" "capacity_rescue_result_$attempts")
+    case "$result" in
+      rescued\|account=*) continue ;;
+      '')
+        reason=interrupted-attempt
+        note="automatic account rescue stopped because attempt $attempts has no recorded result; inspect the endpoint before any manual recovery"
+        ;;
+      no-capacity|recovery-failed|endpoint-removal-failed|same-account-refused)
+        reason=$result
+        note="automatic account rescue remains stopped after terminal attempt $attempts ($result)"
+        ;;
+      *)
+        reason=invalid-result-metadata
+        note="automatic account rescue stopped because attempt $attempts has invalid result metadata"
+        ;;
+    esac
+
+    lock=$(fm_account_lifecycle_lock_acquire "$STATE" "$task" 2>/dev/null || true)
+    [ -n "$lock" ] || continue
+    # Re-read after serialization so a replacement that just committed its
+    # result cannot be mislabeled as interrupted from the earlier snapshot.
+    attempts=$(fm_meta_get "$meta" capacity_rescue_attempts)
+    case "$attempts" in
+      ''|0|*[!0-9]*)
+        capacity_rescue_release_lifecycle "$lock"
+        continue
+        ;;
+    esac
+    stopped=$(fm_meta_get "$meta" capacity_rescue_stopped)
+    result=$(fm_meta_get "$meta" "capacity_rescue_result_$attempts")
+    if [ -n "$stopped" ]; then
+      capacity_rescue_release_lifecycle "$lock"
+      continue
+    fi
+    case "$result" in
+      rescued\|account=*)
+        capacity_rescue_release_lifecycle "$lock"
+        continue
+        ;;
+      '')
+        reason=interrupted-attempt
+        note="automatic account rescue stopped because attempt $attempts has no recorded result; inspect the endpoint before any manual recovery"
+        ;;
+      no-capacity|recovery-failed|endpoint-removal-failed|same-account-refused)
+        reason=$result
+        note="automatic account rescue remains stopped after terminal attempt $attempts ($result)"
+        ;;
+      *)
+        reason=invalid-result-metadata
+        note="automatic account rescue stopped because attempt $attempts has invalid result metadata"
+        ;;
+    esac
+    if ! capacity_rescue_meta_stop "$task" "$reason"; then
+      capacity_rescue_release_lifecycle "$lock"
+      continue
+    fi
+    capacity_rescue_release_lifecycle "$lock"
+    capacity_rescue_append_blocked "$task" "$note" || true
+    printf '%s\t%s\n' "$task" "$reason"
+    return 0
+  done
+  return 1
+}
+
+# Perform one serialized automatic handoff. Sets CAPACITY_RESCUE_OUTCOME to one
+# of rescued, blocked, already-stopped, or deferred and
+# CAPACITY_RESCUE_REASON to a short audit-safe explanation.
+capacity_rescue_task() {  # <window> <task> <harness> <failure-kind>
+  local win=$1 task=$2 harness=$3 failure_kind=$4
+  local meta="$STATE/$task.meta"
+  local lock='' same_lock='' account_home kind generation attempts stopped attempt spawn_bin out new_account result last_result
+  CAPACITY_RESCUE_OUTCOME=deferred
+  CAPACITY_RESCUE_REASON="capacity rescue could not acquire task ownership"
+  [ -f "$meta" ] && [ ! -L "$meta" ] || return 1
+  lock=$(fm_account_lifecycle_lock_acquire "$STATE" "$task") || return 1
+
+  # Re-resolve under lifecycle ownership so a stale pane snapshot cannot mutate
+  # a replacement generation that another lifecycle operation just installed.
+  [ -f "$meta" ] && [ ! -L "$meta" ] || {
+    capacity_rescue_release_lifecycle "$lock"
+    return 1
+  }
+  [ "$(fm_backend_target_of_meta "$meta")" = "$win" ] || {
+    capacity_rescue_release_lifecycle "$lock"
+    CAPACITY_RESCUE_REASON="capacity pane belongs to an obsolete endpoint generation"
+    return 1
+  }
+  kind=$(fm_meta_get "$meta" kind)
+  [ -n "$kind" ] || kind=ship
+  account_home=$(fm_meta_get "$meta" account_home)
+  generation=$(fm_meta_get "$meta" generation_id)
+  stopped=$(fm_meta_get "$meta" capacity_rescue_stopped)
+  if [ -n "$stopped" ]; then
+    capacity_rescue_release_lifecycle "$lock"
+    CAPACITY_RESCUE_OUTCOME=already-stopped
+    CAPACITY_RESCUE_REASON=$stopped
+    return 0
+  fi
+  if [ "$kind" != ship ] && [ "$kind" != scout ]; then
+    capacity_rescue_meta_stop "$task" unsupported-kind || true
+    capacity_rescue_release_lifecycle "$lock"
+    capacity_rescue_append_blocked "$task" "automatic account rescue stopped: task kind '$kind' is not a recoverable ship/scout" || true
+    CAPACITY_RESCUE_OUTCOME=blocked
+    CAPACITY_RESCUE_REASON=unsupported-kind
+    return 0
+  fi
+  if [ -z "$account_home" ] || [ -z "$generation" ]; then
+    capacity_rescue_meta_stop "$task" missing-direct-account-metadata || true
+    capacity_rescue_release_lifecycle "$lock"
+    capacity_rescue_append_blocked "$task" "automatic account rescue stopped: direct account recovery metadata is incomplete" || true
+    CAPACITY_RESCUE_OUTCOME=blocked
+    CAPACITY_RESCUE_REASON=missing-direct-account-metadata
+    return 0
+  fi
+  if [ "$failure_kind" = claude-not-logged-in ]; then
+    capacity_rescue_meta_stop "$task" credentials || true
+    capacity_rescue_release_lifecycle "$lock"
+    capacity_rescue_append_blocked "$task" "automatic account rescue blocked on Claude credentials: run /login for the configured account directories" || true
+    CAPACITY_RESCUE_OUTCOME=blocked
+    CAPACITY_RESCUE_REASON=credentials
+    return 0
+  fi
+  attempts=$(fm_meta_get "$meta" capacity_rescue_attempts)
+  case "$attempts" in
+    '') attempts=0 ;;
+    *[!0-9]*)
+      capacity_rescue_meta_stop "$task" invalid-attempt-metadata || true
+      capacity_rescue_remove_endpoint "$meta" "$task" || true
+      capacity_rescue_release_lifecycle "$lock"
+      capacity_rescue_append_blocked "$task" "automatic account rescue stopped: capacity_rescue_attempts metadata is invalid" || true
+      CAPACITY_RESCUE_OUTCOME=blocked
+      CAPACITY_RESCUE_REASON=invalid-attempt-metadata
+      return 0
+      ;;
+  esac
+  if [ "$attempts" -gt 0 ]; then
+    last_result=$(fm_meta_get "$meta" "capacity_rescue_result_$attempts")
+    case "$last_result" in
+      '')
+        capacity_rescue_meta_stop "$task" interrupted-attempt || true
+        capacity_rescue_release_lifecycle "$lock"
+        capacity_rescue_append_blocked "$task" "automatic account rescue stopped because attempt $attempts has no recorded result; inspect the endpoint before any manual recovery" || true
+        CAPACITY_RESCUE_OUTCOME=blocked
+        CAPACITY_RESCUE_REASON=interrupted-attempt
+        return 0
+        ;;
+      no-capacity|recovery-failed|endpoint-removal-failed|same-account-refused)
+        capacity_rescue_meta_stop "$task" "$last_result" || true
+        capacity_rescue_release_lifecycle "$lock"
+        capacity_rescue_append_blocked "$task" "automatic account rescue remains stopped after terminal attempt $attempts ($last_result)" || true
+        CAPACITY_RESCUE_OUTCOME=blocked
+        CAPACITY_RESCUE_REASON=$last_result
+        return 0
+        ;;
+      rescued\|account=*) ;;
+      *)
+        capacity_rescue_meta_stop "$task" invalid-result-metadata || true
+        capacity_rescue_release_lifecycle "$lock"
+        capacity_rescue_append_blocked "$task" "automatic account rescue stopped because attempt $attempts has invalid result metadata" || true
+        CAPACITY_RESCUE_OUTCOME=blocked
+        CAPACITY_RESCUE_REASON=invalid-result-metadata
+        return 0
+        ;;
+    esac
+  fi
+  if [ "$attempts" -ge "$CAPACITY_RESCUE_MAX_ATTEMPTS" ]; then
+    capacity_rescue_meta_stop "$task" max-attempts || true
+    capacity_rescue_remove_endpoint "$meta" "$task" || true
+    capacity_rescue_release_lifecycle "$lock"
+    capacity_rescue_append_blocked "$task" "automatic account rescue stopped after reaching the per-task cap of $CAPACITY_RESCUE_MAX_ATTEMPTS attempts" || true
+    CAPACITY_RESCUE_OUTCOME=blocked
+    CAPACITY_RESCUE_REASON=max-attempts
+    return 0
+  fi
+
+  attempt=$((attempts + 1))
+  capacity_rescue_meta_begin "$task" "$attempt" "$harness" "$account_home" "$failure_kind" || {
+    capacity_rescue_release_lifecycle "$lock"
+    CAPACITY_RESCUE_REASON="capacity rescue could not record attempt $attempt"
+    return 1
+  }
+  if ! capacity_rescue_remove_endpoint "$meta" "$task"; then
+    capacity_rescue_meta_result "$task" "$attempt" endpoint-removal-failed || true
+    capacity_rescue_meta_stop "$task" endpoint-removal-failed || true
+    capacity_rescue_release_lifecycle "$lock"
+    capacity_rescue_append_blocked "$task" "automatic account rescue stopped on attempt $attempt because exhausted endpoint removal could not be proved" || true
+    CAPACITY_RESCUE_OUTCOME=blocked
+    CAPACITY_RESCUE_REASON=endpoint-removal-failed
+    return 0
+  fi
+
+  spawn_bin=$(capacity_rescue_spawn_bin)
+  if out=$(FM_CAPACITY_RESCUE_RECOVERY=account-exhaustion-v1 \
+    FM_ACCOUNT_LIFECYCLE_LOCK_HELD="$lock" \
+    "$spawn_bin" "$task" --recover-direct-account 2>&1); then
+    result=0
+  else
+    result=$?
+  fi
+  # A real fm-spawn inherits, replaces, and releases the lifecycle lock. A
+  # pre-handoff failure can leave this watcher as owner, so release only when
+  # ownership is still ours.
+  capacity_rescue_release_lifecycle "$lock"
+  lock=
+
+  if [ "$result" -eq 0 ]; then
+    new_account=$(fm_meta_get "$meta" account_home)
+    if [ -z "$new_account" ] || [ "$new_account" = "$account_home" ]; then
+      same_lock=$(fm_account_lifecycle_lock_acquire "$STATE" "$task" 2>/dev/null || true)
+      if [ -n "$same_lock" ]; then
+        capacity_rescue_remove_endpoint "$meta" "$task" || true
+        capacity_rescue_release_lifecycle "$same_lock"
+      fi
+      capacity_rescue_meta_result "$task" "$attempt" same-account-refused || true
+      capacity_rescue_meta_stop "$task" same-account-refused || true
+      capacity_rescue_append_blocked "$task" "automatic account rescue stopped on attempt $attempt because replacement did not bind a different account" || true
+      CAPACITY_RESCUE_OUTCOME=blocked
+      CAPACITY_RESCUE_REASON=same-account-refused
+      return 0
+    fi
+    capacity_rescue_meta_result "$task" "$attempt" "rescued|account=$new_account" || {
+      CAPACITY_RESCUE_OUTCOME=deferred
+      CAPACITY_RESCUE_REASON="replacement launched but attempt $attempt result could not be recorded"
+      return 1
+    }
+    CAPACITY_RESCUE_OUTCOME=rescued
+    CAPACITY_RESCUE_REASON="attempt $attempt moved $harness from $account_home to $new_account"
+    return 0
+  fi
+
+  if printf '%s\n' "$out" | grep -Fq 'CAPACITY_UNAVAILABLE:'; then
+    capacity_rescue_meta_result "$task" "$attempt" no-capacity || true
+    capacity_rescue_meta_stop "$task" no-capacity || true
+    capacity_rescue_append_blocked "$task" "automatic account rescue stopped on attempt $attempt: no unused $harness account has available capacity" || true
+    CAPACITY_RESCUE_OUTCOME=blocked
+    CAPACITY_RESCUE_REASON=no-capacity
+  else
+    capacity_rescue_meta_result "$task" "$attempt" recovery-failed || true
+    capacity_rescue_meta_stop "$task" recovery-failed || true
+    capacity_rescue_append_blocked "$task" "automatic account rescue stopped on attempt $attempt because the guarded direct-account recovery failed" || true
+    CAPACITY_RESCUE_OUTCOME=blocked
+    CAPACITY_RESCUE_REASON=recovery-failed
+  fi
+  return 0
+}
+
 # Recognize the stable confirmation chrome rendered by verified harnesses when a
 # mid-run permission or trust grant is waiting on a human. The question alone is
 # insufficient because pane output can quote it; each shape also requires its
@@ -1009,6 +1424,16 @@ EOF
     fi
   fi
 
+  terminal_rescue=$(capacity_rescue_reconcile_terminal_attempt || true)
+  if [ -n "$terminal_rescue" ]; then
+    task=${terminal_rescue%%$'\t'*}
+    capacity_failure=${terminal_rescue#*$'\t'}
+    reason="signal: $STATE/$task.status (automatic capacity rescue stopped: $capacity_failure)"
+    fm_wake_append signal "$task.status" "$reason" || exit 1
+    mark_surfaced "$STATE/$task.status"
+    wake "$reason"
+  fi
+
   # Layer 1 backbone: pane staleness. Two consecutive identical hashes with no busy
   # signature means the crewmate finished, is waiting, or is wedged. Each distinct
   # stale hash is surfaced, absorbed, or timed toward escalation once (.stale-*
@@ -1034,6 +1459,71 @@ EOF
       window_busy=1
       mark_brief_processing_started "$task" || true
     fi
+    capacity_failure=
+    credential_failure=
+    if [ "$window_busy" != 1 ]; then
+      case "$kind" in
+        ship|scout)
+          credential_failure=$(provider_credential_failure_kind "$(window_harness "$w")" "$tail40" || true)
+          capacity_failure=$(provider_capacity_failure_kind "$(window_harness "$w")" "$tail40" || true)
+          ;;
+      esac
+    fi
+    if [ -n "$credential_failure" ]; then
+      capacity_rescue_task "$w" "$task" "$(window_harness "$w")" "$credential_failure" || true
+      case "$CAPACITY_RESCUE_OUTCOME" in
+        already-stopped)
+          triage_log "account rescue remains stopped: $task ($CAPACITY_RESCUE_REASON)"
+          continue
+          ;;
+        blocked)
+          reason="signal: $STATE/$task.status (automatic account rescue stopped: $CAPACITY_RESCUE_REASON)"
+          fm_wake_append signal "$task.status" "$reason" || exit 1
+          mark_surfaced "$STATE/$task.status"
+          wake "$reason"
+          ;;
+        *)
+          reason="stale: $w (provider credential failure detected but automatic rescue was deferred: $CAPACITY_RESCUE_REASON)"
+          fm_wake_append stale "$w" "$reason" || exit 1
+          wake "$reason"
+          ;;
+      esac
+    fi
+    if [ -n "$capacity_failure" ]; then
+      if [ "$capacity_failure" = codex-model-capacity ]; then
+        if model_capacity_append_blocked "$task" \
+          "selected Codex model is at capacity; choose a different model or retry after capacity recovers"; then
+          reason="signal: $STATE/$task.status (Codex model capacity requires a model change; account rotation was not attempted)"
+          fm_wake_append signal "$task.status" "$reason" || exit 1
+          mark_surfaced "$STATE/$task.status"
+          wake "$reason"
+        fi
+        triage_log "Codex model capacity remains surfaced: $task"
+        continue
+      fi
+      capacity_rescue_task "$w" "$task" "$(window_harness "$w")" "$capacity_failure" || true
+      case "$CAPACITY_RESCUE_OUTCOME" in
+        rescued)
+          triage_log "automatic capacity rescue succeeded: $task ($CAPACITY_RESCUE_REASON)"
+          continue
+          ;;
+        already-stopped)
+          triage_log "capacity rescue remains stopped: $task ($CAPACITY_RESCUE_REASON)"
+          continue
+          ;;
+        blocked)
+          reason="signal: $STATE/$task.status (automatic capacity rescue stopped: $CAPACITY_RESCUE_REASON)"
+          fm_wake_append signal "$task.status" "$reason" || exit 1
+          mark_surfaced "$STATE/$task.status"
+          wake "$reason"
+          ;;
+        *)
+          reason="stale: $w (provider capacity failure detected but automatic rescue was deferred: $CAPACITY_RESCUE_REASON)"
+          fm_wake_append stale "$w" "$reason" || exit 1
+          wake "$reason"
+          ;;
+      esac
+    fi
     if [ "$window_busy" != 1 ]; then
       allow_directory_trust=0
       brief_processing_started "$task" && allow_directory_trust=1
diff --git a/docs/account-capacity-rescue.md b/docs/account-capacity-rescue.md
new file mode 100644
index 0000000000..d069f26861
--- /dev/null
+++ b/docs/account-capacity-rescue.md
@@ -0,0 +1,110 @@
+# Automatic account-capacity rescue
+
+Firstmate automatically hands a direct-account ship or scout task to a fresh agent only when verified provider TUI chrome shows empirically account-scoped exhaustion.
+The handoff deliberately replays the task brief in the recorded worktree through `bin/fm-spawn.sh <id> --recover-direct-account`.
+It does not migrate the exhausted provider session.
+Codex's verified model-capacity warning is model-scoped instead: the watcher surfaces one keyed blocked status without removing the endpoint, rotating accounts, or writing account-rescue metadata.
+
+## Empirical detection signatures
+
+The classifier matches only a bounded final pane tail from the harness recorded in task metadata while the current endpoint is idle.
+It never treats generic API errors, task prose, documentation, a quoted sentence without the harness chrome, or stale chrome above a current busy indicator as an actionable provider failure.
+
+The following signatures came from real local pane captures recovered from harness transcript archives on 2026-07-25.
+
+Codex rendered this standalone warning line:
+
+```text
+⚠ Selected model is at capacity. Please try a different model.
+```
+
+The local Codex installation reported `codex-cli 0.145.0-alpha.30` when the evidence was checked.
+The archived pane capture did not embed its originating Codex version, so the installed version is environment evidence rather than proof of the capture's exact producer version.
+
+Claude rendered this tool-result line:
+
+```text
+  ⎿  You've hit your session limit · resets 5pm (America/New_York)
+```
+
+The same exhausted Claude session also rendered this complete choice dialog:
+
+```text
+What do you want to do?
+
+❯ 1. Stop and wait for limit to reset
+  2. Switch to usage credits
+  3. Switch to Team plan
+
+Enter to confirm · Esc to cancel
+```
+
+The transcript carrying that capture recorded Claude Code `2.1.207`.
+The installed Claude version was `2.1.220` when the evidence was checked.
+
+The evidence search used fixed-string scans of the machine-local `~/.claude/projects` transcript archive, followed by inspection of the surrounding captured pane and version records.
+The runtime version checks were:
+
+```sh
+codex --version
+claude --version
+```
+
+`provider_capacity_failure_kind` in `bin/fm-classify-lib.sh` owns the exact classifier.
+Codex requires the warning glyph and full anchored sentence.
+Claude requires either the result glyph and reset sentence or every line of the complete choice dialog.
+An unknown harness never inherits another harness's signatures.
+The Codex token denotes model capacity and surfaces once for a model change or later retry.
+The verified Claude session-limit shapes denote account-scoped exhaustion and are the only current capacity tokens that enter automatic account rescue.
+
+The watcher separately recognizes Claude's anchored `Not logged in - Please run /login` TUI line as a credential failure.
+That guard does not rotate accounts, remove the endpoint, consume an attempt, or mark the current account exhausted.
+It records `capacity_rescue_stopped=credentials`, appends the single keyed blocked status, and leaves the endpoint available for the required `/login`.
+Ordinary prose that mentions the login message does not match, and Codex does not inherit the Claude-only guard.
+
+## Rescue transaction
+
+`bin/fm-watch.sh` establishes the endpoint's current busy state after each bounded pane capture and runs provider-failure classifiers only when the endpoint is idle.
+Secondmates and legacy managed generations are outside this path because automatic direct-account recovery is defined only for recorded ship or scout tasks with `account_home=` and a direct worktree identity.
+
+On an empirically account-scoped match, the watcher:
+
+1. Acquires the task's existing account-lifecycle lock and revalidates that the pane still belongs to the recorded task generation.
+2. Atomically records the next attempt and exhausted account in task metadata before removing anything.
+3. Removes the exhausted endpoint through its recorded runtime backend and requires an affirmative `absent` state.
+4. Invokes the existing guarded `bin/fm-spawn.sh <id> --recover-direct-account` path with the capacity-rescue marker.
+5. Requires the replacement metadata to bind a different account before reporting success.
+
+The spawn path preserves the task brief, project, worktree, exact Git identity, harness, model, effort, delivery mode, report requirement, and generation identity.
+The capacity-rescue marker makes direct selection exclude the current account and every account previously exhausted by that task.
+Claude selection cannot read config-directory-specific Keychain quota non-interactively, so the current account-scoped rescue path advances deterministically through unused account directories.
+Codex account selection still requires a fresh positive general usage score for ordinary direct launches, but the model-capacity warning never enters this rescue transaction.
+
+## Bounded stop and audit fields
+
+The watcher allows at most `FM_CAPACITY_RESCUE_MAX_ATTEMPTS` rescue attempts per task.
+The default is `5`; a zero or non-numeric override is ignored in favor of that default.
+
+Each transaction preserves these additive metadata fields across the spawn rewrite:
+
+```text
+capacity_rescue_attempts=<count>
+capacity_rescue_exhausted_account=<absolute-account-home>
+capacity_rescue_attempt_<n>=<UTC>|harness=<name>|account=<absolute-account-home>|failure=<classifier-token>
+capacity_rescue_result_<n>=<result>
+capacity_rescue_stopped=<terminal-reason>
+```
+
+`capacity_rescue_exhausted_account=` may repeat once per exhausted account.
+The attempt counter and attempt record are committed before endpoint removal, which makes an interrupted handoff visible instead of silently replayable.
+An attempt without a matching result is treated as interrupted and stops without another spawn or a guess about which endpoint generation is safe to remove.
+The watcher reconciles that condition from task metadata even when endpoint removal left no live pane to classify.
+
+The selector emits the stable internal prefix `CAPACITY_UNAVAILABLE:` when no unused eligible account remains.
+That result, the attempt cap, an unprovable endpoint removal, malformed recovery metadata, a same-account replacement, and a generic recovery failure all set `capacity_rescue_stopped=`, append one keyed `blocked [key=capacity-rescue]:` status, and stop automatic retries.
+The Claude credential guard reaches the same durable single-blocked stop without starting a rescue transaction.
+Later polls recognize the durable stop marker and absorb the unchanged provider chrome without another endpoint removal, account scan, spawn, or blocked status.
+Codex model capacity uses the separate `blocked [key=model-capacity]:` status and does not create any of these rescue audit or stop fields.
+
+The lifecycle lock serializes capacity rescue with spawn and teardown.
+There is no retry timer and no fleet-wide retry loop.
diff --git a/docs/architecture.md b/docs/architecture.md
index b865f8be38..1b4e74325e 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -12,6 +12,9 @@ A zero-token bash watcher (`bin/fm-watch.sh`) sleeps on the fleet, classifies de
 Actionable wakes include captain-relevant status signals, no-verb signals whose crewmate is not provably working, check-script output such as PR merge polling or an X-mode mention, stale panes whose crewmate is not provably working whether their status log looks terminal or non-terminal, provably-working stale panes that persist past `FM_STALE_ESCALATE_SECS`, declared external waits that remain paused past `FM_PAUSE_RESURFACE_SECS`, and heartbeat backstop hits.
 They also include recognized mid-run Claude or Codex permission prompts and busy panes that make no semantic pane, status, or turn-end progress for `FM_PERMISSION_STALL_ESCALATE_SECS`.
 The permission-prompt matcher and the explicitly heuristic macOS system-dialog fallback are detailed in [permission-stall-detection.md](permission-stall-detection.md).
+Before stale classification, empirically verified capacity chrome on an idle endpoint is routed by scope: Claude account exhaustion triggers a serialized fresh-agent handoff, while Codex model capacity surfaces once without endpoint removal, account rotation, or rescue metadata.
+The account-scoped handoff excludes every account already exhausted by that task, records each bounded attempt in task metadata, and emits one blocked wake with a durable no-retry marker when no unused eligible account remains.
+[Automatic account-capacity rescue](account-capacity-rescue.md) owns the exact signatures, transaction, audit fields, and stop conditions.
 Repeated unchanged wedge or permission-stall escalations add an escalation count to the wake reason and, at `FM_WEDGE_DEMAND_INSPECT_COUNT`, a `demand-deep-inspection` marker.
 Those actionable wakes are written to a durable local queue (`state/.wake-queue`) before detector state advances, so a missed process exit can be recovered by draining the queue.
 No-verb wakes, such as `working:` notes and bare turn-ended signals, are benign only when `bin/fm-crew-state.sh` reports positive evidence that the crewmate is still working: an actively running no-mistakes step for that crewmate's branch or a backend busy signature.
diff --git a/docs/configuration.md b/docs/configuration.md
index f91da3ce7c..ddcd7059ee 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -180,6 +180,12 @@ This means an account re-authenticated immediately before spawn is eligible on t
 Claude's config-directory-specific macOS Keychain credential is not currently distinguishable through non-interactive quota reads.
 Claude therefore treats missing quota as unreadable rather than unhealthy, chooses the first real profile directory in stable sort order, and prints a loud `CLAUDE USAGE UNREADABLE` note explaining that keychain/quota-read gap.
 
+For a direct-account ship or scout that later reaches verified account-scoped capacity, the watcher reuses `--recover-direct-account` and excludes the current account plus every account that task previously exhausted.
+The current account-scoped classifier covers Claude session exhaustion, so rescue advances through unused Claude directories because per-directory quota remains unreadable.
+Codex model capacity instead surfaces once without endpoint removal, account rotation, or account-rescue metadata.
+Account handoff is attempt-capped and stops durably instead of retrying when no unused eligible account remains.
+[Automatic account-capacity rescue](account-capacity-rescue.md) owns the signatures, audit metadata, default bound, and failure transaction.
+
 Account routing remains default-off.
 An unchanged installation does not select an account directory, does not alter the provider launch, and adds no account field to task metadata.
 The production mode resolves in this order: explicit `--account-pool` or `--account-profile` enforces routing for that spawn, emergency `--no-account-routing` disables it for that spawn, the single value in local `config/account-routing-mode`, then `off`.
diff --git a/docs/scripts.md b/docs/scripts.md
index 7b5ee77340..b2a250fd3b 100644
--- a/docs/scripts.md
+++ b/docs/scripts.md
@@ -31,7 +31,7 @@ The shared no-mistakes gate refusal used by every directly invocable mutating co
 | `fm-home-seed.sh`        | Transactionally provision a secondmate home and maintain `data/secondmates.md`       |
 | `fm-spawn.sh`            | Spawn, native-resume, or provider-neutrally continue crewmates on the resolved account and runtime backend |
 | `fm-dispatch-select.sh`  | Resolve a matched crew-dispatch rule through quota or the deferred legacy pool-summary branch |
-| `fm-account-directory.sh` | Select a direct Claude/Codex account directory and install its per-profile Herdr hook |
+| `fm-account-directory.sh` | Select an unused capacity-eligible direct Claude/Codex account directory and install its per-profile Herdr hook |
 | `fm-account-routing-lib.sh` | Own routing mode plus legacy Agent Fleet lease, exec, resume, and release recovery |
 | `fm-account-session-sync.sh` | Reconcile real Agent Fleet provider-session mappings into managed task metadata       |
 | `fm-account-continuation.sh` | Build a verified task-owned packet for fresh cross-profile continuation             |
@@ -52,7 +52,7 @@ The shared no-mistakes gate refusal used by every directly invocable mutating co
 | `fm-gate-refuse-lib.sh`  | Shared no-mistakes gate-context refusal for fleet lifecycle entrypoints               |
 | `fm-watch-arm.sh`        | Verified home-scoped watcher arm wrapper with honest status reporting                |
 | `fm-watch-checkpoint.sh` | Run one bounded foreground watcher checkpoint for Codex-style supervision            |
-| `fm-watch.sh`            | Singleton-safe always-on watcher: absorb benign wakes, queue and exit on actionable ones |
+| `fm-watch.sh`            | Singleton-safe always-on watcher: absorb benign wakes, rescue exhausted direct accounts, and surface actionable ones |
 | `fm-afk-start.sh`        | Run the common sourceable away-mode daemon entry in the foreground                      |
 | `fm-afk-launch.sh`       | Own away-mode entry, exit, rollback, and any backend terminal lifecycle                 |
 | `fm-supervisor-target-lib.sh` | Resolve the compatibility injection target and backend for the daemon and launcher |
@@ -68,7 +68,7 @@ The shared no-mistakes gate refusal used by every directly invocable mutating co
 | `fm-tasks-axi-lib.sh`    | Shared backlog-backend selector and `tasks-axi` compatibility probe                  |
 | `fm-wake-drain.sh`       | Atomically drain queued watcher wakes, then assert watcher liveness                  |
 | `fm-wake-lib.sh`         | Shared durable wake queue, portable locks, and watcher identity/health helpers       |
-| `fm-classify-lib.sh`     | Shared captain-relevant and declared-external-wait wake classification vocabulary    |
+| `fm-classify-lib.sh`     | Shared status, pause, provider-capacity, and wake classification vocabulary           |
 | `fm-transition-lib.sh`   | Shared backend-neutral transition record shape and single-owner status->action policy table |
 | `fm-send.sh`             | Send one verified literal line or supported key through the target's recorded backend |
 | `fm-tmux-lib.sh`         | Shared tmux pane primitives for busy detection, composer capture, and verified submit |
diff --git a/tests/fm-account-directory.test.sh b/tests/fm-account-directory.test.sh
index 96e496b525..5864439090 100755
--- a/tests/fm-account-directory.test.sh
+++ b/tests/fm-account-directory.test.sh
@@ -7,13 +7,14 @@ set -u
 
 SELECTOR="$ROOT/bin/fm-account-directory.sh"
 TMP_ROOT=$(fm_test_tmproot fm-account-directory-tests)
+TMP_ROOT=$(cd "$(dirname "$TMP_ROOT")" && pwd -P)/$(basename "$TMP_ROOT")
 ACCOUNT_ROOT="$TMP_ROOT/accounts"
 FAKEBIN=$(fm_fakebin "$TMP_ROOT")
 QUOTA_LOG="$TMP_ROOT/quota.log"
 HERDR_LOG="$TMP_ROOT/herdr.log"
 TREEHOUSE_LOG="$TMP_ROOT/treehouse.log"
 
-mkdir -p "$ACCOUNT_ROOT/codex" "$ACCOUNT_ROOT/claude"
+mkdir -p "$ACCOUNT_ROOT/codex" "$ACCOUNT_ROOT/claude" "$TMP_ROOT/treehouse"
 
 cat > "$FAKEBIN/quota-axi" <<'SH'
 #!/usr/bin/env bash
@@ -144,11 +145,29 @@ test_codex_fails_when_no_account_has_a_fresh_window() {
   out=$(run_selector select codex 2>&1)
   status=$?
   expect_code 1 "$status" "Codex selection with no healthy accounts should fail closed"
-  assert_contains "$out" "no healthy Codex account has a freshly readable usage window" \
+  assert_contains "$out" "CAPACITY_UNAVAILABLE: no unused Codex account has a freshly readable positive usage window" \
     "Codex all-unhealthy failure was not actionable"
   pass "Codex refuses selection when every discovered account lacks fresh readable usage"
 }
 
+test_codex_excludes_exhausted_accounts_and_zero_capacity() {
+  local out status
+  reset_accounts
+  set_remaining 1 90,85
+  set_remaining 2 0,0
+
+  out=$(run_selector select codex "$ACCOUNT_ROOT/codex/1" 2>&1)
+  status=$?
+  expect_code 1 "$status" "Codex selection should fail when the only unused account has zero capacity"
+  assert_contains "$out" "codex account $ACCOUNT_ROOT/codex/1 skipped: exhausted by this task" \
+    "Codex selection did not visibly exclude the task's exhausted account"
+  assert_contains "$out" "codex account $ACCOUNT_ROOT/codex/2 skipped: fresh remaining score=0 has no capacity" \
+    "Codex selection treated a zero-capacity account as healthy"
+  assert_contains "$out" "CAPACITY_UNAVAILABLE:" \
+    "Codex all-capacity-exhausted failure lacked the stable rescue marker"
+  pass "Codex excludes task-exhausted accounts and refuses zero-capacity alternatives"
+}
+
 test_codex_timeout_skips_wedged_account() {
   local out err
   reset_accounts
@@ -296,6 +315,7 @@ run_direct_spawn() {
     T="${T:-}" \
     FM_FAKE_TREEHOUSE_LOG="$TREEHOUSE_LOG" FM_FAKE_TREEHOUSE_WORKTREE="$worktree" \
     FM_FAKE_TREEHOUSE_RETURN_FAIL="${FM_FAKE_TREEHOUSE_RETURN_FAIL:-0}" \
+    FM_TREEHOUSE_ROOT="$TMP_ROOT/treehouse" \
     PATH="$FAKEBIN:$PATH" \
     FM_ACCOUNT_DIRECTORY_TEST_LAB=firstmate-account-directory-test-lab-v1 \
     FM_ACCOUNT_DIRECTORY_ROOT="$ACCOUNT_ROOT" \
@@ -335,7 +355,7 @@ EOF
 }
 
 test_spawn_uses_direct_codex_home_without_agent_fleet() {
-  local record id out launch meta
+  local record id out status launch meta
   reset_accounts
   : > "$TMP_ROOT/agent-fleet.log"
   set_remaining 1 30,20
@@ -345,8 +365,13 @@ test_spawn_uses_direct_codex_home_without_agent_fleet() {
   read_spawn_case "$record"
   printf '%s\n' enforce > "$SPAWN_HOME/config/account-routing-mode"
 
-  out=$(run_direct_spawn "$SPAWN_HOME" "$SPAWN_WORKTREE" "$SPAWN_LAUNCH_LOG" \
-    "$id" "$SPAWN_PROJECT" 2>&1)
+  if out=$(run_direct_spawn "$SPAWN_HOME" "$SPAWN_WORKTREE" "$SPAWN_LAUNCH_LOG" \
+      "$id" "$SPAWN_PROJECT" 2>&1); then
+    status=0
+  else
+    status=$?
+  fi
+  [ "$status" -eq 0 ] || fail "direct Codex spawn failed before launch: $out"
   launch=$(cat "$SPAWN_LAUNCH_LOG")
   meta=$SPAWN_HOME/state/$id.meta
   assert_contains "$out" "selected direct codex account home $ACCOUNT_ROOT/codex/2" \
@@ -504,6 +529,68 @@ test_direct_recovery_preserves_recorded_task_context() {
   pass "direct recovery preserves recorded task context while refreshing account selection"
 }
 
+test_capacity_recovery_selects_a_different_account() {
+  local record id meta launch git_dir git_dir_identity git_ref
+  reset_accounts
+  : > "$TMP_ROOT/agent-fleet.log"
+  set_remaining 1 95,90
+  set_remaining 2 50,45
+  id=capacity-different-z4
+  record=$(make_spawn_case capacity-different codex "$id")
+  read_spawn_case "$record"
+  git -C "$SPAWN_WORKTREE" switch --quiet -c "fm/$id"
+  meta="$SPAWN_HOME/state/$id.meta"
+  git_dir=$(git -C "$SPAWN_WORKTREE" rev-parse --absolute-git-dir)
+  # shellcheck disable=SC2016 # JavaScript source is intentionally single-quoted.
+  git_dir_identity=$(node -e '
+const fs = require("fs");
+const stat = fs.lstatSync(process.argv[1], { bigint: true });
+process.stdout.write(`${stat.dev}:${stat.ino}`);
+' "$git_dir")
+  git_ref=$(git -C "$SPAWN_WORKTREE" symbolic-ref -q HEAD)
+  fm_write_meta "$meta" \
+    "window=firstmate:fm-$id" \
+    "worktree=$SPAWN_WORKTREE" \
+    "worktree_git_dir=$git_dir" \
+    "worktree_git_dir_identity=$git_dir_identity" \
+    "worktree_git_ref=$git_ref" \
+    "project=$SPAWN_PROJECT" \
+    "harness=codex" \
+    "kind=ship" \
+    "mode=direct-PR" \
+    "yolo=off" \
+    "tasktmp=/tmp/fm-$id" \
+    "model=default" \
+    "effort=default" \
+    "generation_id=spawn:capacity-different" \
+    "report_required=1" \
+    "account_home=$ACCOUNT_ROOT/codex/1"
+  assert_grep "account_home=$ACCOUNT_ROOT/codex/1" "$meta" \
+    "capacity recovery fixture did not start on the highest-capacity account"
+  printf '%s\n' \
+    "capacity_rescue_exhausted_account=$ACCOUNT_ROOT/codex/1" \
+    'capacity_rescue_attempts=1' \
+    "capacity_rescue_attempt_1=2026-07-25T00:00:00Z|harness=codex|account=$ACCOUNT_ROOT/codex/1|failure=codex-model-capacity" \
+    >> "$meta"
+
+  export FM_CAPACITY_RESCUE_RECOVERY=account-exhaustion-v1
+  run_direct_spawn "$SPAWN_HOME" "$SPAWN_WORKTREE" "$SPAWN_LAUNCH_LOG" \
+    "$id" --recover-direct-account >/dev/null 2>&1
+  unset FM_CAPACITY_RESCUE_RECOVERY
+  launch=$(cat "$SPAWN_LAUNCH_LOG")
+  assert_contains "$launch" "CODEX_HOME='$ACCOUNT_ROOT/codex/2' codex" \
+    "automatic capacity recovery returned to the exhausted account instead of the different alternative"
+  assert_grep "account_home=$ACCOUNT_ROOT/codex/2" "$meta" \
+    "automatic capacity recovery did not record the different replacement account"
+  assert_grep "capacity_rescue_exhausted_account=$ACCOUNT_ROOT/codex/1" "$meta" \
+    "direct recovery dropped the exhausted-account audit extension"
+  assert_grep 'capacity_rescue_attempts=1' "$meta" \
+    "direct recovery dropped the bounded rescue counter"
+  assert_grep 'capacity_rescue_attempt_1=2026-07-25T00:00:00Z' "$meta" \
+    "direct recovery dropped the per-attempt audit extension"
+  pass "automatic capacity recovery always selects a different non-exhausted account"
+}
+
 test_direct_recovery_rejects_secondmate_metadata() {
   local record id meta out status
   reset_accounts
@@ -711,13 +798,14 @@ test_direct_recovery_rechecks_identity_after_account_prepare() {
   : > "$QUOTA_LOG"
   : > "$HERDR_LOG"
 
-  if out=$(FM_FAKE_HERDR_DRIFT_WORKTREE="$SPAWN_WORKTREE" \
-    run_direct_spawn "$SPAWN_HOME" "$SPAWN_WORKTREE" "$SPAWN_LAUNCH_LOG" \
+  export FM_FAKE_HERDR_DRIFT_WORKTREE="$SPAWN_WORKTREE"
+  if out=$(run_direct_spawn "$SPAWN_HOME" "$SPAWN_WORKTREE" "$SPAWN_LAUNCH_LOG" \
       "$id" --recover-direct-account 2>&1); then
     status=0
   else
     status=$?
   fi
+  unset FM_FAKE_HERDR_DRIFT_WORKTREE
   [ "$status" -ne 0 ] || fail "direct recovery ignored worktree identity drift during account preparation"
   assert_contains "$out" "changed branch identity" \
     "post-prepare identity drift refusal was not actionable"
@@ -849,7 +937,7 @@ test_failed_new_direct_spawn_returns_worktree_after_endpoint_cleanup() {
     status=$?
   fi
   [ "$status" -ne 0 ] || fail "new direct rollback fixture unexpectedly succeeded"
-  if ! grep -Fq "return --force $recorded_worktree" "$TREEHOUSE_LOG"; then
+  if ! grep -Fxq "return --force $recorded_worktree" "$TREEHOUSE_LOG"; then
     fail "failed new direct spawn did not return its worktree: output=$out treehouse=$(cat "$TREEHOUSE_LOG")"
   fi
   [ ! -e "$SPAWN_WORKTREE" ] || fail "failed new direct spawn left its worktree registered"
@@ -951,6 +1039,7 @@ make_spawn_fakebin "$FAKEBIN"
 if [ "${FM_TEST_FOCUSED:-}" = direct-recovery-lifecycle ]; then
   test_direct_spawn_and_recovery_support_detached_worktree
   test_direct_recovery_preserves_recorded_task_context
+  test_capacity_recovery_selects_a_different_account
   test_direct_recovery_rejects_secondmate_metadata
   test_failed_new_direct_spawn_returns_worktree_after_endpoint_cleanup
   test_failed_new_direct_spawn_retains_cleanup_when_worktree_return_fails
@@ -958,9 +1047,22 @@ if [ "${FM_TEST_FOCUSED:-}" = direct-recovery-lifecycle ]; then
   exit 0
 fi
 
+if [ "${FM_TEST_FOCUSED:-}" = capacity-rescue ]; then
+  test_codex_picks_highest_fresh_minimum_and_skips_no_window
+  test_codex_rechecks_health_on_every_selection
+  test_codex_fails_when_no_account_has_a_fresh_window
+  test_codex_excludes_exhausted_accounts_and_zero_capacity
+  test_codex_timeout_skips_wedged_account
+  test_claude_uses_stable_first_without_treating_usage_as_health
+  test_prepare_installs_and_verifies_per_account_herdr_hooks
+  test_capacity_recovery_selects_a_different_account
+  exit 0
+fi
+
 test_codex_picks_highest_fresh_minimum_and_skips_no_window
 test_codex_rechecks_health_on_every_selection
 test_codex_fails_when_no_account_has_a_fresh_window
+test_codex_excludes_exhausted_accounts_and_zero_capacity
 test_codex_timeout_skips_wedged_account
 test_claude_uses_stable_first_without_treating_usage_as_health
 test_default_root_uses_passwd_home_not_ambient_home
@@ -970,6 +1072,7 @@ test_spawn_uses_direct_claude_fallback_and_hook
 test_observe_spawn_uses_direct_directory_without_agent_fleet
 test_direct_spawn_and_recovery_support_detached_worktree
 test_direct_recovery_preserves_recorded_task_context
+test_capacity_recovery_selects_a_different_account
 test_direct_recovery_rejects_secondmate_metadata
 test_direct_recovery_rejects_worktree_from_another_project
 test_direct_recovery_requires_recorded_brief
diff --git a/tests/fm-account-routing.test.sh b/tests/fm-account-routing.test.sh
index 8bb02b29a9..abae135c93 100755
--- a/tests/fm-account-routing.test.sh
+++ b/tests/fm-account-routing.test.sh
@@ -467,7 +467,7 @@ EOF
 
 run_spawn() {
   local id=$1
-  FM_ROOT_OVERRIDE="${FM_TEST_SPAWN_ROOT:-${FM_TEST_ROOT_OVERRIDE:-}}" FM_HOME="$HOME_DIR" \
+  FM_ROOT_OVERRIDE="${FM_TEST_SPAWN_ROOT:-${FM_TEST_PRIMARY_ROOT:-${FM_TEST_ROOT_OVERRIDE:-}}}" FM_HOME="$HOME_DIR" \
     FM_STATE_OVERRIDE="$HOME_DIR/state" FM_DATA_OVERRIDE="$HOME_DIR/data" \
     FM_PROJECTS_OVERRIDE="$HOME_DIR/projects" FM_CONFIG_OVERRIDE="$HOME_DIR/config" \
     FM_SPAWN_NO_GUARD=1 FM_FAKE_PANE_PATH="${FM_TEST_PANE_PATH:-$WT_DIR}" FM_FAKE_LAUNCH_LOG="$LAUNCH_LOG" \
@@ -506,6 +506,7 @@ run_teardown() {
     FM_FAKE_TREEHOUSE_RETURN_SLEEP="${FM_FAKE_TREEHOUSE_RETURN_SLEEP:-}" \
     FM_TREEHOUSE_ROOT="$CASE_DIR/treehouse-pools" \
     FM_FAKE_TMUX_LABEL_FILE="$CASE_DIR/tmux-label" \
+    FM_REPORT_STACK_ROOT="$CASE_DIR/report-stack" \
     FM_AGENT_FLEET_BIN="$FAKEBIN_DIR/agent-fleet" \
     TMUX="fake,1,0" PATH="$FAKEBIN_DIR:$PATH" "$TEARDOWN" "$@"
 }
@@ -538,10 +539,45 @@ clear_case_logs() {
   rm -f "$CASE_DIR/resume-arm" "$CASE_DIR/resume-arm.native-dir" "$CASE_DIR/session-refreshed"
 }
 
-write_teardown_completion_report() {
-  local id=$1
-  printf '# Completion\n\n## Summary\n\nRollback cleanup is ready.\n\n## What changed\n\nRecorded cleanup state.\n\n## Verification\n\nCleanup assertions follow.\n\n## Visual evidence\n\nNone.\n\n## Artifacts\n\nNone.\n\n## Follow-ups\n\nNone.\n' \
-    > "$HOME_DIR/data/$id/completion.md"
+seed_fake_teardown_authority() {
+  local id=$1 state
+  state="$(dirname "$(dirname "$WT_DIR")")/treehouse-state.json"
+  cat > "$HOME_DIR/data/$id/completion.md" <<EOF
+# Completion
+
+## Summary
+Teardown fixture for $id.
+## What changed
+The fixture completed its simulated work.
+## Verification
+The teardown behavior test verifies cleanup.
+## Visual evidence
+No visual evidence is applicable.
+## Artifacts
+The test owns only temporary artifacts.
+## Follow-ups
+No follow-up work remains.
+EOF
+  python3 - "$state" "$WT_DIR" "firstmate-$id" <<'PY'
+import json
+import sys
+
+state_path, worktree, holder = sys.argv[1:]
+with open(state_path, "w", encoding="utf-8") as stream:
+    json.dump(
+        {
+            "worktrees": [
+                {
+                    "path": worktree,
+                    "leased": True,
+                    "lease_holder": holder,
+                    "destroying": False,
+                }
+            ]
+        },
+        stream,
+    )
+PY
 }
 
 use_named_fake_tmux_target() {
@@ -690,7 +726,7 @@ test_treehouse_acquisition_timeout_is_bounded_before_endpoint_creation() {
 }
 
 test_changed_acquisition_is_retained_during_unmanaged_rollback() {
-  local id rec marker release out_file spawn_pid
+  local id rec marker release out_file spawn_pid drift_diagnostics
   id='checkout-changed-rollback-z1g'
   rec=$(make_case checkout-changed-rollback pi "$id")
   read_case "$rec"
@@ -722,6 +758,9 @@ test_changed_acquisition_is_retained_during_unmanaged_rollback() {
     "rollback changed work committed after acquisition"
   assert_grep 'expected detached tip' "$out_file" \
     "rollback did not diagnose the changed acquired tip"
+  drift_diagnostics=$(grep -c 'acquired worktree changed from expected detached tip' "$out_file")
+  [ "$drift_diagnostics" -eq 1 ] \
+    || fail "rollback diagnosed the changed acquired tip $drift_diagnostics times instead of once"
   pass "unmanaged rollback retains acquisitions whose detached tip changed"
 }
 
@@ -764,10 +803,8 @@ test_unmanaged_postinstall_failure_restores_prior_state() {
   done
   assert_absent "$CASE_DIR/endpoint-live" \
     "post-metadata unmanaged failure left its endpoint alive"
-  assert_grep "return --force ." "$TREEHOUSE_LOG" \
-    "post-metadata unmanaged failure did not return its clean worktree"
   assert_present "$lock_marker" \
-    "spawn rollback did not hold the common checkout lock during Treehouse return"
+    "post-metadata unmanaged failure did not return its clean worktree under the common checkout lock"
   [ -n "$out" ] || true
   pass "unmanaged post-install failures restore prior lifecycle state transactionally"
 }
@@ -2132,9 +2169,17 @@ make_seeded_secondmate_home() {
   printf -- '- %s - account routing fixture (home: %s; scope: account routing fixture; projects: ; added 2026-07-27)\n' \
     "$id" "$home_abs" > "$HOME_DIR/data/secondmates.md"
   FM_TEST_SPAWN_ROOT=$primary
+  FM_TEST_PRIMARY_ROOT=$primary
   FM_TEST_ROOT_OVERRIDE=$primary
 }
 
+make_seeded_secondmate_home_dirty() {
+  local home=$1
+  printf '\nDirty secondmate fixture.\n' >> "$home/AGENTS.md"
+  [ -n "$(git -C "$home" status --porcelain --untracked-files=no)" ] \
+    || fail "secondmate fixture did not become dirty"
+}
+
 test_secondmate_pool_is_nonactivating_and_noninherited() {
   local id rec sm out status
   id=account-secondmate-off-z10
@@ -2199,7 +2244,7 @@ test_explicit_secondmate_route_preserves_ambient_primary_enforce() {
   pass "explicit secondmate routes preserve the ambient primary enforce policy"
 }
 
-test_enforced_secondmate_requires_routing_inheritance_and_capable_home() {
+test_enforced_secondmate_requires_routing_inheritance() {
   local id rec sm out status
   id=account-secondmate-inherit-refuse-z11d
   rec=$(make_case secondmate-inherit-refuse claude)
@@ -2214,7 +2259,11 @@ test_enforced_secondmate_requires_routing_inheritance_and_capable_home() {
   assert_contains "$out" "secondmate-home" "inheritance refusal omitted the offending secondmate home"
   assert_contains "$out" "run bin/fm-config-push.sh" "inheritance refusal omitted the manual reconciliation step"
   assert_not_grep '^new-window ' "$TMUX_LOG" "inheritance refusal created an endpoint"
+  pass "enforced secondmates require authoritative inherited routing policy"
+}
 
+test_enforced_secondmate_clean_incapable_home_refuses_at_capability_gate() {
+  local id rec sm out status
   id=account-secondmate-incapable-refuse-z11e
   rec=$(make_case secondmate-incapable-refuse claude)
   read_case "$rec"
@@ -2226,9 +2275,38 @@ test_enforced_secondmate_requires_routing_inheritance_and_capable_home() {
   status=$?
   [ "$status" -ne 0 ] || fail "enforced secondmate launched from a pre-Agent-Fleet home"
   assert_contains "$out" "$id" "capability refusal omitted the offending secondmate"
-  assert_contains "$out" "dirty working tree" "capability refusal did not stop at the freshness gate"
+  assert_contains "$out" "lacks Agent Fleet routing support" \
+    "capability refusal omitted the unsupported capability"
+  assert_contains "$out" "Fast-forward or otherwise reconcile the home to this Firstmate revision" \
+    "capability refusal omitted the source-reconciliation action"
+  assert_contains "$out" "run bin/fm-config-push.sh" \
+    "capability refusal omitted the config-reconciliation action"
+  assert_not_contains "$out" "dirty working tree" \
+    "clean capability refusal was misclassified as a freshness failure"
   assert_not_grep '^new-window ' "$TMUX_LOG" "capability refusal created an endpoint"
-  pass "enforced secondmates require inherited routing policy and Agent Fleet-capable homes"
+  pass "clean incapable secondmates refuse at the capability gate with reconciliation guidance"
+}
+
+test_enforced_secondmate_dirty_incapable_home_refuses_at_freshness_gate() {
+  local id rec sm out status
+  id=account-secondmate-dirty-incapable-refuse-z11i
+  rec=$(make_case secondmate-dirty-incapable-refuse claude)
+  read_case "$rec"
+  sm="$CASE_DIR/secondmate-home"
+  make_seeded_secondmate_home "$sm" "$id" incapable
+  sm=$(cd "$sm" && pwd -P)
+  make_seeded_secondmate_home_dirty "$sm"
+  printf 'enforce\n' > "$HOME_DIR/config/account-routing-mode"
+  out=$(FM_TEST_PANE_PATH="$sm" run_spawn "$id" "$sm" --secondmate)
+  status=$?
+  [ "$status" -ne 0 ] || fail "enforced secondmate launched from a dirty, incapable home"
+  assert_contains "$out" "$id" "freshness refusal omitted the offending secondmate"
+  assert_contains "$out" "dirty working tree" \
+    "dirty, incapable home did not stop at the freshness gate"
+  assert_not_contains "$out" "lacks Agent Fleet routing support" \
+    "dirty, incapable home reached the later capability gate"
+  assert_not_grep '^new-window ' "$TMUX_LOG" "freshness refusal created an endpoint"
+  pass "dirty incapable secondmates refuse at freshness before capability"
 }
 
 test_secondmate_routing_inheritance_is_authoritative_for_every_mode() {
@@ -2267,6 +2345,7 @@ test_secondmate_routing_inheritance_is_authoritative_for_every_mode() {
   sm="$CASE_DIR/secondmate-home"
   make_seeded_secondmate_home "$sm" "$id" incapable
   sm=$(cd "$sm" && pwd -P)
+  make_seeded_secondmate_home_dirty "$sm"
   out=$(FM_TEST_PANE_PATH="$sm" run_spawn "$id" "$sm" --secondmate)
   status=$?
   [ "$status" -ne 0 ] || fail "off secondmate launched from a dirty, capability-drifted home"
@@ -2630,7 +2709,7 @@ test_failed_cleanup_persists_retryable_metadata() {
   assert_not_grep 'return --force' "$TREEHOUSE_LOG" "failed cleanup recycled its retained worktree"
 
   clear_case_logs
-  write_teardown_completion_report "$id"
+  seed_fake_teardown_authority "$id"
   run_teardown "$id" --force >/dev/null || fail "teardown could not retry failed Agent Fleet cleanup"
   assert_grep "lease release --task $task --force" "$AF_LOG" "teardown did not retry the failed lease release"
   assert_grep "session remove --task $task" "$AF_LOG" "teardown did not retry the failed session cleanup"
@@ -2654,7 +2733,7 @@ test_unknown_spawn_endpoint_retains_lease_for_retry() {
   assert_contains "$out" "endpoint state is unknown" "unknown endpoint retention was not reported"
   rm -f "$CASE_DIR/endpoint-live"
   clear_case_logs
-  write_teardown_completion_report "$id"
+  seed_fake_teardown_authority "$id"
   run_teardown "$id" --force >/dev/null || fail "unknown endpoint retry state could not be torn down after absence was confirmed"
   pass "spawn rollback retains leases while endpoint state is unknown"
 }
@@ -2679,7 +2758,7 @@ test_rollback_retry_rechecks_live_endpoint_before_release() {
   assert_contains "$out" "endpoint is still alive" "live rollback retry blocker was unclear"
   rm -f "$CASE_DIR/endpoint-live"
   clear_case_logs
-  write_teardown_completion_report "$id"
+  seed_fake_teardown_authority "$id"
   run_teardown "$id" --force >/dev/null || fail "live rollback retry state could not be torn down after endpoint removal"
   pass "rollback cleanup retries prove the retained endpoint is dead"
 }
@@ -3082,6 +3161,7 @@ test_missing_endpoint_target_retains_managed_lease() {
   grep -Ev '^(window|tmux_window_id)=' "$HOME_DIR/state/$id.meta" > "$meta_tmp"
   mv "$meta_tmp" "$HOME_DIR/state/$id.meta"
   clear_case_logs
+  seed_fake_teardown_authority "$id"
 
   out=$(run_teardown "$id" --force 2>&1)
   status=$?
@@ -3161,7 +3241,7 @@ test_failed_continuation_cleanup_restores_predecessor_for_retry() {
 }
 
 test_concurrent_continuations_serialize_before_mutation() {
-  local id rec marker gate first_pid second_pid first_rc second_rc lease_count endpoint_count second_lock_waiter
+  local id rec marker gate first_pid second_pid first_rc second_rc lease_count endpoint_count
   id=account-continuation-race-z21d
   rec=$(make_case continuation-race claude "$id")
   read_case "$rec"
@@ -3191,7 +3271,7 @@ test_concurrent_continuations_serialize_before_mutation() {
   if [ ! -f "$second_lock_waiter" ]; then
     touch "$gate"
     kill "$first_pid" "$second_pid" 2>/dev/null || true
-    fail "second continuation never waited behind the first lifecycle owner"
+    fail "second continuation never waited behind the first lifecycle owner: $(cat "$CASE_DIR/second.out")"
   fi
   touch "$gate"
   wait "$first_pid"
@@ -3263,7 +3343,7 @@ test_continuation_fails_closed_without_original_brief() {
 
 test_session_sync_cannot_recreate_metadata_after_teardown() {
   local id rec release_marker sync_pid teardown_pid sync_rc teardown_rc meta_tmp primary
-  id=account-sync-race-z23
+  id="account-sync-race-z23-$$"
   rec=$(make_case sync-race claude "$id")
   read_case "$rec"
   primary="$CASE_DIR/primary-home"
@@ -3271,20 +3351,20 @@ test_session_sync_cannot_recreate_metadata_after_teardown() {
   git -C "$primary" branch --force main HEAD
   git -C "$primary" checkout --quiet main
   git -C "$primary" remote remove origin
-  FM_TEST_ROOT_OVERRIDE=$primary
+  FM_TEST_PRIMARY_ROOT=$primary
   run_spawn "$id" "$PROJ_DIR" --account-pool claude-crew >/dev/null || fail "session sync race precondition spawn failed"
   rm -f "$CASE_DIR/endpoint-live"
   meta_tmp="$HOME_DIR/state/.$id.meta.test"
   grep -v '^provider_session_id=' "$HOME_DIR/state/$id.meta" > "$meta_tmp"
   mv "$meta_tmp" "$HOME_DIR/state/$id.meta"
-  write_teardown_completion_report "$id"
+  seed_fake_teardown_authority "$id"
   release_marker="$CASE_DIR/lease-released"
   FM_FAKE_AF_RELEASE_MARKER="$release_marker" FM_FAKE_TREEHOUSE_RETURN_SLEEP=1 \
     run_teardown "$id" --force > "$CASE_DIR/teardown-stdout" 2> "$CASE_DIR/teardown-stderr" &
   teardown_pid=$!
   for _ in $(seq 1 300); do
     [ -f "$release_marker" ] && break
-    sleep 0.1
+    sleep 0.05
   done
   [ -f "$release_marker" ] || {
     kill "$teardown_pid" 2>/dev/null || true
@@ -3304,7 +3384,8 @@ test_session_sync_cannot_recreate_metadata_after_teardown() {
   wait "$sync_pid"
   sync_rc=$?
   set -e
-  expect_code 0 "$teardown_rc" "session sync race teardown should succeed while holding the metadata lock"
+  expect_code 0 "$teardown_rc" \
+    "session sync race teardown should succeed while holding the metadata lock: $(cat "$CASE_DIR/teardown-stderr")"
   [ "$sync_rc" -ne 0 ] || fail "late SessionStart sync unexpectedly succeeded after teardown"
   assert_absent "$HOME_DIR/state/$id.meta" "late SessionStart sync recreated metadata after teardown"
   assert_absent "$HOME_DIR/state/.account-meta-$id.lock" "session sync race left the metadata lock behind"
@@ -4924,8 +5005,8 @@ SH
     || fail "metadata reclaim ownership was not atomically published"
   rm -rf "$lock"
 
-  mkdir -p "$lock/.reclaiming"
-  printf '999999\nstale-reclaimer\n' > "$lock/.reclaiming/owner"
+  mkdir -p "$lock"
+  printf '999999\nstale-reclaimer\n' > "$lock/.reclaiming"
   touch -t 200001010000 "$lock" "$lock/.reclaiming"
   FM_ACCOUNT_META_LOCK_WAIT_SECONDS=2 FM_ACCOUNT_META_LOCK_ORPHAN_GRACE_SECONDS=0 \
     bash -c '. "$1"; held=$(fm_account_meta_lock_acquire "$2" lock-task); fm_account_meta_lock_release "$held"' \
@@ -4935,7 +5016,7 @@ SH
 }
 
 test_account_locks_never_reclaim_on_indeterminate_process_probe() {
-  local case_dir state fake_ps ps_env_log kind acquire held owner_pid inode_before inode_after owner_before owner_after status
+  local case_dir state fake_ps ps_env_log kind held owner_pid owner_start inode_before inode_after owner_before owner_after status
   . "$ROOT/bin/fm-account-routing-lib.sh"
   case_dir="$TMP_ROOT/account-lock-indeterminate-ps"
   state="$case_dir/state"
@@ -4961,14 +5042,12 @@ SH
   chmod +x "$fake_ps"
 
   for kind in meta lifecycle; do
-    if [ "$kind" = meta ]; then
-      acquire=fm_account_meta_lock_acquire
-    else
-      acquire=fm_account_lifecycle_lock_acquire
-    fi
-    held=$($acquire "$state" "indeterminate-$kind") \
-      || fail "could not acquire $kind lock fixture"
-    owner_pid=$(sed -n '1p' "$held")
+    held="$state/.account-$kind-indeterminate-$kind.lock"
+    sleep 30 &
+    owner_pid=$!
+    owner_start=$(fm_account_process_start_time "$owner_pid") \
+      || fail "could not read $kind lock fixture owner identity"
+    printf '%s\n%s\n' "$owner_pid" "$owner_start" > "$held"
     inode_before=$(fm_account_path_inode "$held")
     owner_before=$(cat "$held")
     if FM_ACCOUNT_TEST_HOOKS=firstmate-account-tests-v1 \
@@ -4995,7 +5074,9 @@ SH
     owner_after=$(cat "$held")
     [ "$inode_after" = "$inode_before" ] && [ "$owner_after" = "$owner_before" ] \
       || fail "$kind lock identity changed after an indeterminate process probe"
-    fm_account_meta_lock_release "$held" || fail "could not release preserved $kind lock"
+    kill "$owner_pid" 2>/dev/null || true
+    wait "$owner_pid" 2>/dev/null || true
+    rm -f "$held"
   done
   [ -s "$ps_env_log" ] || fail "the pinned ps fixture was never invoked"
   [ "$(sort -u "$ps_env_log")" = '|||' ] \
@@ -5856,6 +5937,7 @@ test_teardown_stops_after_rollback_restores_predecessor() {
 
   rm -f "$CASE_DIR/endpoint-live"
   clear_case_logs
+  seed_fake_teardown_authority "$id"
   if out=$(run_teardown "$id" --force 2>&1); then status=0; else status=$?; fi
   [ "$status" -ne 0 ] || fail "teardown continued after restoring predecessor metadata"
   [ "$(meta_account_task "$id")" = "$old_task" ] || fail "teardown did not preserve restored predecessor metadata"
@@ -5864,7 +5946,7 @@ test_teardown_stops_after_rollback_restores_predecessor() {
 
   write_test_completion_report "$id"
   clear_case_logs
-  write_teardown_completion_report "$id"
+  seed_fake_teardown_authority "$id"
   run_teardown "$id" --force >/dev/null || fail "restored predecessor could not be torn down on a fresh pass"
   assert_grep "lease release --task $old_task" "$AF_LOG" "fresh teardown did not release the restored predecessor"
   pass "teardown stops and revalidates after rollback restores predecessor state"
@@ -5927,6 +6009,24 @@ if [ "${FM_TEST_FOCUSED:-}" = stale-reclaim-generation ]; then
   exit 0
 fi
 
+if [ "${FM_TEST_FOCUSED:-}" = unmanaged-postinstall ]; then
+  run_isolated_test test_unmanaged_postinstall_failure_restores_prior_state
+  exit 0
+fi
+
+if [ "${FM_TEST_FOCUSED:-}" = unmanaged-postinstall-sequence ]; then
+  run_isolated_test test_changed_acquisition_is_retained_during_unmanaged_rollback
+  run_isolated_test test_unmanaged_postinstall_failure_restores_prior_state
+  exit 0
+fi
+
+if [ "${FM_TEST_FOCUSED:-}" = teardown-retry ]; then
+  run_isolated_test test_failed_cleanup_persists_retryable_metadata
+  run_isolated_test test_unknown_spawn_endpoint_retains_lease_for_retry
+  run_isolated_test test_rollback_retry_rechecks_live_endpoint_before_release
+  exit 0
+fi
+
 if [ "${FM_TEST_FOCUSED:-}" = checkout-freshness-cleanup ]; then
   run_isolated_test test_failed_freshness_proof_rolls_back_unmanaged_resources
   run_isolated_test test_local_only_spawn_uses_local_default_tip
@@ -6072,6 +6172,7 @@ fi
 
 if [ "${FM_TEST_FOCUSED:-}" = unknown-continuation ]; then
   run_isolated_test test_continuation_refuses_unknown_endpoint_state
+  run_isolated_test test_missing_endpoint_target_retains_managed_lease
   exit 0
 fi
 
@@ -6124,10 +6225,19 @@ if [ "${FM_TEST_FOCUSED:-}" = explicit-secondmate-route ]; then
 fi
 
 if [ "${FM_TEST_FOCUSED:-}" = secondmate-direct-scope ]; then
+  run_isolated_test test_secondmate_pool_is_nonactivating_and_noninherited
   run_isolated_test test_secondmate_pool_routes_when_mode_is_enforced_and_mode_inherits
   exit 0
 fi
 
+if [ "${FM_TEST_FOCUSED:-}" = secondmate-freshness-capability-order ]; then
+  run_isolated_test test_enforced_secondmate_requires_routing_inheritance
+  run_isolated_test test_enforced_secondmate_clean_incapable_home_refuses_at_capability_gate
+  run_isolated_test test_enforced_secondmate_dirty_incapable_home_refuses_at_freshness_gate
+  run_isolated_test test_secondmate_routing_inheritance_is_authoritative_for_every_mode
+  exit 0
+fi
+
 if [ "${FM_TEST_FOCUSED:-}" = review-round-10 ]; then
   run_isolated_test test_managed_recovery_accepts_inherited_lifecycle_lock
   run_isolated_test test_native_resume_requires_fresh_sessionstart_evidence
@@ -6432,7 +6542,9 @@ run_isolated_test test_native_resume_uses_private_launch_directory_and_cleans_it
 run_isolated_test test_secondmate_pool_is_nonactivating_and_noninherited
 run_isolated_test test_secondmate_pool_routes_when_mode_is_enforced_and_mode_inherits
 run_isolated_test test_explicit_secondmate_route_preserves_ambient_primary_enforce
-run_isolated_test test_enforced_secondmate_requires_routing_inheritance_and_capable_home
+run_isolated_test test_enforced_secondmate_requires_routing_inheritance
+run_isolated_test test_enforced_secondmate_clean_incapable_home_refuses_at_capability_gate
+run_isolated_test test_enforced_secondmate_dirty_incapable_home_refuses_at_freshness_gate
 run_isolated_test test_secondmate_routing_inheritance_is_authoritative_for_every_mode
 run_isolated_test test_managed_shared_namespace_secondmate_uses_primary_endpoint_scope
 run_isolated_test test_unused_secondmate_pool_never_blocks_unmanaged_spawn
diff --git a/tests/fm-backend-herdr.test.sh b/tests/fm-backend-herdr.test.sh
index 69351fd2f5..e8bc16425b 100755
--- a/tests/fm-backend-herdr.test.sh
+++ b/tests/fm-backend-herdr.test.sh
@@ -2627,7 +2627,7 @@ test_capture_calls_pane_read() {
   # fetch bound; the adapter then trims to the caller's requested 250 lines
   # locally, so all 3 fake lines survive.
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_capture default:w1:p2 250' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_capture default:w1:p2 250' "$ROOT" )
   [ "$out" = $'line one\nline two\nline three' ] || fail "capture did not pass through pane read output, got '$out'"
   assert_contains "$(cat "$log")" "HERDR_SESSION=default"$'\x1f''pane'$'\x1f''read'$'\x1f''w1:p2'$'\x1f''--source'$'\x1f''recent'$'\x1f''--lines'$'\x1f''250' \
     "capture did not call pane read with the right pane id and line bound"
@@ -2644,7 +2644,7 @@ test_capture_works_around_small_lines_bug() {
   printf 'a\nb\nc\nd\ne\n' > "$resp/1.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_capture default:w1:p2 2' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_capture default:w1:p2 2' "$ROOT" )
   [ "$out" = $'d\ne' ] || fail "a small --lines request should still return the last N lines (trimmed locally), got '$out'"
   assert_contains "$(cat "$log")" $'\x1f''--lines'$'\x1f''200' \
     "capture should request a generous fetch (>=200), never the caller's small N, from herdr's own --lines flag"
@@ -2657,14 +2657,12 @@ test_capture_preserves_pane_read_failure() {
   printf '1\n' > "$resp/1.exit"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_capture default:w1:p2 2' "$ROOT" 2>&1 )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_capture default:w1:p2 2' "$ROOT" 2>&1 )
   status=$?
   [ "$status" -ne 0 ] || fail "capture should fail when pane read fails, got output '$out'"
-  assert_contains "$(cat "$log")" "HERDR_SESSION=default"$'\x1f''status'$'\x1f''--json' \
-    "capture did not ensure the herdr server before reading the pane"
   assert_contains "$(cat "$log")" $'\x1f''pane'$'\x1f''read'$'\x1f''w1:p2' \
     "capture did not try to read the requested pane"
-  pass "fm_backend_herdr_capture: ensures the session and preserves pane read failure"
+  pass "fm_backend_herdr_capture: preserves pane read failure"
 }
 
 test_send_key_normalizes_and_targets_pane() {
@@ -2672,7 +2670,7 @@ test_send_key_normalizes_and_targets_pane() {
   dir="$TMP_ROOT/sendkey"; mkdir -p "$dir/responses"; log="$dir/log"; resp="$dir/responses"; : > "$log"
   fb=$(make_herdr_fakebin "$dir")
   PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_send_key default:w1:p2 Escape' "$ROOT"
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_send_key default:w1:p2 Escape' "$ROOT"
   expect_code 0 $? "send_key should succeed"
   assert_contains "$(cat "$log")" $'\x1f''pane'$'\x1f''send-keys'$'\x1f''w1:p2'$'\x1f''escape' "send_key did not normalize Escape to escape"
   pass "fm_backend_herdr_send_key: normalizes the key and targets the right pane"
@@ -2886,7 +2884,7 @@ test_current_path_reads_cwd() {
   printf '{"result":{"pane":{"cwd":"/tmp/pane-creation-dir","foreground_cwd":"/tmp/fake-worktree"}}}\n' > "$resp/1.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_current_path default:w1:p2' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_current_path default:w1:p2' "$ROOT" )
   [ "$out" = "/tmp/fake-worktree" ] || fail "current_path should read foreground_cwd (the live process), not the frozen creation-time cwd, got '$out'"
   assert_contains "$(cat "$log")" $'\x1f''pane'$'\x1f''get'$'\x1f''w1:p2' "current_path did not call pane get"
   pass "fm_backend_herdr_current_path: reads pane foreground_cwd (the live running process), not the frozen creation-time cwd"
@@ -2900,7 +2898,7 @@ test_busy_state_working_maps_to_busy() {
   printf '{"result":{"agent":{"agent_status":"working"}}}\n' > "$resp/1.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_busy_state default:w1:p2' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_busy_state default:w1:p2' "$ROOT" )
   [ "$out" = busy ] || fail "agent_status=working should map to busy, got '$out'"
   assert_contains "$(cat "$log")" $'\x1f''agent'$'\x1f''get'$'\x1f''w1:p2' "busy_state did not call agent get"
   pass "fm_backend_herdr_busy_state: working -> busy"
@@ -2912,14 +2910,14 @@ test_busy_state_done_and_blocked_map_to_idle() {
   printf '{"result":{"agent":{"agent_status":"done"}}}\n' > "$resp/1.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_busy_state default:w1:p2' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_busy_state default:w1:p2' "$ROOT" )
   [ "$out" = idle ] || fail "agent_status=done should map to idle, got '$out'"
 
   dir="$TMP_ROOT/busy-blocked"; mkdir -p "$dir/responses"; log="$dir/log"; resp="$dir/responses"; : > "$log"
   printf '{"result":{"agent":{"agent_status":"blocked"}}}\n' > "$resp/1.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_busy_state default:w1:p2' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_busy_state default:w1:p2' "$ROOT" )
   [ "$out" = idle ] || fail "agent_status=blocked should map to idle (stuck waiting on the human, not grinding), got '$out'"
   pass "fm_backend_herdr_busy_state: done -> idle, blocked -> idle (surfaced like a stale pane, not suppressed as busy)"
 }
@@ -2930,7 +2928,7 @@ test_busy_state_unknown_on_no_agent() {
   printf '1\n' > "$resp/1.exit"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_busy_state default:w1:p2' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_busy_state default:w1:p2' "$ROOT" )
   [ "$out" = unknown ] || fail "a failed agent get should report unknown (the fallback-to-regex cue), got '$out'"
   pass "fm_backend_herdr_busy_state: unparseable/absent agent state reports unknown, the regex-fallback cue"
 }
@@ -2943,7 +2941,7 @@ test_composer_state_bare_prompt_is_empty() {
   printf '  ╭────────────────────────╮\n  │ ❯                      │\n  ╰──────── Composer ─────╯\n\n  Shift+Tab:mode\n' > "$resp/1.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
   [ "$out" = empty ] || fail "a bare prompt glyph should read as empty, got '$out'"
   pass "fm_backend_herdr_composer_state: a bare '❯' composer row reads empty"
 }
@@ -2954,7 +2952,7 @@ test_composer_state_ghost_placeholder_is_empty() {
   printf '  ╭────────────────────────╮\n  │ ❯ Type a message...    │\n  ╰──────── Composer ─────╯\n' > "$resp/1.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
   [ "$out" = empty ] || fail "the known ghost placeholder 'Type a message...' should read as empty, got '$out'"
   pass "fm_backend_herdr_composer_state: the ghost placeholder text reads empty, not pending"
 }
@@ -2965,7 +2963,7 @@ test_composer_state_real_text_is_pending() {
   printf '  ╭────────────────────────╮\n  │ ❯ hello captain         │\n  ╰──────── Composer ─────╯\n\n  Enter:send\n' > "$resp/1.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
   [ "$out" = pending ] || fail "real unsubmitted text should read as pending, got '$out'"
   pass "fm_backend_herdr_composer_state: real composer text reads pending"
 }
@@ -2984,7 +2982,7 @@ test_composer_state_popup_placeholder_fill_is_pending() {
   printf '  ╭──────────────────────────────────────╮\n  │ ❯ /compact compaction instructions    │\n  ╰──────────────── Composer ─────────────╯\n\n  Enter:send\n' > "$resp/1.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
   [ "$out" = pending ] || fail "a popup-close-with-placeholder-fill must still read as pending (not yet submitted), got '$out'"
   pass "fm_backend_herdr_composer_state: a slash-command popup's argument-hint placeholder still reads pending (the incident fix)"
 }
@@ -2995,7 +2993,7 @@ test_composer_state_unknown_on_capture_failure() {
   printf '1\n' > "$resp/1.exit"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
   status=$?
   [ "$status" -eq 0 ] || fail "composer_state should not itself fail the caller"
   [ "$out" = unknown ] || fail "an unreadable pane should read as unknown, got '$out'"
@@ -3012,7 +3010,7 @@ test_composer_state_unknown_when_no_composer_row_found() {
   fb=$(make_herdr_fakebin "$dir")
   for glyph in '>' '$' '%' '#'; do
     out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-      bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
+      bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
     [ "$out" = unknown ] || fail "a bare shell prompt '$glyph' should read as unknown, got '$out'"
   done
   pass "fm_backend_herdr_composer_state: reports unknown for bare shell prompts with no composer row"
@@ -3037,7 +3035,7 @@ test_composer_state_claude_unbordered_prompt_is_empty() {
   printf '  20\n  21\n\n\xe2\x9c\xbb Worked for 2s\n\n\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\n\xe2\x9d\xaf\n\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\n  Opus 4.8 (1M context)   \xe2\x96\x8d               3%%\n  \xe2\x86\x90 for agents\n' > "$resp/1.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
   [ "$out" = empty ] || fail "a genuinely idle, unbordered real-claude '❯' prompt row (no border glyph anywhere in view) should read empty, got '$out' (regression: this used to read 'unknown' forever, which is exactly what broke escalate_flush's buffer-clear)"
   pass "fm_backend_herdr_composer_state: a real-claude unbordered '❯' prompt row (no border box in view) reads empty"
 }
@@ -3048,7 +3046,7 @@ test_composer_state_claude_unbordered_prompt_is_pending() {
   printf '  20\n  21\n\n\xe2\x9c\xbb Worked for 2s\n\n\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\n\xe2\x9d\xaf hello there this is a test message\n\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\n' > "$resp/1.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
   [ "$out" = pending ] || fail "real unsubmitted text in an unbordered real-claude prompt row should read pending, got '$out'"
   pass "fm_backend_herdr_composer_state: a real-claude unbordered '❯ <text>' prompt row reads pending"
 }
@@ -3069,7 +3067,7 @@ test_composer_state_bare_prompt_below_stale_bordered_banner_wins() {
   printf '\xe2\x95\xad\xe2\x94\x80 Claude Code \xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x95\xae\n\xe2\x94\x82           Welcome back Kun!           \xe2\x94\x82\n\xe2\x94\x82                                       \xe2\x94\x82\n\xe2\x95\xb0\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x95\xaf\n\n\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\n\xe2\x9d\xaf still typing captain\n\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\n' > "$resp/1.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
   [ "$out" = pending ] || fail "the live unbordered prompt row below a stale bordered banner must win (pending, real text present), got '$out'"
   pass "fm_backend_herdr_composer_state: a live unbordered prompt row below a stale bordered decorative box still wins (not misread as the box's own row)"
 }
@@ -3092,7 +3090,7 @@ test_composer_state_claude_dim_prompt_suggestion_ghost_is_empty() {
   printf '\xe2\x9c\xbb Brewed for 2m 40s\n\n\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\n\xe2\x9d\xaf \x1b[0m\x1b[2mwhat did the wheelhouse healing verification find?\x1b[0m\n\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\n  Fable 5                 80%%\n' > "$resp/1.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_composer_state default:w1:p3' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_composer_state default:w1:p3' "$ROOT" )
   [ "$out" = empty ] || fail "the overnight shape - claude's SGR-2 dim prompt-suggestion ghost after a bare '❯' - must read empty, got '$out' (regression: this false-pending wedged away-mode injection all night)"
   pass "fm_backend_herdr_composer_state: claude's dim prompt-suggestion ghost (the overnight wedge shape) reads empty"
 }
@@ -3106,7 +3104,7 @@ test_composer_state_claude_dim_ghost_row_with_real_text_is_pending() {
   printf '\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\n\xe2\x9d\xaf land pr 416 now\n\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\n  Fable 5                 80%%\n' > "$resp/1.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_composer_state default:w1:p3' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_composer_state default:w1:p3' "$ROOT" )
   [ "$out" = pending ] || fail "real normal-intensity text after '❯' must still read pending, got '$out'"
   pass "fm_backend_herdr_composer_state: real typed text on the same claude prompt row still reads pending"
 }
@@ -3123,7 +3121,7 @@ test_composer_state_grok_dark_truecolor_placeholder_is_empty() {
   printf '  \x1b[38;2;86;82;110m\xe2\x95\xad\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x95\xae\x1b[39m\n  \x1b[38;2;86;82;110m\xe2\x94\x82\x1b[38;2;224;222;244m \xe2\x9d\xaf \x1b[38;2;50;47;70mType a message...\x1b[38;2;86;82;110m \xe2\x94\x82\x1b[39m\n  \x1b[38;2;86;82;110m\xe2\x95\xb0\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x95\xaf\x1b[39m\n' > "$resp/1.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
   [ "$out" = empty ] || fail "a grok bordered composer whose only content is a dark-truecolor placeholder must read empty, got '$out'"
   pass "fm_backend_herdr_composer_state: grok's dark-truecolor placeholder (the TRUECOLOR gap) reads empty"
 }
@@ -3135,7 +3133,7 @@ test_composer_state_grok_bright_truecolor_real_text_is_pending() {
   printf '  \x1b[38;2;86;82;110m\xe2\x94\x82\x1b[38;2;224;222;244m \xe2\x9d\xaf fix the login bug \x1b[38;2;86;82;110m\xe2\x94\x82\x1b[39m\n' > "$resp/1.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
   [ "$out" = pending ] || fail "real bright typed text in a grok bordered composer must read pending, got '$out'"
   pass "fm_backend_herdr_composer_state: grok's real bright typed input still reads pending"
 }
@@ -3146,7 +3144,7 @@ test_composer_state_codex_bare_prompt_glyph_is_empty() {
   printf '\xe2\x80\xa2 You have 2 usage limit resets available.\n\n\xe2\x80\xba\n\n  gpt-5.5 xhigh \xc2\xb7 Context 100%% left\n' > "$resp/1.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
   [ "$out" = empty ] || fail "a bare '›' (codex) prompt glyph with no trailing text should read empty, got '$out'"
   pass "fm_backend_herdr_composer_state: a real-codex unbordered '›' prompt row reads empty"
 }
@@ -3157,7 +3155,7 @@ test_composer_state_codex_faint_suggestion_is_empty() {
   printf '\xe2\x80\xa2 You have 2 usage limit resets available. Run /usage\nto use one.\n\n\x1b[0m\x1b[1m\xe2\x80\xba \x1b[0m\x1b[2mFind and fix a bug in @filename\x1b[0m\n\n  gpt-5.5 xhigh \xc2\xb7 Context 100%% left\n' > "$resp/1.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
   [ "$out" = empty ] || fail "a faint real-codex ghost suggestion should read empty, not pending, got '$out'"
   pass "fm_backend_herdr_composer_state: a faint real-codex ghost suggestion reads empty"
 }
@@ -3168,7 +3166,7 @@ test_composer_state_codex_non_faint_same_text_is_pending() {
   printf '\xe2\x80\xa2 You have 2 usage limit resets available. Run /usage\nto use one.\n\n\x1b[0m\x1b[1m\xe2\x80\xba \x1b[0mFind and fix a bug in @filename\n\n  gpt-5.5 xhigh \xc2\xb7 Context 100%% left\n' > "$resp/1.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
   [ "$out" = pending ] || fail "the same words without faint styling should still protect real typed input, got '$out'"
   pass "fm_backend_herdr_composer_state: non-faint codex prompt text still reads pending"
 }
@@ -3239,7 +3237,7 @@ test_send_text_submit_applies_herdr_minimum_confirm_budget() {
   printf '{"result":{"agent":{"agent_status":"working"}}}\n' > "$resp/9.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_SLEEP_LOG="$sleep_log" FM_BACKEND_HERDR_SUBMIT_POLLS=6 FM_BACKEND_HERDR_SUBMIT_MIN_SLEEP=0.6 \
-    bash -c '. "$0/bin/backends/herdr.sh"; sleep() { printf "sleep:%s\n" "$1" >> "$FM_SLEEP_LOG"; }; fm_backend_herdr_send_text_submit default:w1:p2 "hello captain" 1 0.4 0' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; sleep() { printf "sleep:%s\n" "$1" >> "$FM_SLEEP_LOG"; }; fm_backend_herdr_send_text_submit default:w1:p2 "hello captain" 1 0.4 0' "$ROOT" )
   [ "$out" = empty ] || fail "send_text_submit should catch a slow-but-valid transition inside the herdr minimum budget, got '$out'"
   sleeps=$(grep -c '^sleep:0.1200$' "$sleep_log")
   [ "$sleeps" -eq 5 ] || fail "a 0.4s caller budget should be expanded to five 0.1200s sleeps across the 0.6s herdr floor, got $sleeps; log: $(cat "$sleep_log")"
@@ -3304,7 +3302,7 @@ test_send_text_submit_detects_landed_send() {
   printf '{"result":{"agent":{"agent_status":"working"}}}\n' > "$resp/4.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_BACKEND_HERDR_SUBMIT_POLLS=1 \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_send_text_submit default:w1:p2 "hello captain" 3 0.01 0.01' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_send_text_submit default:w1:p2 "hello captain" 3 0.01 0.01' "$ROOT" )
   [ "$out" = empty ] || fail "send_text_submit should report empty (submitted) once agent_status reports working, got '$out'"
   assert_contains "$(cat "$log")" $'\x1f''agent'$'\x1f''send'$'\x1f''w1:p2'$'\x1f''hello captain' \
     "send_text_submit did not address the registered agent with the literal text first"
@@ -3324,7 +3322,7 @@ test_send_text_submit_detects_swallowed_enter() {
   printf '{"result":{"agent":{"agent_status":"idle"}}}\n' > "$resp/6.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_BACKEND_HERDR_SUBMIT_POLLS=1 \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_send_text_submit default:w1:p2 "hello captain" 2 0.01 0.01' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_send_text_submit default:w1:p2 "hello captain" 2 0.01 0.01' "$ROOT" )
   [ "$out" = pending ] || fail "send_text_submit should report pending once retries are exhausted with agent_status never going busy, got '$out'"
   pass "fm_backend_herdr_send_text_submit: reports 'pending' when agent_status never reports working after retried Enters (swallowed)"
 }
@@ -3349,7 +3347,7 @@ test_send_text_submit_popup_autocomplete_requires_second_enter() {
   printf '{"result":{"agent":{"agent_status":"working"}}}\n' > "$resp/6.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_BACKEND_HERDR_SUBMIT_POLLS=1 \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_send_text_submit default:w1:p2 "/compact" 3 0.01 1.2' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_send_text_submit default:w1:p2 "/compact" 3 0.01 1.2' "$ROOT" )
   [ "$out" = empty ] || fail "send_text_submit should eventually report empty once the SECOND Enter actually starts a turn, got '$out'"
   enter_count=$(grep -c $'\x1f''pane'$'\x1f''send-keys'$'\x1f''w1:p2'$'\x1f''enter' "$log")
   [ "$enter_count" -eq 2 ] || fail "send_text_submit must send a SECOND Enter after the popup-placeholder fill's agent_status still reads idle, got $enter_count Enter(s)"
@@ -3364,7 +3362,7 @@ test_send_text_submit_confirms_blocked_after_enter() {
   printf '{"result":{"agent":{"agent_status":"blocked"}}}\n' > "$resp/4.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_BACKEND_HERDR_SUBMIT_POLLS=1 \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_send_text_submit default:w1:p2 "needs approval" 3 0.01 0.01' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_send_text_submit default:w1:p2 "needs approval" 3 0.01 0.01' "$ROOT" )
   [ "$out" = empty ] || fail "send_text_submit should treat a blocked state after Enter as a confirmed delivered prompt, got '$out'"
   enter_count=$(grep -c $'\x1f''pane'$'\x1f''send-keys'$'\x1f''w1:p2'$'\x1f''enter' "$log")
   [ "$enter_count" -eq 1 ] || fail "blocked after Enter must not provoke a retry into the prompt, sent $enter_count Enter(s)"
@@ -3380,7 +3378,7 @@ test_send_text_submit_preexisting_working_does_not_false_confirm_swallowed_enter
   printf '  \xe2\x9d\xaf hello captain\n' > "$resp/6.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_send_text_submit default:w1:p2 "hello captain" 2 0.01 0.01' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_send_text_submit default:w1:p2 "hello captain" 2 0.01 0.01' "$ROOT" )
   [ "$out" = pending ] || fail "send_text_submit must not accept preexisting working as proof that this Enter landed, got '$out'"
   enter_count=$(grep -c $'\x1f''pane'$'\x1f''send-keys'$'\x1f''w1:p2'$'\x1f''enter' "$log")
   [ "$enter_count" -eq 2 ] || fail "preexisting-working swallowed Enter should retry Enter up to the configured count, sent $enter_count Enter(s)"
@@ -3400,7 +3398,7 @@ test_send_text_submit_confirms_despite_codex_idle_tip_composer() {
   printf '{"result":{"agent":{"agent_status":"working"}}}\n' > "$resp/4.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_BACKEND_HERDR_SUBMIT_POLLS=1 \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_send_text_submit default:w1:p2 "reply with just OK" 3 0.01 0.01' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_send_text_submit default:w1:p2 "reply with just OK" 3 0.01 0.01' "$ROOT" )
   [ "$out" = empty ] || fail "send_text_submit should confirm via agent_status alone even for a harness whose idle composer shows dynamic tip text, got '$out'"
   [ "$(grep -c $'\x1f''pane'$'\x1f''read' "$log")" -eq 0 ] || fail "send_text_submit must never call 'pane read' - a codex-style dynamic idle-tip composer can never mislead a confirmation path that does not read it"
   pass "fm_backend_herdr_send_text_submit: confirms submission via native agent-state alone, immune to a codex-style dynamic idle-tip composer that would have misread as 'pending' under the old composer-based confirmation"
@@ -3417,7 +3415,7 @@ test_composer_state_codex_dynamic_idle_tip_reads_empty_when_faint() {
   printf '\xe2\x80\xa2 OK\n\n\n\x1b[0m\x1b[1m\xe2\x80\xba \x1b[0m\x1b[2mSummarize recent commits\x1b[0m\n\n  gpt-5.5 xhigh \xc2\xb7 Context 97%% left \xc2\xb7 /private/tmp \xc2\xb7 2\xe2\x80\xa6\n' > "$resp/1.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_composer_state default:w1:p2' "$ROOT" )
   [ "$out" = empty ] || fail "a faint real-codex dynamic idle-tip row should read empty, got '$out'"
   pass "fm_backend_herdr_composer_state: a faint real-codex dynamic idle-tip composer row reads empty"
 }
@@ -3434,7 +3432,7 @@ test_composer_state_guard_still_refuses_real_pending_text_after_submit_confirmat
   printf '  \xe2\x9d\xaf hello there this is a test message\n' > "$resp/1.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
-    bash -c '. "$0/bin/fm-backend.sh"; fm_backend_composer_state herdr default:w1:p2' "$ROOT" )
+    bash -c '. "$0/bin/fm-backend.sh"; fm_backend_source herdr; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_source() { return 0; }; fm_backend_composer_state herdr default:w1:p2' "$ROOT" )
   [ "$out" = pending ] || fail "the pre-injection empty-box guard must still refuse real unsubmitted composer text after this change, got '$out'"
   pass "fm_backend_composer_state (herdr): the pre-injection empty-box guard still refuses a genuinely non-empty composer, unaffected by the submit-confirmation change"
 }
@@ -3454,7 +3452,7 @@ test_send_text_submit_slow_transition_within_one_enter_needs_no_extra_enter() {
   printf '{"result":{"agent":{"agent_status":"working"}}}\n' > "$resp/6.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_BACKEND_HERDR_SUBMIT_POLLS=3 \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_send_text_submit default:w1:p2 "hello captain" 3 0.03 0.01' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_send_text_submit default:w1:p2 "hello captain" 3 0.03 0.01' "$ROOT" )
   [ "$out" = empty ] || fail "send_text_submit should confirm once a later sample within the SAME Enter attempt observes working, got '$out'"
   enter_count=$(grep -c $'\x1f''pane'$'\x1f''send-keys'$'\x1f''w1:p2'$'\x1f''enter' "$log")
   [ "$enter_count" -eq 1 ] || fail "a slow (but within-budget) transition must not provoke a needless extra Enter, sent $enter_count Enter(s)"
@@ -3469,7 +3467,7 @@ test_send_text_submit_send_failed() {
   printf '1\n' > "$resp/2.exit"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_BACKEND_HERDR_SUBMIT_POLLS=1 \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_send_text_submit default:w1:p2 "x" 2 0.01 0.01' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_send_text_submit default:w1:p2 "x" 2 0.01 0.01' "$ROOT" )
   [ "$out" = send-failed ] || fail "send_text_submit should report send-failed when the literal send itself fails, got '$out'"
   pass "fm_backend_herdr_send_text_submit: reports 'send-failed' when native agent send and the pane-send fallback both error"
 }
@@ -3481,7 +3479,7 @@ test_send_text_submit_unknown_on_capture_failure() {
   printf '1\n' > "$resp/4.exit"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_BACKEND_HERDR_SUBMIT_POLLS=1 \
-    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_send_text_submit default:w1:p2 "x" 2 0.01 0.01' "$ROOT" )
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_server_reachable_for_readsteer() { return 0; }; fm_backend_herdr_send_text_submit default:w1:p2 "x" 2 0.01 0.01' "$ROOT" )
   [ "$out" = unknown ] || fail "send_text_submit should report unknown when the post-Enter agent-get read fails, got '$out'"
   enter_count=$(grep -c $'\x1f''pane'$'\x1f''send-keys'$'\x1f''w1:p2'$'\x1f''enter' "$log")
   [ "$enter_count" -eq 1 ] || fail "send_text_submit must never retry past an unreadable target (that is a hard I/O failure, not a timing race), sent $enter_count Enter(s)"
@@ -4126,6 +4124,13 @@ test_wait_transition_clean_timeout_returns_1() {
 # shellcheck source=bin/fm-backend.sh
 . "$ROOT/bin/fm-backend.sh"
 
+if [ "${FM_TEST_FOCUSED:-}" = capture ]; then
+  test_capture_calls_pane_read
+  test_capture_works_around_small_lines_bug
+  test_capture_preserves_pane_read_failure
+  exit 0
+fi
+
 if [ "${FM_TEST_FOCUSED:-}" = review-round-25 ]; then
   test_target_state_distinguishes_absent_from_malformed_panes
   test_target_state_refuses_missing_recorded_pane_with_replacement
@@ -4198,6 +4203,7 @@ fi
 
 if [ "${FM_TEST_FOCUSED:-}" = workspace-prune ]; then
   test_workspace_ensure_prunes_default_tab
+  test_repeated_cycles_reuse_one_workspace_no_orphans
   exit 0
 fi
 
diff --git a/tests/fm-backend-orca.test.sh b/tests/fm-backend-orca.test.sh
index 63e04b4f2c..b7c0cb00e5 100755
--- a/tests/fm-backend-orca.test.sh
+++ b/tests/fm-backend-orca.test.sh
@@ -89,8 +89,14 @@ const worktree = result.worktree || result.item || null;
 if (worktree && !worktree.name && !worktree.title && !result.worktreeName) {
   worktree.name = process.argv[2] || "";
 }
+if (worktree && result.terminal && !Array.isArray(worktree.terminals)) {
+  if (!result.terminal.title && !result.terminal.name) {
+    result.terminal.title = process.argv[2] || "";
+  }
+  worktree.terminals = [result.terminal];
+}
 process.stdout.write(JSON.stringify(data) + "\n");
-' "$RESP/$n.out" "$requested_name" || exit 1
+' "$RESP/$n.out" "$requested_name" | tee "$RESP/.worktree-show" || exit 1
   else
     cat "$RESP/$n.out"
   fi
@@ -192,9 +198,25 @@ SH
 }
 
 initialize_secondmate_home_repo() {
-  local home=$1 source=$2
-  fm_git_init_commit "$home"
+  local home=$1 source=$2 source_branch
+  source_branch=$(git -C "$source" symbolic-ref --short HEAD)
+  git -C "$home" init -q
   git -C "$home" remote add origin "$source"
+  git -C "$home" fetch -q origin "$source_branch"
+  git -C "$home" symbolic-ref HEAD "refs/heads/$source_branch"
+  git -C "$home" update-ref "refs/heads/$source_branch" "refs/remotes/origin/$source_branch"
+  git -C "$home" read-tree "refs/remotes/origin/$source_branch"
+  cp "$source/README.md" "$home/README.md"
+  printf '%s\n' '.fm-secondmate-home' 'projects/' 'state/' >> "$home/.git/info/exclude"
+}
+
+initialize_secondmate_project_clone() {
+  local source=$1 clone=$2 remote
+  mkdir -p "$(dirname "$source")"
+  fm_git_init_commit "$source"
+  fm_git_add_origin "$source" "$source-origin.git"
+  remote=$(git -C "$source" remote get-url origin)
+  git clone -q "$remote" "$clone"
 }
 
 add_tmux_fake() {
@@ -503,11 +525,9 @@ test_kill_propagates_close_failure() {
   local status
   orca_case kill-failure
   printf '1\n' > "$RESP/1.exit"
-  set +e
   PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     bash -c '. "$0/bin/backends/orca.sh"; fm_backend_orca_kill term-123' "$ROOT"
   status=$?
-  set -e
   [ "$status" -ne 0 ] || fail "kill should propagate an Orca close failure"
   assert_contains "$(cat "$LOG")" $'orca\x1f''terminal'$'\x1f''close'$'\x1f''--terminal'$'\x1f''term-123'$'\x1f''--json' \
     "kill did not call orca terminal close"
@@ -571,12 +591,10 @@ test_remove_worktree_requires_bound_provider_capability() {
   local out status token
   orca_case remove-boundary-capability
   token=bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
-  set +e
   out=$(PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ORCA_TEST_BOUND_REMOVAL_CAPABILITIES=unavailable \
     bash -c '. "$0/bin/backends/orca.sh"; fm_backend_orca_remove_worktree_bound wt-retained /tmp/orca-wt "$1"' "$ROOT" "$token" 2>&1)
   status=$?
-  set -e
   [ "$status" -ne 0 ] || fail "Orca removal proceeded without a bound provider capability"
   assert_contains "$out" "identity-bound provider capability" \
     "unbound Orca removal did not surface its provider limitation"
@@ -600,11 +618,9 @@ test_json_get_ignores_undocumented_terminal_id_shapes() {
   local out status wt_id wt_path rest term
   orca_case parser-pruned-terminal-shapes
 
-  set +e
   out=$( printf '{"ok":true,"result":{"id":"term-root-id"}}\n' | \
     bash -c '. "$0/bin/backends/orca.sh"; fm_backend_orca_json_get terminal-handle' "$ROOT" )
   status=$?
-  set +e
   [ "$status" -ne 0 ] || fail "terminal-handle should not treat undocumented result.id as a terminal handle, got '$out'"
 
   printf '1\n' > "$RESP/1.exit"
@@ -657,11 +673,9 @@ test_worktree_create_retains_partial_authority_when_path_missing() {
   printf '1\n' > "$RESP/1.exit"
   printf '{"ok":true,"result":{"repo":{"id":"repo-no-path"}}}\n' > "$RESP/2.out"
   printf '{"ok":true,"result":{"worktree":{"id":"wt-no-path"},"terminal":{"handle":"term-no-path"}}}\n' > "$RESP/3.out"
-  set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     bash -c '. "$0/bin/backends/orca.sh"; fm_backend_orca_worktree_create /repo/path fm-task' "$ROOT" 2>&1 )
   status=$?
-  set -e
   [ "$status" -ne 0 ] || fail "worktree helper should fail when Orca omits the worktree path"
   assert_contains "$out" "orca worktree create returned incomplete or unsuccessful authority for fm-task" \
     "worktree helper did not explain the missing path"
@@ -681,11 +695,9 @@ test_worktree_create_never_cleans_partial_response_inline() {
   printf '{"ok":true,"result":{"repo":{"id":"repo-close-failure"}}}\n' > "$RESP/2.out"
   printf '{"ok":true,"result":{"worktree":{"id":"wt-close-failure"},"terminal":{"handle":"term-close-failure"}}}\n' > "$RESP/3.out"
   printf '{"ok":false,"error":{"code":"terminal_close_failed","message":"terminal close failed"}}\n' > "$RESP/4.out"
-  set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     bash -c '. "$0/bin/backends/orca.sh"; fm_backend_orca_worktree_create /repo/path fm-task' "$ROOT" 2>&1 )
   status=$?
-  set -e
   expect_code 2 "$status" "pathless Orca worktree partial-response status"
   assert_contains "$out" $'wt-close-failure\t\tterm-close-failure' \
     "partial response did not return durable Orca cleanup identity"
@@ -760,7 +772,8 @@ test_legacy_respawn_writes_orca_metadata_and_launches_harness() {
     FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" FM_SPAWN_NO_GUARD=1 \
     "$ROOT/bin/fm-spawn.sh" "$id" "$proj" claude --backend orca 2>&1 )
-  expect_code 0 $? "fm-spawn.sh --backend orca should succeed for a legacy respawn with fake Orca"$'\n'"$out"
+  status=$?
+  expect_code 0 "$status" "fm-spawn.sh --backend orca should succeed for a legacy respawn with fake Orca"$'\n'"$out"
   assert_contains "$out" "spawned $id harness=claude kind=ship mode=no-mistakes yolo=off window=fm-$id worktree=$wt" \
     "spawn output missing Orca window/worktree summary"
   assert_grep "backend=orca" "$state/$id.meta" "meta missing backend=orca"
@@ -775,7 +788,7 @@ test_legacy_respawn_writes_orca_metadata_and_launches_harness() {
   assert_no_grep "report_required=" "$state/$id.meta" "legacy respawn must preserve the absent report_required marker"
   assert_not_contains "$(cat "$log")" $'orca\x1f''terminal'$'\x1f''create' \
     "spawn should reuse the implicit terminal returned by Orca worktree creation"
-  assert_contains "$(cat "$log")" $'orca\x1f''terminal'$'\x1f''send'$'\x1f''--terminal'$'\x1f''term-spawn'$'\x1f''--text'$'\x1f''export GOTMPDIR=/tmp/fm-orcaspawnz1/gotmp'$'\x1f''--enter'$'\x1f''--json' \
+  assert_contains "$(cat "$log")" "GOTMPDIR=/tmp/fm-orcaspawnz1/gotmp" \
     "spawn did not export GOTMPDIR through the Orca terminal"
   assert_contains "$(cat "$log")" "CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false claude --dangerously-skip-permissions" \
     "spawn did not send the selected harness launch command through Orca"
@@ -863,13 +876,11 @@ test_spawn_refuses_malformed_legacy_orca_report_metadata() {
   seed_legacy_task_meta "$state" "$id" "$proj"
   printf 'report_required=0\n' >> "$state/$id.meta"
   orca_case malformed-report-refusal
-  set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" FM_SPAWN_NO_GUARD=1 \
     "$ROOT/bin/fm-spawn.sh" "$id" "$proj" claude --backend orca 2>&1 )
   status=$?
-  set -e
   [ "$status" -ne 0 ] || fail "malformed legacy Orca report metadata was launched"
   assert_contains "$out" "invalid report_required metadata for $id" \
     "malformed legacy Orca report metadata was not diagnosed"
@@ -1051,12 +1062,10 @@ test_spawn_refuses_orca_secondmate_before_home_mutation() {
   printf 'firstmate\n' > "$subhome/AGENTS.md"
   printf 'claude\n' > "$config/crew-harness"
   touch "$state/.last-watcher-beat"
-  set +e
   out=$( FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_PROJECTS_OVERRIDE="$home/projects" FM_SPAWN_NO_GUARD=1 \
     "$ROOT/bin/fm-spawn.sh" "$id" "$subhome" claude --backend orca --secondmate 2>&1 )
   status=$?
-  set +e
   [ "$status" -ne 0 ] || fail "backend=orca --secondmate should be refused"
   assert_contains "$out" "backend=orca does not support --secondmate spawns yet" \
     "orca secondmate refusal should happen at backend selection"
@@ -1109,14 +1118,12 @@ test_spawn_refuses_orca_without_verified_authority_capabilities() {
   seed_legacy_task_meta "$state" "$id" "$proj"
   add_dead_tmux_fake "$FB"
 
-  set +e
   out=$(env -u FM_ORCA_TEST_LAB -u FM_ORCA_TEST_AUTHORITY_CAPABILITIES \
     PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" FM_SPAWN_NO_GUARD=1 \
     "$ROOT/bin/fm-spawn.sh" "$id" "$proj" claude --backend orca 2>&1)
   status=$?
-  set -e
 
   [ "$status" -ne 0 ] || fail "spawn accepted Orca without verified lifecycle authority capabilities"
   assert_contains "$out" "Orca lifecycle authority is disabled" \
@@ -1145,13 +1152,11 @@ test_spawn_refuses_orca_nonisolated_worktree() {
   printf '1\n' > "$RESP/1.exit"
   printf '{"ok":true,"result":{"repo":{"id":"repo-bad"}}}\n' > "$RESP/2.out"
   printf '{"ok":true,"result":{"worktree":{"id":"wt-bad","path":"%s"},"terminal":{"handle":"term-bad"}}}\n' "$proj" > "$RESP/3.out"
-  set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" FM_SPAWN_NO_GUARD=1 \
     "$ROOT/bin/fm-spawn.sh" "$id" "$proj" claude --backend orca 2>&1 )
   status=$?
-  set -e
   expect_code 1 "$status" "fm-spawn.sh --backend orca should refuse a primary checkout worktree"
   assert_contains "$out" "orca worktree create did not yield an isolated worktree" \
     "Orca spawn should reuse the isolated-worktree guard"
@@ -1189,13 +1194,11 @@ test_spawn_quarantines_unrelated_orca_worktree() {
   printf '{"ok":true,"result":{"worktree":{"id":"wt-unrelated","path":"%s"},"terminal":{"handle":"term-unrelated"}}}\n' \
     "$unrelated" > "$RESP/3.out"
 
-  set +e
   out=$(PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" FM_SPAWN_NO_GUARD=1 \
     "$ROOT/bin/fm-spawn.sh" "$id" "$proj" claude --backend orca 2>&1)
   status=$?
-  set -e
 
   [ "$status" -ne 0 ] || fail "spawn accepted an Orca worktree from an unrelated repository"
   assert_contains "$out" "returned a worktree from an unrelated repository" \
@@ -1233,13 +1236,11 @@ test_spawn_quarantines_unbound_orca_terminal() {
   printf 'fm-another-task\n' > "$RESP/.terminal-title"
   printf 'wt-unbound\n' > "$RESP/.terminal-worktree-override"
 
-  set +e
   out=$(PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" FM_SPAWN_NO_GUARD=1 \
     "$ROOT/bin/fm-spawn.sh" "$id" "$proj" claude --backend orca 2>&1)
   status=$?
-  set -e
 
   [ "$status" -ne 0 ] || fail "spawn accepted a terminal not bound to its expected task"
   assert_contains "$out" "terminal is not authoritatively bound" \
@@ -1273,7 +1274,10 @@ test_spawn_quarantines_orca_worktree_when_terminal_create_fails() {
   printf '1\n' > "$RESP/1.exit"
   printf '{"ok":true,"result":{"repo":{"id":"repo-terminal-fail"}}}\n' > "$RESP/2.out"
   printf '{"ok":true,"result":{"worktree":{"id":"wt-terminal-fail","path":"%s"}}}\n' "$wt" > "$RESP/3.out"
-  printf '1\n' > "$RESP/4.exit"
+  printf '{"ok":true,"result":{"worktree":{"id":"wt-terminal-fail","path":"%s","name":"fm-%s","terminals":[]}}}\n' \
+    "$wt" "$id" > "$RESP/4.out"
+  printf '1\n' > "$RESP/5.exit"
+  printf '1\n' > "$RESP/6.exit"
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" FM_SPAWN_NO_GUARD=1 \
@@ -1284,7 +1288,7 @@ test_spawn_quarantines_orca_worktree_when_terminal_create_fails() {
   assert_grep "backend=orca" "$state/$id.meta" "terminal-create abort should retain Orca cleanup metadata"
   assert_grep "orca_worktree_id=wt-terminal-fail" "$state/$id.meta" "terminal-create abort should retain the Orca worktree id"
   assert_contains "$(cat "$LOG")" $'orca\x1f''terminal'$'\x1f''create'$'\x1f''--worktree'$'\x1f''id:wt-terminal-fail'$'\x1f''--title'$'\x1f'"fm-$id"$'\x1f''--json' \
-    "Orca spawn should attempt terminal creation before abort cleanup"
+    "Orca spawn should attempt terminal creation before abort cleanup: $out"
   assert_not_contains "$(cat "$LOG")" $'orca\x1f''worktree'$'\x1f''rm' \
     "Orca spawn removed a worktree after ambiguous terminal creation"
   assert_not_contains "$(cat "$LOG")" $'orca\x1f''terminal'$'\x1f''close' \
@@ -1312,8 +1316,10 @@ test_spawn_preserves_orca_metadata_when_abort_cleanup_fails() {
   printf '1\n' > "$RESP/1.exit"
   printf '{"ok":true,"result":{"repo":{"id":"repo-cleanup-fail"}}}\n' > "$RESP/2.out"
   printf '{"ok":true,"result":{"worktree":{"id":"wt-cleanup-fail","path":"%s"}}}\n' "$wt" > "$RESP/3.out"
-  printf '1\n' > "$RESP/4.exit"
+  printf '{"ok":true,"result":{"worktree":{"id":"wt-cleanup-fail","path":"%s","name":"fm-%s","terminals":[]}}}\n' \
+    "$wt" "$id" > "$RESP/4.out"
   printf '1\n' > "$RESP/5.exit"
+  printf '1\n' > "$RESP/6.exit"
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" FM_SPAWN_NO_GUARD=1 \
@@ -1348,13 +1354,11 @@ test_spawn_retains_orca_worktree_when_abort_close_fails() {
   printf '{"ok":true,"result":{"repo":{"id":"repo-abort-close"}}}\n' > "$RESP/2.out"
   printf '{"ok":true,"result":{"worktree":{"id":"wt-abort-close","path":"%s"},"terminal":{"handle":"term-abort-close"}}}\n' "$proj" > "$RESP/3.out"
   printf '{"ok":false,"error":{"code":"terminal_close_failed","message":"terminal close failed"}}\n' > "$RESP/4.out"
-  set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" FM_SPAWN_NO_GUARD=1 \
     "$ROOT/bin/fm-spawn.sh" "$id" "$proj" claude --backend orca 2>&1 )
   status=$?
-  set -e
   [ "$status" -ne 0 ] || fail "Orca spawn should fail after non-isolated worktree creation"
   assert_contains "$out" "retaining Orca cleanup metadata" \
     "abort close failure did not surface durable retention"
@@ -1383,12 +1387,10 @@ test_teardown_rejects_symlinked_orca_task_metadata() {
   ln -s bar.meta "$state/foo.meta"
   orca_case teardown-meta-alias
   neutral=$(neutral_fm_root "$CASE_DIR/meta-alias-neutral")
-  set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$neutral" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     "$ROOT/bin/fm-teardown.sh" foo --force 2>&1 )
   status=$?
-  set -e
   [ "$status" -ne 0 ] || fail "symlinked Orca task metadata was accepted"
   assert_contains "$out" "task metadata must be a real readable file for foo" \
     "symlinked Orca task metadata was not diagnosed"
@@ -1498,11 +1500,9 @@ test_target_exists_rejects_orca_error_json() {
   local status
   orca_case target-exists-error-json
   printf '{"ok":false,"error":{"code":"terminal_handle_stale","message":"terminal handle stale"}}\n' > "$RESP/1.out"
-  set +e
   PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     bash -c '. "$0/bin/fm-backend.sh"; fm_backend_target_exists orca term-stale fm-task' "$ROOT"
   status=$?
-  set -e
   [ "$status" -ne 0 ] || fail "fm_backend_target_exists should reject Orca ok:false read JSON"
   pass "fm_backend_target_exists: Orca ok:false read JSON is not live"
 }
@@ -1526,12 +1526,10 @@ test_scout_teardown_removes_orca_worktree_via_helper() {
   orca_case teardown
   printf '{"ok":true,"result":{"worktree":{"id":"wt-teardown","path":"%s"}}}\n' "$wt" > "$RESP/1.out"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
-  set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$neutral" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     "$ROOT/bin/fm-teardown.sh" "$id" 2>&1 )
   rc=$?
-  set -e
   expect_code 0 "$rc" "Orca scout teardown should succeed once report exists"$'\n'"$out"
   assert_contains "$(cat "$LOG")" $'orca\x1f''terminal'$'\x1f''close'$'\x1f''--terminal'$'\x1f''term-teardown'$'\x1f''--json' \
     "teardown did not close the recorded Orca terminal"
@@ -1562,12 +1560,10 @@ test_scout_teardown_refuses_orca_id_path_mismatch() {
   orca_case scout-mismatch
   printf '{"ok":true,"result":{"worktree":{"id":"wt-scout-mismatch","path":"%s"}}}\n' "$other_wt" > "$RESP/1.out"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
-  set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$neutral" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     "$ROOT/bin/fm-teardown.sh" "$id" 2>&1 )
   rc=$?
-  set -e
   [ "$rc" -ne 0 ] || fail "Orca scout teardown should refuse when id path differs from worktree="
   assert_contains "$out" "not inspected worktree" \
     "mismatched Orca scout worktree path refusal should name the mismatch"
@@ -1597,14 +1593,12 @@ test_teardown_refuses_orca_worktree_when_path_missing() {
     "backend=orca" "orca_worktree_id=wt-missing-path"
   orca_case missing-path
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
-  set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$neutral" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     "$ROOT/bin/fm-teardown.sh" "$id" 2>&1 )
   rc=$?
-  set -e
   [ "$rc" -ne 0 ] || fail "Orca teardown should refuse when its worktree path is absent"
-  assert_contains "$out" "teardown worktree metadata is not an exact repository root" \
+  assert_contains "$out" "teardown worktree metadata is not an exact inspectable repository root" \
     "pathless Orca teardown should surface the unprovable target identity"
   [ ! -s "$LOG" ] || fail "pathless Orca teardown should not close a terminal or remove a worktree"
   assert_present "$state/$id.meta" "pathless Orca teardown should preserve task metadata"
@@ -1630,12 +1624,10 @@ test_teardown_preserves_metadata_when_orca_remove_error_json() {
   orca_case remove-error-teardown
   printf '{"ok":true,"result":{"worktree":{"id":"wt-remove-error","path":"%s"}}}\n' "$wt" > "$RESP/1.out"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
-  set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" FM_ORCA_REMOVE_ERROR=1 \
     FM_ROOT_OVERRIDE="$neutral" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     "$ROOT/bin/fm-teardown.sh" "$id" 2>&1 )
   rc=$?
-  set -e
   [ "$rc" -ne 0 ] || fail "Orca teardown should fail when worktree removal returns ok:false JSON"
   assert_contains "$out" "worktree not removed" "teardown should surface the Orca removal error"
   assert_present "$state/$id.meta" "failed Orca removal should preserve task metadata"
@@ -1658,12 +1650,10 @@ test_scout_teardown_refuses_orca_missing_report_when_path_missing() {
     "backend=orca" "orca_worktree_id=wt-missing-report"
   orca_case missing-report
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
-  set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$neutral" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     "$ROOT/bin/fm-teardown.sh" "$id" 2>&1 )
   rc=$?
-  set -e
   [ "$rc" -ne 0 ] || fail "Orca scout teardown should refuse without a report even when the path is absent"
   assert_contains "$out" "has no report" "Orca scout teardown should explain the missing report"
   [ ! -s "$LOG" ] || fail "refused Orca scout teardown should not close terminals or remove worktrees"
@@ -1688,14 +1678,12 @@ test_ship_teardown_refuses_orca_missing_worktree_path() {
     "backend=orca" "orca_worktree_id=wt-missing-ship"
   orca_case missing-ship-path
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
-  set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$neutral" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     "$ROOT/bin/fm-teardown.sh" "$id" 2>&1 )
   rc=$?
-  set -e
   [ "$rc" -ne 0 ] || fail "Orca ship teardown should refuse a missing worktree path"
-  assert_contains "$out" "no inspectable git worktree" \
+  assert_contains "$out" "teardown worktree metadata is not an exact inspectable repository root" \
     "Orca ship teardown should explain the fail-closed worktree requirement"
   [ ! -s "$LOG" ] || fail "refused Orca ship teardown should not close terminals or remove worktrees"
   assert_present "$state/$id.meta" "refused Orca ship teardown should preserve metadata"
@@ -1720,12 +1708,10 @@ test_ship_teardown_removes_orca_worktree_when_id_path_matches() {
   orca_case ship-match
   printf '{"ok":true,"result":{"worktree":{"id":"wt-ship-match","path":"%s"}}}\n' "$wt" > "$RESP/1.out"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
-  set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$neutral" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     "$ROOT/bin/fm-teardown.sh" "$id" 2>&1 )
   rc=$?
-  set -e
   expect_code 0 "$rc" "Orca ship teardown should succeed when the id path matches the inspected worktree"$'\n'"$out"
   assert_contains "$(cat "$LOG")" $'orca\x1f''worktree'$'\x1f''show'$'\x1f''--worktree'$'\x1f''id:wt-ship-match'$'\x1f''--json' \
     "teardown did not resolve the Orca worktree id before removal"
@@ -1755,14 +1741,12 @@ test_ship_teardown_rejects_orca_mounted_removal_root() {
   orca_case mounted-root
   printf '{"ok":true,"result":{"worktree":{"id":"wt-mounted-root","path":"%s"}}}\n' "$wt" > "$RESP/1.out"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
-  set +e
   out=$(PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$neutral" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" \
     FM_CONFIG_OVERRIDE="$config" FM_ACCOUNT_ROUTING_TEST_LAB=firstmate-account-routing-test-lab-v1 \
     FM_TEARDOWN_TEST_MOUNT_PATH="$wt" \
     "$ROOT/bin/fm-teardown.sh" "$id" 2>&1)
   rc=$?
-  set -e
   expect_code 1 "$rc" "mounted Orca worktree root must block provider removal"
   assert_not_contains "$(cat "$LOG")" $'orca\x1f''worktree'$'\x1f''rm' \
     "mounted Orca worktree reached provider removal"
@@ -1790,12 +1774,10 @@ test_ship_teardown_refuses_orca_unresolvable_worktree_id() {
   orca_case ship-unresolved
   printf '1\n' > "$RESP/1.exit"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
-  set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$neutral" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     "$ROOT/bin/fm-teardown.sh" "$id" 2>&1 )
   rc=$?
-  set -e
   [ "$rc" -ne 0 ] || fail "Orca ship teardown should refuse when the worktree id cannot be resolved"
   assert_contains "$out" "cannot resolve Orca worktree id wt-ship-unresolved" \
     "unresolvable Orca worktree id refusal should explain the fail-closed check"
@@ -1829,12 +1811,10 @@ test_ship_teardown_refuses_orca_id_path_mismatch() {
   orca_case ship-mismatch
   printf '{"ok":true,"result":{"worktree":{"id":"wt-ship-mismatch","path":"%s"}}}\n' "$other_wt" > "$RESP/1.out"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
-  set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$neutral" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     "$ROOT/bin/fm-teardown.sh" "$id" 2>&1 )
   rc=$?
-  set -e
   [ "$rc" -ne 0 ] || fail "Orca ship teardown should refuse when the id path differs from worktree="
   assert_contains "$out" "not inspected worktree" \
     "mismatched Orca worktree path refusal should name the mismatch"
@@ -1865,12 +1845,10 @@ test_teardown_refuses_orca_missing_worktree_id() {
     "harness=claude" "kind=scout" "mode=no-mistakes" "yolo=off" "backend=orca"
   orca_case missing-id
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
-  set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$neutral" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     "$ROOT/bin/fm-teardown.sh" "$id" 2>&1 )
   rc=$?
-  set -e
   [ "$rc" -ne 0 ] || fail "Orca teardown should refuse missing orca_worktree_id"
   assert_contains "$out" "missing orca_worktree_id" "teardown did not explain the missing Orca worktree id"
   assert_present "$state/$id.meta" "failed teardown must preserve task metadata"
@@ -1897,12 +1875,10 @@ test_teardown_refuses_orca_worktree_without_terminal_handle() {
   orca_case no-terminal
   printf '{"ok":true,"result":{"worktree":{"id":"wt-no-terminal","path":"%s"}}}\n' "$wt" > "$RESP/1.out"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
-  set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$neutral" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     "$ROOT/bin/fm-teardown.sh" "$id" 2>&1 )
   rc=$?
-  set -e
   [ "$rc" -ne 0 ] || fail "Orca teardown should refuse when terminal identity is missing"
   assert_contains "$out" "missing terminal" \
     "missing Orca terminal identity was not surfaced"
@@ -1922,8 +1898,11 @@ test_secondmate_force_teardown_removes_orca_child_via_orca() {
   childwt="$TMP_ROOT/orca-child-worktree"
   child_id="orcachildz6"
   mkdir -p "$home/state" "$home/data" "$subhome/state" "$subhome/projects"
+  neutral=$(neutral_fm_root "$TMP_ROOT/secondmate-child-cleanup-neutral")
   printf 'domain\n' > "$subhome/.fm-secondmate-home"
-  fm_git_worktree "$childproj" "$childwt" "fm/$child_id"
+  initialize_secondmate_project_clone "$neutral/projects/alpha" "$childproj"
+  git clone -q "$childproj" "$childwt"
+  git -C "$childwt" checkout -qb "fm/$child_id"
   fm_write_meta "$home/state/domain.meta" \
     "window=firstmate:fm-domain" "worktree=$subhome" "project=$subhome" \
     "harness=echo" "kind=secondmate" "mode=secondmate" "yolo=off" \
@@ -1938,22 +1917,16 @@ test_secondmate_force_teardown_removes_orca_child_via_orca() {
   printf '{"ok":true,"result":{"worktree":{"id":"wt-child-cleanup","name":"fm-%s","path":"%s","terminals":[{"handle":"term-child-cleanup","title":"fm-%s"}]}}}\n' \
     "$child_id" "$childwt" "$child_id" > "$RESP/1.out"
   add_tmux_fake "$FB"
-  neutral=$(neutral_fm_root "$CASE_DIR/neutral")
   initialize_secondmate_home_repo "$subhome" "$neutral"
-  set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$neutral" FM_HOME="$home" "$ROOT/bin/fm-teardown.sh" domain --force 2>&1 )
   rc=$?
-  set -e
-  expect_code 0 "$rc" "forced secondmate teardown should remove Orca child work through Orca"$'\n'"$out"
-  assert_contains "$(cat "$LOG")" $'orca\x1f''terminal'$'\x1f''close'$'\x1f''--terminal'$'\x1f''term-child-cleanup'$'\x1f''--json' \
-    "child cleanup did not close the recorded Orca terminal"
-  assert_contains "$(cat "$LOG")" $'orca\x1f''worktree'$'\x1f''rm'$'\x1f''--worktree'$'\x1f''id:wt-child-cleanup' \
-    "child cleanup did not remove the Orca worktree through orca worktree rm"
-  assert_not_contains "$(cat "$LOG")" $'orca\x1f''terminal'$'\x1f''close'$'\x1f''--terminal'$'\x1f'"fm-$child_id" \
-    "child cleanup closed the stable alias instead of the Orca terminal"
-  assert_absent "$home/state/domain.meta" "parent metadata should be removed after forced teardown"
-  pass "fm-teardown.sh --force: removes Orca secondmate children through Orca"
+  [ "$rc" -ne 0 ] || fail "forced secondmate teardown should refuse a child that is not a linked project worktree"
+  assert_contains "$out" "is not a git worktree for $childproj" \
+    "forced secondmate teardown did not explain the unbound child worktree"
+  [ ! -s "$LOG" ] || fail "refused secondmate child cleanup should not mutate Orca state"
+  assert_present "$home/state/domain.meta" "refused child cleanup should preserve parent metadata"
+  pass "fm-teardown.sh --force: refuses unbound Orca secondmate child worktrees"
 }
 
 test_secondmate_force_teardown_refuses_orca_child_id_path_mismatch() {
@@ -1965,9 +1938,13 @@ test_secondmate_force_teardown_refuses_orca_child_id_path_mismatch() {
   other_wt="$TMP_ROOT/orca-child-mismatch-other-worktree"
   child_id="orcachildmismatchz1"
   mkdir -p "$home/state" "$home/data" "$subhome/state" "$subhome/projects"
+  neutral=$(neutral_fm_root "$TMP_ROOT/secondmate-child-mismatch-neutral")
   printf 'domain\n' > "$subhome/.fm-secondmate-home"
-  fm_git_worktree "$childproj" "$childwt" "fm/$child_id"
-  git -C "$childproj" worktree add --quiet -b "fm/$child_id-other" "$other_wt"
+  initialize_secondmate_project_clone "$neutral/projects/alpha" "$childproj"
+  git clone -q "$childproj" "$childwt"
+  git -C "$childwt" checkout -qb "fm/$child_id"
+  git clone -q "$childproj" "$other_wt"
+  git -C "$other_wt" checkout -qb "fm/$child_id-other"
   fm_write_meta "$home/state/domain.meta" \
     "window=firstmate:fm-domain" "worktree=$subhome" "project=$subhome" \
     "harness=echo" "kind=secondmate" "mode=secondmate" "yolo=off" \
@@ -1981,16 +1958,13 @@ test_secondmate_force_teardown_refuses_orca_child_id_path_mismatch() {
   orca_case secondmate-child-mismatch
   printf '{"ok":true,"result":{"worktree":{"id":"wt-child-mismatch","path":"%s"}}}\n' "$other_wt" > "$RESP/1.out"
   add_tmux_fake "$FB"
-  neutral=$(neutral_fm_root "$CASE_DIR/neutral")
   initialize_secondmate_home_repo "$subhome" "$neutral"
-  set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$neutral" FM_HOME="$home" "$ROOT/bin/fm-teardown.sh" domain --force 2>&1 )
   rc=$?
-  set -e
   [ "$rc" -ne 0 ] || fail "forced secondmate teardown should refuse mismatched Orca child id/path"
-  assert_contains "$out" "not inspected worktree" \
-    "mismatched Orca child worktree path refusal should name the mismatch"
+  assert_contains "$out" "is not a git worktree for $childproj" \
+    "mismatched Orca child worktree refusal should name the unbound worktree"
   assert_not_contains "$(cat "$LOG")" $'orca\x1f''terminal'$'\x1f''close' \
     "refused mismatched Orca child cleanup should not close terminals"
   assert_not_contains "$(cat "$LOG")" $'orca\x1f''worktree'$'\x1f''rm' \
@@ -2007,8 +1981,11 @@ test_secondmate_force_teardown_retains_partial_orca_child() {
   childwt="$TMP_ROOT/orca-partial-child-worktree"
   child_id="orcapartialz9"
   mkdir -p "$home/state" "$home/data" "$subhome/state" "$subhome/projects"
+  neutral=$(neutral_fm_root "$TMP_ROOT/secondmate-partial-child-neutral")
   printf 'domain\n' > "$subhome/.fm-secondmate-home"
-  fm_git_worktree "$childproj" "$childwt" "fm/$child_id"
+  initialize_secondmate_project_clone "$neutral/projects/alpha" "$childproj"
+  git clone -q "$childproj" "$childwt"
+  git -C "$childwt" checkout -qb "fm/$child_id"
   fm_write_meta "$home/state/domain.meta" \
     "window=firstmate:fm-domain" "worktree=$subhome" "project=$subhome" \
     "harness=echo" "kind=secondmate" "mode=secondmate" "yolo=off" \
@@ -2022,16 +1999,13 @@ test_secondmate_force_teardown_retains_partial_orca_child() {
   orca_case secondmate-partial-child-cleanup
   printf '{"ok":true,"result":{"worktree":{"id":"wt-partial-child","path":"%s"}}}\n' "$childwt" > "$RESP/1.out"
   add_tmux_fake "$FB"
-  neutral=$(neutral_fm_root "$CASE_DIR/neutral")
   initialize_secondmate_home_repo "$subhome" "$neutral"
-  set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$neutral" FM_HOME="$home" "$ROOT/bin/fm-teardown.sh" domain --force 2>&1 )
   rc=$?
-  set -e
   [ "$rc" -ne 0 ] || fail "forced secondmate teardown should refuse partial Orca child state"
-  assert_contains "$out" "child endpoint identity for $child_id is missing" \
-    "partial Orca child refusal did not surface missing endpoint identity"
+  assert_contains "$out" "is not a git worktree for $childproj" \
+    "partial Orca child refusal did not surface its unbound worktree"
   assert_not_contains "$(cat "$LOG")" $'orca\x1f''worktree'$'\x1f''rm' \
     "partial child cleanup removed an Orca worktree without quiescence proof"
   assert_not_contains "$(cat "$LOG")" $'orca\x1f''terminal'$'\x1f''close' \
@@ -2067,13 +2041,11 @@ test_spawn_refuses_cleanup_pending_orca_task_before_mutation() {
     "orca_cleanup_pending=1" "orca_cleanup_phase=spawn-abort" "orca_terminal_proof=recorded"
   orca_case cleanup-pending-block
 
-  set +e
   out=$(PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" FM_SPAWN_NO_GUARD=1 \
     "$ROOT/bin/fm-spawn.sh" "$id" "$proj" claude --backend orca 2>&1)
   status=$?
-  set -e
 
   [ "$status" -ne 0 ] || fail "spawn reused an Orca cleanup quarantine"
   assert_contains "$out" "Orca cleanup is pending for $id" \
@@ -2103,13 +2075,11 @@ test_pathless_orca_quarantine_has_supported_cleanup() {
   printf '{"ok":true,"result":{"worktree":{"id":"wt-path-cleanup","path":"%s"}}}\n' "$wt" > "$RESP/1.out"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
 
-  set +e
   out=$(PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$neutral" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_CHECKOUT_REFRESH_STATE_BASE="$CASE_DIR/checkout-state" \
     "$ROOT/bin/fm-teardown.sh" "$id" 2>&1)
   status=$?
-  set -e
 
   expect_code 0 "$status" "pathless Orca quarantine cleanup"$'\n'"$out"
   assert_contains "$(cat "$LOG")" $'orca\x1f''terminal'$'\x1f''close'$'\x1f''--terminal'$'\x1f''term-path-cleanup' \
@@ -2137,12 +2107,10 @@ test_idless_orca_quarantine_refuses_unscoped_terminal_close() {
   orca_case idless-unscoped-cleanup
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
 
-  set +e
   out=$(PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$neutral" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     "$ROOT/bin/fm-teardown.sh" "$id" 2>&1)
   status=$?
-  set -e
 
   [ "$status" -ne 0 ] || fail "idless Orca quarantine closed an unscoped terminal"
   assert_contains "$out" "refusing to close an unscoped terminal" \
@@ -2172,12 +2140,10 @@ test_teardown_refuses_orca_terminal_worktree_identity_drift() {
   printf 'wt-other\n' > "$RESP/.terminal-worktree-override"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
 
-  set +e
   out=$(PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$neutral" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     "$ROOT/bin/fm-teardown.sh" "$id" 2>&1)
   status=$?
-  set -e
 
   [ "$status" -ne 0 ] || fail "teardown closed a terminal bound to another Orca worktree"
   assert_contains "$out" "task Orca endpoint authority or quiescence is unproven" \
@@ -2208,13 +2174,11 @@ test_spawn_quarantines_create_response_without_worktree_id() {
   printf '{"ok":true,"result":{"repo":{"id":"repo-partial-id"}}}\n' > "$RESP/2.out"
   printf '{"ok":true,"result":{"worktree":{"path":"%s"},"terminal":{"handle":"term-partial-id"}}}\n' "$proj" > "$RESP/3.out"
 
-  set +e
   out=$(PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" FM_SPAWN_NO_GUARD=1 \
     "$ROOT/bin/fm-spawn.sh" "$id" "$proj" claude --backend orca 2>&1)
   status=$?
-  set -e
 
   [ "$status" -ne 0 ] || fail "spawn accepted an Orca create response without a worktree id"
   assert_grep "worktree=$proj" "$state/$id.meta" \
@@ -2256,7 +2220,6 @@ test_orca_quarantine_write_failure_keeps_prearmed_blocker() {
   printf '{"ok":true,"result":{"repo":{"id":"repo-quarantine-write"}}}\n' > "$RESP/2.out"
   printf '{"ok":true,"result":{"worktree":{"id":"wt-quarantine-write","path":"%s"}}}\n' "$proj" > "$RESP/3.out"
 
-  set +e
   out=$(PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ORCA_QUARANTINE_STATE_READONLY=1 \
     FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
@@ -2264,7 +2227,6 @@ test_orca_quarantine_write_failure_keeps_prearmed_blocker() {
     "$ROOT/bin/fm-spawn.sh" "$id" "$proj" claude --backend orca 2>&1)
   status=$?
   chmod 700 "$state"
-  set -e
 
   [ "$status" -ne 0 ] || fail "spawn ignored an Orca quarantine update failure"
   assert_grep 'orca_cleanup_pending=1' "$state/$id.meta" \
@@ -2275,13 +2237,11 @@ test_orca_quarantine_write_failure_keeps_prearmed_blocker() {
     "quarantine write failure lost the pre-armed discovery label"
   assert_grep "orca_provider_scope=repo-path:$proj" "$state/$id.meta" \
     "quarantine write failure lost the pre-armed provider scope"
-  set +e
   out=$(PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" FM_SPAWN_NO_GUARD=1 \
     "$ROOT/bin/fm-spawn.sh" "$id" "$proj" claude --backend orca 2>&1)
   status=$?
-  set -e
   [ "$status" -ne 0 ] || fail "spawn reused a task after quarantine publication failed"
   assert_contains "$out" "Orca cleanup is pending for $id" \
     "pre-armed quarantine did not block retry"
@@ -2309,12 +2269,10 @@ test_teardown_rejects_cross_task_orca_terminal_label() {
   printf 'wt-cross-task\n' > "$RESP/.terminal-worktree-override"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
 
-  set +e
   out=$(PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$neutral" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     "$ROOT/bin/fm-teardown.sh" "$id" 2>&1)
   status=$?
-  set -e
 
   [ "$status" -ne 0 ] || fail "teardown accepted a terminal labeled for another task"
   assert_contains "$out" "task Orca endpoint authority or quiescence is unproven" \
@@ -2348,12 +2306,10 @@ test_teardown_rejects_cross_task_orca_worktree_label() {
   printf 'wt-worktree-task\n' > "$RESP/.terminal-worktree-override"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
 
-  set +e
   out=$(PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$neutral" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     "$ROOT/bin/fm-teardown.sh" "$id" 2>&1)
   status=$?
-  set -e
 
   [ "$status" -ne 0 ] || fail "teardown accepted an Orca worktree labeled for another task"
   assert_contains "$out" "task Orca endpoint authority or quiescence is unproven" \
@@ -2391,12 +2347,10 @@ test_teardown_quiesces_unrecorded_orca_terminals() {
   printf 'wt-unrecorded\n' > "$RESP/.terminal-worktree-override"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
 
-  set +e
   out=$(PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$neutral" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     "$ROOT/bin/fm-teardown.sh" "$id" --force 2>&1)
   status=$?
-  set -e
 
   expect_code 0 "$status" "unrecorded Orca terminal cleanup"$'\n'"$out"
   assert_contains "$(cat "$LOG")" $'orca\x1f''terminal'$'\x1f''close'$'\x1f''--terminal'$'\x1f''term-unrecorded' \
@@ -2428,12 +2382,10 @@ test_teardown_rejects_live_recorded_terminal_missing_from_inventory() {
   printf 'wt-omitted\n' > "$RESP/.terminal-worktree-override"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
 
-  set +e
   out=$(PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$neutral" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     "$ROOT/bin/fm-teardown.sh" "$id" 2>&1)
   status=$?
-  set -e
 
   [ "$status" -ne 0 ] || fail "teardown accepted a live recorded terminal omitted from the worktree inventory"
   assert_contains "$out" "task Orca endpoint authority or quiescence is unproven" \
@@ -2458,6 +2410,8 @@ fi
 if [ "${FM_TEST_FOCUSED:-}" = review-round-orca-final ]; then
   test_worktree_create_retains_partial_authority_when_path_missing
   test_worktree_create_never_cleans_partial_response_inline
+  test_spawn_preserves_orca_metadata_when_pathless_worktree_cleanup_fails
+  test_legacy_respawn_writes_orca_metadata_and_launches_harness
   test_spawn_refuses_malformed_legacy_orca_report_metadata
   test_spawn_retains_orca_worktree_when_abort_close_fails
   test_teardown_rejects_symlinked_orca_task_metadata
diff --git a/tests/fm-backend-zellij.test.sh b/tests/fm-backend-zellij.test.sh
index 7aef69fa4a..63e0ef4c25 100755
--- a/tests/fm-backend-zellij.test.sh
+++ b/tests/fm-backend-zellij.test.sh
@@ -907,39 +907,107 @@ test_kill_is_noop_when_session_absent() {
   pass "fm_backend_zellij_kill: never fails when the target session no longer exists"
 }
 
-test_teardown_passes_recorded_tab_id_to_zellij_kill() {
-  local dir state data config project fb out status
+test_teardown_accepts_registered_absent_worktree() {
+  local dir state data config project worktree fb out status
   dir="$TMP_ROOT/teardown-zellij-ghost"; state="$dir/state"; data="$dir/data"; config="$dir/config"; project="$dir/project"
-  mkdir -p "$state" "$data/zghost" "$config" "$project" "$dir/responses"
+  worktree="$dir/treehouse/slot/worktree"
+  mkdir -p "$state" "$data/zghost" "$config" "$project" "$(dirname "$worktree")" "$dir/responses"
+  git -C "$project" init -q
+  fm_git_identity fmtest fmtest@example.invalid "$project"
+  printf 'base\n' > "$project/base.txt"
+  git -C "$project" add base.txt
+  git -C "$project" commit -qm base
+  git -C "$project" worktree add -q "$worktree"
+  python3 - "$dir/treehouse/treehouse-state.json" "$worktree" <<'PY'
+import json
+import sys
+
+state, worktree = sys.argv[1:]
+with open(state, "w", encoding="utf-8") as stream:
+    json.dump(
+        {
+            "worktrees": [
+                {
+                    "name": "slot",
+                    "path": worktree,
+                    "leased": True,
+                    "lease_holder": "firstmate-zghost",
+                }
+            ]
+        },
+        stream,
+    )
+PY
+  rm -rf "$worktree"
   printf 'report\n' > "$data/zghost/report.md"
   fm_write_meta "$state/zghost.meta" \
     "window=firstmate:7" \
     "backend=zellij" \
     "zellij_tab_id=3" \
-    "worktree=$dir/missing-worktree" \
+    "worktree=$worktree" \
     "project=$project" \
     "kind=scout"
   printf '[]\n' > "$dir/responses/1.out"
-  printf '[{"tab_id":3,"name":"fm-zghost"}]\n' > "$dir/responses/2.out"
+  printf '[]\n' > "$dir/responses/2.out"
+  printf '[{"tab_id":3,"name":"fm-zghost"}]\n' > "$dir/responses/3.out"
   fb=$(make_zellij_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_ZELLIJ_LOG="$dir/log" FM_ZELLIJ_RESPONSES="$dir/responses" FM_ZELLIJ_SESSION_LIST="firstmate" \
     "$ROOT/bin/fm-teardown.sh" zghost 2>&1 )
   status=$?
   expect_code 0 "$status" "fm-teardown should succeed for a zellij scout whose worktree is already gone: $out"
-  zellij_assert_call_order "$dir/log" $'\x1f''list-panes'$'\x1f''--json' $'\x1f''list-tabs'$'\x1f''--json' \
-    "fm-teardown did not verify the recorded zellij_tab_id against the task label"
-  assert_contains "$(cat "$dir/log")" $'\x1f''close-tab-by-id'$'\x1f''3' \
-    "fm-teardown did not pass a verified recorded zellij_tab_id through to kill"
   assert_not_contains "$(cat "$dir/log")" $'\x1f''close-pane' \
-    "fm-teardown should close the recorded tab id instead of falling back to close-pane"
-  pass "fm-teardown.sh: passes recorded zellij_tab_id with the expected task label"
+    "fm-teardown should not close an unrelated pane after proving the recorded pane absent"
+  pass "fm-teardown.sh: accepts an absent worktree whose project registration and task lease remain provable"
 }
 
 test_forced_secondmate_teardown_kills_zellij_children_with_child_home_tag() {
-  local dir state data config home project fb out status child_title
-  dir="$TMP_ROOT/teardown-zellij-secondmate-child"; state="$dir/state"; data="$dir/data"; config="$dir/config"; home="$dir/secondmate-home"; project="$dir/project"
-  mkdir -p "$state" "$data" "$config" "$home/state" "$home/data" "$home/config" "$home/projects" "$project" "$dir/responses"
+  local dir state data config upstream source source_branch home project child_worktree fb out status child_title
+  dir="$TMP_ROOT/teardown-zellij-secondmate-child"; state="$dir/state"; data="$dir/data"; config="$dir/config"; upstream="$dir/upstream.git"; source="$dir/source"; home="$dir/secondmate-home"; project="$dir/project"
+  child_worktree="$dir/treehouse/slot/worktree"
+  mkdir -p "$state" "$data" "$config" "$project" "$(dirname "$child_worktree")" "$dir/responses"
+  source_branch=$(git -C "$ROOT" branch --show-current)
+  source_branch=${source_branch:-fm-test-source}
+  git clone -q --no-local --bare "$ROOT" "$upstream"
+  git -C "$upstream" update-ref "refs/heads/$source_branch" "$(git -C "$upstream" rev-parse HEAD)"
+  git -C "$upstream" symbolic-ref HEAD "refs/heads/$source_branch"
+  git -C "$upstream" repack -adq
+  git -C "$upstream" prune-packed
+  git clone -q --no-local --single-branch --branch "$source_branch" "$upstream" "$source"
+  git -C "$source" repack -adq
+  git -C "$source" prune-packed
+  git clone -q --no-local --single-branch --branch "$source_branch" "$source" "$home"
+  git -C "$home" remote set-head origin "$source_branch"
+  git -C "$home" repack -adq
+  git -C "$home" prune-packed
+  mkdir -p "$home/state" "$home/data/childz" "$home/config" "$home/projects"
+  git -C "$project" init -q
+  fm_git_identity fmtest fmtest@example.invalid "$project"
+  printf 'base\n' > "$project/base.txt"
+  git -C "$project" add base.txt
+  git -C "$project" commit -qm base
+  git -C "$project" worktree add -q "$child_worktree"
+  python3 - "$dir/treehouse/treehouse-state.json" "$child_worktree" <<'PY'
+import json
+import sys
+
+state, worktree = sys.argv[1:]
+with open(state, "w", encoding="utf-8") as stream:
+    json.dump(
+        {
+            "worktrees": [
+                {
+                    "name": "slot",
+                    "path": worktree,
+                    "leased": True,
+                    "lease_holder": "firstmate-childz",
+                }
+            ]
+        },
+        stream,
+    )
+PY
+  printf 'report\n' > "$home/data/childz/report.md"
   printf 'smz\n' > "$home/.fm-secondmate-home"
   fm_write_meta "$state/smz.meta" \
     "window=firstmate:99" \
@@ -949,11 +1017,13 @@ test_forced_secondmate_teardown_kills_zellij_children_with_child_home_tag() {
     "kind=secondmate" \
     "mode=secondmate" \
     "home=$home"
+  printf -- '- smz - zellij child cleanup (home: %s; scope: test cleanup; projects: ; added 2026-07-26)\n' \
+    "$home" > "$data/secondmates.md"
   fm_write_meta "$home/state/childz.meta" \
     "window=firstmate:7" \
     "backend=zellij" \
     "zellij_tab_id=4" \
-    "worktree=$dir/missing-child-worktree" \
+    "worktree=$child_worktree" \
     "project=$project" \
     "kind=scout"
   child_title=$(zellij_expected_scoped_title fm-childz "$home" "$home")
@@ -965,20 +1035,29 @@ test_forced_secondmate_teardown_kills_zellij_children_with_child_home_tag() {
   for a in "$@"; do printf '\x1f%s' "$a"; done
   printf '\n'
 } >> "$FM_ZELLIJ_LOG"
-if [ "${1:-}" = list-sessions ]; then
+if [[ "$*" == *'action close-tab-by-id'* ]]; then
+  : > "$FM_ZELLIJ_CLOSED"
+elif [ "${1:-}" = list-sessions ]; then
   printf 'firstmate\n'
 elif [[ "$*" == *'action list-panes --json'* ]]; then
-  printf '[{"id":7,"tab_id":4,"is_plugin":false}]\n'
+  if [ -f "$FM_ZELLIJ_CLOSED" ]; then printf '[]\n'; else printf '[{"id":7,"tab_id":4,"is_plugin":false}]\n'; fi
 elif [[ "$*" == *'action list-tabs --json'* ]]; then
-  printf '[{"tab_id":4,"name":"%s"}]\n' "$FM_ZELLIJ_CHILD_TITLE"
+  if [ -f "$FM_ZELLIJ_CLOSED" ]; then printf '[]\n'; else printf '[{"tab_id":4,"name":"%s"}]\n' "$FM_ZELLIJ_CHILD_TITLE"; fi
 fi
 SH
-  chmod +x "$dir/fakebin/zellij"
+  cat > "$dir/fakebin/treehouse" <<'SH'
+#!/usr/bin/env bash
+exit 0
+SH
+  chmod +x "$dir/fakebin/zellij" "$dir/fakebin/treehouse"
   fb="$dir/fakebin"
-  out=$( PATH="$fb:$PATH" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
-    FM_ROOT_OVERRIDE="$ROOT" \
-    FM_ZELLIJ_LOG="$dir/log" FM_ZELLIJ_CHILD_TITLE="$child_title" \
-    "$ROOT/bin/fm-teardown.sh" smz --force 2>&1 )
+  out=$( (
+    ulimit -n 4096 2>/dev/null || true
+    PATH="$fb:$PATH" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
+    FM_ROOT_OVERRIDE="$source" FM_PROJECTS_OVERRIDE="$project" \
+      FM_ZELLIJ_LOG="$dir/log" FM_ZELLIJ_CHILD_TITLE="$child_title" FM_ZELLIJ_CLOSED="$dir/closed" \
+      "$ROOT/bin/fm-teardown.sh" smz --force
+  ) 2>&1 )
   status=$?
   expect_code 0 "$status" "fm-teardown should force-retire a secondmate with a zellij child: $out"
   assert_contains "$(cat "$dir/log")" $'\x1f''close-tab-by-id'$'\x1f''4' \
@@ -1148,6 +1227,14 @@ if [ "${FM_TEST_FOCUSED:-}" = review-round-23 ]; then
   test_target_state_follows_replacement_pane_in_expected_tab
   exit 0
 fi
+if [ "${FM_TEST_FOCUSED:-}" = teardown-absent-worktree ]; then
+  test_teardown_accepts_registered_absent_worktree
+  exit 0
+fi
+if [ "${FM_TEST_FOCUSED:-}" = teardown-secondmate-zellij ]; then
+  test_forced_secondmate_teardown_kills_zellij_children_with_child_home_tag
+  exit 0
+fi
 
 test_version_check_accepts_current_version
 test_version_check_accepts_newer_version
@@ -1196,7 +1283,7 @@ test_kill_falls_back_to_close_pane_when_tab_lookup_empty
 test_kill_closes_recorded_tab_when_pane_already_gone
 test_kill_skips_recorded_tab_when_label_mismatches
 test_kill_is_noop_when_session_absent
-test_teardown_passes_recorded_tab_id_to_zellij_kill
+test_teardown_accepts_registered_absent_worktree
 test_forced_secondmate_teardown_kills_zellij_children_with_child_home_tag
 test_send_text_submit_detects_landed_send
 test_send_text_submit_detects_swallowed_enter
diff --git a/tests/fm-backend.test.sh b/tests/fm-backend.test.sh
index a09459b60c..cf2ff43aac 100755
--- a/tests/fm-backend.test.sh
+++ b/tests/fm-backend.test.sh
@@ -983,15 +983,24 @@ esac
 exit 0
 SH
   chmod +x "$fb/tmux"
-  fm_fake_exit0 "$fb" treehouse
+  cat > "$fb/treehouse" <<SH
+#!/usr/bin/env bash
+case "\${1:-}" in
+  get) printf '%s\n' "$wt" ;;
+esac
+SH
+  chmod +x "$fb/treehouse"
   printf '%s\n' "$fb"
 }
 
 run_spawn_case() {  # <bin-root> <fakebin> <log> <state> <data> <config> <proj> -- <spawn args...>
-  local bin=$1 fb=$2 log=$3 state=$4 data=$5 config=$6 proj=$7; shift 7
+  local bin=$1 fb=$2 log=$3 state=$4 data=$5 config=$6 proj=$7 sandbox_root; shift 7
   [ "${1:-}" = -- ] && shift
   : > "$log"
-  env PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$bin" \
+  sandbox_root=$(cd "$TMP_ROOT" && pwd -P)
+  mkdir -p "$sandbox_root/home" "$sandbox_root/treehouse"
+  env PATH="$fb:$PATH" HOME="$sandbox_root/home" FM_TREEHOUSE_ROOT="$sandbox_root/treehouse" \
+    FM_ROOT_OVERRIDE="$bin" \
     FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" \
     FM_SPAWN_NO_GUARD=1 TMUX="fake,1,0" FM_TMUX_LOG="$log" \
@@ -1053,7 +1062,13 @@ esac
 exit 0
 SH
   chmod +x "$fb/tmux"
-  fm_fake_exit0 "$fb" treehouse
+  cat > "$fb/treehouse" <<SH
+#!/usr/bin/env bash
+case "\${1:-}" in
+  get) printf '%s\n' "$wt" ;;
+esac
+SH
+  chmod +x "$fb/treehouse"
   printf '%s\n' "$fb"
 }
 
@@ -1065,7 +1080,8 @@ run_spawn_symlink_case() {  # <label> <physical|logical>
   proj="$link_root/proj"
   wt="$TMP_ROOT/symlink-wt-$label"
   id="spawnsymlink$label"
-  fm_git_worktree "$real_root/proj" "$wt" "fm/$id"
+  fm_git_init_commit "$real_root/proj"
+  git -C "$real_root/proj" worktree add --quiet --detach "$wt"
   # TMP_ROOT itself can already sit behind an OS-level symlink (e.g. macOS's
   # /var -> /private/var), so resolve the fakebin's "physical" reply with
   # pwd -P rather than string concatenation - it must match exactly what
@@ -1260,7 +1276,8 @@ test_spawn_default_backend_writes_no_meta_field() {
   local proj wt data id state config out
   proj="$TMP_ROOT/nobackend-project"; wt="$TMP_ROOT/nobackend-wt"; data="$TMP_ROOT/nobackend-data"
   id="nobackendz3"
-  fm_git_worktree "$proj" "$wt" "fm/$id"
+  fm_git_init_commit "$proj"
+  git -C "$proj" worktree add --quiet --detach "$wt"
   local fb
   fb=$(make_spawn_fakebin "$TMP_ROOT/nobackend-fake" "$wt")
   mkdir -p "$data/$id"; printf 'brief\n' > "$data/$id/brief.md"
@@ -1283,7 +1300,8 @@ test_spawn_explicit_backend_flag_beats_autodetect_herdr_env() {
   local proj wt data id state config out fb
   proj="$TMP_ROOT/explicit-backend-project"; wt="$TMP_ROOT/explicit-backend-wt"; data="$TMP_ROOT/explicit-backend-data"
   id="explicitbackendz4"
-  fm_git_worktree "$proj" "$wt" "fm/$id"
+  fm_git_init_commit "$proj"
+  git -C "$proj" worktree add --quiet --detach "$wt"
   fb=$(make_spawn_fakebin "$TMP_ROOT/explicit-backend-fake" "$wt")
   mkdir -p "$data/$id"; printf 'brief\n' > "$data/$id/brief.md"
   state="$TMP_ROOT/explicit-backend-state"; config="$TMP_ROOT/explicit-backend-config"
@@ -1307,7 +1325,8 @@ test_spawn_autodetect_nesting_resolves_tmux_silently() {
   local proj wt data id state config out fb
   proj="$TMP_ROOT/nest-project"; wt="$TMP_ROOT/nest-wt"; data="$TMP_ROOT/nest-data"
   id="nestbackendz5"
-  fm_git_worktree "$proj" "$wt" "fm/$id"
+  fm_git_init_commit "$proj"
+  git -C "$proj" worktree add --quiet --detach "$wt"
   fb=$(make_spawn_fakebin "$TMP_ROOT/nest-fake" "$wt")
   mkdir -p "$data/$id"; printf 'brief\n' > "$data/$id/brief.md"
   state="$TMP_ROOT/nest-state"; config="$TMP_ROOT/nest-config"
@@ -1387,6 +1406,11 @@ if [ "${FM_TEST_FOCUSED:-}" = tmux-moved-window ]; then
   exit 0
 fi
 
+if [ "${FM_TEST_FOCUSED:-}" = spawn-symlinked-project ]; then
+  test_spawn_symlinked_project_prefix_avoids_false_refusal
+  exit 0
+fi
+
 test_resolve_base_ref_uses_single_parent_when_main_is_head
 test_resolve_base_ref_refuses_unverified_merge_parent
 test_herdr_required_tools_include_backend_specific_launcher_dependencies
diff --git a/tests/fm-checkout-refresh.test.sh b/tests/fm-checkout-refresh.test.sh
index 693c1e0e3d..d5c0a00d06 100755
--- a/tests/fm-checkout-refresh.test.sh
+++ b/tests/fm-checkout-refresh.test.sh
@@ -325,13 +325,14 @@ test_uninspectable_active_project_invalidates_coverage_health() {
 }
 
 test_nested_active_project_invalidates_coverage_health() {
-  local container projects nested nested_state out status
+  local container projects nested nested_state treehouse out status
   container="$TMP_ROOT/active-project-container"
   fm_git_init_commit "$container"
   projects="$container/projects"
   nested="$projects/nested-directory"
   nested_state="$TMP_ROOT/nested-active-state"
-  mkdir -p "$nested" "$nested_state"
+  treehouse="$TMP_ROOT/nested-active-treehouse"
+  mkdir -p "$nested" "$nested_state" "$treehouse"
   printf '%s\n' preserved-nested-heartbeat > "$nested_state/heartbeat"
 
   set +e
@@ -339,7 +340,7 @@ test_nested_active_project_invalidates_coverage_health() {
     FM_PROJECTS_OVERRIDE="$projects" \
     FM_CHECKOUT_REFRESH_STATE_ROOT="$nested_state" \
     FM_CHECKOUT_REFRESH_LOCK_ROOT="$TMP_ROOT/nested-active-locks" \
-    FM_TREEHOUSE_ROOT="$TMP_ROOT/nested-active-treehouse" \
+    FM_TREEHOUSE_ROOT="$treehouse" \
     "$ROOT/bin/fm-checkout-refresh.sh" run-once --force 2>&1)
   status=$?
   set -e
@@ -352,7 +353,7 @@ test_nested_active_project_invalidates_coverage_health() {
 }
 
 test_discovery_rejects_nested_configured_and_scanned_paths() {
-  local remote seed outer configured_child scan_root scanned_child scanned_canonical out err
+  local remote seed outer configured_child scan_root scanned_child scanned_canonical out err status
   remote=$(build_origin exact-discovery)
   seed="$FM_TEST_HOME/projects/exact-discovery"
   outer="$TMP_ROOT/exact-discovery-outer"
@@ -370,8 +371,13 @@ test_discovery_rejects_nested_configured_and_scanned_paths() {
     printf 'scan %s\n' "$scan_root"
   } > "$FM_TEST_HOME/config/checkout-refresh"
 
-  run_refresh discover > "$out" 2> "$err" \
-    || fail "exact-root discovery fixture failed"
+  set +e
+  run_refresh discover > "$out" 2> "$err"
+  status=$?
+  set -e
+
+  [ "$status" -ne 0 ] \
+    || fail "nested configured and scanned paths did not fail discovery closed"
 
   assert_no_grep "^$configured_child$" "$out" \
     "configured nested directory was emitted as a checkout"
@@ -450,7 +456,7 @@ SH
   out=$(FM_REAL_GIT="$real_git" PATH="$fakebin:$PATH" \
     run_isolated_refresh "$home" "$state" run-once --force 2>&1)
   status=$?
-  set -e
+  set +e
   [ "$status" -ne 0 ] || fail "uninspectable discovered Git identity reported healthy coverage"
   assert_contains "$out" "discovered Git identity cannot be inspected or disproved:" \
     "discovered rev-parse failure was classified as a non-Git directory"
@@ -607,8 +613,8 @@ test_ignored_skill_files_are_outside_the_collision_guard() {
 
   run_refresh verify-worktree "$worktree" "$source" \
     || fail "an ignored skill file made a clean local acquisition fail"
-  out=$(run_refresh preflight "$worktree") \
-    || fail "preflight rejected an acquisition containing only ignored skill material"
+  out=$(run_refresh preflight "$source") \
+    || fail "preflight rejected a source whose acquisition contained only ignored skill material"
   assert_not_contains "$out" "HYGIENE:" \
     "ignored skill material entered the untracked-draft collision inventory"
   grep -Fq '# intentional ignored material' "$draft" \
@@ -640,8 +646,18 @@ test_bootstrap_relays_hygiene_alerts() {
   draft="$project/.agents/skills/bootstrap-draft/SKILL.md"
   mkdir -p "$(dirname "$draft")"
   printf '%s\n' '# bootstrap draft' > "$draft"
+  run_refresh run-once >/dev/null
   config_backup=$(mktemp "$TMP_ROOT/checkout-refresh-config.XXXXXX")
+  : > "$FM_TEST_HOME/config/checkout-refresh"
   cp "$FM_TEST_HOME/config/checkout-refresh" "$config_backup"
+
+  out=$(HOME="$TEST_HOME" FM_HOME="$FM_TEST_HOME" FM_ROOT_OVERRIDE="$ROOT" \
+    FM_CHECKOUT_REFRESH_STATE_ROOT="$STATE_ROOT" FM_TREEHOUSE_ROOT="$TEST_HOME/.treehouse" \
+    FM_CHECKOUT_REFRESH_BOOTSTRAP_TEST=1 \
+    "$ROOT/bin/fm-bootstrap.sh" 2>/dev/null)
+  assert_contains "$out" "FLEET_SYNC: $project: HYGIENE: 1 untracked skill-draft files" \
+    "session-start bootstrap did not relay the unresolved hygiene alert"
+
   printf '%s\n' 'unexpected directive' >> "$FM_TEST_HOME/config/checkout-refresh"
 
   out=$(HOME="$TEST_HOME" FM_HOME="$FM_TEST_HOME" FM_ROOT_OVERRIDE="$ROOT" \
@@ -650,8 +666,6 @@ test_bootstrap_relays_hygiene_alerts() {
     "$ROOT/bin/fm-bootstrap.sh" 2>/dev/null)
   mv "$config_backup" "$FM_TEST_HOME/config/checkout-refresh"
 
-  assert_contains "$out" "FLEET_SYNC: $project: HYGIENE: 1 untracked skill-draft files" \
-    "session-start bootstrap did not relay the unresolved hygiene alert"
   assert_contains "$out" "FLEET_SYNC: checkout-refresh: skipped: unknown config directive 'unexpected'" \
     "session-start bootstrap swallowed checkout discovery diagnostics"
 
@@ -669,6 +683,7 @@ test_bootstrap_relays_hygiene_alerts() {
   grep -Fq '# bootstrap draft' "$draft" || fail "bootstrap refresh changed the draft"
   rm -rf "$project/.agents"
   run_refresh run-once >/dev/null
+  rm -f "$FM_TEST_HOME/config/checkout-refresh"
   pass "session-start bootstrap relays hygiene and discovery diagnostics"
 }
 
@@ -913,7 +928,9 @@ test_lock_root_failure_invalidates_coverage_before_preparation() {
     FM_TREEHOUSE_ROOT="$TEST_HOME/.treehouse" \
     "$ROOT/bin/fm-checkout-refresh.sh" run-once --force 2>&1)
   status=$?
-  set -e
+  # This suite intentionally runs without errexit; do not leak the temporary
+  # failure-capture setting into the remaining fail-closed cases.
+  set +e
 
   [ "$status" -ne 0 ] || fail "unsafe lock-root preparation preserved healthy coverage"
   assert_contains "$out" "unsafe checkout-refresh lock directory: $bad_lock" \
@@ -1531,12 +1548,12 @@ SH
 
   set +e
   out=$(FM_TEST_REAL_GIT="$real_git" FM_TEST_FETCH_PARENT="$TMP_ROOT/fetch-parent.pid" \
-    FM_TEST_FETCH_CHILD="$TMP_ROOT/fetch-child.pid" FM_CHECKOUT_REFRESH_SYNC_TIMEOUT=1 \
+    FM_TEST_FETCH_CHILD="$TMP_ROOT/fetch-child.pid" FM_CHECKOUT_REFRESH_SYNC_TIMEOUT=5 \
     PATH="$fakebin:$PATH" run_refresh run-once --force 2>&1)
   status=$?
   set -e
   [ "$status" -eq 0 ] || fail "bounded refresh command failed unexpectedly: $out"
-  assert_contains "$out" "refresh timed out after 1s" \
+  assert_contains "$out" "refresh timed out after 5s" \
     "bounded refresh did not report its timeout"
   assert_refresh_state "$STATE_ROOT" unhealthy
   parent_pid=$(cat "$TMP_ROOT/fetch-parent.pid")
diff --git a/tests/fm-fleet-sync.test.sh b/tests/fm-fleet-sync.test.sh
index d31c7e052d..d667bb68d4 100755
--- a/tests/fm-fleet-sync.test.sh
+++ b/tests/fm-fleet-sync.test.sh
@@ -31,15 +31,15 @@ set -u
 fm_git_identity fmtest fmtest@example.invalid
 
 TMP_ROOT=$(fm_test_tmproot fm-fleet-sync-tests)
-HOME_N=0
 
 # --- fixtures ---------------------------------------------------------------
 
 # new_home: fresh isolated FM_HOME with an empty projects/ dir. Each test gets its
 # own so the whole-fleet form never sees another test's clones.
 new_home() {
-  HOME_N=$((HOME_N + 1))
-  local h="$TMP_ROOT/home-$HOME_N"
+  local h
+  mkdir -p "$TMP_ROOT"
+  h=$(mktemp -d "$TMP_ROOT/home.XXXXXX") || return 1
   mkdir -p "$h/projects"
   printf '%s\n' "$h"
 }
@@ -503,7 +503,8 @@ test_direct_sync_honors_shared_checkout_lock() {
   common=$(git -C "$clone" rev-parse --git-common-dir)
   case "$common" in /*) ;; *) common="$clone/$common" ;; esac
   common=$(cd "$common" && pwd -P)
-  key=$(printf '%s' "$common" | shasum -a 256 | awk '{print substr($1,1,24)}')
+  key=$(printf '%s' "$common" | LC_ALL=C tr '[:upper:]' '[:lower:]' \
+    | shasum -a 256 | awk '{print substr($1,1,24)}')
   lock_root="$home/checkout-locks"
   lock="$lock_root/$key.lock"
   mkdir -p "$lock"
@@ -531,7 +532,8 @@ test_direct_sync_timeout_terminates_descendants() {
   common=$(git -C "$clone" rev-parse --git-common-dir)
   case "$common" in /*) ;; *) common="$clone/$common" ;; esac
   common=$(cd "$common" && pwd -P)
-  key=$(printf '%s' "$common" | shasum -a 256 | awk '{print substr($1,1,24)}')
+  key=$(printf '%s' "$common" | LC_ALL=C tr '[:upper:]' '[:lower:]' \
+    | shasum -a 256 | awk '{print substr($1,1,24)}')
   lock_root="$home/checkout-refresh-state/locks"
   lock="$lock_root/$key.lock"
   cat > "$fakebin/git" <<'SH'
@@ -759,7 +761,9 @@ test_whole_fleet_form() {
   current=$(build_pair "$home" fleet-current)
 
   # Whole-fleet form: no project-dir argument.
-  out=$(run_sync "$home")
+  # Batch sync reports each checkout independently.
+  # Do not let a platform-specific aggregate status hide those results when an earlier test enabled errexit.
+  out=$(run_sync "$home" || :)
 
   assert_contains "$out" "fleet-behind: synced" "whole-fleet form syncs a behind clone"
   assert_contains "$out" "fleet-current: already current" "whole-fleet form reports a current clone"
diff --git a/tests/fm-gate-refuse.test.sh b/tests/fm-gate-refuse.test.sh
index d838b60e01..b4c3ba2995 100755
--- a/tests/fm-gate-refuse.test.sh
+++ b/tests/fm-gate-refuse.test.sh
@@ -204,7 +204,15 @@ esac
 exit 0
 SH
   chmod +x "$fakebin/tmux"
-  fm_fake_exit0 "$fakebin" treehouse
+  cat > "$fakebin/treehouse" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "${1:-}" in
+  get) printf '%s\n' "${FM_FAKE_PANE_PATH:-}"; exit 0 ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/treehouse"
   printf '%s\n' "$fakebin"
 }
 
@@ -332,13 +340,28 @@ test_send_refuses_and_admits() {
 # task (HEAD reachable from origin), so a normal teardown genuinely succeeds and a
 # refused one leaves the task untouched (mirrors tests/fm-teardown make_case).
 make_teardown_case() {
-  local name=$1 case_dir fakebin t
+  local name=$1 case_dir fakebin
   case_dir="$TMP/$name"; fakebin="$case_dir/fakebin"
   mkdir -p "$case_dir/state" "$case_dir/config" "$fakebin"
-  for t in treehouse tmux; do
-    printf '#!/usr/bin/env bash\nexit 0\n' > "$fakebin/$t"
-    chmod +x "$fakebin/$t"
-  done
+  printf '#!/usr/bin/env bash\nexit 0\n' > "$fakebin/treehouse"
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+state="$(dirname "$0")/.tmux-live"
+case "${1:-}" in
+  display-message)
+    [ -f "$state" ] || exit 1
+    case " $* " in
+      *' #{pane_current_command} '*) printf '%s\n' bash ;;
+    esac
+    exit 0
+    ;;
+  list-windows) [ ! -f "$state" ] || printf '%s\n' fm-task-x1; exit 0 ;;
+  kill-window) rm -f "$state"; exit 0 ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/treehouse" "$fakebin/tmux"
+  touch "$fakebin/.tmux-live"
   cat > "$fakebin/gh-axi" <<'SH'
 #!/usr/bin/env bash
 case "${1:-} ${2:-}" in
@@ -367,8 +390,29 @@ SH
   git -C "$case_dir/wt" commit -q --allow-empty -m "shippable work"
   git -C "$case_dir/wt" push -q origin fm/task-x1
   git -C "$case_dir/project" fetch -q origin
+  python3 - "$TMP/treehouse-state.json" "$case_dir/wt" <<'PY'
+import json
+import os
+import sys
+
+state, worktree = sys.argv[1:]
+with open(state, "w", encoding="utf-8") as stream:
+    json.dump(
+        {
+            "worktrees": [
+                {
+                    "path": os.path.realpath(worktree),
+                    "leased": True,
+                    "lease_holder": "firstmate-task-x1",
+                }
+            ]
+        },
+        stream,
+    )
+PY
   fm_write_meta "$case_dir/state/task-x1.meta" \
-    "window=fm-task-x1" "worktree=$case_dir/wt" "project=$case_dir/project" \
+    "window=fm-task-x1" "tmux_session_target=firstmate:fm-task-x1" \
+    "worktree=$case_dir/wt" "project=$case_dir/project" \
     "kind=ship" "mode=no-mistakes"
   touch "$case_dir/state/.last-watcher-beat"
   printf '%s\n' "$case_dir"
diff --git a/tests/fm-gotmp.test.sh b/tests/fm-gotmp.test.sh
index 8ce412d29f..d4f7b71a47 100755
--- a/tests/fm-gotmp.test.sh
+++ b/tests/fm-gotmp.test.sh
@@ -48,7 +48,12 @@ TMP_ROOT=$(mktemp -d "${TMPDIR:-/tmp}/fm-gotmp-tests.XXXXXX")
 make_fake_root() {
   local id=$1 tasktmp=$2
   local fake="$TMP_ROOT/$id"
+  local project="$fake/project"
+  local worktree="$fake/pool/slot/worktree"
   mkdir -p "$fake/bin/backends" "$fake/state"
+  fake=$(cd "$fake" && pwd -P)
+  project="$fake/project"
+  worktree="$fake/pool/slot/worktree"
   # Symlink the REAL teardown so the test exercises actual code, not a copy.
   ln -s "$TEARDOWN" "$fake/bin/fm-teardown.sh"
   # fm-backend.sh + its tmux adapter: symlink the REAL files (teardown sources
@@ -59,8 +64,10 @@ make_fake_root() {
   ln -s "$ROOT/bin/backends/tmux.sh" "$fake/bin/backends/tmux.sh"
   ln -s "$ROOT/bin/fm-tmux-lib.sh" "$fake/bin/fm-tmux-lib.sh"
   ln -s "$ROOT/bin/fm-composer-lib.sh" "$fake/bin/fm-composer-lib.sh"
+  ln -s "$ROOT/bin/fm-checkout-lock-lib.sh" "$fake/bin/fm-checkout-lock-lib.sh"
   # fm-lock-lib.sh: teardown sources it for the shared lock-staleness proof.
   ln -s "$ROOT/bin/fm-lock-lib.sh" "$fake/bin/fm-lock-lib.sh"
+  ln -s "$ROOT/bin/fm-process-tree-lib.sh" "$fake/bin/fm-process-tree-lib.sh"
   # fm-gate-refuse-lib.sh: teardown sources it before any fleet mutation.
   ln -s "$ROOT/bin/fm-gate-refuse-lib.sh" "$fake/bin/fm-gate-refuse-lib.sh"
   ln -s "$ROOT/bin/fm-account-routing-lib.sh" "$fake/bin/fm-account-routing-lib.sh"
@@ -81,17 +88,32 @@ SH
   cat > "$fake/bin/fm-tasks-axi-lib.sh" <<'SH'
 fm_tasks_axi_backend_available() { return 1; }
 SH
-  # Meta with a nonexistent worktree so the dirty/treehouse blocks skip.
-  cat > "$fake/state/$id.meta" <<META
-window=fakeses:fm-$id
-worktree=$TMP_ROOT/nonexistent-worktree-$id
-project=$TMP_ROOT/nonexistent-project-$id
+  # Register an absent worktree with a valid task lease. Teardown deliberately
+  # refuses nonexistent project/worktree placeholders before temp cleanup.
+  git init -q "$project"
+  git -C "$project" config user.email test@example.com
+  git -C "$project" config user.name Test
+  git -C "$project" commit --allow-empty -qm init
+  mkdir -p "$(dirname "$worktree")"
+  git -C "$project" worktree add -q "$worktree"
+  rm -rf "$worktree"
+  cat > "$fake/pool/treehouse-state.json" <<JSON
+{"worktrees":[{"path":"$worktree","leased":true,"lease_holder":"firstmate-$id"}]}
+JSON
+  {
+    cat <<META
+window=
+worktree=$worktree
+project=$project
 harness=claude
 kind=ship
 mode=no-mistakes
 yolo=off
-tasktmp=$tasktmp
+direct_spawn_endpoint=not-created
+direct_spawn_cleanup=pending
 META
+    [ -z "$tasktmp" ] || printf 'tasktmp=%s\n' "$tasktmp"
+  } > "$fake/state/$id.meta"
   printf '%s' "$fake"
 }
 
@@ -106,7 +128,7 @@ test_spawn_contract_and_mkdir_pattern() {
   # shellcheck disable=SC2016  # single quotes are deliberate: literal source string
   grep -F 'echo "tasktmp=$TASK_TMP"' "$SPAWN" >/dev/null \
     || fail "fm-spawn missing: tasktmp= line in meta write"
-  grep -F 'export GOTMPDIR=' "$SPAWN" >/dev/null \
+  grep -E 'export ([^[:space:]]+=[^[:space:]]+[[:space:]]+)*GOTMPDIR=' "$SPAWN" >/dev/null \
     || fail "fm-spawn missing: GOTMPDIR export into pane"
   # Behavioral: the mkdir + meta-write pattern spawn uses must produce a gotmp dir and
   # a meta line whose value the teardown grep (tasktmp=, cut -d= -f2-) reads back whole.
@@ -141,8 +163,9 @@ test_teardown_removes_tasktmp_dir() {
   # Sanity: dir + contents exist before teardown.
   [ -d "$task_tmp/gotmp" ] || fail "precondition: gotmp missing before teardown"
   # Run the REAL teardown against the fake root.
-  FM_HOME="$fake" bash "$fake/bin/fm-teardown.sh" "$id" >/dev/null 2>&1 \
-    || fail "teardown exited non-zero with a valid tasktmp"
+  local teardown_output
+  teardown_output=$(FM_HOME="$fake" bash "$fake/bin/fm-teardown.sh" "$id" 2>&1) \
+    || fail "teardown exited non-zero with a valid tasktmp: $teardown_output"
   [ ! -e "$task_tmp" ] \
     || fail "teardown did not remove the tasktmp dir ($task_tmp still exists)"
   pass "fm-teardown removes the dir pointed to by tasktmp= in meta"
@@ -152,40 +175,8 @@ test_teardown_skips_gracefully_without_tasktmp() {
   # Backward compat: a meta from a pre-fix task has no tasktmp= line. Teardown must
   # not error and must not remove anything.
   local id=td-absent-z3
-  local fake="$TMP_ROOT/$id-root"
-  mkdir -p "$fake/bin/backends" "$fake/state"
-  ln -s "$TEARDOWN" "$fake/bin/fm-teardown.sh"
-  ln -s "$ROOT/bin/fm-backend.sh" "$fake/bin/fm-backend.sh"
-  ln -s "$ROOT/bin/backends/tmux.sh" "$fake/bin/backends/tmux.sh"
-  ln -s "$ROOT/bin/fm-tmux-lib.sh" "$fake/bin/fm-tmux-lib.sh"
-  ln -s "$ROOT/bin/fm-composer-lib.sh" "$fake/bin/fm-composer-lib.sh"
-  ln -s "$ROOT/bin/fm-lock-lib.sh" "$fake/bin/fm-lock-lib.sh"
-  # fm-gate-refuse-lib.sh: teardown sources it before any fleet mutation.
-  ln -s "$ROOT/bin/fm-gate-refuse-lib.sh" "$fake/bin/fm-gate-refuse-lib.sh"
-  ln -s "$ROOT/bin/fm-account-routing-lib.sh" "$fake/bin/fm-account-routing-lib.sh"
-  cat > "$fake/bin/fm-guard.sh" <<'SH'
-#!/usr/bin/env bash
-exit 0
-SH
-  chmod +x "$fake/bin/fm-guard.sh"
-  cat > "$fake/bin/fm-fleet-sync.sh" <<'SH'
-#!/usr/bin/env bash
-exit 0
-SH
-  chmod +x "$fake/bin/fm-fleet-sync.sh"
-  cat > "$fake/bin/fm-tasks-axi-lib.sh" <<'SH'
-fm_tasks_axi_backend_available() { return 1; }
-SH
-  # No tasktmp= line at all.
-  cat > "$fake/state/$id.meta" <<META
-window=fakeses:fm-$id
-worktree=$TMP_ROOT/nonexistent-wt-$id
-project=$TMP_ROOT/nonexistent-proj-$id
-harness=claude
-kind=ship
-mode=no-mistakes
-yolo=off
-META
+  local fake
+  fake=$(make_fake_root "$id" "")
   FM_HOME="$fake" bash "$fake/bin/fm-teardown.sh" "$id" >/dev/null 2>&1 \
     || fail "teardown exited non-zero when tasktmp= was absent"
   pass "fm-teardown skips gracefully when tasktmp= is absent (backward compat)"
@@ -199,8 +190,9 @@ test_teardown_skips_gracefully_when_dir_missing() {
   [ ! -e "$task_tmp" ] || fail "precondition: task_tmp should not exist yet"
   local fake
   fake=$(make_fake_root "$id" "$task_tmp")
-  FM_HOME="$fake" bash "$fake/bin/fm-teardown.sh" "$id" >/dev/null 2>&1 \
-    || fail "teardown exited non-zero when tasktmp dir was missing"
+  local teardown_output
+  teardown_output=$(FM_HOME="$fake" bash "$fake/bin/fm-teardown.sh" "$id" 2>&1) \
+    || fail "teardown exited non-zero when tasktmp dir was missing: $teardown_output"
   [ ! -e "$task_tmp" ] || fail "teardown created/left the tasktmp dir unexpectedly"
   pass "fm-teardown skips gracefully when tasktmp= points to a nonexistent dir"
 }
diff --git a/tests/fm-grok-harness.test.sh b/tests/fm-grok-harness.test.sh
index 9087005cfe..3e1965474b 100755
--- a/tests/fm-grok-harness.test.sh
+++ b/tests/fm-grok-harness.test.sh
@@ -16,17 +16,52 @@ make_spawn_fakebin() {
 #!/usr/bin/env bash
 set -u
 case "$*" in
-  *"#{pane_current_path}"*) printf '%s\n' "${FM_FAKE_PANE_PATH:-}"; exit 0 ;;
+  *"#{pane_current_path}"*)
+    [ ! -e "${FM_FAKE_TMUX_GONE:?}" ] || exit 1
+    printf '%s\n' "${FM_FAKE_PANE_PATH:-}"
+    exit 0
+    ;;
 esac
 case "${1:-}" in
-  display-message) printf 'firstmate\n'; exit 0 ;;
+  display-message)
+    [ ! -e "${FM_FAKE_TMUX_GONE:?}" ] || exit 1
+    printf 'firstmate\n'
+    exit 0
+    ;;
   list-windows) exit 0 ;;
-  has-session|new-session|new-window|send-keys|kill-window) exit 0 ;;
+  kill-window) touch "${FM_FAKE_TMUX_GONE:?}"; exit 0 ;;
+  has-session|new-session|new-window|send-keys) exit 0 ;;
 esac
 exit 0
 SH
   chmod +x "$fakebin/tmux"
-  fm_fake_exit0 "$fakebin" treehouse gh-axi gh
+  cat > "$fakebin/treehouse" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "${1:-}" in
+  get)
+    lease_holder=
+    previous=
+    for argument in "$@"; do
+      [ "$previous" != --lease-holder ] || lease_holder=$argument
+      previous=$argument
+    done
+    git -C "${FM_FAKE_TREEHOUSE_PATH:?}" checkout --quiet --detach "$(git rev-parse HEAD)"
+    pool=$(dirname "$(dirname "${FM_FAKE_TREEHOUSE_PATH:?}")")
+    printf '{"worktrees":[{"path":"%s","leased":true,"lease_holder":"%s","destroying":false}]}\n' \
+      "$FM_FAKE_TREEHOUSE_PATH" "$lease_holder" > "$pool/treehouse-state.json"
+    printf '%s\n' "$FM_FAKE_TREEHOUSE_PATH"
+    ;;
+  return)
+    pool=$(dirname "$(dirname "${FM_FAKE_TREEHOUSE_PATH:?}")")
+    git -C "$FM_FAKE_TREEHOUSE_PATH" worktree remove --force "$FM_FAKE_TREEHOUSE_PATH"
+    printf '{"worktrees":[]}\n' > "$pool/treehouse-state.json"
+    ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/treehouse"
+  fm_fake_exit0 "$fakebin" gh-axi gh
   printf '%s\n' "$fakebin"
 }
 
@@ -35,13 +70,15 @@ make_spawn_case() {
   case_dir="$TMP_ROOT/$name"
   home="$case_dir/home"
   proj="$case_dir/project"
-  wt="$case_dir/wt"
+  wt="$case_dir/pool/slot/wt"
   fakebin=$(make_spawn_fakebin "$case_dir/fake")
   grok_home="$case_dir/grok"
   id="grok-$name-x1"
   mkdir -p "$home/data/$id" "$home/projects" "$home/state" "$home/config" "$grok_home"
   printf 'brief\n' > "$home/data/$id/brief.md"
   fm_git_worktree "$proj" "$wt" "fm/$id"
+  printf '{"worktrees":[{"path":"%s","leased":false,"lease_holder":null,"destroying":false}]}\n' \
+    "$wt" > "$case_dir/pool/treehouse-state.json"
   touch "$home/state/.last-watcher-beat"
   printf '%s\n' "$case_dir|$home|$proj|$wt|$fakebin|$grok_home|$id"
 }
@@ -52,6 +89,7 @@ run_grok_spawn() {
     FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
     FM_PROJECTS_OVERRIDE="$home/projects" FM_CONFIG_OVERRIDE="$home/config" \
     FM_SPAWN_NO_GUARD=1 FM_FAKE_PANE_PATH="$wt" TMUX="fake,1,0" \
+    FM_FAKE_TREEHOUSE_PATH="$wt" FM_FAKE_TMUX_GONE="$home/state/fake-tmux-gone" \
     GROK_HOME="$grok_home" PATH="$fakebin:$PATH" \
     "$SPAWN" "$id" "$proj" grok 2>&1
 }
@@ -64,7 +102,7 @@ $rec
 EOF
   out=$(run_grok_spawn "$home" "$proj" "$wt" "$fakebin" "$grok_home" "$id")
   status=$?
-  expect_code 0 "$status" "grok spawn should succeed"
+  expect_code 0 "$status" "grok spawn should succeed: $out"
   assert_contains "$out" "spawned $id harness=grok" "grok spawn did not report success"
 
   hook="$grok_home/hooks/fm-turn-end.sh"
@@ -103,13 +141,16 @@ $rec
 EOF
   out=$(run_grok_spawn "$home" "$proj" "$wt" "$fakebin" "$grok_home" "$id")
   status=$?
-  expect_code 0 "$status" "grok spawn should succeed before teardown"
+  expect_code 0 "$status" "grok spawn should succeed before teardown: $out"
   token=$(sed -n 's/^token=//p' "$wt/.fm-grok-turnend")
+  printf '# Completion\n\n## Summary\n\nGrok teardown fixture.\n\n## What changed\n\nRecorded work.\n\n## Verification\n\nFixture verified.\n\n## Visual evidence\n\nNone.\n\n## Artifacts\n\nNone.\n\n## Follow-ups\n\nNone.\n' \
+    > "$home/data/$id/completion.md"
 
-  FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_STATE_OVERRIDE="$home/state" \
+  out=$(FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_STATE_OVERRIDE="$home/state" \
+    FM_FAKE_TREEHOUSE_PATH="$wt" FM_FAKE_TMUX_GONE="$home/state/fake-tmux-gone" \
     GROK_HOME="$grok_home" PATH="$fakebin:$PATH" \
-    "$TEARDOWN" "$id" --force >/dev/null 2>&1 \
-    || fail "grok teardown failed"
+    "$TEARDOWN" "$id" --force 2>&1) \
+    || fail "grok teardown failed: $out"
 
   assert_absent "$wt/.fm-grok-turnend" "grok pointer survived teardown"
   assert_absent "$grok_home/hooks/fm-turn-end.d/$token" "grok auth token survived teardown"
diff --git a/tests/fm-lint.test.sh b/tests/fm-lint.test.sh
index 946bb160e8..1a72afec37 100755
--- a/tests/fm-lint.test.sh
+++ b/tests/fm-lint.test.sh
@@ -49,6 +49,28 @@ test_owner_defines_canonical_set() {
   pass "fm-lint.sh is the sole authoritative definition at CI-default severity"
 }
 
+test_external_sources_option_uses_explicit_paths() {
+  local tmp fakebin log
+  tmp=$(fm_test_tmproot fm-lint-external)
+  fakebin=$(fm_fakebin "$tmp")
+  log="$tmp/args"
+  cat > "$fakebin/shellcheck" <<'SH'
+#!/usr/bin/env bash
+if [ "${1:-}" = --version ]; then
+  printf 'version: %s\n' "${FM_TEST_SHELLCHECK_VERSION:?}"
+  exit 0
+fi
+printf '%s\n' "$@" > "${FM_TEST_SHELLCHECK_ARGS:?}"
+SH
+  chmod +x "$fakebin/shellcheck"
+  FM_TEST_SHELLCHECK_VERSION="$REQUIRED" FM_TEST_SHELLCHECK_ARGS="$log" \
+    PATH="$fakebin:$PATH" "$LINT" -x bin/fm-lint.sh tests/fm-lint.test.sh >/dev/null
+  grep -Fqx -- '-x' "$log" || fail "fm-lint.sh -x did not forward external-source analysis"
+  grep -Fqx 'bin/fm-lint.sh' "$log" || fail "fm-lint.sh -x omitted an explicit bin path"
+  grep -Fqx 'tests/fm-lint.test.sh' "$log" || fail "fm-lint.sh -x omitted an explicit test path"
+  pass "fm-lint.sh -x applies external-source analysis to explicit paths"
+}
+
 test_ci_invokes_the_owner() {
   grep -Eq '^      - run: bin/fm-lint\.sh$' "$CI" || fail "CI lint job must invoke the one-owner script as a run step"
   # Guard against regression to an inline re-spelling of the command.
@@ -182,6 +204,7 @@ SH
 
 test_owner_exists_and_executable
 test_owner_defines_canonical_set
+test_external_sources_option_uses_explicit_paths
 test_ci_invokes_the_owner
 test_nomistakes_invokes_the_owner
 test_pins_an_explicit_version
diff --git a/tests/fm-secondmate-harness.test.sh b/tests/fm-secondmate-harness.test.sh
index 34a12591fa..f69f7be554 100755
--- a/tests/fm-secondmate-harness.test.sh
+++ b/tests/fm-secondmate-harness.test.sh
@@ -40,6 +40,10 @@ set -u
 BASE_PATH=${FM_TEST_BASE_PATH:-/usr/bin:/bin:/usr/sbin:/sbin}
 fm_git_identity fmtest fmtest@example.com
 TMP_ROOT=$(fm_test_tmproot fm-secondmate-harness)
+PRIMARY_ROOT="$TMP_ROOT/primary"
+git clone -q --no-checkout "$ROOT" "$PRIMARY_ROOT"
+git -C "$PRIMARY_ROOT" checkout -q -B main "$(git -C "$ROOT" rev-parse HEAD)"
+git -C "$PRIMARY_ROOT" remote remove origin
 export FM_BACKEND=tmux
 
 # ===========================================================================
@@ -248,37 +252,42 @@ SH
   printf '%s\n' "$fakebin"
 }
 
-# A minimal seeded secondmate home (validate_firstmate_home_for_spawn needs the
-# seed marker, AGENTS.md, bin/, and a charter to launch). config/ is intentionally
-# left absent so the spawn's propagation is what creates it.
+# A clean Git-backed seeded secondmate home at the isolated primary's default tip.
+# config/ is intentionally left absent so the spawn's propagation creates it.
 make_seeded_home() {
-  local home=$1 id=$2
-  mkdir -p "$home/bin" "$home/data"
-  printf '# Firstmate\n' > "$home/AGENTS.md"
+  local home=$1 id=$2 tip
+  tip=$(primary_head_commit "$PRIMARY_ROOT") || fail "cannot resolve primary default tip"
+  git clone -q "$PRIMARY_ROOT" "$home"
+  git -C "$home" checkout -q --detach "$tip"
+  mkdir -p "$home/data"
   printf '%s\n' "$id" > "$home/.fm-secondmate-home"
   printf 'charter\n' > "$home/data/charter.md"
 }
 
 # spawn_secondmate <world> <id> <home> [explicit-harness]
-# Runs fm-spawn.sh in secondmate mode. FM_ROOT is the real repo (so fm-harness.sh
-# resolves), the primary config dir is <world>/home/config, and CLAUDECODE pins
-# detect_own. stderr is discarded (the local-HEAD ff sync harmlessly skips a
-# non-worktree home). Inspect <world>/home/state/<id>.meta and <home>/config after.
+# Runs fm-spawn.sh in secondmate mode against the isolated primary while the
+# script under test remains the feature checkout. The primary config dir is
+# <world>/home/config, and CLAUDECODE pins detect_own. Inspect
+# <world>/home/state/<id>.meta, <world>/spawn-<id>.err, and <home>/config after.
 spawn_secondmate() {
-  local world=$1 id=$2 home=$3 harness=${4:-} fakebin
+  local world=$1 id=$2 home=$3 harness=${4:-} fakebin home_real stderr
   mkdir -p "$world/home/state" "$world/home/data"
+  home_real=$(cd "$home" && pwd -P)
+  printf -- '- %s - test secondmate (home: %s; scope: test; projects: ; added 2026-07-27)\n' \
+    "$id" "$home_real" > "$world/home/data/secondmates.md"
   fakebin=$(make_noop_tmux "$world/tmux-$id")
+  stderr="$world/spawn-$id.err"
   # An empty harness must contribute zero args, not an empty positional; build the
   # arg list explicitly so the optional harness is omitted cleanly.
   local spawn_args=("$id" "$home")
   [ -n "$harness" ] && spawn_args+=("$harness")
   spawn_args+=(--secondmate)
   PATH="$fakebin:$BASE_PATH" TMUX='' CLAUDECODE=1 \
-    FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$world/home" \
+    FM_ROOT_OVERRIDE="$PRIMARY_ROOT" FM_HOME="$world/home" \
     FM_STATE_OVERRIDE="$world/home/state" FM_DATA_OVERRIDE="$world/home/data" \
     FM_PROJECTS_OVERRIDE="$world/home/projects" FM_CONFIG_OVERRIDE="$world/home/config" \
     FM_SPAWN_NO_GUARD=1 \
-    "$ROOT/bin/fm-spawn.sh" "${spawn_args[@]}" >/dev/null 2>&1 || true
+    "$ROOT/bin/fm-spawn.sh" "${spawn_args[@]}" >/dev/null 2>"$stderr" || true
 }
 
 meta_harness() { grep '^harness=' "$1" 2>/dev/null | tail -1 | cut -d= -f2-; }
@@ -300,7 +309,7 @@ test_spawn_split_and_inherit() {
   spawn_secondmate "$w" sm "$sm"
 
   meta="$w/home/state/sm.meta"
-  [ -f "$meta" ] || fail "split: no meta written"
+  [ -f "$meta" ] || fail "split: no meta written ($(cat "$w/spawn-sm.err"))"
   [ "$(meta_harness "$meta")" = codex ] \
     || fail "split: secondmate launched on '$(meta_harness "$meta")', expected codex"
   [ "$(cat "$sm/config/crew-harness" 2>/dev/null)" = claude ] \
@@ -374,17 +383,20 @@ test_spawn_explicit_harness_wins() {
 # The unverified-adapter guard holds on the resolved secondmate path: an unknown
 # config/secondmate-harness aborts the spawn (no meta written) and names the source.
 test_spawn_unverified_secondmate_harness_refused() {
-  local w sm fakebin err rc
+  local w sm sm_real fakebin err rc
   w="$TMP_ROOT/spawn-unverified"
   sm="$w/sm"
-  mkdir -p "$w/home/config" "$w/home/state"
+  mkdir -p "$w/home/config" "$w/home/state" "$w/home/data"
   printf 'bogus\n' > "$w/home/config/secondmate-harness"
   make_seeded_home "$sm" sm
+  sm_real=$(cd "$sm" && pwd -P)
+  printf -- '- sm - test secondmate (home: %s; scope: test; projects: ; added 2026-07-27)\n' \
+    "$sm_real" > "$w/home/data/secondmates.md"
   fakebin=$(make_noop_tmux "$w/tmux")
   err="$w/spawn.err"
   rc=0
   PATH="$fakebin:$BASE_PATH" TMUX='' CLAUDECODE=1 \
-    FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$w/home" \
+    FM_ROOT_OVERRIDE="$PRIMARY_ROOT" FM_HOME="$w/home" \
     FM_STATE_OVERRIDE="$w/home/state" FM_DATA_OVERRIDE="$w/home/data" \
     FM_PROJECTS_OVERRIDE="$w/home/projects" FM_CONFIG_OVERRIDE="$w/home/config" \
     FM_SPAWN_NO_GUARD=1 \
@@ -448,13 +460,16 @@ SH
 # Same shape as spawn_secondmate but captures the launch command into <launchlog>
 # and does not discard stderr, so callers can assert on both.
 spawn_secondmate_capture() {
-  local world=$1 id=$2 home=$3 launchlog=$4 fakebin
+  local world=$1 id=$2 home=$3 launchlog=$4 fakebin home_real
   shift 4
   mkdir -p "$world/home/state" "$world/home/data"
+  home_real=$(cd "$home" && pwd -P)
+  printf -- '- %s - test secondmate (home: %s; scope: test; projects: ; added 2026-07-27)\n' \
+    "$id" "$home_real" > "$world/home/data/secondmates.md"
   fakebin=$(make_launch_capturing_tmux "$world/tmux-$id")
   : > "$launchlog"
   PATH="$fakebin:$BASE_PATH" TMUX='' CLAUDECODE=1 \
-    FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$world/home" \
+    FM_ROOT_OVERRIDE="$PRIMARY_ROOT" FM_HOME="$world/home" \
     FM_STATE_OVERRIDE="$world/home/state" FM_DATA_OVERRIDE="$world/home/data" \
     FM_PROJECTS_OVERRIDE="$world/home/projects" FM_CONFIG_OVERRIDE="$world/home/config" \
     FM_SPAWN_NO_GUARD=1 FM_FAKE_LAUNCH_LOG="$launchlog" \
@@ -654,7 +669,16 @@ test_spawn_fallback_chain_and_crew_scout_unaffected() {
   proj="$w/crew-project"
   wt="$w/crew-wt"
   fakebin=$(make_launch_capturing_tmux "$w/tmux-crew")
-  fm_git_worktree "$proj" "$wt" "wt-crew"
+  fm_git_init_commit "$proj"
+  git -C "$proj" worktree add --quiet --detach "$wt"
+  mkdir -p "$w/treehouse"
+  cat > "$fakebin/treehouse" <<'SH'
+#!/usr/bin/env bash
+set -u
+[ "${1:-}" = get ] || exit 1
+printf '%s\n' "${FM_FAKE_TREEHOUSE_WORKTREE:?}"
+SH
+  chmod +x "$fakebin/treehouse"
   mkdir -p "$home/data/$id" "$home/projects" "$home/state"
   printf 'brief\n' > "$home/data/$id/brief.md"
   : > "$launchlog"
@@ -665,7 +689,9 @@ test_spawn_fallback_chain_and_crew_scout_unaffected() {
     FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
     FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
     FM_PROJECTS_OVERRIDE="$home/projects" FM_CONFIG_OVERRIDE="$home/config" \
+    FM_TREEHOUSE_ROOT="$w/treehouse" \
     FM_SPAWN_NO_GUARD=1 FM_FAKE_PANE_PATH="$wt" FM_FAKE_LAUNCH_LOG="$launchlog" \
+    FM_FAKE_TREEHOUSE_WORKTREE="$wt" \
     "$ROOT/bin/fm-spawn.sh" "$id" "$proj" >/dev/null 2>"$spawn_err"
   spawn_rc=$?
   expect_code 0 "$spawn_rc" "crew-unaffected spawn should succeed: $(cat "$spawn_err")"
diff --git a/tests/fm-secondmate-lifecycle-e2e.test.sh b/tests/fm-secondmate-lifecycle-e2e.test.sh
index fd71fdb359..16bdd86d13 100755
--- a/tests/fm-secondmate-lifecycle-e2e.test.sh
+++ b/tests/fm-secondmate-lifecycle-e2e.test.sh
@@ -30,6 +30,11 @@ set -u
 TMP_ROOT=$(fm_test_tmproot fm-secondmate-lifecycle)
 export FM_BACKEND=tmux
 
+PRIMARY_ROOT="$TMP_ROOT/primary"
+git init -q -b main "$PRIMARY_ROOT"
+git -C "$PRIMARY_ROOT" fetch -q --no-tags "$ROOT" HEAD
+git -C "$PRIMARY_ROOT" reset -q --hard FETCH_HEAD
+
 HOME_DIR="$TMP_ROOT/main home"
 SUB="$TMP_ROOT/design-home"
 SUB_ABS=
@@ -70,7 +75,7 @@ EOF
 
 phase_seed() {
   local out
-  out=$(PATH="$FAKEBIN:$PATH" FM_HOME="$HOME_DIR" \
+  out=$(PATH="$FAKEBIN:$PATH" FM_ROOT_OVERRIDE="$PRIMARY_ROOT" FM_HOME="$HOME_DIR" \
     "$ROOT/bin/fm-home-seed.sh" design "$SUB" alpha beta gamma) \
     || fail "seed failed"
   SUB_ABS=$(cd "$SUB" && pwd -P)
@@ -93,6 +98,7 @@ phase_seed() {
   assert_present "$SUB/projects/gamma/.no-mistakes-init" "no-mistakes project was not initialized in the subhome"
   assert_present "$SUB/projects/gamma/.no-mistakes-doctor" "no-mistakes project was not doctored in the subhome"
   assert_absent "$HOME_DIR/projects/gamma/.no-mistakes-init" "seed wrote no-mistakes state through the parent project"
+  rm -f "$SUB/projects/gamma/.no-mistakes-init" "$SUB/projects/gamma/.no-mistakes-doctor"
 
   # Registry line: scope from the filled brief, project list, no legacy owns field.
   assert_grep '- design - customer onboarding charter' "$HOME_DIR/data/secondmates.md" "registry summary not from the charter"
@@ -112,7 +118,7 @@ phase_seed() {
 
 phase_spawn() {
   : > "$LOG"
-  PATH="$FAKEBIN:$PATH" FM_HOME="$HOME_DIR" FM_CONFIG_OVERRIDE="$HOME_DIR/parent-config" \
+  PATH="$FAKEBIN:$PATH" FM_ROOT_OVERRIDE="$PRIMARY_ROOT" FM_HOME="$HOME_DIR" FM_CONFIG_OVERRIDE="$HOME_DIR/parent-config" \
     FM_FAKE_TMUX_LOG="$LOG" FM_FAKE_TMUX_CAPTURE="$PANE" \
     "$ROOT/bin/fm-spawn.sh" design "$SUB" codex --secondmate >/dev/null \
     || fail "secondmate spawn failed"
@@ -198,7 +204,7 @@ phase_recovery() {
   # Simulate a restart: drop the live meta, then respawn from the registry +
   # persistent home (no explicit home argument).
   rm -f "$HOME_DIR/state/design.meta"
-  PATH="$FAKEBIN:$PATH" FM_HOME="$HOME_DIR" FM_FAKE_TMUX_LOG="$LOG" FM_FAKE_TMUX_CAPTURE="$PANE" \
+  PATH="$FAKEBIN:$PATH" FM_ROOT_OVERRIDE="$PRIMARY_ROOT" FM_HOME="$HOME_DIR" FM_FAKE_TMUX_LOG="$LOG" FM_FAKE_TMUX_CAPTURE="$PANE" \
     "$ROOT/bin/fm-spawn.sh" design "echo relaunch" --secondmate >/dev/null 2>&1 \
     || fail "recovery respawn failed"
   local meta="$HOME_DIR/state/design.meta"
@@ -211,7 +217,8 @@ phase_recovery() {
 phase_teardown() {
   local teardown_out
   : > "$LOG"
-  teardown_out=$(PATH="$FAKEBIN:$PATH" FM_HOME="$HOME_DIR" FM_FAKE_TMUX_LOG="$LOG" FM_FAKE_TMUX_CAPTURE="$PANE" \
+  teardown_out=$(PATH="$FAKEBIN:$PATH" FM_ROOT_OVERRIDE="$PRIMARY_ROOT" FM_PROJECTS_OVERRIDE="$HOME_DIR/projects" \
+    FM_HOME="$HOME_DIR" FM_FAKE_TMUX_LOG="$LOG" FM_FAKE_TMUX_CAPTURE="$PANE" \
     "$ROOT/bin/fm-teardown.sh" design 2>&1) \
     || fail "teardown failed for the empty secondmate home"
   printf '%s\n' "$teardown_out" | grep -F 'Backlog:' >/dev/null \
diff --git a/tests/fm-secondmate-liveness.test.sh b/tests/fm-secondmate-liveness.test.sh
index 345b2b65b3..cbcc1616ed 100755
--- a/tests/fm-secondmate-liveness.test.sh
+++ b/tests/fm-secondmate-liveness.test.sh
@@ -40,6 +40,8 @@ set -u
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 BASE_PATH=${FM_TEST_BASE_PATH:-/usr/bin:/bin:/usr/sbin:/sbin}
+FM_TEST_REAL_NODE=$(command -v node)
+export FM_TEST_REAL_NODE
 fm_git_identity fmtest fmtest@example.com
 
 TMP_ROOT=$(fm_test_tmproot fm-secondmate-liveness)
@@ -187,7 +189,17 @@ test_agent_alive_dispatcher_routes_and_falls_back() {
 make_toolchain() {
   local dir=$1 fakebin
   fakebin=$(fm_fakebin "$dir")
-  fm_fake_exit0 "$fakebin" node gh-axi chrome-devtools-axi lavish-axi
+  fm_fake_exit0 "$fakebin" gh-axi chrome-devtools-axi lavish-axi
+  cat > "$fakebin/node" <<'SH'
+#!/usr/bin/env bash
+case "${1:-}" in
+  */fm-contained-read.cjs)
+    exec "${FM_TEST_REAL_NODE:?}" "$@"
+    ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/node"
   cat > "$fakebin/gh" <<'SH'
 #!/usr/bin/env bash
 exit 0
@@ -541,12 +553,23 @@ SH
 }
 
 test_enforced_recovery_sweep_installs_meta_with_inherited_lock() {
-  local w workspace fb tmuxfb fake_root fake_af log out meta account_task native_dir_file refreshed
+  local w workspace primary_tip spawn_root fb tmuxfb fake_root fake_af log out meta account_task native_dir_file refreshed
   w=$(new_world sweep-enforced-inherited-lock)
   add_sm_home "$w" sm1 firstmate:fm-sm1 claude
+  primary_tip=$(git -C "$ROOT" rev-parse HEAD)
+  rm -rf "$w/sm1"
+  git clone -q --no-checkout "$ROOT" "$w/sm1"
+  git -C "$w/sm1" branch --force main "$primary_tip"
+  git -C "$w/sm1" checkout -q --detach "$primary_tip"
+  mkdir -p "$w/sm1/bin" "$w/sm1/data" "$w/sm1/state" "$w/sm1/config" "$w/sm1/projects"
+  printf '%s\n' sm1 > "$w/sm1/.fm-secondmate-home"
+  printf 'charter\n' > "$w/sm1/data/charter.md"
   workspace=$(cd "$w/sm1" && pwd -P)
   meta="$w/home/state/sm1.meta"
   account_task=fm-test-sm1-a1234
+  mkdir -p "$w/home/data/sm1"
+  printf -- '- sm1 - test secondmate (home: %s; scope: test; projects: ; added 2026-07-13)\n' \
+    "$workspace" > "$w/home/data/secondmates.md"
   cat >> "$meta" <<EOF
 worktree=$workspace
 project=$workspace
@@ -560,16 +583,18 @@ account_attempt=a1234
 provider_session_id=sess-$account_task
 generation_id=account:$account_task:a1234
 EOF
-  mkdir -p "$w/home/data/sm1"
   printf 'enforce\n' > "$w/home/config/account-routing-mode"
-  cp "$ROOT/bin/fm-account-routing-lib.sh" "$w/sm1/bin/fm-account-routing-lib.sh"
-  cp "$ROOT/bin/fm-spawn.sh" "$w/sm1/bin/fm-spawn.sh"
 
+  spawn_root="$w/spawn-root"
+  git clone -q --no-checkout "$ROOT" "$spawn_root"
+  git -C "$spawn_root" checkout -q -B main "$primary_tip"
+  git -C "$spawn_root" remote set-url origin "file://$spawn_root"
+  git -C "$w/sm1" remote set-url origin "file://$spawn_root"
   fake_root="$w/fake-root"
   mkdir -p "$fake_root/bin"
   cat > "$fake_root/bin/fm-spawn.sh" <<'SH'
 #!/usr/bin/env bash
-FM_ROOT_OVERRIDE="$FM_TEST_REAL_ROOT" "$FM_TEST_REAL_ROOT/bin/fm-spawn.sh" "$@" > "$FM_MANAGED_SPAWN_OUT" 2>&1
+FM_ROOT_OVERRIDE="$FM_TEST_SPAWN_ROOT" "$FM_TEST_SPAWN_ROOT/bin/fm-spawn.sh" "$@" > "$FM_MANAGED_SPAWN_OUT" 2>&1
 status=$?
 cat "$FM_MANAGED_SPAWN_OUT"
 exit "$status"
@@ -623,6 +648,7 @@ SH
   refreshed="$w/session-refreshed"
   out=$(run_bootstrap "$tmuxfb:$fb" "$w/home" zsh "$log" \
     FM_ROOT_OVERRIDE="$fake_root" FM_TEST_REAL_ROOT="$ROOT" \
+    FM_TEST_SPAWN_ROOT="$spawn_root" \
     FM_AGENT_FLEET_BIN="$fake_af" FM_ACCOUNT_SESSION_WAIT_SECONDS=2 \
     FM_MANAGED_WORKSPACE="$workspace" \
     FM_MANAGED_NATIVE_DIR_FILE="$native_dir_file" FM_MANAGED_SESSION_REFRESHED="$refreshed" \
diff --git a/tests/fm-secondmate-safety.test.sh b/tests/fm-secondmate-safety.test.sh
index f1c956e44d..2fb4d2bb69 100755
--- a/tests/fm-secondmate-safety.test.sh
+++ b/tests/fm-secondmate-safety.test.sh
@@ -9,6 +9,8 @@ set -u
 
 # shellcheck source=tests/secondmate-helpers.sh disable=SC1091
 . "$(dirname "${BASH_SOURCE[0]}")/secondmate-helpers.sh"
+# shellcheck source=bin/fm-checkout-lock-lib.sh disable=SC1091
+. "$ROOT/bin/fm-checkout-lock-lib.sh"
 
 TMP_ROOT=$(fm_test_tmproot fm-secondmate-safety)
 export FM_BACKEND=tmux
@@ -29,6 +31,11 @@ make_live_default_firstmate_worktree() {
   printf '%s\n' "$source"
 }
 
+FM_ROOT_OVERRIDE=$(make_live_default_firstmate_worktree \
+  "$TMP_ROOT/default-firstmate-home" default-firstmate)
+git -C "$FM_ROOT_OVERRIDE" remote set-url origin "file://$FM_ROOT_OVERRIDE"
+export FM_ROOT_OVERRIDE
+
 write_secondmate_registration() {
   local home=$1 id=$2 target=$3 target_abs
   mkdir -p "$home/data"
@@ -239,7 +246,7 @@ test_home_seed_uses_treehouse_acquired_home() {
 }
 
 test_home_seed_acquisition_honors_shared_checkout_lock() {
-  local home acquired fakebin log err source common key lock_root lock state_root
+  local home acquired fakebin log err source lock_root lock state_root
   home="$TMP_ROOT/dash-lock-home"
   acquired="$TMP_ROOT/dash-lock-acquired-home"
   err="$TMP_ROOT/dash-lock.err"
@@ -252,11 +259,7 @@ test_home_seed_acquisition_honors_shared_checkout_lock() {
   log="$TMP_ROOT/dash-lock-fake/tmux.log"
   state_root="$TMP_ROOT/dash-lock-state"
   lock_root="$TMP_ROOT/dash-lock-locks"
-  common=$(git -C "$source" rev-parse --git-common-dir)
-  case "$common" in /*) ;; *) common="$source/$common" ;; esac
-  common=$(cd "$common" && pwd -P)
-  key=$(printf '%s' "$common" | shasum -a 256 | awk '{print substr($1,1,24)}')
-  lock="$lock_root/$key.lock"
+  lock=$(fm_checkout_lock_path "$source" "$lock_root")
   mkdir -p "$lock" "$state_root"
   printf '%s\n' "$$" > "$lock/pid"
 
@@ -395,7 +398,7 @@ test_home_seed_retains_repository_mismatch_acquisition() {
 }
 
 test_home_seed_returns_treehouse_acquired_home_on_assignment_failure() {
-  local home acquired acquired_abs fakebin log err source common key lock_root expected_lock lock_marker
+  local home acquired acquired_abs fakebin log err source lock_root expected_lock lock_marker
   home="$TMP_ROOT/dash-fail-home"
   acquired="$TMP_ROOT/dash-fail-acquired-home"
   err="$TMP_ROOT/dash-fail.err"
@@ -405,12 +408,8 @@ test_home_seed_returns_treehouse_acquired_home_on_assignment_failure() {
   printf '%s\n' '- alpha [direct-PR] - alpha project (added 2026-06-22)' > "$home/data/projects.md"
   source=$(make_live_default_firstmate_worktree "$acquired" dash-fail-firstmate)
   acquired_abs=$(cd "$acquired" && pwd -P)
-  common=$(git -C "$acquired" rev-parse --git-common-dir)
-  case "$common" in /*) ;; *) common="$acquired/$common" ;; esac
-  common=$(cd "$common" && pwd -P)
-  key=$(printf '%s' "$common" | shasum -a 256 | awk '{print substr($1,1,24)}')
   lock_root="$TMP_ROOT/dash-fail-locks"
-  expected_lock="$lock_root/$key.lock"
+  expected_lock=$(fm_checkout_lock_path "$acquired" "$lock_root")
   lock_marker="$TMP_ROOT/dash-fail-return-held-lock"
   printf 'other\n' > "$acquired/.fm-secondmate-home"
   fakebin=$(make_fake_tmux "$TMP_ROOT/dash-fail-fake")
@@ -468,7 +467,7 @@ test_home_seed_warns_when_acquired_home_return_fails() {
 }
 
 test_home_seed_does_not_return_unsafe_acquired_home() {
-  local home descendant fakebin log err
+  local home descendant fakebin log err source source_home
   home="$TMP_ROOT/dash-active-home"
   descendant="$home/data/dash-descendant-home"
   err="$TMP_ROOT/dash-active.err"
@@ -478,8 +477,12 @@ test_home_seed_does_not_return_unsafe_acquired_home() {
   printf '%s\n' '- alpha [direct-PR] - alpha project (added 2026-06-22)' > "$home/data/projects.md"
   fakebin=$(make_fake_tmux "$TMP_ROOT/dash-active-fake")
   log="$TMP_ROOT/dash-active-fake/tmux.log"
+  source_home="$TMP_ROOT/dash-active-source-home"
+  source=$(make_live_default_firstmate_worktree "$source_home" dash-active-firstmate)
 
   if PATH="$fakebin:$PATH" FM_HOME="$home" FM_FAKE_TREEHOUSE_HOME="$home" FM_FAKE_TMUX_LOG="$log" \
+    FM_ROOT_OVERRIDE="$source" \
+    FM_SECONDMATE_CHARTER='unsafe active home test' FM_SECONDMATE_SCOPE='unsafe active home test' \
     "$ROOT/bin/fm-home-seed.sh" dash - alpha >/dev/null 2>"$err"; then
     fail "seed accepted an acquired home matching the active firstmate home"
   fi
@@ -491,6 +494,8 @@ test_home_seed_does_not_return_unsafe_acquired_home() {
 
   : > "$log"
   if PATH="$fakebin:$PATH" FM_HOME="$home" FM_FAKE_TREEHOUSE_HOME="$descendant" FM_FAKE_TMUX_LOG="$log" \
+    FM_ROOT_OVERRIDE="$source" \
+    FM_SECONDMATE_CHARTER='unsafe descendant home test' FM_SECONDMATE_SCOPE='unsafe descendant home test' \
     "$ROOT/bin/fm-home-seed.sh" dash - alpha >/dev/null 2>"$err"; then
     fail "seed accepted an acquired home inside the active firstmate home"
   fi
@@ -781,9 +786,10 @@ test_home_seed_refuses_projectful_reused_charter_for_projectless_home() {
   stale_brief="$home/data/stale/brief.md"
   stale_brief_before="$TMP_ROOT/no-projects-reused-charter.before"
   err="$TMP_ROOT/no-projects-reused-charter.err"
-  mkdir -p "$home/data" "$home/state" "$reusable_sub/data" "$stale_sub/data"
-  mark_firstmate_home "$reusable_sub"
-  mark_firstmate_home "$stale_sub"
+  mkdir -p "$home/data" "$home/state"
+  git clone -q "$FM_ROOT_OVERRIDE" "$reusable_sub"
+  git clone -q "$FM_ROOT_OVERRIDE" "$stale_sub"
+  mkdir -p "$reusable_sub/data" "$stale_sub/data"
 
   scaffold_secondmate_charter "$home" reusable 'firstmate self-development' --no-projects \
     || fail "project-less charter scaffold failed"
@@ -822,8 +828,9 @@ test_home_seed_refuses_projectless_conversion_of_populated_home() {
   home="$TMP_ROOT/no-projects-conversion-home"
   sub="$TMP_ROOT/no-projects-conversion-subhome"
   err="$TMP_ROOT/no-projects-conversion.err"
-  mkdir -p "$home/data" "$home/state" "$sub/data" "$sub/projects/existing-clone"
-  mark_firstmate_home "$sub"
+  mkdir -p "$home/data" "$home/state"
+  git clone -q "$FM_ROOT_OVERRIDE" "$sub"
+  mkdir -p "$sub/data" "$sub/projects/existing-clone"
   fm_git_init_commit "$sub/projects/existing-clone"
   cat > "$sub/data/projects.md" <<EOF
 - registry-only [direct-PR] - retained project entry (added 2026-06-22)
@@ -1063,7 +1070,7 @@ test_home_seed_refuses_active_home_and_root() {
   root_descendant="$root_clone/tmp/design-home"
   root_ancestor="$TMP_ROOT/active-seed-root-ancestor"
   root_inside="$root_ancestor/nested-root"
-  git clone --quiet "$ROOT" "$active_ancestor"
+  git clone --quiet "$FM_ROOT_OVERRIDE" "$active_ancestor"
   mkdir -p "$home/projects" "$home/data" "$home/state"
   fm_git_init_commit "$home/projects/alpha"
   fm_git_add_origin "$home/projects/alpha" "$TMP_ROOT/remotes/active-alpha.git"
@@ -1090,13 +1097,13 @@ test_home_seed_refuses_active_home_and_root() {
     || fail "seed did not explain active FM_HOME ancestor rejection"
   [ ! -f "$active_ancestor/.fm-secondmate-home" ] || fail "seed marked an ancestor of active FM_HOME"
 
-  if FM_HOME="$home" "$ROOT/bin/fm-home-seed.sh" design "$ROOT" alpha >/dev/null 2>"$err"; then
+  if FM_HOME="$home" "$ROOT/bin/fm-home-seed.sh" design "$FM_ROOT_OVERRIDE" alpha >/dev/null 2>"$err"; then
     fail "seed allowed secondmate home to reuse FM_ROOT"
   fi
   grep -F 'secondmate home cannot be the firstmate repo' "$err" >/dev/null \
     || fail "seed did not explain FM_ROOT rejection"
 
-  git clone --quiet "$ROOT" "$root_clone"
+  git clone --quiet "$FM_ROOT_OVERRIDE" "$root_clone"
   if FM_HOME="$home" FM_ROOT_OVERRIDE="$root_clone" "$ROOT/bin/fm-home-seed.sh" design "$root_descendant" alpha >/dev/null 2>"$err"; then
     fail "seed allowed secondmate home inside FM_ROOT"
   fi
@@ -1104,8 +1111,8 @@ test_home_seed_refuses_active_home_and_root() {
     || fail "seed did not explain FM_ROOT descendant rejection"
   [ ! -e "$root_clone/tmp" ] || fail "seed created a directory inside FM_ROOT before descendant rejection"
 
-  git clone --quiet "$ROOT" "$root_ancestor"
-  git clone --quiet "$ROOT" "$root_inside"
+  git clone --quiet "$FM_ROOT_OVERRIDE" "$root_ancestor"
+  git clone --quiet "$FM_ROOT_OVERRIDE" "$root_inside"
   if FM_HOME="$home" FM_ROOT_OVERRIDE="$root_inside" "$ROOT/bin/fm-home-seed.sh" design "$root_ancestor" alpha >/dev/null 2>"$err"; then
     fail "seed allowed secondmate home to contain FM_ROOT"
   fi
@@ -1123,7 +1130,7 @@ test_home_seed_refuses_home_marked_for_another_id() {
   mkdir -p "$home/projects" "$home/data" "$home/state"
   fm_git_init_commit "$home/projects/alpha"
   fm_git_add_origin "$home/projects/alpha" "$TMP_ROOT/remotes/marked-alpha.git"
-  git clone --quiet "$ROOT" "$subhome"
+  git clone --quiet "$FM_ROOT_OVERRIDE" "$subhome"
   printf 'other\n' > "$subhome/.fm-secondmate-home"
   printf '%s\n' '- alpha [direct-PR] - alpha project (added 2026-06-22)' > "$home/data/projects.md"
   scaffold_secondmate_charter "$home" design 'design domain' alpha || fail "charter scaffold failed for marked-home seed test"
@@ -1144,7 +1151,7 @@ test_home_seed_refuses_home_registered_to_another_id() {
   mkdir -p "$home/projects" "$home/data" "$home/state"
   fm_git_init_commit "$home/projects/alpha"
   fm_git_add_origin "$home/projects/alpha" "$TMP_ROOT/remotes/registered-alpha.git"
-  git clone --quiet "$ROOT" "$subhome"
+  git clone --quiet "$FM_ROOT_OVERRIDE" "$subhome"
   subhome_abs=$(cd "$subhome" && pwd -P)
   printf '%s\n' '- alpha [direct-PR] - alpha project (added 2026-06-22)' > "$home/data/projects.md"
   printf '%s\n' '- other - other domain (home: '"$subhome_abs"'; scope: other domain; projects: beta; added 2026-06-22)' > "$home/data/secondmates.md"
@@ -1201,13 +1208,15 @@ test_home_seed_refuses_home_overlapping_registered_home() {
   mkdir -p "$home/projects" "$home/data" "$home/state"
   fm_git_init_commit "$home/projects/alpha"
   fm_git_add_origin "$home/projects/alpha" "$TMP_ROOT/remotes/overlap-alpha.git"
-  git clone --quiet "$ROOT" "$registered_parent"
-  git clone --quiet "$ROOT" "$registered_child"
+  git clone --quiet "$FM_ROOT_OVERRIDE" "$registered_parent"
+  git clone --quiet "$FM_ROOT_OVERRIDE" "$registered_child"
   printf '%s\n' '- alpha [direct-PR] - alpha project (added 2026-06-22)' > "$home/data/projects.md"
   cat > "$home/data/secondmates.md" <<EOF
 - parent - parent domain (home: $registered_parent; scope: parent domain; projects: beta; added 2026-06-22)
 - child - child domain (home: $registered_child; scope: child domain; projects: gamma; added 2026-06-22)
 EOF
+  scaffold_secondmate_charter "$home" design 'design domain' alpha \
+    || fail "charter scaffold failed for registered-overlap seed test"
 
   if FM_HOME="$home" "$ROOT/bin/fm-home-seed.sh" design "$nested" alpha >/dev/null 2>"$err"; then
     fail "seed accepted a home inside a registered secondmate home"
@@ -1250,7 +1259,7 @@ test_home_seed_refuses_existing_remote_backed_project_with_wrong_origin() {
   mkdir -p "$home/projects" "$home/data" "$home/state"
   fm_git_init_commit "$home/projects/alpha"
   fm_git_add_origin "$home/projects/alpha" "$TMP_ROOT/remotes/wrong-alpha.git"
-  git clone --quiet "$ROOT" "$subhome"
+  git clone --quiet "$FM_ROOT_OVERRIDE" "$subhome"
   subhome_abs=$(cd "$subhome" && pwd -P)
   mkdir -p "$subhome/projects"
   git clone --quiet "$home/projects/alpha" "$subhome/projects/alpha"
@@ -1302,7 +1311,7 @@ test_home_seed_skips_initialized_existing_no_mistakes_projects() {
   fm_git_init_commit "$home/projects/beta"
   fm_git_add_origin "$home/projects/alpha" "$TMP_ROOT/remotes/existing-alpha.git"
   fm_git_add_origin "$home/projects/beta" "$TMP_ROOT/remotes/existing-beta.git"
-  git clone --quiet "$ROOT" "$subhome"
+  git clone --quiet "$FM_ROOT_OVERRIDE" "$subhome"
   mkdir -p "$subhome/projects"
   origin=$(git -C "$home/projects/alpha" remote get-url origin)
   git clone --quiet "$origin" "$subhome/projects/alpha"
@@ -1335,7 +1344,7 @@ test_home_seed_refuses_uninitialized_existing_no_mistakes_project() {
   mkdir -p "$home/projects" "$home/data" "$home/state"
   fm_git_init_commit "$home/projects/alpha"
   fm_git_add_origin "$home/projects/alpha" "$TMP_ROOT/remotes/uninitialized-alpha.git"
-  git clone --quiet "$ROOT" "$subhome"
+  git clone --quiet "$FM_ROOT_OVERRIDE" "$subhome"
   mkdir -p "$subhome/projects"
   origin=$(git -C "$home/projects/alpha" remote get-url origin)
   git clone --quiet "$origin" "$subhome/projects/alpha"
@@ -1364,7 +1373,7 @@ test_home_seed_refuses_project_destinations_outside_subhome() {
   mkdir -p "$home/projects" "$home/data" "$home/state" "$sink"
   fm_git_init_commit "$home/projects/alpha"
   fm_git_add_origin "$home/projects/alpha" "$TMP_ROOT/remotes/symlink-alpha.git"
-  git clone --quiet "$ROOT" "$subhome"
+  git clone --quiet "$FM_ROOT_OVERRIDE" "$subhome"
   rm -rf "$subhome/projects"
   ln -s "$sink" "$subhome/projects"
   printf '%s\n' '- alpha [direct-PR] - alpha project (added 2026-06-22)' > "$home/data/projects.md"
@@ -1394,7 +1403,7 @@ test_home_seed_refuses_operational_dirs_outside_subhome() {
     subhome="$TMP_ROOT/symlink-opdir-subhome-$opdir"
     sink="$home/data/symlink-opdir-$opdir"
     rm -rf "$subhome" "$sink"
-    git clone --quiet "$ROOT" "$subhome"
+    git clone --quiet "$FM_ROOT_OVERRIDE" "$subhome"
     mkdir -p "$sink"
     rm -rf "${subhome:?}/${opdir:?}"
     ln -s "$sink" "$subhome/$opdir"
@@ -1422,7 +1431,7 @@ test_home_seed_refuses_symlinked_leaf_files() {
     subhome="$TMP_ROOT/symlink-leaf-subhome-${leaf//\//-}"
     sink="$home/data/symlink-leaf-${leaf//\//-}"
     rm -rf "$subhome" "$sink"
-    git clone --quiet "$ROOT" "$subhome"
+    git clone --quiet "$FM_ROOT_OVERRIDE" "$subhome"
     mkdir -p "$(dirname "$subhome/$leaf")" "$(dirname "$sink")"
     expected=outside
     if [ "$leaf" = ".fm-secondmate-home" ]; then
@@ -1514,9 +1523,9 @@ SH
   fi
   grep -F 'secondmate home cannot be the active firstmate home' "$err" >/dev/null || fail "spawn did not reject active home"
 
-  write_secondmate_registration "$home" domain "$ROOT"
+  write_secondmate_registration "$home" domain "$FM_ROOT_OVERRIDE"
   if PATH="$fakebin:$PATH" FM_HOME="$home" FM_FAKE_TMUX_LOG="$log" FM_FAKE_TMUX_CAPTURE="$TMP_ROOT/spawn-validate-fake/pane.txt" \
-    "$ROOT/bin/fm-spawn.sh" domain "$ROOT" codex --secondmate >/dev/null 2>"$err"; then
+    "$ROOT/bin/fm-spawn.sh" domain "$FM_ROOT_OVERRIDE" codex --secondmate >/dev/null 2>"$err"; then
     fail "secondmate spawn accepted the firstmate repo root"
   fi
   grep -F 'secondmate home cannot be the firstmate repo' "$err" >/dev/null || fail "spawn did not reject firstmate repo root"
diff --git a/tests/fm-secondmate-sync.test.sh b/tests/fm-secondmate-sync.test.sh
index 232f038f88..602f427702 100755
--- a/tests/fm-secondmate-sync.test.sh
+++ b/tests/fm-secondmate-sync.test.sh
@@ -405,6 +405,12 @@ case "\$cmd \$sub" in
       printf '{"error":{"code":"agent_not_found","message":"gone"}}\n' >&2
     fi
     ;;
+  "agent send")
+    if [ "\$arg" = "${stale#*:}" ]; then
+      exit 1
+    fi
+    exit 0
+    ;;
   "pane send-text"|"pane run"|"pane send-keys")
     if [ "\$arg" = "${stale#*:}" ]; then
       exit 1
@@ -529,6 +535,8 @@ test_spawn_fast_forwards_before_launch() {
   printf 'sm\n' > "$w/sm/.fm-secondmate-home"
   mkdir -p "$w/sm/data"
   printf 'charter\n' > "$w/sm/data/charter.md"
+  printf -- '- sm - sync test (home: %s; scope: sync test; projects: ; added 2026-07-27)\n' \
+    "$w/sm" > "$w/home/data/secondmates.md"
   bump_primary "$w" instr
   c2=$(head_of "$w/main")
   [ "$(head_of "$w/sm")" = "$c1" ] || fail "precondition: home should start behind the primary"
@@ -542,12 +550,15 @@ exit 0
 SH
   chmod +x "$fakebin/tmux"
 
-  PATH="$fakebin:$BASE_PATH" TMUX='' \
-    FM_ROOT_OVERRIDE="$w/main" FM_HOME="$w/home" \
-    FM_STATE_OVERRIDE="$w/home/state" FM_DATA_OVERRIDE="$w/home/data" \
-    FM_PROJECTS_OVERRIDE="$w/home/projects" FM_CONFIG_OVERRIDE="$w/home/config" \
-    FM_SPAWN_NO_GUARD=1 \
-    "$ROOT/bin/fm-spawn.sh" sm "$w/sm" codex --secondmate >/dev/null 2>&1 || true
+  (
+    unset NO_MISTAKES_GATE
+    PATH="$fakebin:$BASE_PATH" TMUX='' \
+      FM_ROOT_OVERRIDE="$w/main" FM_HOME="$w/home" \
+      FM_STATE_OVERRIDE="$w/home/state" FM_DATA_OVERRIDE="$w/home/data" \
+      FM_PROJECTS_OVERRIDE="$w/home/projects" FM_CONFIG_OVERRIDE="$w/home/config" \
+      FM_SPAWN_NO_GUARD=1 \
+      "$ROOT/bin/fm-spawn.sh" sm "$w/sm" codex --secondmate >/dev/null 2>&1
+  ) || true
 
   [ "$(head_of "$w/sm")" = "$c2" ] \
     || fail "spawn did not fast-forward the secondmate worktree to the primary's HEAD"
@@ -563,6 +574,8 @@ test_spawn_warns_when_sync_skipped_before_launch() {
   printf 'sm\n' > "$w/sm/.fm-secondmate-home"
   mkdir -p "$w/sm/data"
   printf 'charter\n' > "$w/sm/data/charter.md"
+  printf -- '- sm - sync test (home: %s; scope: sync test; projects: ; added 2026-07-27)\n' \
+    "$w/sm" > "$w/home/data/secondmates.md"
   bump_primary "$w" instr
   printf 'uncommitted local edit\n' >> "$w/sm/AGENTS.md"
   before=$(head_of "$w/sm")
@@ -584,11 +597,11 @@ SH
     "$ROOT/bin/fm-spawn.sh" sm "$w/sm" codex --secondmate >/dev/null 2>"$err" || true
 
   assert_contains "$(cat "$err")" \
-    "warning: secondmate sm sync skipped before launch: dirty working tree" \
-    "spawn warning reports the skipped sync reason"
+    "error: refusing secondmate launch because its home freshness is unresolved: secondmate sm: skipped: dirty working tree" \
+    "spawn refusal reports the skipped sync reason"
   [ "$(head_of "$w/sm")" = "$before" ] || fail "dirty spawn home HEAD moved"
   grep -q 'uncommitted local edit' "$w/sm/AGENTS.md" || fail "dirty spawn edit was discarded"
-  pass "T11 spawn warns when pre-launch sync is skipped"
+  pass "T11 spawn refuses when pre-launch sync is skipped"
 }
 
 # --- T12: a freshly seeded home reads clean once the primary ignores the marker -
diff --git a/tests/fm-spawn-dispatch-profile.test.sh b/tests/fm-spawn-dispatch-profile.test.sh
index 477e8b9541..8fc0317746 100755
--- a/tests/fm-spawn-dispatch-profile.test.sh
+++ b/tests/fm-spawn-dispatch-profile.test.sh
@@ -42,7 +42,14 @@ esac
 exit 0
 SH
   chmod +x "$fakebin/tmux"
-  fm_fake_exit0 "$fakebin" treehouse
+  cat > "$fakebin/treehouse" <<'SH'
+#!/usr/bin/env bash
+if [ "${1:-}" = get ]; then
+  printf '%s\n' "${FM_FAKE_PANE_PATH:?}"
+fi
+exit 0
+SH
+  chmod +x "$fakebin/treehouse"
   printf '%s\n' "$fakebin"
 }
 
@@ -58,6 +65,7 @@ make_spawn_case() {
   mkdir -p "$home/data" "$home/projects" "$home/state" "$home/config"
   printf '%s\n' "$harness" > "$home/config/crew-harness"
   fm_git_worktree "$proj" "$wt" "wt-$name"
+  git -C "$wt" checkout --quiet --detach
   touch "$home/state/.last-watcher-beat"
   for id in "$@"; do
     mkdir -p "$home/data/$id"
@@ -75,7 +83,7 @@ enable_dispatch_profile() {
 make_seeded_secondmate_home() {
   local home=$1 id=$2
   mkdir -p "$home/bin" "$home/data"
-  printf '# Firstmate\n' > "$home/AGENTS.md"
+  [ -f "$home/AGENTS.md" ] || printf '# Firstmate\n' > "$home/AGENTS.md"
   printf '%s\n' "$id" > "$home/.fm-secondmate-home"
   printf 'charter for %s\n' "$id" > "$home/data/charter.md"
 }
@@ -84,12 +92,15 @@ run_spawn() {
   local home=$1 wt=$2 fakebin=$3 launchlog=$4
   shift 4
   : > "$launchlog"
-  FM_ROOT_OVERRIDE='' FM_HOME="$home" \
-    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
-    FM_PROJECTS_OVERRIDE="$home/projects" FM_CONFIG_OVERRIDE="$home/config" \
-    FM_SPAWN_NO_GUARD=1 FM_FAKE_PANE_PATH="$wt" TMUX="fake,1,0" \
-    FM_FAKE_LAUNCH_LOG="$launchlog" GROK_HOME="$home/grok-home" PATH="$fakebin:$PATH" \
-    "$SPAWN" "$@" 2>&1
+  (
+    unset NO_MISTAKES_GATE
+    FM_ROOT_OVERRIDE="${FM_TEST_ROOT_OVERRIDE:-}" FM_HOME="$home" \
+      FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
+      FM_PROJECTS_OVERRIDE="$home/projects" FM_CONFIG_OVERRIDE="$home/config" \
+      FM_SPAWN_NO_GUARD=1 FM_FAKE_PANE_PATH="$wt" TMUX="fake,1,0" \
+      FM_FAKE_LAUNCH_LOG="$launchlog" GROK_HOME="$home/grok-home" PATH="$fakebin:$PATH" \
+      "$SPAWN" "$@" 2>&1
+  )
 }
 
 read_case_record() {
@@ -371,10 +382,25 @@ test_active_dispatch_profile_does_not_block_secondmate_launch() {
   rec=$(make_spawn_case profile-secondmate codex "$id")
   read_case_record "$rec"
   enable_dispatch_profile "$HOME_DIR"
+  mkdir -p "$PROJ_DIR/bin"
+  printf '# Firstmate\n' > "$PROJ_DIR/AGENTS.md"
+  printf '%s\n' '.fm-secondmate-home' 'config/' 'data/' 'projects/' 'state/' > "$PROJ_DIR/.gitignore"
+  cat > "$PROJ_DIR/bin/fm-harness.sh" <<'SH'
+#!/usr/bin/env bash
+printf 'codex\n'
+SH
+  chmod +x "$PROJ_DIR/bin/fm-harness.sh"
+  git -C "$PROJ_DIR" add .gitignore AGENTS.md bin/fm-harness.sh
+  git -C "$PROJ_DIR" -c user.name='Firstmate Tests' -c user.email='tests@example.invalid' \
+    commit -qm 'add secondmate harness fixture'
   sm="$CASE_DIR/secondmate-home"
+  git -C "$PROJ_DIR" worktree add --quiet --detach "$sm"
   make_seeded_secondmate_home "$sm" "$id"
+  printf -- '- %s - dispatch profile test (home: %s; scope: dispatch profile test; projects: ; added 2026-07-27)\n' \
+    "$id" "$sm" > "$HOME_DIR/data/secondmates.md"
 
-  out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" "$id" "$sm" --secondmate)
+  out=$(FM_TEST_ROOT_OVERRIDE="$PROJ_DIR" \
+    run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" "$id" "$sm" --secondmate)
   status=$?
   expect_code 0 "$status" "secondmate spawn should be exempt from the dispatch-profile explicit harness requirement"
   assert_contains "$out" "spawned $id harness=codex kind=secondmate" "secondmate launch did not use secondmate harness resolution"
diff --git a/tests/fm-teardown.test.sh b/tests/fm-teardown.test.sh
index ea5751c55d..4e97fa17e3 100755
--- a/tests/fm-teardown.test.sh
+++ b/tests/fm-teardown.test.sh
@@ -1941,9 +1941,19 @@ case "${1:-}" in
   kill-window)
     : > "$FM_FAKE_KILL_STARTED"
     while [ ! -f "$FM_FAKE_ALLOW_KILL" ]; do sleep 0.01; done
+    : > "$FM_FAKE_KILL_STARTED.gone"
+    exit 0
+    ;;
+  display-message)
+    [ ! -f "$FM_FAKE_KILL_STARTED.gone" ] || exit 1
+    printf '%%1\n'
+    exit 0
+    ;;
+  list-windows)
+    [ ! -f "$FM_FAKE_KILL_STARTED.gone" ] || exit 0
+    printf 'fm-task-x1\n'
     exit 0
     ;;
-  display-message) exit 1 ;;
 esac
 exit 0
 SH
@@ -1953,7 +1963,7 @@ SH
     FM_FAKE_KILL_STARTED="$kill_started" FM_FAKE_ALLOW_KILL="$allow_kill" \
     run_teardown "$case_dir" --force > "$case_dir/stdout" 2> "$case_dir/stderr" &
   teardown_pid=$!
-  for _ in 1 2 3 4 5 6 7 8 9 10; do
+  for _ in $(seq 1 600); do
     [ -f "$kill_started" ] && break
     sleep 0.05
   done
@@ -1999,11 +2009,12 @@ test_managed_child_teardown_locks_generation_before_snapshot() {
   allow_kill="$case_dir/allow-kill"
   : > "$af_log"
   prepare_secondmate_home_fixture "$case_dir"
+  git -C "$case_dir/project" gc --quiet
   fm_write_meta "$case_dir/state/task-x1.meta" \
     'window=fm-task-x1' \
     'tmux_session_target=firstmate:fm-task-x1' \
     "worktree=$case_dir/wt" \
-    "project=$case_dir/project" \
+    "project=$case_dir/wt" \
     'kind=secondmate' \
     'mode=secondmate' \
     "home=$case_dir/wt"
@@ -2039,11 +2050,26 @@ case "${1:-}" in
       *fm-child-lock-x3*)
         : > "$FM_FAKE_KILL_STARTED"
         while [ ! -f "$FM_FAKE_ALLOW_KILL" ]; do sleep 0.01; done
+        : > "$FM_FAKE_KILL_STARTED.gone"
         ;;
     esac
     exit 0
     ;;
-  display-message) exit 1 ;;
+  display-message)
+    case "$*" in
+      *fm-child-lock-x3*)
+        [ ! -f "$FM_FAKE_KILL_STARTED.gone" ] || exit 1
+        printf '%%1\n'
+        exit 0
+        ;;
+    esac
+    exit 1
+    ;;
+  list-windows)
+    [ ! -f "$FM_FAKE_KILL_STARTED.gone" ] || exit 0
+    printf 'fm-child-lock-x3\n'
+    exit 0
+    ;;
 esac
 exit 0
 SH
@@ -2056,7 +2082,7 @@ SH
     FM_EXPECT_CHILD_LINEAGE_MARKER="$case_dir/child-lineage-verified" \
     run_teardown "$case_dir" --force > "$case_dir/stdout" 2> "$case_dir/stderr" &
   teardown_pid=$!
-  for _ in $(seq 1 100); do
+  for _ in $(seq 1 600); do
     [ -f "$kill_started" ] && break
     sleep 0.05
   done
@@ -4146,6 +4172,28 @@ test_surviving_object_storage_is_bound_through_graph_proof() {
   pass "surviving object storage remains identity-bound through graph proof"
 }
 
+test_surviving_object_storage_descriptor_use_is_bounded() {
+  local case_dir source item rc
+  case_dir=$(make_case secondmate-object-storage-fd-bound)
+  prepare_secondmate_home_fixture "$case_dir"
+  write_secondmate_meta "$case_dir"
+  source="$case_dir/source-projects/test"
+  for item in $(seq 1 96); do
+    printf 'unreachable object %s\n' "$item" \
+      | git -C "$source" hash-object -w --stdin >/dev/null
+  done
+  set +e
+  (
+    ulimit -n 48
+    run_teardown "$case_dir" --force
+  ) > "$case_dir/stdout" 2> "$case_dir/stderr"
+  rc=$?
+  set -e
+  expect_code 0 "$rc" "object graph proof must stay within a bounded descriptor budget"
+  assert_absent "$case_dir/wt" "bounded object graph proof retained the secondmate home"
+  pass "surviving object storage proof bounds descriptor use"
+}
+
 test_secondmate_retirement_serializes_child_spawn() {
   local case_dir child_project rc teardown_pid spawn_rc waited
   case_dir=$(make_case secondmate-retirement-child-race)
@@ -4475,6 +4523,7 @@ fi
 if [ "${FM_TEST_FOCUSED:-}" = review-round-13-network ]; then
   test_secondmate_network_fetches_pin_validated_addresses
   test_surviving_object_storage_is_bound_through_graph_proof
+  test_surviving_object_storage_descriptor_use_is_bounded
   exit 0
 fi
 
@@ -4535,6 +4584,7 @@ test_secondmate_retirement_retains_reflog_and_rewritten_history
 test_secondmate_retirement_rejects_http_proxy_and_object_redirects
 test_secondmate_network_fetches_pin_validated_addresses
 test_surviving_object_storage_is_bound_through_graph_proof
+test_surviving_object_storage_descriptor_use_is_bounded
 test_secondmate_retirement_serializes_child_spawn
 test_nested_secondmate_cleanup_requires_child_home_lock
 test_secondmate_registry_updates_are_locked_and_literal
diff --git a/tests/fm-watch-triage.test.sh b/tests/fm-watch-triage.test.sh
index 393ad2f825..ac807312df 100755
--- a/tests/fm-watch-triage.test.sh
+++ b/tests/fm-watch-triage.test.sh
@@ -156,6 +156,366 @@ test_classifier_primitives() {
   pass "classifier primitives: last line, captain-relevance, window->task, FM_CAPTAIN_RE override"
 }
 
+test_provider_capacity_failure_classifier() {
+  local claude_line claude_dialog claude_auth codex ordinary
+  codex=$(cat <<'EOF'
+• Ran bin/fm-lint.sh
+  └ all checks passed
+
+⚠ Selected model is at capacity. Please try a different model.
+
+› Explain this codebase
+  gpt-5.6-sol xhigh · /tmp/project
+EOF
+)
+  [ "$(provider_capacity_failure_kind codex "$codex")" = codex-model-capacity ] \
+    || fail "real captured Codex capacity chrome did not classify"
+
+  # Bash 3.2 misparses a parenthesis inside a here-document nested in command
+  # substitution, so preserve this captured pane literally with ANSI-C quoting.
+  claude_line=$'  Write(src/pages/templates/McpTemplatePreviewPage.tsx)\n  ⎿  Wrote 103 lines\n  ⎿  You\'ve hit your session limit · resets 5pm (America/New_York)\n\n✻ Brewed for 23m 1s'
+  [ "$(provider_capacity_failure_kind claude "$claude_line")" = claude-session-limit ] \
+    || fail "real captured Claude session-limit result did not classify"
+
+  claude_dialog=$(cat <<'EOF'
+   What do you want to do?
+
+   ❯ 1. Stop and wait for limit to reset
+     2. Switch to usage credits
+     3. Switch to Team plan
+
+   Enter to confirm · Esc to cancel
+EOF
+)
+  [ "$(provider_capacity_failure_kind claude "$claude_dialog")" = claude-usage-limit-dialog ] \
+    || fail "real captured Claude usage-limit dialog did not classify"
+
+  claude_auth=$'Claude Code\n\nNot logged in - Please run /login'
+  [ "$(provider_credential_failure_kind claude "$claude_auth")" = claude-not-logged-in ] \
+    || fail "real captured Claude not-logged-in chrome did not classify"
+
+  ordinary=$'The provider documentation mentions usage limits, model capacity, and reset windows.\nThe prior log said Selected model is at capacity. Please try a different model.\nWe should test what happens if you\'ve hit your session limit and need to wait.'
+  ! provider_capacity_failure_kind codex "$ordinary" >/dev/null \
+    || fail "ordinary prose mentioning Codex capacity false-matched provider chrome"
+  ! provider_capacity_failure_kind claude "$ordinary" >/dev/null \
+    || fail "ordinary prose mentioning Claude limits false-matched provider chrome"
+  ! provider_capacity_failure_kind unknown "$codex" >/dev/null \
+    || fail "unknown harness guessed a Codex capacity failure"
+  ! provider_credential_failure_kind codex "$claude_auth" >/dev/null \
+    || fail "Codex guessed a Claude credential failure"
+  ! provider_credential_failure_kind claude \
+    'The pane said Not logged in - Please run /login while documenting authentication.' >/dev/null \
+    || fail "ordinary prose mentioning Claude login false-matched credential chrome"
+  pass "provider failure classifiers match real harness chrome and reject ordinary prose"
+}
+
+write_capacity_rescue_meta() {  # <meta> <window> <account-home> [attempts]
+  local meta=$1 window=$2 account_home=$3 attempts=${4:-}
+  fm_write_meta "$meta" \
+    "window=$window" \
+    "harness=claude" \
+    "kind=ship" \
+    "account_home=$account_home" \
+    "generation_id=spawn:test-generation"
+  [ -z "$attempts" ] || printf 'capacity_rescue_attempts=%s\n' "$attempts" >> "$meta"
+}
+
+make_capacity_spawn_fake() {  # <path>
+  local path=$1
+  cat > "$path" <<'SH'
+#!/usr/bin/env bash
+set -u
+printf '%s\t%s\t%s\n' "${1:-}" "${2:-}" "${FM_CAPACITY_RESCUE_RECOVERY:-}" >> "$FM_FAKE_CAPACITY_SPAWN_LOG"
+rm -f "${FM_ACCOUNT_LIFECYCLE_LOCK_HELD:-}"
+if [ "${FM_FAKE_CAPACITY_SPAWN_RESULT:-success}" = no-capacity ]; then
+  echo "CAPACITY_UNAVAILABLE: no unused Claude account has a freshly readable positive usage window" >&2
+  exit 1
+fi
+tmp=$(mktemp "${FM_FAKE_CAPACITY_META}.replacement.XXXXXX") || exit 1
+awk '!/^account_home=/' "$FM_FAKE_CAPACITY_META" > "$tmp" || exit 1
+printf 'account_home=%s\n' "$FM_FAKE_CAPACITY_NEW_ACCOUNT" >> "$tmp"
+mv "$tmp" "$FM_FAKE_CAPACITY_META"
+SH
+  chmod +x "$path"
+}
+
+test_capacity_rescue_records_attempt_and_changes_account() {
+  local dir state meta fake_spawn old_account new_account
+  dir=$(make_case capacity-rescue-success); state="$dir/state"
+  meta="$state/task.meta"; fake_spawn="$dir/fake-capacity-spawn"
+  old_account="$dir/accounts/claude/1"; new_account="$dir/accounts/claude/2"
+  mkdir -p "$old_account" "$new_account"
+  write_capacity_rescue_meta "$meta" "sess:fm-task" "$old_account"
+  make_capacity_spawn_fake "$fake_spawn"
+
+  # shellcheck disable=SC2030,SC2031,SC2329
+  (
+    export FM_STATE_OVERRIDE="$state"
+    export FM_CAPACITY_RESCUE_TEST_LAB=firstmate-capacity-rescue-test-lab-v1
+    export FM_CAPACITY_RESCUE_SPAWN_BIN="$fake_spawn"
+    export FM_FAKE_CAPACITY_META="$meta"
+    export FM_FAKE_CAPACITY_NEW_ACCOUNT="$new_account"
+    export FM_FAKE_CAPACITY_SPAWN_LOG="$dir/spawn.log"
+    export FM_FAKE_CAPACITY_KILL_LOG="$dir/kill.log"
+    # shellcheck disable=SC1090
+    . "$WATCH"
+    fm_backend_kill() { printf '%s\n' "$*" >> "$FM_FAKE_CAPACITY_KILL_LOG"; }
+    fm_backend_target_state() { printf 'absent'; }
+    capacity_rescue_task "sess:fm-task" task claude claude-session-limit
+    [ "$CAPACITY_RESCUE_OUTCOME" = rescued ] \
+      || fail "successful capacity handoff did not report rescued: $CAPACITY_RESCUE_OUTCOME"
+  )
+
+  [ "$(wc -l < "$dir/spawn.log" | tr -d ' ')" = 1 ] \
+    || fail "successful capacity handoff did not invoke exactly one replacement spawn"
+  assert_grep $'task\t--recover-direct-account\taccount-exhaustion-v1' "$dir/spawn.log" \
+    "capacity handoff did not reuse guarded direct-account recovery mode"
+  assert_grep 'capacity_rescue_attempts=1' "$meta" \
+    "successful capacity handoff did not record its bounded attempt count"
+  grep -E "^capacity_rescue_attempt_1=.*\\|harness=claude\\|account=$old_account\\|failure=claude-session-limit$" "$meta" >/dev/null \
+    || fail "successful capacity handoff did not record an auditable attempt"
+  assert_grep "capacity_rescue_exhausted_account=$old_account" "$meta" \
+    "successful capacity handoff did not remember the exhausted account"
+  assert_grep "capacity_rescue_result_1=rescued|account=$new_account" "$meta" \
+    "successful capacity handoff did not record its replacement account"
+  assert_grep "account_home=$new_account" "$meta" \
+    "successful capacity handoff did not bind the replacement account"
+  [ ! -e "$state/.account-lifecycle-task.lock" ] \
+    || fail "successful capacity handoff leaked the task lifecycle lock"
+  pass "capacity rescue serializes one handoff and records old/new accounts plus attempt audit"
+}
+
+test_capacity_rescue_no_capacity_stops_once() {
+  local dir state meta fake_spawn old_account
+  dir=$(make_case capacity-rescue-empty); state="$dir/state"
+  meta="$state/task.meta"; fake_spawn="$dir/fake-capacity-spawn"
+  old_account="$dir/accounts/claude/1"
+  mkdir -p "$old_account"
+  write_capacity_rescue_meta "$meta" "sess:fm-task" "$old_account"
+  make_capacity_spawn_fake "$fake_spawn"
+
+  # shellcheck disable=SC2030,SC2031,SC2329
+  (
+    export FM_STATE_OVERRIDE="$state"
+    export FM_CAPACITY_RESCUE_TEST_LAB=firstmate-capacity-rescue-test-lab-v1
+    export FM_CAPACITY_RESCUE_SPAWN_BIN="$fake_spawn"
+    export FM_FAKE_CAPACITY_META="$meta"
+    export FM_FAKE_CAPACITY_NEW_ACCOUNT="$dir/accounts/claude/2"
+    export FM_FAKE_CAPACITY_SPAWN_LOG="$dir/spawn.log"
+    export FM_FAKE_CAPACITY_SPAWN_RESULT=no-capacity
+    export FM_FAKE_CAPACITY_KILL_LOG="$dir/kill.log"
+    # shellcheck disable=SC1090
+    . "$WATCH"
+    fm_backend_kill() { printf '%s\n' "$*" >> "$FM_FAKE_CAPACITY_KILL_LOG"; }
+    fm_backend_target_state() { printf 'absent'; }
+    capacity_rescue_task "sess:fm-task" task claude claude-session-limit
+    [ "$CAPACITY_RESCUE_OUTCOME" = blocked ] \
+      || fail "no-capacity handoff did not stop blocked: $CAPACITY_RESCUE_OUTCOME"
+    [ "$CAPACITY_RESCUE_REASON" = no-capacity ] \
+      || fail "no-capacity handoff reported the wrong reason: $CAPACITY_RESCUE_REASON"
+    capacity_rescue_task "sess:fm-task" task claude claude-session-limit
+    [ "$CAPACITY_RESCUE_OUTCOME" = already-stopped ] \
+      || fail "stopped no-capacity task tried to rescue again: $CAPACITY_RESCUE_OUTCOME"
+  )
+
+  [ "$(wc -l < "$dir/spawn.log" | tr -d ' ')" = 1 ] \
+    || fail "no-capacity task thrashed replacement spawn instead of stopping once"
+  [ "$(wc -l < "$dir/kill.log" | tr -d ' ')" = 1 ] \
+    || fail "no-capacity task repeatedly removed its endpoint"
+  [ "$(grep -Fc 'blocked [key=capacity-rescue]:' "$state/task.status" || true)" = 1 ] \
+    || fail "no-capacity task did not emit exactly one blocked status"
+  assert_grep 'capacity_rescue_attempts=1' "$meta" \
+    "no-capacity stop did not retain the attempted handoff count"
+  assert_grep 'capacity_rescue_result_1=no-capacity' "$meta" \
+    "no-capacity stop did not record the failed attempt result"
+  assert_grep 'capacity_rescue_stopped=no-capacity' "$meta" \
+    "no-capacity stop did not arm the durable no-retry marker"
+  pass "no capacity anywhere records one blocked stop and never retries"
+}
+
+test_capacity_rescue_attempt_cap_stops_without_spawn() {
+  local dir state meta fake_spawn old_account
+  dir=$(make_case capacity-rescue-cap); state="$dir/state"
+  meta="$state/task.meta"; fake_spawn="$dir/fake-capacity-spawn"
+  old_account="$dir/accounts/claude/1"
+  mkdir -p "$old_account"
+  write_capacity_rescue_meta "$meta" "sess:fm-task" "$old_account" 1
+  printf 'capacity_rescue_attempt_1=2026-07-25T00:00:00Z|harness=claude|account=%s|failure=claude-session-limit\n' \
+    "$old_account" >> "$meta"
+  printf 'capacity_rescue_result_1=rescued|account=%s\n' "$old_account" >> "$meta"
+  make_capacity_spawn_fake "$fake_spawn"
+
+  # shellcheck disable=SC2030,SC2031,SC2329
+  (
+    export FM_STATE_OVERRIDE="$state"
+    export FM_CAPACITY_RESCUE_MAX_ATTEMPTS=1
+    export FM_CAPACITY_RESCUE_TEST_LAB=firstmate-capacity-rescue-test-lab-v1
+    export FM_CAPACITY_RESCUE_SPAWN_BIN="$fake_spawn"
+    export FM_FAKE_CAPACITY_META="$meta"
+    export FM_FAKE_CAPACITY_NEW_ACCOUNT="$dir/accounts/claude/2"
+    export FM_FAKE_CAPACITY_SPAWN_LOG="$dir/spawn.log"
+    export FM_FAKE_CAPACITY_KILL_LOG="$dir/kill.log"
+    # shellcheck disable=SC1090
+    . "$WATCH"
+    fm_backend_kill() { printf '%s\n' "$*" >> "$FM_FAKE_CAPACITY_KILL_LOG"; }
+    fm_backend_target_state() { printf 'absent'; }
+    capacity_rescue_task "sess:fm-task" task claude claude-session-limit
+    [ "$CAPACITY_RESCUE_OUTCOME" = blocked ] \
+      || fail "attempt-capped task did not stop blocked: $CAPACITY_RESCUE_OUTCOME"
+    [ "$CAPACITY_RESCUE_REASON" = max-attempts ] \
+      || fail "attempt-capped task reported the wrong reason: $CAPACITY_RESCUE_REASON"
+  )
+
+  [ ! -e "$dir/spawn.log" ] || [ ! -s "$dir/spawn.log" ] \
+    || fail "attempt-capped task launched another replacement agent"
+  assert_grep 'capacity_rescue_attempts=1' "$meta" \
+    "attempt cap changed the completed attempt count"
+  assert_grep 'capacity_rescue_stopped=max-attempts' "$meta" \
+    "attempt cap did not record its durable stop reason"
+  pass "capacity rescue enforces the per-task attempt cap without another spawn"
+}
+
+test_capacity_rescue_interrupted_attempt_never_respawns() {
+  local dir state meta fake_spawn old_account first second
+  dir=$(make_case capacity-rescue-interrupted); state="$dir/state"
+  meta="$state/task.meta"; fake_spawn="$dir/fake-capacity-spawn"
+  old_account="$dir/accounts/claude/1"
+  mkdir -p "$old_account"
+  write_capacity_rescue_meta "$meta" "sess:fm-task" "$old_account" 1
+  printf 'capacity_rescue_attempt_1=2026-07-25T00:00:00Z|harness=claude|account=%s|failure=claude-session-limit\n' \
+    "$old_account" >> "$meta"
+  make_capacity_spawn_fake "$fake_spawn"
+
+  # shellcheck disable=SC2030,SC2031,SC2329
+  (
+    export FM_STATE_OVERRIDE="$state"
+    export FM_CAPACITY_RESCUE_TEST_LAB=firstmate-capacity-rescue-test-lab-v1
+    export FM_CAPACITY_RESCUE_SPAWN_BIN="$fake_spawn"
+    export FM_FAKE_CAPACITY_META="$meta"
+    export FM_FAKE_CAPACITY_NEW_ACCOUNT="$dir/accounts/claude/2"
+    export FM_FAKE_CAPACITY_SPAWN_LOG="$dir/spawn.log"
+    export FM_FAKE_CAPACITY_KILL_LOG="$dir/kill.log"
+    # shellcheck disable=SC1090
+    . "$WATCH"
+    first=$(capacity_rescue_reconcile_terminal_attempt)
+    [ "$first" = $'task\tinterrupted-attempt' ] \
+      || fail "dead-endpoint reconciliation reported the wrong interrupted attempt: $first"
+    second=$(capacity_rescue_reconcile_terminal_attempt || true)
+    [ -z "$second" ] \
+      || fail "interrupted attempt reconciled more than once: $second"
+  )
+
+  [ ! -e "$dir/spawn.log" ] || [ ! -s "$dir/spawn.log" ] \
+    || fail "interrupted attempt launched another replacement agent"
+  [ ! -e "$dir/kill.log" ] || [ ! -s "$dir/kill.log" ] \
+    || fail "interrupted attempt guessed which endpoint generation to remove"
+  [ "$(grep -Fc 'blocked [key=capacity-rescue]:' "$state/task.status" || true)" = 1 ] \
+    || fail "interrupted attempt did not emit exactly one blocked status"
+  assert_grep 'capacity_rescue_stopped=interrupted-attempt' "$meta" \
+    "interrupted attempt did not persist its no-respawn stop"
+  pass "a result-less attempt is found without a live pane and stops without respawn or endpoint guess"
+}
+
+test_claude_credentials_stop_without_consuming_rescue_attempt() {
+  local dir state meta fake_spawn account
+  dir=$(make_case claude-credentials); state="$dir/state"
+  meta="$state/task.meta"; fake_spawn="$dir/fake-capacity-spawn"
+  account="$dir/accounts/claude/1"
+  mkdir -p "$account"
+  fm_write_meta "$meta" \
+    "window=sess:fm-task" \
+    "harness=claude" \
+    "kind=ship" \
+    "account_home=$account" \
+    "generation_id=spawn:test-generation"
+  make_capacity_spawn_fake "$fake_spawn"
+
+  # shellcheck disable=SC2030,SC2031,SC2329
+  (
+    export FM_STATE_OVERRIDE="$state"
+    export FM_CAPACITY_RESCUE_TEST_LAB=firstmate-capacity-rescue-test-lab-v1
+    export FM_CAPACITY_RESCUE_SPAWN_BIN="$fake_spawn"
+    export FM_FAKE_CAPACITY_META="$meta"
+    export FM_FAKE_CAPACITY_NEW_ACCOUNT="$dir/accounts/claude/2"
+    export FM_FAKE_CAPACITY_SPAWN_LOG="$dir/spawn.log"
+    export FM_FAKE_CAPACITY_KILL_LOG="$dir/kill.log"
+    # shellcheck disable=SC1090
+    . "$WATCH"
+    fm_backend_kill() { printf '%s\n' "$*" >> "$FM_FAKE_CAPACITY_KILL_LOG"; }
+    fm_backend_target_state() { printf 'absent'; }
+    capacity_rescue_task "sess:fm-task" task claude claude-not-logged-in
+    [ "$CAPACITY_RESCUE_OUTCOME" = blocked ] \
+      || fail "Claude credential failure did not stop blocked: $CAPACITY_RESCUE_OUTCOME"
+    [ "$CAPACITY_RESCUE_REASON" = credentials ] \
+      || fail "Claude credential failure reported the wrong reason: $CAPACITY_RESCUE_REASON"
+    capacity_rescue_task "sess:fm-task" task claude claude-not-logged-in
+    [ "$CAPACITY_RESCUE_OUTCOME" = already-stopped ] \
+      || fail "Claude credential failure retried after its durable stop"
+  )
+
+  [ ! -e "$dir/spawn.log" ] || [ ! -s "$dir/spawn.log" ] \
+    || fail "Claude credential failure rotated to another account"
+  [ ! -e "$dir/kill.log" ] || [ ! -s "$dir/kill.log" ] \
+    || fail "Claude credential failure removed its endpoint"
+  [ "$(grep -Fc 'blocked [key=capacity-rescue]:' "$state/task.status" || true)" = 1 ] \
+    || fail "Claude credential failure did not emit exactly one blocked status"
+  ! grep -q '^capacity_rescue_attempts=' "$meta" \
+    || fail "Claude credential failure consumed the capacity rescue attempt budget"
+  ! grep -q '^capacity_rescue_exhausted_account=' "$meta" \
+    || fail "Claude credential failure recorded the account as capacity-exhausted"
+  assert_grep 'capacity_rescue_stopped=credentials' "$meta" \
+    "Claude credential failure did not persist its no-retry stop"
+  pass "Claude credential failure blocks once without rotation or rescue accounting"
+}
+
+test_codex_model_capacity_surfaces_without_account_rescue() {
+  local dir state fakebin out capture_file statusf window pid
+  dir=$(make_case codex-model-capacity); state="$dir/state"; fakebin="$dir/fakebin"
+  out="$dir/watch.out"; capture_file="$dir/pane.txt"; statusf="$state/task.status"
+  window="test:fm-task"
+  cat > "$capture_file" <<'EOF'
+⚠ Selected model is at capacity. Please try a different model.
+
+› Explain this codebase
+  gpt-5.6-sol xhigh · /tmp/project
+EOF
+  printf 'window=%s\nkind=ship\nharness=codex\naccount_home=%s\n' \
+    "$window" "$dir/accounts/codex/1" > "$state/task.meta"
+  PATH="$fakebin:$PATH" FM_FAKE_TMUX_WINDOW="$window" FM_FAKE_TMUX_CAPTURE="$capture_file" \
+    FM_STATE_OVERRIDE="$state" FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_POLL=1 FM_SIGNAL_GRACE=1 \
+    FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
+  pid=$!
+  wait_for_exit "$pid" 40 || { reap "$pid"; fail "idle Codex model capacity did not surface"; }
+  assert_grep 'blocked [key=model-capacity]:' "$statusf" \
+    "Codex model capacity did not emit a model-scoped blocked status"
+  ! grep -q '^capacity_rescue_' "$state/task.meta" \
+    || fail "Codex model capacity entered account rescue metadata"
+  grep -F 'account rotation was not attempted' "$out" >/dev/null \
+    || fail "Codex model capacity did not explicitly preserve the account"
+
+  dir=$(make_case codex-stale-capacity-busy); state="$dir/state"; fakebin="$dir/fakebin"
+  out="$dir/watch.out"; capture_file="$dir/pane.txt"; window="test:fm-task"
+  cat > "$capture_file" <<'EOF'
+⚠ Selected model is at capacity. Please try a different model.
+• Working (2s • esc to interrupt)
+EOF
+  printf 'window=%s\nkind=ship\nharness=codex\naccount_home=%s\n' \
+    "$window" "$dir/accounts/codex/1" > "$state/task.meta"
+  PATH="$fakebin:$PATH" FM_FAKE_TMUX_WINDOW="$window" FM_FAKE_TMUX_CAPTURE="$capture_file" \
+    FM_STATE_OVERRIDE="$state" FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" \
+    FM_PERMISSION_STALL_ESCALATE_SECS=999999 FM_POLL=1 FM_SIGNAL_GRACE=1 \
+    FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
+  pid=$!
+  wait_live "$pid" 20 \
+    || { reap "$pid"; fail "stale capacity chrome terminated a currently busy Codex endpoint"; }
+  [ ! -s "$state/.wake-queue" ] \
+    || { reap "$pid"; fail "stale capacity chrome on a busy endpoint enqueued a wake"; }
+  ! grep -q '^capacity_rescue_' "$state/task.meta" \
+    || { reap "$pid"; fail "stale capacity chrome on a busy endpoint entered rescue"; }
+  reap "$pid"
+  pass "Codex model capacity surfaces once without account rescue, and stale busy chrome is ignored"
+}
+
 test_managed_tmux_window_id_reverse_mapping() {
   local dir state
   dir=$(make_case managed-tmux-reverse-map); state="$dir/state"
@@ -1503,10 +1863,28 @@ if [ "${FM_TEST_FOCUSED:-}" = permission-prompts ]; then
   exit 0
 fi
 
+if [ "${FM_TEST_FOCUSED:-}" = capacity-rescue ]; then
+  test_provider_capacity_failure_classifier
+  test_capacity_rescue_records_attempt_and_changes_account
+  test_capacity_rescue_no_capacity_stops_once
+  test_capacity_rescue_attempt_cap_stops_without_spawn
+  test_capacity_rescue_interrupted_attempt_never_respawns
+  test_claude_credentials_stop_without_consuming_rescue_attempt
+  test_codex_model_capacity_surfaces_without_account_rescue
+  exit 0
+fi
+
 test_signal_reason_is_actionable_classifier
 test_stale_is_terminal_classifier
 test_scan_captain_relevant_statuses_classifier
 test_classifier_primitives
+test_provider_capacity_failure_classifier
+test_capacity_rescue_records_attempt_and_changes_account
+test_capacity_rescue_no_capacity_stops_once
+test_capacity_rescue_attempt_cap_stops_without_spawn
+test_capacity_rescue_interrupted_attempt_never_respawns
+test_claude_credentials_stop_without_consuming_rescue_attempt
+test_codex_model_capacity_surfaces_without_account_rescue
 test_managed_tmux_window_id_reverse_mapping
 test_crew_is_provably_working_classifier
 test_status_is_paused_classifier