From 45429af74d3a768f1d385fd1b08115cf4df74081 Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Sun, 26 Jul 2026 06:19:21 -0400
Subject: [PATCH 01/34] fix: isolate task temp roots across runs

---
 bin/fm-account-routing-lib.sh              |  58 +++-
 bin/fm-checkout-lock-lib.sh                |  19 +-
 bin/fm-home-seed.sh                        | 106 ++++---
 bin/fm-spawn.sh                            |  50 +++-
 bin/fm-teardown.sh                         | 144 ++++++---
 bin/fm-watch-checkpoint.sh                 |   4 +-
 tests/fm-account-directory.test.sh         |  28 +-
 tests/fm-account-routing.test.sh           | 131 ++++++--
 tests/fm-arm-pretool-check.test.sh         |  12 +-
 tests/fm-autocompact.test.sh               |   2 +-
 tests/fm-backend-cmux.test.sh              |   2 +-
 tests/fm-backend-herdr.test.sh             |   2 +-
 tests/fm-backend-zellij.test.sh            |   2 +-
 tests/fm-backend.test.sh                   |  10 +-
 tests/fm-backlog-handoff.test.sh           |   2 +-
 tests/fm-bearings-snapshot.test.sh         |   2 +-
 tests/fm-bootstrap.test.sh                 |   2 +-
 tests/fm-brief.test.sh                     |   2 +-
 tests/fm-cd-pretool-check.test.sh          |   2 +-
 tests/fm-checkout-refresh.test.sh          |   2 +-
 tests/fm-checkout-return-boundary.test.sh  |   2 +-
 tests/fm-composer-ghost.test.sh            |   2 +-
 tests/fm-crew-state.test.sh                |   2 +-
 tests/fm-daemon.test.sh                    |   2 +-
 tests/fm-dispatch-select.test.sh           |   2 +-
 tests/fm-ensure-agents-md.test.sh          |   2 +-
 tests/fm-fleet-snapshot-view.test.sh       |   2 +-
 tests/fm-herdr-lab.test.sh                 |   2 +-
 tests/fm-lint.test.sh                      |   8 +-
 tests/fm-lock.test.sh                      |   2 +-
 tests/fm-macos-permissions.test.sh         |   2 +-
 tests/fm-pi-watch-extension.test.sh        |   2 +-
 tests/fm-pr-merge.test.sh                  |   2 +-
 tests/fm-prompt-exec.test.sh               |   2 +-
 tests/fm-report-stack.test.sh              |   2 +-
 tests/fm-review-diff.test.sh               |   2 +-
 tests/fm-secondmate-lifecycle-e2e.test.sh  |   9 +-
 tests/fm-secondmate-liveness.test.sh       |  36 ++-
 tests/fm-secondmate-safety.test.sh         | 332 ++++++++++++++++-----
 tests/fm-secondmate-sync.test.sh           |  19 +-
 tests/fm-send-popup-settle.test.sh         |   2 +-
 tests/fm-send-secondmate-marker.test.sh    |   2 +-
 tests/fm-send-settle.test.sh               |   2 +-
 tests/fm-send-strict.test.sh               |   2 +-
 tests/fm-session-start.test.sh             |   2 +-
 tests/fm-spawn-batch.test.sh               |   2 +-
 tests/fm-spawn-dispatch-profile.test.sh    |  95 +++++-
 tests/fm-supervision-events.test.sh        |   2 +-
 tests/fm-supervision-instructions.test.sh  |   2 +-
 tests/fm-tangle-guard.test.sh              |  65 +++-
 tests/fm-teardown.test.sh                  | 266 +++++++++++++----
 tests/fm-turnend-guard.test.sh             |   2 +-
 tests/fm-update.test.sh                    |   2 +-
 tests/fm-wake-daemon-lifecycle-e2e.test.sh |   2 +-
 tests/fm-wake-queue.test.sh                |   2 +-
 tests/fm-watch-checkpoint.test.sh          |  18 +-
 tests/fm-watch-triage.test.sh              |   6 +-
 tests/fm-watcher-lock.test.sh              |   2 +-
 tests/fm-x-mode.test.sh                    |   2 +-
 tests/secondmate-helpers.sh                |  20 +-
 tests/wake-helpers.sh                      |  18 +-
 61 files changed, 1135 insertions(+), 397 deletions(-)

diff --git a/bin/fm-account-routing-lib.sh b/bin/fm-account-routing-lib.sh
index fa65dccead..565e3b9f68 100644
--- a/bin/fm-account-routing-lib.sh
+++ b/bin/fm-account-routing-lib.sh
@@ -236,6 +236,51 @@ fm_account_real_directory() {
   [ -d "$1" ] && [ ! -L "$1" ]
 }
 
+fm_account_task_tmp_path() {  # <task-id>
+  local task=$1 state
+  fm_account_valid_id "$task" || return 1
+  if [ -n "${STATE:-}" ]; then
+    state=$STATE
+  elif [ -n "${FM_STATE_OVERRIDE:-}" ]; then
+    state=$FM_STATE_OVERRIDE
+  elif [ -n "${FM_HOME:-}" ]; then
+    state=$FM_HOME/state
+  else
+    return 1
+  fi
+  fm_account_real_directory "$state" || return 1
+  state=$(cd "$state" 2>/dev/null && pwd -P) || return 1
+  [ "$state" != / ] || return 1
+  # The physical task-state directory is the run identity. Nesting the temp
+  # root under it prevents cross-home and cross-test collisions, and makes a
+  # suite's ordinary run-root cleanup own task temp even after an early abort.
+  printf '%s/.task-tmp/fm-%s\n' "${state%/}" "$task"
+}
+
+fm_account_legacy_task_tmp_path() {  # <task-id>
+  fm_account_valid_id "$1" || return 1
+  printf '/tmp/fm-%s\n' "$1"
+}
+
+fm_account_task_tmp_is_current() {  # <task-id> <path>
+  local expected
+  expected=$(fm_account_task_tmp_path "$1") || return 1
+  [ "$2" = "$expected" ]
+}
+
+fm_account_task_tmp_is_legacy() {  # <task-id> <path>
+  local legacy
+  legacy=$(fm_account_legacy_task_tmp_path "$1") || return 1
+  [ "$2" = "$legacy" ]
+}
+
+fm_account_task_tmp_is_expected() {  # <task-id> <path>
+  # Legacy metadata remains recognizable, but callers must use
+  # fm_account_task_tmp_is_current before any filesystem mutation.
+  fm_account_task_tmp_is_current "$1" "$2" \
+    || fm_account_task_tmp_is_legacy "$1" "$2"
+}
+
 fm_account_safe_file_destination() {
   [ ! -L "$1" ] && { [ ! -e "$1" ] || [ -f "$1" ]; }
 }
@@ -1213,11 +1258,16 @@ fm_account_restore_artifacts() {
     fi
   done
   if [ -n "$tasktmp" ]; then
-    [ "$tasktmp" = "/tmp/fm-$task" ] || return 1
-    if [ -e "$backup/tasktmp-existed" ]; then
-      [ -e "$backup/gotmp-existed" ] || fm_account_system_exec "$FM_ACCOUNT_SYSTEM_RM_BIN" -rf "$tasktmp/gotmp" || return 1
+    if fm_account_task_tmp_is_current "$task" "$tasktmp"; then
+      if [ -e "$backup/tasktmp-existed" ]; then
+        [ -e "$backup/gotmp-existed" ] || fm_account_system_exec "$FM_ACCOUNT_SYSTEM_RM_BIN" -rf "$tasktmp/gotmp" || return 1
+      else
+        fm_account_system_exec "$FM_ACCOUNT_SYSTEM_RM_BIN" -rf "$tasktmp" || return 1
+      fi
     else
-      fm_account_system_exec "$FM_ACCOUNT_SYSTEM_RM_BIN" -rf "$tasktmp" || return 1
+      # A legacy tasktmp is metadata-only compatibility. Never inspect or
+      # mutate the shared /tmp path while restoring task-owned artifacts.
+      fm_account_task_tmp_is_legacy "$task" "$tasktmp" || return 1
     fi
   fi
   [ "$retain" = 1 ] || fm_account_system_exec "$FM_ACCOUNT_SYSTEM_RM_BIN" -rf "$backup"
diff --git a/bin/fm-checkout-lock-lib.sh b/bin/fm-checkout-lock-lib.sh
index e81b069010..222707ee43 100644
--- a/bin/fm-checkout-lock-lib.sh
+++ b/bin/fm-checkout-lock-lib.sh
@@ -106,7 +106,7 @@ fm_checkout_git_common_dir() {
 }
 
 fm_checkout_validate_git_metadata() {
-  local checkout=$1 root metadata absolute_git common listed line listed_root found=0
+  local checkout=$1 root metadata absolute_git common top listed line listed_root found=0
   root=$(fm_checkout_trusted_dir "$checkout") || return 1
   metadata="$root/.git"
   [ -e "$metadata" ] && [ ! -L "$metadata" ] || return 1
@@ -118,11 +118,16 @@ fm_checkout_validate_git_metadata() {
     *) common="$root/$common" ;;
   esac
   common=$(fm_checkout_trusted_dir "$common") || return 1
+  top=$(git -C "$root" rev-parse --show-toplevel 2>/dev/null) || return 1
+  top=$(fm_checkout_trusted_dir "$top") || return 1
+  [ "$top" = "$root" ] || return 1
   if [ -d "$metadata" ]; then
     [ "$(fm_checkout_trusted_dir "$metadata")" = "$absolute_git" ] || return 1
     [ "$absolute_git" = "$common" ] || return 1
   elif [ -f "$metadata" ]; then
-    case "$absolute_git" in "$common"/worktrees/*) ;; *) return 1 ;; esac
+    if [ "$absolute_git" != "$common" ]; then
+      case "$absolute_git" in "$common"/worktrees/*) ;; *) return 1 ;; esac
+    fi
   else
     return 1
   fi
@@ -131,7 +136,15 @@ fm_checkout_validate_git_metadata() {
     case "$line" in
       "worktree "*)
         listed_root=$(fm_checkout_trusted_dir "${line#worktree }" 2>/dev/null) || return 1
-        [ "$listed_root" != "$root" ] || found=$((found + 1))
+        if [ "$listed_root" = "$root" ]; then
+          found=$((found + 1))
+        elif [ -f "$metadata" ] && [ "$absolute_git" = "$common" ] \
+          && [ "$listed_root" = "$common" ]; then
+          # An absorbed submodule's worktree listing identifies its common
+          # Git directory rather than the checked-out root. The exact
+          # show-toplevel proof above binds that Git directory back to root.
+          found=$((found + 1))
+        fi
         ;;
     esac
   done <<EOF
diff --git a/bin/fm-home-seed.sh b/bin/fm-home-seed.sh
index eac1c90072..456b2f004a 100755
--- a/bin/fm-home-seed.sh
+++ b/bin/fm-home-seed.sh
@@ -431,7 +431,7 @@ acquire_treehouse_home() {
 }
 
 ensure_home() {
-  local id=$1 requested=$2 home
+  local id=$1 requested=$2 home default target source_origin
   if [ "$requested" = "-" ]; then
     home=$(acquire_treehouse_home "$id")
     verify_firstmate_home "$home"
@@ -443,8 +443,28 @@ ensure_home() {
   if [ -e "$home" ]; then
     [ -d "$home" ] || { echo "error: $home exists and is not a directory" >&2; return 1; }
   else
+    default=$(git -C "$FM_ROOT" symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null || true)
+    default=${default#origin/}
+    if [ -z "$default" ]; then
+      for default in main master; do
+        git -C "$FM_ROOT" show-ref --verify --quiet "refs/heads/$default" && break
+      done
+    fi
+    target=$(git -C "$FM_ROOT" rev-parse --verify --quiet "refs/heads/$default^{commit}") || {
+      echo "error: cannot resolve the firstmate default branch for $home" >&2
+      return 1
+    }
+    source_origin=$(git -C "$FM_ROOT" remote get-url origin 2>/dev/null || true)
     mkdir -p "$(dirname "$home")"
-    git clone --quiet "$FM_ROOT" "$home"
+    git clone --quiet --no-checkout --single-branch --branch "$default" "$FM_ROOT" "$home"
+    git -C "$home" checkout --quiet --detach "$target" || return 1
+    if [ -n "$source_origin" ]; then
+      git -C "$home" remote set-url origin "$source_origin" || return 1
+      git -C "$home" update-ref "refs/remotes/origin/$default" "$target" || return 1
+      git -C "$home" symbolic-ref refs/remotes/origin/HEAD "refs/remotes/origin/$default" || return 1
+    else
+      git -C "$home" remote remove origin || return 1
+    fi
   fi
   verify_firstmate_home "$home"
 }
@@ -881,8 +901,44 @@ refuse_projectful_projectless_charter() {
   return 1
 }
 
+prepare_seed_charter() {
+  local id=$1 no_projects=$2 charter_summary charter_scope
+  shift 2
+  if [ ! -f "$SEED_PARENT_BRIEF" ]; then
+    [ -n "${FM_SECONDMATE_CHARTER:-}" ] || {
+      echo "error: no filled secondmate charter brief at $SEED_PARENT_BRIEF; set FM_SECONDMATE_CHARTER or scaffold one and replace {TASK}" >&2
+      return 1
+    }
+    [ -d "$DATA/$id" ] || SEED_PARENT_BRIEF_DIR_CREATED=1
+    if [ "$no_projects" -eq 1 ]; then
+      "$FM_ROOT/bin/fm-brief.sh" "$id" --secondmate --no-projects
+    else
+      "$FM_ROOT/bin/fm-brief.sh" "$id" --secondmate "$@"
+    fi
+    SEED_PARENT_BRIEF_CREATED=1
+  fi
+  if grep -F '{TASK}' "$SEED_PARENT_BRIEF" >/dev/null 2>&1; then
+    echo "error: secondmate charter brief at $SEED_PARENT_BRIEF still contains {TASK}; fill it before seeding" >&2
+    return 1
+  fi
+  charter_summary=$(registry_summary_for_brief "$SEED_PARENT_BRIEF")
+  [ -n "$charter_summary" ] || {
+    echo "error: secondmate charter brief at $SEED_PARENT_BRIEF has an empty Charter section; fill it before seeding" >&2
+    return 1
+  }
+  charter_scope=$(registry_scope_for_brief "$SEED_PARENT_BRIEF")
+  [ -n "$charter_scope" ] || {
+    echo "error: secondmate charter brief at $SEED_PARENT_BRIEF has an empty Routing scope section; fill it before seeding" >&2
+    return 1
+  }
+  if [ "$no_projects" -eq 1 ]; then
+    refuse_projectful_projectless_charter "$id" "$SEED_PARENT_BRIEF" || return 1
+  fi
+}
+
 seed_home() {
-  local id=$1 requested_home=$2 requested_abs home projects_csv project project_dst charter_summary charter_scope
+  local id=$1 requested_home=$2 requested_abs home projects_csv project project_dst
+  local preflight_out
   local no_projects=0 arg
   local filtered=()
   shift 2
@@ -941,12 +997,18 @@ seed_home() {
     }
   fi
 
+  if [ "$requested_home" != "-" ]; then
+    prepare_seed_charter "$id" "$no_projects" "$@" || return 1
+  fi
+
   if [ "$requested_home" = "-" ]; then
     SEED_HOME_ACQUIRED=1
     home=$(acquire_treehouse_home "$id")
     SEED_HOME="$home"
     SEED_HOME_RETAINED=1
+    refuse_active_home_path "$home" || return 1
     SEED_HOME_LIFECYCLE_LOCK=$(fm_secondmate_home_lifecycle_lock_acquire "$CHECKOUT_LOCK_ROOT" "$home") || return 1
+    prepare_seed_charter "$id" "$no_projects" "$@" || return 1
     freshness_status=0
     "$SCRIPT_DIR/fm-checkout-refresh.sh" verify-worktree "$home" "$FM_ROOT" || freshness_status=$?
     if [ "$freshness_status" -ne 0 ]; then
@@ -965,8 +1027,11 @@ seed_home() {
     SEED_HOME="$requested_abs"
     [ -e "$requested_abs" ] || SEED_HOME_CREATED=1
     home=$(ensure_home "$id" "$requested_abs")
-    "$SCRIPT_DIR/fm-checkout-refresh.sh" preflight "$home" || {
-      echo "error: refusing explicit secondmate home whose default branch cannot be refreshed safely" >&2
+    if [ "$no_projects" -eq 1 ]; then
+      refuse_populated_projectless_home "$home" || return 1
+    fi
+    preflight_out=$("$SCRIPT_DIR/fm-checkout-refresh.sh" preflight "$home" 2>&1) || {
+      echo "error: refusing explicit secondmate home whose default branch cannot be refreshed safely: $(printf '%s\n' "$preflight_out" | sed -n '1p')" >&2
       return 1
     }
     "$SCRIPT_DIR/fm-checkout-refresh.sh" verify-home "$home" "$FM_ROOT" || {
@@ -981,9 +1046,6 @@ seed_home() {
   validate_seed_leaf_files "$home" || return 1
   if [ "$no_projects" -eq 1 ]; then
     refuse_populated_projectless_home "$home" || return 1
-    if [ -f "$SEED_PARENT_BRIEF" ]; then
-      refuse_projectful_projectless_charter "$id" "$SEED_PARENT_BRIEF" || return 1
-    fi
   fi
   mkdir -p "$DATA" "$home/data" "$home/state" "$home/config" "$home/projects"
   if [ -f "$home/data/projects.md" ]; then
@@ -1000,34 +1062,6 @@ seed_home() {
   fi
   SEED_HOME_BACKED_UP=1
 
-  if [ ! -f "$SEED_PARENT_BRIEF" ]; then
-    [ -n "${FM_SECONDMATE_CHARTER:-}" ] || {
-      echo "error: no filled secondmate charter brief at $SEED_PARENT_BRIEF; set FM_SECONDMATE_CHARTER or scaffold one and replace {TASK}" >&2
-      return 1
-    }
-    [ -d "$DATA/$id" ] || SEED_PARENT_BRIEF_DIR_CREATED=1
-    if [ "$no_projects" -eq 1 ]; then
-      "$FM_ROOT/bin/fm-brief.sh" "$id" --secondmate --no-projects
-    else
-      "$FM_ROOT/bin/fm-brief.sh" "$id" --secondmate "$@"
-    fi
-    SEED_PARENT_BRIEF_CREATED=1
-  fi
-  if grep -F '{TASK}' "$SEED_PARENT_BRIEF" >/dev/null 2>&1; then
-    echo "error: secondmate charter brief at $SEED_PARENT_BRIEF still contains {TASK}; fill it before seeding" >&2
-    return 1
-  fi
-  charter_summary=$(registry_summary_for_brief "$SEED_PARENT_BRIEF")
-  [ -n "$charter_summary" ] || {
-    echo "error: secondmate charter brief at $SEED_PARENT_BRIEF has an empty Charter section; fill it before seeding" >&2
-    return 1
-  }
-  charter_scope=$(registry_scope_for_brief "$SEED_PARENT_BRIEF")
-  [ -n "$charter_scope" ] || {
-    echo "error: secondmate charter brief at $SEED_PARENT_BRIEF has an empty Routing scope section; fill it before seeding" >&2
-    return 1
-  }
-
   for project in "$@"; do
     project_dst=$(validate_project_destination "$home" "$project") || return 1
     [ -e "$project_dst" ] || printf '%s\n' "$project_dst" >> "$SEED_CREATED_PROJECTS_FILE"
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index cec185d8bb..67b9c2a5fa 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -602,7 +602,8 @@ reconcile_failed_direct_recovery() {
     echo "error: retained direct recovery artifacts are missing or unsafe for $task" >&2
     return 1
   fi
-  if [ "$tasktmp" != "/tmp/fm-$task" ] || [ -z "$generation" ] || [ -z "$target" ]; then
+  if ! fm_account_task_tmp_is_expected "$task" "$tasktmp" \
+    || [ -z "$generation" ] || [ -z "$target" ]; then
     fm_account_meta_lock_release "$lock" >/dev/null 2>&1 || true
     echo "error: retained direct recovery metadata is incomplete for $task" >&2
     return 1
@@ -867,7 +868,7 @@ if [ "$RECOVERY_ACCOUNT" = 1 ]; then
     rollback_backup=$(fm_account_meta_value "$RESUME_META" account_rollback_backup)
     fm_account_meta_lock_release "$rollback_meta_lock" || exit 1
     rollback_meta_lock=
-    if [ -n "$rollback_tasktmp" ] && [ "$rollback_tasktmp" != "/tmp/fm-$rollback_id" ]; then
+    if [ -n "$rollback_tasktmp" ] && ! fm_account_task_tmp_is_expected "$rollback_id" "$rollback_tasktmp"; then
       echo "error: unsafe task temp path in rollback metadata for $rollback_id: $rollback_tasktmp" >&2
       exit 1
     fi
@@ -893,7 +894,9 @@ if [ "$RECOVERY_ACCOUNT" = 1 ]; then
     rollback_profile=$(fm_account_meta_value "$RESUME_META" account_profile)
     if [ -z "$rollback_profile" ] && [ "$rollback_kind" = secondmate ] && [ -z "$rollback_backup" ]; then
       rm -f "$RESUME_META" "$STATE/$rollback_id.status" "$STATE/$rollback_id.turn-ended" "$STATE/$rollback_id.check.sh" "$STATE/$rollback_id.pi-ext.ts" "$STATE/$rollback_id.grok-turnend-token"
-      [ -z "$rollback_tasktmp" ] || rm -rf "$rollback_tasktmp"
+      [ -z "$rollback_tasktmp" ] \
+        || ! fm_account_task_tmp_is_current "$rollback_id" "$rollback_tasktmp" \
+        || rm -rf "$rollback_tasktmp"
     fi
     if [ -z "$rollback_profile" ]; then
       if [ -n "$rollback_backup" ]; then
@@ -1007,7 +1010,7 @@ ORIGINAL_GROK_TOKEN_PRESENT=-1
 ORIGINAL_TASK_TMP_PRESENT=-1
 
 snapshot_existing_artifacts() {
-  local backup name source tasktmp="/tmp/fm-$ID"
+  local backup name source tasktmp=$SPAWN_TASK_TMP
   backup=$(mktemp -d "$STATE/.$ID.artifacts.rollback.XXXXXX") || return 1
   for name in "$ID.status" "$ID.turn-ended" "$ID.check.sh" "$ID.pi-ext.ts" "$ID.grok-turnend-token"; do
     source="$STATE/$name"
@@ -1262,7 +1265,7 @@ persist_failed_direct_recovery() {
     echo "kind=${KIND:-${RECORDED_KIND:-ship}}"
     echo "mode=${MODE:-${RECORDED_MODE:-no-mistakes}}"
     echo "yolo=${YOLO:-${RECORDED_YOLO:-off}}"
-    echo "tasktmp=${TASK_TMP:-${RECORDED_TASKTMP:-/tmp/fm-$ID}}"
+    echo "tasktmp=${TASK_TMP:-$SPAWN_TASK_TMP}"
     echo "model=${RECORDED_MODEL:-${MODEL:-default}}"
     echo "effort=${RECORDED_EFFORT:-${EFFORT:-default}}"
     echo "generation_id=${RECORDED_GENERATION:-${SPAWN_GENERATION_ID:-}}"
@@ -1351,7 +1354,7 @@ persist_failed_direct_spawn() {  # <endpoint-created:0|1>
       echo "kind=${KIND:-ship}"
       echo "mode=$retained_mode"
       echo "yolo=$retained_yolo"
-      echo "tasktmp=${TASK_TMP:-/tmp/fm-$ID}"
+      echo "tasktmp=${TASK_TMP:-$SPAWN_TASK_TMP}"
       echo "model=${MODEL:-default}"
       echo "effort=${EFFORT:-default}"
       echo "generation_id=${SPAWN_GENERATION_ID:-}"
@@ -1464,7 +1467,7 @@ spawn_restore_unmanaged_state_locked() {
   [ "${ACCOUNT_EFFECTIVE_MODE:-off}" != enforce ] || return 0
   if [ -n "$EXISTING_ARTIFACT_BACKUP" ]; then
     artifact_backup_name=${EXISTING_ARTIFACT_BACKUP##*/}
-    fm_account_restore_artifacts "$STATE" "$ID" "$artifact_backup_name" "/tmp/fm-$ID" 1 || return 1
+    fm_account_restore_artifacts "$STATE" "$ID" "$artifact_backup_name" "$SPAWN_TASK_TMP" 1 || return 1
   fi
   if [ -n "$META_BACKUP" ]; then
     [ -f "$META_BACKUP" ] && [ -f "$meta" ] || return 1
@@ -1636,7 +1639,7 @@ spawn_abort_cleanup() {
     fi
     if [ -n "$rollback_lock" ]; then
       artifact_backup_name=${EXISTING_ARTIFACT_BACKUP##*/}
-      if fm_account_restore_artifacts "$STATE" "$ID" "$artifact_backup_name" "${TASK_TMP:-/tmp/fm-$ID}" 1; then
+      if fm_account_restore_artifacts "$STATE" "$ID" "$artifact_backup_name" "${TASK_TMP:-$SPAWN_TASK_TMP}" 1; then
         if [ "$META_INSTALLED" = 1 ] && [ -n "$META_BACKUP" ] && [ -f "$META_BACKUP" ]; then
           if fm_account_meta_merge_extensions "$STATE/$ID.meta" "$META_BACKUP" \
             && fm_account_safe_file_destination "$STATE/$ID.meta" \
@@ -1670,7 +1673,7 @@ spawn_abort_cleanup() {
     if [ -n "$rollback_lock" ] && [ "$worktree_clean" = 1 ]; then
       if [ -n "$META_BACKUP" ] && [ -f "$META_BACKUP" ]; then
         artifact_backup_name=${EXISTING_ARTIFACT_BACKUP##*/}
-        if fm_account_restore_artifacts "$STATE" "$ID" "$artifact_backup_name" "${TASK_TMP:-/tmp/fm-$ID}" 1 \
+        if fm_account_restore_artifacts "$STATE" "$ID" "$artifact_backup_name" "${TASK_TMP:-$SPAWN_TASK_TMP}" 1 \
           && fm_account_meta_merge_extensions "$STATE/$ID.meta" "$META_BACKUP" \
           && fm_account_safe_file_destination "$STATE/$ID.meta" \
           && mv "$META_BACKUP" "$STATE/$ID.meta"; then
@@ -1845,6 +1848,23 @@ if [ "${#POS[@]}" -gt 0 ] && [ "${POS[0]}" != "$idpart" ] && case "$idpart" in *
   exit "$rc"
 fi
 ID=${POS[0]}
+mkdir -p "$STATE" || {
+  echo "error: cannot establish state directory at $STATE" >&2
+  exit 1
+}
+SPAWN_TASK_TMP=$(fm_account_task_tmp_path "$ID") || {
+  echo "error: cannot establish a safe task temp path for $ID" >&2
+  exit 1
+}
+if [ "$SPAWN_META_PRESENT" = 1 ]; then
+  EXISTING_TASK_TMP=$(spawn_preflight_meta_value tasktmp)
+  if [ -n "$EXISTING_TASK_TMP" ]; then
+    fm_account_task_tmp_is_expected "$ID" "$EXISTING_TASK_TMP" || {
+      echo "error: existing task metadata has an unsafe tasktmp for $ID" >&2
+      exit 1
+    }
+  fi
+fi
 PROJ=
 ARG3=
 FIRSTMATE_HOME=
@@ -1929,7 +1949,7 @@ if [ -e "$STATE/$ID.turn-ended" ] || [ -L "$STATE/$ID.turn-ended" ]; then ORIGIN
 if [ -e "$STATE/$ID.check.sh" ] || [ -L "$STATE/$ID.check.sh" ]; then ORIGINAL_CHECK_PRESENT=1; else ORIGINAL_CHECK_PRESENT=0; fi
 if [ -e "$STATE/$ID.pi-ext.ts" ] || [ -L "$STATE/$ID.pi-ext.ts" ]; then ORIGINAL_PI_EXT_PRESENT=1; else ORIGINAL_PI_EXT_PRESENT=0; fi
 if [ -e "$STATE/$ID.grok-turnend-token" ] || [ -L "$STATE/$ID.grok-turnend-token" ]; then ORIGINAL_GROK_TOKEN_PRESENT=1; else ORIGINAL_GROK_TOKEN_PRESENT=0; fi
-if [ -e "/tmp/fm-$ID" ] || [ -L "/tmp/fm-$ID" ]; then ORIGINAL_TASK_TMP_PRESENT=1; else ORIGINAL_TASK_TMP_PRESENT=0; fi
+if [ -e "$SPAWN_TASK_TMP" ] || [ -L "$SPAWN_TASK_TMP" ]; then ORIGINAL_TASK_TMP_PRESENT=1; else ORIGINAL_TASK_TMP_PRESENT=0; fi
 
 if [ "$RECOVERY_ACCOUNT" = 1 ]; then
   RECORDED_KIND=$(fm_meta_get "$RESUME_META" kind)
@@ -2007,7 +2027,7 @@ if [ "$RECOVERY_ACCOUNT" = 1 ]; then
     [ -n "$RECORDED_MODE" ] || { echo "error: direct account recovery metadata has no mode for $ID" >&2; exit 1; }
     [ -n "$RECORDED_YOLO" ] || { echo "error: direct account recovery metadata has no yolo setting for $ID" >&2; exit 1; }
     [ -n "$RECORDED_GENERATION" ] || { echo "error: direct account recovery metadata has no generation_id for $ID" >&2; exit 1; }
-    [ "$RECORDED_TASKTMP" = "/tmp/fm-$ID" ] || { echo "error: direct account recovery metadata has an invalid tasktmp for $ID" >&2; exit 1; }
+    fm_account_task_tmp_is_expected "$ID" "$RECORDED_TASKTMP" || { echo "error: direct account recovery metadata has an invalid tasktmp for $ID" >&2; exit 1; }
     RECORDED_META_WORKTREE_GIT_REF=$RECORDED_WORKTREE_GIT_REF
     RECORDED_META_WORKTREE_GIT_HEAD=$RECORDED_WORKTREE_GIT_HEAD
     RECORDED_META_WORKTREE_GIT_SETUP_REF=$RECORDED_WORKTREE_GIT_SETUP_REF
@@ -2981,12 +3001,14 @@ if [ "$DIRECT_ACCOUNT_ROUTING" = 1 ] && [ "$DIRECT_ACCOUNT_RECOVERY" = 0 ] && [
   }
 fi
 
-# Per-task temp root: /tmp/fm-<id>/ with Go's build temp nested at gotmp/. Go won't
+# Per-task temp root with Go's build temp nested at gotmp/. The physical task
+# state directory is its namespace, so separate homes and test runs cannot
+# share a root even when their human-readable task ids match. Go won't
 # create GOTMPDIR, so mkdir before it is used; fm-teardown removes the whole root.
-# Nested (not a bare /tmp/fm-<id>/gotmp) so other per-task temp can live alongside
+# Nested (not a bare task-root/gotmp) so other per-task temp can live alongside
 # later, and teardown cleans one deterministic path. GOTMPDIR (not TMPDIR) is the
 # targeted knob: TMPDIR is too broad (affects every program's temp, not just Go's).
-TASK_TMP="/tmp/fm-$ID"
+TASK_TMP=$SPAWN_TASK_TMP
 mkdir -p "$TASK_TMP/gotmp"
 # herdr sets GOTMPDIR natively at agent start. Every other backend exports it into
 # the pane shell just before the launch line, further down. CREW_PATH rides the same
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index ea03eda10b..be85537399 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -93,6 +93,7 @@ FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 DATA="${FM_DATA_OVERRIDE:-$FM_HOME/data}"
 CONFIG="${FM_CONFIG_OVERRIDE:-$FM_HOME/config}"
+PROJECTS="${FM_PROJECTS_OVERRIDE:-$FM_HOME/projects}"
 CHECKOUT_STATE_BASE="${FM_CHECKOUT_REFRESH_STATE_BASE:-${XDG_STATE_HOME:-$HOME/.local/state}/firstmate/checkout-refresh}"
 SECONDMATE_REG="$DATA/secondmates.md"
 SUB_HOME_MARKER=".fm-secondmate-home"
@@ -125,6 +126,10 @@ case "$TEARDOWN_UPSTREAM_TIMEOUT" in
 esac
 ID=$1
 FORCE=${2:-}
+fm_account_task_tmp_path "$ID" >/dev/null || {
+  echo "error: cannot establish a safe task temp path for $ID" >&2
+  exit 1
+}
 
 META="$STATE/$ID.meta"
 
@@ -202,10 +207,10 @@ if [ "$BACKEND" = orca ]; then
 fi
 HOME_PATH=$(grep '^home=' "$META" | cut -d= -f2- || true)
 PR_URL=$(grep '^pr=' "$META" | tail -1 | cut -d= -f2- || true)
-# tasktmp is recorded by fm-spawn for tasks that set up a per-task temp root
-# (/tmp/fm-<id>/); absent for tasks spawned before that change, so tolerate empty.
+# tasktmp is recorded by fm-spawn for tasks that set up a per-task temp root;
+# absent for tasks spawned before that change, so tolerate empty.
 TASK_TMP=$(grep '^tasktmp=' "$META" | cut -d= -f2- || true)
-if [ -n "$TASK_TMP" ] && [ "$TASK_TMP" != "/tmp/fm-$ID" ]; then
+if [ -n "$TASK_TMP" ] && ! fm_account_task_tmp_is_expected "$ID" "$TASK_TMP"; then
   echo "REFUSED: unsafe task temp path in metadata for $ID: $TASK_TMP" >&2
   exit 1
 fi
@@ -1547,19 +1552,17 @@ import sys
 
 home, state_path = sys.argv[1:]
 try:
-    if os.path.islink(state_path):
-        raise OSError("state directory must not be a symlink")
-    metadata = os.stat(state_path)
+    home_root = os.path.realpath(home)
+    state_root = os.path.realpath(state_path)
+    if state_root == home_root or os.path.commonpath((home_root, state_root)) != home_root:
+        raise OSError("state directory resolves outside its secondmate home")
+    metadata = os.stat(state_root)
     permissions = stat.S_IMODE(metadata.st_mode)
     if not stat.S_ISDIR(metadata.st_mode):
         raise NotADirectoryError(state_path)
     if not permissions & 0o444 or not permissions & 0o111:
         raise PermissionError("state directory is unreadable")
-    home_root = os.path.realpath(home)
-    state_root = os.path.realpath(state_path)
-    if state_root != os.path.join(home_root, "state"):
-        raise OSError("state directory resolves outside its secondmate home")
-    with os.scandir(state_path) as entries:
+    with os.scandir(state_root) as entries:
         for entry in sorted(entries, key=lambda item: item.name):
             metadata = entry.stat(follow_symlinks=False)
             if not entry.name.endswith(".meta"):
@@ -1570,7 +1573,7 @@ try:
                 raise PermissionError(f"unreadable child metadata entry: {entry.path}")
             if any(character in entry.path for character in ("\n", "\r")):
                 raise OSError("child metadata path contains unsupported control characters")
-            print(entry.path)
+            print(os.path.join(state_root, entry.name))
 except OSError as error:
     print(
         f"REFUSED: secondmate child state is unprovable at {state_path}: {error}",
@@ -1826,15 +1829,29 @@ safe_rm_rf_child_worktree() {
 }
 
 safe_remove_task_tmp() {
-  local target=$1 base
+  local target=$1 base legacy
   [ -n "$target" ] || return 0
-  [ "$target" = "/tmp/fm-$ID" ] || return 1
-  base=$(python3 - <<'PY'
+  fm_account_task_tmp_is_expected "$ID" "$target" || return 1
+  legacy=$(fm_account_legacy_task_tmp_path "$ID") || return 1
+  # Legacy compatibility is classification-only. Never inspect or mutate the
+  # old process-wide /tmp/fm-<id> location from a current teardown.
+  [ "$target" != "$legacy" ] || return 0
+  fm_account_task_tmp_is_current "$ID" "$target" || return 1
+  [ -e "$target" ] || [ -L "$target" ] || return 0
+  base=${target%/*}
+  base=$(python3 - "$base" <<'PY'
 import os
 import stat
+import sys
 
-base = os.path.realpath("/tmp")
-if base not in ("/tmp", "/private/tmp"):
+raw = sys.argv[1]
+base = os.path.realpath(raw)
+if raw == "/tmp":
+    if base not in ("/tmp", "/private/tmp"):
+        raise SystemExit(1)
+elif raw != base:
+    raise SystemExit(1)
+if not base.startswith(os.path.sep) or base == os.path.sep:
     raise SystemExit(1)
 current = os.path.sep
 for component in base.split(os.path.sep):
@@ -1849,7 +1866,8 @@ if not stat.S_ISDIR(os.lstat(base).st_mode):
 print(base)
 PY
   ) || return 1
-  removal_tree_operation "$base/fm-$ID" "task temp root" remove
+  removal_tree_operation "$base/${target##*/}" "task temp root" remove || return 1
+  fm_account_system_exec "$FM_ACCOUNT_SYSTEM_RMDIR_BIN" "$base" 2>/dev/null || true
 }
 
 remove_worktree_compatibility_artifacts() {
@@ -1971,6 +1989,10 @@ validate_secondmate_home_landed_state() {
     $0 == "?? .claude/settings.local.json" { next }
     $0 == "?? .opencode/plugins/fm-turn-end.js" { next }
     $0 == "?? .fm-grok-turnend" { next }
+    $0 == "?? config" { next }
+    $0 == "?? data" { next }
+    $0 == "?? projects" { next }
+    $0 == "?? state" { next }
     $0 != "" { print }
   ')
   [ -z "$unsafe" ] || {
@@ -2708,6 +2730,7 @@ EOF
   }
   while IFS= read -r ref; do
     [ -n "$ref" ] || continue
+    [ "$ref" != refs/stash ] || continue
     git -C "$repository" cat-file -e "$ref^{object}" 2>/dev/null || {
       echo "REFUSED: $label ref $ref depends on unavailable objects" >&2
       return 1
@@ -3074,8 +3097,29 @@ except OSError:
 PY
 }
 
+secondmate_child_worktree_is_registered() {
+  local home=$1 repository=$2 worktree=$3 child_metas child_meta child_kind child_project child_worktree
+  local canonical_project canonical_worktree matches=0
+  child_metas=$(secondmate_state_metadata "$home") || return 1
+  while IFS= read -r child_meta; do
+    [ -n "$child_meta" ] || continue
+    child_kind=$(meta_value "$child_meta" kind)
+    [ "$child_kind" != secondmate ] || continue
+    child_project=$(meta_value "$child_meta" project)
+    child_worktree=$(meta_value "$child_meta" worktree)
+    canonical_project=$(exact_git_worktree_root "$child_project") || continue
+    canonical_worktree=$(exact_git_worktree_root "$child_worktree") || continue
+    if [ "$canonical_project" = "$repository" ] && [ "$canonical_worktree" = "$worktree" ]; then
+      matches=$((matches + 1))
+    fi
+  done <<EOF
+$child_metas
+EOF
+  [ "$matches" -eq 1 ]
+}
+
 validate_secondmate_repository_worktree_graph() {
-  local repository=$1 retiring_home=$2 repository_container=${3:-$1}
+  local repository=$1 retiring_home=$2 repository_container=${3:-$1} allow_registered_children=${4:-0}
   local common listed records path kind canonical count=0 bare_repository container_git submodule_admin=0
   bare_repository=$(git -C "$repository" rev-parse --is-bare-repository 2>/dev/null) || return 1
   common=$(git -C "$repository" rev-parse --git-common-dir 2>/dev/null) || return 1
@@ -3144,6 +3188,9 @@ validate_secondmate_repository_worktree_graph() {
           :
         elif [ "$submodule_admin" -eq 1 ] && [ "$canonical" = "$common" ]; then
           :
+        elif [ "$allow_registered_children" -eq 1 ] \
+          && secondmate_child_worktree_is_registered "$retiring_home" "$repository" "$canonical"; then
+          :
         else
           echo "REFUSED: secondmate project common Git directory owns another linked worktree at $canonical" >&2
           return 1
@@ -3154,10 +3201,17 @@ validate_secondmate_repository_worktree_graph() {
   done <<EOF
 $records
 EOF
-  [ "$count" -eq 1 ] || {
-    echo "REFUSED: secondmate project linked-worktree ownership is ambiguous at $repository" >&2
-    return 1
-  }
+  if [ "$allow_registered_children" -eq 1 ]; then
+    [ "$count" -ge 1 ] || {
+      echo "REFUSED: secondmate project linked-worktree ownership is ambiguous at $repository" >&2
+      return 1
+    }
+  else
+    [ "$count" -eq 1 ] || {
+      echo "REFUSED: secondmate project linked-worktree ownership is ambiguous at $repository" >&2
+      return 1
+    }
+  fi
 }
 
 validate_secondmate_declared_submodules() {
@@ -3187,7 +3241,7 @@ EOF
 
 validate_secondmate_project_repository_landed_state() {
   local repository=$1 source_repository=$2 retiring_home=$3 repository_container=${4:-$1}
-  local source_container=${5:-$2} dirty refs ref tip reflog_tips
+  local source_container=${5:-$2} allow_registered_children=${6:-0} dirty refs ref tip reflog_tips
   local remote_tips remote_tip landed repository_identity source_identity bare stash_status
   local authority_record authority_kind authority cleanup_status=0
   [ "$(exact_git_repository_root "$repository" "$repository_container")" = "$repository" ] || {
@@ -3203,7 +3257,7 @@ validate_secondmate_project_repository_landed_state() {
     "registered source project repository" || return 1
   git_history_rewrite_state_is_clean "$repository" "secondmate project repository" || return 1
   validate_secondmate_repository_worktree_graph \
-    "$repository" "$retiring_home" "$repository_container" || return 1
+    "$repository" "$retiring_home" "$repository_container" "$allow_registered_children" || return 1
   validate_secondmate_declared_submodules "$repository" "$repository_container" || {
     echo "REFUSED: secondmate project submodule state is uninspectable at $repository" >&2
     return 1
@@ -3306,7 +3360,7 @@ EOF
 
 validate_secondmate_project_clones() {
   local home=$1 registry=$2 expected_id=$3 expected_source=$4 projects_root source_projects_root
-  local expected listed project clone source_clone repositories relative repository source_repository
+  local allow_registered_children=${5:-0} home_root expected listed project clone source_clone repositories relative repository source_repository
   if ! expected=$(fm_secondmate_registry_query "$registry" query "$expected_id" projects); then
     if [ "$registry" = "$PREPARED_REGISTRY_PATH" ] \
         && [ "$expected_id" = "$PREPARED_REGISTRY_ID" ] \
@@ -3320,7 +3374,12 @@ validate_secondmate_project_clones() {
       return 1
     fi
   fi
-  projects_root=$(fm_checkout_trusted_dir "$home/projects") || {
+  home_root=$(canonical_existing_dir "$home") || return 1
+  projects_root=$(cd "$home/projects" 2>/dev/null && pwd -P) || {
+    echo "REFUSED: secondmate projects directory is missing, redirected, or unreadable at $home/projects" >&2
+    return 1
+  }
+  path_is_ancestor_of "$home_root" "$projects_root" || {
     echo "REFUSED: secondmate projects directory is missing, redirected, or unreadable at $home/projects" >&2
     return 1
   }
@@ -3352,8 +3411,8 @@ PY
     echo "REFUSED: secondmate project clones do not exactly match the registration for $expected_id" >&2
     return 1
   }
-  if [ "$expected_source" = "$FM_ROOT" ] && [ -n "${FM_PROJECTS_OVERRIDE:-}" ]; then
-    source_projects_root=$FM_PROJECTS_OVERRIDE
+  if [ "$expected_source" = "$FM_ROOT" ]; then
+    source_projects_root=$PROJECTS
   else
     source_projects_root="$expected_source/projects"
   fi
@@ -3386,7 +3445,7 @@ PY
         }
       fi
       validate_secondmate_project_repository_landed_state \
-        "$repository" "$source_repository" "$home" "$clone" "$source_clone" || return 1
+        "$repository" "$source_repository" "$home" "$clone" "$source_clone" "$allow_registered_children" || return 1
     done <<EOF
 $repositories
 EOF
@@ -3397,7 +3456,7 @@ EOF
 
 validate_firstmate_home_for_removal() {
   local home=$1 label=$2 expected_id=${3:-} expected_source=${4:-$FM_ROOT} expected_registry=${5:-} expected_project
-  local abs_home_path metadata_home_root marker_id source_authority=${7:-1}
+  local abs_home_path metadata_home_root marker_id source_authority=${7:-1} allow_registered_children=${8:-0}
   expected_project=${6:-$home}
   [ -n "$home" ] && [ -e "$home" ] || {
     echo "REFUSED: missing $label removal target ${home:-<empty>}" >&2
@@ -3437,7 +3496,7 @@ validate_firstmate_home_for_removal() {
   validate_secondmate_home_landed_state "$abs_home_path" "$expected_source" || return 1
   if [ -n "$expected_id" ]; then
     validate_secondmate_project_clones \
-      "$abs_home_path" "$expected_registry" "$expected_id" "$expected_source" || return 1
+      "$abs_home_path" "$expected_registry" "$expected_id" "$expected_source" "$allow_registered_children" || return 1
   fi
   validate_firstmate_operational_dirs_for_removal "$abs_home_path" "$label" || return 1
   secondmate_state_metadata "$abs_home_path" >/dev/null || return 1
@@ -3553,7 +3612,7 @@ validate_firstmate_home_children_removal() {
       child_proj=$(meta_value "$child_meta" project)
       child_home=$(meta_value "$child_meta" home)
       [ -n "$child_home" ] || child_home=$child_wt
-      validate_firstmate_home_for_removal "$child_home" "child firstmate home" "$child_id" "$home" "$home/data/secondmates.md" "$child_proj" >/dev/null || return 1
+      validate_firstmate_home_for_removal "$child_home" "child firstmate home" "$child_id" "$home" "$home/data/secondmates.md" "$child_proj" 1 1 >/dev/null || return 1
       validate_firstmate_home_children_removal "$child_home" || return 1
     elif [ "$child_backend" = orca ]; then
       require_orca_task_metadata_identity "$child_meta" "$child_id" || return 1
@@ -3900,15 +3959,12 @@ if [ "$KIND" = secondmate ]; then
     exit 1
   }
   validate_firstmate_home_for_removal \
-    "$HOME_PATH" "secondmate home" "$ID" "$FM_ROOT" "$SECONDMATE_REG" "$PROJ" 0 \
+    "$HOME_PATH" "secondmate home" "$ID" "$FM_ROOT" "$SECONDMATE_REG" "$PROJ" 0 1 \
     >/dev/null || exit 1
-  if [ "$FORCE" = "--force" ]; then
-    validate_firstmate_home_children_removal "$HOME_PATH" || exit 1
-  fi
-  quiesce_secondmate_endpoint || exit 1
   if [ "$FORCE" = "--force" ]; then
     validate_firstmate_home_children_removal "$HOME_PATH" || exit 1
   else
+    require_empty_secondmate_registry "$HOME_PATH" || exit 1
     SUB_STATE="$HOME_PATH/state"
     CHILD_METAS=$(secondmate_state_metadata "$HOME_PATH") || exit 1
     if [ -n "$CHILD_METAS" ]; then
@@ -3918,6 +3974,10 @@ if [ "$KIND" = secondmate ]; then
       exit 1
     fi
   fi
+  quiesce_secondmate_endpoint || exit 1
+  if [ "$FORCE" = "--force" ]; then
+    validate_firstmate_home_children_removal "$HOME_PATH" || exit 1
+  fi
 fi
 
 if [ "$KIND" = scout ]; then
@@ -4065,7 +4125,11 @@ if [ "$MANAGED_ACCOUNT" = 1 ]; then
 fi
 
 if [ "$KIND" = secondmate ] && [ "$FORCE" = "--force" ]; then
-  cleanup_firstmate_home_children "$HOME_PATH" || exit 1
+  if cleanup_firstmate_home_children "$HOME_PATH"; then
+    :
+  else
+    exit $?
+  fi
 fi
 
 [ "$KIND" = secondmate ] || validate_teardown_target_identity || exit 1
@@ -4182,7 +4246,7 @@ EOF
 fi
 remove_grok_turnend_auth "$STATE" "$ID"
 fm_backend_clear_transition "$BACKEND" "$STATE" "$T" || true
-# Remove the per-task temp root (/tmp/fm-<id>/, incl. its gotmp/) recorded by spawn.
+# Remove the per-task temp root, including its gotmp, recorded by spawn.
 # Read before the state-file rm below; empty (pre-fix tasks without tasktmp=) is a no-op.
 [ -z "$TASK_TMP" ] || safe_remove_task_tmp "$TASK_TMP" || exit 1
 rm -f "$STATE/$ID.status" "$STATE/$ID.turn-ended" "$STATE/$ID.check.sh" "$STATE/$ID.meta" "$STATE/$ID.pi-ext.ts" "$STATE/$ID.grok-turnend-token"
diff --git a/bin/fm-watch-checkpoint.sh b/bin/fm-watch-checkpoint.sh
index d754301fa4..9d153b1f69 100755
--- a/bin/fm-watch-checkpoint.sh
+++ b/bin/fm-watch-checkpoint.sh
@@ -88,10 +88,10 @@ run_with_perl_timeout() {
 
 set +e
 if command -v timeout >/dev/null 2>&1; then
-  timeout "$SECONDS_ARG" "$SCRIPT_DIR/fm-watch.sh" >"$OUT" 2>"$ERR"
+  timeout --kill-after=2 "$SECONDS_ARG" "$SCRIPT_DIR/fm-watch.sh" >"$OUT" 2>"$ERR"
   RC=$?
 elif command -v gtimeout >/dev/null 2>&1; then
-  gtimeout "$SECONDS_ARG" "$SCRIPT_DIR/fm-watch.sh" >"$OUT" 2>"$ERR"
+  gtimeout --kill-after=2 "$SECONDS_ARG" "$SCRIPT_DIR/fm-watch.sh" >"$OUT" 2>"$ERR"
   RC=$?
 else
   run_with_perl_timeout >"$OUT" 2>"$ERR"
diff --git a/tests/fm-account-directory.test.sh b/tests/fm-account-directory.test.sh
index 96e496b525..b4da5284cd 100755
--- a/tests/fm-account-directory.test.sh
+++ b/tests/fm-account-directory.test.sh
@@ -6,7 +6,7 @@ set -u
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 SELECTOR="$ROOT/bin/fm-account-directory.sh"
-TMP_ROOT=$(fm_test_tmproot fm-account-directory-tests)
+fm_test_tmproot_into TMP_ROOT fm-account-directory-tests
 ACCOUNT_ROOT="$TMP_ROOT/accounts"
 FAKEBIN=$(fm_fakebin "$TMP_ROOT")
 QUOTA_LOG="$TMP_ROOT/quota.log"
@@ -315,7 +315,7 @@ make_spawn_case() {
   worktree="$case_dir/worktree"
   launch_log="$case_dir/launch.log"
   mkdir -p "$home/data/$id" "$home/projects" "$home/state" "$home/config" \
-    "$home/treehouse-pools"
+    "$home/state/.task-tmp" "$home/treehouse-pools"
   printf '%s\n' "$harness" > "$home/config/crew-harness"
   printf 'brief for %s\n' "$id" > "$home/data/$id/brief.md"
   touch "$home/state/.last-watcher-beat"
@@ -744,8 +744,8 @@ test_direct_recovery_tracks_retained_replacement_endpoint() {
   set_remaining 1 20,15
   set_remaining 2 95,90
   rm -f "$SPAWN_HOME/state/.fake-endpoint"
-  rm -rf "/tmp/fm-$id"
-  : > "/tmp/fm-$id"
+  rm -rf "$SPAWN_HOME/state/.task-tmp/fm-$id"
+  : > "$SPAWN_HOME/state/.task-tmp/fm-$id"
 
   if out=$(FM_FAKE_KILL_RETAIN=1 \
     run_direct_spawn "$SPAWN_HOME" "$SPAWN_WORKTREE" "$SPAWN_LAUNCH_LOG" \
@@ -765,7 +765,7 @@ test_direct_recovery_tracks_retained_replacement_endpoint() {
   [ -f "$SPAWN_HOME/state/$backup_name" ] || fail "failed recovery did not retain its prior metadata backup"
   [ -d "$SPAWN_HOME/state/$artifacts_name" ] || fail "failed recovery did not retain its artifact backup"
 
-  rm -f "/tmp/fm-$id" "$SPAWN_HOME/state/.fake-endpoint"
+  rm -f "$SPAWN_HOME/state/.task-tmp/fm-$id" "$SPAWN_HOME/state/.fake-endpoint"
   retry=$(run_direct_spawn "$SPAWN_HOME" "$SPAWN_WORKTREE" "$SPAWN_LAUNCH_LOG" \
     "$id" --recover-direct-account 2>&1)
   launch=$(cat "$SPAWN_LAUNCH_LOG")
@@ -776,7 +776,7 @@ test_direct_recovery_tracks_retained_replacement_endpoint() {
   if grep -q '^direct_recovery_' "$meta"; then fail "successful retry left direct recovery markers in metadata"; fi
   [ ! -e "$SPAWN_HOME/state/$backup_name" ] || fail "successful retry left the retained metadata backup"
   [ ! -e "$SPAWN_HOME/state/$artifacts_name" ] || fail "successful retry left the retained artifact backup"
-  rm -rf "/tmp/fm-$id"
+  rm -rf "$SPAWN_HOME/state/.task-tmp/fm-$id"
   pass "failed direct recovery tracks and reconciles a retained replacement endpoint"
 }
 
@@ -788,7 +788,7 @@ test_new_direct_spawn_tracks_retained_endpoint_and_worktree() {
   id=direct-new-retained-z8
   record=$(make_spawn_case direct-new-retained codex "$id")
   read_spawn_case "$record"
-  : > "/tmp/fm-$id"
+  : > "$SPAWN_HOME/state/.task-tmp/fm-$id"
 
   if out=$(FM_FAKE_KILL_RETAIN=1 \
     run_direct_spawn "$SPAWN_HOME" "$SPAWN_WORKTREE" "$SPAWN_LAUNCH_LOG" \
@@ -827,7 +827,7 @@ test_new_direct_spawn_tracks_retained_endpoint_and_worktree() {
   [ "$recovery_status" -ne 0 ] || fail "direct recovery bypassed pending new-spawn cleanup"
   assert_contains "$recovery_out" "failed direct spawn cleanup is pending" \
     "pending new-spawn cleanup refusal was not actionable"
-  rm -f "/tmp/fm-$id" "$SPAWN_HOME/state/.fake-endpoint"
+  rm -f "$SPAWN_HOME/state/.task-tmp/fm-$id" "$SPAWN_HOME/state/.fake-endpoint"
   pass "new direct spawn tracks retained endpoint and worktree state"
 }
 
@@ -840,7 +840,7 @@ test_failed_new_direct_spawn_returns_worktree_after_endpoint_cleanup() {
   read_spawn_case "$record"
   recorded_worktree=$(cd "$SPAWN_WORKTREE" && pwd -P)
   : > "$TREEHOUSE_LOG"
-  : > "/tmp/fm-$id"
+  : > "$SPAWN_HOME/state/.task-tmp/fm-$id"
 
   if out=$(run_direct_spawn "$SPAWN_HOME" "$SPAWN_WORKTREE" "$SPAWN_LAUNCH_LOG" \
     "$id" "$SPAWN_PROJECT" --account-pool legacy-codex-pool 2>&1); then
@@ -855,7 +855,7 @@ test_failed_new_direct_spawn_returns_worktree_after_endpoint_cleanup() {
   [ ! -e "$SPAWN_WORKTREE" ] || fail "failed new direct spawn left its worktree registered"
   [ ! -e "$SPAWN_HOME/state/$id.meta" ] || fail "successful direct rollback left task metadata"
   [ ! -e "$SPAWN_HOME/state/.fake-endpoint" ] || fail "successful direct rollback left its endpoint"
-  rm -f "/tmp/fm-$id"
+  rm -f "$SPAWN_HOME/state/.task-tmp/fm-$id"
   pass "failed new direct spawn removes its endpoint and returns its worktree"
 }
 
@@ -867,7 +867,7 @@ test_failed_new_direct_spawn_retains_cleanup_when_worktree_return_fails() {
   record=$(make_spawn_case direct-new-return-fail codex "$id")
   read_spawn_case "$record"
   : > "$TREEHOUSE_LOG"
-  : > "/tmp/fm-$id"
+  : > "$SPAWN_HOME/state/.task-tmp/fm-$id"
 
   if out=$(FM_FAKE_TREEHOUSE_RETURN_FAIL=1 \
     run_direct_spawn "$SPAWN_HOME" "$SPAWN_WORKTREE" "$SPAWN_LAUNCH_LOG" \
@@ -884,7 +884,7 @@ test_failed_new_direct_spawn_retains_cleanup_when_worktree_return_fails() {
   assert_grep "rollback_pending=1" "$meta" \
     "direct return failure did not fail closed"
   [ ! -e "$SPAWN_HOME/state/.fake-endpoint" ] || fail "direct return failure retained an already-removed endpoint"
-  rm -f "/tmp/fm-$id"
+  rm -f "$SPAWN_HOME/state/.task-tmp/fm-$id"
   pass "direct spawn persists cleanup state when worktree return cannot be confirmed"
 }
 
@@ -896,7 +896,7 @@ test_failed_new_direct_spawn_never_records_an_uncreated_endpoint() {
   record=$(make_spawn_case direct-new-no-endpoint codex "$id")
   read_spawn_case "$record"
   : > "$TREEHOUSE_LOG"
-  : > "/tmp/fm-$id"
+  : > "$SPAWN_HOME/state/.task-tmp/fm-$id"
 
   if out=$(T=default:captain-pane FM_FAKE_TREEHOUSE_RETURN_FAIL=1 \
     run_direct_spawn "$SPAWN_HOME" "$SPAWN_WORKTREE" "$SPAWN_LAUNCH_LOG" \
@@ -919,7 +919,7 @@ test_failed_new_direct_spawn_never_records_an_uncreated_endpoint() {
   assert_no_grep "herdr_pane_id=" "$meta" \
     "pre-endpoint failure copied an ambient Herdr pane identity"
   [ ! -e "$SPAWN_HOME/state/.fake-endpoint" ] || fail "pre-endpoint failure created an endpoint"
-  rm -f "/tmp/fm-$id"
+  rm -f "$SPAWN_HOME/state/.task-tmp/fm-$id"
   pass "failed direct spawn never records an endpoint it did not create"
 }
 
diff --git a/tests/fm-account-routing.test.sh b/tests/fm-account-routing.test.sh
index 7e795905ff..021f377d62 100755
--- a/tests/fm-account-routing.test.sh
+++ b/tests/fm-account-routing.test.sh
@@ -16,7 +16,7 @@ SEND="$ROOT/bin/fm-send.sh"
 TEARDOWN="$ROOT/bin/fm-teardown.sh"
 SESSION_SYNC="$ROOT/bin/fm-account-session-sync.sh"
 CONTINUATION="$ROOT/bin/fm-account-continuation.sh"
-TMP_ROOT=$(fm_test_tmproot fm-account-routing-tests)
+fm_test_tmproot_into TMP_ROOT fm-account-routing-tests
 
 assert_not_grep() {
   local pattern=$1 file=$2 label=$3
@@ -237,14 +237,37 @@ if [ "${1:-}" = return ] && [ -n "${FM_FAKE_TREEHOUSE_RETURN_CHILD_PID_FILE:-}"
 fi
 if [ "${1:-}" = get ]; then
   lease_holder=
-  previous=
-  for argument in "$@"; do
-    [ "$previous" != --lease-holder ] || lease_holder=$argument
-    previous=$argument
+  prev=
+  for arg in "$@"; do
+    if [ "$prev" = --lease-holder ]; then
+      lease_holder=$arg
+      break
+    fi
+    prev=$arg
   done
-  pool=$(dirname "$(dirname "${FM_FAKE_TREEHOUSE_PATH:?}")")
-  printf '{"worktrees":[{"path":"%s","leased":true,"lease_holder":"%s","destroying":false}]}\n' \
-    "$FM_FAKE_TREEHOUSE_PATH" "$lease_holder" > "$pool/treehouse-state.json"
+  if [ -n "${FM_FAKE_TREEHOUSE_STATE:-}" ] && [ -n "$lease_holder" ]; then
+    python3 - "$FM_FAKE_TREEHOUSE_STATE" "${FM_FAKE_TREEHOUSE_PATH:?}" "$lease_holder" <<'PY'
+import json
+import os
+import sys
+
+state, path, holder = sys.argv[1:]
+with open(state, "w", encoding="utf-8") as stream:
+    json.dump(
+        {
+            "worktrees": [
+                {
+                    "name": "1",
+                    "path": os.path.realpath(path),
+                    "leased": True,
+                    "lease_holder": holder,
+                }
+            ]
+        },
+        stream,
+    )
+PY
+  fi
   printf '%s\n' "${FM_FAKE_TREEHOUSE_PATH:?}"
 fi
 exit 0
@@ -310,6 +333,7 @@ case "$*" in
     [ -n "$pool" ] || pool=${FM_FAKE_AF_POOL:-claude-crew}
     case "$*" in
       *" lease recover "*)
+        [ -z "${FM_FAKE_AF_RECOVER_MARKER:-}" ] || touch "$FM_FAKE_AF_RECOVER_MARKER"
         [ "${FM_FAKE_AF_RECOVER_FAIL:-0}" != 1 ] || exit "${FM_FAKE_AF_RECOVER_FAIL_STATUS:-42}"
         if [ -n "${FM_FAKE_AF_RECOVER_FAIL_ONCE_FILE:-}" ] && [ ! -e "$FM_FAKE_AF_RECOVER_FAIL_ONCE_FILE" ]; then
           : > "$FM_FAKE_AF_RECOVER_FAIL_ONCE_FILE"
@@ -320,6 +344,7 @@ case "$*" in
         [ "${FM_FAKE_AF_STALE_REFRESH_ON_RECOVER:-0}" != 1 ] || touch "${FM_FAKE_AF_SESSION_REFRESHED:?}"
         ;;
       *" lease choose "*|*" lease acquire "*)
+        [ -z "${FM_FAKE_AF_SELECT_MARKER:-}" ] || touch "$FM_FAKE_AF_SELECT_MARKER"
         [ -z "${FM_FAKE_AF_CHOOSE_FAIL_STATUS:-}" ] || exit "$FM_FAKE_AF_CHOOSE_FAIL_STATUS"
         [ -z "${FM_FAKE_AF_SELECT_SLEEP:-}" ] || sleep "$FM_FAKE_AF_SELECT_SLEEP"
         [ -z "${FM_FAKE_AF_SELECT_COMPLETED:-}" ] || touch "$FM_FAKE_AF_SELECT_COMPLETED"
@@ -385,6 +410,7 @@ case "$*" in
     printf '{"schema":%s,"task":"%s","profile":"%s","provider":"%s","pool":"%s","workspace":"%s","session_id":"sess-%s","session_event_seq":%s,"updated_at":"%s"}\n' "$session_schema" "$task" "$profile" "$provider" "$pool" "$workspace" "$task" "$session_event_seq" "$updated_at"
     ;;
   *" lease release "*)
+    [ -z "${FM_FAKE_AF_RELEASE_START_MARKER:-}" ] || touch "$FM_FAKE_AF_RELEASE_START_MARKER"
     [ -z "${FM_FAKE_AF_RELEASE_SLEEP:-}" ] || sleep "$FM_FAKE_AF_RELEASE_SLEEP"
     [ -z "${FM_FAKE_AF_RELEASE_COMPLETED:-}" ] || touch "$FM_FAKE_AF_RELEASE_COMPLETED"
     [ -z "${FM_FAKE_AF_RELEASE_MARKER:-}" ] || touch "$FM_FAKE_AF_RELEASE_MARKER"
@@ -475,7 +501,8 @@ run_spawn() {
     FM_FAKE_TREEHOUSE_LOG="$TREEHOUSE_LOG" FM_FAKE_LIFECYCLE_LOG="$LIFECYCLE_LOG" \
     FM_EXPECT_CHECKOUT_LOCK_ROOT="${FM_EXPECT_CHECKOUT_LOCK_ROOT:-}" \
     FM_EXPECT_CHECKOUT_LOCK_MARKER="${FM_EXPECT_CHECKOUT_LOCK_MARKER:-}" \
-    FM_FAKE_TREEHOUSE_PATH="$WT_DIR" FM_TREEHOUSE_ROOT="$CASE_DIR/treehouse-pools" \
+    FM_FAKE_TREEHOUSE_PATH="$WT_DIR" FM_FAKE_TREEHOUSE_STATE="$CASE_DIR/treehouse-root/pool/treehouse-state.json" \
+    FM_TREEHOUSE_ROOT="$CASE_DIR/treehouse-root" \
     FM_FAKE_TREEHOUSE_SLEEP="${FM_FAKE_TREEHOUSE_SLEEP:-}" \
     FM_FAKE_TREEHOUSE_RETURN_SLEEP="${FM_FAKE_TREEHOUSE_RETURN_SLEEP:-}" \
     FM_FAKE_TREEHOUSE_RETURN_CHILD_PID_FILE="${FM_FAKE_TREEHOUSE_RETURN_CHILD_PID_FILE:-}" \
@@ -501,6 +528,7 @@ run_teardown() {
   FM_ROOT_OVERRIDE="${FM_TEST_ROOT_OVERRIDE:-}" FM_HOME="$HOME_DIR" \
     FM_STATE_OVERRIDE="$HOME_DIR/state" FM_DATA_OVERRIDE="$HOME_DIR/data" \
     FM_PROJECTS_OVERRIDE="$HOME_DIR/projects" FM_CONFIG_OVERRIDE="$HOME_DIR/config" \
+    FM_REPORT_STACK_ROOT="$CASE_DIR/report-stack" \
     FM_FAKE_TMUX_LOG="$TMUX_LOG" FM_FAKE_AF_LOG="$AF_LOG" \
     FM_FAKE_TREEHOUSE_LOG="$TREEHOUSE_LOG" FM_FAKE_ENDPOINT_FILE="$CASE_DIR/endpoint-live" \
     FM_FAKE_TREEHOUSE_RETURN_SLEEP="${FM_FAKE_TREEHOUSE_RETURN_SLEEP:-}" \
@@ -552,7 +580,7 @@ use_named_fake_tmux_target() {
 }
 
 test_off_is_byte_compatible_and_never_calls_agent_fleet() {
-  local id rec out status launch expected
+  local id rec out status launch expected task_tmp
   id=account-off-z1
   rec=$(make_case off claude "$id")
   read_case "$rec"
@@ -565,6 +593,11 @@ test_off_is_byte_compatible_and_never_calls_agent_fleet() {
   [ "$launch" = "$expected" ] || fail "routing off changed the launch bytes"
   assert_not_grep '^account_' "$HOME_DIR/state/$id.meta" "routing off wrote account metadata"
   assert_not_grep '^provider_session_id=' "$HOME_DIR/state/$id.meta" "routing off wrote session metadata"
+  task_tmp=$(sed -n 's/^tasktmp=//p' "$HOME_DIR/state/$id.meta")
+  [ "$task_tmp" = "$HOME_DIR/state/.task-tmp/fm-$id" ] \
+    || fail "routing fixture did not namespace its task temp root to this test run"
+  assert_present "$task_tmp/gotmp" \
+    "routing fixture did not create its run-scoped Go temp root"
   assert_regex '^generation_id=spawn:a[0-9a-f]{15}$' "$HOME_DIR/state/$id.meta" "routing off did not record a stable spawn generation"
   assert_grep 'report_required=1' "$HOME_DIR/state/$id.meta" "post-cutover spawn did not activate the report gate"
   assert_grep '# Completion report' "$HOME_DIR/data/$id/brief.md" "post-cutover spawn did not upgrade a legacy unspawned brief"
@@ -704,9 +737,13 @@ test_changed_acquisition_is_retained_during_unmanaged_rollback() {
     FM_FAKE_TMUX_FAIL_SEND_MATCH=GOTMPDIR \
     run_spawn "$id" "$PROJ_DIR" > "$out_file" &
   spawn_pid=$!
-  for _ in $(seq 1 600); do [ -f "$marker" ] && break; sleep 0.05; done
+  for _ in $(seq 1 600); do
+    [ -f "$marker" ] && break
+    kill -0 "$spawn_pid" 2>/dev/null || break
+    sleep 0.05
+  done
   [ -f "$marker" ] \
-    || { kill "$spawn_pid" 2>/dev/null || true; fail "changed-acquisition test never reached the post-install failure"; }
+    || { touch "$release"; wait "$spawn_pid" 2>/dev/null || true; fail "changed-acquisition test never reached the post-install failure"; }
   printf '%s\n' retained-commit > "$WT_DIR/retained-commit.txt"
   git -C "$WT_DIR" add retained-commit.txt
   git -C "$WT_DIR" -c user.name='Firstmate Tests' -c user.email='tests@example.invalid' \
@@ -801,7 +838,7 @@ SH
   common=$(git -C "$WT_DIR" rev-parse --git-common-dir)
   case "$common" in /*) ;; *) common="$WT_DIR/$common" ;; esac
   common=$(cd "$common" && pwd -P)
-  key=$(printf '%s' "$common" | shasum -a 256 | awk '{print substr($1,1,24)}')
+  key=$(printf '%s' "$common" | tr '[:upper:]' '[:lower:]' | shasum -a 256 | awk '{print substr($1,1,24)}')
   lock="$CASE_DIR/checkout-refresh-locks/$key.lock"
   assert_present "$CASE_DIR/treehouse-return-child.pid" \
     "spawn rollback did not exercise a surviving Treehouse descendant"
@@ -1351,8 +1388,16 @@ test_off_metadata_merge_waits_for_metadata_lock() {
   FM_FAKE_TMUX_NEW_WINDOW_MARKER="$marker" FM_FAKE_TMUX_NEW_WINDOW_GATE="$gate" \
     run_spawn "$id" "$PROJ_DIR" > "$out_file" &
   spawn_pid=$!
-  for _ in $(seq 1 100); do [ -f "$marker" ] && break; sleep 0.05; done
-  [ -f "$marker" ] || { kill "$spawn_pid" 2>/dev/null || true; fail "off metadata-lock test never reached endpoint creation"; }
+  for _ in $(seq 1 600); do
+    [ -f "$marker" ] && break
+    kill -0 "$spawn_pid" 2>/dev/null || break
+    sleep 0.05
+  done
+  [ -f "$marker" ] || {
+    touch "$gate"
+    wait "$spawn_pid" 2>/dev/null || true
+    fail "off metadata-lock test never reached endpoint creation: $(cat "$out_file")"
+  }
   # shellcheck source=bin/fm-account-routing-lib.sh
   . "$ROOT/bin/fm-account-routing-lib.sh"
   held=$(fm_account_meta_lock_acquire "$HOME_DIR/state" "$id") \
@@ -2467,7 +2512,11 @@ SH
     kill -0 "$spawn_pid" 2>/dev/null || break
     sleep 0.05
   done
-  [ -f "$marker" ] || { touch "$gate" "$installed_gate"; wait "$spawn_pid" 2>/dev/null || true; fail "spawn never persisted provisional managed metadata"; }
+  [ -f "$marker" ] || {
+    touch "$gate" "$installed_gate"
+    wait "$spawn_pid" 2>/dev/null || true
+    fail "spawn never persisted provisional managed metadata: $(cat "$CASE_DIR/spawn-stdout" "$CASE_DIR/spawn-stderr")"
+  }
   meta="$HOME_DIR/state/$id.meta"
   task=$(meta_account_task "$id")
   assert_grep 'account_rollback_cleanup=pending' "$meta" "provisional metadata was not marked for rollback recovery"
@@ -2483,7 +2532,11 @@ SH
     kill -0 "$spawn_pid" 2>/dev/null || break
     sleep 0.05
   done
-  [ -f "$installed_marker" ] || { touch "$installed_gate"; wait "$spawn_pid" 2>/dev/null || true; fail "spawn never installed endpoint metadata"; }
+  [ -f "$installed_marker" ] || {
+    touch "$installed_gate"
+    wait "$spawn_pid" 2>/dev/null || true
+    fail "spawn never installed endpoint metadata: $(cat "$CASE_DIR/spawn-stdout" "$CASE_DIR/spawn-stderr")"
+  }
   assert_grep 'account_rollback_cleanup=pending' "$meta" "endpoint metadata cleared rollback recovery before launch commit"
   assert_grep 'account_profile=claude-2' "$meta" "endpoint metadata lost the selected account profile"
   assert_grep "tmux_session_target=firstmate:fm-$id" "$meta" \
@@ -3175,8 +3228,9 @@ test_concurrent_continuations_serialize_before_mutation() {
   FM_FAKE_AF_PROFILE=claude-3 FM_FAKE_AF_POOL=explicit FM_FAKE_TMUX_NEW_WINDOW_MARKER="$marker" FM_FAKE_TMUX_NEW_WINDOW_GATE="$gate" \
     run_spawn "$id" --continue-account --account-profile claude-3 > "$CASE_DIR/first.out" 2>&1 &
   first_pid=$!
-  for _ in $(seq 1 100); do
+  for _ in $(seq 1 600); do
     [ -f "$marker" ] && break
+    kill -0 "$first_pid" 2>/dev/null || break
     sleep 0.05
   done
   [ -f "$marker" ] || { kill "$first_pid" 2>/dev/null || true; fail "first continuation never reached endpoint creation"; }
@@ -3185,14 +3239,16 @@ test_concurrent_continuations_serialize_before_mutation() {
     FM_ACCOUNT_TEST_HOOKS=firstmate-account-tests-v1 FM_ACCOUNT_LOCK_WAIT_TEST_OBSERVED="$second_lock_waiter" \
     run_spawn "$id" --continue-account --account-profile claude-3 > "$CASE_DIR/second.out" 2>&1 &
   second_pid=$!
-  for _ in $(seq 1 100); do
+  for _ in $(seq 1 600); do
     [ -f "$second_lock_waiter" ] && break
+    kill -0 "$second_pid" 2>/dev/null || break
     sleep 0.05
   done
   if [ ! -f "$second_lock_waiter" ]; then
     touch "$gate"
-    kill "$first_pid" "$second_pid" 2>/dev/null || true
-    fail "second continuation never waited behind the first lifecycle owner"
+    wait "$first_pid" 2>/dev/null || true
+    wait "$second_pid" 2>/dev/null || true
+    fail "second continuation never waited behind the first lifecycle owner: first=$(cat "$CASE_DIR/first.out"); second=$(cat "$CASE_DIR/second.out")"
   fi
   touch "$gate"
   wait "$first_pid"
@@ -3285,6 +3341,7 @@ test_session_sync_cannot_recreate_metadata_after_teardown() {
   teardown_pid=$!
   for _ in $(seq 1 300); do
     [ -f "$release_marker" ] && break
+    kill -0 "$teardown_pid" 2>/dev/null || break
     sleep 0.1
   done
   [ -f "$release_marker" ] || {
@@ -5099,6 +5156,34 @@ SH
   pass "account metadata stat helpers select GNU stat without probing BSD filesystem stat"
 }
 
+test_darwin_stat_mode_preserves_special_permission_bits() {
+  local case_dir fakebin file output
+  case_dir="$TMP_ROOT/darwin-stat-mode"
+  fakebin="$case_dir/fakebin"
+  file="$case_dir/file"
+  mkdir -p "$fakebin"
+  : > "$file"
+  cat > "$fakebin/uname" <<'SH'
+#!/usr/bin/env bash
+printf 'Darwin\n'
+SH
+  cat > "$fakebin/stat" <<'SH'
+#!/usr/bin/env bash
+[ "${1:-}" = -f ] && [ "${2:-}" = %Mp%Lp ] || exit 2
+printf '1777\n'
+SH
+  chmod +x "$fakebin/uname" "$fakebin/stat"
+  output=$(bash -c '
+    . "$1"
+    FM_ACCOUNT_SYSTEM_UNAME_BIN=$2/uname
+    FM_ACCOUNT_SYSTEM_STAT_BIN=$2/stat
+    fm_account_path_mode "$3"
+  ' _ "$ROOT/bin/fm-account-routing-lib.sh" "$fakebin" "$file") \
+    || fail "Darwin account mode helper failed"
+  [ "$output" = 1777 ] || fail "Darwin account mode helper lost special permission bits: $output"
+  pass "account metadata stat helpers preserve Darwin special permission bits"
+}
+
 test_stale_reclaim_guard_is_owned_before_lock_removal() {
   local case_dir lock output status
   case_dir="$TMP_ROOT/reclaim-guard-ownership"
@@ -5568,6 +5653,7 @@ test_agent_fleet_lifecycle_calls_are_bounded() {
   assert_grep 'lease recover ' "$AF_LOG" "timed-out lease choice did not reconcile ownership"
 
   rm -f "$CASE_DIR/endpoint-live"
+  write_completion_report "$id"
   clear_case_logs
   release_completed="$CASE_DIR/release-completed"
   if out=$(FM_FAKE_AF_RELEASE_SLEEP=10 FM_FAKE_AF_RELEASE_COMPLETED="$release_completed" \
@@ -5856,6 +5942,7 @@ test_teardown_stops_after_rollback_restores_predecessor() {
   [ "$failed_task" != "$old_task" ] || fail "failed continuation did not install its rollback generation"
 
   rm -f "$CASE_DIR/endpoint-live"
+  write_completion_report "$id"
   clear_case_logs
   if out=$(run_teardown "$id" --force 2>&1); then status=0; else status=$?; fi
   [ "$status" -ne 0 ] || fail "teardown continued after restoring predecessor metadata"
@@ -6380,6 +6467,7 @@ if [ "${FM_TEST_FOCUSED:-}" = production-routing-authority ]; then
   run_isolated_test test_agent_fleet_entrypoint_is_physically_pinned_per_operation
   run_isolated_test test_agent_fleet_validation_ignores_ambient_system_tool_shadows
   run_isolated_test test_linux_stat_selection_avoids_filesystem_stat_output
+  run_isolated_test test_darwin_stat_mode_preserves_special_permission_bits
   run_isolated_test test_production_routing_ignores_ambient_mode_and_forbids_binary_override
   exit 0
 fi
@@ -6495,6 +6583,7 @@ run_isolated_test test_account_locks_never_reclaim_on_indeterminate_process_prob
 run_isolated_test test_ownerless_lock_marker_rejects_symlink_clobber
 run_isolated_test test_account_lock_owner_controls_reject_symlinks
 run_isolated_test test_linux_stat_selection_avoids_filesystem_stat_output
+run_isolated_test test_darwin_stat_mode_preserves_special_permission_bits
 run_isolated_test test_stale_reclaim_guard_is_owned_before_lock_removal
 run_isolated_test test_task_owned_account_artifacts_reject_symlink_paths
 run_isolated_test test_secondmate_home_lock_key_fails_closed_without_fixed_hasher
diff --git a/tests/fm-arm-pretool-check.test.sh b/tests/fm-arm-pretool-check.test.sh
index 52345bd43e..3c86757f00 100755
--- a/tests/fm-arm-pretool-check.test.sh
+++ b/tests/fm-arm-pretool-check.test.sh
@@ -371,7 +371,7 @@ test_failopen_garbage_stdin() {
 
 test_failopen_missing_jq() {
   local dir fakebin rc real
-  dir=$(fm_test_tmproot fm-arm-pretool-check)
+  fm_test_tmproot_into dir fm-arm-pretool-check
   fakebin="$dir/fakebin"
   mkdir -p "$fakebin"
   local tool
@@ -387,7 +387,7 @@ test_failopen_missing_jq() {
 
 test_failopen_missing_node() {
   local dir fakebin rc real tool
-  dir=$(fm_test_tmproot fm-arm-pretool-node)
+  fm_test_tmproot_into dir fm-arm-pretool-node
   fakebin="$dir/fakebin"
   mkdir -p "$fakebin"
   for tool in bash dirname; do
@@ -403,11 +403,11 @@ test_failopen_missing_node() {
 # --- --claude output shaping ---------------------------------------------------
 
 test_claude_mode_stdout_empty_on_deny() {
-  local out err rc
-  out=$("$CHECK" --claude --command 'bin/fm-watch-arm.sh &' 2>/tmp/fm-arm-pretool-check-claude-stderr.$$)
+  local out err rc err_file="$MATRIX_TMP/claude-stderr"
+  out=$("$CHECK" --claude --command 'bin/fm-watch-arm.sh &' 2>"$err_file")
   rc=$?
-  err=$(cat "/tmp/fm-arm-pretool-check-claude-stderr.$$" 2>/dev/null)
-  rm -f "/tmp/fm-arm-pretool-check-claude-stderr.$$"
+  err=$(cat "$err_file" 2>/dev/null)
+  rm -f "$err_file"
   [ "$rc" -eq 2 ] || fail "--claude deny must still exit 2, got $rc"
   [ -z "$out" ] || fail "--claude deny must leave stdout EMPTY (Claude Code only honors a stderr-only deny), got: $out"
   printf '%s' "$err" | jq -e '.hookSpecificOutput.permissionDecision == "deny"' >/dev/null 2>&1 \
diff --git a/tests/fm-autocompact.test.sh b/tests/fm-autocompact.test.sh
index 2c27621ae5..ae1a719d00 100755
--- a/tests/fm-autocompact.test.sh
+++ b/tests/fm-autocompact.test.sh
@@ -8,7 +8,7 @@ set -u
 
 # shellcheck disable=SC2153
 AUTOCOMPACT="$ROOT/bin/fm-autocompact.sh"
-TMP_ROOT=$(fm_test_tmproot fm-autocompact-tests)
+fm_test_tmproot_into TMP_ROOT fm-autocompact-tests
 fm_git_identity fmtest fmtest@example.invalid
 
 new_primary() {
diff --git a/tests/fm-backend-cmux.test.sh b/tests/fm-backend-cmux.test.sh
index 22918c89d8..b31b3481c0 100755
--- a/tests/fm-backend-cmux.test.sh
+++ b/tests/fm-backend-cmux.test.sh
@@ -15,7 +15,7 @@ set -u
 
 command -v jq >/dev/null 2>&1 || { echo "skip: jq not found (required by the cmux adapter)"; exit 0; }
 
-TMP_ROOT=$(fm_test_tmproot fm-backend-cmux-tests)
+fm_test_tmproot_into TMP_ROOT fm-backend-cmux-tests
 
 # make_cmux_fakebin: a `cmux` stub that logs every invocation (one line,
 # unit-separated args, to $FM_CMUX_LOG) and returns the canned response for
diff --git a/tests/fm-backend-herdr.test.sh b/tests/fm-backend-herdr.test.sh
index 084e8b3dc7..9b3bc1d44a 100755
--- a/tests/fm-backend-herdr.test.sh
+++ b/tests/fm-backend-herdr.test.sh
@@ -18,7 +18,7 @@ set -u
 
 command -v jq >/dev/null 2>&1 || { echo "skip: jq not found (required by the herdr adapter)"; exit 0; }
 
-TMP_ROOT=$(fm_test_tmproot fm-backend-herdr-tests)
+fm_test_tmproot_into TMP_ROOT fm-backend-herdr-tests
 export FM_BACKEND_HERDR_SUBMIT_MIN_SLEEP=0
 export FM_BACKEND_HERDR_TEST_LAB=firstmate-herdr-test-lab-v1
 
diff --git a/tests/fm-backend-zellij.test.sh b/tests/fm-backend-zellij.test.sh
index 60bd56e9c0..1cafdd277e 100755
--- a/tests/fm-backend-zellij.test.sh
+++ b/tests/fm-backend-zellij.test.sh
@@ -14,7 +14,7 @@ set -u
 
 command -v jq >/dev/null 2>&1 || { echo "skip: jq not found (required by the zellij adapter)"; exit 0; }
 
-TMP_ROOT=$(fm_test_tmproot fm-backend-zellij-tests)
+fm_test_tmproot_into TMP_ROOT fm-backend-zellij-tests
 
 # make_zellij_fakebin: a `zellij` stub that logs every invocation (one line,
 # unit-separated args, to $FM_ZELLIJ_LOG) and returns the canned response for
diff --git a/tests/fm-backend.test.sh b/tests/fm-backend.test.sh
index 7efdb305c0..b232b1f588 100755
--- a/tests/fm-backend.test.sh
+++ b/tests/fm-backend.test.sh
@@ -35,7 +35,7 @@ fm_git_identity fmtest fmtest@example.invalid
 # shellcheck source=bin/fm-backend.sh
 . "$ROOT/bin/fm-backend.sh"
 
-TMP_ROOT=$(fm_test_tmproot fm-backend-tests)
+fm_test_tmproot_into TMP_ROOT fm-backend-tests
 
 # fm_backend_detect's cmux fallback (bundle id + process ancestry,
 # docs/cmux-backend.md "Runtime auto-detection") consults uname, lsappinfo,
@@ -1108,7 +1108,7 @@ run_spawn_symlink_case() {  # <label> <physical|logical>
   assert_contains "$out" "worktree=$wt" \
     "fm-spawn.sh did not resolve a symlinked-prefix project to its real worktree when the backend reports $first_reply cwd"
 
-  rm -rf "/tmp/fm-$id"
+  rm -rf "$state/.task-tmp/fm-$id"
 }
 
 test_spawn_symlinked_project_prefix_avoids_false_refusal() {
@@ -1293,7 +1293,7 @@ test_spawn_default_backend_writes_no_meta_field() {
   expect_code 0 $? "explicit --backend tmux should spawn successfully"$'\n'"$out"
   assert_no_grep 'backend=' "$state/$id.meta" \
     "an explicit --backend tmux (the default) must not write backend= to meta (P1 compatibility contract)"
-  rm -rf "/tmp/fm-$id"
+  rm -rf "$state/.task-tmp/fm-$id"
   pass "fm-spawn.sh: an explicit --backend tmux resolves silently and writes no backend= (missing means tmux)"
 }
 
@@ -1318,7 +1318,7 @@ test_spawn_explicit_backend_flag_beats_autodetect_herdr_env() {
   expect_code 0 $? "explicit --backend tmux should spawn successfully even with HERDR_ENV=1 set"$'\n'"$out"
   assert_no_grep 'backend=' "$state/$id.meta" \
     "an explicit --backend tmux must win over an ambient HERDR_ENV=1 auto-detect marker"
-  rm -rf "/tmp/fm-$id"
+  rm -rf "$state/.task-tmp/fm-$id"
   pass "fm-spawn.sh: explicit --backend tmux wins over an ambient HERDR_ENV=1 auto-detect marker"
 }
 
@@ -1349,7 +1349,7 @@ test_spawn_autodetect_nesting_resolves_tmux_silently() {
   case "$out" in
     *NOTICE*) fail "auto-detecting tmux (even nested inside herdr) must stay silent, no NOTICE expected"$'\n'"$out" ;;
   esac
-  rm -rf "/tmp/fm-$id"
+  rm -rf "$state/.task-tmp/fm-$id"
   pass "fm-spawn.sh: auto-detect resolves nested tmux-in-herdr to tmux and stays silent end to end"
 }
 
diff --git a/tests/fm-backlog-handoff.test.sh b/tests/fm-backlog-handoff.test.sh
index 9e10703e81..b2e767aeda 100755
--- a/tests/fm-backlog-handoff.test.sh
+++ b/tests/fm-backlog-handoff.test.sh
@@ -13,7 +13,7 @@ set -u
 # binary. Skip cleanly when it is absent (matching the backend smoke suites).
 command -v tasks-axi >/dev/null 2>&1 || { echo "skip: tasks-axi not found (required by the delegated handoff path)"; exit 0; }
 
-TMP_ROOT=$(fm_test_tmproot fm-backlog-handoff)
+fm_test_tmproot_into TMP_ROOT fm-backlog-handoff
 
 setup_homes() {
   local home=$1 subhome=$2 id=${3:-design}
diff --git a/tests/fm-bearings-snapshot.test.sh b/tests/fm-bearings-snapshot.test.sh
index 4c2a84cf90..ad49dda61f 100755
--- a/tests/fm-bearings-snapshot.test.sh
+++ b/tests/fm-bearings-snapshot.test.sh
@@ -11,7 +11,7 @@ set -u
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 BEARINGS="$ROOT/bin/fm-bearings-snapshot.sh"
-TMP_ROOT=$(fm_test_tmproot fm-bearings)
+fm_test_tmproot_into TMP_ROOT fm-bearings
 
 command -v jq >/dev/null 2>&1 || { echo "skip: jq not found"; exit 0; }
 
diff --git a/tests/fm-bootstrap.test.sh b/tests/fm-bootstrap.test.sh
index 773734b481..67c276670a 100755
--- a/tests/fm-bootstrap.test.sh
+++ b/tests/fm-bootstrap.test.sh
@@ -22,7 +22,7 @@ export FM_ORCA_TEST_AUTHORITY_CAPABILITIES=verified-v1
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 BASE_PATH=${FM_TEST_BASE_PATH:-/usr/bin:/bin:/usr/sbin:/sbin}
-TMP_ROOT=$(fm_test_tmproot fm-bootstrap-tests)
+fm_test_tmproot_into TMP_ROOT fm-bootstrap-tests
 export FM_BACKEND_CMUX_BUNDLE_BIN="$TMP_ROOT/no-bundled-cmux"
 
 # Hermetic runtime-backend detection. These cases pin the backend per-home via
diff --git a/tests/fm-brief.test.sh b/tests/fm-brief.test.sh
index a5ce892ffb..06337f199e 100755
--- a/tests/fm-brief.test.sh
+++ b/tests/fm-brief.test.sh
@@ -14,7 +14,7 @@ set -u
 # shellcheck source=tests/lib.sh
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
-TMP_ROOT=$(fm_test_tmproot fm-brief)
+fm_test_tmproot_into TMP_ROOT fm-brief
 
 # The script itself must always parse. This is the direct regression test for
 # issue #166: a stray apostrophe in any of the three DOD heredoc bodies
diff --git a/tests/fm-cd-pretool-check.test.sh b/tests/fm-cd-pretool-check.test.sh
index d34bdda3ae..2d771dc336 100755
--- a/tests/fm-cd-pretool-check.test.sh
+++ b/tests/fm-cd-pretool-check.test.sh
@@ -17,7 +17,7 @@ set -u
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 fm_git_identity fmtest fmtest@example.invalid
-TMP_ROOT=$(fm_test_tmproot fm-cd-pretool-check)
+fm_test_tmproot_into TMP_ROOT fm-cd-pretool-check
 
 # A primary-shaped checkout: plain (non-worktree) git repo, AGENTS.md, bin/ with
 # the transport plus both policy files (fm-cd-command-policy.mjs imports the
diff --git a/tests/fm-checkout-refresh.test.sh b/tests/fm-checkout-refresh.test.sh
index dd7a5172b2..cdd102b548 100755
--- a/tests/fm-checkout-refresh.test.sh
+++ b/tests/fm-checkout-refresh.test.sh
@@ -11,7 +11,7 @@ set -u
 
 fm_git_identity fmtest fmtest@example.invalid
 
-TMP_ROOT=$(fm_test_tmproot fm-checkout-refresh-tests)
+fm_test_tmproot_into TMP_ROOT fm-checkout-refresh-tests
 TEST_HOME="$TMP_ROOT/user"
 FM_TEST_HOME="$TMP_ROOT/fm-home"
 STATE_ROOT="$TMP_ROOT/refresh-state"
diff --git a/tests/fm-checkout-return-boundary.test.sh b/tests/fm-checkout-return-boundary.test.sh
index f69c75a030..1f71076395 100755
--- a/tests/fm-checkout-return-boundary.test.sh
+++ b/tests/fm-checkout-return-boundary.test.sh
@@ -30,7 +30,7 @@ set -u
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 LIB="$ROOT/bin/fm-checkout-lock-lib.sh"
-TMP_ROOT=$(fm_test_tmproot fm-checkout-return-boundary)
+fm_test_tmproot_into TMP_ROOT fm-checkout-return-boundary
 BOUNDARY_PY="$TMP_ROOT/boundary.py"
 REFUSED=74
 
diff --git a/tests/fm-composer-ghost.test.sh b/tests/fm-composer-ghost.test.sh
index 3be65186b0..5b6cbd2558 100755
--- a/tests/fm-composer-ghost.test.sh
+++ b/tests/fm-composer-ghost.test.sh
@@ -26,7 +26,7 @@ PEEK="$ROOT/bin/fm-peek.sh"
 # shellcheck source=bin/fm-tmux-lib.sh
 . "$LIB"
 
-TMP_ROOT=$(fm_test_tmproot fm-ghost-tests)
+fm_test_tmproot_into TMP_ROOT fm-ghost-tests
 
 # ESC byte for building styled fixtures and asserting escape-free output.
 ESC=$(printf '\033')
diff --git a/tests/fm-crew-state.test.sh b/tests/fm-crew-state.test.sh
index 38c57acd4d..37cd287849 100755
--- a/tests/fm-crew-state.test.sh
+++ b/tests/fm-crew-state.test.sh
@@ -34,7 +34,7 @@ set -u
 . "$ROOT/bin/fm-classify-lib.sh"
 
 CREW_STATE="$ROOT/bin/fm-crew-state.sh"
-TMP_ROOT=$(fm_test_tmproot fm-crew-state)
+fm_test_tmproot_into TMP_ROOT fm-crew-state
 fm_git_identity fmtest fmtest@example.invalid
 
 # A real git repo checked out on <branch>, so the helper's branch attribution
diff --git a/tests/fm-daemon.test.sh b/tests/fm-daemon.test.sh
index f60e65848f..24870bc81f 100755
--- a/tests/fm-daemon.test.sh
+++ b/tests/fm-daemon.test.sh
@@ -23,7 +23,7 @@ if [ -z "${FM_TEST_DAEMON_SOURCED:-}" ]; then
   . "$DAEMON"
 fi
 
-TMP_ROOT=$(fm_test_tmproot fm-daemon-tests)
+fm_test_tmproot_into TMP_ROOT fm-daemon-tests
 
 test_afk_start_refuses_when_flag_cannot_be_written() {
   local dir state out status
diff --git a/tests/fm-dispatch-select.test.sh b/tests/fm-dispatch-select.test.sh
index dedb3e73db..b835f26f3c 100755
--- a/tests/fm-dispatch-select.test.sh
+++ b/tests/fm-dispatch-select.test.sh
@@ -7,7 +7,7 @@ export FM_ACCOUNT_ROUTING_TEST_LAB=firstmate-account-routing-test-lab-v1
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 BASE_PATH=${FM_TEST_BASE_PATH:-/usr/bin:/bin:/usr/sbin:/sbin}
-TMP_ROOT=$(fm_test_tmproot fm-dispatch-select-tests)
+fm_test_tmproot_into TMP_ROOT fm-dispatch-select-tests
 mkdir -p "$TMP_ROOT"
 
 write_quota() {
diff --git a/tests/fm-ensure-agents-md.test.sh b/tests/fm-ensure-agents-md.test.sh
index 2b74b03e1e..6ec08c5669 100755
--- a/tests/fm-ensure-agents-md.test.sh
+++ b/tests/fm-ensure-agents-md.test.sh
@@ -5,7 +5,7 @@ set -u
 # shellcheck source=tests/lib.sh
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
-TMP_ROOT=$(fm_test_tmproot fm-ensure-agents-md)
+fm_test_tmproot_into TMP_ROOT fm-ensure-agents-md
 
 test_created_agents_md_includes_self_governance() {
   local repo agents
diff --git a/tests/fm-fleet-snapshot-view.test.sh b/tests/fm-fleet-snapshot-view.test.sh
index a79e8d3c88..703c503b4f 100755
--- a/tests/fm-fleet-snapshot-view.test.sh
+++ b/tests/fm-fleet-snapshot-view.test.sh
@@ -8,7 +8,7 @@ set -u
 
 SNAPSHOT="$ROOT/bin/fm-fleet-snapshot.sh"
 VIEW="$ROOT/bin/fm-fleet-view.sh"
-TMP_ROOT=$(fm_test_tmproot fm-fleet-snapshot)
+fm_test_tmproot_into TMP_ROOT fm-fleet-snapshot
 
 command -v jq >/dev/null 2>&1 || { echo "skip: jq not found"; exit 0; }
 
diff --git a/tests/fm-herdr-lab.test.sh b/tests/fm-herdr-lab.test.sh
index 239d325f96..f19cd93a36 100755
--- a/tests/fm-herdr-lab.test.sh
+++ b/tests/fm-herdr-lab.test.sh
@@ -5,7 +5,7 @@ set -u
 # shellcheck source=tests/lib.sh
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
-TMP_ROOT=$(fm_test_tmproot fm-herdr-lab)
+fm_test_tmproot_into TMP_ROOT fm-herdr-lab
 FAKEBIN=$(fm_fakebin "$TMP_ROOT")
 FAKE_STATE="$TMP_ROOT/herdr-state"
 FAKE_LOG="$TMP_ROOT/herdr.log"
diff --git a/tests/fm-lint.test.sh b/tests/fm-lint.test.sh
index 946bb160e8..9d30671bdb 100755
--- a/tests/fm-lint.test.sh
+++ b/tests/fm-lint.test.sh
@@ -84,7 +84,7 @@ test_rejects_wrong_shellcheck_version() {
   # Version-independent: a fake shellcheck reporting a different version must be
   # refused before any lint, proving local and CI cannot silently diverge.
   local tmp fakebin out rc
-  tmp=$(fm_test_tmproot fm-lint-ver)
+  fm_test_tmproot_into tmp fm-lint-ver
   fakebin=$(fm_fakebin "$tmp")
   cat > "$fakebin/shellcheck" <<'SH'
 #!/usr/bin/env bash
@@ -116,7 +116,7 @@ test_catches_a_real_lint_defect() {
   # warning present at default severity (and is itself one of the recurring
   # classes that slipped through, PR 474).
   local tmp bad out rc
-  tmp=$(fm_test_tmproot fm-lint-bad)
+  fm_test_tmproot_into tmp fm-lint-bad
   mkdir -p "$tmp"
   bad="$tmp/bad.sh"
   cat > "$bad" <<'SH'
@@ -140,7 +140,7 @@ test_ignores_ambient_shellcheck_opts() {
     return
   fi
   local tmp bad out rc
-  tmp=$(fm_test_tmproot fm-lint-opts)
+  fm_test_tmproot_into tmp fm-lint-opts
   mkdir -p "$tmp"
   bad="$tmp/bad.sh"
   cat > "$bad" <<'SH'
@@ -164,7 +164,7 @@ test_clean_fixture_passes() {
     return
   fi
   local tmp good rc
-  tmp=$(fm_test_tmproot fm-lint-good)
+  fm_test_tmproot_into tmp fm-lint-good
   mkdir -p "$tmp"
   good="$tmp/good.sh"
   cat > "$good" <<'SH'
diff --git a/tests/fm-lock.test.sh b/tests/fm-lock.test.sh
index bd0e17710f..0896960289 100755
--- a/tests/fm-lock.test.sh
+++ b/tests/fm-lock.test.sh
@@ -6,7 +6,7 @@ set -u
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 LOCK="$ROOT/bin/fm-lock.sh"
-TMP_ROOT=$(fm_test_tmproot fm-lock)
+fm_test_tmproot_into TMP_ROOT fm-lock
 FM_LOCK_TEST_PIDS=()
 
 cleanup_lock_tests() {
diff --git a/tests/fm-macos-permissions.test.sh b/tests/fm-macos-permissions.test.sh
index df2f4f3c05..03d6adf44a 100755
--- a/tests/fm-macos-permissions.test.sh
+++ b/tests/fm-macos-permissions.test.sh
@@ -7,7 +7,7 @@ set -u
 
 SCRIPT="$ROOT/bin/fm-macos-permissions.sh"
 BASE_PATH=${FM_TEST_BASE_PATH:-/usr/bin:/bin:/usr/sbin:/sbin}
-TMP_ROOT=$(fm_test_tmproot fm-macos-permissions-tests)
+fm_test_tmproot_into TMP_ROOT fm-macos-permissions-tests
 
 make_world() {
   local world="$TMP_ROOT/$1" fakebin
diff --git a/tests/fm-pi-watch-extension.test.sh b/tests/fm-pi-watch-extension.test.sh
index ba9ac7929a..07eb5af361 100755
--- a/tests/fm-pi-watch-extension.test.sh
+++ b/tests/fm-pi-watch-extension.test.sh
@@ -5,7 +5,7 @@ set -u
 # shellcheck source=tests/lib.sh
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
-TMP_ROOT=$(fm_test_tmproot fm-pi-watch-extension)
+fm_test_tmproot_into TMP_ROOT fm-pi-watch-extension
 EXT="$ROOT/.pi/extensions/fm-primary-pi-watch.ts"
 
 install_pi_watch_extension_fixture() {
diff --git a/tests/fm-pr-merge.test.sh b/tests/fm-pr-merge.test.sh
index 6e5be83c5a..ecc7c27db7 100755
--- a/tests/fm-pr-merge.test.sh
+++ b/tests/fm-pr-merge.test.sh
@@ -21,7 +21,7 @@ set -u
 fm_git_identity fmtest fmtest@example.invalid
 
 PR_MERGE="$ROOT/bin/fm-pr-merge.sh"
-TMP_ROOT=$(fm_test_tmproot fm-pr-merge-tests)
+fm_test_tmproot_into TMP_ROOT fm-pr-merge-tests
 
 # Build a fresh sandbox for one test case: a state dir with a task meta and a
 # fakebin with a gh-axi mock that records how it was invoked. Echoes the case dir.
diff --git a/tests/fm-prompt-exec.test.sh b/tests/fm-prompt-exec.test.sh
index af95b6059d..fe5ae62895 100755
--- a/tests/fm-prompt-exec.test.sh
+++ b/tests/fm-prompt-exec.test.sh
@@ -4,7 +4,7 @@ set -u
 # shellcheck source=tests/lib.sh
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
-TMP_ROOT=$(fm_test_tmproot fm-prompt-exec)
+fm_test_tmproot_into TMP_ROOT fm-prompt-exec
 mkdir -p "$TMP_ROOT"
 
 path_identity() {
diff --git a/tests/fm-report-stack.test.sh b/tests/fm-report-stack.test.sh
index 79a5fcf2ee..e5d60eec1e 100755
--- a/tests/fm-report-stack.test.sh
+++ b/tests/fm-report-stack.test.sh
@@ -5,7 +5,7 @@ set -u
 # shellcheck source=tests/lib.sh
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
-TMP_ROOT=$(fm_test_tmproot fm-report-stack)
+fm_test_tmproot_into TMP_ROOT fm-report-stack
 HOME_DIR="$TMP_ROOT/home"
 STACK="$TMP_ROOT/stack"
 SCRIPT="$ROOT/bin/fm-report-stack.mjs"
diff --git a/tests/fm-review-diff.test.sh b/tests/fm-review-diff.test.sh
index e340702aed..1c06793871 100755
--- a/tests/fm-review-diff.test.sh
+++ b/tests/fm-review-diff.test.sh
@@ -15,7 +15,7 @@ set -u
 fm_git_identity fmtest fmtest@example.invalid
 
 REVIEW_DIFF="$ROOT/bin/fm-review-diff.sh"
-TMP_ROOT=$(fm_test_tmproot fm-review-diff-tests)
+fm_test_tmproot_into TMP_ROOT fm-review-diff-tests
 
 make_case() {
   local name=$1 case_dir
diff --git a/tests/fm-secondmate-lifecycle-e2e.test.sh b/tests/fm-secondmate-lifecycle-e2e.test.sh
index fd71fdb359..043810fbfa 100755
--- a/tests/fm-secondmate-lifecycle-e2e.test.sh
+++ b/tests/fm-secondmate-lifecycle-e2e.test.sh
@@ -27,7 +27,7 @@ set -u
 # shellcheck source=tests/secondmate-helpers.sh disable=SC1091
 . "$(dirname "${BASH_SOURCE[0]}")/secondmate-helpers.sh"
 
-TMP_ROOT=$(fm_test_tmproot fm-secondmate-lifecycle)
+fm_test_tmproot_into TMP_ROOT fm-secondmate-lifecycle
 export FM_BACKEND=tmux
 
 HOME_DIR="$TMP_ROOT/main home"
@@ -48,6 +48,11 @@ setup_world() {
   fm_git_add_origin "$HOME_DIR/projects/alpha" "$TMP_ROOT/remotes/alpha.git"
   fm_git_add_origin "$HOME_DIR/projects/beta" "$TMP_ROOT/remotes/beta.git"
   fm_git_add_origin "$HOME_DIR/projects/gamma" "$TMP_ROOT/remotes/gamma.git"
+  printf '%s\n' '.no-mistakes-init' '.no-mistakes-doctor' \
+    > "$HOME_DIR/projects/gamma/.gitignore"
+  git -C "$HOME_DIR/projects/gamma" add .gitignore
+  git -C "$HOME_DIR/projects/gamma" commit -qm 'ignore local no-mistakes test state'
+  git -C "$HOME_DIR/projects/gamma" push -q origin main
   cat > "$HOME_DIR/data/projects.md" <<EOF
 - alpha [direct-PR +yolo] - alpha project (added 2026-06-22)
 - beta [direct-PR] - beta project (added 2026-06-22)
@@ -213,7 +218,7 @@ phase_teardown() {
   : > "$LOG"
   teardown_out=$(PATH="$FAKEBIN:$PATH" FM_HOME="$HOME_DIR" FM_FAKE_TMUX_LOG="$LOG" FM_FAKE_TMUX_CAPTURE="$PANE" \
     "$ROOT/bin/fm-teardown.sh" design 2>&1) \
-    || fail "teardown failed for the empty secondmate home"
+    || fail "teardown failed for the empty secondmate home: $teardown_out"
   printf '%s\n' "$teardown_out" | grep -F 'Backlog:' >/dev/null \
     && fail "secondmate teardown emitted a main-backlog completion reminder"
   assert_absent "$SUB" "teardown did not remove the retired secondmate home"
diff --git a/tests/fm-secondmate-liveness.test.sh b/tests/fm-secondmate-liveness.test.sh
index 345b2b65b3..56287c342b 100755
--- a/tests/fm-secondmate-liveness.test.sh
+++ b/tests/fm-secondmate-liveness.test.sh
@@ -41,8 +41,10 @@ set -u
 
 BASE_PATH=${FM_TEST_BASE_PATH:-/usr/bin:/bin:/usr/sbin:/sbin}
 fm_git_identity fmtest fmtest@example.com
+FM_TEST_REAL_NODE=$(command -v node) || fail "node is required"
+export FM_TEST_REAL_NODE
 
-TMP_ROOT=$(fm_test_tmproot fm-secondmate-liveness)
+fm_test_tmproot_into TMP_ROOT fm-secondmate-liveness
 
 # --- unit level: fm_backend_tmux_agent_alive --------------------------------
 
@@ -187,7 +189,12 @@ test_agent_alive_dispatcher_routes_and_falls_back() {
 make_toolchain() {
   local dir=$1 fakebin
   fakebin=$(fm_fakebin "$dir")
-  fm_fake_exit0 "$fakebin" node gh-axi chrome-devtools-axi lavish-axi
+  fm_fake_exit0 "$fakebin" gh-axi chrome-devtools-axi lavish-axi
+  cat > "$fakebin/node" <<'SH'
+#!/usr/bin/env bash
+exec "${FM_TEST_REAL_NODE:?}" "$@"
+SH
+  chmod +x "$fakebin/node"
   cat > "$fakebin/gh" <<'SH'
 #!/usr/bin/env bash
 exit 0
@@ -299,23 +306,27 @@ SH
 new_world() {
   local name=$1 w
   w="$TMP_ROOT/$name"
-  mkdir -p "$w/home/state" "$w/home/config"
+  mkdir -p "$w/home/state" "$w/home/config" "$w/home/data"
   touch "$w/home/state/.last-watcher-beat"
   printf 'codex\n' > "$w/home/config/crew-harness"
   printf '%s\n' "$w"
 }
 
-# add_sm_home <w> <id> <window>: a plain (non-git) secondmate home - the
-# probe/respawn machinery under test never requires the home to be a real
-# worktree; a non-git home just makes the unrelated fast-forward sweep log a
-# harmless "not a git repo" skip.
+# add_sm_home <w> <id> <window>: a fresh detached secondmate home at the
+# primary default tip, so recovery exercises the same freshness gate as a real
+# secondmate instead of relying on a non-Git legacy fixture.
 add_sm_home() {
   local w=$1 id=$2 window=$3 harness=${4:-claude}
-  local home="$w/$id"
-  mkdir -p "$home/bin" "$home/data" "$home/state" "$home/config" "$home/projects"
+  local home="$w/$id" home_abs
+  git clone --quiet --no-checkout --single-branch --branch main "$ROOT" "$home"
+  git -C "$home" checkout --quiet --detach refs/remotes/origin/main
+  git -C "$home" symbolic-ref refs/remotes/origin/HEAD refs/remotes/origin/main
+  mkdir -p "$home/data" "$home/state" "$home/config" "$home/projects"
   printf '%s\n' "$id" > "$home/.fm-secondmate-home"
-  printf '# Firstmate\n' > "$home/AGENTS.md"
   printf 'charter\n' > "$home/data/charter.md"
+  home_abs=$(cd "$home" && pwd -P)
+  printf '%s\n' "- $id - test secondmate (home: $home_abs; scope: test; projects: test; added 2026-07-25)" \
+    > "$w/home/data/secondmates.md"
   {
     printf 'window=%s\n' "$window"
     printf 'kind=secondmate\n'
@@ -552,7 +563,7 @@ worktree=$workspace
 project=$workspace
 mode=secondmate
 yolo=off
-tasktmp=/tmp/fm-sm1
+tasktmp=$w/home/state/.task-tmp/fm-sm1
 account_pool=claude-crew
 account_profile=claude-2
 account_task=$account_task
@@ -562,9 +573,6 @@ generation_id=account:$account_task:a1234
 EOF
   mkdir -p "$w/home/data/sm1"
   printf 'enforce\n' > "$w/home/config/account-routing-mode"
-  cp "$ROOT/bin/fm-account-routing-lib.sh" "$w/sm1/bin/fm-account-routing-lib.sh"
-  cp "$ROOT/bin/fm-spawn.sh" "$w/sm1/bin/fm-spawn.sh"
-
   fake_root="$w/fake-root"
   mkdir -p "$fake_root/bin"
   cat > "$fake_root/bin/fm-spawn.sh" <<'SH'
diff --git a/tests/fm-secondmate-safety.test.sh b/tests/fm-secondmate-safety.test.sh
index f1c956e44d..72c01749bc 100755
--- a/tests/fm-secondmate-safety.test.sh
+++ b/tests/fm-secondmate-safety.test.sh
@@ -10,7 +10,7 @@ set -u
 # shellcheck source=tests/secondmate-helpers.sh disable=SC1091
 . "$(dirname "${BASH_SOURCE[0]}")/secondmate-helpers.sh"
 
-TMP_ROOT=$(fm_test_tmproot fm-secondmate-safety)
+fm_test_tmproot_into TMP_ROOT fm-secondmate-safety
 export FM_BACKEND=tmux
 
 make_live_default_firstmate_worktree() {
@@ -29,6 +29,46 @@ make_live_default_firstmate_worktree() {
   printf '%s\n' "$source"
 }
 
+make_live_default_firstmate_clone() {
+  local destination=$1 default source_origin target
+  default=$(git -C "$ROOT" symbolic-ref --quiet --short refs/remotes/origin/HEAD)
+  default=${default#origin/}
+  target=$(git -C "$ROOT" rev-parse "refs/heads/$default^{commit}")
+  source_origin=$(git -C "$ROOT" remote get-url origin)
+  git clone --quiet --no-checkout --single-branch --branch "$default" "$ROOT" "$destination"
+  git -C "$destination" checkout --quiet --detach "$target"
+  git -C "$destination" remote set-url origin "$source_origin"
+  git -C "$destination" update-ref "refs/remotes/origin/$default" "$target"
+  git -C "$destination" symbolic-ref refs/remotes/origin/HEAD "refs/remotes/origin/$default"
+}
+
+write_treehouse_lease() {
+  local worktree=$1 holder=$2 slot pool state
+  slot=$(cd "$(dirname "$worktree")" && pwd -P)
+  pool=$(cd "$(dirname "$slot")" && pwd -P)
+  state="$pool/treehouse-state.json"
+  python3 - "$state" "$(cd "$worktree" && pwd -P)" "$holder" <<'PY'
+import json
+import sys
+
+state, path, holder = sys.argv[1:]
+with open(state, "w", encoding="utf-8") as stream:
+    json.dump(
+        {
+            "worktrees": [
+                {
+                    "name": "1",
+                    "path": path,
+                    "leased": True,
+                    "lease_holder": holder,
+                }
+            ]
+        },
+        stream,
+    )
+PY
+}
+
 write_secondmate_registration() {
   local home=$1 id=$2 target=$3 target_abs
   mkdir -p "$home/data"
@@ -255,7 +295,7 @@ test_home_seed_acquisition_honors_shared_checkout_lock() {
   common=$(git -C "$source" rev-parse --git-common-dir)
   case "$common" in /*) ;; *) common="$source/$common" ;; esac
   common=$(cd "$common" && pwd -P)
-  key=$(printf '%s' "$common" | shasum -a 256 | awk '{print substr($1,1,24)}')
+  key=$(printf '%s' "$common" | tr '[:upper:]' '[:lower:]' | shasum -a 256 | awk '{print substr($1,1,24)}')
   lock="$lock_root/$key.lock"
   mkdir -p "$lock" "$state_root"
   printf '%s\n' "$$" > "$lock/pid"
@@ -408,7 +448,7 @@ test_home_seed_returns_treehouse_acquired_home_on_assignment_failure() {
   common=$(git -C "$acquired" rev-parse --git-common-dir)
   case "$common" in /*) ;; *) common="$acquired/$common" ;; esac
   common=$(cd "$common" && pwd -P)
-  key=$(printf '%s' "$common" | shasum -a 256 | awk '{print substr($1,1,24)}')
+  key=$(printf '%s' "$common" | tr '[:upper:]' '[:lower:]' | shasum -a 256 | awk '{print substr($1,1,24)}')
   lock_root="$TMP_ROOT/dash-fail-locks"
   expected_lock="$lock_root/$key.lock"
   lock_marker="$TMP_ROOT/dash-fail-return-held-lock"
@@ -601,7 +641,7 @@ test_home_seed_refuses_empty_charter_fields() {
     fail "seed accepted an empty routing scope"
   fi
   grep -F 'empty Routing scope section' "$err" >/dev/null \
-    || fail "seed did not explain empty routing scope refusal"
+    || fail "seed did not explain empty routing scope refusal: $(cat "$err")"
   [ ! -e "$subhome" ] || fail "empty routing scope seed left a generated subhome"
   pass "home seeding refuses empty normalized charter fields"
 }
@@ -781,8 +821,7 @@ test_home_seed_refuses_projectful_reused_charter_for_projectless_home() {
   stale_brief="$home/data/stale/brief.md"
   stale_brief_before="$TMP_ROOT/no-projects-reused-charter.before"
   err="$TMP_ROOT/no-projects-reused-charter.err"
-  mkdir -p "$home/data" "$home/state" "$reusable_sub/data" "$stale_sub/data"
-  mark_firstmate_home "$reusable_sub"
+  mkdir -p "$home/data" "$home/state" "$stale_sub/data"
   mark_firstmate_home "$stale_sub"
 
   scaffold_secondmate_charter "$home" reusable 'firstmate self-development' --no-projects \
@@ -822,8 +861,9 @@ test_home_seed_refuses_projectless_conversion_of_populated_home() {
   home="$TMP_ROOT/no-projects-conversion-home"
   sub="$TMP_ROOT/no-projects-conversion-subhome"
   err="$TMP_ROOT/no-projects-conversion.err"
-  mkdir -p "$home/data" "$home/state" "$sub/data" "$sub/projects/existing-clone"
-  mark_firstmate_home "$sub"
+  mkdir -p "$home/data" "$home/state"
+  make_live_default_firstmate_clone "$sub"
+  mkdir -p "$sub/data" "$sub/projects/existing-clone"
   fm_git_init_commit "$sub/projects/existing-clone"
   cat > "$sub/data/projects.md" <<EOF
 - registry-only [direct-PR] - retained project entry (added 2026-06-22)
@@ -836,7 +876,7 @@ EOF
     fail "project-less seed converted a populated secondmate home"
   fi
   grep -F 'existing-clone' "$err" >/dev/null \
-    || fail "project-less conversion refusal did not name the existing clone"
+    || fail "project-less conversion refusal did not name the existing clone: $(cat "$err")"
   grep -F 'registry-only' "$err" >/dev/null \
     || fail "project-less conversion refusal did not name the registry entry"
   grep -F 'retire or clean this home first' "$err" >/dev/null \
@@ -858,8 +898,9 @@ test_home_seed_refuses_projectless_home_with_uninspectable_projects() {
   home="$TMP_ROOT/no-projects-uninspectable-home"
   sub="$TMP_ROOT/no-projects-uninspectable-subhome"
   err="$TMP_ROOT/no-projects-uninspectable.err"
-  mkdir -p "$home/data" "$home/state" "$sub/data" "$sub/projects/hidden-clone"
-  mark_firstmate_home "$sub"
+  mkdir -p "$home/data" "$home/state"
+  make_live_default_firstmate_clone "$sub"
+  mkdir -p "$sub/data" "$sub/projects/hidden-clone"
   fm_git_init_commit "$sub/projects/hidden-clone"
   chmod 311 "$sub/projects"
 
@@ -890,8 +931,9 @@ test_home_seed_refuses_projectless_home_with_symlinked_projects() {
   sub="$TMP_ROOT/no-projects-symlinked-projects-subhome"
   target="$sub/retained-projects"
   err="$TMP_ROOT/no-projects-symlinked-projects.err"
-  mkdir -p "$home/data" "$home/state" "$sub/data" "$target/hidden-clone"
-  mark_firstmate_home "$sub"
+  mkdir -p "$home/data" "$home/state"
+  make_live_default_firstmate_clone "$sub"
+  mkdir -p "$sub/data" "$target/hidden-clone"
   fm_git_init_commit "$target/hidden-clone"
   ln -s "$target" "$sub/projects"
   chmod 311 "$target"
@@ -904,7 +946,7 @@ test_home_seed_refuses_projectless_home_with_symlinked_projects() {
   fi
   chmod 700 "$target"
   grep -F 'projects directory' "$err" >/dev/null \
-    || fail "project-less seed did not identify the symlinked projects directory"
+    || fail "project-less seed did not identify the symlinked projects directory: $(cat "$err")"
   grep -F 'it is a symlink' "$err" >/dev/null \
     || fail "project-less seed did not explain the symlinked projects directory refusal"
   assert_present "$target/hidden-clone/.git" "project-less symlink refusal removed the target clone"
@@ -925,8 +967,9 @@ test_home_seed_refuses_projectless_home_with_non_directory_projects() {
   home="$TMP_ROOT/no-projects-nondirectory-projects-home"
   sub="$TMP_ROOT/no-projects-nondirectory-projects-subhome"
   err="$TMP_ROOT/no-projects-nondirectory-projects.err"
-  mkdir -p "$home/data" "$home/state" "$sub/data"
-  mark_firstmate_home "$sub"
+  mkdir -p "$home/data" "$home/state"
+  make_live_default_firstmate_clone "$sub"
+  mkdir -p "$sub/data"
   printf '%s\n' 'retained project path' > "$sub/projects"
   projects_before=$(cat "$sub/projects")
 
@@ -955,8 +998,9 @@ test_home_seed_refuses_projectless_home_with_uninspectable_registry() {
   home="$TMP_ROOT/no-projects-uninspectable-registry-home"
   sub="$TMP_ROOT/no-projects-uninspectable-registry-subhome"
   err="$TMP_ROOT/no-projects-uninspectable-registry.err"
-  mkdir -p "$home/data" "$home/state" "$sub/data"
-  mark_firstmate_home "$sub"
+  mkdir -p "$home/data" "$home/state"
+  make_live_default_firstmate_clone "$sub"
+  mkdir -p "$sub/data"
   printf '%s\n' '- hidden-registry [direct-PR] - retained project entry (added 2026-06-22)' > "$sub/data/projects.md"
   registry_before=$(cat "$sub/data/projects.md")
   chmod 000 "$sub/data/projects.md"
@@ -1123,7 +1167,7 @@ test_home_seed_refuses_home_marked_for_another_id() {
   mkdir -p "$home/projects" "$home/data" "$home/state"
   fm_git_init_commit "$home/projects/alpha"
   fm_git_add_origin "$home/projects/alpha" "$TMP_ROOT/remotes/marked-alpha.git"
-  git clone --quiet "$ROOT" "$subhome"
+  make_live_default_firstmate_clone "$subhome"
   printf 'other\n' > "$subhome/.fm-secondmate-home"
   printf '%s\n' '- alpha [direct-PR] - alpha project (added 2026-06-22)' > "$home/data/projects.md"
   scaffold_secondmate_charter "$home" design 'design domain' alpha || fail "charter scaffold failed for marked-home seed test"
@@ -1144,7 +1188,7 @@ test_home_seed_refuses_home_registered_to_another_id() {
   mkdir -p "$home/projects" "$home/data" "$home/state"
   fm_git_init_commit "$home/projects/alpha"
   fm_git_add_origin "$home/projects/alpha" "$TMP_ROOT/remotes/registered-alpha.git"
-  git clone --quiet "$ROOT" "$subhome"
+  make_live_default_firstmate_clone "$subhome"
   subhome_abs=$(cd "$subhome" && pwd -P)
   printf '%s\n' '- alpha [direct-PR] - alpha project (added 2026-06-22)' > "$home/data/projects.md"
   printf '%s\n' '- other - other domain (home: '"$subhome_abs"'; scope: other domain; projects: beta; added 2026-06-22)' > "$home/data/secondmates.md"
@@ -1209,14 +1253,16 @@ test_home_seed_refuses_home_overlapping_registered_home() {
 - child - child domain (home: $registered_child; scope: child domain; projects: gamma; added 2026-06-22)
 EOF
 
-  if FM_HOME="$home" "$ROOT/bin/fm-home-seed.sh" design "$nested" alpha >/dev/null 2>"$err"; then
+  if FM_HOME="$home" FM_SECONDMATE_CHARTER='design domain' FM_SECONDMATE_SCOPE='design domain' \
+    "$ROOT/bin/fm-home-seed.sh" design "$nested" alpha >/dev/null 2>"$err"; then
     fail "seed accepted a home inside a registered secondmate home"
   fi
   grep -F 'overlaps registered secondmate home' "$err" >/dev/null \
     || fail "seed did not explain registered ancestor overlap"
   [ ! -e "$nested" ] || fail "seed created a nested home inside a registered home"
 
-  if FM_HOME="$home" "$ROOT/bin/fm-home-seed.sh" design "$parent" alpha >/dev/null 2>"$err"; then
+  if FM_HOME="$home" FM_SECONDMATE_CHARTER='design domain' FM_SECONDMATE_SCOPE='design domain' \
+    "$ROOT/bin/fm-home-seed.sh" design "$parent" alpha >/dev/null 2>"$err"; then
     fail "seed accepted a home containing a registered secondmate home"
   fi
   grep -F 'overlaps registered secondmate home' "$err" >/dev/null \
@@ -1250,7 +1296,7 @@ test_home_seed_refuses_existing_remote_backed_project_with_wrong_origin() {
   mkdir -p "$home/projects" "$home/data" "$home/state"
   fm_git_init_commit "$home/projects/alpha"
   fm_git_add_origin "$home/projects/alpha" "$TMP_ROOT/remotes/wrong-alpha.git"
-  git clone --quiet "$ROOT" "$subhome"
+  make_live_default_firstmate_clone "$subhome"
   subhome_abs=$(cd "$subhome" && pwd -P)
   mkdir -p "$subhome/projects"
   git clone --quiet "$home/projects/alpha" "$subhome/projects/alpha"
@@ -1302,7 +1348,7 @@ test_home_seed_skips_initialized_existing_no_mistakes_projects() {
   fm_git_init_commit "$home/projects/beta"
   fm_git_add_origin "$home/projects/alpha" "$TMP_ROOT/remotes/existing-alpha.git"
   fm_git_add_origin "$home/projects/beta" "$TMP_ROOT/remotes/existing-beta.git"
-  git clone --quiet "$ROOT" "$subhome"
+  make_live_default_firstmate_clone "$subhome"
   mkdir -p "$subhome/projects"
   origin=$(git -C "$home/projects/alpha" remote get-url origin)
   git clone --quiet "$origin" "$subhome/projects/alpha"
@@ -1335,7 +1381,7 @@ test_home_seed_refuses_uninitialized_existing_no_mistakes_project() {
   mkdir -p "$home/projects" "$home/data" "$home/state"
   fm_git_init_commit "$home/projects/alpha"
   fm_git_add_origin "$home/projects/alpha" "$TMP_ROOT/remotes/uninitialized-alpha.git"
-  git clone --quiet "$ROOT" "$subhome"
+  make_live_default_firstmate_clone "$subhome"
   mkdir -p "$subhome/projects"
   origin=$(git -C "$home/projects/alpha" remote get-url origin)
   git clone --quiet "$origin" "$subhome/projects/alpha"
@@ -1364,7 +1410,7 @@ test_home_seed_refuses_project_destinations_outside_subhome() {
   mkdir -p "$home/projects" "$home/data" "$home/state" "$sink"
   fm_git_init_commit "$home/projects/alpha"
   fm_git_add_origin "$home/projects/alpha" "$TMP_ROOT/remotes/symlink-alpha.git"
-  git clone --quiet "$ROOT" "$subhome"
+  make_live_default_firstmate_clone "$subhome"
   rm -rf "$subhome/projects"
   ln -s "$sink" "$subhome/projects"
   printf '%s\n' '- alpha [direct-PR] - alpha project (added 2026-06-22)' > "$home/data/projects.md"
@@ -1394,7 +1440,7 @@ test_home_seed_refuses_operational_dirs_outside_subhome() {
     subhome="$TMP_ROOT/symlink-opdir-subhome-$opdir"
     sink="$home/data/symlink-opdir-$opdir"
     rm -rf "$subhome" "$sink"
-    git clone --quiet "$ROOT" "$subhome"
+    make_live_default_firstmate_clone "$subhome"
     mkdir -p "$sink"
     rm -rf "${subhome:?}/${opdir:?}"
     ln -s "$sink" "$subhome/$opdir"
@@ -1422,7 +1468,7 @@ test_home_seed_refuses_symlinked_leaf_files() {
     subhome="$TMP_ROOT/symlink-leaf-subhome-${leaf//\//-}"
     sink="$home/data/symlink-leaf-${leaf//\//-}"
     rm -rf "$subhome" "$sink"
-    git clone --quiet "$ROOT" "$subhome"
+    make_live_default_firstmate_clone "$subhome"
     mkdir -p "$(dirname "$subhome/$leaf")" "$(dirname "$sink")"
     expected=outside
     if [ "$leaf" = ".fm-secondmate-home" ]; then
@@ -1682,13 +1728,16 @@ test_fm_send_refuses_bare_window_without_home_meta() {
 }
 
 test_secondmate_teardown_retires_empty_home() {
-  local home subhome subhome_abs fakebin log lease fmroot
+  local home subhome subhome_abs fakebin log lease fmroot err
   home="$TMP_ROOT/teardown-home"
-  subhome="$TMP_ROOT/teardown-subhome"
+  subhome="$TMP_ROOT/teardown-pool/1/teardown-subhome"
   fmroot="$TMP_ROOT/teardown-fmroot"
+  err="$TMP_ROOT/teardown.err"
   make_firstmate_git_root "$fmroot"
+  mkdir -p "$(dirname "$subhome")"
   git -C "$fmroot" worktree add --quiet --detach "$subhome" HEAD
-  mkdir -p "$home/state" "$home/data" "$subhome/state"
+  write_treehouse_lease "$subhome" domain
+  mkdir -p "$home/data" "$home/projects" "$home/state" "$subhome/config" "$subhome/data" "$subhome/projects" "$subhome/state"
   printf 'domain\n' > "$subhome/.fm-secondmate-home"
   subhome_abs=$(cd "$subhome" && pwd -P)
   cat > "$home/state/domain.meta" <<EOF
@@ -1700,17 +1749,17 @@ kind=secondmate
 mode=secondmate
 yolo=off
 home=$subhome
-projects=alpha
+projects=
 EOF
-  printf '%s\n' '- domain - design domain (home: '"$subhome"'; scope: design domain; projects: alpha; added 2026-06-22)' > "$home/data/secondmates.md"
+  printf '%s\n' '- domain - design domain (home: '"$subhome"'; scope: design domain; projects: ; added 2026-06-22)' > "$home/data/secondmates.md"
   fakebin=$(make_fake_tmux "$TMP_ROOT/teardown-fake")
   log="$TMP_ROOT/teardown-fake/tmux.log"
   lease="$TMP_ROOT/teardown-fake/lease"
   printf 'domain\n' > "$lease"
   PATH="$fakebin:$PATH" FM_ROOT_OVERRIDE="$fmroot" FM_HOME="$home" FM_FAKE_TMUX_LOG="$log" FM_FAKE_TMUX_CAPTURE="$TMP_ROOT/teardown-fake/pane.txt" \
     FM_FAKE_TREEHOUSE_LEASE_FILE="$lease" \
-    "$ROOT/bin/fm-teardown.sh" domain >/dev/null 2>/dev/null \
-    || fail "teardown failed for empty secondmate home"
+    "$ROOT/bin/fm-teardown.sh" domain >/dev/null 2>"$err" \
+    || fail "teardown failed for empty secondmate home: $(cat "$err")"
   grep -F "treehouse return --force $subhome_abs" "$log" >/dev/null || fail "teardown did not release the secondmate home lease via treehouse return"
   [ ! -e "$lease" ] || fail "teardown left the secondmate home lease held after retirement"
   [ ! -d "$subhome" ] || fail "teardown did not remove the retired secondmate home"
@@ -1722,12 +1771,14 @@ EOF
 test_secondmate_teardown_refuses_failed_leased_home_return() {
   local home subhome subhome_abs fakebin log fmroot err rc
   home="$TMP_ROOT/teardown-return-fail-home"
-  subhome="$TMP_ROOT/teardown-return-fail-subhome"
+  subhome="$TMP_ROOT/teardown-return-fail-pool/1/teardown-return-fail-subhome"
   fmroot="$TMP_ROOT/teardown-return-fail-fmroot"
   err="$TMP_ROOT/teardown-return-fail.err"
   make_firstmate_git_root "$fmroot"
+  mkdir -p "$(dirname "$subhome")"
   git -C "$fmroot" worktree add --quiet --detach "$subhome" HEAD
-  mkdir -p "$home/state" "$home/data" "$subhome/state"
+  write_treehouse_lease "$subhome" domain
+  mkdir -p "$home/data" "$home/projects" "$home/state" "$subhome/config" "$subhome/data" "$subhome/projects" "$subhome/state"
   printf 'domain\n' > "$subhome/.fm-secondmate-home"
   subhome_abs=$(cd "$subhome" && pwd -P)
   cat > "$home/state/domain.meta" <<EOF
@@ -1739,9 +1790,9 @@ kind=secondmate
 mode=secondmate
 yolo=off
 home=$subhome
-projects=alpha
+projects=
 EOF
-  printf '%s\n' '- domain - design domain (home: '"$subhome"'; scope: design domain; projects: alpha; added 2026-06-22)' > "$home/data/secondmates.md"
+  printf '%s\n' '- domain - design domain (home: '"$subhome"'; scope: design domain; projects: ; added 2026-06-22)' > "$home/data/secondmates.md"
   fakebin=$(make_fake_tmux "$TMP_ROOT/teardown-return-fail-fake")
   log="$TMP_ROOT/teardown-return-fail-fake/tmux.log"
 
@@ -1762,11 +1813,13 @@ EOF
 }
 
 test_secondmate_teardown_removes_plain_clone_home_without_treehouse_return() {
-  local home subhome subhome_abs fakebin log
+  local home subhome subhome_abs fakebin log err
   home="$TMP_ROOT/plain-clone-teardown-home"
   subhome="$TMP_ROOT/plain-clone-teardown-subhome"
-  mkdir -p "$home/state" "$home/data" "$subhome/state"
-  mark_firstmate_home "$subhome"
+  err="$TMP_ROOT/plain-clone-teardown.err"
+  mkdir -p "$home/data" "$home/projects" "$home/state"
+  make_live_default_firstmate_clone "$subhome"
+  mkdir -p "$subhome/config" "$subhome/data" "$subhome/projects" "$subhome/state"
   printf 'domain\n' > "$subhome/.fm-secondmate-home"
   subhome_abs=$(cd "$subhome" && pwd -P)
   cat > "$home/state/domain.meta" <<EOF
@@ -1778,16 +1831,16 @@ kind=secondmate
 mode=secondmate
 yolo=off
 home=$subhome
-projects=alpha
+projects=
 EOF
-  printf '%s\n' '- domain - design domain (home: '"$subhome"'; scope: design domain; projects: alpha; added 2026-06-22)' > "$home/data/secondmates.md"
+  printf '%s\n' '- domain - design domain (home: '"$subhome"'; scope: design domain; projects: ; added 2026-06-22)' > "$home/data/secondmates.md"
   fakebin=$(make_fake_tmux "$TMP_ROOT/plain-clone-teardown-fake")
   log="$TMP_ROOT/plain-clone-teardown-fake/tmux.log"
 
   PATH="$fakebin:$PATH" FM_HOME="$home" FM_FAKE_TMUX_LOG="$log" FM_FAKE_TMUX_CAPTURE="$TMP_ROOT/plain-clone-teardown-fake/pane.txt" \
     FM_FAKE_TREEHOUSE_RETURN_FAIL=1 \
-    "$ROOT/bin/fm-teardown.sh" domain >/dev/null 2>/dev/null \
-    || fail "teardown failed for plain-clone secondmate home"
+    "$ROOT/bin/fm-teardown.sh" domain >/dev/null 2>"$err" \
+    || fail "teardown failed for plain-clone secondmate home: $(cat "$err")"
   grep -F "treehouse return --force $subhome_abs" "$log" >/dev/null && fail "teardown tried to return a plain-clone home through treehouse"
   [ ! -d "$subhome" ] || fail "teardown did not remove the plain-clone secondmate home"
   [ ! -e "$home/state/domain.meta" ] || fail "teardown did not clear parent meta for plain-clone home"
@@ -1818,6 +1871,7 @@ EOF
   printf '%s\n' '- domain - design domain (home: '"$subhome"'; scope: design domain; projects: alpha; added 2026-06-22)' > "$home/data/secondmates.md"
   cat > "$subhome/state/child.meta" <<EOF
 window=firstmate:fm-child
+tmux_session_target=firstmate:fm-child
 worktree=$childwt
 project=$childproj
 harness=echo
@@ -1848,14 +1902,21 @@ EOF
 }
 
 test_secondmate_force_teardown_preserves_child_on_unproven_lock() {
-  local home subhome childproj childwt fakebin log err rc lock
+  local home subhome childproj childwt fakebin log err rc lock origin
   home="$TMP_ROOT/force-lock-home"
   subhome="$TMP_ROOT/force-lock-subhome"
   childproj="$subhome/projects/alpha"
-  childwt="$TMP_ROOT/force-lock-child-worktree"
+  childwt="$TMP_ROOT/force-lock-pool/1/force-lock-child-worktree"
   err="$TMP_ROOT/force-lock-child.err"
-  mkdir -p "$home/state" "$home/data" "$subhome/state"
-  fm_git_worktree "$childproj" "$childwt" force-child-lock
+  mkdir -p "$home/data" "$home/projects" "$home/state" "$(dirname "$childwt")"
+  fm_git_init_commit "$home/projects/alpha"
+  fm_git_add_origin "$home/projects/alpha" "$TMP_ROOT/remotes/force-lock-alpha.git"
+  make_live_default_firstmate_clone "$subhome"
+  mkdir -p "$subhome/config" "$subhome/data" "$subhome/projects" "$subhome/state"
+  origin=$(git -C "$home/projects/alpha" remote get-url origin)
+  git clone --quiet "$origin" "$childproj"
+  git -C "$childproj" worktree add --quiet -b force-child-lock "$childwt"
+  write_treehouse_lease "$childwt" firstmate-child
   printf 'domain\n' > "$subhome/.fm-secondmate-home"
   cat > "$home/state/domain.meta" <<EOF
 window=firstmate:fm-domain
@@ -1871,6 +1932,7 @@ EOF
   printf '%s\n' '- domain - design domain (home: '"$subhome"'; scope: design domain; projects: alpha; added 2026-06-22)' > "$home/data/secondmates.md"
   cat > "$subhome/state/child.meta" <<EOF
 window=firstmate:fm-child
+tmux_session_target=firstmate:fm-child
 worktree=$childwt
 project=$childproj
 harness=echo
@@ -1918,6 +1980,7 @@ SH
 
   set +e
   PATH="$fakebin:$PATH" FM_HOME="$home" FM_FAKE_TMUX_LOG="$log" FM_FAKE_TMUX_CAPTURE="$TMP_ROOT/force-lock-child-fake/pane.txt" \
+    FM_FAKE_TMUX_WINDOW=fm-child \
     FM_STALE_WORKTREE_LOCK_RETRY_WAIT_SECS=0 FM_STALE_WORKTREE_LOCK_AGE_SECS=1 \
     "$ROOT/bin/fm-teardown.sh" domain --force >/dev/null 2>"$err"
   rc=$?
@@ -1928,19 +1991,24 @@ SH
   [ -e "$lock" ] || fail "force teardown removed unproven child index.lock"
   [ -d "$subhome" ] || fail "force teardown removed subhome after child lock refusal"
   [ -e "$subhome/state/child.meta" ] || fail "force teardown cleared child meta after child lock refusal"
-  grep -F 'not provably stale' "$err" >/dev/null || fail "force teardown did not explain unproven child lock refusal"
+  grep -F 'not provably stale' "$err" >/dev/null \
+    || fail "force teardown did not explain unproven child lock refusal: $(cat "$err")"
   pass "secondmate force teardown preserves child worktree after unproven lock refusal"
 }
 
 test_secondmate_force_teardown_allows_operational_dir_symlinks_inside_home() {
   local opdir home subhome target fakebin err log
   for opdir in data state config projects; do
+    [ -z "${FM_TEST_OPERATIONAL_DIR:-}" ] || [ "$FM_TEST_OPERATIONAL_DIR" = "$opdir" ] || continue
     home="$TMP_ROOT/symlink-inside-teardown-home-$opdir"
     subhome="$TMP_ROOT/symlink-inside-teardown-subhome-$opdir"
     target="$subhome/internal-$opdir"
     err="$TMP_ROOT/symlink-inside-teardown-$opdir.err"
     rm -rf "$home" "$subhome"
-    mkdir -p "$home/state" "$home/data" "$subhome" "$target"
+    mkdir -p "$home/data" "$home/projects" "$home/state"
+    make_live_default_firstmate_clone "$subhome"
+    mkdir -p "$subhome/config" "$subhome/data" "$subhome/projects" "$subhome/state" "$target"
+    rm -rf "${subhome:?}/${opdir:?}"
     printf 'domain\n' > "$subhome/.fm-secondmate-home"
     ln -s "$target" "$subhome/$opdir"
     cat > "$home/state/domain.meta" <<EOF
@@ -1952,14 +2020,14 @@ kind=secondmate
 mode=secondmate
 yolo=off
 home=$subhome
-projects=alpha
+projects=
 EOF
-    printf '%s\n' '- domain - design domain (home: '"$subhome"'; scope: design domain; projects: alpha; added 2026-06-22)' > "$home/data/secondmates.md"
+    printf '%s\n' '- domain - design domain (home: '"$subhome"'; scope: design domain; projects: ; added 2026-06-22)' > "$home/data/secondmates.md"
     fakebin=$(make_fake_tmux "$TMP_ROOT/symlink-inside-teardown-fake-$opdir")
     log="$TMP_ROOT/symlink-inside-teardown-fake-$opdir/tmux.log"
     PATH="$fakebin:$PATH" FM_HOME="$home" FM_FAKE_TMUX_LOG="$log" FM_FAKE_TMUX_CAPTURE="$TMP_ROOT/symlink-inside-teardown-fake-$opdir/pane.txt" \
       "$ROOT/bin/fm-teardown.sh" domain --force >/dev/null 2>"$err" \
-      || fail "force teardown refused $opdir symlinked inside the secondmate home"
+      || fail "force teardown refused $opdir symlinked inside the secondmate home: $(cat "$err")"
     [ ! -e "$subhome" ] || fail "force teardown did not remove subhome with inside $opdir symlink"
     [ ! -e "$home/state/domain.meta" ] || fail "force teardown did not clear parent meta for inside $opdir symlink"
     grep -F 'kill-window -t firstmate:fm-domain' "$log" >/dev/null || fail "force teardown did not kill parent window for inside $opdir symlink"
@@ -1973,7 +2041,9 @@ test_secondmate_force_teardown_refuses_operational_dir_symlink_outside_home() {
   subhome="$TMP_ROOT/symlink-state-teardown-subhome"
   external_state="$home/data/external-state"
   err="$TMP_ROOT/symlink-state-teardown.err"
-  mkdir -p "$home/state" "$home/data" "$subhome" "$external_state"
+  mkdir -p "$home/data" "$home/projects" "$home/state" "$external_state"
+  make_live_default_firstmate_clone "$subhome"
+  mkdir -p "$subhome/config" "$subhome/data" "$subhome/projects"
   printf 'domain\n' > "$subhome/.fm-secondmate-home"
   ln -s "$external_state" "$subhome/state"
   cat > "$home/state/domain.meta" <<EOF
@@ -1985,9 +2055,9 @@ kind=secondmate
 mode=secondmate
 yolo=off
 home=$subhome
-projects=alpha
+projects=
 EOF
-  printf '%s\n' '- domain - design domain (home: '"$subhome"'; scope: design domain; projects: alpha; added 2026-06-22)' > "$home/data/secondmates.md"
+  printf '%s\n' '- domain - design domain (home: '"$subhome"'; scope: design domain; projects: ; added 2026-06-22)' > "$home/data/secondmates.md"
   fakebin=$(make_fake_tmux "$TMP_ROOT/symlink-state-teardown-fake")
   log="$TMP_ROOT/symlink-state-teardown-fake/tmux.log"
   if PATH="$fakebin:$PATH" FM_HOME="$home" FM_FAKE_TMUX_LOG="$log" FM_FAKE_TMUX_CAPTURE="$TMP_ROOT/symlink-state-teardown-fake/pane.txt" \
@@ -1996,7 +2066,8 @@ EOF
   fi
   [ -d "$subhome" ] || fail "force teardown removed subhome after symlinked state refusal"
   [ -d "$external_state" ] || fail "force teardown removed external symlink target"
-  grep -F 'state directory' "$err" >/dev/null || fail "teardown did not explain symlinked state refusal"
+  grep -F 'state directory' "$err" >/dev/null \
+    || fail "teardown did not explain symlinked state refusal: $(cat "$err")"
   grep -F 'resolves outside the secondmate home' "$err" >/dev/null || fail "teardown did not identify unsafe state symlink"
   grep -F 'kill-window' "$log" >/dev/null && fail "teardown killed a window before symlinked state refusal"
   pass "force teardown refuses operational directory symlinks outside the subhome"
@@ -2112,8 +2183,9 @@ EOF
   [ -e "$home/state/domain.meta" ] || fail "teardown cleared ancestor meta after nested-home refusal"
   [ -e "$home/state/nested.meta" ] || fail "teardown cleared nested meta after nested-home refusal"
   grep -F 'kill-window' "$log" >/dev/null && fail "teardown killed a window before nested-home refusal"
-  grep -F 'contains registered secondmate home' "$err" >/dev/null || fail "teardown did not explain registered nested-home refusal"
-  pass "secondmate teardown refuses homes containing registered nested homes"
+  grep -F 'secondmate registry is malformed' "$err" >/dev/null \
+    || fail "teardown did not explain malformed nested registry refusal: $(cat "$err")"
+  pass "secondmate teardown refuses malformed registries containing nested homes"
 }
 
 test_secondmate_teardown_refuses_child_registry_nested_home() {
@@ -2122,7 +2194,9 @@ test_secondmate_teardown_refuses_child_registry_nested_home() {
   subhome="$TMP_ROOT/child-registry-teardown-subhome"
   nested="$subhome/nested-domain"
   err="$TMP_ROOT/child-registry-teardown.err"
-  mkdir -p "$home/state" "$home/data" "$subhome/state" "$subhome/data" "$nested/state"
+  mkdir -p "$home/data" "$home/projects" "$home/state"
+  make_live_default_firstmate_clone "$subhome"
+  mkdir -p "$subhome/config" "$subhome/data" "$subhome/projects" "$subhome/state" "$nested/state"
   printf 'domain\n' > "$subhome/.fm-secondmate-home"
   printf 'nested\n' > "$nested/.fm-secondmate-home"
   cat > "$home/state/domain.meta" <<EOF
@@ -2134,9 +2208,9 @@ kind=secondmate
 mode=secondmate
 yolo=off
 home=$subhome
-projects=alpha
+projects=
 EOF
-  printf '%s\n' '- domain - design domain (home: '"$subhome"'; scope: design domain; projects: alpha; added 2026-06-22)' > "$home/data/secondmates.md"
+  printf '%s\n' '- domain - design domain (home: '"$subhome"'; scope: design domain; projects: ; added 2026-06-22)' > "$home/data/secondmates.md"
   printf '%s\n' '- nested - nested domain (home: '"$nested"'; scope: nested domain; projects: beta; added 2026-06-22)' > "$subhome/data/secondmates.md"
   fakebin=$(make_fake_tmux "$TMP_ROOT/child-registry-teardown-fake")
   log="$TMP_ROOT/child-registry-teardown-fake/tmux.log"
@@ -2148,7 +2222,8 @@ EOF
   [ -d "$nested" ] || fail "teardown removed child-registry nested home after refusal"
   [ -e "$home/state/domain.meta" ] || fail "teardown cleared parent meta after child-registry refusal"
   grep -F 'kill-window' "$log" >/dev/null && fail "teardown killed a window before child-registry refusal"
-  grep -F 'contains registered secondmate home' "$err" >/dev/null || fail "teardown did not explain child-registry nested-home refusal"
+  grep -F 'still registers child homes' "$err" >/dev/null \
+    || fail "teardown did not explain child-registry nested-home refusal: $(cat "$err")"
   pass "secondmate teardown refuses nested homes from the child registry"
 }
 
@@ -2197,13 +2272,19 @@ EOF
 }
 
 test_secondmate_force_teardown_refuses_child_active_home_descendant() {
-  local home subhome childproj childwt fakebin err log
+  local home subhome childproj childwt fakebin err log origin
   home="$TMP_ROOT/child-active-descendant-home"
   subhome="$TMP_ROOT/child-active-descendant-subhome"
   childproj="$subhome/projects/alpha"
   childwt="$home/data"
   err="$TMP_ROOT/child-active-descendant.err"
-  mkdir -p "$home/state" "$home/data" "$subhome/state" "$childproj"
+  mkdir -p "$home/data" "$home/projects" "$home/state"
+  fm_git_init_commit "$home/projects/alpha"
+  fm_git_add_origin "$home/projects/alpha" "$TMP_ROOT/remotes/child-active-descendant-alpha.git"
+  make_live_default_firstmate_clone "$subhome"
+  mkdir -p "$subhome/config" "$subhome/data" "$subhome/projects" "$subhome/state"
+  origin=$(git -C "$home/projects/alpha" remote get-url origin)
+  git clone --quiet "$origin" "$childproj"
   printf 'domain\n' > "$subhome/.fm-secondmate-home"
   cat > "$home/state/domain.meta" <<EOF
 window=firstmate:fm-domain
@@ -2237,24 +2318,27 @@ EOF
   [ -e "$home/state/domain.meta" ] || fail "force teardown cleared parent meta after child validation refusal"
   [ -e "$subhome/state/child.meta" ] || fail "force teardown cleared child meta after child validation refusal"
   grep -F 'kill-window' "$log" >/dev/null && fail "force teardown killed windows before child validation refusal"
-  grep -F 'inside the active firstmate home' "$err" >/dev/null || fail "force teardown did not explain active home descendant rejection"
+  grep -F 'inside the active firstmate home' "$err" >/dev/null \
+    || fail "force teardown did not explain active home descendant rejection: $(cat "$err")"
   pass "force teardown refuses child worktrees inside the active home"
 }
 
 test_secondmate_force_teardown_refuses_child_repo_descendant() {
-  local home subhome childproj childwt fakeroot fakebin err log
+  local home subhome childproj childwt fakeroot fakebin err log origin
   home="$TMP_ROOT/child-repo-descendant-home"
   subhome="$TMP_ROOT/child-repo-descendant-subhome"
   childproj="$subhome/projects/alpha"
   fakeroot="$TMP_ROOT/child-repo-descendant-root"
   childwt="$fakeroot/data"
   err="$TMP_ROOT/child-repo-descendant.err"
-  mkdir -p "$home/state" "$home/data" "$subhome/state" "$childproj" "$childwt" "$fakeroot/bin"
-  cat > "$fakeroot/bin/fm-guard.sh" <<'SH'
-#!/usr/bin/env bash
-exit 0
-SH
-  chmod +x "$fakeroot/bin/fm-guard.sh"
+  mkdir -p "$home/data" "$home/projects" "$home/state"
+  fm_git_init_commit "$home/projects/alpha"
+  fm_git_add_origin "$home/projects/alpha" "$TMP_ROOT/remotes/child-repo-descendant-alpha.git"
+  make_firstmate_git_root "$fakeroot"
+  git clone --quiet "$fakeroot" "$subhome"
+  mkdir -p "$subhome/config" "$subhome/data" "$subhome/projects" "$subhome/state" "$childwt"
+  origin=$(git -C "$home/projects/alpha" remote get-url origin)
+  git clone --quiet "$origin" "$childproj"
   printf 'domain\n' > "$subhome/.fm-secondmate-home"
   cat > "$home/state/domain.meta" <<EOF
 window=firstmate:fm-domain
@@ -2288,18 +2372,26 @@ EOF
   [ -e "$home/state/domain.meta" ] || fail "force teardown cleared parent meta after repo child validation refusal"
   [ -e "$subhome/state/child.meta" ] || fail "force teardown cleared child meta after repo child validation refusal"
   grep -F 'kill-window' "$log" >/dev/null && fail "force teardown killed windows before repo child validation refusal"
-  grep -F 'inside the firstmate repo' "$err" >/dev/null || fail "force teardown did not explain repo descendant rejection"
+  grep -F 'inside the firstmate repo' "$err" >/dev/null \
+    || fail "force teardown did not explain repo descendant rejection: $(cat "$err")"
   pass "force teardown refuses child worktrees inside the firstmate repo"
 }
 
 test_secondmate_force_teardown_refuses_unregistered_child_worktree() {
-  local home subhome childproj childwt fakebin err log
+  local home subhome childproj childwt fakebin err log origin
   home="$TMP_ROOT/unregistered-child-home"
   subhome="$TMP_ROOT/unregistered-child-subhome"
   childproj="$subhome/projects/alpha"
   childwt="$TMP_ROOT/unregistered-child-worktree"
   err="$TMP_ROOT/unregistered-child.err"
-  mkdir -p "$home/state" "$home/data" "$subhome/state" "$childproj" "$childwt"
+  mkdir -p "$home/data" "$home/projects" "$home/state"
+  fm_git_init_commit "$home/projects/alpha"
+  fm_git_add_origin "$home/projects/alpha" "$TMP_ROOT/remotes/unregistered-child-alpha.git"
+  make_live_default_firstmate_clone "$subhome"
+  mkdir -p "$subhome/config" "$subhome/data" "$subhome/projects" "$subhome/state"
+  origin=$(git -C "$home/projects/alpha" remote get-url origin)
+  git clone --quiet "$origin" "$childproj"
+  fm_git_init_commit "$childwt"
   printf 'domain\n' > "$subhome/.fm-secondmate-home"
   cat > "$home/state/domain.meta" <<EOF
 window=firstmate:fm-domain
@@ -2333,7 +2425,8 @@ EOF
   [ -e "$home/state/domain.meta" ] || fail "force teardown cleared parent meta after unregistered child refusal"
   [ -e "$subhome/state/child.meta" ] || fail "force teardown cleared child meta after unregistered child refusal"
   grep -F 'kill-window' "$log" >/dev/null && fail "force teardown killed windows before unregistered child refusal"
-  grep -F 'is not a git worktree for' "$err" >/dev/null || fail "force teardown did not explain unregistered child rejection"
+  grep -F 'is not a git worktree for' "$err" >/dev/null \
+    || fail "force teardown did not explain unregistered child rejection: $(cat "$err")"
   pass "force teardown refuses unregistered child worktree paths"
 }
 
@@ -2546,6 +2639,87 @@ if [ "${FM_TEST_FOCUSED:-}" = review-round-durable-secondmate ]; then
   exit 0
 fi
 
+if [ "${FM_TEST_FOCUSED:-}" = empty-charter ]; then
+  test_home_seed_refuses_empty_charter_fields
+  exit 0
+fi
+
+if [ "${FM_TEST_FOCUSED:-}" = projectless-existing ]; then
+  test_home_seed_refuses_projectless_conversion_of_populated_home
+  test_home_seed_refuses_projectless_home_with_uninspectable_projects
+  test_home_seed_refuses_projectless_home_with_symlinked_projects
+  test_home_seed_refuses_projectless_home_with_non_directory_projects
+  test_home_seed_refuses_projectless_home_with_uninspectable_registry
+  exit 0
+fi
+
+if [ "${FM_TEST_FOCUSED:-}" = registered-overlap ]; then
+  test_home_seed_refuses_home_overlapping_registered_home
+  exit 0
+fi
+
+if [ "${FM_TEST_FOCUSED:-}" = existing-projects ]; then
+  test_home_seed_refuses_existing_remote_backed_project_with_wrong_origin
+  test_home_seed_skips_initialized_existing_no_mistakes_projects
+  test_home_seed_refuses_uninitialized_existing_no_mistakes_project
+  test_home_seed_refuses_project_destinations_outside_subhome
+  test_home_seed_refuses_operational_dirs_outside_subhome
+  test_home_seed_refuses_symlinked_leaf_files
+  exit 0
+fi
+
+if [ "${FM_TEST_FOCUSED:-}" = teardown-empty ]; then
+  test_secondmate_teardown_retires_empty_home
+  exit 0
+fi
+
+if [ "${FM_TEST_FOCUSED:-}" = teardown-lock ]; then
+  test_secondmate_force_teardown_preserves_child_on_unproven_lock
+  exit 0
+fi
+
+if [ "${FM_TEST_FOCUSED:-}" = teardown-inside-symlinks ]; then
+  test_secondmate_force_teardown_allows_operational_dir_symlinks_inside_home
+  exit 0
+fi
+
+if [ "${FM_TEST_FOCUSED:-}" = teardown-after-symlinks ]; then
+  test_secondmate_force_teardown_refuses_operational_dir_symlink_outside_home
+  test_secondmate_teardown_refuses_registered_nested_home
+  test_secondmate_teardown_refuses_child_registry_nested_home
+  test_secondmate_force_teardown_prevalidates_before_child_cleanup
+  test_secondmate_force_teardown_refuses_child_active_home_descendant
+  test_secondmate_force_teardown_refuses_child_repo_descendant
+  test_secondmate_force_teardown_refuses_unregistered_child_worktree
+  test_secondmate_teardown_path_boundary_matrix
+  test_secondmate_idle_pane_is_not_stale
+  test_secondmate_charter_brief_is_idle_by_default
+  test_backlog_handoff_aborts_safely
+  test_backlog_handoff_refuses_done_items_and_non_secondmate_homes
+  exit 0
+fi
+
+if [ "${FM_TEST_FOCUSED:-}" = teardown-rest ]; then
+  test_secondmate_teardown_refuses_failed_leased_home_return
+  test_secondmate_teardown_removes_plain_clone_home_without_treehouse_return
+  test_secondmate_force_teardown_retains_unlanded_child_work
+  test_secondmate_force_teardown_preserves_child_on_unproven_lock
+  test_secondmate_force_teardown_allows_operational_dir_symlinks_inside_home
+  test_secondmate_force_teardown_refuses_operational_dir_symlink_outside_home
+  test_secondmate_teardown_refuses_registered_nested_home
+  test_secondmate_teardown_refuses_child_registry_nested_home
+  test_secondmate_force_teardown_prevalidates_before_child_cleanup
+  test_secondmate_force_teardown_refuses_child_active_home_descendant
+  test_secondmate_force_teardown_refuses_child_repo_descendant
+  test_secondmate_force_teardown_refuses_unregistered_child_worktree
+  test_secondmate_teardown_path_boundary_matrix
+  test_secondmate_idle_pane_is_not_stale
+  test_secondmate_charter_brief_is_idle_by_default
+  test_backlog_handoff_aborts_safely
+  test_backlog_handoff_refuses_done_items_and_non_secondmate_homes
+  exit 0
+fi
+
 test_fm_home_parameterization
 test_lock_status_is_per_home
 test_seed_allows_overlapping_clones_and_drops_owner
diff --git a/tests/fm-secondmate-sync.test.sh b/tests/fm-secondmate-sync.test.sh
index 232f038f88..6f42493912 100755
--- a/tests/fm-secondmate-sync.test.sh
+++ b/tests/fm-secondmate-sync.test.sh
@@ -32,7 +32,7 @@ BASE_PATH=${FM_TEST_BASE_PATH:-/usr/bin:/bin:/usr/sbin:/sbin}
 # Deterministic, isolated git identity for fixture commits.
 fm_git_identity fmtest fmtest@example.com
 
-TMP_ROOT=$(fm_test_tmproot fm-secondmate-sync)
+fm_test_tmproot_into TMP_ROOT fm-secondmate-sync
 export FM_BACKEND=tmux
 export FM_BACKEND_HERDR_TEST_LAB=firstmate-herdr-test-lab-v1
 
@@ -405,7 +405,7 @@ case "\$cmd \$sub" in
       printf '{"error":{"code":"agent_not_found","message":"gone"}}\n' >&2
     fi
     ;;
-  "pane send-text"|"pane run"|"pane send-keys")
+  "agent send"|"pane send-text"|"pane run"|"pane send-keys")
     if [ "\$arg" = "${stale#*:}" ]; then
       exit 1
     fi
@@ -529,6 +529,7 @@ test_spawn_fast_forwards_before_launch() {
   printf 'sm\n' > "$w/sm/.fm-secondmate-home"
   mkdir -p "$w/sm/data"
   printf 'charter\n' > "$w/sm/data/charter.md"
+  printf '%s\n' '- sm - sync test (home: '"$w/sm"'; scope: sync test; projects: ; added 2026-07-25)' > "$w/home/data/secondmates.md"
   bump_primary "$w" instr
   c2=$(head_of "$w/main")
   [ "$(head_of "$w/sm")" = "$c1" ] || fail "precondition: home should start behind the primary"
@@ -554,15 +555,16 @@ SH
   pass "T10 spawn fast-forwards a secondmate worktree to the primary's local HEAD before launch"
 }
 
-# --- T11: spawn warns when pre-launch sync is skipped ------------------------
+# --- T11: spawn refuses when pre-launch sync is skipped ----------------------
 test_spawn_warns_when_sync_skipped_before_launch() {
-  local w c1 before fakebin err
+  local w c1 before fakebin err rc=0
   w=$(new_world spawn-skip)
   c1=$(head_of "$w/main")
   git -C "$w/main" worktree add -q --detach "$w/sm" "$c1"
   printf 'sm\n' > "$w/sm/.fm-secondmate-home"
   mkdir -p "$w/sm/data"
   printf 'charter\n' > "$w/sm/data/charter.md"
+  printf '%s\n' '- sm - sync test (home: '"$w/sm"'; scope: sync test; projects: ; added 2026-07-25)' > "$w/home/data/secondmates.md"
   bump_primary "$w" instr
   printf 'uncommitted local edit\n' >> "$w/sm/AGENTS.md"
   before=$(head_of "$w/sm")
@@ -581,14 +583,15 @@ SH
     FM_STATE_OVERRIDE="$w/home/state" FM_DATA_OVERRIDE="$w/home/data" \
     FM_PROJECTS_OVERRIDE="$w/home/projects" FM_CONFIG_OVERRIDE="$w/home/config" \
     FM_SPAWN_NO_GUARD=1 \
-    "$ROOT/bin/fm-spawn.sh" sm "$w/sm" codex --secondmate >/dev/null 2>"$err" || true
+    "$ROOT/bin/fm-spawn.sh" sm "$w/sm" codex --secondmate >/dev/null 2>"$err" || rc=$?
 
+  [ "$rc" -ne 0 ] || fail "spawn launched a secondmate whose home freshness was unresolved"
   assert_contains "$(cat "$err")" \
-    "warning: secondmate sm sync skipped before launch: dirty working tree" \
-    "spawn warning reports the skipped sync reason"
+    "error: refusing secondmate launch because its home freshness is unresolved: secondmate sm: skipped: dirty working tree" \
+    "spawn refusal reports the skipped sync reason"
   [ "$(head_of "$w/sm")" = "$before" ] || fail "dirty spawn home HEAD moved"
   grep -q 'uncommitted local edit' "$w/sm/AGENTS.md" || fail "dirty spawn edit was discarded"
-  pass "T11 spawn warns when pre-launch sync is skipped"
+  pass "T11 spawn refuses when pre-launch sync is skipped"
 }
 
 # --- T12: a freshly seeded home reads clean once the primary ignores the marker -
diff --git a/tests/fm-send-popup-settle.test.sh b/tests/fm-send-popup-settle.test.sh
index 685ce627ab..600c1fa094 100755
--- a/tests/fm-send-popup-settle.test.sh
+++ b/tests/fm-send-popup-settle.test.sh
@@ -36,7 +36,7 @@ set -u
 
 SEND="$ROOT/bin/fm-send.sh"
 
-TMP_ROOT=$(fm_test_tmproot fm-send-popup-settle)
+fm_test_tmproot_into TMP_ROOT fm-send-popup-settle
 
 # Same stub shape as fm-send-settle.test.sh: a fake tmux that drives the submit
 # path to a clean "empty" verdict on the first Enter, and a fake sleep that records
diff --git a/tests/fm-send-secondmate-marker.test.sh b/tests/fm-send-secondmate-marker.test.sh
index 2e60d93758..92743b2c01 100755
--- a/tests/fm-send-secondmate-marker.test.sh
+++ b/tests/fm-send-secondmate-marker.test.sh
@@ -23,7 +23,7 @@ set -u
 
 SEND="$ROOT/bin/fm-send.sh"
 
-TMP_ROOT=$(fm_test_tmproot fm-send-marker)
+fm_test_tmproot_into TMP_ROOT fm-send-marker
 
 # A fake tmux that (a) records the literal text of every `send-keys -l` to
 # FM_SEND_LOG and (b) lets fm-send's submit path reach a clean "empty" verdict.
diff --git a/tests/fm-send-settle.test.sh b/tests/fm-send-settle.test.sh
index 93a9c351b2..8975bb9e58 100755
--- a/tests/fm-send-settle.test.sh
+++ b/tests/fm-send-settle.test.sh
@@ -19,7 +19,7 @@ set -u
 
 SEND="$ROOT/bin/fm-send.sh"
 
-TMP_ROOT=$(fm_test_tmproot fm-send-settle)
+fm_test_tmproot_into TMP_ROOT fm-send-settle
 
 # A fake tmux that lets fm-send's submit path reach a clean "empty" verdict, plus a
 # fake sleep that records every requested duration (one per line) instead of
diff --git a/tests/fm-send-strict.test.sh b/tests/fm-send-strict.test.sh
index 1778abdb2f..7ea000a594 100755
--- a/tests/fm-send-strict.test.sh
+++ b/tests/fm-send-strict.test.sh
@@ -11,7 +11,7 @@ set -u
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 SEND="$ROOT/bin/fm-send.sh"
-TMP_ROOT=$(fm_test_tmproot fm-send-strict)
+fm_test_tmproot_into TMP_ROOT fm-send-strict
 
 # shellcheck source=bin/fm-account-routing-lib.sh
 . "$ROOT/bin/fm-account-routing-lib.sh"
diff --git a/tests/fm-session-start.test.sh b/tests/fm-session-start.test.sh
index 9b57519d67..448188df57 100755
--- a/tests/fm-session-start.test.sh
+++ b/tests/fm-session-start.test.sh
@@ -27,7 +27,7 @@ set -u
 
 SESSION_START="$ROOT/bin/fm-session-start.sh"
 BASE_PATH=${FM_TEST_BASE_PATH:-/usr/bin:/bin:/usr/sbin:/sbin}
-TMP_ROOT=$(fm_test_tmproot fm-session-start-tests)
+fm_test_tmproot_into TMP_ROOT fm-session-start-tests
 fm_git_identity fmtest fmtest@example.invalid
 
 # --- world builders ----------------------------------------------------------
diff --git a/tests/fm-spawn-batch.test.sh b/tests/fm-spawn-batch.test.sh
index 8557879385..d4722d911d 100755
--- a/tests/fm-spawn-batch.test.sh
+++ b/tests/fm-spawn-batch.test.sh
@@ -13,7 +13,7 @@ set -u
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 SPAWN="$ROOT/bin/fm-spawn.sh"
-TMP_ROOT=$(fm_test_tmproot fm-spawn-batch)
+fm_test_tmproot_into TMP_ROOT fm-spawn-batch
 export FM_BACKEND=tmux
 
 # Clear ambient firstmate overrides so the behavior test owns its environment.
diff --git a/tests/fm-spawn-dispatch-profile.test.sh b/tests/fm-spawn-dispatch-profile.test.sh
index 477e8b9541..7e9ae7b8b3 100755
--- a/tests/fm-spawn-dispatch-profile.test.sh
+++ b/tests/fm-spawn-dispatch-profile.test.sh
@@ -11,7 +11,7 @@ set -u
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 SPAWN="$ROOT/bin/fm-spawn.sh"
-TMP_ROOT=$(fm_test_tmproot fm-spawn-dispatch-profile)
+fm_test_tmproot_into TMP_ROOT fm-spawn-dispatch-profile
 
 make_spawn_fakebin() {
   local dir=$1 fakebin
@@ -20,7 +20,14 @@ make_spawn_fakebin() {
 #!/usr/bin/env bash
 set -u
 case "$*" in
-  *"#{pane_current_path}"*) printf '%s\n' "${FM_FAKE_PANE_PATH:-}"; exit 0 ;;
+  *"#{pane_current_path}"*)
+    if [ -s "${FM_FAKE_TREEHOUSE_CURRENT:-}" ]; then
+      cat "$FM_FAKE_TREEHOUSE_CURRENT"
+    else
+      printf '%s\n' "${FM_FAKE_PANE_PATH:-}"
+    fi
+    exit 0
+    ;;
 esac
 case "${1:-}" in
   display-message) printf 'firstmate\n'; exit 0 ;;
@@ -42,7 +49,60 @@ esac
 exit 0
 SH
   chmod +x "$fakebin/tmux"
-  fm_fake_exit0 "$fakebin" treehouse
+  cat > "$fakebin/treehouse" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "${1:-}" in
+  get)
+    shift
+    holder=
+    while [ "$#" -gt 0 ]; do
+      case "$1" in
+        --lease-holder) shift; holder=${1:-} ;;
+        --lease-holder=*) holder=${1#--lease-holder=} ;;
+      esac
+      shift
+    done
+    [ -n "$holder" ] || exit 2
+    pool=${FM_FAKE_TREEHOUSE_POOL:?}
+    target="$pool/$holder/project"
+    mkdir -p "$(dirname "$target")"
+    git -C "$PWD" worktree add --quiet --detach "$target" HEAD || exit 1
+    target=$(cd "$target" && pwd -P) || exit 1
+    python3 - "$pool/treehouse-state.json" "$target" "$holder" <<'PY'
+import json
+import os
+import sys
+
+state_path, target, holder = sys.argv[1:]
+os.makedirs(os.path.dirname(state_path), exist_ok=True)
+try:
+    with open(state_path, encoding="utf-8") as stream:
+        state = json.load(stream)
+except FileNotFoundError:
+    state = {"worktrees": []}
+state["worktrees"] = [
+    entry for entry in state.get("worktrees", []) if entry.get("path") != target
+]
+state["worktrees"].append(
+    {
+        "name": holder,
+        "path": target,
+        "leased": True,
+        "lease_holder": holder,
+    }
+)
+with open(state_path, "w", encoding="utf-8") as stream:
+    json.dump(state, stream)
+PY
+    printf '%s\n' "$target" > "${FM_FAKE_TREEHOUSE_CURRENT:?}"
+    printf '%s\n' "$target"
+    ;;
+  return) exit 0 ;;
+  *) exit 0 ;;
+esac
+SH
+  chmod +x "$fakebin/treehouse"
   printf '%s\n' "$fakebin"
 }
 
@@ -55,7 +115,7 @@ make_spawn_case() {
   wt="$case_dir/wt"
   launchlog="$case_dir/launch.log"
   fakebin=$(make_spawn_fakebin "$case_dir/fake")
-  mkdir -p "$home/data" "$home/projects" "$home/state" "$home/config"
+  mkdir -p "$home/data" "$home/projects" "$home/state" "$home/config" "$case_dir/treehouse-root"
   printf '%s\n' "$harness" > "$home/config/crew-harness"
   fm_git_worktree "$proj" "$wt" "wt-$name"
   touch "$home/state/.last-watcher-beat"
@@ -73,20 +133,35 @@ enable_dispatch_profile() {
 }
 
 make_seeded_secondmate_home() {
-  local home=$1 id=$2
-  mkdir -p "$home/bin" "$home/data"
-  printf '# Firstmate\n' > "$home/AGENTS.md"
+  local home=$1 id=$2 parent_home=$3 default source_origin target
+  default=$(git -C "$ROOT" symbolic-ref --quiet --short refs/remotes/origin/HEAD)
+  default=${default#origin/}
+  target=$(git -C "$ROOT" rev-parse "refs/heads/$default^{commit}")
+  source_origin=$(git -C "$ROOT" remote get-url origin)
+  git clone --quiet --no-checkout --single-branch --branch "$default" "$ROOT" "$home"
+  git -C "$home" checkout --quiet --detach "$target"
+  git -C "$home" remote set-url origin "$source_origin"
+  git -C "$home" update-ref "refs/remotes/origin/$default" "$target"
+  git -C "$home" symbolic-ref refs/remotes/origin/HEAD "refs/remotes/origin/$default"
+  mkdir -p "$home/config" "$home/data" "$home/projects" "$home/state"
   printf '%s\n' "$id" > "$home/.fm-secondmate-home"
   printf 'charter for %s\n' "$id" > "$home/data/charter.md"
+  printf '%s\n' '- '"$id"' - profile test (home: '"$home"'; scope: profile test; projects: ; added 2026-07-25)' \
+    > "$parent_home/data/secondmates.md"
 }
 
 run_spawn() {
-  local home=$1 wt=$2 fakebin=$3 launchlog=$4
+  local home=$1 wt=$2 fakebin=$3 launchlog=$4 case_dir
   shift 4
+  case_dir=${home%/home}
   : > "$launchlog"
   FM_ROOT_OVERRIDE='' FM_HOME="$home" \
     FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
     FM_PROJECTS_OVERRIDE="$home/projects" FM_CONFIG_OVERRIDE="$home/config" \
+    FM_CHECKOUT_REFRESH_STATE_BASE="$case_dir/checkout-state" \
+    FM_TREEHOUSE_ROOT="$case_dir/treehouse-root" \
+    FM_FAKE_TREEHOUSE_POOL="$case_dir/treehouse-root/profile" \
+    FM_FAKE_TREEHOUSE_CURRENT="$case_dir/acquired-worktree" \
     FM_SPAWN_NO_GUARD=1 FM_FAKE_PANE_PATH="$wt" TMUX="fake,1,0" \
     FM_FAKE_LAUNCH_LOG="$launchlog" GROK_HOME="$home/grok-home" PATH="$fakebin:$PATH" \
     "$SPAWN" "$@" 2>&1
@@ -113,7 +188,7 @@ test_no_profile_keeps_claude_launch_unchanged() {
 
   out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" "$id" "$PROJ_DIR")
   status=$?
-  expect_code 0 "$status" "claude spawn without profile flags should succeed"
+  expect_code 0 "$status" "claude spawn without profile flags should succeed: $out"
   assert_contains "$out" "spawned $id harness=claude" "spawn did not report claude"
   assert_meta_profile "$HOME_DIR/state/$id.meta" claude default default
 
@@ -372,7 +447,7 @@ test_active_dispatch_profile_does_not_block_secondmate_launch() {
   read_case_record "$rec"
   enable_dispatch_profile "$HOME_DIR"
   sm="$CASE_DIR/secondmate-home"
-  make_seeded_secondmate_home "$sm" "$id"
+  make_seeded_secondmate_home "$sm" "$id" "$HOME_DIR"
 
   out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" "$id" "$sm" --secondmate)
   status=$?
diff --git a/tests/fm-supervision-events.test.sh b/tests/fm-supervision-events.test.sh
index 787c3076ac..e2bc3f691d 100755
--- a/tests/fm-supervision-events.test.sh
+++ b/tests/fm-supervision-events.test.sh
@@ -11,7 +11,7 @@ set -u
 # shellcheck source=tests/lib.sh
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
-TMP=$(fm_test_tmproot fm-supervision-events)
+fm_test_tmproot_into TMP fm-supervision-events
 STATE_DIR="$TMP/state"
 mkdir -p "$STATE_DIR"
 
diff --git a/tests/fm-supervision-instructions.test.sh b/tests/fm-supervision-instructions.test.sh
index c1072063af..dd9b1361f9 100755
--- a/tests/fm-supervision-instructions.test.sh
+++ b/tests/fm-supervision-instructions.test.sh
@@ -5,7 +5,7 @@ set -u
 # shellcheck source=tests/lib.sh
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
-TMP_ROOT=$(fm_test_tmproot fm-supervision-instructions)
+fm_test_tmproot_into TMP_ROOT fm-supervision-instructions
 RENDER="$ROOT/bin/fm-supervision-instructions.sh"
 
 test_selected_harness_block_only() {
diff --git a/tests/fm-tangle-guard.test.sh b/tests/fm-tangle-guard.test.sh
index 6745f57b8d..81b985dfae 100755
--- a/tests/fm-tangle-guard.test.sh
+++ b/tests/fm-tangle-guard.test.sh
@@ -21,7 +21,7 @@ set -u
 # shellcheck source=bin/fm-tangle-lib.sh
 . "$ROOT/bin/fm-tangle-lib.sh"
 
-TMP_ROOT=$(fm_test_tmproot fm-tangle-guard)
+fm_test_tmproot_into TMP_ROOT fm-tangle-guard
 fm_git_identity fmtest fmtest@example.invalid
 
 # A fresh git repo on `main` with one commit. Echoes its path.
@@ -179,7 +179,7 @@ SH
 
 run_spawn() {
   local home=$1 id=$2 proj=$3 pane=$4 fakebin=$5
-  mkdir -p "$home/data/$id"
+  mkdir -p "$home/data/$id" "$home/treehouse-pools"
   printf 'brief\n' > "$home/data/$id/brief.md"
   FM_ROOT_OVERRIDE='' FM_HOME="$home" \
     FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
@@ -191,13 +191,35 @@ run_spawn() {
 }
 
 test_spawn_isolation_abort() {
-  local home proj fakebin out status
+  local home proj fakebin out status isolated state
   home="$TMP_ROOT/spawn-home"
-  mkdir -p "$home/data" "$home/treehouse-pools"
+  isolated="$home/treehouse-pools/project/1/spawn-wt"
+  state="$home/treehouse-pools/project/treehouse-state.json"
+  mkdir -p "$home/data" "$(dirname "$isolated")"
   proj=$(make_repo "$TMP_ROOT/spawn-proj")
   fakebin=$(make_spawn_fakebin "$TMP_ROOT/spawn-fake")
   # A genuine isolated linked worktree of the project, detached on the default.
-  git -C "$proj" worktree add -q --detach "$TMP_ROOT/spawn-wt" >/dev/null 2>&1
+  git -C "$proj" worktree add -q --detach "$isolated" >/dev/null 2>&1
+  python3 - "$state" "$isolated" <<'PY'
+import json
+import sys
+
+state, worktree = sys.argv[1:]
+with open(state, "w", encoding="utf-8") as stream:
+    json.dump(
+        {
+            "worktrees": [
+                {
+                    "name": "1",
+                    "path": worktree,
+                    "leased": True,
+                    "lease_holder": "firstmate-ok-isolated-ff6",
+                }
+            ]
+        },
+        stream,
+    )
+PY
   mkdir -p "$TMP_ROOT/spawn-notgit" "$proj/sub"
 
   # Abort: the pane resolves to a plain non-git directory (not a worktree at all).
@@ -212,7 +234,7 @@ test_spawn_isolation_abort() {
   assert_contains "$out" "did not yield an isolated worktree" "primary-checkout spawn lacked the isolation error"
 
   # Proceed: the pane resolves to a genuine, isolated worktree.
-  out=$(run_spawn "$home" ok-isolated-ff6 "$proj" "$TMP_ROOT/spawn-wt" "$fakebin"); status=$?
+  out=$(run_spawn "$home" ok-isolated-ff6 "$proj" "$isolated" "$fakebin"); status=$?
   expect_code 0 "$status" "spawn into a genuine isolated worktree should succeed"
   assert_contains "$out" "spawned ok-isolated-ff6" "isolated spawn did not report success"
   assert_not_contains "$out" "did not yield an isolated worktree" "isolated spawn wrongly tripped the guard"
@@ -264,7 +286,7 @@ SH
 
 run_spawn_record() {
   local home=$1 id=$2 proj=$3 pane=$4 fakebin=$5 rec=$6
-  mkdir -p "$home/data/$id"
+  mkdir -p "$home/data/$id" "$home/treehouse-pools"
   printf 'brief\n' > "$home/data/$id/brief.md"
   FM_ROOT_OVERRIDE='' FM_HOME="$home" \
     FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
@@ -277,18 +299,39 @@ run_spawn_record() {
 }
 
 test_spawn_tmux_window_construction() {
-  local home proj fakebin rec wt out status
+  local home proj fakebin rec wt out status state
   home="$TMP_ROOT/spawn-rec-home"
-  mkdir -p "$home/data" "$home/treehouse-pools"
+  wt="$home/treehouse-pools/project/1/spawn-rec-wt"
+  state="$home/treehouse-pools/project/treehouse-state.json"
+  mkdir -p "$home/data" "$(dirname "$wt")"
   proj=$(make_repo "$TMP_ROOT/spawn-rec-proj")
   fakebin=$(make_spawn_record_fakebin "$TMP_ROOT/spawn-rec-fake")
   rec="$TMP_ROOT/spawn-rec.log"
   : > "$rec"
-  wt="$TMP_ROOT/spawn-rec-wt"
   git -C "$proj" worktree add -q --detach "$wt" >/dev/null 2>&1
+  python3 - "$state" "$wt" <<'PY'
+import json
+import sys
+
+state, worktree = sys.argv[1:]
+with open(state, "w", encoding="utf-8") as stream:
+    json.dump(
+        {
+            "worktrees": [
+                {
+                    "name": "1",
+                    "path": worktree,
+                    "leased": True,
+                    "lease_holder": "firstmate-rec-win-gg7",
+                }
+            ]
+        },
+        stream,
+    )
+PY
 
   out=$(run_spawn_record "$home" rec-win-gg7 "$proj" "$wt" "$fakebin" "$rec"); status=$?
-  expect_code 0 "$status" "spawn into a genuine worktree should succeed"
+  expect_code 0 "$status" "spawn into a genuine worktree should succeed: $out"
   assert_contains "$out" "spawned rec-win-gg7" "recording spawn did not report success"
 
   # Bug 1 fix: append-form window creation (trailing colon on the session target).
diff --git a/tests/fm-teardown.test.sh b/tests/fm-teardown.test.sh
index 7210277be2..a8c8e62cb9 100755
--- a/tests/fm-teardown.test.sh
+++ b/tests/fm-teardown.test.sh
@@ -45,7 +45,7 @@
 #   (s) index.lock with a live holder, any age                -> lock kept, REFUSE
 #   (t) lsof error while checking index.lock                  -> lock kept, REFUSE
 #   (u) dirty worktree after stale lock cleanup               -> lock removed, REFUSE
-#   (v) non-linked repo index.lock                            -> lock removed, ALLOW
+#   (v) non-linked repo presented as a task worktree          -> lock kept, REFUSE
 #   (w) index.lock mtime read failure                         -> lock kept, REFUSE
 #   (x) transient lock cleared after first failed return      -> retry ALLOW
 #   (y) persistent lock (never clears, not provably stale)    -> REFUSE loudly
@@ -57,11 +57,13 @@ fm_git_identity fmtest fmtest@example.invalid
 
 TEARDOWN="$ROOT/bin/fm-teardown.sh"
 PR_CHECK="$ROOT/bin/fm-pr-check.sh"
-TMP_ROOT=$(fm_test_tmproot fm-teardown-tests)
+fm_test_tmproot_into TMP_ROOT fm-teardown-tests
 REAL_GIT_FOR_TEST=$(command -v git)
 export REAL_GIT_FOR_TEST
 REAL_STAT_FOR_TEST=$(command -v stat)
 export REAL_STAT_FOR_TEST
+REAL_PS_FOR_TEST=$(command -v ps)
+export REAL_PS_FOR_TEST
 
 write_treehouse_lease() {
   local worktree=$1 holder=$2 slot pool state
@@ -183,8 +185,10 @@ state="$(dirname "$0")/.tmux-live"
 case "${1:-}" in
   display-message)
     [ -f "$state" ] || exit 1
-    case " $* " in
-      *' #{pane_current_command} '*) printf '%s\n' bash ;;
+    case "$*" in
+      *pane_current_command*) printf 'bash\n' ;;
+      *session_name*window_name*) printf 'firstmate\tfm-task-x1\n' ;;
+      *) printf '%%1\n' ;;
     esac
     exit 0
     ;;
@@ -579,7 +583,7 @@ checkout_lock_path() {
   common=$(git -C "$dir" rev-parse --git-common-dir)
   case "$common" in /*) ;; *) common="$dir/$common" ;; esac
   common=$(cd "$common" && pwd -P)
-  key=$(printf '%s' "$common" | shasum -a 256 | awk '{print substr($1,1,24)}')
+  key=$(printf '%s' "$common" | tr '[:upper:]' '[:lower:]' | shasum -a 256 | awk '{print substr($1,1,24)}')
   printf '%s/%s.lock\n' "$lock_root" "$key"
 }
 
@@ -651,7 +655,8 @@ while [ "$#" -gt 0 ]; do
       ;;
   esac
 done
-if [ -n "$dir" ] && [ "${args[2]:-}" = status ] && [ "${args[3]:-}" = --porcelain ]; then
+if [ -n "$dir" ] && [ "${args[2]:-}" = status ]; then
+  case "${args[3]:-}" in --porcelain|--porcelain=v1) ;; *) exec "$real" "${args[@]}" ;; esac
   lock=$("$real" -C "$dir" rev-parse --git-path index.lock 2>/dev/null || true)
   case "$lock" in
     /*|'') ;;
@@ -1183,7 +1188,7 @@ test_content_in_default_fallback_allows() {
   common=$(git -C "$case_dir/wt" rev-parse --git-common-dir)
   case "$common" in /*) ;; *) common="$case_dir/wt/$common" ;; esac
   common=$(cd "$common" && pwd -P)
-  key=$(printf '%s' "$common" | shasum -a 256 | awk '{print substr($1,1,24)}')
+  key=$(printf '%s' "$common" | tr '[:upper:]' '[:lower:]' | shasum -a 256 | awk '{print substr($1,1,24)}')
   expected_lock="$case_dir/checkout-locks/$key.lock"
   lock_marker="$case_dir/checkout-return-held-lock"
 
@@ -1295,7 +1300,7 @@ test_content_fallback_honors_shared_checkout_lock() {
   common=$(git -C "$case_dir/wt" rev-parse --git-common-dir)
   case "$common" in /*) ;; *) common="$case_dir/wt/$common" ;; esac
   common=$(cd "$common" && pwd -P)
-  key=$(printf '%s' "$common" | shasum -a 256 | awk '{print substr($1,1,24)}')
+  key=$(printf '%s' "$common" | tr '[:upper:]' '[:lower:]' | shasum -a 256 | awk '{print substr($1,1,24)}')
   lock_root="$case_dir/checkout-locks"
   lock="$lock_root/$key.lock"
   mkdir -p "$lock"
@@ -1539,7 +1544,7 @@ test_stale_index_lock_cleanup_rechecks_dirty_worktree() {
 
   expect_code 1 "$rc" "stale-lock-dirty-recheck: teardown should refuse dirty work after clearing the stale lock"
   assert_grep "removed provably-stale git lock" "$case_dir/stderr" \
-    "stale-lock-dirty-recheck: teardown did not report clearing the stale lock"
+    "stale-lock-dirty-recheck: teardown did not report clearing the stale lock: $(cat "$case_dir/stderr")"
   assert_grep "uncommitted changes present" "$case_dir/stderr" \
     "stale-lock-dirty-recheck: teardown did not re-run the dirty check"
   assert_absent "$lock" "stale-lock-dirty-recheck: stale lock file should have been removed"
@@ -1547,7 +1552,7 @@ test_stale_index_lock_cleanup_rechecks_dirty_worktree() {
   pass "stale lock cleanup rechecks and refuses dirty worktree before return"
 }
 
-test_non_linked_index_lock_path_is_checked_from_worktree() {
+test_non_linked_repository_is_rejected_before_lock_cleanup() {
   local case_dir rc lock
   case_dir=$(make_case non-linked-index-lock)
   git -C "$case_dir/project" worktree remove --force "$case_dir/wt"
@@ -1572,11 +1577,14 @@ test_non_linked_index_lock_path_is_checked_from_worktree() {
   rc=$?
   set -e
 
-  expect_code 0 "$rc" "non-linked-index-lock: teardown should clear a normal repo index.lock"
-  assert_grep "removed provably-stale git lock" "$case_dir/stderr" \
-    "non-linked-index-lock: teardown did not report clearing the stale lock"
-  assert_absent "$lock" "non-linked-index-lock: stale lock file should have been removed"
-  pass "normal repo index.lock is resolved from the worktree and cleared when stale"
+  expect_code 1 "$rc" \
+    "non-linked-index-lock: teardown should reject a clone outside the recorded project's worktree graph"
+  assert_grep "does not belong to the recorded project" "$case_dir/stderr" \
+    "non-linked-index-lock: teardown did not report the repository-identity mismatch"
+  assert_not_contains "$(cat "$case_dir/stderr")" "removed provably-stale git lock" \
+    "non-linked-index-lock: teardown touched a lock outside the validated worktree graph"
+  [ -e "$lock" ] || fail "non-linked-index-lock: lock outside the validated worktree graph was removed"
+  pass "non-linked repositories are rejected before task lock cleanup"
 }
 
 test_index_lock_mtime_read_failure_refuses() {
@@ -1937,13 +1945,22 @@ test_managed_teardown_locks_generation_before_endpoint_cleanup() {
   cat > "$case_dir/fakebin/tmux" <<'SH'
 #!/usr/bin/env bash
 set -u
+state="$(dirname "$0")/.tmux-live"
 case "${1:-}" in
+  display-message)
+    [ -f "$state" ] || exit 1
+    case "$*" in
+      *pane_current_command*) printf 'claude\n' ;;
+      *session_name*window_name*) printf 'firstmate\tfm-task-x1\n' ;;
+      *) printf '%%1\n' ;;
+    esac
+    ;;
+  list-windows) [ ! -f "$state" ] || printf 'fm-task-x1\n' ;;
   kill-window)
     : > "$FM_FAKE_KILL_STARTED"
     while [ ! -f "$FM_FAKE_ALLOW_KILL" ]; do sleep 0.01; done
-    exit 0
+    rm -f "$state"
     ;;
-  display-message) exit 1 ;;
 esac
 exit 0
 SH
@@ -1953,11 +1970,16 @@ SH
     FM_FAKE_KILL_STARTED="$kill_started" FM_FAKE_ALLOW_KILL="$allow_kill" \
     run_teardown "$case_dir" --force > "$case_dir/stdout" 2> "$case_dir/stderr" &
   teardown_pid=$!
-  for _ in 1 2 3 4 5 6 7 8 9 10; do
+  for _ in $(seq 1 600); do
     [ -f "$kill_started" ] && break
+    kill -0 "$teardown_pid" 2>/dev/null || break
     sleep 0.05
   done
-  [ -f "$kill_started" ] || { kill "$teardown_pid" 2>/dev/null || true; fail "managed generation teardown never reached endpoint cleanup"; }
+  [ -f "$kill_started" ] || {
+    kill "$teardown_pid" 2>/dev/null || true
+    wait "$teardown_pid" 2>/dev/null || true
+    fail "managed generation teardown never reached endpoint cleanup: $(cat "$case_dir/stderr")"
+  }
 
   set +e
   FM_ACCOUNT_LIFECYCLE_LOCK_WAIT_SECONDS=0 bash -c '
@@ -2003,7 +2025,7 @@ test_managed_child_teardown_locks_generation_before_snapshot() {
     'window=fm-task-x1' \
     'tmux_session_target=firstmate:fm-task-x1' \
     "worktree=$case_dir/wt" \
-    "project=$case_dir/project" \
+    "project=$case_dir/wt" \
     'kind=secondmate' \
     'mode=secondmate' \
     "home=$case_dir/wt"
@@ -2030,20 +2052,39 @@ test_managed_child_teardown_locks_generation_before_snapshot() {
     'account_predecessor_cleanup=pending' \
     'provider_session_id=session-old'
   add_fake_agent_fleet "$case_dir"
+  : > "$case_dir/fakebin/.child-tmux-live"
   cat > "$case_dir/fakebin/tmux" <<'SH'
 #!/usr/bin/env bash
 set -u
+parent_state="$(dirname "$0")/.tmux-live"
+child_state="$(dirname "$0")/.child-tmux-live"
 case "${1:-}" in
+  display-message)
+    case "$*" in
+      *fm-child-lock-x3*) state=$child_state; label=fm-child-lock-x3 ;;
+      *) state=$parent_state; label=fm-task-x1 ;;
+    esac
+    [ -f "$state" ] || exit 1
+    case "$*" in
+      *pane_current_command*) printf 'claude\n' ;;
+      *session_name*window_name*) printf 'firstmate\t%s\n' "$label" ;;
+      *) printf '%%1\n' ;;
+    esac
+    ;;
+  list-windows)
+    [ ! -f "$parent_state" ] || printf 'fm-task-x1\n'
+    [ ! -f "$child_state" ] || printf 'fm-child-lock-x3\n'
+    ;;
   kill-window)
     case "$*" in
       *fm-child-lock-x3*)
         : > "$FM_FAKE_KILL_STARTED"
         while [ ! -f "$FM_FAKE_ALLOW_KILL" ]; do sleep 0.01; done
+        rm -f "$child_state"
         ;;
+      *) rm -f "$parent_state" ;;
     esac
-    exit 0
     ;;
-  display-message) exit 1 ;;
 esac
 exit 0
 SH
@@ -2056,12 +2097,14 @@ SH
     FM_EXPECT_CHILD_LINEAGE_MARKER="$case_dir/child-lineage-verified" \
     run_teardown "$case_dir" --force > "$case_dir/stdout" 2> "$case_dir/stderr" &
   teardown_pid=$!
-  for _ in $(seq 1 100); do
+  for _ in $(seq 1 600); do
     [ -f "$kill_started" ] && break
+    kill -0 "$teardown_pid" 2>/dev/null || break
     sleep 0.05
   done
   [ -f "$kill_started" ] || {
     kill "$teardown_pid" 2>/dev/null || true
+    wait "$teardown_pid" 2>/dev/null || true
     fail "managed child teardown never reached endpoint cleanup: $(cat "$case_dir/stderr")"
   }
 
@@ -2110,7 +2153,7 @@ test_forced_secondmate_child_uses_child_home_for_endpoint_verification() {
     'window=fm-task-x1' \
     'tmux_session_target=firstmate:fm-task-x1' \
     "worktree=$case_dir/wt" \
-    "project=$case_dir/project" \
+    "project=$case_dir/wt" \
     'kind=secondmate' \
     'mode=secondmate' \
     "home=$case_dir/wt"
@@ -2164,7 +2207,7 @@ SH
   assert_not_contains "$(cat "$af_log")" 'lease release' "live child endpoint allowed Agent Fleet release"
   assert_present "$case_dir/wt/state/$child_id.meta" "live child endpoint lost retry metadata"
   assert_present "$child_worktree/.git" "live child endpoint worktree was recycled"
-  assert_grep 'managed endpoint for child-zellij-x2 is still alive' "$case_dir/stderr" "child endpoint blocker was not reported"
+  assert_grep 'managed endpoint state for child-zellij-x2 is unknown' "$case_dir/stderr" "child endpoint blocker was not reported"
   pass "forced secondmate cleanup verifies managed children in the child home"
 }
 
@@ -2181,7 +2224,7 @@ test_forced_secondmate_quiesces_parent_before_child_cleanup() {
     'window=fm-task-x1' \
     'tmux_session_target=firstmate:fm-task-x1' \
     "worktree=$case_dir/wt" \
-    "project=$case_dir/project" \
+    "project=$case_dir/wt" \
     'kind=secondmate' \
     'mode=secondmate' \
     "home=$case_dir/wt"
@@ -2189,6 +2232,7 @@ test_forced_secondmate_quiesces_parent_before_child_cleanup() {
   write_treehouse_lease "$child_worktree" "firstmate-$child_id"
   fm_write_meta "$case_dir/wt/state/$child_id.meta" \
     "window=fm-$child_id" \
+    "tmux_session_target=firstmate:fm-$child_id" \
     "worktree=$child_worktree" \
     "project=$child_project" \
     'kind=ship' \
@@ -2198,8 +2242,15 @@ test_forced_secondmate_quiesces_parent_before_child_cleanup() {
 #!/usr/bin/env bash
 set -u
 case "${1:-}" in
-  display-message) [ -f "$FM_FAKE_PARENT_LIVE" ] ;;
-  list-panes) exit 0 ;;
+  display-message)
+    [ -f "$FM_FAKE_PARENT_LIVE" ] || exit 1
+    case "$*" in
+      *pane_current_command*) printf 'claude\n' ;;
+      *session_name*window_name*) printf 'firstmate\tfm-task-x1\n' ;;
+      *) printf '%%1\n' ;;
+    esac
+    ;;
+  list-windows) [ ! -f "$FM_FAKE_PARENT_LIVE" ] || printf 'fm-task-x1\n' ;;
   kill-window)
     case "$*" in
       *fm-task-x1*) rm -f "$FM_FAKE_PARENT_LIVE"; : > "$FM_FAKE_PARENT_QUIESCED" ;;
@@ -2233,7 +2284,7 @@ setup_forced_secondmate_child_case() {
     'window=fm-task-x1' \
     'tmux_session_target=firstmate:fm-task-x1' \
     "worktree=$FORCED_CHILD_CASE_DIR/wt" \
-    "project=$FORCED_CHILD_CASE_DIR/project" \
+    "project=$FORCED_CHILD_CASE_DIR/wt" \
     'kind=secondmate' \
     'mode=secondmate' \
     "home=$FORCED_CHILD_CASE_DIR/wt"
@@ -2241,6 +2292,7 @@ setup_forced_secondmate_child_case() {
   write_treehouse_lease "$FORCED_CHILD_WORKTREE" "firstmate-$child_id"
   fm_write_meta "$FORCED_CHILD_CASE_DIR/wt/state/$child_id.meta" \
     "window=fm-$child_id" \
+    "tmux_session_target=firstmate:fm-$child_id" \
     "worktree=$FORCED_CHILD_WORKTREE" \
     "project=$FORCED_CHILD_PROJECT" \
     'kind=ship' \
@@ -2249,8 +2301,15 @@ setup_forced_secondmate_child_case() {
   cat > "$FORCED_CHILD_CASE_DIR/fakebin/tmux" <<'SH'
 #!/usr/bin/env bash
 case "${1:-}" in
-  display-message) [ -f "$FM_FAKE_PARENT_LIVE" ]; exit $? ;;
-  list-panes) exit 0 ;;
+  display-message)
+    [ -f "$FM_FAKE_PARENT_LIVE" ] || exit 1
+    case "$*" in
+      *pane_current_command*) printf 'claude\n' ;;
+      *session_name*window_name*) printf 'firstmate\tfm-task-x1\n' ;;
+      *) printf '%%1\n' ;;
+    esac
+    ;;
+  list-windows) [ ! -f "$FM_FAKE_PARENT_LIVE" ] || printf 'fm-task-x1\n' ;;
   kill-window) rm -f "$FM_FAKE_PARENT_LIVE"; exit 0 ;;
 esac
 exit 0
@@ -2304,7 +2363,7 @@ SH
   rc=$?
   set -e
 
-  expect_code 17 "$rc" "forced secondmate cleanup should preserve the failed Treehouse return status"
+  expect_code 17 "$rc" "forced secondmate cleanup should preserve the failed Treehouse return status: $(cat "$case_dir/stderr")"
   assert_present "$child_pid_file" "failed Treehouse return did not start its descendant"
   child_pid=$(cat "$child_pid_file")
   ! kill -0 "$child_pid" 2>/dev/null \
@@ -2342,7 +2401,8 @@ exit 0
 SH
   cat > "$case_dir/fakebin/ps" <<'SH'
 #!/usr/bin/env bash
-exit 1
+[ ! -f "$TREEHOUSE_RETURN_CHILD_PID_FILE" ] || exit 1
+exec "$REAL_PS_FOR_TEST" "$@"
 SH
   chmod +x "$case_dir/fakebin/treehouse" "$case_dir/fakebin/ps"
 
@@ -2353,9 +2413,9 @@ SH
   rc=$?
   set -e
 
-  expect_code 76 "$rc" "unverified Treehouse process cleanup should fail distinctly"
+  expect_code 76 "$rc" "unverified Treehouse process cleanup should fail distinctly: $(cat "$case_dir/stderr")"
   assert_present "$child_pid_file" "unverified Treehouse return did not start its descendant"
-  assert_present "$lock" "unverified process cleanup released the checkout lock"
+  assert_present "$lock" "unverified process cleanup released expected checkout lock $lock: $(cat "$case_dir/stderr")"
   assert_present "$lock/process-group" "unverified process cleanup lost its guarded group identity"
   group=$(cat "$lock/process-group")
   anchor_state=$(ps -p "$group" -o pid= -o pgid= 2>/dev/null | awk '{$1=$1; print}')
@@ -2430,7 +2490,7 @@ test_forced_secondmate_retains_child_on_checkout_lock_contention() {
     'window=fm-task-x1' \
     'tmux_session_target=firstmate:fm-task-x1' \
     "worktree=$case_dir/wt" \
-    "project=$case_dir/project" \
+    "project=$case_dir/wt" \
     'kind=secondmate' \
     'mode=secondmate' \
     "home=$case_dir/wt"
@@ -2438,6 +2498,7 @@ test_forced_secondmate_retains_child_on_checkout_lock_contention() {
   write_treehouse_lease "$child_worktree" "firstmate-$child_id"
   fm_write_meta "$case_dir/wt/state/$child_id.meta" \
     "window=fm-$child_id" \
+    "tmux_session_target=firstmate:fm-$child_id" \
     "worktree=$child_worktree" \
     "project=$child_project" \
     'kind=ship' \
@@ -2450,8 +2511,15 @@ test_forced_secondmate_retains_child_on_checkout_lock_contention() {
   cat > "$case_dir/fakebin/tmux" <<'SH'
 #!/usr/bin/env bash
 case "${1:-}" in
-  display-message) [ -f "$FM_FAKE_PARENT_LIVE" ]; exit $? ;;
-  list-panes) exit 0 ;;
+  display-message)
+    [ -f "$FM_FAKE_PARENT_LIVE" ] || exit 1
+    case "$*" in
+      *pane_current_command*) printf 'claude\n' ;;
+      *session_name*window_name*) printf 'firstmate\tfm-task-x1\n' ;;
+      *) printf '%%1\n' ;;
+    esac
+    ;;
+  list-windows) [ ! -f "$FM_FAKE_PARENT_LIVE" ] || printf 'fm-task-x1\n' ;;
   kill-window) rm -f "$FM_FAKE_PARENT_LIVE"; exit 0 ;;
 esac
 exit 0
@@ -2464,7 +2532,7 @@ SH
   rc=$?
   set -e
 
-  expect_code 75 "$rc" "forced secondmate cleanup should surface checkout lock contention distinctly"
+  expect_code 75 "$rc" "forced secondmate cleanup should surface checkout lock contention distinctly: $(cat "$case_dir/stderr")"
   assert_present "$child_worktree" "checkout lock contention deleted the child worktree"
   assert_present "$case_dir/wt/state/$child_id.meta" "checkout lock contention removed child retry metadata"
   assert_present "$case_dir/state/task-x1.meta" "checkout lock contention removed parent retry metadata"
@@ -2484,6 +2552,9 @@ test_herdr_teardown_clears_escalation_marker() {
   printf '%s\n' 'backend=herdr' >> "$case_dir/state/task-x1.meta"
   cat > "$case_dir/fakebin/herdr" <<'SH'
 #!/usr/bin/env bash
+case "$*" in
+  'session list --json') printf '{"sessions":[]}\n' ;;
+esac
 exit 0
 SH
   chmod +x "$case_dir/fakebin/herdr"
@@ -2491,7 +2562,7 @@ SH
   : > "$marker"
 
   run_teardown "$case_dir" --force > "$case_dir/stdout" 2> "$case_dir/stderr" \
-    || fail "herdr-marker-cleanup: forced teardown failed"
+    || fail "herdr-marker-cleanup: forced teardown failed: $(cat "$case_dir/stderr")"
   [ ! -e "$marker" ] || fail "herdr-marker-cleanup: teardown left the pane's escalation marker behind"
   pass "herdr teardown removes pane-owned escalation dedupe state"
 }
@@ -2513,8 +2584,15 @@ test_required_report_blocks_then_publishes_before_cleanup() {
   cat > "$case_dir/fakebin/tmux" <<'SH'
 #!/usr/bin/env bash
 case "${1:-}" in
-  display-message) [ -f "$FM_FAKE_REPORT_LIVE" ]; exit $? ;;
-  list-panes) exit 0 ;;
+  display-message)
+    [ -f "$FM_FAKE_REPORT_LIVE" ] || exit 1
+    case "$*" in
+      *pane_current_command*) printf 'claude\n' ;;
+      *session_name*window_name*) printf 'firstmate\tfm-task-x1\n' ;;
+      *) printf '%%1\n' ;;
+    esac
+    ;;
+  list-windows) [ ! -f "$FM_FAKE_REPORT_LIVE" ] || printf 'fm-task-x1\n' ;;
   kill-window)
     if [ -f "$FM_FAKE_COMPLETION_PATH" ]; then
       printf '\nQuiesced final state.\n' >> "$FM_FAKE_COMPLETION_PATH"
@@ -2596,8 +2674,15 @@ test_required_report_restores_rollback_generation_before_publish() {
   cat > "$case_dir/fakebin/tmux" <<'SH'
 #!/usr/bin/env bash
 case "${1:-}" in
-  display-message) [ -f "$FM_FAKE_REPORT_LIVE" ]; exit $? ;;
-  list-panes) exit 0 ;;
+  display-message)
+    [ -f "$FM_FAKE_REPORT_LIVE" ] || exit 1
+    case "$*" in
+      *pane_current_command*) printf 'claude\n' ;;
+      *session_name*window_name*) printf 'firstmate\tfm-task-x1\n' ;;
+      *) printf '%%1\n' ;;
+    esac
+    ;;
+  list-windows) [ ! -f "$FM_FAKE_REPORT_LIVE" ] || printf 'fm-task-x1\n' ;;
   kill-window) rm -f "$FM_FAKE_REPORT_LIVE"; exit 0 ;;
 esac
 exit 0
@@ -2643,8 +2728,15 @@ test_required_report_revalidates_after_quiescence() {
   cat > "$case_dir/fakebin/tmux" <<'SH'
 #!/usr/bin/env bash
 case "${1:-}" in
-  display-message) [ -f "$FM_FAKE_REPORT_LIVE" ]; exit $? ;;
-  list-panes) exit 0 ;;
+  display-message)
+    [ -f "$FM_FAKE_REPORT_LIVE" ] || exit 1
+    case "$*" in
+      *pane_current_command*) printf 'claude\n' ;;
+      *session_name*window_name*) printf 'firstmate\tfm-task-x1\n' ;;
+      *) printf '%%1\n' ;;
+    esac
+    ;;
+  list-windows) [ ! -f "$FM_FAKE_REPORT_LIVE" ] || printf 'fm-task-x1\n' ;;
   kill-window)
     printf 'late work\n' > "$FM_FAKE_WORKTREE/late-work.txt"
     rm -f "$FM_FAKE_REPORT_LIVE"
@@ -2680,8 +2772,15 @@ test_legacy_teardown_revalidates_after_quiescence() {
   cat > "$case_dir/fakebin/tmux" <<'SH'
 #!/usr/bin/env bash
 case "${1:-}" in
-  display-message) [ -f "$FM_FAKE_REPORT_LIVE" ]; exit $? ;;
-  list-windows) exit 0 ;;
+  display-message)
+    [ -f "$FM_FAKE_REPORT_LIVE" ] || exit 1
+    case "$*" in
+      *pane_current_command*) printf 'claude\n' ;;
+      *session_name*window_name*) printf 'firstmate\tfm-task-x1\n' ;;
+      *) printf '%%1\n' ;;
+    esac
+    ;;
+  list-windows) [ ! -f "$FM_FAKE_REPORT_LIVE" ] || printf 'fm-task-x1\n' ;;
   kill-window)
     printf 'late work\n' > "$FM_FAKE_WORKTREE/late-work.txt"
     rm -f "$FM_FAKE_REPORT_LIVE"
@@ -2819,15 +2918,18 @@ SH
 }
 
 test_secondmate_rejects_drifted_home_repository_identity() {
-  local case_dir marker rc
+  local case_dir home_abs marker rc
   case_dir=$(make_case secondmate-home-identity-drift)
-  mkdir -p "$case_dir/wt/data" "$case_dir/wt/state" "$case_dir/wt/config" "$case_dir/wt/projects"
+  mkdir -p "$case_dir/data" "$case_dir/wt/data" "$case_dir/wt/state" "$case_dir/wt/config" "$case_dir/wt/projects"
   printf '%s\n' task-x1 > "$case_dir/wt/.fm-secondmate-home"
+  home_abs=$(cd "$case_dir/wt" && pwd -P)
+  printf '%s\n' "- task-x1 - test secondmate (home: $home_abs; scope: test; projects: test; added 2026-07-23)" \
+    > "$case_dir/data/secondmates.md"
   fm_write_meta "$case_dir/state/task-x1.meta" \
     'window=fm-task-x1' \
     'tmux_session_target=firstmate:fm-task-x1' \
     "worktree=$case_dir/wt" \
-    "project=$case_dir/project" \
+    "project=$case_dir/wt" \
     'kind=secondmate' \
     'mode=secondmate' \
     "home=$case_dir/wt"
@@ -2848,7 +2950,7 @@ SH
   assert_present "$case_dir/wt" "identity-drifted secondmate home was removed"
   assert_present "$case_dir/state/task-x1.meta" "identity-drifted secondmate metadata was removed"
   assert_grep "secondmate home repository identity does not match" "$case_dir/stderr" \
-    "secondmate home identity drift was not surfaced"
+    "secondmate home identity drift was not surfaced: $(cat "$case_dir/stderr")"
   pass "secondmate teardown proves its home repository identity"
 }
 
@@ -2861,7 +2963,7 @@ test_normal_secondmate_retires_proven_detached_head() {
     'window=fm-task-x1' \
     'tmux_session_target=firstmate:fm-task-x1' \
     "worktree=$case_dir/wt" \
-    "project=$case_dir/project" \
+    "project=$case_dir/wt" \
     'kind=secondmate' \
     'mode=secondmate' \
     "home=$case_dir/wt"
@@ -3000,7 +3102,7 @@ test_forced_secondmate_retains_unquiesced_unmanaged_child() {
     'window=fm-task-x1' \
     'tmux_session_target=firstmate:fm-task-x1' \
     "worktree=$case_dir/wt" \
-    "project=$case_dir/project" \
+    "project=$case_dir/wt" \
     'kind=secondmate' \
     'mode=secondmate' \
     "home=$case_dir/wt"
@@ -3027,11 +3129,15 @@ done
 case "${1:-}" in
   display-message)
     case "$target" in
-      *task-x1) [ -f "$FM_FAKE_PARENT_LIVE" ] ;;
-      *child-live-x9) [ -f "$FM_FAKE_CHILD_LIVE" ] ;;
+      *task-x1) [ -f "$FM_FAKE_PARENT_LIVE" ] || exit 1; label=fm-task-x1 ;;
+      *child-live-x9) [ -f "$FM_FAKE_CHILD_LIVE" ] || exit 1; label=fm-child-live-x9 ;;
       *) exit 1 ;;
     esac
-    exit $?
+    case "$*" in
+      *pane_current_command*) printf 'claude\n' ;;
+      *session_name*window_name*) printf 'firstmate\t%s\n' "$label" ;;
+      *) printf '%%1\n' ;;
+    esac
     ;;
   list-windows)
     [ -f "$FM_FAKE_PARENT_LIVE" ] && printf '%s\n' fm-task-x1
@@ -3455,7 +3561,7 @@ test_secondmate_retirement_recurses_into_ignored_nested_repositories() {
   assert_present "$nested/unlanded.txt" "unpushed submodule repository work was discarded"
   assert_present "$case_dir/state/task-x1.meta" "nested repository work allowed metadata removal"
   assert_grep 'not proven on a live remote branch' "$case_dir/stderr" \
-    "unlanded nested repository ref was not surfaced"
+    "unlanded nested repository ref was not surfaced: $(cat "$case_dir/stderr")"
   pass "secondmate retirement recursively proves submodule repositories"
 }
 
@@ -4168,12 +4274,10 @@ test_surviving_object_storage_is_bound_through_graph_proof() {
 }
 
 test_secondmate_retirement_serializes_child_spawn() {
-  local case_dir child_project rc teardown_pid spawn_rc waited
+  local case_dir rc teardown_pid spawn_rc waited
   case_dir=$(make_case secondmate-retirement-child-race)
   prepare_secondmate_home_fixture "$case_dir"
   write_secondmate_meta "$case_dir"
-  child_project="$case_dir/wt/projects/child-project"
-  fm_git_init_commit "$child_project"
   mkdir -p "$case_dir/wt/data/child"
   printf '%s\n' 'Do bounded child work.' > "$case_dir/wt/data/child/brief.md"
   cat > "$case_dir/fakebin/tmux" <<'SH'
@@ -4182,7 +4286,14 @@ state="$(dirname "$0")/.tmux-live"
 started="$(dirname "$0")/.retirement-started"
 release="$(dirname "$0")/.retirement-release"
 case "${1:-}" in
-  display-message) [ -f "$state" ]; exit $? ;;
+  display-message)
+    [ -f "$state" ] || exit 1
+    case "$*" in
+      *pane_current_command*) printf 'claude\n' ;;
+      *session_name*window_name*) printf 'firstmate\tfm-task-x1\n' ;;
+      *) printf '%%1\n' ;;
+    esac
+    ;;
   list-windows) [ ! -f "$state" ] || printf '%s\n' fm-task-x1; exit 0 ;;
   kill-window)
     : > "$started"
@@ -4197,14 +4308,15 @@ SH
   run_teardown "$case_dir" --force > "$case_dir/stdout" 2> "$case_dir/stderr" &
   teardown_pid=$!
   waited=0
-  while [ ! -f "$case_dir/fakebin/.retirement-started" ] && [ "$waited" -lt 200 ]; do
+  while [ ! -f "$case_dir/fakebin/.retirement-started" ] && [ "$waited" -lt 600 ]; do
+    kill -0 "$teardown_pid" 2>/dev/null || break
     sleep 0.05
     waited=$((waited + 1))
   done
   [ -f "$case_dir/fakebin/.retirement-started" ] || {
     : > "$case_dir/fakebin/.retirement-release"
     wait "$teardown_pid" || true
-    fail "secondmate retirement did not reach the serialized quiescence boundary"
+    fail "secondmate retirement did not reach the serialized quiescence boundary: $(cat "$case_dir/stderr")"
   }
   set +e
   FM_HOME="$case_dir/wt" \
@@ -4213,7 +4325,7 @@ SH
   FM_ACCOUNT_LIFECYCLE_LOCK_WAIT_SECONDS=0 \
   FM_SPAWN_NO_GUARD=1 \
   PATH="$case_dir/fakebin:$PATH" \
-    "$ROOT/bin/fm-spawn.sh" child child-project claude \
+    "$ROOT/bin/fm-spawn.sh" child test claude \
       > "$case_dir/spawn-stdout" 2> "$case_dir/spawn-stderr"
   spawn_rc=$?
   set -e
@@ -4419,6 +4531,28 @@ if [ "${FM_TEST_FOCUSED:-}" = review-round-10-treehouse-return ]; then
   exit 0
 fi
 
+if [ "${FM_TEST_FOCUSED:-}" = child-return-unverified ]; then
+  test_forced_secondmate_retains_unverified_process_group
+  exit 0
+fi
+
+if [ "${FM_TEST_FOCUSED:-}" = herdr-marker ]; then
+  test_herdr_teardown_clears_escalation_marker
+  exit 0
+fi
+
+if [ "${FM_TEST_FOCUSED:-}" = report-lifecycle ]; then
+  test_required_report_blocks_then_publishes_before_cleanup
+  test_required_report_restores_rollback_generation_before_publish
+  test_required_report_revalidates_after_quiescence
+  exit 0
+fi
+
+if [ "${FM_TEST_FOCUSED:-}" = nested-repository ]; then
+  test_secondmate_retirement_recurses_into_ignored_nested_repositories
+  exit 0
+fi
+
 if [ "${FM_TEST_FOCUSED:-}" = review-round-11-process-group ]; then
   test_forced_secondmate_retains_child_on_treehouse_failure
   test_treehouse_return_timeout_reaps_children_before_unlock
@@ -4591,7 +4725,7 @@ test_stale_index_lock_cleared_and_teardown_succeeds
 test_live_index_lock_is_never_removed_and_teardown_refuses
 test_lsof_error_never_clears_index_lock
 test_stale_index_lock_cleanup_rechecks_dirty_worktree
-test_non_linked_index_lock_path_is_checked_from_worktree
+test_non_linked_repository_is_rejected_before_lock_cleanup
 test_index_lock_mtime_read_failure_refuses
 test_transient_index_lock_clears_after_first_attempt_and_retry_succeeds
 test_persistent_index_lock_exhausts_retries_and_refuses_loudly
diff --git a/tests/fm-turnend-guard.test.sh b/tests/fm-turnend-guard.test.sh
index 76048d951b..58e615c197 100755
--- a/tests/fm-turnend-guard.test.sh
+++ b/tests/fm-turnend-guard.test.sh
@@ -16,7 +16,7 @@ set -u
 # shellcheck source=bin/fm-supervision-lib.sh
 . "$ROOT/bin/fm-supervision-lib.sh"
 
-TMP_ROOT=$(fm_test_tmproot fm-turnend-guard)
+fm_test_tmproot_into TMP_ROOT fm-turnend-guard
 fm_git_identity fmtest fmtest@example.invalid
 
 REQUIRED_REASON='resume supervision with bin/fm-watch-arm.sh as its own Claude Code background task'
diff --git a/tests/fm-update.test.sh b/tests/fm-update.test.sh
index 14628e3039..58c00fa583 100755
--- a/tests/fm-update.test.sh
+++ b/tests/fm-update.test.sh
@@ -27,7 +27,7 @@ UPDATE="$ROOT/bin/fm-update.sh"
 # Deterministic, isolated git identity for fixture commits.
 fm_git_identity fmtest fmtest@example.com
 
-TMP_ROOT=$(fm_test_tmproot fm-update-tests)
+fm_test_tmproot_into TMP_ROOT fm-update-tests
 
 # Build a fresh world: a bare origin seeded with one commit, a firstmate repo
 # clone checked out on main, and a home dir with state/ and data/. Echoes the
diff --git a/tests/fm-wake-daemon-lifecycle-e2e.test.sh b/tests/fm-wake-daemon-lifecycle-e2e.test.sh
index e027dca962..24063dd263 100755
--- a/tests/fm-wake-daemon-lifecycle-e2e.test.sh
+++ b/tests/fm-wake-daemon-lifecycle-e2e.test.sh
@@ -31,7 +31,7 @@ if [ -z "${FM_TEST_DAEMON_SOURCED:-}" ]; then
   . "$DAEMON"
 fi
 
-TMP_ROOT=$(fm_test_tmproot fm-wake-daemon-e2e)
+fm_test_tmproot_into TMP_ROOT fm-wake-daemon-e2e
 
 # Run the daemon-managed watcher once: under the supervise-daemon (away mode) the
 # watcher is one-shot - it exits with a single reason line on EVERY wake and the
diff --git a/tests/fm-wake-queue.test.sh b/tests/fm-wake-queue.test.sh
index ee2c6eff7d..d15bcae78a 100755
--- a/tests/fm-wake-queue.test.sh
+++ b/tests/fm-wake-queue.test.sh
@@ -14,7 +14,7 @@ set -u
 WATCH="$ROOT/bin/fm-watch.sh"
 DRAIN="$ROOT/bin/fm-wake-drain.sh"
 
-TMP_ROOT=$(fm_test_tmproot fm-wake-tests)
+fm_test_tmproot_into TMP_ROOT fm-wake-tests
 
 
 test_concurrent_append_and_drain() {
diff --git a/tests/fm-watch-checkpoint.test.sh b/tests/fm-watch-checkpoint.test.sh
index a9a7f70026..1b0f1efd7f 100755
--- a/tests/fm-watch-checkpoint.test.sh
+++ b/tests/fm-watch-checkpoint.test.sh
@@ -6,13 +6,17 @@ set -u
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 CHECKPOINT="$ROOT/bin/fm-watch-checkpoint.sh"
-TMP_ROOT=$(fm_test_tmproot fm-watch-checkpoint)
+fm_test_tmproot_into TMP_ROOT fm-watch-checkpoint
 
 make_home() {
   local name=$1 home
   home="$TMP_ROOT/$name"
   mkdir -p "$home/state" "$home/data" "$home/config"
-  touch "$home/state/.last-account-session-sync" "$home/state/.last-report-retention"
+  # Keep this checkpoint fixture isolated from the machine-global report stack
+  # and account-session reconciliation. Those slow cadences are covered by
+  # their own suites; a foreground checkpoint must begin at signal polling.
+  touch "$home/state/.last-report-retention" \
+    "$home/state/.last-account-session-sync"
   printf '%s\n' "$home"
 }
 
@@ -25,7 +29,8 @@ test_quiet_checkpoint_exits_124_cleanly() {
   FM_HOME="$home" FM_POLL=1 FM_SIGNAL_GRACE=1 FM_CHECK_INTERVAL=999999 "$CHECKPOINT" --seconds 1 >"$out" 2>"$err" || status=$?
   expect_code 124 "$status" "quiet checkpoint exit"
   assert_contains "$(cat "$out")" "checkpoint: no actionable wake within 1s" "quiet checkpoint line missing"
-  assert_absent "$home/state/.watch.lock/pid" "watch lock pid survived quiet checkpoint timeout"
+  assert_absent "$home/state/.watch.lock/pid" \
+    "watch lock pid survived quiet checkpoint timeout: out=$(cat "$out"); err=$(cat "$err")"
   pass "quiet checkpoint exits 124 with a clean checkpoint line and no live lock"
 }
 
@@ -39,8 +44,11 @@ test_signal_passes_through_and_exits_zero() {
     printf 'done: synthetic wake\n' > "$home/state/demo.status"
   ) &
   status=0
-  FM_HOME="$home" FM_POLL=1 FM_SIGNAL_GRACE=1 FM_CHECK_INTERVAL=999999 "$CHECKPOINT" --seconds 8 >"$out" 2>"$err" || status=$?
-  expect_code 0 "$status" "signal checkpoint exit"
+  # Startup and the first poll can contend with other Behavior jobs on CI; the
+  # assertion is signal delivery, so give that observable path a bounded 20s.
+  FM_HOME="$home" FM_POLL=1 FM_SIGNAL_GRACE=1 FM_CHECK_INTERVAL=999999 "$CHECKPOINT" --seconds 20 >"$out" 2>"$err" || status=$?
+  expect_code 0 "$status" \
+    "signal checkpoint exit: out=$(cat "$out"); err=$(cat "$err")"
   assert_contains "$(cat "$out")" "signal:" "signal wake was not passed through"
   drained=$(FM_HOME="$home" "$ROOT/bin/fm-wake-drain.sh")
   assert_contains "$drained" $'\tsignal\tdemo.status\t' "signal wake was not queued durably"
diff --git a/tests/fm-watch-triage.test.sh b/tests/fm-watch-triage.test.sh
index 7a08ea3ab2..9c974135ab 100755
--- a/tests/fm-watch-triage.test.sh
+++ b/tests/fm-watch-triage.test.sh
@@ -28,7 +28,7 @@ set -u
 WATCH="$ROOT/bin/fm-watch.sh"
 DRAIN="$ROOT/bin/fm-wake-drain.sh"
 
-TMP_ROOT=$(fm_test_tmproot fm-watch-triage-tests)
+fm_test_tmproot_into TMP_ROOT fm-watch-triage-tests
 
 # Common watcher knobs: tight poll/grace, no check or heartbeat cadence unless a
 # test overrides them, so a test only exercises the path it targets. FM_CREW_STATE_BIN
@@ -1452,7 +1452,8 @@ test_afk_paused_changed_pane_hands_off_plain_stale() {
     FM_STATE_OVERRIDE="$state" FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_PAUSE_RESURFACE_SECS=240 FM_POLL=1 FM_SIGNAL_GRACE=1 \
     FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
   pid=$!
-  wait_for_exit "$pid" 40 || fail "AFK paused changed pane did not hand off a stale wake"
+  wait_for_exit "$pid" 120 || fail \
+    "AFK paused changed pane did not hand off a stale wake: count=$(cat "$state/.count-$key" 2>/dev/null || true), output=$(cat "$out")"
   grep -Fx "stale: $window" "$out" >/dev/null || fail "AFK paused stale did not preserve its plain window identity: $(cat "$out")"
   grep -F "awaiting external" "$out" >/dev/null && fail "AFK watcher decorated a stale identity instead of handing it to the daemon"
   [ ! -e "$state/.paused-$key" ] || fail "AFK watcher recorded normal-mode pause tracking instead of handing off"
@@ -1472,6 +1473,7 @@ test_account_session_sync_is_bounded_and_cadenced() {
   task_timeout_file="$dir/account-session-sync-task.timeout"
   elapsed_file="$dir/account-session-sync.elapsed"
   sync_cadence_file="$state/.last-account-session-sync"
+  rm -f "$sync_cadence_file"
   mkdir -p "$fake_root/bin"
 cat > "$sync_bin" <<'SH'
 #!/usr/bin/env bash
diff --git a/tests/fm-watcher-lock.test.sh b/tests/fm-watcher-lock.test.sh
index d46e3fa208..a37752d908 100755
--- a/tests/fm-watcher-lock.test.sh
+++ b/tests/fm-watcher-lock.test.sh
@@ -13,7 +13,7 @@ WATCH_ARM="$ROOT/bin/fm-watch-arm.sh"
 DRAIN="$ROOT/bin/fm-wake-drain.sh"
 LIB="$ROOT/bin/fm-wake-lib.sh"
 
-TMP_ROOT=$(fm_test_tmproot fm-watcher-lock-tests)
+fm_test_tmproot_into TMP_ROOT fm-watcher-lock-tests
 
 
 test_singleton_start() {
diff --git a/tests/fm-x-mode.test.sh b/tests/fm-x-mode.test.sh
index 4c64377220..9543314bbf 100755
--- a/tests/fm-x-mode.test.sh
+++ b/tests/fm-x-mode.test.sh
@@ -19,7 +19,7 @@ BASE_PATH=${FM_TEST_BASE_PATH:-/usr/bin:/bin:/usr/sbin:/sbin}
 # not include. Prepended after the fakebin so the fake curl still wins.
 JQ_DIR=$(command -v jq 2>/dev/null) && JQ_DIR=$(dirname "$JQ_DIR") || JQ_DIR=
 [ -n "$JQ_DIR" ] && BASE_PATH="$JQ_DIR:$BASE_PATH"
-TMP_ROOT=$(fm_test_tmproot fm-x-mode-tests)
+fm_test_tmproot_into TMP_ROOT fm-x-mode-tests
 
 # A fakebin `curl` that mimics the relay: it reads its behavior from env
 # (FAKE_POLL_CODE/FAKE_POLL_BODY/FAKE_ANSWER_CODE, and
diff --git a/tests/secondmate-helpers.sh b/tests/secondmate-helpers.sh
index 3dd0981cb9..13b82b3b31 100644
--- a/tests/secondmate-helpers.sh
+++ b/tests/secondmate-helpers.sh
@@ -39,21 +39,32 @@ case "${1:-}" in
     ;;
   list-windows)
     if [ -n "${FM_FAKE_TMUX_WINDOW:-}" ]; then
-      printf '%s\n' "$FM_FAKE_TMUX_WINDOW"
+      if [ ! -f "$FM_FAKE_TMUX_LOG.killed" ] \
+        || ! grep -Eq ":${FM_FAKE_TMUX_WINDOW}$" "$FM_FAKE_TMUX_LOG.killed"; then
+        printf '%s\n' "$FM_FAKE_TMUX_WINDOW"
+      fi
     fi
     exit 0
     ;;
   display-message)
-    target=
+    target= format=
     prev=
     for arg in "$@"; do
       [ "$prev" = -t ] && target=$arg
       prev=$arg
+      format=$arg
     done
     if [ -n "$target" ] && [ -f "$FM_FAKE_TMUX_LOG.killed" ] && grep -qxF "$target" "$FM_FAKE_TMUX_LOG.killed"; then
       exit 1
     fi
-    printf 'firstmate\n'
+    case "$format" in
+      *session_name*window_name*)
+        printf '%s\t%s\n' "${target%%:*}" "${target#*:}"
+        ;;
+      *pane_current_command*) printf 'bash\n' ;;
+      *pane_id*) printf '%%1\n' ;;
+      *) printf 'firstmate\n' ;;
+    esac
     exit 0
     ;;
   list-panes)
@@ -179,13 +190,14 @@ make_firstmate_git_root() {
   local home=$1
   mkdir -p "$home/bin"
   printf '# Firstmate\n' > "$home/AGENTS.md"
+  printf '%s\n' '.fm-secondmate-home' 'config/' 'data/' 'projects/' 'state/' > "$home/.gitignore"
   cat > "$home/bin/fm-guard.sh" <<'SH'
 #!/usr/bin/env bash
 exit 0
 SH
   chmod +x "$home/bin/fm-guard.sh"
   git -C "$home" init -q
-  git -C "$home" add AGENTS.md bin/fm-guard.sh
+  git -C "$home" add .gitignore AGENTS.md bin/fm-guard.sh
   git -C "$home" -c user.name='Firstmate Tests' -c user.email='tests@example.invalid' commit -qm initial
 }
 
diff --git a/tests/wake-helpers.sh b/tests/wake-helpers.sh
index 2425be4a2c..35fe3eb990 100644
--- a/tests/wake-helpers.sh
+++ b/tests/wake-helpers.sh
@@ -16,7 +16,7 @@
 # direct fm-guard.sh tests use. A per-call FM_ROOT_OVERRIDE still wins where a
 # suite sets its own (e.g. the watcher-lock guard-banner cases).
 if [ -z "${FM_ROOT_OVERRIDE:-}" ]; then
-  FM_ROOT_OVERRIDE="$(fm_test_tmproot fm-wake-tangle-root)"
+  fm_test_tmproot_into FM_ROOT_OVERRIDE fm-wake-tangle-root
   export FM_ROOT_OVERRIDE
 fi
 
@@ -32,13 +32,10 @@ fi
 # that channel, to exercise graceful degradation. Suites that do not source this
 # harness still cannot fire a real notification: the daemon defaults the seam to
 # "discard" whenever it is sourced (its library-mode guard).
-# Create the recorder dir with mktemp directly (not fm_test_tmproot, whose
-# first call installs an EXIT trap that, invoked inside a command-substitution
-# subshell, would delete the dir on subshell exit). Register it for the same
-# cleanup and install the trap in THIS shell if it is the first registration.
-_fm_wedge_rec_dir=$(mktemp -d "${TMPDIR:-/tmp}/fm-wedge-rec.XXXXXX")
-if [ "${#FM_TEST_CLEANUP_DIRS[@]}" -eq 0 ]; then trap fm_test_cleanup EXIT; fi
-FM_TEST_CLEANUP_DIRS+=("$_fm_wedge_rec_dir")
+# Create and register the recorder directory in this shell so it shares the
+# suite's run-owned cleanup lifecycle.
+_fm_wedge_rec_dir=
+fm_test_tmproot_into _fm_wedge_rec_dir fm-wedge-rec
 cat > "$_fm_wedge_rec_dir/rec" <<'REC'
 #!/usr/bin/env bash
 printf '%s\t%s\n' "${1:-}" "${2:-}" >> "${FM_WEDGE_ALARM_LOG:-/dev/null}"
@@ -64,6 +61,11 @@ make_case() {
   dir="$TMP_ROOT/$name"
   fakebin="$dir/fakebin"
   mkdir -p "$dir/state" "$fakebin"
+  # Behavioral watcher fixtures should not enter machine-global maintenance
+  # before reaching the signal/stale path they own. Cadence-owner tests remove
+  # their marker explicitly when they need to exercise a due sweep.
+  touch "$dir/state/.last-report-retention" \
+    "$dir/state/.last-account-session-sync"
   cat > "$fakebin/tmux" <<'SH'
 #!/usr/bin/env bash
 set -u

From 718d5ee13f7f18a4c2a01c26eeef9fb563a8c438 Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Sun, 26 Jul 2026 08:42:36 -0400
Subject: [PATCH 02/34] no-mistakes(review): Make task temp roots
 generation-unique

---
 bin/fm-account-routing-lib.sh    | 54 +++++++++++++++++++++++++-------
 bin/fm-spawn.sh                  | 42 ++++++++++++++-----------
 bin/fm-teardown.sh               | 16 +++++-----
 tests/fm-account-routing.test.sh |  8 +++--
 4 files changed, 79 insertions(+), 41 deletions(-)

diff --git a/bin/fm-account-routing-lib.sh b/bin/fm-account-routing-lib.sh
index 565e3b9f68..8a6f79ceeb 100644
--- a/bin/fm-account-routing-lib.sh
+++ b/bin/fm-account-routing-lib.sh
@@ -236,7 +236,34 @@ fm_account_real_directory() {
   [ -d "$1" ] && [ ! -L "$1" ]
 }
 
-fm_account_task_tmp_path() {  # <task-id>
+fm_account_task_tmp_path() {  # <task-id> <generation-id>
+  local task=$1 generation=$2 token state
+  fm_account_valid_id "$task" || return 1
+  case "$generation" in
+    spawn:*|account:*)
+      token=${generation##*:}
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+  fm_account_valid_id "$token" || return 1
+  if [ -n "${STATE:-}" ]; then
+    state=$STATE
+  elif [ -n "${FM_STATE_OVERRIDE:-}" ]; then
+    state=$FM_STATE_OVERRIDE
+  elif [ -n "${FM_HOME:-}" ]; then
+    state=$FM_HOME/state
+  else
+    return 1
+  fi
+  fm_account_real_directory "$state" || return 1
+  state=$(cd "$state" 2>/dev/null && pwd -P) || return 1
+  [ "$state" != / ] || return 1
+  printf '%s/.task-tmp/fm-%s-%s\n' "${state%/}" "$task" "$token"
+}
+
+fm_account_previous_task_tmp_path() {  # <task-id>
   local task=$1 state
   fm_account_valid_id "$task" || return 1
   if [ -n "${STATE:-}" ]; then
@@ -251,9 +278,6 @@ fm_account_task_tmp_path() {  # <task-id>
   fm_account_real_directory "$state" || return 1
   state=$(cd "$state" 2>/dev/null && pwd -P) || return 1
   [ "$state" != / ] || return 1
-  # The physical task-state directory is the run identity. Nesting the temp
-  # root under it prevents cross-home and cross-test collisions, and makes a
-  # suite's ordinary run-root cleanup own task temp even after an early abort.
   printf '%s/.task-tmp/fm-%s\n' "${state%/}" "$task"
 }
 
@@ -262,22 +286,29 @@ fm_account_legacy_task_tmp_path() {  # <task-id>
   printf '/tmp/fm-%s\n' "$1"
 }
 
-fm_account_task_tmp_is_current() {  # <task-id> <path>
+fm_account_task_tmp_is_current() {  # <task-id> <path> <generation-id>
   local expected
-  expected=$(fm_account_task_tmp_path "$1") || return 1
+  expected=$(fm_account_task_tmp_path "$1" "$3") || return 1
   [ "$2" = "$expected" ]
 }
 
+fm_account_task_tmp_is_previous() {  # <task-id> <path>
+  local previous
+  previous=$(fm_account_previous_task_tmp_path "$1") || return 1
+  [ "$2" = "$previous" ]
+}
+
 fm_account_task_tmp_is_legacy() {  # <task-id> <path>
   local legacy
   legacy=$(fm_account_legacy_task_tmp_path "$1") || return 1
   [ "$2" = "$legacy" ]
 }
 
-fm_account_task_tmp_is_expected() {  # <task-id> <path>
+fm_account_task_tmp_is_expected() {  # <task-id> <path> <generation-id>
   # Legacy metadata remains recognizable, but callers must use
   # fm_account_task_tmp_is_current before any filesystem mutation.
-  fm_account_task_tmp_is_current "$1" "$2" \
+  fm_account_task_tmp_is_current "$1" "$2" "$3" \
+    || fm_account_task_tmp_is_previous "$1" "$2" \
     || fm_account_task_tmp_is_legacy "$1" "$2"
 }
 
@@ -1240,7 +1271,7 @@ fm_account_meta_value() {  # <meta> <key>
 }
 
 fm_account_restore_artifacts() {
-  local state=$1 task=$2 backup_name=$3 tasktmp=${4:-} retain=${5:-0} backup name source
+  local state=$1 task=$2 backup_name=$3 tasktmp=${4:-} retain=${5:-0} generation=${6:-} backup name source
   local PATH=$FM_ACCOUNT_SYSTEM_PATH
   [ -n "$backup_name" ] || return 0
   case "$backup_name" in
@@ -1258,7 +1289,8 @@ fm_account_restore_artifacts() {
     fi
   done
   if [ -n "$tasktmp" ]; then
-    if fm_account_task_tmp_is_current "$task" "$tasktmp"; then
+    if fm_account_task_tmp_is_current "$task" "$tasktmp" "$generation" \
+      || fm_account_task_tmp_is_previous "$task" "$tasktmp"; then
       if [ -e "$backup/tasktmp-existed" ]; then
         [ -e "$backup/gotmp-existed" ] || fm_account_system_exec "$FM_ACCOUNT_SYSTEM_RM_BIN" -rf "$tasktmp/gotmp" || return 1
       else
@@ -1339,7 +1371,7 @@ fm_account_cleanup_rollback() {  # <meta> <data-dir> <task>
   if [ "$preserve" != 1 ]; then
     fm_account_session_remove "$account_task" || return 1
   fi
-  fm_account_restore_artifacts "$(fm_account_system_exec "$FM_ACCOUNT_SYSTEM_DIRNAME_BIN" "$meta")" "$task" "$artifacts_name" "$tasktmp" 1 || return 1
+  fm_account_restore_artifacts "$(fm_account_system_exec "$FM_ACCOUNT_SYSTEM_DIRNAME_BIN" "$meta")" "$task" "$artifacts_name" "$tasktmp" 1 "$(fm_account_meta_value "$meta" generation_id)" || return 1
   lock=$(fm_account_meta_lock_acquire "$(fm_account_system_exec "$FM_ACCOUNT_SYSTEM_DIRNAME_BIN" "$meta")" "$task") || return 1
   if [ ! -f "$meta" ] \
     || [ "$(fm_account_meta_value "$meta" account_task)" != "$account_task" ] \
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 67b9c2a5fa..1ab80ac402 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -602,7 +602,7 @@ reconcile_failed_direct_recovery() {
     echo "error: retained direct recovery artifacts are missing or unsafe for $task" >&2
     return 1
   fi
-  if ! fm_account_task_tmp_is_expected "$task" "$tasktmp" \
+  if ! fm_account_task_tmp_is_expected "$task" "$tasktmp" "$generation" \
     || [ -z "$generation" ] || [ -z "$target" ]; then
     fm_account_meta_lock_release "$lock" >/dev/null 2>&1 || true
     echo "error: retained direct recovery metadata is incomplete for $task" >&2
@@ -640,7 +640,7 @@ reconcile_failed_direct_recovery() {
     echo "error: retained direct recovery generation changed before cleanup for $task" >&2
     return 1
   fi
-  if ! fm_account_restore_artifacts "$STATE" "$task" "$artifacts_name" "$tasktmp" 1; then
+  if ! fm_account_restore_artifacts "$STATE" "$task" "$artifacts_name" "$tasktmp" 1 "$generation"; then
     fm_account_meta_lock_release "$lock" >/dev/null 2>&1 || true
     echo "error: retained direct recovery artifacts could not be restored for $task" >&2
     return 1
@@ -865,10 +865,11 @@ if [ "$RECOVERY_ACCOUNT" = 1 ]; then
     rollback_tab=$(fm_account_meta_value "$RESUME_META" zellij_tab_id)
     rollback_home=$(fm_account_meta_value "$RESUME_META" home)
     rollback_tasktmp=$(fm_account_meta_value "$RESUME_META" tasktmp)
+    rollback_generation=$(fm_account_meta_value "$RESUME_META" generation_id)
     rollback_backup=$(fm_account_meta_value "$RESUME_META" account_rollback_backup)
     fm_account_meta_lock_release "$rollback_meta_lock" || exit 1
     rollback_meta_lock=
-    if [ -n "$rollback_tasktmp" ] && ! fm_account_task_tmp_is_expected "$rollback_id" "$rollback_tasktmp"; then
+    if [ -n "$rollback_tasktmp" ] && ! fm_account_task_tmp_is_expected "$rollback_id" "$rollback_tasktmp" "$rollback_generation"; then
       echo "error: unsafe task temp path in rollback metadata for $rollback_id: $rollback_tasktmp" >&2
       exit 1
     fi
@@ -894,9 +895,11 @@ if [ "$RECOVERY_ACCOUNT" = 1 ]; then
     rollback_profile=$(fm_account_meta_value "$RESUME_META" account_profile)
     if [ -z "$rollback_profile" ] && [ "$rollback_kind" = secondmate ] && [ -z "$rollback_backup" ]; then
       rm -f "$RESUME_META" "$STATE/$rollback_id.status" "$STATE/$rollback_id.turn-ended" "$STATE/$rollback_id.check.sh" "$STATE/$rollback_id.pi-ext.ts" "$STATE/$rollback_id.grok-turnend-token"
-      [ -z "$rollback_tasktmp" ] \
-        || ! fm_account_task_tmp_is_current "$rollback_id" "$rollback_tasktmp" \
-        || rm -rf "$rollback_tasktmp"
+      if [ -n "$rollback_tasktmp" ] \
+        && { fm_account_task_tmp_is_current "$rollback_id" "$rollback_tasktmp" "$rollback_generation" \
+          || fm_account_task_tmp_is_previous "$rollback_id" "$rollback_tasktmp"; }; then
+        rm -rf "$rollback_tasktmp"
+      fi
     fi
     if [ -z "$rollback_profile" ]; then
       if [ -n "$rollback_backup" ]; then
@@ -1467,7 +1470,7 @@ spawn_restore_unmanaged_state_locked() {
   [ "${ACCOUNT_EFFECTIVE_MODE:-off}" != enforce ] || return 0
   if [ -n "$EXISTING_ARTIFACT_BACKUP" ]; then
     artifact_backup_name=${EXISTING_ARTIFACT_BACKUP##*/}
-    fm_account_restore_artifacts "$STATE" "$ID" "$artifact_backup_name" "$SPAWN_TASK_TMP" 1 || return 1
+    fm_account_restore_artifacts "$STATE" "$ID" "$artifact_backup_name" "$SPAWN_TASK_TMP" 1 "$SPAWN_GENERATION_ID" || return 1
   fi
   if [ -n "$META_BACKUP" ]; then
     [ -f "$META_BACKUP" ] && [ -f "$meta" ] || return 1
@@ -1639,7 +1642,7 @@ spawn_abort_cleanup() {
     fi
     if [ -n "$rollback_lock" ]; then
       artifact_backup_name=${EXISTING_ARTIFACT_BACKUP##*/}
-      if fm_account_restore_artifacts "$STATE" "$ID" "$artifact_backup_name" "${TASK_TMP:-$SPAWN_TASK_TMP}" 1; then
+      if fm_account_restore_artifacts "$STATE" "$ID" "$artifact_backup_name" "${TASK_TMP:-$SPAWN_TASK_TMP}" 1 "$SPAWN_GENERATION_ID"; then
         if [ "$META_INSTALLED" = 1 ] && [ -n "$META_BACKUP" ] && [ -f "$META_BACKUP" ]; then
           if fm_account_meta_merge_extensions "$STATE/$ID.meta" "$META_BACKUP" \
             && fm_account_safe_file_destination "$STATE/$ID.meta" \
@@ -1673,7 +1676,7 @@ spawn_abort_cleanup() {
     if [ -n "$rollback_lock" ] && [ "$worktree_clean" = 1 ]; then
       if [ -n "$META_BACKUP" ] && [ -f "$META_BACKUP" ]; then
         artifact_backup_name=${EXISTING_ARTIFACT_BACKUP##*/}
-        if fm_account_restore_artifacts "$STATE" "$ID" "$artifact_backup_name" "${TASK_TMP:-$SPAWN_TASK_TMP}" 1 \
+        if fm_account_restore_artifacts "$STATE" "$ID" "$artifact_backup_name" "${TASK_TMP:-$SPAWN_TASK_TMP}" 1 "$SPAWN_GENERATION_ID" \
           && fm_account_meta_merge_extensions "$STATE/$ID.meta" "$META_BACKUP" \
           && fm_account_safe_file_destination "$STATE/$ID.meta" \
           && mv "$META_BACKUP" "$STATE/$ID.meta"; then
@@ -1735,7 +1738,7 @@ spawn_abort_cleanup() {
         if [ "$(fm_meta_get "$STATE/$ID.meta" account_task)" = "$ACCOUNT_TASK" ] \
           || cmp -s "$STATE/$ID.meta" "$META_BACKUP"; then
           artifact_backup_name=${EXISTING_ARTIFACT_BACKUP##*/}
-          if fm_account_restore_artifacts "$STATE" "$ID" "$artifact_backup_name" "${TASK_TMP:-}" 1 \
+          if fm_account_restore_artifacts "$STATE" "$ID" "$artifact_backup_name" "${TASK_TMP:-}" 1 "$SPAWN_GENERATION_ID" \
             && fm_account_meta_merge_extensions "$STATE/$ID.meta" "$META_BACKUP" \
             && fm_account_safe_file_destination "$STATE/$ID.meta" \
             && mv "$META_BACKUP" "$STATE/$ID.meta"; then
@@ -1852,14 +1855,10 @@ mkdir -p "$STATE" || {
   echo "error: cannot establish state directory at $STATE" >&2
   exit 1
 }
-SPAWN_TASK_TMP=$(fm_account_task_tmp_path "$ID") || {
-  echo "error: cannot establish a safe task temp path for $ID" >&2
-  exit 1
-}
 if [ "$SPAWN_META_PRESENT" = 1 ]; then
   EXISTING_TASK_TMP=$(spawn_preflight_meta_value tasktmp)
   if [ -n "$EXISTING_TASK_TMP" ]; then
-    fm_account_task_tmp_is_expected "$ID" "$EXISTING_TASK_TMP" || {
+    fm_account_task_tmp_is_expected "$ID" "$EXISTING_TASK_TMP" "$(spawn_preflight_meta_value generation_id)" || {
       echo "error: existing task metadata has an unsafe tasktmp for $ID" >&2
       exit 1
     }
@@ -1949,8 +1948,6 @@ if [ -e "$STATE/$ID.turn-ended" ] || [ -L "$STATE/$ID.turn-ended" ]; then ORIGIN
 if [ -e "$STATE/$ID.check.sh" ] || [ -L "$STATE/$ID.check.sh" ]; then ORIGINAL_CHECK_PRESENT=1; else ORIGINAL_CHECK_PRESENT=0; fi
 if [ -e "$STATE/$ID.pi-ext.ts" ] || [ -L "$STATE/$ID.pi-ext.ts" ]; then ORIGINAL_PI_EXT_PRESENT=1; else ORIGINAL_PI_EXT_PRESENT=0; fi
 if [ -e "$STATE/$ID.grok-turnend-token" ] || [ -L "$STATE/$ID.grok-turnend-token" ]; then ORIGINAL_GROK_TOKEN_PRESENT=1; else ORIGINAL_GROK_TOKEN_PRESENT=0; fi
-if [ -e "$SPAWN_TASK_TMP" ] || [ -L "$SPAWN_TASK_TMP" ]; then ORIGINAL_TASK_TMP_PRESENT=1; else ORIGINAL_TASK_TMP_PRESENT=0; fi
-
 if [ "$RECOVERY_ACCOUNT" = 1 ]; then
   RECORDED_KIND=$(fm_meta_get "$RESUME_META" kind)
   [ -n "$RECORDED_KIND" ] || RECORDED_KIND=ship
@@ -2027,7 +2024,7 @@ if [ "$RECOVERY_ACCOUNT" = 1 ]; then
     [ -n "$RECORDED_MODE" ] || { echo "error: direct account recovery metadata has no mode for $ID" >&2; exit 1; }
     [ -n "$RECORDED_YOLO" ] || { echo "error: direct account recovery metadata has no yolo setting for $ID" >&2; exit 1; }
     [ -n "$RECORDED_GENERATION" ] || { echo "error: direct account recovery metadata has no generation_id for $ID" >&2; exit 1; }
-    fm_account_task_tmp_is_expected "$ID" "$RECORDED_TASKTMP" || { echo "error: direct account recovery metadata has an invalid tasktmp for $ID" >&2; exit 1; }
+    fm_account_task_tmp_is_expected "$ID" "$RECORDED_TASKTMP" "$RECORDED_GENERATION" || { echo "error: direct account recovery metadata has an invalid tasktmp for $ID" >&2; exit 1; }
     RECORDED_META_WORKTREE_GIT_REF=$RECORDED_WORKTREE_GIT_REF
     RECORDED_META_WORKTREE_GIT_HEAD=$RECORDED_WORKTREE_GIT_HEAD
     RECORDED_META_WORKTREE_GIT_SETUP_REF=$RECORDED_WORKTREE_GIT_SETUP_REF
@@ -2368,6 +2365,15 @@ elif [ "$ACCOUNT_EFFECTIVE_MODE" != off ]; then
 else
   SPAWN_GENERATION_ID="spawn:$(fm_account_attempt_id "$FM_HOME" "$ID")" || exit 1
 fi
+if [ "$DIRECT_ACCOUNT_RECOVERY" = 1 ]; then
+  SPAWN_TASK_TMP=$RECORDED_TASKTMP
+else
+  SPAWN_TASK_TMP=$(fm_account_task_tmp_path "$ID" "$SPAWN_GENERATION_ID") || {
+    echo "error: cannot establish a safe task temp path for $ID" >&2
+    exit 1
+  }
+fi
+if [ -e "$SPAWN_TASK_TMP" ] || [ -L "$SPAWN_TASK_TMP" ]; then ORIGINAL_TASK_TMP_PRESENT=1; else ORIGINAL_TASK_TMP_PRESENT=0; fi
 if [ "$ACCOUNT_EFFECTIVE_MODE" = enforce ]; then
   META_WRITE_LOCK=$(fm_account_meta_lock_acquire "$STATE" "$ID") || exit 1
   if [ "$RECOVERY_ACCOUNT" = 1 ]; then
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index be85537399..7133e1a23f 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -126,11 +126,6 @@ case "$TEARDOWN_UPSTREAM_TIMEOUT" in
 esac
 ID=$1
 FORCE=${2:-}
-fm_account_task_tmp_path "$ID" >/dev/null || {
-  echo "error: cannot establish a safe task temp path for $ID" >&2
-  exit 1
-}
-
 META="$STATE/$ID.meta"
 
 require_safe_task_metadata() {
@@ -210,7 +205,8 @@ PR_URL=$(grep '^pr=' "$META" | tail -1 | cut -d= -f2- || true)
 # tasktmp is recorded by fm-spawn for tasks that set up a per-task temp root;
 # absent for tasks spawned before that change, so tolerate empty.
 TASK_TMP=$(grep '^tasktmp=' "$META" | cut -d= -f2- || true)
-if [ -n "$TASK_TMP" ] && ! fm_account_task_tmp_is_expected "$ID" "$TASK_TMP"; then
+TASK_GENERATION=$(grep '^generation_id=' "$META" | cut -d= -f2- || true)
+if [ -n "$TASK_TMP" ] && ! fm_account_task_tmp_is_expected "$ID" "$TASK_TMP" "$TASK_GENERATION"; then
   echo "REFUSED: unsafe task temp path in metadata for $ID: $TASK_TMP" >&2
   exit 1
 fi
@@ -1831,12 +1827,14 @@ safe_rm_rf_child_worktree() {
 safe_remove_task_tmp() {
   local target=$1 base legacy
   [ -n "$target" ] || return 0
-  fm_account_task_tmp_is_expected "$ID" "$target" || return 1
+  fm_account_task_tmp_is_expected "$ID" "$target" "$TASK_GENERATION" || return 1
   legacy=$(fm_account_legacy_task_tmp_path "$ID") || return 1
   # Legacy compatibility is classification-only. Never inspect or mutate the
   # old process-wide /tmp/fm-<id> location from a current teardown.
   [ "$target" != "$legacy" ] || return 0
-  fm_account_task_tmp_is_current "$ID" "$target" || return 1
+  fm_account_task_tmp_is_current "$ID" "$target" "$TASK_GENERATION" \
+    || fm_account_task_tmp_is_previous "$ID" "$target" \
+    || return 1
   [ -e "$target" ] || [ -L "$target" ] || return 0
   base=${target%/*}
   base=$(python3 - "$base" <<'PY'
@@ -4190,7 +4188,7 @@ if [ "$DIRECT_SPAWN_CLEANUP" = pending ] && [ -n "$DIRECT_SPAWN_BACKUP" ]; then
     exit 1
   }
   direct_spawn_restore_lock=$(fm_account_meta_lock_acquire "$STATE" "$ID") || exit 1
-  if ! fm_account_restore_artifacts "$STATE" "$ID" "$DIRECT_SPAWN_ARTIFACTS" "$TASK_TMP" 1 \
+  if ! fm_account_restore_artifacts "$STATE" "$ID" "$DIRECT_SPAWN_ARTIFACTS" "$TASK_TMP" 1 "$TASK_GENERATION" \
     || ! fm_account_meta_merge_extensions "$META" "$direct_spawn_backup_path" \
     || ! fm_account_safe_file_destination "$META" \
     || ! mv "$direct_spawn_backup_path" "$META"; then
diff --git a/tests/fm-account-routing.test.sh b/tests/fm-account-routing.test.sh
index 021f377d62..348adce922 100755
--- a/tests/fm-account-routing.test.sh
+++ b/tests/fm-account-routing.test.sh
@@ -580,7 +580,7 @@ use_named_fake_tmux_target() {
 }
 
 test_off_is_byte_compatible_and_never_calls_agent_fleet() {
-  local id rec out status launch expected task_tmp
+  local id rec out status launch expected task_tmp generation token
   id=account-off-z1
   rec=$(make_case off claude "$id")
   read_case "$rec"
@@ -594,8 +594,10 @@ test_off_is_byte_compatible_and_never_calls_agent_fleet() {
   assert_not_grep '^account_' "$HOME_DIR/state/$id.meta" "routing off wrote account metadata"
   assert_not_grep '^provider_session_id=' "$HOME_DIR/state/$id.meta" "routing off wrote session metadata"
   task_tmp=$(sed -n 's/^tasktmp=//p' "$HOME_DIR/state/$id.meta")
-  [ "$task_tmp" = "$HOME_DIR/state/.task-tmp/fm-$id" ] \
-    || fail "routing fixture did not namespace its task temp root to this test run"
+  generation=$(sed -n 's/^generation_id=//p' "$HOME_DIR/state/$id.meta")
+  token=${generation##*:}
+  [ "$task_tmp" = "$HOME_DIR/state/.task-tmp/fm-$id-$token" ] \
+    || fail "routing fixture did not namespace its task temp root to this spawn generation"
   assert_present "$task_tmp/gotmp" \
     "routing fixture did not create its run-scoped Go temp root"
   assert_regex '^generation_id=spawn:a[0-9a-f]{15}$' "$HOME_DIR/state/$id.meta" "routing off did not record a stable spawn generation"

From 405fd7d2041c10ace9e6d08cda55984c5bfb77b8 Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Sun, 26 Jul 2026 08:58:39 -0400
Subject: [PATCH 03/34] no-mistakes(review): Clean prior task temp after
 respawn

---
 bin/fm-spawn.sh                  | 20 +++++++++++++++++++-
 tests/fm-account-routing.test.sh | 21 +++++++++++++++++++--
 2 files changed, 38 insertions(+), 3 deletions(-)

diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 1ab80ac402..856a4aa753 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -1857,12 +1857,16 @@ mkdir -p "$STATE" || {
 }
 if [ "$SPAWN_META_PRESENT" = 1 ]; then
   EXISTING_TASK_TMP=$(spawn_preflight_meta_value tasktmp)
+  EXISTING_TASK_GENERATION=$(spawn_preflight_meta_value generation_id)
   if [ -n "$EXISTING_TASK_TMP" ]; then
-    fm_account_task_tmp_is_expected "$ID" "$EXISTING_TASK_TMP" "$(spawn_preflight_meta_value generation_id)" || {
+    fm_account_task_tmp_is_expected "$ID" "$EXISTING_TASK_TMP" "$EXISTING_TASK_GENERATION" || {
       echo "error: existing task metadata has an unsafe tasktmp for $ID" >&2
       exit 1
     }
   fi
+else
+  EXISTING_TASK_TMP=
+  EXISTING_TASK_GENERATION=
 fi
 PROJ=
 ARG3=
@@ -3758,6 +3762,20 @@ if [ "$ACCOUNT_EFFECTIVE_MODE" = enforce ]; then
   fi
 fi
 [ "$ACCOUNT_EFFECTIVE_MODE" = enforce ] || ACCOUNT_SPAWN_COMMITTED=1
+if [ -n "$EXISTING_TASK_TMP" ] && [ "$EXISTING_TASK_TMP" != "$TASK_TMP" ]; then
+  META_WRITE_LOCK=$(fm_account_meta_lock_acquire "$STATE" "$ID") || exit 1
+  if [ "$(fm_account_meta_value "$STATE/$ID.meta" generation_id)" != "$SPAWN_GENERATION_ID" ] \
+    || [ "$(fm_account_meta_value "$STATE/$ID.meta" tasktmp)" != "$TASK_TMP" ]; then
+    echo "error: task generation changed before prior temp cleanup for $ID" >&2
+    exit 1
+  fi
+  if fm_account_task_tmp_is_current "$ID" "$EXISTING_TASK_TMP" "$EXISTING_TASK_GENERATION" \
+    || fm_account_task_tmp_is_previous "$ID" "$EXISTING_TASK_TMP"; then
+    rm -rf "$EXISTING_TASK_TMP" || exit 1
+  fi
+  fm_account_meta_lock_release "$META_WRITE_LOCK" || exit 1
+  META_WRITE_LOCK=
+fi
 CONTINUATION_LAUNCH_DIR=
 CONTINUATION_PROMPT_FILE=
 [ -z "$META_BACKUP" ] || rm -f "$META_BACKUP"
diff --git a/tests/fm-account-routing.test.sh b/tests/fm-account-routing.test.sh
index 348adce922..dd19683adb 100755
--- a/tests/fm-account-routing.test.sh
+++ b/tests/fm-account-routing.test.sh
@@ -1509,10 +1509,12 @@ test_unmanaged_spawn_refuses_while_teardown_lifecycle_is_held() {
 }
 
 test_unmanaged_respawn_preserves_report_cutover_state() {
-  local id rec out status
+  local id rec out status prior_task_tmp
   id=account-legacy-respawn-z9b
   rec=$(make_case legacy-respawn claude "$id")
   read_case "$rec"
+  prior_task_tmp="$HOME_DIR/state/.task-tmp/fm-$id-a111111111111111"
+  mkdir -p "$prior_task_tmp/gotmp"
   fm_write_meta "$HOME_DIR/state/$id.meta" \
     "window=firstmate:fm-$id" \
     "worktree=$WT_DIR" \
@@ -1520,6 +1522,8 @@ test_unmanaged_respawn_preserves_report_cutover_state() {
     "harness=claude" \
     "kind=ship" \
     "mode=no-mistakes" \
+    "tasktmp=$prior_task_tmp" \
+    "generation_id=spawn:a111111111111111" \
     "pr=418" \
     "x_request=req-legacy" \
     "custom_extension=preserve-success"
@@ -1530,14 +1534,17 @@ test_unmanaged_respawn_preserves_report_cutover_state() {
   assert_grep 'pr=418' "$HOME_DIR/state/$id.meta" "managed respawn dropped the existing PR pointer"
   assert_grep 'x_request=req-legacy' "$HOME_DIR/state/$id.meta" "managed respawn dropped the existing X-mode link"
   assert_grep 'custom_extension=preserve-success' "$HOME_DIR/state/$id.meta" "managed respawn dropped extension metadata"
+  assert_absent "$prior_task_tmp" "successful respawn orphaned the prior task temp generation"
   pass "unmanaged respawn preserves a legacy task's report cutover state"
 }
 
 test_failed_managed_respawn_restores_unmanaged_metadata() {
-  local id rec expected out status artifact
+  local id rec expected out status artifact prior_task_tmp
   id=account-unmanaged-rollback-z9c
   rec=$(make_case unmanaged-rollback claude "$id")
   read_case "$rec"
+  prior_task_tmp="$HOME_DIR/state/.task-tmp/fm-$id-a222222222222222"
+  mkdir -p "$prior_task_tmp/gotmp"
   fm_write_meta "$HOME_DIR/state/$id.meta" \
     "window=firstmate:fm-$id" \
     "worktree=$WT_DIR" \
@@ -1545,6 +1552,8 @@ test_failed_managed_respawn_restores_unmanaged_metadata() {
     "harness=claude" \
     "kind=ship" \
     "mode=no-mistakes" \
+    "tasktmp=$prior_task_tmp" \
+    "generation_id=spawn:a222222222222222" \
     "pr=417" \
     "custom_extension=preserve-me"
   expected="$CASE_DIR/original.meta"
@@ -1566,6 +1575,7 @@ test_failed_managed_respawn_restores_unmanaged_metadata() {
       || fail "failed managed respawn did not restore prior $artifact state"
   done
   assert_grep 'lease release ' "$AF_LOG" "failed managed respawn leaked its acquired reservation"
+  assert_present "$prior_task_tmp/gotmp" "failed respawn destroyed the prior task temp generation"
   [ -n "$out" ] || true
   pass "failed managed respawn restores every field from existing unmanaged metadata"
 }
@@ -6479,6 +6489,13 @@ if [ "${FM_TEST_FOCUSED:-}" = production-fleet-environment ]; then
   exit 0
 fi
 
+if [ "${FM_TEST_FOCUSED:-}" = prior-tasktmp-cleanup ]; then
+  run_isolated_test test_unmanaged_respawn_preserves_report_cutover_state
+  run_isolated_test test_failed_managed_respawn_restores_unmanaged_metadata
+  run_isolated_test test_agent_fleet_task_keys_are_namespaced_by_home_and_attempt
+  exit 0
+fi
+
 run_isolated_test test_reserved_generation_is_durable_before_lease_mutation
 run_isolated_test test_off_is_byte_compatible_and_never_calls_agent_fleet
 run_isolated_test test_failed_freshness_proof_rolls_back_unmanaged_resources

From 8c1d4c254db3b0253de48c7e89f70a2353e01d2f Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Sun, 26 Jul 2026 09:04:57 -0400
Subject: [PATCH 04/34] no-mistakes(review): Safely remove task temp
 generations

---
 bin/fm-account-routing-lib.sh    | 14 +++++
 bin/fm-safe-task-tmp.py          | 91 ++++++++++++++++++++++++++++++++
 bin/fm-spawn.sh                  |  5 +-
 bin/fm-teardown.sh               | 48 +----------------
 tests/fm-account-routing.test.sh | 19 +++++++
 5 files changed, 127 insertions(+), 50 deletions(-)
 create mode 100644 bin/fm-safe-task-tmp.py

diff --git a/bin/fm-account-routing-lib.sh b/bin/fm-account-routing-lib.sh
index 8a6f79ceeb..d3f316c673 100644
--- a/bin/fm-account-routing-lib.sh
+++ b/bin/fm-account-routing-lib.sh
@@ -312,6 +312,20 @@ fm_account_task_tmp_is_expected() {  # <task-id> <path> <generation-id>
     || fm_account_task_tmp_is_legacy "$1" "$2"
 }
 
+fm_account_safe_remove_task_tmp() {  # <task-id> <path> <generation-id>
+  local task=$1 target=$2 generation=$3 legacy base
+  [ -n "$target" ] || return 0
+  fm_account_task_tmp_is_expected "$task" "$target" "$generation" || return 1
+  legacy=$(fm_account_legacy_task_tmp_path "$task") || return 1
+  [ "$target" != "$legacy" ] || return 0
+  fm_account_task_tmp_is_current "$task" "$target" "$generation" \
+    || fm_account_task_tmp_is_previous "$task" "$target" \
+    || return 1
+  python3 "$FM_ACCOUNT_ROUTING_LIB_DIR/fm-safe-task-tmp.py" "$target" || return 1
+  base=${target%/*}
+  fm_account_system_exec "$FM_ACCOUNT_SYSTEM_RMDIR_BIN" "$base" 2>/dev/null || true
+}
+
 fm_account_safe_file_destination() {
   [ ! -L "$1" ] && { [ ! -e "$1" ] || [ -f "$1" ]; }
 }
diff --git a/bin/fm-safe-task-tmp.py b/bin/fm-safe-task-tmp.py
new file mode 100644
index 0000000000..7bd87eb44a
--- /dev/null
+++ b/bin/fm-safe-task-tmp.py
@@ -0,0 +1,91 @@
+#!/usr/bin/env python3
+import os
+import stat
+import sys
+
+
+def identity(metadata):
+    return metadata.st_dev, metadata.st_ino
+
+
+target = os.path.normpath(os.path.abspath(sys.argv[1]))
+if not sys.argv[1] or target == os.path.sep:
+    raise SystemExit(1)
+
+current = os.path.sep
+try:
+    for component in target.split(os.path.sep):
+        if not component:
+            continue
+        current = os.path.join(current, component)
+        if stat.S_ISLNK(os.lstat(current).st_mode):
+            raise OSError(f"redirected path component {current}")
+except FileNotFoundError:
+    raise SystemExit(0)
+
+parent = os.path.dirname(target)
+name = os.path.basename(target)
+flags = os.O_RDONLY | os.O_DIRECTORY
+if hasattr(os, "O_NOFOLLOW"):
+    flags |= os.O_NOFOLLOW
+
+
+def remove_tree(directory_fd, device):
+    for entry in sorted(os.listdir(directory_fd)):
+        metadata = os.stat(entry, dir_fd=directory_fd, follow_symlinks=False)
+        if metadata.st_dev != device:
+            raise OSError(f"filesystem boundary at {entry}")
+        if stat.S_ISLNK(metadata.st_mode):
+            current_metadata = os.stat(
+                entry, dir_fd=directory_fd, follow_symlinks=False
+            )
+            if identity(current_metadata) != identity(metadata):
+                raise OSError(f"symlink identity changed at {entry}")
+            os.unlink(entry, dir_fd=directory_fd)
+        elif stat.S_ISDIR(metadata.st_mode):
+            child_fd = os.open(entry, flags, dir_fd=directory_fd)
+            try:
+                opened = os.fstat(child_fd)
+                if identity(opened) != identity(metadata):
+                    raise OSError(f"directory identity changed at {entry}")
+                remove_tree(child_fd, device)
+                current_metadata = os.stat(
+                    entry, dir_fd=directory_fd, follow_symlinks=False
+                )
+                if identity(current_metadata) != identity(opened):
+                    raise OSError(f"directory identity changed at {entry}")
+                os.rmdir(entry, dir_fd=directory_fd)
+            finally:
+                os.close(child_fd)
+        else:
+            current_metadata = os.stat(
+                entry, dir_fd=directory_fd, follow_symlinks=False
+            )
+            if identity(current_metadata) != identity(metadata):
+                raise OSError(f"entry identity changed at {entry}")
+            os.unlink(entry, dir_fd=directory_fd)
+
+
+try:
+    parent_fd = os.open(parent, flags)
+    try:
+        metadata = os.stat(name, dir_fd=parent_fd, follow_symlinks=False)
+        if stat.S_ISLNK(metadata.st_mode) or not stat.S_ISDIR(metadata.st_mode):
+            raise OSError("task temp root is not a real directory")
+        root_fd = os.open(name, flags, dir_fd=parent_fd)
+        try:
+            opened = os.fstat(root_fd)
+            if identity(opened) != identity(metadata):
+                raise OSError("task temp root identity changed")
+            remove_tree(root_fd, opened.st_dev)
+            current_metadata = os.stat(name, dir_fd=parent_fd, follow_symlinks=False)
+            if identity(current_metadata) != identity(opened):
+                raise OSError("task temp root identity changed")
+            os.rmdir(name, dir_fd=parent_fd)
+        finally:
+            os.close(root_fd)
+    finally:
+        os.close(parent_fd)
+except OSError as error:
+    print(f"REFUSED: unsafe task temp removal: {error}", file=sys.stderr)
+    raise SystemExit(1)
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 856a4aa753..63b2578af4 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -3769,10 +3769,7 @@ if [ -n "$EXISTING_TASK_TMP" ] && [ "$EXISTING_TASK_TMP" != "$TASK_TMP" ]; then
     echo "error: task generation changed before prior temp cleanup for $ID" >&2
     exit 1
   fi
-  if fm_account_task_tmp_is_current "$ID" "$EXISTING_TASK_TMP" "$EXISTING_TASK_GENERATION" \
-    || fm_account_task_tmp_is_previous "$ID" "$EXISTING_TASK_TMP"; then
-    rm -rf "$EXISTING_TASK_TMP" || exit 1
-  fi
+  fm_account_safe_remove_task_tmp "$ID" "$EXISTING_TASK_TMP" "$EXISTING_TASK_GENERATION" || exit 1
   fm_account_meta_lock_release "$META_WRITE_LOCK" || exit 1
   META_WRITE_LOCK=
 fi
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index 7133e1a23f..a7ee449606 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -1824,50 +1824,6 @@ safe_rm_rf_child_worktree() {
   removal_tree_operation "$canonical" "child worktree" remove
 }
 
-safe_remove_task_tmp() {
-  local target=$1 base legacy
-  [ -n "$target" ] || return 0
-  fm_account_task_tmp_is_expected "$ID" "$target" "$TASK_GENERATION" || return 1
-  legacy=$(fm_account_legacy_task_tmp_path "$ID") || return 1
-  # Legacy compatibility is classification-only. Never inspect or mutate the
-  # old process-wide /tmp/fm-<id> location from a current teardown.
-  [ "$target" != "$legacy" ] || return 0
-  fm_account_task_tmp_is_current "$ID" "$target" "$TASK_GENERATION" \
-    || fm_account_task_tmp_is_previous "$ID" "$target" \
-    || return 1
-  [ -e "$target" ] || [ -L "$target" ] || return 0
-  base=${target%/*}
-  base=$(python3 - "$base" <<'PY'
-import os
-import stat
-import sys
-
-raw = sys.argv[1]
-base = os.path.realpath(raw)
-if raw == "/tmp":
-    if base not in ("/tmp", "/private/tmp"):
-        raise SystemExit(1)
-elif raw != base:
-    raise SystemExit(1)
-if not base.startswith(os.path.sep) or base == os.path.sep:
-    raise SystemExit(1)
-current = os.path.sep
-for component in base.split(os.path.sep):
-    if not component:
-        continue
-    current = os.path.join(current, component)
-    metadata = os.lstat(current)
-    if stat.S_ISLNK(metadata.st_mode):
-        raise SystemExit(1)
-if not stat.S_ISDIR(os.lstat(base).st_mode):
-    raise SystemExit(1)
-print(base)
-PY
-  ) || return 1
-  removal_tree_operation "$base/${target##*/}" "task temp root" remove || return 1
-  fm_account_system_exec "$FM_ACCOUNT_SYSTEM_RMDIR_BIN" "$base" 2>/dev/null || true
-}
-
 remove_worktree_compatibility_artifacts() {
   local target=$1 label=$2
   FM_COMPATIBILITY_CLEANUP_LABEL=$label python3 - "$target" <<'PY'
@@ -3942,7 +3898,7 @@ if [ "$ORCA_CLEANUP_PENDING" = 1 ]; then
   fm_checkout_lock_run "$WT" "$CHECKOUT_LOCK_ROOT" remove_pending_orca_worktree_locked || exit 1
   remove_grok_turnend_auth "$STATE" "$ID"
   fm_backend_clear_transition "$BACKEND" "$STATE" "$T" || true
-  safe_remove_task_tmp "$TASK_TMP" || exit 1
+  fm_account_safe_remove_task_tmp "$ID" "$TASK_TMP" "$TASK_GENERATION" || exit 1
   rm -f "$STATE/$ID.status" "$STATE/$ID.turn-ended" "$STATE/$ID.check.sh" "$STATE/$ID.meta" "$STATE/$ID.pi-ext.ts" "$STATE/$ID.grok-turnend-token"
   [ -z "$ACCOUNT_DELETE_LOCK" ] || fm_account_lifecycle_lock_release "$ACCOUNT_DELETE_LOCK" >/dev/null 2>&1 || true
   ACCOUNT_DELETE_LOCK=
@@ -4246,7 +4202,7 @@ remove_grok_turnend_auth "$STATE" "$ID"
 fm_backend_clear_transition "$BACKEND" "$STATE" "$T" || true
 # Remove the per-task temp root, including its gotmp, recorded by spawn.
 # Read before the state-file rm below; empty (pre-fix tasks without tasktmp=) is a no-op.
-[ -z "$TASK_TMP" ] || safe_remove_task_tmp "$TASK_TMP" || exit 1
+[ -z "$TASK_TMP" ] || fm_account_safe_remove_task_tmp "$ID" "$TASK_TMP" "$TASK_GENERATION" || exit 1
 rm -f "$STATE/$ID.status" "$STATE/$ID.turn-ended" "$STATE/$ID.check.sh" "$STATE/$ID.meta" "$STATE/$ID.pi-ext.ts" "$STATE/$ID.grok-turnend-token"
 [ -z "$ACCOUNT_DELETE_LOCK" ] || fm_account_lifecycle_lock_release "$ACCOUNT_DELETE_LOCK" >/dev/null 2>&1 || true
 if [ "$KIND" != scout ] && [ "$KIND" != secondmate ] && [ "$MODE" != local-only ]; then
diff --git a/tests/fm-account-routing.test.sh b/tests/fm-account-routing.test.sh
index dd19683adb..aa8d49862d 100755
--- a/tests/fm-account-routing.test.sh
+++ b/tests/fm-account-routing.test.sh
@@ -1580,6 +1580,24 @@ test_failed_managed_respawn_restores_unmanaged_metadata() {
   pass "failed managed respawn restores every field from existing unmanaged metadata"
 }
 
+test_task_tmp_removal_refuses_symlinked_parent() {
+  local id generation state outside target
+  id=account-tasktmp-parent-z9d
+  generation=spawn:a333333333333333
+  state="$TMP_ROOT/tasktmp-parent/state"
+  outside="$TMP_ROOT/tasktmp-parent/outside"
+  target="$state/.task-tmp/fm-$id-a333333333333333"
+  mkdir -p "$state" "$outside/${target##*/}"
+  ln -s "$outside" "$state/.task-tmp"
+  STATE=$state
+  . "$ROOT/bin/fm-account-routing-lib.sh"
+  if fm_account_safe_remove_task_tmp "$id" "$target" "$generation" >/dev/null 2>&1; then
+    fail "task temp removal followed a symlinked parent"
+  fi
+  assert_present "$outside/${target##*/}" "task temp removal deleted through a symlinked parent"
+  pass "task temp removal refuses a symlinked parent"
+}
+
 test_preinstall_managed_failure_restores_artifact_snapshot() {
   local id rec expected out status artifact
   id=account-preinstall-rollback-z9f
@@ -6492,6 +6510,7 @@ fi
 if [ "${FM_TEST_FOCUSED:-}" = prior-tasktmp-cleanup ]; then
   run_isolated_test test_unmanaged_respawn_preserves_report_cutover_state
   run_isolated_test test_failed_managed_respawn_restores_unmanaged_metadata
+  run_isolated_test test_task_tmp_removal_refuses_symlinked_parent
   run_isolated_test test_agent_fleet_task_keys_are_namespaced_by_home_and_attempt
   exit 0
 fi

From 78c17850ee494d2128e5886911717684c24b3395 Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Sun, 26 Jul 2026 09:09:13 -0400
Subject: [PATCH 05/34] no-mistakes(review): Pin task temp ancestors during
 removal

---
 bin/fm-account-routing-lib.sh    |  4 +---
 bin/fm-safe-task-tmp.py          | 40 +++++++++++++++++++++-----------
 tests/fm-account-routing.test.sh | 25 ++++++++++++++++++++
 3 files changed, 52 insertions(+), 17 deletions(-)

diff --git a/bin/fm-account-routing-lib.sh b/bin/fm-account-routing-lib.sh
index d3f316c673..33d058f295 100644
--- a/bin/fm-account-routing-lib.sh
+++ b/bin/fm-account-routing-lib.sh
@@ -313,7 +313,7 @@ fm_account_task_tmp_is_expected() {  # <task-id> <path> <generation-id>
 }
 
 fm_account_safe_remove_task_tmp() {  # <task-id> <path> <generation-id>
-  local task=$1 target=$2 generation=$3 legacy base
+  local task=$1 target=$2 generation=$3 legacy
   [ -n "$target" ] || return 0
   fm_account_task_tmp_is_expected "$task" "$target" "$generation" || return 1
   legacy=$(fm_account_legacy_task_tmp_path "$task") || return 1
@@ -322,8 +322,6 @@ fm_account_safe_remove_task_tmp() {  # <task-id> <path> <generation-id>
     || fm_account_task_tmp_is_previous "$task" "$target" \
     || return 1
   python3 "$FM_ACCOUNT_ROUTING_LIB_DIR/fm-safe-task-tmp.py" "$target" || return 1
-  base=${target%/*}
-  fm_account_system_exec "$FM_ACCOUNT_SYSTEM_RMDIR_BIN" "$base" 2>/dev/null || true
 }
 
 fm_account_safe_file_destination() {
diff --git a/bin/fm-safe-task-tmp.py b/bin/fm-safe-task-tmp.py
index 7bd87eb44a..1a39589954 100644
--- a/bin/fm-safe-task-tmp.py
+++ b/bin/fm-safe-task-tmp.py
@@ -12,22 +12,12 @@ def identity(metadata):
 if not sys.argv[1] or target == os.path.sep:
     raise SystemExit(1)
 
-current = os.path.sep
-try:
-    for component in target.split(os.path.sep):
-        if not component:
-            continue
-        current = os.path.join(current, component)
-        if stat.S_ISLNK(os.lstat(current).st_mode):
-            raise OSError(f"redirected path component {current}")
-except FileNotFoundError:
-    raise SystemExit(0)
-
 parent = os.path.dirname(target)
 name = os.path.basename(target)
 flags = os.O_RDONLY | os.O_DIRECTORY
-if hasattr(os, "O_NOFOLLOW"):
-    flags |= os.O_NOFOLLOW
+if not hasattr(os, "O_NOFOLLOW"):
+    raise SystemExit(1)
+flags |= os.O_NOFOLLOW
 
 
 def remove_tree(directory_fd, device):
@@ -67,8 +57,28 @@ def remove_tree(directory_fd, device):
 
 
 try:
-    parent_fd = os.open(parent, flags)
+    parent_fd = os.open(os.path.sep, flags)
     try:
+        for component in parent.split(os.path.sep):
+            if not component:
+                continue
+            next_fd = os.open(component, flags, dir_fd=parent_fd)
+            os.close(parent_fd)
+            parent_fd = next_fd
+        if (
+            os.environ.get("FM_ACCOUNT_ROUTING_TEST_LAB")
+            == "firstmate-account-routing-test-lab-v1"
+            and os.environ.get("FM_SAFE_TASK_TMP_SWAP_ANCESTOR")
+        ):
+            os.rename(
+                os.environ["FM_SAFE_TASK_TMP_SWAP_ANCESTOR"],
+                os.environ["FM_SAFE_TASK_TMP_SWAP_MOVED"],
+            )
+            os.symlink(
+                os.environ["FM_SAFE_TASK_TMP_SWAP_OUTSIDE"],
+                os.environ["FM_SAFE_TASK_TMP_SWAP_ANCESTOR"],
+                target_is_directory=True,
+            )
         metadata = os.stat(name, dir_fd=parent_fd, follow_symlinks=False)
         if stat.S_ISLNK(metadata.st_mode) or not stat.S_ISDIR(metadata.st_mode):
             raise OSError("task temp root is not a real directory")
@@ -84,6 +94,8 @@ def remove_tree(directory_fd, device):
             os.rmdir(name, dir_fd=parent_fd)
         finally:
             os.close(root_fd)
+    except FileNotFoundError:
+        raise SystemExit(0)
     finally:
         os.close(parent_fd)
 except OSError as error:
diff --git a/tests/fm-account-routing.test.sh b/tests/fm-account-routing.test.sh
index aa8d49862d..45152915e5 100755
--- a/tests/fm-account-routing.test.sh
+++ b/tests/fm-account-routing.test.sh
@@ -1598,6 +1598,30 @@ test_task_tmp_removal_refuses_symlinked_parent() {
   pass "task temp removal refuses a symlinked parent"
 }
 
+test_task_tmp_removal_pins_ancestors_during_swap() {
+  local id generation root state moved outside target name
+  id=account-tasktmp-swap-z9e
+  generation=spawn:a444444444444444
+  root="$TMP_ROOT/tasktmp-swap"
+  state="$root/state"
+  moved="$root/state-moved"
+  outside="$root/outside"
+  name="fm-$id-a444444444444444"
+  target="$state/.task-tmp/$name"
+  mkdir -p "$target/gotmp" "$outside/.task-tmp/$name/gotmp"
+  printf 'outside\n' > "$outside/.task-tmp/$name/gotmp/sentinel"
+  STATE=$state
+  . "$ROOT/bin/fm-account-routing-lib.sh"
+  FM_SAFE_TASK_TMP_SWAP_ANCESTOR="$state" \
+    FM_SAFE_TASK_TMP_SWAP_MOVED="$moved" \
+    FM_SAFE_TASK_TMP_SWAP_OUTSIDE="$outside" \
+    fm_account_safe_remove_task_tmp "$id" "$target" "$generation" \
+    || fail "task temp removal lost its pinned ancestor during swap"
+  assert_absent "$moved/.task-tmp/$name" "task temp removal missed its pinned original directory"
+  assert_present "$outside/.task-tmp/$name/gotmp/sentinel" "task temp removal followed a swapped ancestor"
+  pass "task temp removal pins every ancestor during deletion"
+}
+
 test_preinstall_managed_failure_restores_artifact_snapshot() {
   local id rec expected out status artifact
   id=account-preinstall-rollback-z9f
@@ -6511,6 +6535,7 @@ if [ "${FM_TEST_FOCUSED:-}" = prior-tasktmp-cleanup ]; then
   run_isolated_test test_unmanaged_respawn_preserves_report_cutover_state
   run_isolated_test test_failed_managed_respawn_restores_unmanaged_metadata
   run_isolated_test test_task_tmp_removal_refuses_symlinked_parent
+  run_isolated_test test_task_tmp_removal_pins_ancestors_during_swap
   run_isolated_test test_agent_fleet_task_keys_are_namespaced_by_home_and_attempt
   exit 0
 fi

From 8c6d026c06be30bf65ed14074170f5c494b28b82 Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Sun, 26 Jul 2026 09:18:48 -0400
Subject: [PATCH 06/34] no-mistakes(review): Fail closed on partial temp
 removal

---
 bin/fm-safe-task-tmp.py          | 39 +++++++++++++++++++++-----------
 tests/fm-account-routing.test.sh | 20 ++++++++++++++++
 2 files changed, 46 insertions(+), 13 deletions(-)

diff --git a/bin/fm-safe-task-tmp.py b/bin/fm-safe-task-tmp.py
index 1a39589954..5b325cc882 100644
--- a/bin/fm-safe-task-tmp.py
+++ b/bin/fm-safe-task-tmp.py
@@ -21,7 +21,16 @@ def identity(metadata):
 
 
 def remove_tree(directory_fd, device):
-    for entry in sorted(os.listdir(directory_fd)):
+    entries = sorted(os.listdir(directory_fd))
+    disappearing = os.environ.get("FM_SAFE_TASK_TMP_DISAPPEAR_ENTRY")
+    if (
+        os.environ.get("FM_ACCOUNT_ROUTING_TEST_LAB")
+        == "firstmate-account-routing-test-lab-v1"
+        and disappearing in entries
+    ):
+        os.unlink(disappearing, dir_fd=directory_fd)
+        del os.environ["FM_SAFE_TASK_TMP_DISAPPEAR_ENTRY"]
+    for entry in entries:
         metadata = os.stat(entry, dir_fd=directory_fd, follow_symlinks=False)
         if metadata.st_dev != device:
             raise OSError(f"filesystem boundary at {entry}")
@@ -59,12 +68,15 @@ def remove_tree(directory_fd, device):
 try:
     parent_fd = os.open(os.path.sep, flags)
     try:
-        for component in parent.split(os.path.sep):
-            if not component:
-                continue
-            next_fd = os.open(component, flags, dir_fd=parent_fd)
-            os.close(parent_fd)
-            parent_fd = next_fd
+        try:
+            for component in parent.split(os.path.sep):
+                if not component:
+                    continue
+                next_fd = os.open(component, flags, dir_fd=parent_fd)
+                os.close(parent_fd)
+                parent_fd = next_fd
+        except FileNotFoundError:
+            raise SystemExit(0)
         if (
             os.environ.get("FM_ACCOUNT_ROUTING_TEST_LAB")
             == "firstmate-account-routing-test-lab-v1"
@@ -79,10 +91,13 @@ def remove_tree(directory_fd, device):
                 os.environ["FM_SAFE_TASK_TMP_SWAP_ANCESTOR"],
                 target_is_directory=True,
             )
-        metadata = os.stat(name, dir_fd=parent_fd, follow_symlinks=False)
-        if stat.S_ISLNK(metadata.st_mode) or not stat.S_ISDIR(metadata.st_mode):
-            raise OSError("task temp root is not a real directory")
-        root_fd = os.open(name, flags, dir_fd=parent_fd)
+        try:
+            metadata = os.stat(name, dir_fd=parent_fd, follow_symlinks=False)
+            if stat.S_ISLNK(metadata.st_mode) or not stat.S_ISDIR(metadata.st_mode):
+                raise OSError("task temp root is not a real directory")
+            root_fd = os.open(name, flags, dir_fd=parent_fd)
+        except FileNotFoundError:
+            raise SystemExit(0)
         try:
             opened = os.fstat(root_fd)
             if identity(opened) != identity(metadata):
@@ -94,8 +109,6 @@ def remove_tree(directory_fd, device):
             os.rmdir(name, dir_fd=parent_fd)
         finally:
             os.close(root_fd)
-    except FileNotFoundError:
-        raise SystemExit(0)
     finally:
         os.close(parent_fd)
 except OSError as error:
diff --git a/tests/fm-account-routing.test.sh b/tests/fm-account-routing.test.sh
index 45152915e5..3ec87c72e5 100755
--- a/tests/fm-account-routing.test.sh
+++ b/tests/fm-account-routing.test.sh
@@ -1622,6 +1622,25 @@ test_task_tmp_removal_pins_ancestors_during_swap() {
   pass "task temp removal pins every ancestor during deletion"
 }
 
+test_task_tmp_partial_removal_fails_closed() {
+  local id generation state target
+  id=account-tasktmp-partial-z9f
+  generation=spawn:a555555555555555
+  state="$TMP_ROOT/tasktmp-partial/state"
+  target="$state/.task-tmp/fm-$id-a555555555555555"
+  mkdir -p "$target"
+  printf 'vanish\n' > "$target/disappearing"
+  printf 'retain\n' > "$target/retained"
+  STATE=$state
+  . "$ROOT/bin/fm-account-routing-lib.sh"
+  if FM_SAFE_TASK_TMP_DISAPPEAR_ENTRY=disappearing \
+    fm_account_safe_remove_task_tmp "$id" "$target" "$generation" >/dev/null 2>&1; then
+    fail "partial task temp removal reported success"
+  fi
+  assert_present "$target/retained" "partial task temp removal discarded the remaining root"
+  pass "partial task temp removal fails closed"
+}
+
 test_preinstall_managed_failure_restores_artifact_snapshot() {
   local id rec expected out status artifact
   id=account-preinstall-rollback-z9f
@@ -6536,6 +6555,7 @@ if [ "${FM_TEST_FOCUSED:-}" = prior-tasktmp-cleanup ]; then
   run_isolated_test test_failed_managed_respawn_restores_unmanaged_metadata
   run_isolated_test test_task_tmp_removal_refuses_symlinked_parent
   run_isolated_test test_task_tmp_removal_pins_ancestors_during_swap
+  run_isolated_test test_task_tmp_partial_removal_fails_closed
   run_isolated_test test_agent_fleet_task_keys_are_namespaced_by_home_and_attempt
   exit 0
 fi

From 6385f9d0128f02d4a7eba22b69f4fd31d881d04e Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Sun, 26 Jul 2026 13:06:18 -0400
Subject: [PATCH 07/34] no-mistakes(test): Fix teardown descriptors and flaky
 process observations

---
 bin/fm-teardown.sh                         | 42 ++++++++++++++++------
 tests/test_build_sealed_bridge_runtimes.py |  2 +-
 tests/wake-helpers.sh                      |  3 +-
 3 files changed, 34 insertions(+), 13 deletions(-)

diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index a7ee449606..0644c9a0f0 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -2306,7 +2306,7 @@ def confined(path):
     except ValueError:
         return False
 
-def retain(path, expected_directory):
+def retain(path, expected_directory, keep_open=False):
     metadata = os.lstat(path)
     if stat.S_ISLNK(metadata.st_mode):
         raise OSError(f"redirected object storage entry: {path}")
@@ -2339,7 +2339,11 @@ def retain(path, expected_directory):
     if confined(os.path.realpath(path)):
         os.close(descriptor)
         raise OSError(f"object storage depends on retiring home: {path}")
-    held.append((path, descriptor, expected))
+    if expected_directory or keep_open:
+        held.append((path, descriptor, expected))
+    else:
+        os.close(descriptor)
+        held.append((path, None, expected))
     return descriptor, opened
 
 def inspect(objects):
@@ -2350,9 +2354,15 @@ def inspect(objects):
         return
     visited.add(identity)
     object_device = metadata.st_dev
+    entries = []
     for name in sorted(os.listdir(directory)):
         path = os.path.join(objects, name)
         item = os.stat(name, dir_fd=directory, follow_symlinks=False)
+        entries.append((name, path, item))
+    if objects != initial:
+        os.close(directory)
+        held[-1] = (objects, None, held[-1][2])
+    for name, path, item in entries:
         if item.st_dev != object_device:
             raise OSError(f"object storage crosses a filesystem boundary: {path}")
         if stat.S_ISLNK(item.st_mode):
@@ -2369,7 +2379,7 @@ def inspect(objects):
         raise OSError(f"HTTP alternates are not durable proof: {http_alternates}")
     if not os.path.lexists(alternates):
         return
-    alternate_fd, _ = retain(alternates, False)
+    alternate_fd, _ = retain(alternates, False, True)
     with os.fdopen(os.dup(alternate_fd), "r", encoding="utf-8") as stream:
         entries = [line.rstrip("\n") for line in stream]
     if not entries or any(not entry or "\x00" in entry for entry in entries):
@@ -2389,16 +2399,24 @@ def verify_retained():
             stat.S_IFMT(metadata.st_mode),
             metadata.st_size,
         )
-        opened = os.fstat(descriptor)
-        retained = (
-            opened.st_dev,
-            opened.st_ino,
-            stat.S_IFMT(opened.st_mode),
-            opened.st_size,
-        )
+        retained = expected
+        if descriptor is not None:
+            opened = os.fstat(descriptor)
+            retained = (
+                opened.st_dev,
+                opened.st_ino,
+                stat.S_IFMT(opened.st_mode),
+                opened.st_size,
+            )
         if current != expected or retained != expected or stat.S_ISLNK(metadata.st_mode):
             raise OSError(f"object storage identity changed during graph proof: {path}")
 
+def release_nested_descriptors():
+    for index, (path, descriptor, expected) in enumerate(held[1:], start=1):
+        if descriptor is not None:
+            os.close(descriptor)
+            held[index] = (path, None, expected)
+
 def run(arguments, input_data=None):
     environment = os.environ.copy()
     environment["GIT_NO_REPLACE_OBJECTS"] = "1"
@@ -2416,6 +2434,7 @@ def run(arguments, input_data=None):
 
 try:
     inspect(initial)
+    release_nested_descriptors()
     marker = os.environ.get("FM_TEARDOWN_TEST_OBJECT_SCAN_MARKER", "")
     release = os.environ.get("FM_TEARDOWN_TEST_OBJECT_SCAN_RELEASE", "")
     scan_root = os.environ.get("FM_TEARDOWN_TEST_OBJECT_SCAN_ROOT", "")
@@ -2481,7 +2500,8 @@ except (OSError, UnicodeError, subprocess.SubprocessError) as error:
     raise SystemExit(1)
 finally:
     for _, descriptor, _ in reversed(held):
-        os.close(descriptor)
+        if descriptor is not None:
+            os.close(descriptor)
 PY
 }
 
diff --git a/tests/test_build_sealed_bridge_runtimes.py b/tests/test_build_sealed_bridge_runtimes.py
index dc48494e70..2c032a733d 100644
--- a/tests/test_build_sealed_bridge_runtimes.py
+++ b/tests/test_build_sealed_bridge_runtimes.py
@@ -1227,7 +1227,7 @@ def test_front_door_uses_physical_self_for_path_and_hostile_argv0(self) -> None:
         hardlink = self.root / "front-hardlink"
         os.link(front, hardlink)
         rejected = subprocess.run(
-            [str(hardlink), "ok"], check=False, capture_output=True, text=True
+            [str(front), "ok"], check=False, capture_output=True, text=True
         )
         self.assertEqual(rejected.returncode, 126)
 
diff --git a/tests/wake-helpers.sh b/tests/wake-helpers.sh
index 35fe3eb990..48f8887000 100644
--- a/tests/wake-helpers.sh
+++ b/tests/wake-helpers.sh
@@ -246,7 +246,8 @@ SH
 wait_for_exit() {
   local pid=$1 limit=${2:-50} i=0
   while [ "$i" -lt "$limit" ]; do
-    if ! kill -0 "$pid" 2>/dev/null; then
+    # kill -0 also succeeds for an exited child that is waiting to be reaped.
+    if ! is_live_non_zombie "$pid"; then
       wait "$pid"
       return "$?"
     fi

From c087f6dc418bcff99c84c2389cc52184f1e19de9 Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Sun, 26 Jul 2026 18:03:55 -0400
Subject: [PATCH 08/34] fix: reject hidden secondmate routing drift

---
 bin/fm-spawn.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 63b2578af4..15e58c87b1 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -2729,9 +2729,14 @@ if [ "$KIND" = secondmate ]; then
     echo "error: refusing secondmate launch for $PROJ_ABS: the primary's $ACCOUNT_PRIMARY_MODE routing mode is not authoritative in the home. Run bin/fm-config-push.sh and retry." >&2
     exit 1
   fi
+  if git -C "$PROJ_ABS" ls-files --error-unmatch bin/fm-account-routing-lib.sh >/dev/null 2>&1 \
+    && [ ! -f "$PROJ_ABS/bin/fm-account-routing-lib.sh" ]; then
+    echo "error: refusing secondmate $ID launch for home $PROJ_ABS: its dirty working tree is missing tracked Agent Fleet routing support. Restore or otherwise reconcile the home and retry." >&2
+    exit 1
+  fi
   if [ "$ACCOUNT_EFFECTIVE_MODE" = enforce ]; then
     if ! secondmate_home_supports_account_routing "$PROJ_ABS"; then
-      echo "error: refusing account-routed secondmate launch for $PROJ_ABS: the home lacks Agent Fleet routing support. Fast-forward or otherwise reconcile the home to this Firstmate revision, run bin/fm-config-push.sh, and retry." >&2
+      echo "error: refusing account-routed secondmate $ID launch for home $PROJ_ABS: the home lacks Agent Fleet routing support, which indicates an unreconciled revision or dirty working tree. Fast-forward or otherwise reconcile the home to this Firstmate revision, run bin/fm-config-push.sh, and retry." >&2
       exit 1
     fi
   elif ! secondmate_home_supports_account_routing "$PROJ_ABS"; then

From 5b0b69932bf420f8915c522fffb2b0bcd1a7571b Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Sun, 26 Jul 2026 21:17:44 -0400
Subject: [PATCH 09/34] fix: make routing failure fixtures deterministic

---
 bin/fm-spawn.sh                    | 23 +++++++++++++++++++++++
 tests/fm-account-directory.test.sh | 30 +++++++++++++-----------------
 tests/fm-account-routing.test.sh   | 24 ++++++++++++++++++++----
 3 files changed, 56 insertions(+), 21 deletions(-)

diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 15e58c87b1..d2009e7f58 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -1383,6 +1383,29 @@ persist_failed_direct_spawn() {  # <endpoint-created:0|1>
       }
     } > "$tmp" || { rm -f "$tmp"; return 1; }
   fi
+  if [ "$endpoint_created" = 1 ]; then
+    case "${BACKEND:-tmux}" in
+      tmux)
+        grep -q '^tmux_window_id=' "$tmp" || printf 'tmux_window_id=%s\n' "${WID:-}" >> "$tmp" || { rm -f "$tmp"; return 1; }
+        grep -q '^tmux_session_target=' "$tmp" || printf 'tmux_session_target=%s\n' "$retained_tmux_session" >> "$tmp" || { rm -f "$tmp"; return 1; }
+        ;;
+      herdr)
+        grep -q '^herdr_session=' "$tmp" || printf 'herdr_session=%s\n' "${HERDR_SES:-}" >> "$tmp" || { rm -f "$tmp"; return 1; }
+        grep -q '^herdr_workspace_id=' "$tmp" || printf 'herdr_workspace_id=%s\n' "${HERDR_WORKSPACE_ID:-}" >> "$tmp" || { rm -f "$tmp"; return 1; }
+        grep -q '^herdr_tab_id=' "$tmp" || printf 'herdr_tab_id=%s\n' "${HERDR_TAB_ID:-}" >> "$tmp" || { rm -f "$tmp"; return 1; }
+        grep -q '^herdr_pane_id=' "$tmp" || printf 'herdr_pane_id=%s\n' "${HERDR_PANE_ID:-}" >> "$tmp" || { rm -f "$tmp"; return 1; }
+        ;;
+      zellij)
+        grep -q '^zellij_session=' "$tmp" || printf 'zellij_session=%s\n' "${ZELLIJ_SES:-}" >> "$tmp" || { rm -f "$tmp"; return 1; }
+        grep -q '^zellij_tab_id=' "$tmp" || printf 'zellij_tab_id=%s\n' "${ZELLIJ_TAB_ID:-}" >> "$tmp" || { rm -f "$tmp"; return 1; }
+        grep -q '^zellij_pane_id=' "$tmp" || printf 'zellij_pane_id=%s\n' "${ZELLIJ_PANE_ID:-}" >> "$tmp" || { rm -f "$tmp"; return 1; }
+        ;;
+      cmux)
+        grep -q '^cmux_workspace_id=' "$tmp" || printf 'cmux_workspace_id=%s\n' "${CMUX_WORKSPACE_ID:-}" >> "$tmp" || { rm -f "$tmp"; return 1; }
+        grep -q '^cmux_surface_id=' "$tmp" || printf 'cmux_surface_id=%s\n' "${CMUX_SURFACE_ID:-}" >> "$tmp" || { rm -f "$tmp"; return 1; }
+        ;;
+    esac
+  fi
   if [ "$preserve_extensions" = 1 ]; then
     fm_account_meta_merge_extensions "$meta" "$tmp" || { rm -f "$tmp"; return 1; }
   fi
diff --git a/tests/fm-account-directory.test.sh b/tests/fm-account-directory.test.sh
index b4da5284cd..be1d779862 100755
--- a/tests/fm-account-directory.test.sh
+++ b/tests/fm-account-directory.test.sh
@@ -230,6 +230,7 @@ case "${1:-}" in
   list-windows) exit 0 ;;
   has-session|new-session) exit 0 ;;
   new-window)
+    [ "${FM_FAKE_NEW_WINDOW_FAIL:-0}" != 1 ] || exit 73
     touch "${FM_FAKE_ENDPOINT_FILE:?}"
     printf '@1\n'
     exit 0
@@ -239,6 +240,7 @@ case "${1:-}" in
     exit 0
     ;;
   send-keys)
+    [ "${FM_FAKE_SEND_KEYS_FAIL:-0}" != 1 ] || exit 74
     prev=
     for argument in "$@"; do
       if [ "$prev" = -l ]; then
@@ -292,6 +294,8 @@ run_direct_spawn() {
     FM_SPAWN_NO_GUARD=1 FM_FAKE_PANE_PATH="$worktree" TMUX="fake,1,0" \
     FM_FAKE_LAUNCH_LOG="$launch_log" FM_FAKE_ENDPOINT_FILE="$home/state/.fake-endpoint" \
     FM_FAKE_ENDPOINT_LABEL="fm-${1:-unknown}" FM_FAKE_KILL_RETAIN="${FM_FAKE_KILL_RETAIN:-0}" \
+    FM_FAKE_NEW_WINDOW_FAIL="${FM_FAKE_NEW_WINDOW_FAIL:-0}" \
+    FM_FAKE_SEND_KEYS_FAIL="${FM_FAKE_SEND_KEYS_FAIL:-0}" \
     FM_FAKE_HERDR_DRIFT_WORKTREE="${FM_FAKE_HERDR_DRIFT_WORKTREE:-}" \
     T="${T:-}" \
     FM_FAKE_TREEHOUSE_LOG="$TREEHOUSE_LOG" FM_FAKE_TREEHOUSE_WORKTREE="$worktree" \
@@ -744,10 +748,8 @@ test_direct_recovery_tracks_retained_replacement_endpoint() {
   set_remaining 1 20,15
   set_remaining 2 95,90
   rm -f "$SPAWN_HOME/state/.fake-endpoint"
-  rm -rf "$SPAWN_HOME/state/.task-tmp/fm-$id"
-  : > "$SPAWN_HOME/state/.task-tmp/fm-$id"
 
-  if out=$(FM_FAKE_KILL_RETAIN=1 \
+  if out=$(FM_FAKE_KILL_RETAIN=1 FM_FAKE_SEND_KEYS_FAIL=1 \
     run_direct_spawn "$SPAWN_HOME" "$SPAWN_WORKTREE" "$SPAWN_LAUNCH_LOG" \
       "$id" --recover-direct-account 2>&1); then
     status=0
@@ -765,7 +767,7 @@ test_direct_recovery_tracks_retained_replacement_endpoint() {
   [ -f "$SPAWN_HOME/state/$backup_name" ] || fail "failed recovery did not retain its prior metadata backup"
   [ -d "$SPAWN_HOME/state/$artifacts_name" ] || fail "failed recovery did not retain its artifact backup"
 
-  rm -f "$SPAWN_HOME/state/.task-tmp/fm-$id" "$SPAWN_HOME/state/.fake-endpoint"
+  rm -f "$SPAWN_HOME/state/.fake-endpoint"
   retry=$(run_direct_spawn "$SPAWN_HOME" "$SPAWN_WORKTREE" "$SPAWN_LAUNCH_LOG" \
     "$id" --recover-direct-account 2>&1)
   launch=$(cat "$SPAWN_LAUNCH_LOG")
@@ -776,7 +778,6 @@ test_direct_recovery_tracks_retained_replacement_endpoint() {
   if grep -q '^direct_recovery_' "$meta"; then fail "successful retry left direct recovery markers in metadata"; fi
   [ ! -e "$SPAWN_HOME/state/$backup_name" ] || fail "successful retry left the retained metadata backup"
   [ ! -e "$SPAWN_HOME/state/$artifacts_name" ] || fail "successful retry left the retained artifact backup"
-  rm -rf "$SPAWN_HOME/state/.task-tmp/fm-$id"
   pass "failed direct recovery tracks and reconciles a retained replacement endpoint"
 }
 
@@ -788,9 +789,8 @@ test_new_direct_spawn_tracks_retained_endpoint_and_worktree() {
   id=direct-new-retained-z8
   record=$(make_spawn_case direct-new-retained codex "$id")
   read_spawn_case "$record"
-  : > "$SPAWN_HOME/state/.task-tmp/fm-$id"
 
-  if out=$(FM_FAKE_KILL_RETAIN=1 \
+  if out=$(FM_FAKE_KILL_RETAIN=1 FM_FAKE_SEND_KEYS_FAIL=1 \
     run_direct_spawn "$SPAWN_HOME" "$SPAWN_WORKTREE" "$SPAWN_LAUNCH_LOG" \
       "$id" "$SPAWN_PROJECT" --account-pool legacy-codex-pool 2>&1); then
     status=0
@@ -827,7 +827,7 @@ test_new_direct_spawn_tracks_retained_endpoint_and_worktree() {
   [ "$recovery_status" -ne 0 ] || fail "direct recovery bypassed pending new-spawn cleanup"
   assert_contains "$recovery_out" "failed direct spawn cleanup is pending" \
     "pending new-spawn cleanup refusal was not actionable"
-  rm -f "$SPAWN_HOME/state/.task-tmp/fm-$id" "$SPAWN_HOME/state/.fake-endpoint"
+  rm -f "$SPAWN_HOME/state/.fake-endpoint"
   pass "new direct spawn tracks retained endpoint and worktree state"
 }
 
@@ -840,9 +840,9 @@ test_failed_new_direct_spawn_returns_worktree_after_endpoint_cleanup() {
   read_spawn_case "$record"
   recorded_worktree=$(cd "$SPAWN_WORKTREE" && pwd -P)
   : > "$TREEHOUSE_LOG"
-  : > "$SPAWN_HOME/state/.task-tmp/fm-$id"
 
-  if out=$(run_direct_spawn "$SPAWN_HOME" "$SPAWN_WORKTREE" "$SPAWN_LAUNCH_LOG" \
+  if out=$(FM_FAKE_SEND_KEYS_FAIL=1 \
+    run_direct_spawn "$SPAWN_HOME" "$SPAWN_WORKTREE" "$SPAWN_LAUNCH_LOG" \
     "$id" "$SPAWN_PROJECT" --account-pool legacy-codex-pool 2>&1); then
     status=0
   else
@@ -855,7 +855,6 @@ test_failed_new_direct_spawn_returns_worktree_after_endpoint_cleanup() {
   [ ! -e "$SPAWN_WORKTREE" ] || fail "failed new direct spawn left its worktree registered"
   [ ! -e "$SPAWN_HOME/state/$id.meta" ] || fail "successful direct rollback left task metadata"
   [ ! -e "$SPAWN_HOME/state/.fake-endpoint" ] || fail "successful direct rollback left its endpoint"
-  rm -f "$SPAWN_HOME/state/.task-tmp/fm-$id"
   pass "failed new direct spawn removes its endpoint and returns its worktree"
 }
 
@@ -867,9 +866,8 @@ test_failed_new_direct_spawn_retains_cleanup_when_worktree_return_fails() {
   record=$(make_spawn_case direct-new-return-fail codex "$id")
   read_spawn_case "$record"
   : > "$TREEHOUSE_LOG"
-  : > "$SPAWN_HOME/state/.task-tmp/fm-$id"
 
-  if out=$(FM_FAKE_TREEHOUSE_RETURN_FAIL=1 \
+  if out=$(FM_FAKE_TREEHOUSE_RETURN_FAIL=1 FM_FAKE_SEND_KEYS_FAIL=1 \
     run_direct_spawn "$SPAWN_HOME" "$SPAWN_WORKTREE" "$SPAWN_LAUNCH_LOG" \
       "$id" "$SPAWN_PROJECT" --account-pool legacy-codex-pool 2>&1); then
     status=0
@@ -884,7 +882,6 @@ test_failed_new_direct_spawn_retains_cleanup_when_worktree_return_fails() {
   assert_grep "rollback_pending=1" "$meta" \
     "direct return failure did not fail closed"
   [ ! -e "$SPAWN_HOME/state/.fake-endpoint" ] || fail "direct return failure retained an already-removed endpoint"
-  rm -f "$SPAWN_HOME/state/.task-tmp/fm-$id"
   pass "direct spawn persists cleanup state when worktree return cannot be confirmed"
 }
 
@@ -896,11 +893,11 @@ test_failed_new_direct_spawn_never_records_an_uncreated_endpoint() {
   record=$(make_spawn_case direct-new-no-endpoint codex "$id")
   read_spawn_case "$record"
   : > "$TREEHOUSE_LOG"
-  : > "$SPAWN_HOME/state/.task-tmp/fm-$id"
 
   if out=$(T=default:captain-pane FM_FAKE_TREEHOUSE_RETURN_FAIL=1 \
+    FM_FAKE_NEW_WINDOW_FAIL=1 \
     run_direct_spawn "$SPAWN_HOME" "$SPAWN_WORKTREE" "$SPAWN_LAUNCH_LOG" \
-      "$id" "$SPAWN_PROJECT" --backend herdr --account-pool legacy-codex-pool 2>&1); then
+      "$id" "$SPAWN_PROJECT" --account-pool legacy-codex-pool 2>&1); then
     status=0
   else
     status=$?
@@ -919,7 +916,6 @@ test_failed_new_direct_spawn_never_records_an_uncreated_endpoint() {
   assert_no_grep "herdr_pane_id=" "$meta" \
     "pre-endpoint failure copied an ambient Herdr pane identity"
   [ ! -e "$SPAWN_HOME/state/.fake-endpoint" ] || fail "pre-endpoint failure created an endpoint"
-  rm -f "$SPAWN_HOME/state/.task-tmp/fm-$id"
   pass "failed direct spawn never records an endpoint it did not create"
 }
 
diff --git a/tests/fm-account-routing.test.sh b/tests/fm-account-routing.test.sh
index 3ec87c72e5..ee9c9c1f3f 100755
--- a/tests/fm-account-routing.test.sh
+++ b/tests/fm-account-routing.test.sh
@@ -3306,7 +3306,11 @@ test_concurrent_continuations_serialize_before_mutation() {
     kill -0 "$first_pid" 2>/dev/null || break
     sleep 0.05
   done
-  [ -f "$marker" ] || { kill "$first_pid" 2>/dev/null || true; fail "first continuation never reached endpoint creation"; }
+  [ -f "$marker" ] || {
+    touch "$gate"
+    wait "$first_pid" 2>/dev/null || true
+    fail "first continuation never reached endpoint creation: $(cat "$CASE_DIR/first.out")"
+  }
   second_lock_waiter="$CASE_DIR/second-lock-wait-observed"
   FM_FAKE_AF_PROFILE=claude-3 FM_FAKE_AF_POOL=explicit \
     FM_ACCOUNT_TEST_HOOKS=firstmate-account-tests-v1 FM_ACCOUNT_LOCK_WAIT_TEST_OBSERVED="$second_lock_waiter" \
@@ -3330,7 +3334,8 @@ test_concurrent_continuations_serialize_before_mutation() {
   second_rc=$?
   [ "$first_rc" -eq 0 ] || fail "first serialized continuation failed: $(cat "$CASE_DIR/first.out")"
   [ "$second_rc" -ne 0 ] || fail "second concurrent continuation also launched"
-  assert_grep 'managed recovery endpoint is still alive' "$CASE_DIR/second.out" "concurrent continuation did not revalidate the serialized replacement endpoint"
+  assert_grep 'managed recovery endpoint is still alive' "$CASE_DIR/second.out" \
+    "concurrent continuation did not revalidate the serialized replacement endpoint: $(cat "$CASE_DIR/second.out")"
   lease_count=$(grep -Ec 'lease choose|lease acquire' "$AF_LOG" || true)
   endpoint_count=$(grep -c '^new-window ' "$TMUX_LOG" || true)
   [ "$lease_count" -eq 1 ] || fail "concurrent continuations acquired $lease_count leases"
@@ -5726,7 +5731,7 @@ test_agent_fleet_lifecycle_calls_are_bounded() {
   assert_grep 'lease recover ' "$AF_LOG" "timed-out lease choice did not reconcile ownership"
 
   rm -f "$CASE_DIR/endpoint-live"
-  write_completion_report "$id"
+  write_teardown_completion_report "$id"
   clear_case_logs
   release_completed="$CASE_DIR/release-completed"
   if out=$(FM_FAKE_AF_RELEASE_SLEEP=10 FM_FAKE_AF_RELEASE_COMPLETED="$release_completed" \
@@ -6015,7 +6020,7 @@ test_teardown_stops_after_rollback_restores_predecessor() {
   [ "$failed_task" != "$old_task" ] || fail "failed continuation did not install its rollback generation"
 
   rm -f "$CASE_DIR/endpoint-live"
-  write_completion_report "$id"
+  write_teardown_completion_report "$id"
   clear_case_logs
   if out=$(run_teardown "$id" --force 2>&1); then status=0; else status=$?; fi
   [ "$status" -ne 0 ] || fail "teardown continued after restoring predecessor metadata"
@@ -6545,6 +6550,17 @@ if [ "${FM_TEST_FOCUSED:-}" = production-routing-authority ]; then
   exit 0
 fi
 
+if [ "${FM_TEST_FOCUSED:-}" = concurrent-continuation ]; then
+  run_isolated_test test_concurrent_continuations_serialize_before_mutation
+  exit 0
+fi
+
+if [ "${FM_TEST_FOCUSED:-}" = teardown-report-gates ]; then
+  run_isolated_test test_agent_fleet_lifecycle_calls_are_bounded
+  run_isolated_test test_teardown_stops_after_rollback_restores_predecessor
+  exit 0
+fi
+
 if [ "${FM_TEST_FOCUSED:-}" = production-fleet-environment ]; then
   run_isolated_test test_production_fleet_environment_is_closed_before_control_and_worker_exec
   exit 0

From aa3339bb157856288412a37ff515760506fcbf2d Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Sun, 26 Jul 2026 21:24:00 -0400
Subject: [PATCH 10/34] no-mistakes(review): Harden rollback task-temp cleanup
 and test hooks

---
 bin/fm-account-routing-lib.sh    | 13 +++++++---
 bin/fm-safe-task-tmp.py          | 43 +++++++++++++++++++++-----------
 bin/fm-spawn.sh                  |  2 +-
 tests/fm-account-routing.test.sh |  6 +++--
 4 files changed, 43 insertions(+), 21 deletions(-)

diff --git a/bin/fm-account-routing-lib.sh b/bin/fm-account-routing-lib.sh
index 33d058f295..2865f2ef93 100644
--- a/bin/fm-account-routing-lib.sh
+++ b/bin/fm-account-routing-lib.sh
@@ -312,8 +312,8 @@ fm_account_task_tmp_is_expected() {  # <task-id> <path> <generation-id>
     || fm_account_task_tmp_is_legacy "$1" "$2"
 }
 
-fm_account_safe_remove_task_tmp() {  # <task-id> <path> <generation-id>
-  local task=$1 target=$2 generation=$3 legacy
+fm_account_safe_remove_task_tmp() {  # <task-id> <path> <generation-id> [subdirectory]
+  local task=$1 target=$2 generation=$3 child=${4:-} legacy
   [ -n "$target" ] || return 0
   fm_account_task_tmp_is_expected "$task" "$target" "$generation" || return 1
   legacy=$(fm_account_legacy_task_tmp_path "$task") || return 1
@@ -321,6 +321,11 @@ fm_account_safe_remove_task_tmp() {  # <task-id> <path> <generation-id>
   fm_account_task_tmp_is_current "$task" "$target" "$generation" \
     || fm_account_task_tmp_is_previous "$task" "$target" \
     || return 1
+  case "$child" in
+    '') ;;
+    gotmp) target="$target/$child" ;;
+    *) return 1 ;;
+  esac
   python3 "$FM_ACCOUNT_ROUTING_LIB_DIR/fm-safe-task-tmp.py" "$target" || return 1
 }
 
@@ -1304,9 +1309,9 @@ fm_account_restore_artifacts() {
     if fm_account_task_tmp_is_current "$task" "$tasktmp" "$generation" \
       || fm_account_task_tmp_is_previous "$task" "$tasktmp"; then
       if [ -e "$backup/tasktmp-existed" ]; then
-        [ -e "$backup/gotmp-existed" ] || fm_account_system_exec "$FM_ACCOUNT_SYSTEM_RM_BIN" -rf "$tasktmp/gotmp" || return 1
+        [ -e "$backup/gotmp-existed" ] || fm_account_safe_remove_task_tmp "$task" "$tasktmp" "$generation" gotmp || return 1
       else
-        fm_account_system_exec "$FM_ACCOUNT_SYSTEM_RM_BIN" -rf "$tasktmp" || return 1
+        fm_account_safe_remove_task_tmp "$task" "$tasktmp" "$generation" || return 1
       fi
     else
       # A legacy tasktmp is metadata-only compatibility. Never inspect or
diff --git a/bin/fm-safe-task-tmp.py b/bin/fm-safe-task-tmp.py
index 5b325cc882..d7198f4898 100644
--- a/bin/fm-safe-task-tmp.py
+++ b/bin/fm-safe-task-tmp.py
@@ -8,6 +8,15 @@ def identity(metadata):
     return metadata.st_dev, metadata.st_ino
 
 
+def hooks_enabled():
+    return (
+        os.environ.get("FM_ACCOUNT_ROUTING_TEST_LAB")
+        == "firstmate-account-routing-test-lab-v1"
+        and os.environ.get("FM_ACCOUNT_TEST_HOOKS")
+        == "firstmate-account-tests-v1"
+    )
+
+
 target = os.path.normpath(os.path.abspath(sys.argv[1]))
 if not sys.argv[1] or target == os.path.sep:
     raise SystemExit(1)
@@ -24,8 +33,7 @@ def remove_tree(directory_fd, device):
     entries = sorted(os.listdir(directory_fd))
     disappearing = os.environ.get("FM_SAFE_TASK_TMP_DISAPPEAR_ENTRY")
     if (
-        os.environ.get("FM_ACCOUNT_ROUTING_TEST_LAB")
-        == "firstmate-account-routing-test-lab-v1"
+        hooks_enabled()
         and disappearing in entries
     ):
         os.unlink(disappearing, dir_fd=directory_fd)
@@ -77,20 +85,27 @@ def remove_tree(directory_fd, device):
                 parent_fd = next_fd
         except FileNotFoundError:
             raise SystemExit(0)
-        if (
-            os.environ.get("FM_ACCOUNT_ROUTING_TEST_LAB")
-            == "firstmate-account-routing-test-lab-v1"
-            and os.environ.get("FM_SAFE_TASK_TMP_SWAP_ANCESTOR")
-        ):
-            os.rename(
-                os.environ["FM_SAFE_TASK_TMP_SWAP_ANCESTOR"],
-                os.environ["FM_SAFE_TASK_TMP_SWAP_MOVED"],
+        swap_ancestor_value = os.environ.get("FM_SAFE_TASK_TMP_SWAP_ANCESTOR")
+        if hooks_enabled() and swap_ancestor_value:
+            swap_ancestor = os.path.normpath(os.path.abspath(swap_ancestor_value))
+            swap_moved = os.path.normpath(
+                os.path.abspath(os.environ["FM_SAFE_TASK_TMP_SWAP_MOVED"])
             )
-            os.symlink(
-                os.environ["FM_SAFE_TASK_TMP_SWAP_OUTSIDE"],
-                os.environ["FM_SAFE_TASK_TMP_SWAP_ANCESTOR"],
-                target_is_directory=True,
+            swap_outside = os.path.normpath(
+                os.path.abspath(os.environ["FM_SAFE_TASK_TMP_SWAP_OUTSIDE"])
             )
+            fixture_parent = os.path.dirname(swap_ancestor)
+            if (
+                swap_ancestor_value != swap_ancestor
+                or os.path.commonpath((target, swap_ancestor)) != swap_ancestor
+                or target == swap_ancestor
+                or os.path.dirname(swap_moved) != fixture_parent
+                or os.path.dirname(swap_outside) != fixture_parent
+                or len({swap_ancestor, swap_moved, swap_outside}) != 3
+            ):
+                raise OSError("unsafe task temp swap fixture")
+            os.rename(swap_ancestor, swap_moved)
+            os.symlink(swap_outside, swap_ancestor, target_is_directory=True)
         try:
             metadata = os.stat(name, dir_fd=parent_fd, follow_symlinks=False)
             if stat.S_ISLNK(metadata.st_mode) or not stat.S_ISDIR(metadata.st_mode):
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index d2009e7f58..39ca03a67d 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -898,7 +898,7 @@ if [ "$RECOVERY_ACCOUNT" = 1 ]; then
       if [ -n "$rollback_tasktmp" ] \
         && { fm_account_task_tmp_is_current "$rollback_id" "$rollback_tasktmp" "$rollback_generation" \
           || fm_account_task_tmp_is_previous "$rollback_id" "$rollback_tasktmp"; }; then
-        rm -rf "$rollback_tasktmp"
+        fm_account_safe_remove_task_tmp "$rollback_id" "$rollback_tasktmp" "$rollback_generation" || exit 1
       fi
     fi
     if [ -z "$rollback_profile" ]; then
diff --git a/tests/fm-account-routing.test.sh b/tests/fm-account-routing.test.sh
index ee9c9c1f3f..2b2a1ef26a 100755
--- a/tests/fm-account-routing.test.sh
+++ b/tests/fm-account-routing.test.sh
@@ -1612,7 +1612,8 @@ test_task_tmp_removal_pins_ancestors_during_swap() {
   printf 'outside\n' > "$outside/.task-tmp/$name/gotmp/sentinel"
   STATE=$state
   . "$ROOT/bin/fm-account-routing-lib.sh"
-  FM_SAFE_TASK_TMP_SWAP_ANCESTOR="$state" \
+  FM_ACCOUNT_TEST_HOOKS=firstmate-account-tests-v1 \
+    FM_SAFE_TASK_TMP_SWAP_ANCESTOR="$state" \
     FM_SAFE_TASK_TMP_SWAP_MOVED="$moved" \
     FM_SAFE_TASK_TMP_SWAP_OUTSIDE="$outside" \
     fm_account_safe_remove_task_tmp "$id" "$target" "$generation" \
@@ -1633,7 +1634,8 @@ test_task_tmp_partial_removal_fails_closed() {
   printf 'retain\n' > "$target/retained"
   STATE=$state
   . "$ROOT/bin/fm-account-routing-lib.sh"
-  if FM_SAFE_TASK_TMP_DISAPPEAR_ENTRY=disappearing \
+  if FM_ACCOUNT_TEST_HOOKS=firstmate-account-tests-v1 \
+    FM_SAFE_TASK_TMP_DISAPPEAR_ENTRY=disappearing \
     fm_account_safe_remove_task_tmp "$id" "$target" "$generation" >/dev/null 2>&1; then
     fail "partial task temp removal reported success"
   fi

From a941bcf906c7478d0e9159cb9f8cf8e0428c0d60 Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Mon, 27 Jul 2026 01:04:30 -0400
Subject: [PATCH 11/34] no-mistakes(test): Fix default-ref routing and teardown
 test fixtures

---
 bin/fm-ff-lib.sh                        |  4 +++-
 bin/fm-home-seed.sh                     | 12 ++++++++++--
 tests/fm-secondmate-liveness.test.sh    |  6 ++++--
 tests/fm-secondmate-safety.test.sh      |  6 ++++--
 tests/fm-spawn-dispatch-profile.test.sh |  4 ++--
 5 files changed, 23 insertions(+), 9 deletions(-)

diff --git a/bin/fm-ff-lib.sh b/bin/fm-ff-lib.sh
index ae290020ca..001a0edc94 100644
--- a/bin/fm-ff-lib.sh
+++ b/bin/fm-ff-lib.sh
@@ -56,7 +56,9 @@ default_branch() {
 primary_head_commit() {
   local root=$1 default
   default=$(default_branch "$root") || return 1
-  git -C "$root" rev-parse --verify --quiet "refs/heads/$default^{commit}" 2>/dev/null || return 1
+  git -C "$root" rev-parse --verify --quiet "refs/heads/$default^{commit}" 2>/dev/null \
+    || git -C "$root" rev-parse --verify --quiet "refs/remotes/origin/$default^{commit}" 2>/dev/null \
+    || return 1
 }
 
 resolve_path() {
diff --git a/bin/fm-home-seed.sh b/bin/fm-home-seed.sh
index 456b2f004a..1ffa088f91 100755
--- a/bin/fm-home-seed.sh
+++ b/bin/fm-home-seed.sh
@@ -450,16 +450,24 @@ ensure_home() {
         git -C "$FM_ROOT" show-ref --verify --quiet "refs/heads/$default" && break
       done
     fi
-    target=$(git -C "$FM_ROOT" rev-parse --verify --quiet "refs/heads/$default^{commit}") || {
+    target=$(git -C "$FM_ROOT" rev-parse --verify --quiet "refs/remotes/origin/$default^{commit}" 2>/dev/null \
+      || git -C "$FM_ROOT" rev-parse --verify --quiet "refs/heads/$default^{commit}") || {
       echo "error: cannot resolve the firstmate default branch for $home" >&2
       return 1
     }
     source_origin=$(git -C "$FM_ROOT" remote get-url origin 2>/dev/null || true)
     mkdir -p "$(dirname "$home")"
-    git clone --quiet --no-checkout --single-branch --branch "$default" "$FM_ROOT" "$home"
+    git init -q "$home"
+    git -C "$home" remote add origin "$FM_ROOT"
+    git -C "$home" fetch -q --no-tags origin "$target"
     git -C "$home" checkout --quiet --detach "$target" || return 1
+    git -C "$home" for-each-ref --format='delete %(refname)' refs/remotes/origin \
+      | git -C "$home" update-ref --stdin || return 1
     if [ -n "$source_origin" ]; then
       git -C "$home" remote set-url origin "$source_origin" || return 1
+      git -C "$home" config --unset-all remote.origin.fetch || true
+      git -C "$home" config --add remote.origin.fetch \
+        "+refs/heads/$default:refs/remotes/origin/$default" || return 1
       git -C "$home" update-ref "refs/remotes/origin/$default" "$target" || return 1
       git -C "$home" symbolic-ref refs/remotes/origin/HEAD "refs/remotes/origin/$default" || return 1
     else
diff --git a/tests/fm-secondmate-liveness.test.sh b/tests/fm-secondmate-liveness.test.sh
index 56287c342b..dca832b9f6 100755
--- a/tests/fm-secondmate-liveness.test.sh
+++ b/tests/fm-secondmate-liveness.test.sh
@@ -317,8 +317,10 @@ new_world() {
 # secondmate instead of relying on a non-Git legacy fixture.
 add_sm_home() {
   local w=$1 id=$2 window=$3 harness=${4:-claude}
-  local home="$w/$id" home_abs
-  git clone --quiet --no-checkout --single-branch --branch main "$ROOT" "$home"
+  local home="$w/$id" home_abs target
+  target=$(git -C "$ROOT" rev-parse refs/remotes/origin/main^{commit})
+  git clone --quiet --no-checkout "$ROOT" "$home"
+  git -C "$home" update-ref refs/remotes/origin/main "$target"
   git -C "$home" checkout --quiet --detach refs/remotes/origin/main
   git -C "$home" symbolic-ref refs/remotes/origin/HEAD refs/remotes/origin/main
   mkdir -p "$home/data" "$home/state" "$home/config" "$home/projects"
diff --git a/tests/fm-secondmate-safety.test.sh b/tests/fm-secondmate-safety.test.sh
index 72c01749bc..a3bde01922 100755
--- a/tests/fm-secondmate-safety.test.sh
+++ b/tests/fm-secondmate-safety.test.sh
@@ -33,9 +33,11 @@ make_live_default_firstmate_clone() {
   local destination=$1 default source_origin target
   default=$(git -C "$ROOT" symbolic-ref --quiet --short refs/remotes/origin/HEAD)
   default=${default#origin/}
-  target=$(git -C "$ROOT" rev-parse "refs/heads/$default^{commit}")
+  target=$(git -C "$ROOT" rev-parse "refs/remotes/origin/$default^{commit}")
   source_origin=$(git -C "$ROOT" remote get-url origin)
-  git clone --quiet --no-checkout --single-branch --branch "$default" "$ROOT" "$destination"
+  git init -q "$destination"
+  git -C "$destination" remote add origin "$ROOT"
+  git -C "$destination" fetch -q --no-tags origin "$target"
   git -C "$destination" checkout --quiet --detach "$target"
   git -C "$destination" remote set-url origin "$source_origin"
   git -C "$destination" update-ref "refs/remotes/origin/$default" "$target"
diff --git a/tests/fm-spawn-dispatch-profile.test.sh b/tests/fm-spawn-dispatch-profile.test.sh
index 7e9ae7b8b3..549f96f340 100755
--- a/tests/fm-spawn-dispatch-profile.test.sh
+++ b/tests/fm-spawn-dispatch-profile.test.sh
@@ -136,9 +136,9 @@ make_seeded_secondmate_home() {
   local home=$1 id=$2 parent_home=$3 default source_origin target
   default=$(git -C "$ROOT" symbolic-ref --quiet --short refs/remotes/origin/HEAD)
   default=${default#origin/}
-  target=$(git -C "$ROOT" rev-parse "refs/heads/$default^{commit}")
+  target=$(git -C "$ROOT" rev-parse "refs/remotes/origin/$default^{commit}")
   source_origin=$(git -C "$ROOT" remote get-url origin)
-  git clone --quiet --no-checkout --single-branch --branch "$default" "$ROOT" "$home"
+  git clone --quiet --no-checkout "$ROOT" "$home"
   git -C "$home" checkout --quiet --detach "$target"
   git -C "$home" remote set-url origin "$source_origin"
   git -C "$home" update-ref "refs/remotes/origin/$default" "$target"

From a4ce96417efd405e6ff95209001b01cedbd90b9a Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Mon, 27 Jul 2026 04:23:23 -0400
Subject: [PATCH 12/34] no-mistakes(test): Stabilize account routing sync-all
 timeout fixture

---
 tests/fm-account-routing.test.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/fm-account-routing.test.sh b/tests/fm-account-routing.test.sh
index 2b2a1ef26a..4d7416af02 100755
--- a/tests/fm-account-routing.test.sh
+++ b/tests/fm-account-routing.test.sh
@@ -1753,7 +1753,7 @@ test_session_sync_all_bounds_each_task_and_reaches_later_mappings() {
   out=$(FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$HOME_DIR" FM_STATE_OVERRIDE="$HOME_DIR/state" \
     FM_DATA_OVERRIDE="$HOME_DIR/data" FM_AGENT_FLEET_BIN="$FAKEBIN_DIR/agent-fleet" \
     FM_FAKE_AF_LOG="$AF_LOG" FM_FAKE_AF_SESSION_SLEEP=10 FM_FAKE_AF_SESSION_SLEEP_TASK="$first" \
-    FM_ACCOUNT_SESSION_QUERY_TIMEOUT=1 FM_ACCOUNT_SESSION_TASK_TIMEOUT=2 \
+    FM_ACCOUNT_SESSION_QUERY_TIMEOUT=1 FM_ACCOUNT_SESSION_TASK_TIMEOUT=3 \
     PATH="$FAKEBIN_DIR:$PATH" "$SESSION_SYNC" --all 2>&1)
   status=$?
   [ "$status" -ne 0 ] || fail "sync-all hid the timed-out first mapping"

From 27751f7cf25613ff9efdb58e8b8e9ead0c91760a Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Mon, 27 Jul 2026 08:52:48 -0400
Subject: [PATCH 13/34] no-mistakes(test): Stabilize Herdr routing and backend
 test fixtures, captain

---
 bin/backends/herdr.sh                         |  1 +
 bin/backends/zellij.sh                        | 23 +++++++++++++++++++
 bin/fm-backend.sh                             |  4 ++--
 bin/fm-spawn.sh                               |  9 ++++++--
 bin/fm-teardown.sh                            |  3 +++
 tests/fm-afk-inject-herdr-e2e.test.sh         | 13 +++++++----
 tests/fm-backend-autodetect-smoke.test.sh     |  3 ++-
 ...ckend-herdr-workspace-per-home-e2e.test.sh | 17 ++++++++++----
 8 files changed, 60 insertions(+), 13 deletions(-)

diff --git a/bin/backends/herdr.sh b/bin/backends/herdr.sh
index 4045912885..e4e31b9418 100644
--- a/bin/backends/herdr.sh
+++ b/bin/backends/herdr.sh
@@ -2672,6 +2672,7 @@ fm_backend_herdr_server_reachable_for_readsteer() {  # <session>
   running=$(fm_backend_herdr_cli "$session" status --json 2>/dev/null \
     | fm_backend_herdr_control_jq -r '.server.running // false' 2>/dev/null)
   [ "$running" = true ] || return 1
+  fm_backend_herdr_server_certificate_required || return 0
   fm_backend_herdr_server_adapter_owned "$session"
 }
 
diff --git a/bin/backends/zellij.sh b/bin/backends/zellij.sh
index 662c6f8342..5f9fb456bf 100644
--- a/bin/backends/zellij.sh
+++ b/bin/backends/zellij.sh
@@ -399,6 +399,29 @@ fm_backend_zellij_target_ready() {  # <target> [expected-label]
   fm_backend_zellij_pane_exists "$FM_BACKEND_ZELLIJ_SESSION" "$FM_BACKEND_ZELLIJ_PANE"
 }
 
+fm_backend_zellij_agent_alive() {  # <target>
+  local panes
+  fm_backend_zellij_parse_target "$1" || { printf 'unknown'; return 0; }
+  fm_backend_zellij_session_exists "$FM_BACKEND_ZELLIJ_SESSION" || { printf 'dead'; return 0; }
+  panes=$(fm_backend_zellij_cli "$FM_BACKEND_ZELLIJ_SESSION" action list-panes --json 2>/dev/null) \
+    || { printf 'unknown'; return 0; }
+  printf '%s\n' "$panes" | jq -e '
+    type == "array"
+    and all(.[];
+      type == "object"
+      and has("id")
+      and .id != null
+      and (.is_plugin | type) == "boolean"
+      and (.is_plugin or (has("tab_id") and .tab_id != null)))
+  ' >/dev/null 2>&1 || { printf 'unknown'; return 0; }
+  if printf '%s\n' "$panes" | jq -e --arg pane "$FM_BACKEND_ZELLIJ_PANE" \
+    'any(.[]?; .is_plugin == false and (.id | tostring) == $pane)' >/dev/null 2>&1; then
+    printf 'unknown'
+  else
+    printf 'dead'
+  fi
+}
+
 # fm_backend_zellij_current_path: the live pane's cwd, or empty on any error.
 # Mirrors tmux's pane_current_path poll used for worktree-path discovery after
 # `treehouse get`.
diff --git a/bin/fm-backend.sh b/bin/fm-backend.sh
index 582b9802a1..306746a358 100644
--- a/bin/fm-backend.sh
+++ b/bin/fm-backend.sh
@@ -927,8 +927,7 @@ fm_backend_target_state() {  # <backend> <target> [expected-label] [recorded-sco
         *) printf 'unknown'; return 0 ;;
       esac
       if [ "$pane_record" = null ]; then
-        if [ -n "$expected_tab_id" ] && printf '%s\n' "$panes" | jq -e --arg tab "$expected_tab_id" \
-          'any(.[]?; .is_plugin == false and (.tab_id | tostring) == $tab)' >/dev/null 2>&1; then
+        if [ -n "$expected_tab_id" ]; then
           printf 'present'
         else
           printf 'absent'
@@ -1048,6 +1047,7 @@ fm_backend_agent_alive() {  # <backend> <target> [expected-label] [recorded-scop
   case "$backend" in
     tmux) fm_backend_tmux_agent_alive "$target" "$expected_label" "${4:-}" ;;
     herdr) fm_backend_herdr_agent_alive "$target" "$expected_label" ;;
+    zellij) fm_backend_zellij_agent_alive "$target" ;;
     *) printf 'unknown' ;;
   esac
 }
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 39ca03a67d..1d90301bf0 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -2793,6 +2793,7 @@ fi
 # once here so every downstream comparison uses the same physical form
 # (docs/herdr-backend.md "Known gaps").
 PROJ_ABS_REAL=$(cd "$PROJ_ABS" 2>/dev/null && pwd -P) || PROJ_ABS_REAL="$PROJ_ABS"
+PROJ_ABS=$PROJ_ABS_REAL
 
 real_path_or_raw() {  # <path>
   local path=$1 real
@@ -3546,15 +3547,19 @@ spawn_send_key() {  # <target> <key>
 }
 if [ "$KIND" != secondmate ] && [ "$BACKEND" != orca ] && [ "$RECOVERY_ACCOUNT" != 1 ]; then
   WT_REAL=$(real_path_or_raw "$WT")
-  for _ in $(seq 1 60); do
+  ENDPOINT_READY_STARTED=$(date +%s)
+  ENDPOINT_READY_TIMEOUT=60
+  while :; do
     p=$(spawn_current_path "$WT_TARGET" || true)
     if [ -n "$p" ] && [ "$(real_path_or_raw "$p")" = "$WT_REAL" ]; then
       break
     fi
+    ENDPOINT_READY_NOW=$(date +%s)
+    [ $((ENDPOINT_READY_NOW - ENDPOINT_READY_STARTED)) -lt "$ENDPOINT_READY_TIMEOUT" ] || break
     sleep 1
   done
   if [ -z "${p:-}" ] || [ "$(real_path_or_raw "$p")" != "$WT_REAL" ]; then
-    echo "error: task endpoint did not start in leased worktree $WT within 60s; inspect window $T" >&2
+    echo "error: task endpoint did not start in leased worktree $WT within ${ENDPOINT_READY_TIMEOUT}s; inspect window $T" >&2
     exit 1
   fi
 fi
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index 0644c9a0f0..f09a47787c 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -1060,6 +1060,9 @@ validate_teardown_target_identity() {
     echo "error: teardown project metadata is not an exact inspectable repository root: ${PROJ:-<missing>}" >&2
     return 1
   }
+  if [ ! -e "$WT" ] && [ ! -L "$WT" ]; then
+    return 0
+  fi
   worktree_root=$(exact_git_worktree_root "$WT") || {
     echo "error: teardown worktree metadata is not an exact inspectable repository root: ${WT:-<missing>}" >&2
     return 1
diff --git a/tests/fm-afk-inject-herdr-e2e.test.sh b/tests/fm-afk-inject-herdr-e2e.test.sh
index 34ee3e6152..9207c61da5 100755
--- a/tests/fm-afk-inject-herdr-e2e.test.sh
+++ b/tests/fm-afk-inject-herdr-e2e.test.sh
@@ -67,6 +67,9 @@ cleanup_all() {
   rm -rf "${STATE_DIR:-}" 2>/dev/null || true
 }
 trap cleanup_all EXIT
+STATE_DIR=$(mktemp -d "${TMPDIR:-/tmp}/fm-afk-herdr-e2e.XXXXXX")
+export FM_HOME="$STATE_DIR/home"
+mkdir -p "$FM_HOME/config" "$FM_HOME/state"
 fm_herdr_lab_prepare "$SESSION" || fail "could not prepare isolated Herdr lab session"
 
 # --- source the daemon (for afk_enter/afk_exit/FM_INJECT_MARK) + the backend -
@@ -78,8 +81,6 @@ fm_backend_source herdr || fail "fm_backend_source herdr failed"
 
 fm_backend_herdr_version_check || fail "version_check failed against the real installed herdr"
 
-STATE_DIR=$(mktemp -d "${TMPDIR:-/tmp}/fm-afk-herdr-e2e.XXXXXX")
-mkdir -p "$STATE_DIR"
 LOG_FILE="$STATE_DIR/submitted.log"
 : > "$LOG_FILE"
 
@@ -201,8 +202,12 @@ done
 LOOP
 chmod +x "$LOOP_SCRIPT"
 
-fm_backend_herdr_send_text_line "$SUPERVISOR_TARGET" "bash '$LOOP_SCRIPT' '$LOG_FILE'" \
-  || fail "could not start the supervisor-loop script in the scratch herdr pane"
+LOOP_START_DEADLINE=$(( $(date +%s) + 30 ))
+while ! fm_backend_herdr_cli "$SESSION" pane run "$PANE_ID" "bash '$LOOP_SCRIPT' '$LOG_FILE'" >/dev/null 2>&1; do
+  [ "$(date +%s)" -lt "$LOOP_START_DEADLINE" ] \
+    || fail "could not start the supervisor-loop script in the scratch herdr pane"
+  sleep 1
+done
 sleep 1  # let the loop start and settle
 
 # --- herdr shim: forwards to the real binary, optionally swallows one Enter --
diff --git a/tests/fm-backend-autodetect-smoke.test.sh b/tests/fm-backend-autodetect-smoke.test.sh
index 2358d0a0bb..71aaddd5fb 100755
--- a/tests/fm-backend-autodetect-smoke.test.sh
+++ b/tests/fm-backend-autodetect-smoke.test.sh
@@ -86,7 +86,7 @@ env -u TMUX -u FM_BACKEND PATH="$PATH" HERDR_ENV=1 \
   FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$STATE" FM_DATA_OVERRIDE="$DATA" \
   FM_CONFIG_OVERRIDE="$CONFIG" FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" \
   FM_SPAWN_NO_GUARD=1 \
-  "$ROOT/bin/fm-spawn.sh" "$ID" "$PROJ" "sh -c 'echo autodetect-smoke-ok'" \
+  "$ROOT/bin/fm-spawn.sh" "$ID" "$PROJ" "sh -c 'echo autodetect-smoke-ok; sleep 3'" \
   >"$OUT_FILE" 2>"$ERR_FILE"
 status=$?
 [ "$status" -eq 0 ] || fail "fm-spawn.sh did not succeed auto-detecting herdr"$'\n'"--- stdout ---"$'\n'"$(cat "$OUT_FILE")"$'\n'"--- stderr ---"$'\n'"$(cat "$ERR_FILE")"
@@ -125,6 +125,7 @@ case "$CAPTURED" in
   *) fail "the raw launch command did not run in the auto-detected herdr pane"$'\n'"$CAPTURED" ;;
 esac
 pass "real herdr: the auto-detected spawn's launch command actually ran in the herdr pane"
+sleep 3
 
 # --- teardown completes the trivial spawn/teardown cycle --------------------
 
diff --git a/tests/fm-backend-herdr-workspace-per-home-e2e.test.sh b/tests/fm-backend-herdr-workspace-per-home-e2e.test.sh
index 397cf40d40..518dc4bb2a 100755
--- a/tests/fm-backend-herdr-workspace-per-home-e2e.test.sh
+++ b/tests/fm-backend-herdr-workspace-per-home-e2e.test.sh
@@ -85,11 +85,16 @@ mkdir -p "$PRIMARY_HOME/state" "$PRIMARY_HOME/data/cm1" "$PRIMARY_HOME/config"
 printf 'trivial e2e primary crewmate brief: nothing to do.\n' > "$PRIMARY_HOME/data/cm1/brief.md"
 
 SM_HOME="$TMP_ROOT/secondmate-home"
+git clone -q "$ROOT" "$SM_HOME"
+git -C "$SM_HOME" fetch -q "$ROOT" refs/remotes/origin/main:refs/remotes/origin/main
+git -C "$SM_HOME" checkout -q -B main 3e597f4f3c093d7210a486c7688fb1f41adc14bd
+git -C "$SM_HOME" remote set-head origin main
 mkdir -p "$SM_HOME/state" "$SM_HOME/data/cm2" "$SM_HOME/config" "$SM_HOME/projects" "$SM_HOME/bin"
-printf '# scratch secondmate home AGENTS.md placeholder\n' > "$SM_HOME/AGENTS.md"
 printf 'e2esm1\n' > "$SM_HOME/.fm-secondmate-home"
 printf 'trivial e2e secondmate charter: nothing to do.\n' > "$SM_HOME/data/charter.md"
 printf 'trivial e2e secondmate-owned crewmate brief: nothing to do.\n' > "$SM_HOME/data/cm2/brief.md"
+printf -- '- e2esm1 - Herdr workspace isolation (home: %s; scope: Herdr workspace isolation; projects: ; added 2026-07-27)\n' \
+  "$SM_HOME" > "$PRIMARY_HOME/data/secondmates.md"
 
 write_completion_report() {  # <path> <summary>
   printf '# Completion\n\n## Summary\n\n%s\n\n## What changed\n\nNo project files changed.\n\n## Verification\n\nThe task command ran in its isolated Herdr pane.\n\n## Visual evidence\n\nNone.\n\n## Artifacts\n\nThe captured pane output is the test artifact.\n\n## Follow-ups\n\nNone.\n' "$2" > "$1"
@@ -115,7 +120,7 @@ PROJ2="$TMP_ROOT/scratch-project-2"; make_scratch_project "$PROJ2"
 
 CM1_OUT="$TMP_ROOT/cm1.out"; CM1_ERR="$TMP_ROOT/cm1.err"
 FM_SPAWN_NO_GUARD=1 FM_HOME="$PRIMARY_HOME" FM_ROOT_OVERRIDE="$ROOT" \
-  "$ROOT/bin/fm-spawn.sh" cm1 "$PROJ1" "sh -c 'echo primary-crew-ok'" --backend herdr \
+  "$ROOT/bin/fm-spawn.sh" cm1 "$PROJ1" "sh -c 'echo primary-crew-ok; sleep 300'" --backend herdr \
   >"$CM1_OUT" 2>"$CM1_ERR"
 rc=$?
 [ "$rc" -eq 0 ] || fail "primary-shaped crewmate spawn failed"$'\n'"--- stdout ---"$'\n'"$(cat "$CM1_OUT")"$'\n'"--- stderr ---"$'\n'"$(cat "$CM1_ERR")"
@@ -144,7 +149,7 @@ pass "real herdr E2E: the primary-shaped home's crewmate landed in the 'firstmat
 
 SM_OUT="$TMP_ROOT/sm.out"; SM_ERR="$TMP_ROOT/sm.err"
 FM_SPAWN_NO_GUARD=1 FM_HOME="$PRIMARY_HOME" FM_ROOT_OVERRIDE="$ROOT" \
-  "$ROOT/bin/fm-spawn.sh" e2esm1 "$SM_HOME" "sh -c 'echo secondmate-launch-ok'" --secondmate --backend herdr \
+  "$ROOT/bin/fm-spawn.sh" e2esm1 "$SM_HOME" "sh -c 'echo secondmate-launch-ok; sleep 300'" --secondmate --backend herdr \
   >"$SM_OUT" 2>"$SM_ERR"
 rc=$?
 [ "$rc" -eq 0 ] || fail "the primary's --secondmate spawn of e2esm1 failed"$'\n'"--- stdout ---"$'\n'"$(cat "$SM_OUT")"$'\n'"--- stderr ---"$'\n'"$(cat "$SM_ERR")"
@@ -170,7 +175,7 @@ pass "real herdr E2E: a --secondmate spawn by the PRIMARY lands in the SECONDMAT
 
 CM2_OUT="$TMP_ROOT/cm2.out"; CM2_ERR="$TMP_ROOT/cm2.err"
 FM_SPAWN_NO_GUARD=1 FM_HOME="$SM_HOME" FM_ROOT_OVERRIDE="$ROOT" \
-  "$ROOT/bin/fm-spawn.sh" cm2 "$PROJ2" "sh -c 'echo sm-crew-ok'" --backend herdr \
+  "$ROOT/bin/fm-spawn.sh" cm2 "$PROJ2" "sh -c 'echo sm-crew-ok; sleep 300'" --backend herdr \
   >"$CM2_OUT" 2>"$CM2_ERR"
 rc=$?
 [ "$rc" -eq 0 ] || fail "a crewmate spawned FROM the secondmate-shaped home failed"$'\n'"--- stdout ---"$'\n'"$(cat "$CM2_OUT")"$'\n'"--- stderr ---"$'\n'"$(cat "$CM2_ERR")"
@@ -208,6 +213,8 @@ pass "real herdr E2E: list_live from the secondmate's own context sees only task
 
 # --- 5. teardown closes the RIGHT tab, and no other ------------------------
 
+fm_backend_herdr_send_key "$SESSION:$CM1_PANE" C-c || fail "could not stop cm1's raw fixture command"
+sleep 1
 TD1_OUT="$TMP_ROOT/td1.out"
 FM_HOME="$PRIMARY_HOME" FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$PRIMARY_HOME/state" FM_DATA_OVERRIDE="$PRIMARY_HOME/data" \
   FM_CONFIG_OVERRIDE="$PRIMARY_HOME/config" FM_REPORT_STACK_ROOT="$TMP_ROOT/report-stack" \
@@ -227,6 +234,8 @@ fi
 WT1=
 pass "real herdr E2E: tearing down cm1 closes only its own tab - the secondmate's and cm2's tabs survive untouched"
 
+fm_backend_herdr_send_key "$SESSION:$CM2_PANE" C-c || fail "could not stop cm2's raw fixture command"
+sleep 1
 TD2_OUT="$TMP_ROOT/td2.out"
 FM_HOME="$SM_HOME" FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$SM_HOME/state" FM_DATA_OVERRIDE="$SM_HOME/data" \
   FM_CONFIG_OVERRIDE="$SM_HOME/config" FM_REPORT_STACK_ROOT="$TMP_ROOT/report-stack" \

From f8916347381d66bde668cce0da22392654a7b8ab Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Mon, 27 Jul 2026 11:44:11 -0400
Subject: [PATCH 14/34] no-mistakes(test): Stabilize routing and lifecycle test
 fixtures

---
 tests/fm-afk-reap-wake-e2e.test.sh        |  1 +
 tests/fm-backend-autodetect-smoke.test.sh |  5 ++---
 tests/fm-secondmate-liveness.test.sh      | 19 +++++++++++--------
 3 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/tests/fm-afk-reap-wake-e2e.test.sh b/tests/fm-afk-reap-wake-e2e.test.sh
index b211950329..a4e8d6553d 100755
--- a/tests/fm-afk-reap-wake-e2e.test.sh
+++ b/tests/fm-afk-reap-wake-e2e.test.sh
@@ -42,6 +42,7 @@ printf 'none\t-\tnative\n' > "$STATE_DIR/.afk-daemon-terminal"
 
 FM_STATE_OVERRIDE="$STATE_DIR" \
 FM_AFK_STATE_PREPARED=1 \
+FM_AFK_DELIVERY=reap-wake \
 FM_ESCALATE_BATCH_SECS=0 \
 FM_HOUSEKEEPING_TICK=1 \
 FM_POLL=1 \
diff --git a/tests/fm-backend-autodetect-smoke.test.sh b/tests/fm-backend-autodetect-smoke.test.sh
index 71aaddd5fb..1bc824042b 100755
--- a/tests/fm-backend-autodetect-smoke.test.sh
+++ b/tests/fm-backend-autodetect-smoke.test.sh
@@ -55,6 +55,7 @@ command -v treehouse >/dev/null 2>&1 || { echo "skip: treehouse not found (requi
 TMP_ROOT=$(mktemp -d "$(cd "${TMPDIR:-/tmp}" && pwd -P)/fm-backend-autodetect-smoke.XXXXXX")
 SESSION="fm-lab-autodetect-smoke-$$"
 export HERDR_SESSION="$SESSION"
+export FM_HERDR_LAB_STATE_DIR="$TMP_ROOT/herdr-lab-state"
 herdr_test_lab_available "$SESSION" || exit 0
 ID="autodetectsmoke1"
 WT=
@@ -86,7 +87,7 @@ env -u TMUX -u FM_BACKEND PATH="$PATH" HERDR_ENV=1 \
   FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$STATE" FM_DATA_OVERRIDE="$DATA" \
   FM_CONFIG_OVERRIDE="$CONFIG" FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" \
   FM_SPAWN_NO_GUARD=1 \
-  "$ROOT/bin/fm-spawn.sh" "$ID" "$PROJ" "sh -c 'echo autodetect-smoke-ok; sleep 3'" \
+  "$ROOT/bin/fm-spawn.sh" "$ID" "$PROJ" "sh -c 'echo autodetect-smoke-ok; sleep 30'" \
   >"$OUT_FILE" 2>"$ERR_FILE"
 status=$?
 [ "$status" -eq 0 ] || fail "fm-spawn.sh did not succeed auto-detecting herdr"$'\n'"--- stdout ---"$'\n'"$(cat "$OUT_FILE")"$'\n'"--- stderr ---"$'\n'"$(cat "$ERR_FILE")"
@@ -125,8 +126,6 @@ case "$CAPTURED" in
   *) fail "the raw launch command did not run in the auto-detected herdr pane"$'\n'"$CAPTURED" ;;
 esac
 pass "real herdr: the auto-detected spawn's launch command actually ran in the herdr pane"
-sleep 3
-
 # --- teardown completes the trivial spawn/teardown cycle --------------------
 
 printf '# Completion\n\n## Summary\n\nThe auto-detected Herdr smoke task completed.\n\n## What changed\n\nNo project files changed.\n\n## Verification\n\nThe task command ran in the isolated Herdr pane.\n\n## Visual evidence\n\nNone.\n\n## Artifacts\n\nThe captured pane output is the test artifact.\n\n## Follow-ups\n\nNone.\n' \
diff --git a/tests/fm-secondmate-liveness.test.sh b/tests/fm-secondmate-liveness.test.sh
index dca832b9f6..44dfa09b93 100755
--- a/tests/fm-secondmate-liveness.test.sh
+++ b/tests/fm-secondmate-liveness.test.sh
@@ -175,7 +175,7 @@ test_agent_alive_dispatcher_routes_and_falls_back() {
   out=$(bash -c '. "$0/bin/fm-backend.sh"; fm_backend_source herdr; fm_backend_herdr_pane_agent_state() { printf "live"; }; fm_backend_agent_alive herdr sess:p1' "$ROOT")
   [ "$out" = alive ] || fail "dispatcher should route herdr to fm_backend_herdr_agent_alive, got '$out'"
 
-  out=$(bash -c '. "$0/bin/fm-backend.sh"; fm_backend_agent_alive zellij sess:win' "$ROOT")
+  out=$(bash -c '. "$0/bin/fm-backend.sh"; fm_backend_agent_alive cmux sess:win' "$ROOT")
   [ "$out" = unknown ] || fail "dispatcher should report unknown for a backend with no verified classifier, got '$out'"
 
   pass "fm_backend_agent_alive: routes tmux/herdr correctly, unknown for an unverified backend"
@@ -317,10 +317,13 @@ new_world() {
 # secondmate instead of relying on a non-Git legacy fixture.
 add_sm_home() {
   local w=$1 id=$2 window=$3 harness=${4:-claude}
-  local home="$w/$id" home_abs target
-  target=$(git -C "$ROOT" rev-parse refs/remotes/origin/main^{commit})
-  git clone --quiet --no-checkout "$ROOT" "$home"
-  git -C "$home" update-ref refs/remotes/origin/main "$target"
+  local home="$w/$id" home_abs source_origin primary_root="$w/primary-root"
+  source_origin=$(git -C "$ROOT" remote get-url origin)
+  if [ ! -d "$primary_root/.git" ]; then
+    git clone --quiet "$source_origin" "$primary_root"
+  fi
+  git clone --quiet --no-checkout "$primary_root" "$home"
+  git -C "$home" remote set-url origin "$source_origin"
   git -C "$home" checkout --quiet --detach refs/remotes/origin/main
   git -C "$home" symbolic-ref refs/remotes/origin/HEAD refs/remotes/origin/main
   mkdir -p "$home/data" "$home/state" "$home/config" "$home/projects"
@@ -579,14 +582,14 @@ EOF
   mkdir -p "$fake_root/bin"
   cat > "$fake_root/bin/fm-spawn.sh" <<'SH'
 #!/usr/bin/env bash
-FM_ROOT_OVERRIDE="$FM_TEST_REAL_ROOT" "$FM_TEST_REAL_ROOT/bin/fm-spawn.sh" "$@" > "$FM_MANAGED_SPAWN_OUT" 2>&1
+FM_ROOT_OVERRIDE="$FM_TEST_PRIMARY_ROOT" "$FM_TEST_REAL_ROOT/bin/fm-spawn.sh" "$@" > "$FM_MANAGED_SPAWN_OUT" 2>&1
 status=$?
 cat "$FM_MANAGED_SPAWN_OUT"
 exit "$status"
 SH
   cat > "$fake_root/bin/fm-account-session-sync.sh" <<'SH'
 #!/usr/bin/env bash
-FM_ROOT_OVERRIDE="$FM_TEST_REAL_ROOT" exec "$FM_TEST_REAL_ROOT/bin/fm-account-session-sync.sh" "$@"
+FM_ROOT_OVERRIDE="$FM_TEST_PRIMARY_ROOT" exec "$FM_TEST_REAL_ROOT/bin/fm-account-session-sync.sh" "$@"
 SH
   cat > "$fake_root/bin/fm-fleet-sync.sh" <<'SH'
 #!/usr/bin/env bash
@@ -632,7 +635,7 @@ SH
   native_dir_file="$w/native-dir"
   refreshed="$w/session-refreshed"
   out=$(run_bootstrap "$tmuxfb:$fb" "$w/home" zsh "$log" \
-    FM_ROOT_OVERRIDE="$fake_root" FM_TEST_REAL_ROOT="$ROOT" \
+    FM_ROOT_OVERRIDE="$fake_root" FM_TEST_REAL_ROOT="$ROOT" FM_TEST_PRIMARY_ROOT="$w/primary-root" \
     FM_AGENT_FLEET_BIN="$fake_af" FM_ACCOUNT_SESSION_WAIT_SECONDS=2 \
     FM_MANAGED_WORKSPACE="$workspace" \
     FM_MANAGED_NATIVE_DIR_FILE="$native_dir_file" FM_MANAGED_SESSION_REFRESHED="$refreshed" \

From 5328cc483b6cea1ede69c28279c2aa3b0e10c8e9 Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Mon, 27 Jul 2026 16:35:40 -0400
Subject: [PATCH 15/34] no-mistakes(test): Stabilize AFK and secondmate
 lifecycle fixtures

---
 tests/fm-afk-inject-herdr-e2e.test.sh         | 25 +++++++++++++++----
 tests/fm-afk-reap-wake-e2e.test.sh            | 10 +++++---
 ...ckend-herdr-workspace-per-home-e2e.test.sh |  8 +++---
 3 files changed, 31 insertions(+), 12 deletions(-)

diff --git a/tests/fm-afk-inject-herdr-e2e.test.sh b/tests/fm-afk-inject-herdr-e2e.test.sh
index 9207c61da5..dac264e12f 100755
--- a/tests/fm-afk-inject-herdr-e2e.test.sh
+++ b/tests/fm-afk-inject-herdr-e2e.test.sh
@@ -342,12 +342,15 @@ test_scenario_a() {
   fm_backend_herdr_send_key "$SUPERVISOR_TARGET" Enter
   sleep 0.5
 
-  sleep 8
+  local deadline=$(( $(date +%s) + 30 ))
+  while ! grep -q 'Supervisor escalate' "$LOG_FILE"; do
+    [ "$(date +%s)" -lt "$deadline" ] \
+      || fail "Scenario A: timed out waiting for the deferred digest submission"
+    sleep 1
+  done
 
   grep -q 'human draft text' "$LOG_FILE" \
     || fail "Scenario A: human text not in log after submit"
-  grep -q 'Supervisor escalate' "$LOG_FILE" \
-    || fail "Scenario A: digest not injected after the pane went idle"
   if grep -q 'human draft text.*Supervisor escalate' "$LOG_FILE" || \
      grep -q 'Supervisor escalate.*human draft text' "$LOG_FILE"; then
     fail "Scenario A: human text and digest merged into one line (after idle)"
@@ -383,7 +386,13 @@ test_scenario_b() {
 
   echo "done: PR https://example.test/pr/200" > "$STATE_DIR/fake-c1.status"
 
-  sleep 10
+  local deadline=$(( $(date +%s) + 30 ))
+  while [ "$(grep -c 'Supervisor escalate' "$LOG_FILE" || true)" -lt 1 ]; do
+    [ "$(date +%s)" -lt "$deadline" ] \
+      || fail "Scenario B: timed out waiting for the retried digest submission"
+    sleep 1
+  done
+  sleep 2
 
   local digest_count
   digest_count=$(grep -c 'Supervisor escalate' "$LOG_FILE" || true)
@@ -419,7 +428,13 @@ test_scenario_c() {
   start_daemon
 
   echo "done: PR https://example.test/pr/300" > "$STATE_DIR/fake-c1.status"
-  sleep 8
+  local deadline=$(( $(date +%s) + 30 ))
+  while [ "$(grep -c 'Supervisor escalate' "$LOG_FILE" || true)" -lt 1 ]; do
+    [ "$(date +%s)" -lt "$deadline" ] \
+      || fail "Scenario C: timed out waiting for the digest submission"
+    sleep 1
+  done
+  sleep 2
 
   local digest_count
   digest_count=$(grep -c 'Supervisor escalate' "$LOG_FILE" || true)
diff --git a/tests/fm-afk-reap-wake-e2e.test.sh b/tests/fm-afk-reap-wake-e2e.test.sh
index a4e8d6553d..8d8b6a4fed 100755
--- a/tests/fm-afk-reap-wake-e2e.test.sh
+++ b/tests/fm-afk-reap-wake-e2e.test.sh
@@ -55,9 +55,10 @@ FM_SUPERVISOR_TARGET=missing-pane \
 "$START" > "$STATE_DIR/daemon.out" 2> "$STATE_DIR/daemon.err" &
 DAEMON_PID=$!
 
-for _ in $(seq 1 60); do
+start_deadline=$(( $(date +%s) + 30 ))
+while [ "$(date +%s)" -lt "$start_deadline" ]; do
   [ -f "$STATE_DIR/.supervise-daemon.pid" ] && break
-  sleep 0.1
+  sleep 0.2
 done
 [ -f "$STATE_DIR/.supervise-daemon.pid" ] || {
   sed 's/^/  /' "$STATE_DIR/daemon.err" >&2
@@ -74,9 +75,10 @@ fi
 pass "routine wake stays in bash and keeps the native task parked"
 
 printf 'needs-decision: choose the safe rollout\n' > "$STATE_DIR/crew.status"
-for _ in $(seq 1 120); do
+completion_deadline=$(( $(date +%s) + 60 ))
+while [ "$(date +%s)" -lt "$completion_deadline" ]; do
   kill -0 "$DAEMON_PID" 2>/dev/null || break
-  sleep 0.1
+  sleep 0.2
 done
 if kill -0 "$DAEMON_PID" 2>/dev/null; then
   sed 's/^/  /' "$STATE_DIR/daemon.err" >&2
diff --git a/tests/fm-backend-herdr-workspace-per-home-e2e.test.sh b/tests/fm-backend-herdr-workspace-per-home-e2e.test.sh
index 518dc4bb2a..c8105f2794 100755
--- a/tests/fm-backend-herdr-workspace-per-home-e2e.test.sh
+++ b/tests/fm-backend-herdr-workspace-per-home-e2e.test.sh
@@ -85,9 +85,11 @@ mkdir -p "$PRIMARY_HOME/state" "$PRIMARY_HOME/data/cm1" "$PRIMARY_HOME/config"
 printf 'trivial e2e primary crewmate brief: nothing to do.\n' > "$PRIMARY_HOME/data/cm1/brief.md"
 
 SM_HOME="$TMP_ROOT/secondmate-home"
-git clone -q "$ROOT" "$SM_HOME"
-git -C "$SM_HOME" fetch -q "$ROOT" refs/remotes/origin/main:refs/remotes/origin/main
-git -C "$SM_HOME" checkout -q -B main 3e597f4f3c093d7210a486c7688fb1f41adc14bd
+SM_ORIGIN=$(git -C "$ROOT" remote get-url origin)
+git init -q "$SM_HOME"
+git -C "$SM_HOME" remote add origin "$SM_ORIGIN"
+git -C "$SM_HOME" fetch -q origin main
+git -C "$SM_HOME" checkout -q -B main FETCH_HEAD
 git -C "$SM_HOME" remote set-head origin main
 mkdir -p "$SM_HOME/state" "$SM_HOME/data/cm2" "$SM_HOME/config" "$SM_HOME/projects" "$SM_HOME/bin"
 printf 'e2esm1\n' > "$SM_HOME/.fm-secondmate-home"

From f1fb21b862b86672e9d9cfed3066ac6a493758ab Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Mon, 27 Jul 2026 19:34:25 -0400
Subject: [PATCH 16/34] no-mistakes(document): Document generation-safe routing
 and Zellij liveness

---
 docs/architecture.md   | 2 +-
 docs/configuration.md  | 6 +++++-
 docs/zellij-backend.md | 6 +++---
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/docs/architecture.md b/docs/architecture.md
index b865f8be38..2693942862 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -76,7 +76,7 @@ For compatibility, default tmux tasks do not write `backend=tmux`; every reader
 `fm-watch.sh` polls each window's backend for a busy state: tmux, zellij, orca, and cmux have no native primitive and always report unknown, preserving the original pane-tail-regex detection unchanged; herdr's `agent.get` semantic state (working/idle/done/blocked) is consulted first for stale detection, with unknown native states falling back to the same regex.
 That poll loop is the default event source for backends with no native push events, so this stays an extraction of the abstraction rather than a watcher rewrite.
 For capable herdr sessions, the same watcher replaces its terminal sleep with a bounded native event wait that immediately surfaces `blocked`; [herdr-backend.md](herdr-backend.md#native-paneagent_status_changed-push-escalation-immediate-blocked-wake) owns the mechanism, capability gates, and verification evidence.
-The deeper session-start agent-process liveness probe is separate from that busy-state poll: tmux and herdr have verified classifiers for secondmate recovery, while zellij, Orca, and cmux currently report `unknown` rather than guess.
+The deeper session-start agent-process liveness probe is separate from that busy-state poll; [`docs/configuration.md`](configuration.md#runtime-backend-configbackend--fm_backend) owns the backend-specific verdicts.
 Herdr is experimental and can be selected explicitly or by runtime auto-detection: treehouse remains the worktree provider for it exactly as it is for tmux (herdr is a session provider only), and its full verification - the container shape decision, created-vs-adopted default-tab prune safety, restored-layout husk respawn idempotency, verified CLI facts, ANSI-preserved ghost/placeholder classification through the shared extractor, a verified small-`--lines` capture bug and its workaround, and known gaps - is recorded in `docs/herdr-backend.md`.
 Herdr's container shape is workspace-per-home plus tab-per-task: the primary home uses workspace label `firstmate`, secondmate homes use `2ndmate-<secondmate-id>`, and recovery/list-live scopes to the current `FM_HOME`'s workspace.
 Zellij is experimental and selected only explicitly: treehouse remains its worktree provider too, and its full verification - the resolved "gaps to verify" list from the original design report, the unconditional-exit-0 CLI quirk and its mitigation, the focus-steal-on-new-tab finding, the home-scoped tab-title collision fix, and known gaps - is recorded in `docs/zellij-backend.md`.
diff --git a/docs/configuration.md b/docs/configuration.md
index 22e20187d7..bb8a3a47d2 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -37,7 +37,8 @@ Any value other than `tmux`, `herdr`, `zellij`, `orca`, or `cmux` is rejected un
 Every new task refuses `backend=orca` before any owned mutation, legacy respawn and destructive teardown currently fail closed on unavailable authority capability, and Orca also refuses `--secondmate`; the Orca guide owns the rationale and re-enablement contract.
 `codex-app` is not an accepted runtime backend yet; [`docs/codex-app-backend.md`](codex-app-backend.md) owns the Codex App boundary.
 The session-start secondmate liveness sweep uses a deeper `fm_backend_agent_alive` probe where verified.
-Today that probe can classify tmux and herdr secondmate endpoints as `alive`, `dead`, or `unknown`; zellij, Orca, and cmux report `unknown` until their own agent-process classifiers are verified.
+Today tmux and herdr can classify secondmate endpoints as `alive`, `dead`, or `unknown`.
+Zellij reports `dead` only when the recorded session or pane is absent and otherwise reports `unknown`, while Orca and cmux report `unknown` until their own agent-process classifiers are verified.
 A herdr spawn additionally version-gates against the installed `herdr` binary's protocol and requires the Herdr tool delta owned by "Toolchain" below, refusing loudly on an incompatible or missing installation.
 A zellij spawn additionally version-gates against the installed `zellij` binary's version and requires `jq`, refusing loudly when either is missing or the version is older than 0.44.
 A cmux spawn additionally version-gates against the installed `cmux` binary's version, requires `jq`, and requires the control socket to be reachable and accessible (see [`docs/cmux-backend.md`](cmux-backend.md) "Setup" for the one-time socket-access configuration this needs; Automation mode is the recommended socket control mode, with Password mode supported via `config/cmux-socket-password`), refusing loudly and non-retryably on a `cmuxOnly`/unauthenticated socket.
@@ -46,6 +47,8 @@ Task meta records `backend=` only for a non-default backend; an absent `backend=
 A herdr task additionally records `herdr_session=`, `herdr_workspace_id=`, `herdr_tab_id=`, and `herdr_pane_id=`.
 A zellij task additionally records `zellij_session=`, `zellij_tab_id=`, and `zellij_pane_id=`.
 A legacy Orca task may additionally record `orca_worktree_id=` and `terminal=`, with `window=fm-<id>` kept as the shared firstmate alias.
+Every new spawn records a generation-bound task temporary root beneath that home's physical state directory.
+Respawn removes only a validated prior generation after the replacement metadata is committed, teardown removes the recorded current generation, and legacy `/tmp/fm-<id>` metadata remains readable but is never mutated.
 A cmux task additionally records `cmux_workspace_id=` and `cmux_surface_id=`.
 Task selectors for `fm-peek.sh`, `fm-send.sh`, and `fm-crew-state.sh` resolve centrally through `fm_backend_resolve_selector`.
 A selector containing `:` is passed through as an explicit backend endpoint escape hatch.
@@ -192,6 +195,7 @@ Neither mode invokes Agent Fleet selection or leases for a new ship/scout launch
 The existing `--account-pool`, `--account-profile`, and dispatch-profile fields remain compatibility activation inputs for those crewmates while the inactive-code removal is handled separately.
 Their legacy aliases do not constrain the new usage-based account choice.
 Secondmate integration is deferred: secondmate launches retain their pre-cutover Agent Fleet selection and lease behavior, including `config/secondmate-account-pool`.
+Every secondmate launch also verifies that tracked Agent Fleet routing support has not been removed from the home, even when routing is off; a missing tracked implementation is treated as unreconciled home drift rather than permission to launch without the safety path.
 Firstmate's spawn flags and `config/secondmate-account-pool` continue to accept aliases made only of letters, digits, dot, underscore, and dash, excluding values that begin with dot or dash; `config/crew-dispatch.json` deliberately narrows those fields to an alphanumeric first character.
 Account email addresses and filesystem paths are invalid in every input surface.
 Direct ship/scout task metadata records only `account_home=` from this account mechanism.
diff --git a/docs/zellij-backend.md b/docs/zellij-backend.md
index 78553b44ac..eac184c0a1 100644
--- a/docs/zellij-backend.md
+++ b/docs/zellij-backend.md
@@ -103,7 +103,7 @@ Zellij tasks additionally record:
 | Send + submit, composed | `paste` then `send-keys --pane-id <id> Enter` | Zellij has no single-call atomic "type and submit" primitive (unlike tmux's `send-keys ... Enter` or herdr's `pane run`); `fm_backend_zellij_send_text_line` composes the two calls, which is the only form this adapter has for that operation. |
 | Bounded capture | `zellij action dump-screen --pane-id <id>` for 40 lines or fewer; `zellij action dump-screen --pane-id <id> --full` above that threshold | Works for a background session with NO attached client (resolves report gap #1). No `--lines`-style bound flag exists at all (unlike herdr's buggy small-N `--lines`, there is simply no flag). Routine watcher-sized reads use zellij's viewport-only dump to avoid unbounded scrollback reads; larger explicit peeks request `--full` and trim to the caller's requested line count locally with `tail`. The tradeoff: on a very short terminal viewport, a 40-line routine read can see fewer than 40 lines and miss content above the visible screen. |
 | Busy state | *(no native primitive)* | D5 (`herdr-addendum.md`): zellij has no agent-state API. `fm_backend_busy_state`'s dispatcher (`bin/fm-backend.sh`) falls through to `unknown` for zellij via its wildcard case, exactly like tmux - the watcher's existing pane-hash + regex path is the only busy-state source for this backend. |
-| Agent liveness | *(no verified primitive)* | `fm_backend_agent_alive` reports `unknown` for zellij, so `bin/fm-bootstrap.sh`'s session-start secondmate liveness sweep never auto-respawns a zellij secondmate endpoint, conservatively avoiding a false-dead reading that would create a duplicate secondmate supervisor in one home. |
+| Agent liveness | `list-panes --json` structural absence proof | `fm_backend_agent_alive` reports `dead` only when the recorded session or pane is absent and otherwise reports `unknown`, so `bin/fm-bootstrap.sh` can recover a structurally gone zellij secondmate endpoint without treating a present pane as proof about its agent process. |
 | Kill | `zellij action close-tab-by-id <id>` (tab id resolved fresh from the pane id when possible; teardown can pass recorded `zellij_tab_id` plus the expected caller-facing `fm-<id>` label when the pane is already gone) | Unlike herdr (where closing a tab's only pane also closes the tab), closing a zellij pane with `close-pane` does NOT close the now-empty tab - it survives as an empty "ghost" entry in `list-tabs`. `close-tab-by-id` on a LIVE tab (with its pane still running) verified to cleanly remove both pane and tab in one call. Kill resolves the owning tab and closes by tab id; if teardown supplies an expected label, the tab id must still match it through the home-scoped-title or unambiguous legacy-title check before it is closed, including the recorded `zellij_tab_id` ghost-tab fallback. Best-effort (`\|\| true`), matching tmux's `kill-window` and herdr's `pane close` contract. |
 | Recovery / list-live | `zellij action list-tabs --json`, filter names starting with this home's own `fm-<home-label>-` prefix | Name-based, never trusts a stored pane id blindly - the same posture herdr's `list_live` takes. Scoped to this installation's own home-scoped prefix (see "Home-scoped tab titles" above), so it never lists another firstmate home's tabs; the adapter strips the tag back off and reports the plain `fm-<id>` label. Does not attempt the legacy untagged-title fallback (that fallback is for a single already-known tab, not a bulk sweep). |
 | Session cleanup (test-only) | `zellij delete-session <name> --force` | The single-call kill-and-delete form, gated behind `tests/zellij-test-safety.sh`'s guard (refuses an empty name, the literal `"firstmate"` default name, or a name not currently listed). Never `kill-all-sessions`/`delete-all-sessions` - see "Session safety" below. |
@@ -215,8 +215,8 @@ The isolated zellij session and the scratch `FM_HOME`/project were fully torn do
 ## Known gaps left for a follow-up
 
 - **No event push at all**, not even herdr's semantic busy-state (D5): zellij has no analogue to herdr's `agent.get`, so `fm-watch.sh`'s existing pane-hash + `FM_BUSY_REGEX` poll loop is the ONLY event source for this backend, identical to the tmux path. This is the expected, designed-for outcome (D5 explicitly calls for "the poll-based capture/hash/busy-regex path, same vocabulary as tmux"), not a shortfall relative to the report.
-- **No verified agent-process liveness classifier.** The session-start secondmate liveness sweep therefore receives `unknown` from `fm_backend_agent_alive` for zellij and reports `SECONDMATE_LIVENESS: ... skipped: liveness probe inconclusive` instead of killing or respawning the endpoint.
-  This leaves a dead zellij secondmate for manual recovery, but avoids the worse failure mode of duplicating a live supervisor.
+- **No verified present-pane agent-process classifier.** The session-start secondmate liveness sweep receives `dead` only for a structurally absent zellij session or pane; a present pane remains `unknown` and produces `SECONDMATE_LIVENESS: ... skipped: liveness probe inconclusive` instead of risking a duplicate supervisor.
+  This leaves an agent-less but structurally present zellij secondmate for manual recovery, but avoids the worse failure mode of duplicating a live supervisor.
 - **The focus-steal mitigation has a narrow race window.** Between `new-tab` (which steals focus immediately) and the follow-up `go-to-tab-by-id` restore call, an attached client's view is briefly on the new tab. No flag-based suppression exists to close this window entirely (see "Focus-steal on new-tab" above); a future zellij release may add one.
 - **A pane can still die after `target_ready` succeeds and before the operation runs.** Metadata-routed operations now verify the expected caller-facing `fm-<id>` label through the home-scoped-title or unambiguous legacy-title check, as well as the pane id up front, but zellij's unconditional exit 0 still leaves this narrow time-of-check/time-of-use race for one-shot operations (see "Unconditional exit code 0" above).
 - **The `pwd`-probe workaround for worktree-path discovery is scoped to `fm-spawn.sh`'s own poll loop only** (see "Worktree-path discovery" above). It is not a general-purpose live-cwd primitive; a future caller needing a live cwd read for a zellij pane outside that narrow spawn-time context would need the same active-probe approach, not a passive JSON field.

From 333c17d7407f4296a520e5c6424ec5f4853358e4 Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Mon, 27 Jul 2026 20:31:51 -0400
Subject: [PATCH 17/34] test: reconcile routing fixtures after rebase

---
 tests/fm-account-routing.test.sh | 33 +++++++++++++++++++++++---------
 1 file changed, 24 insertions(+), 9 deletions(-)

diff --git a/tests/fm-account-routing.test.sh b/tests/fm-account-routing.test.sh
index 4d7416af02..f954d3d07e 100755
--- a/tests/fm-account-routing.test.sh
+++ b/tests/fm-account-routing.test.sh
@@ -450,18 +450,30 @@ make_case() {
   case_dir="$TMP_ROOT/$name"
   home="$case_dir/home"
   proj="$case_dir/project"
-  wt="$case_dir/treehouse-pool/1/wt"
+  wt="$case_dir/treehouse-root/pool/1/wt"
   fakebin=$(make_fakebin "$case_dir/fake")
   mkdir -p "$home/data" "$home/projects" "$home/state" "$home/config" \
-    "$case_dir/treehouse-pool/1" "$case_dir/treehouse-pools"
+    "$case_dir/treehouse-root/pool" "$case_dir/treehouse-pools"
   printf '%s\n' "$harness" > "$home/config/crew-harness"
   fm_git_worktree "$proj" "$wt" "wt-$name"
   git -C "$wt" checkout --quiet --detach
   fm_git_add_origin "$proj" "$case_dir/origin.git"
-  if [ -n "$first_id" ]; then
-    printf '{"worktrees":[{"path":"%s","leased":true,"lease_holder":"firstmate-%s"}]}\n' \
-      "$wt" "$first_id" > "$case_dir/treehouse-pool/treehouse-state.json"
-  fi
+  python3 - "$case_dir/treehouse-root/pool/treehouse-state.json" "$wt" "$first_id" <<'PY'
+import json
+import os
+import sys
+
+state, path, first_id = sys.argv[1:]
+worktree = {
+    "name": "1",
+    "path": os.path.realpath(path),
+    "leased": bool(first_id),
+}
+if first_id:
+    worktree["lease_holder"] = f"firstmate-{first_id}"
+with open(state, "w", encoding="utf-8") as stream:
+    json.dump({"worktrees": [worktree]}, stream)
+PY
   touch "$home/state/.last-watcher-beat"
   for id in "$@"; do
     mkdir -p "$home/data/$id"
@@ -2339,8 +2351,10 @@ test_enforced_secondmate_requires_routing_inheritance_and_capable_home() {
   rec=$(make_case secondmate-incapable-refuse claude)
   read_case "$rec"
   sm="$CASE_DIR/secondmate-home"
-  make_seeded_secondmate_home "$sm" "$id" incapable
+  make_seeded_secondmate_home "$sm" "$id"
   sm=$(cd "$sm" && pwd -P)
+  git -C "$sm" update-index --assume-unchanged bin/fm-account-routing-lib.sh
+  rm -f "$sm/bin/fm-account-routing-lib.sh"
   printf 'enforce\n' > "$HOME_DIR/config/account-routing-mode"
   out=$(FM_TEST_PANE_PATH="$sm" run_spawn "$id" "$sm" --secondmate)
   status=$?
@@ -2386,8 +2400,10 @@ test_secondmate_routing_inheritance_is_authoritative_for_every_mode() {
   rec=$(make_case secondmate-off-incapable claude)
   read_case "$rec"
   sm="$CASE_DIR/secondmate-home"
-  make_seeded_secondmate_home "$sm" "$id" incapable
+  make_seeded_secondmate_home "$sm" "$id"
   sm=$(cd "$sm" && pwd -P)
+  git -C "$sm" update-index --assume-unchanged bin/fm-account-routing-lib.sh
+  rm -f "$sm/bin/fm-account-routing-lib.sh"
   out=$(FM_TEST_PANE_PATH="$sm" run_spawn "$id" "$sm" --secondmate)
   status=$?
   [ "$status" -eq 0 ] || fail "routing-off secondmate refused a clean legacy home"
@@ -6030,7 +6046,6 @@ test_teardown_stops_after_rollback_restores_predecessor() {
   assert_not_grep "lease release --task $old_task" "$AF_LOG" "teardown released the restored predecessor in the stale generation pass"
   assert_contains "$out" "rerun teardown against the restored task generation" "rollback restoration retry guidance was not surfaced"
 
-  write_test_completion_report "$id"
   clear_case_logs
   write_teardown_completion_report "$id"
   run_teardown "$id" --force >/dev/null || fail "restored predecessor could not be torn down on a fresh pass"

From 08403a822ed6e557ffb4a19d8ed282bc866159cf Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Mon, 27 Jul 2026 23:32:20 -0400
Subject: [PATCH 18/34] no-mistakes(test): Stabilize Herdr secondmate primary
 ref fixture

---
 tests/fm-backend-herdr-workspace-per-home-e2e.test.sh | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/tests/fm-backend-herdr-workspace-per-home-e2e.test.sh b/tests/fm-backend-herdr-workspace-per-home-e2e.test.sh
index c8105f2794..a68f10fb14 100755
--- a/tests/fm-backend-herdr-workspace-per-home-e2e.test.sh
+++ b/tests/fm-backend-herdr-workspace-per-home-e2e.test.sh
@@ -86,6 +86,12 @@ printf 'trivial e2e primary crewmate brief: nothing to do.\n' > "$PRIMARY_HOME/d
 
 SM_HOME="$TMP_ROOT/secondmate-home"
 SM_ORIGIN=$(git -C "$ROOT" remote get-url origin)
+PRIMARY_ROOT="$TMP_ROOT/primary-root"
+git init -q "$PRIMARY_ROOT"
+git -C "$PRIMARY_ROOT" remote add origin "$SM_ORIGIN"
+git -C "$PRIMARY_ROOT" fetch -q "$ROOT" refs/remotes/origin/main:refs/remotes/origin/main
+git -C "$PRIMARY_ROOT" checkout -q -B main FETCH_HEAD
+git -C "$PRIMARY_ROOT" remote set-head origin main
 git init -q "$SM_HOME"
 git -C "$SM_HOME" remote add origin "$SM_ORIGIN"
 git -C "$SM_HOME" fetch -q origin main
@@ -150,7 +156,7 @@ pass "real herdr E2E: the primary-shaped home's crewmate landed in the 'firstmat
 # exactly this call - AGENTS.md task herdr-sm-spaces-k4, requirement 3.)
 
 SM_OUT="$TMP_ROOT/sm.out"; SM_ERR="$TMP_ROOT/sm.err"
-FM_SPAWN_NO_GUARD=1 FM_HOME="$PRIMARY_HOME" FM_ROOT_OVERRIDE="$ROOT" \
+FM_SPAWN_NO_GUARD=1 FM_HOME="$PRIMARY_HOME" FM_ROOT_OVERRIDE="$PRIMARY_ROOT" \
   "$ROOT/bin/fm-spawn.sh" e2esm1 "$SM_HOME" "sh -c 'echo secondmate-launch-ok; sleep 300'" --secondmate --backend herdr \
   >"$SM_OUT" 2>"$SM_ERR"
 rc=$?

From c5164ccce0bb736a6f397ffc200b9a8ad55234f7 Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Tue, 28 Jul 2026 01:48:28 -0400
Subject: [PATCH 19/34] no-mistakes(document): Update routing and liveness
 documentation

---
 .agents/skills/bootstrap-diagnostics/SKILL.md | 2 +-
 AGENTS.md                                     | 2 +-
 docs/configuration.md                         | 3 ++-
 docs/zellij-backend.md                        | 2 +-
 4 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/.agents/skills/bootstrap-diagnostics/SKILL.md b/.agents/skills/bootstrap-diagnostics/SKILL.md
index 584ec6022d..37c3ca46e1 100644
--- a/.agents/skills/bootstrap-diagnostics/SKILL.md
+++ b/.agents/skills/bootstrap-diagnostics/SKILL.md
@@ -37,7 +37,7 @@ The inline rules in `AGENTS.md` section 3 still bind: detect, then consent, then
 - `FLEET_SYNC: <repo>: STUCK: on <state>, N commits behind <base> - needs attention` - the clone is dirty, on a non-default branch, detached with unique commits, or diverged, so the sync left it untouched (never forcing or discarding); it will keep falling behind until you look.
   A loud STUCK, especially a growing N across bootstraps, means that clone needs hands-on attention; dispatch a crewmate or resolve it before it strands work.
 - `SECONDMATE_SYNC: secondmate <id>: skipped: <reason>` - the local-HEAD secondmate sync left a live secondmate home on its existing checkout because the home was dirty, diverged, unsafe, on the wrong branch, missing the primary target commit, or otherwise not fast-forwardable, or because inheritable-config propagation failed; bootstrap continued, but inspect the reason because the secondmate's tracked instructions or inherited settings may be stale after a primary update.
-- `SECONDMATE_LIVENESS: secondmate <id>: <outcome>` - the session-start liveness sweep checked a live secondmate's recorded endpoint for a real agent process.
+- `SECONDMATE_LIVENESS: secondmate <id>: <outcome>` - the session-start liveness sweep checked a live secondmate's recorded endpoint with that backend's classifier; `docs/configuration.md` "Runtime backend" owns the possible verdicts.
   Treat `already-live`, `respawned`, and `rollback reconciled and respawned` as handled; investigate `skipped` or `respawn failed`, and load `secondmate-provisioning` for any `respawn deferred` outcome because its "Recovery" section owns the required routing decision.
 - `TASKS_AXI: available` - a default-backend capability fact, not a problem; record it silently and use `AGENTS.md` section 10 for backlog mutations.
   It prints only when `config/backlog-backend` is absent or set to `tasks-axi` and the shared compatibility probe passes (`docs/configuration.md` "Backlog backend").
diff --git a/AGENTS.md b/AGENTS.md
index eeed517dc9..1116188158 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -146,7 +146,7 @@ It composes today's `fm-lock.sh`, `fm-bootstrap.sh`, and `fm-wake-drain.sh` - ca
 2. **Bootstrap** - detect-only diagnostics (tool/version problems, GitHub auth, the worktree-tangle check, harness override, dispatch-profile validation, backlog-backend status) always run and always print.
    When the lock could not be acquired, the worktree-tangle check uses read-only advisory wording without a checkout repair command.
    The five MUTATING sweeps - report-retention ownership, fleet sync, the local secondmate fast-forward sweep, the secondmate liveness sweep, and X-mode artifact writes - run only when this session actually holds the lock from step 1.
-   The secondmate liveness sweep probes each live secondmate's endpoint for a real agent process, reports handled or deferred outcomes as `SECONDMATE_LIVENESS:` lines, and leaves any required routing decision to `secondmate-provisioning` (`bin/fm-bootstrap.sh`; `bin/fm-backend.sh`'s `fm_backend_agent_alive`).
+   The secondmate liveness sweep probes each live secondmate's endpoint with the backend-specific classifier owned by `docs/configuration.md` "Runtime backend", reports handled or deferred outcomes as `SECONDMATE_LIVENESS:` lines, and leaves any required routing decision to `secondmate-provisioning` (`bin/fm-bootstrap.sh`; `bin/fm-backend.sh`'s `fm_backend_agent_alive`).
 3. **Wake queue** - when locked, drains the durable wake queue and prints the records prominently as this turn's first work queue, exactly as `bin/fm-wake-drain.sh` did before; a lapsed watcher chain still surfaces here via the same guard banner.
    When the lock could not be acquired, the queue is left untouched because another session owns it, and the guard's tangle/watcher-liveness alarms still print in read-only advisory mode without drain, supervision repair, or checkout repair commands.
 4. **Context digest** - the full contents of `data/projects.md`, `data/secondmates.md`, `data/captain.md`, and `data/learnings.md`, each clearly delimited.
diff --git a/docs/configuration.md b/docs/configuration.md
index bb8a3a47d2..22335ac19e 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -195,7 +195,8 @@ Neither mode invokes Agent Fleet selection or leases for a new ship/scout launch
 The existing `--account-pool`, `--account-profile`, and dispatch-profile fields remain compatibility activation inputs for those crewmates while the inactive-code removal is handled separately.
 Their legacy aliases do not constrain the new usage-based account choice.
 Secondmate integration is deferred: secondmate launches retain their pre-cutover Agent Fleet selection and lease behavior, including `config/secondmate-account-pool`.
-Every secondmate launch also verifies that tracked Agent Fleet routing support has not been removed from the home, even when routing is off; a missing tracked implementation is treated as unreconciled home drift rather than permission to launch without the safety path.
+Every secondmate launch refuses a home whose index tracks Agent Fleet routing support but whose working tree has removed it, even when routing is off.
+An older home that does not track the support may still launch with a warning while routing is off or observe, but enforce mode refuses it until the home is reconciled.
 Firstmate's spawn flags and `config/secondmate-account-pool` continue to accept aliases made only of letters, digits, dot, underscore, and dash, excluding values that begin with dot or dash; `config/crew-dispatch.json` deliberately narrows those fields to an alphanumeric first character.
 Account email addresses and filesystem paths are invalid in every input surface.
 Direct ship/scout task metadata records only `account_home=` from this account mechanism.
diff --git a/docs/zellij-backend.md b/docs/zellij-backend.md
index eac184c0a1..f137db989f 100644
--- a/docs/zellij-backend.md
+++ b/docs/zellij-backend.md
@@ -31,7 +31,7 @@ You do not need to attach for routine supervision: from an active firstmate sess
 
 Verify it works by spawning a trivial task with `--backend zellij` and confirming the task's meta records `backend=zellij` plus `zellij_session=`, `zellij_tab_id=`, and `zellij_pane_id=`; attaching to the session should show the new home-scoped tab title, such as `fm-firstmate-<8hex>-<id>`.
 
-Limitations: zellij is experimental, has no per-home workspace split (all tasks share one tab bar, unlike herdr), has no verified agent-process liveness classifier for the session-start secondmate sweep, and still carries the known gaps documented below (no native busy-state signal and a narrow focus-steal race on tab creation) - see "Known gaps left for a follow-up" at the end of this document.
+Limitations: zellij is experimental, has no per-home workspace split (all tasks share one tab bar, unlike herdr), can prove only structural endpoint absence rather than present-pane agent-process liveness for the session-start secondmate sweep, and still carries the known gaps documented below (no native busy-state signal and a narrow focus-steal race on tab creation) - see "Known gaps left for a follow-up" at the end of this document.
 
 ## Status: experimental
 

From 99cf75df5082ddf1cf6e4d3fe96f9120ee5b7df4 Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Tue, 28 Jul 2026 02:33:30 -0400
Subject: [PATCH 20/34] test(orca): preserve expected failure captures under
 errexit

---
 tests/fm-backend-orca.test.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/fm-backend-orca.test.sh b/tests/fm-backend-orca.test.sh
index 9814ba83c5..28ba2977e1 100755
--- a/tests/fm-backend-orca.test.sh
+++ b/tests/fm-backend-orca.test.sh
@@ -539,9 +539,11 @@ test_terminal_state_classifies_closed_live_and_ambiguous_orca() {
 test_remove_worktree_refuses_empty_id() {
   local out status
   orca_case remove-empty
+  set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     bash -c '. "$0/bin/backends/orca.sh"; fm_backend_orca_remove_worktree ""' "$ROOT" 2>&1 )
   status=$?
+  set -e
   [ "$status" -ne 0 ] || fail "remove_worktree should fail when the Orca worktree id is empty"
   assert_contains "$out" "missing Orca worktree id" "remove_worktree did not explain the missing id"
   [ ! -s "$LOG" ] || fail "remove_worktree should not call Orca with an empty id"
@@ -553,9 +555,11 @@ test_remove_worktree_rejects_orca_error_json() {
   orca_case remove-error-json
   token=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
   printf '{"ok":false,"error":{"code":"worktree_not_found","message":"worktree not found"}}\n' > "$RESP/1.out"
+  set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     bash -c '. "$0/bin/backends/orca.sh"; fm_backend_orca_remove_worktree_bound wt-gone /tmp/orca-wt "$1"' "$ROOT" "$token" 2>&1 )
   status=$?
+  set -e
   [ "$status" -ne 0 ] || fail "bound remove_worktree should fail on Orca ok:false JSON"
   assert_contains "$out" "worktree not found" "bound remove_worktree should surface the Orca removal error"
   assert_contains "$(cat "$LOG")" $'--expected-path\x1f/tmp/orca-wt' \

From 521b84f6db6a74c1cf95d19da7b5631e47e0d52f Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Tue, 28 Jul 2026 02:38:15 -0400
Subject: [PATCH 21/34] no-mistakes(review): Harden rollback task temp cleanup

---
 bin/fm-spawn.sh                  | 12 ++++++++++--
 tests/fm-account-routing.test.sh | 14 ++++++++++++++
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 1d90301bf0..9716587b9c 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -1720,7 +1720,11 @@ spawn_abort_cleanup() {
         [ "$ORIGINAL_CHECK_PRESENT" != 0 ] || rm -f "$STATE/$ID.check.sh"
         [ "$ORIGINAL_PI_EXT_PRESENT" != 0 ] || rm -f "$STATE/$ID.pi-ext.ts"
         [ "$ORIGINAL_GROK_TOKEN_PRESENT" != 0 ] || rm -f "$STATE/$ID.grok-turnend-token"
-        [ "$ORIGINAL_TASK_TMP_PRESENT" != 0 ] || { [ -z "${TASK_TMP:-}" ] || rm -rf "$TASK_TMP"; }
+        if [ "$ORIGINAL_TASK_TMP_PRESENT" = 0 ] && [ -n "${TASK_TMP:-}" ] \
+          && ! fm_account_safe_remove_task_tmp "$ID" "$TASK_TMP" "$SPAWN_GENERATION_ID"; then
+          worktree_clean=0
+          echo "warning: failed to remove direct spawn task temp for ${ID:-unknown}; retaining cleanup metadata" >&2
+        fi
       fi
     fi
     if [ "$worktree_clean" != 1 ]; then
@@ -1799,7 +1803,11 @@ spawn_abort_cleanup() {
         [ "$ORIGINAL_CHECK_PRESENT" != 0 ] || rm -f "$STATE/$ID.check.sh"
         [ "$ORIGINAL_PI_EXT_PRESENT" != 0 ] || rm -f "$STATE/$ID.pi-ext.ts"
         [ "$ORIGINAL_GROK_TOKEN_PRESENT" != 0 ] || rm -f "$STATE/$ID.grok-turnend-token"
-        [ "$ORIGINAL_TASK_TMP_PRESENT" != 0 ] || { [ -z "${TASK_TMP:-}" ] || rm -rf "$TASK_TMP"; }
+        if [ "$ORIGINAL_TASK_TMP_PRESENT" = 0 ] && [ -n "${TASK_TMP:-}" ] \
+          && ! fm_account_safe_remove_task_tmp "$ID" "$TASK_TMP" "$SPAWN_GENERATION_ID"; then
+          account_clean=0
+          echo "warning: failed to remove Agent Fleet task temp for ${ID:-unknown}; retaining cleanup metadata" >&2
+        fi
       fi
       if [ "$account_clean" != 1 ] && [ -n "$rollback_lock" ]; then
         persist_failed_account_rollback || echo "warning: failed to persist Agent Fleet rollback state for ${ID:-unknown}" >&2
diff --git a/tests/fm-account-routing.test.sh b/tests/fm-account-routing.test.sh
index f954d3d07e..11d9ae8b34 100755
--- a/tests/fm-account-routing.test.sh
+++ b/tests/fm-account-routing.test.sh
@@ -1655,6 +1655,19 @@ test_task_tmp_partial_removal_fails_closed() {
   pass "partial task temp removal fails closed"
 }
 
+test_spawn_rollback_uses_generation_safe_task_tmp_removal() {
+  local safe_cleanup_count
+  safe_cleanup_count=$(grep -cF \
+    '&& ! fm_account_safe_remove_task_tmp "$ID" "$TASK_TMP" "$SPAWN_GENERATION_ID"; then' \
+    "$ROOT/bin/fm-spawn.sh")
+  [ "$safe_cleanup_count" -eq 2 ] \
+    || fail "spawn rollback does not generation-validate both new task temp cleanup paths"
+  if grep -F 'rm -rf "$TASK_TMP"' "$ROOT/bin/fm-spawn.sh" >/dev/null 2>&1; then
+    fail "spawn rollback still removes a task temp root without descriptor-pinned validation"
+  fi
+  pass "spawn rollback generation-validates both task temp cleanup paths"
+}
+
 test_preinstall_managed_failure_restores_artifact_snapshot() {
   local id rec expected out status artifact
   id=account-preinstall-rollback-z9f
@@ -6291,6 +6304,7 @@ if [ "${FM_TEST_FOCUSED:-}" = session-sync-teardown-race ]; then
 fi
 
 if [ "${FM_TEST_FOCUSED:-}" = rollback-safety ]; then
+  run_isolated_test test_spawn_rollback_uses_generation_safe_task_tmp_removal
   run_isolated_test test_secondmate_rollback_refuses_unsafe_tasktmp
   run_isolated_test test_rollback_backup_rejects_symlink_and_rechecks_under_lock
   exit 0

From dd52b12692a320bbd65cd707c75d493b5a296b9f Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Tue, 28 Jul 2026 02:44:15 -0400
Subject: [PATCH 22/34] no-mistakes(review): Exercise rollback temp cleanup
 failures

---
 tests/fm-account-routing.test.sh | 100 +++++++++++++++++++++++++++----
 1 file changed, 88 insertions(+), 12 deletions(-)

diff --git a/tests/fm-account-routing.test.sh b/tests/fm-account-routing.test.sh
index 11d9ae8b34..2ffe880f03 100755
--- a/tests/fm-account-routing.test.sh
+++ b/tests/fm-account-routing.test.sh
@@ -1655,17 +1655,93 @@ test_task_tmp_partial_removal_fails_closed() {
   pass "partial task temp removal fails closed"
 }
 
-test_spawn_rollback_uses_generation_safe_task_tmp_removal() {
-  local safe_cleanup_count
-  safe_cleanup_count=$(grep -cF \
-    '&& ! fm_account_safe_remove_task_tmp "$ID" "$TASK_TMP" "$SPAWN_GENERATION_ID"; then' \
-    "$ROOT/bin/fm-spawn.sh")
-  [ "$safe_cleanup_count" -eq 2 ] \
-    || fail "spawn rollback does not generation-validate both new task temp cleanup paths"
-  if grep -F 'rm -rf "$TASK_TMP"' "$ROOT/bin/fm-spawn.sh" >/dev/null 2>&1; then
-    fail "spawn rollback still removes a task temp root without descriptor-pinned validation"
-  fi
-  pass "spawn rollback generation-validates both task temp cleanup paths"
+test_spawn_rollback_task_tmp_refusal_is_retryable() {
+  local mode id rec marker release output ancestor moved outside tasktmp spawn_pid status tries
+  for mode in direct managed; do
+    id="account-tasktmp-rollback-$mode-z9g"
+    rec=$(make_case "tasktmp-rollback-$mode" claude "$id")
+    read_case "$rec"
+    marker="$CASE_DIR/gotmp-send-started"
+    release="$CASE_DIR/gotmp-send-release"
+    output="$CASE_DIR/spawn.out"
+    ancestor="$HOME_DIR/state/.task-tmp"
+    moved="$HOME_DIR/state/task-tmp-$mode-moved"
+    outside="$HOME_DIR/state/task-tmp-$mode-outside"
+    mkdir -p "$outside"
+
+    if [ "$mode" = direct ]; then
+      mkdir -p "$CASE_DIR/accounts/claude/account-1"
+      cat > "$FAKEBIN_DIR/herdr" <<'SH'
+#!/usr/bin/env bash
+set -u
+[ "${1:-}" = integration ] && [ "${2:-}" = install ] && [ "${3:-}" = claude ] || exit 64
+mkdir -p "${CLAUDE_CONFIG_DIR:?}/hooks"
+printf '#!/usr/bin/env bash\n' > "$CLAUDE_CONFIG_DIR/hooks/herdr-agent-state.sh"
+SH
+      chmod +x "$FAKEBIN_DIR/herdr"
+      FM_ACCOUNT_ROUTING_LEGACY_NEW_LAUNCH_TEST='' \
+        FM_ACCOUNT_DIRECTORY_TEST_LAB=firstmate-account-directory-test-lab-v1 \
+        FM_ACCOUNT_DIRECTORY_ROOT="$CASE_DIR/accounts" \
+        FM_ACCOUNT_DIRECTORY_HERDR="$FAKEBIN_DIR/herdr" \
+        FM_ACCOUNT_TEST_HOOKS=firstmate-account-tests-v1 \
+        FM_SAFE_TASK_TMP_SWAP_ANCESTOR="$ancestor" \
+        FM_SAFE_TASK_TMP_SWAP_MOVED="$moved" \
+        FM_SAFE_TASK_TMP_SWAP_OUTSIDE="$outside" \
+        FM_SAFE_TASK_TMP_DISAPPEAR_ENTRY=gotmp \
+        FM_FAKE_TMUX_GATE_SEND_MATCH=GOTMPDIR \
+        FM_FAKE_TMUX_GATE_SEND_MARKER="$marker" \
+        FM_FAKE_TMUX_GATE_SEND_RELEASE="$release" \
+        FM_FAKE_TMUX_FAIL_SEND_MATCH=GOTMPDIR \
+        run_spawn "$id" "$PROJ_DIR" --account-pool claude-crew > "$output" &
+    else
+      FM_ACCOUNT_TEST_HOOKS=firstmate-account-tests-v1 \
+        FM_SAFE_TASK_TMP_SWAP_ANCESTOR="$ancestor" \
+        FM_SAFE_TASK_TMP_SWAP_MOVED="$moved" \
+        FM_SAFE_TASK_TMP_SWAP_OUTSIDE="$outside" \
+        FM_SAFE_TASK_TMP_DISAPPEAR_ENTRY=gotmp \
+        FM_FAKE_TMUX_GATE_SEND_MATCH=GOTMPDIR \
+        FM_FAKE_TMUX_GATE_SEND_MARKER="$marker" \
+        FM_FAKE_TMUX_GATE_SEND_RELEASE="$release" \
+        FM_FAKE_TMUX_FAIL_SEND_MATCH=GOTMPDIR \
+        run_spawn "$id" "$PROJ_DIR" --account-pool claude-crew > "$output" &
+    fi
+    spawn_pid=$!
+    tries=0
+    while [ ! -f "$marker" ] && kill -0 "$spawn_pid" 2>/dev/null && [ "$tries" -lt 200 ]; do
+      sleep 0.05
+      tries=$((tries + 1))
+    done
+    if [ ! -f "$marker" ]; then
+      touch "$release"
+      wait "$spawn_pid" 2>/dev/null || true
+      fail "$mode rollback task temp test never reached its post-metadata failure"
+    fi
+    tasktmp=$(sed -n 's/^tasktmp=//p' "$HOME_DIR/state/$id.meta" | tail -1)
+    [ -n "$tasktmp" ] || {
+      touch "$release"
+      wait "$spawn_pid" 2>/dev/null || true
+      fail "$mode rollback task temp test did not publish provisional metadata"
+    }
+    mkdir -p "$outside/${tasktmp##*/}"
+    printf 'preserve\n' > "$outside/${tasktmp##*/}/sentinel"
+    touch "$release"
+    if wait "$spawn_pid"; then status=0; else status=$?; fi
+    [ "$status" -ne 0 ] || fail "$mode rollback task temp refusal unexpectedly succeeded"
+    assert_present "$outside/${tasktmp##*/}/sentinel" \
+      "$mode rollback followed the swapped task temp ancestor"
+    assert_present "$moved/${tasktmp##*/}" \
+      "$mode rollback discarded its partially cleaned task temp generation"
+    assert_contains "$(cat "$output")" "retaining cleanup metadata" \
+      "$mode rollback did not report retryable task temp cleanup"
+    if [ "$mode" = direct ]; then
+      assert_regex '^direct_spawn_cleanup=pending$' "$HOME_DIR/state/$id.meta" \
+        "direct rollback task temp refusal lost retry metadata"
+    else
+      assert_regex '^account_rollback_cleanup=pending$' "$HOME_DIR/state/$id.meta" \
+        "managed rollback task temp refusal lost retry metadata"
+    fi
+  done
+  pass "spawn rollback task temp refusals preserve outside data and retry state"
 }
 
 test_preinstall_managed_failure_restores_artifact_snapshot() {
@@ -6304,7 +6380,7 @@ if [ "${FM_TEST_FOCUSED:-}" = session-sync-teardown-race ]; then
 fi
 
 if [ "${FM_TEST_FOCUSED:-}" = rollback-safety ]; then
-  run_isolated_test test_spawn_rollback_uses_generation_safe_task_tmp_removal
+  run_isolated_test test_spawn_rollback_task_tmp_refusal_is_retryable
   run_isolated_test test_secondmate_rollback_refuses_unsafe_tasktmp
   run_isolated_test test_rollback_backup_rejects_symlink_and_rechecks_under_lock
   exit 0

From c8e4330a551d13689f9115842e9138f8de9ff509 Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Tue, 28 Jul 2026 05:00:35 -0400
Subject: [PATCH 23/34] no-mistakes(document): Correct stale routing and
 teardown documentation

---
 .agents/skills/secondmate-provisioning/SKILL.md | 2 +-
 bin/fm-backend.sh                               | 8 +++++---
 bin/fm-spawn.sh                                 | 5 +++--
 bin/fm-teardown.sh                              | 7 ++++---
 4 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/.agents/skills/secondmate-provisioning/SKILL.md b/.agents/skills/secondmate-provisioning/SKILL.md
index 3607a37c33..024c85d25d 100644
--- a/.agents/skills/secondmate-provisioning/SKILL.md
+++ b/.agents/skills/secondmate-provisioning/SKILL.md
@@ -77,7 +77,7 @@ An explicit `--account-pool` or `--account-profile` overrides it for that spawn,
 This pool is not inherited into the secondmate home because it governs the primary's secondmate launch, while `config/account-routing-mode` is inherited so the secondmate applies the same off/observe/enforce policy to its own crewmates.
 
 This section is the single owner of the secondmate sync and inheritable-config propagation contract; `AGENTS.md` sections 3 and 4 point here.
-Before launch, `fm-spawn.sh --secondmate` locally fast-forwards the home to the primary firstmate checkout's current default-branch commit when it is safe; dirty, diverged, or in-flight homes launch unchanged with a warning.
+Before launch, `fm-spawn.sh --secondmate` locally fast-forwards the home to the primary firstmate checkout's current default-branch commit when it is safe; other dirty, diverged, or in-flight homes launch unchanged with a warning, subject to the account-routing compatibility refusal owned by `docs/configuration.md` "Agent Fleet account routing."
 The locked session-start bootstrap sweep runs the same guarded fast-forward for every live secondmate home, discovered from `state/<id>.meta` records with `kind=secondmate` (`data/secondmates.md` only backfills `home=` for older records).
 That no-fetch path is a purely local fast-forward of tracked files, never an origin fetch, and it never touches the gitignored operational dirs, so a secondmate's backlog, projects, and in-flight work are never disturbed; a linked worktree advances immediately, while a standalone clone that lacks the target receives firstmate updates through `/updatefirstmate`'s origin refresh.
 The same launch and the same locked bootstrap sweep also propagate the primary's declared inheritable local config, currently `config/crew-dispatch.json`, `config/crew-harness`, `config/backlog-backend`, and `config/account-routing-mode`, into the secondmate home's `config/`.
diff --git a/bin/fm-backend.sh b/bin/fm-backend.sh
index 306746a358..685f3b9264 100644
--- a/bin/fm-backend.sh
+++ b/bin/fm-backend.sh
@@ -1034,9 +1034,11 @@ fm_backend_target_state() {  # <backend> <target> [expected-label] [recorded-sco
 # Scoped to today's --secondmate-spawn-capable backends with an empirically
 # verified classifier: tmux (docs/tmux-backend.md "Agent liveness probe") and
 # herdr (docs/herdr-backend.md "Agent liveness probe reuses the husk
-# classifier"). zellij, orca, and cmux report unknown until independently
-# verified - future work, not a functional gap for the two backends
-# --secondmate spawns actually support today plus tmux's reference path.
+# classifier"). Zellij can report dead only when the recorded session or pane
+# is structurally absent; a present pane remains unknown. Orca and cmux report
+# unknown until independently verified - future work, not a functional gap for
+# the two backends --secondmate spawns actually support today plus tmux's
+# reference path.
 # Callers must treat unknown exactly like an unreadable target: NEVER license
 # an action from it alone - the secondmate-liveness sweep gates a respawn on
 # `dead` only, precisely so a momentary read glitch can never duplicate a
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 9716587b9c..1677e1a267 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -3053,8 +3053,9 @@ fi
 # share a root even when their human-readable task ids match. Go won't
 # create GOTMPDIR, so mkdir before it is used; fm-teardown removes the whole root.
 # Nested (not a bare task-root/gotmp) so other per-task temp can live alongside
-# later, and teardown cleans one deterministic path. GOTMPDIR (not TMPDIR) is the
-# targeted knob: TMPDIR is too broad (affects every program's temp, not just Go's).
+# later, and teardown removes only this recorded generation. GOTMPDIR (not TMPDIR)
+# is the targeted knob: TMPDIR is too broad (affects every program's temp, not
+# just Go's).
 TASK_TMP=$SPAWN_TASK_TMP
 mkdir -p "$TASK_TMP/gotmp"
 # herdr sets GOTMPDIR natively at agent start. Every other backend exports it into
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index f09a47787c..72fcb3c774 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -43,9 +43,10 @@
 # the handle stale, and remove the recorded worktree under its checkout lock;
 # teardown never substitutes the shared window alias for a missing terminal.
 # Secondmates (kind=secondmate in meta) are retired explicitly. Teardown proves
-# the home clean and every ref and reflog commit landed, then quiesces its endpoint and
-# refuses while the home has in-flight crewmate meta files. --force authorizes
-# recursive retirement only after every child passes the same endpoint, identity,
+# the home clean and every ref and reflog commit landed, then without --force
+# refuses an in-flight child or non-empty child registry before quiescing the
+# endpoint. --force quiesces only after the parent proofs, then authorizes
+# recursive retirement after every child passes the same endpoint, identity,
 # cleanliness, stash, and landed-work proofs. Project retirement also rejects
 # mount boundaries, rewritten history, and landing authorities whose complete Git
 # object storage or network transport may depend on the retiring home or local machine. Removing a

From 28ffc42de884f4c77ba00782c809a917dd0169fa Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Tue, 28 Jul 2026 06:21:50 -0400
Subject: [PATCH 24/34] no-mistakes: apply CI fixes

---
 bin/fm-spawn.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 1677e1a267..16cea5f043 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -3487,8 +3487,8 @@ EOF
         echo "error: cannot durably record Orca create authority for $ID" >&2
         exit 1
       }
-      if [ -z "$ORCA_WORKTREE_ID" ] || [ -z "$WT" ] || [ "$ORCA_PROVIDER_TASK" != "$ORCA_EXPECTED_TASK" ]; then
-        echo "error: orca did not return matching worktree id, path, and task authority for $W" >&2
+      if [ -z "$ORCA_WORKTREE_ID" ] || [ -z "$WT" ]; then
+        echo "error: orca did not return worktree id and path authority for $W" >&2
         exit 1
       fi
       validate_spawn_worktree "orca worktree create" "$W"

From 6c68460330e1e353f56186c1b321e8fbd466f702 Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Tue, 28 Jul 2026 07:43:13 -0400
Subject: [PATCH 25/34] fix: stabilize Orca secondmate teardown checks

---
 bin/fm-spawn.sh               |  2 --
 bin/fm-teardown.sh            |  4 +++
 tests/fm-backend-orca.test.sh | 47 +++++++++++++++++++++++++++++------
 3 files changed, 43 insertions(+), 10 deletions(-)

diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 16cea5f043..25cf75b30c 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -959,7 +959,6 @@ ORCA_TERMINAL=
 ORCA_TERMINAL_PROOF=
 ORCA_REPO_ID=
 ORCA_EXPECTED_TASK=
-ORCA_PROVIDER_TASK=
 ID=
 ACCOUNT_LEASE_CREATED=0
 FM_ACCOUNT_MUTATION_ACQUIRED=0
@@ -1050,7 +1049,6 @@ parse_orca_worktree_result() {
   rest=${rest#*$'\t'}
   ORCA_REPO_ID=$rest
   case "$ORCA_REPO_ID" in *$'\t'*) return 1 ;; esac
-  ORCA_PROVIDER_TASK=
 }
 
 persist_orca_cleanup_quarantine() {
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index 72fcb3c774..fb6f48428f 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -412,6 +412,10 @@ quiesce_child_endpoint() {
   scoped_target=$(meta_value "$meta" tmux_session_target)
   [ "$backend" != orca ] || scoped_target=$(meta_value "$meta" orca_worktree_id)
   if [ "$backend" = orca ]; then
+    [ -n "$target" ] || {
+      echo "error: child endpoint identity for $task is missing; refusing destructive cleanup" >&2
+      return 1
+    }
     quiesce_authoritative_orca_endpoint "$target" "$scoped_target" "fm-$task" || {
       echo "error: child Orca endpoint authority or quiescence is unproven for $task" >&2
       return 1
diff --git a/tests/fm-backend-orca.test.sh b/tests/fm-backend-orca.test.sh
index 28ba2977e1..d52886efa4 100755
--- a/tests/fm-backend-orca.test.sh
+++ b/tests/fm-backend-orca.test.sh
@@ -119,7 +119,9 @@ case "${1:-} ${2:-}" in
     else
       worktree="wt-${terminal#term-}"
     fi
-    if [ -f "$RESP/.terminal-title" ]; then
+    if [ -n "${FM_ORCA_DEFAULT_TERMINAL_TITLE:-}" ]; then
+      title=$FM_ORCA_DEFAULT_TERMINAL_TITLE
+    elif [ -f "$RESP/.terminal-title" ]; then
       title=$(cat "$RESP/.terminal-title")
     elif [ -n "${FM_STATE_OVERRIDE:-}" ] && [ -d "$FM_STATE_OVERRIDE" ]; then
       title=
@@ -160,6 +162,9 @@ process.stdout.write(JSON.stringify(data) + "\n");
     if [ -n "${FM_ORCA_REMOVE_ERROR:-}" ]; then
       printf '{"ok":false,"error":{"code":"worktree_not_removed","message":"worktree not removed"}}\n'
     else
+      if [ -n "${FM_ORCA_REMOVE_PROJECT:-}" ] && [ -n "${FM_ORCA_REMOVE_PATH:-}" ]; then
+        git -C "$FM_ORCA_REMOVE_PROJECT" worktree remove --force "$FM_ORCA_REMOVE_PATH" || exit 1
+      fi
       printf '{"ok":true,"result":{"removed":true}}\n'
     fi
     ;;
@@ -194,9 +199,27 @@ SH
 initialize_secondmate_home_repo() {
   local home=$1 source=$2
   fm_git_init_commit "$home"
+  git -C "$home" branch -M main
+  printf '%s\n' '.fm-secondmate-home' 'projects/' 'state/' > "$home/.gitignore"
+  git -C "$home" add .gitignore
+  git -C "$home" -c user.name='Firstmate Tests' -c user.email=tests@example.invalid \
+    commit -qm 'ignore operational state'
+  git -C "$source" fetch -q "$home" HEAD
+  git -C "$source" update-ref refs/heads/main FETCH_HEAD
   git -C "$home" remote add origin "$source"
 }
 
+initialize_secondmate_project_repo() {
+  local source_root=$1 clone=$2 worktree=$3 branch=$4 authority
+  authority="$source_root/project-origins/alpha"
+  mkdir -p "$source_root/projects" "$source_root/project-origins"
+  fm_git_init_commit "$authority"
+  git clone -q "$authority" "$source_root/projects/alpha"
+  git clone -q "$source_root/projects/alpha" "$clone"
+  git -C "$clone" remote set-url origin "$authority"
+  git -C "$clone" worktree add --quiet -b "$branch" "$worktree"
+}
+
 add_tmux_fake() {
   local fb=$1
   cat > "$fb/tmux" <<'SH'
@@ -1861,7 +1884,10 @@ test_secondmate_force_teardown_removes_orca_child_via_orca() {
   child_id="orcachildz6"
   mkdir -p "$home/state" "$home/data" "$subhome/state" "$subhome/projects"
   printf 'domain\n' > "$subhome/.fm-secondmate-home"
-  fm_git_worktree "$childproj" "$childwt" "fm/$child_id"
+  orca_case secondmate-child-cleanup
+  neutral=$(neutral_fm_root "$CASE_DIR/neutral")
+  initialize_secondmate_home_repo "$subhome" "$neutral"
+  initialize_secondmate_project_repo "$home" "$childproj" "$childwt" "fm/$child_id"
   fm_write_meta "$home/state/domain.meta" \
     "window=firstmate:fm-domain" "worktree=$subhome" "project=$subhome" \
     "harness=echo" "kind=secondmate" "mode=secondmate" "yolo=off" \
@@ -1872,13 +1898,14 @@ test_secondmate_force_teardown_removes_orca_child_via_orca() {
     "window=fm-$child_id" "terminal=term-child-cleanup" "worktree=$childwt" "project=$childproj" \
     "harness=claude" "kind=ship" "mode=no-mistakes" "yolo=off" \
     "backend=orca" "orca_worktree_id=wt-child-cleanup"
-  orca_case secondmate-child-cleanup
   printf '{"ok":true,"result":{"worktree":{"id":"wt-child-cleanup","name":"fm-%s","path":"%s","terminals":[{"handle":"term-child-cleanup","title":"fm-%s"}]}}}\n' \
     "$child_id" "$childwt" "$child_id" > "$RESP/1.out"
   add_tmux_fake "$FB"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
   initialize_secondmate_home_repo "$subhome" "$neutral"
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
+    FM_ORCA_DEFAULT_TERMINAL_TITLE="fm-$child_id" \
+    FM_ORCA_REMOVE_PROJECT="$childproj" FM_ORCA_REMOVE_PATH="$childwt" \
     FM_ROOT_OVERRIDE="$neutral" FM_HOME="$home" "$ROOT/bin/fm-teardown.sh" domain --force 2>&1 )
   rc=$?
   expect_code 0 "$rc" "forced secondmate teardown should remove Orca child work through Orca"$'\n'"$out"
@@ -1902,8 +1929,11 @@ test_secondmate_force_teardown_refuses_orca_child_id_path_mismatch() {
   child_id="orcachildmismatchz1"
   mkdir -p "$home/state" "$home/data" "$subhome/state" "$subhome/projects"
   printf 'domain\n' > "$subhome/.fm-secondmate-home"
-  fm_git_worktree "$childproj" "$childwt" "fm/$child_id"
-  git -C "$childproj" worktree add --quiet -b "fm/$child_id-other" "$other_wt"
+  orca_case secondmate-child-mismatch
+  neutral=$(neutral_fm_root "$CASE_DIR/neutral")
+  initialize_secondmate_home_repo "$subhome" "$neutral"
+  initialize_secondmate_project_repo "$home" "$childproj" "$childwt" "fm/$child_id"
+  mkdir -p "$other_wt"
   fm_write_meta "$home/state/domain.meta" \
     "window=firstmate:fm-domain" "worktree=$subhome" "project=$subhome" \
     "harness=echo" "kind=secondmate" "mode=secondmate" "yolo=off" \
@@ -1914,7 +1944,6 @@ test_secondmate_force_teardown_refuses_orca_child_id_path_mismatch() {
     "window=fm-$child_id" "terminal=term-child-mismatch" "worktree=$childwt" "project=$childproj" \
     "harness=claude" "kind=ship" "mode=no-mistakes" "yolo=off" \
     "backend=orca" "orca_worktree_id=wt-child-mismatch"
-  orca_case secondmate-child-mismatch
   printf '{"ok":true,"result":{"worktree":{"id":"wt-child-mismatch","path":"%s"}}}\n' "$other_wt" > "$RESP/1.out"
   add_tmux_fake "$FB"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
@@ -1942,7 +1971,10 @@ test_secondmate_force_teardown_retains_partial_orca_child() {
   child_id="orcapartialz9"
   mkdir -p "$home/state" "$home/data" "$subhome/state" "$subhome/projects"
   printf 'domain\n' > "$subhome/.fm-secondmate-home"
-  fm_git_worktree "$childproj" "$childwt" "fm/$child_id"
+  orca_case secondmate-partial-child-cleanup
+  neutral=$(neutral_fm_root "$CASE_DIR/neutral")
+  initialize_secondmate_home_repo "$subhome" "$neutral"
+  initialize_secondmate_project_repo "$home" "$childproj" "$childwt" "fm/$child_id"
   fm_write_meta "$home/state/domain.meta" \
     "window=firstmate:fm-domain" "worktree=$subhome" "project=$subhome" \
     "harness=echo" "kind=secondmate" "mode=secondmate" "yolo=off" \
@@ -1953,7 +1985,6 @@ test_secondmate_force_teardown_retains_partial_orca_child() {
     "window=fm-$child_id" "worktree=$childwt" "project=$childproj" \
     "harness=claude" "kind=ship" "mode=no-mistakes" "yolo=off" \
     "backend=orca" "orca_worktree_id=wt-partial-child"
-  orca_case secondmate-partial-child-cleanup
   printf '{"ok":true,"result":{"worktree":{"id":"wt-partial-child","path":"%s"}}}\n' "$childwt" > "$RESP/1.out"
   add_tmux_fake "$FB"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")

From 35f87e772fe09a3c10e29dc1e87fe76d91a527b3 Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Tue, 28 Jul 2026 09:30:00 -0400
Subject: [PATCH 26/34] fix: fail closed on checkout reinspection

---
 bin/fm-checkout-refresh.sh | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/bin/fm-checkout-refresh.sh b/bin/fm-checkout-refresh.sh
index 91af403fb6..4cfbc4deb7 100755
--- a/bin/fm-checkout-refresh.sh
+++ b/bin/fm-checkout-refresh.sh
@@ -1882,6 +1882,18 @@ record_reinspection_failure() {
   }
 }
 
+reinspect_covered_checkout() {
+  local checkout=$1 count
+  if [ "${FM_CHECKOUT_REFRESH_TEST:-0}" = 1 ] \
+      && [ "${FM_CHECKOUT_TEST_REINSPECTION_FAILURE_AT:-}" = "$checkout" ]; then
+    count=$(cat "${FM_CHECKOUT_TEST_REINSPECTION_COUNT:?}" 2>/dev/null || printf 0)
+    count=$((count + 1))
+    printf '%s\n' "$count" > "$FM_CHECKOUT_TEST_REINSPECTION_COUNT"
+    return 1
+  fi
+  exact_git_root "$checkout"
+}
+
 CHECKOUT_REFRESH_AUTHORITY=
 resolve_checkout_refresh_authority() {
   local checkout=$1 mode_line mode
@@ -2423,9 +2435,10 @@ run_once() {
 
   while IFS= read -r checkout; do
     [ -n "$checkout" ] || continue
-    if ! reinspected=$(exact_git_root "$checkout") || [ "$reinspected" != "$checkout" ]; then
+    if ! reinspected=$(reinspect_covered_checkout "$checkout") || [ "$reinspected" != "$checkout" ]; then
       record_reinspection_failure "$checkout" || status=1
       coverage_failed=1
+      status=1
       continue
     fi
     key=$(checkout_key "$checkout") || {
@@ -2447,9 +2460,10 @@ run_once() {
 
   while IFS= read -r checkout; do
     [ -n "$checkout" ] || continue
-    if ! reinspected=$(exact_git_root "$checkout") || [ "$reinspected" != "$checkout" ]; then
+    if ! reinspected=$(reinspect_covered_checkout "$checkout") || [ "$reinspected" != "$checkout" ]; then
       record_reinspection_failure "$checkout" || status=1
       coverage_failed=1
+      status=1
       continue
     fi
     key=$(checkout_key "$checkout") || {

From 01284ded014582e86ec9ee31ec46c23dd1e15fc2 Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Tue, 28 Jul 2026 10:16:48 -0400
Subject: [PATCH 27/34] ci: allow behavior suite to complete

---
 .github/workflows/ci.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 652e768c25..96e89ac78b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,9 +27,9 @@ jobs:
   tests:
     name: Behavior tests
     runs-on: ubuntu-latest
-    # The pre-cutover suite reached 25m35s, and the exhaustive Bridge crash
-    # matrix adds bounded work. Keep enough margin without masking a real hang.
-    timeout-minutes: 45
+    # The expanded suite was still making forward progress when the prior 45m
+    # budget expired. Allow measured headroom while retaining a finite hang cap.
+    timeout-minutes: 90
     steps:
       - uses: actions/checkout@v6
         with:

From 6609f2c65681e91c25fe37cddc4f81c15277b54a Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Tue, 28 Jul 2026 11:15:04 -0400
Subject: [PATCH 28/34] test: stabilize secondmate lifecycle git fixture

---
 tests/fm-secondmate-lifecycle-e2e.test.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/fm-secondmate-lifecycle-e2e.test.sh b/tests/fm-secondmate-lifecycle-e2e.test.sh
index 043810fbfa..a62b82b417 100755
--- a/tests/fm-secondmate-lifecycle-e2e.test.sh
+++ b/tests/fm-secondmate-lifecycle-e2e.test.sh
@@ -27,6 +27,7 @@ set -u
 # shellcheck source=tests/secondmate-helpers.sh disable=SC1091
 . "$(dirname "${BASH_SOURCE[0]}")/secondmate-helpers.sh"
 
+fm_git_identity fmtest fmtest@example.invalid
 fm_test_tmproot_into TMP_ROOT fm-secondmate-lifecycle
 export FM_BACKEND=tmux
 
@@ -52,7 +53,7 @@ setup_world() {
     > "$HOME_DIR/projects/gamma/.gitignore"
   git -C "$HOME_DIR/projects/gamma" add .gitignore
   git -C "$HOME_DIR/projects/gamma" commit -qm 'ignore local no-mistakes test state'
-  git -C "$HOME_DIR/projects/gamma" push -q origin main
+  git -C "$HOME_DIR/projects/gamma" push -q origin HEAD
   cat > "$HOME_DIR/data/projects.md" <<EOF
 - alpha [direct-PR +yolo] - alpha project (added 2026-06-22)
 - beta [direct-PR] - beta project (added 2026-06-22)

From 1063b2cf2ef95760d93ddcf2eea6993017826b6a Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Tue, 28 Jul 2026 23:33:10 -0400
Subject: [PATCH 29/34] test: reconcile routing fixtures with updated base

---
 tests/fm-account-routing.test.sh |  6 ++----
 tests/lib.sh                     | 11 +++++++++++
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/tests/fm-account-routing.test.sh b/tests/fm-account-routing.test.sh
index 2ffe880f03..b036b6f94e 100755
--- a/tests/fm-account-routing.test.sh
+++ b/tests/fm-account-routing.test.sh
@@ -2449,7 +2449,7 @@ test_enforced_secondmate_requires_routing_inheritance_and_capable_home() {
   status=$?
   [ "$status" -ne 0 ] || fail "enforced secondmate launched from a pre-Agent-Fleet home"
   assert_contains "$out" "$sm" "capability refusal omitted the offending secondmate home"
-  assert_contains "$out" "lacks Agent Fleet routing support" \
+  assert_contains "$out" "missing tracked Agent Fleet routing support" \
     "capability refusal did not stop at the capability gate"
   assert_not_grep '^new-window ' "$TMUX_LOG" "capability refusal created an endpoint"
   pass "enforced secondmates require inherited routing policy and Agent Fleet-capable homes"
@@ -2489,10 +2489,8 @@ test_secondmate_routing_inheritance_is_authoritative_for_every_mode() {
   rec=$(make_case secondmate-off-incapable claude)
   read_case "$rec"
   sm="$CASE_DIR/secondmate-home"
-  make_seeded_secondmate_home "$sm" "$id"
+  make_seeded_secondmate_home "$sm" "$id" incapable
   sm=$(cd "$sm" && pwd -P)
-  git -C "$sm" update-index --assume-unchanged bin/fm-account-routing-lib.sh
-  rm -f "$sm/bin/fm-account-routing-lib.sh"
   out=$(FM_TEST_PANE_PATH="$sm" run_spawn "$id" "$sm" --secondmate)
   status=$?
   [ "$status" -eq 0 ] || fail "routing-off secondmate refused a clean legacy home"
diff --git a/tests/lib.sh b/tests/lib.sh
index a691df66f3..eb8ecb8e77 100644
--- a/tests/lib.sh
+++ b/tests/lib.sh
@@ -86,6 +86,17 @@ fm_test_tmproot() {
   printf '%s\n' "$root"
 }
 
+# Compatibility for suites replayed from the run-unique temp-root migration.
+# The manifest-backed allocator remains authoritative and Bash 3.2 safe.
+fm_test_tmproot_into() {
+  local target_var=$1 prefix=${2:-fm-test} root
+  case "$target_var" in
+    ''|[!A-Za-z_]*|*[!A-Za-z0-9_]*) return 2 ;;
+  esac
+  root=$(fm_test_tmproot "$prefix") || return 1
+  printf -v "$target_var" '%s' "$root"
+}
+
 # --- node capability probe ---------------------------------------------------
 #
 # fm_node_supports_ts_import succeeds when the ambient node can import a .ts

From 0e5b7ae7ba0c70f346a2dd969a3b922bb3081591 Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Tue, 28 Jul 2026 23:58:46 -0400
Subject: [PATCH 30/34] test: preserve Orca failure capture after rebase

---
 tests/fm-backend-orca.test.sh | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/tests/fm-backend-orca.test.sh b/tests/fm-backend-orca.test.sh
index d52886efa4..023b8d47c9 100755
--- a/tests/fm-backend-orca.test.sh
+++ b/tests/fm-backend-orca.test.sh
@@ -566,7 +566,7 @@ test_remove_worktree_refuses_empty_id() {
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     bash -c '. "$0/bin/backends/orca.sh"; fm_backend_orca_remove_worktree ""' "$ROOT" 2>&1 )
   status=$?
-  set -e
+  set +e
   [ "$status" -ne 0 ] || fail "remove_worktree should fail when the Orca worktree id is empty"
   assert_contains "$out" "missing Orca worktree id" "remove_worktree did not explain the missing id"
   [ ! -s "$LOG" ] || fail "remove_worktree should not call Orca with an empty id"
@@ -582,7 +582,7 @@ test_remove_worktree_rejects_orca_error_json() {
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     bash -c '. "$0/bin/backends/orca.sh"; fm_backend_orca_remove_worktree_bound wt-gone /tmp/orca-wt "$1"' "$ROOT" "$token" 2>&1 )
   status=$?
-  set -e
+  set +e
   [ "$status" -ne 0 ] || fail "bound remove_worktree should fail on Orca ok:false JSON"
   assert_contains "$out" "worktree not found" "bound remove_worktree should surface the Orca removal error"
   assert_contains "$(cat "$LOG")" $'--expected-path\x1f/tmp/orca-wt' \
@@ -596,10 +596,12 @@ test_remove_worktree_requires_bound_provider_capability() {
   local out status token
   orca_case remove-boundary-capability
   token=bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
+  set +e
   out=$(PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ORCA_TEST_BOUND_REMOVAL_CAPABILITIES=unavailable \
     bash -c '. "$0/bin/backends/orca.sh"; fm_backend_orca_remove_worktree_bound wt-retained /tmp/orca-wt "$1"' "$ROOT" "$token" 2>&1)
   status=$?
+  set +e
   [ "$status" -ne 0 ] || fail "Orca removal proceeded without a bound provider capability"
   assert_contains "$out" "identity-bound provider capability" \
     "unbound Orca removal did not surface its provider limitation"
@@ -773,13 +775,15 @@ test_legacy_respawn_refuses_without_provider_task_authority() {
   printf '1\n' > "$RESP/1.exit"
   printf '{"ok":true,"result":{"repo":{"id":"repo-spawn"}}}\n' > "$RESP/2.out"
   printf '{"ok":true,"result":{"worktree":{"id":"wt-spawn","path":"%s"},"terminal":{"handle":"term-spawn"}}}\n' "$wt" > "$RESP/3.out"
+  printf '{"ok":true,"result":{"worktree":{"id":"wt-spawn","path":"%s","terminals":[{"handle":"term-spawn"}]}}}\n' \
+    "$wt" > "$RESP/4.out"
   if out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" FM_SPAWN_NO_GUARD=1 \
     "$ROOT/bin/fm-spawn.sh" "$id" "$proj" claude --backend orca 2>&1 ); then
     fail "legacy Orca respawn proceeded without provider task authority"
   fi
-  assert_contains "$out" "did not return matching worktree id, path, and task authority" \
+  assert_contains "$out" "Orca terminal is not authoritatively bound" \
     "legacy Orca respawn did not explain its fail-closed authority refusal"
   assert_not_contains "$(cat "$log")" $'orca\x1f''terminal'$'\x1f''send' \
     "refused legacy Orca respawn launched the harness"

From 4130ede1690b50cc54da80a6d390678281252b92 Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Wed, 29 Jul 2026 00:39:10 -0400
Subject: [PATCH 31/34] test: make routing race fixtures deterministic

---
 tests/fm-account-routing.test.sh | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/tests/fm-account-routing.test.sh b/tests/fm-account-routing.test.sh
index b036b6f94e..f7d168a2f2 100755
--- a/tests/fm-account-routing.test.sh
+++ b/tests/fm-account-routing.test.sh
@@ -4807,8 +4807,12 @@ test_continuation_rollback_preserves_concurrent_packet_replacement() {
     FM_ACCOUNT_CONTINUATION_INSTALL_TEST_PROCEED="$proceed" PATH="$FAKEBIN_DIR:$PATH" \
     "$CONTINUATION" "$id" owned-rollback > "$output" 2>&1 &
   packet_pid=$!
-  for _ in $(seq 1 100); do [ -e "$ready" ] && break; sleep 0.05; done
-  [ -e "$ready" ] || { kill -TERM "$packet_pid" 2>/dev/null || true; fail "owned-rollback continuation gate did not open"; }
+  for _ in $(seq 1 400); do [ -e "$ready" ] && break; sleep 0.05; done
+  [ -e "$ready" ] || {
+    kill -TERM "$packet_pid" 2>/dev/null || true
+    wait "$packet_pid" 2>/dev/null || true
+    fail "owned-rollback continuation gate did not open: $(cat "$output" 2>/dev/null)"
+  }
   rm -f "$packet"
   cp "$replacement" "$packet"
   printf 'changed during owned packet rollback\n' > "$worktree/owned-rollback-race.txt"
@@ -5166,10 +5170,10 @@ SH
   rm -rf "$lock"
 
   mkdir -p "$lock/.reclaiming"
-  printf '%s\nstale-reclaimer\n' "$$" > "$lock/.reclaiming/owner"
+  printf '999999\nstale-reclaimer\n' > "$lock/.reclaiming/owner"
   touch -t 200001010000 "$lock" "$lock/.reclaiming"
   FM_ACCOUNT_META_LOCK_WAIT_SECONDS=2 FM_ACCOUNT_META_LOCK_ORPHAN_GRACE_SECONDS=0 \
-    bash -c '. "$1"; held=$(fm_account_meta_lock_acquire "$2" lock-task); fm_account_meta_lock_release "$held"' \
+    bash -c '. "$1"; held=$(fm_account_meta_lock_acquire "$2" lock-task) || exit $?; fm_account_meta_lock_release "$held"' \
     _ "$ROOT/bin/fm-account-routing-lib.sh" "$state" || fail "abandoned metadata reclaim owner blocked acquisition"
   assert_absent "$lock" "metadata lock retained an abandoned reclaim owner"
   pass "metadata locks reclaim abandoned directories without deleting new owners"

From 82d3465369527f9ce80a1b74f0b559bf50ea7f8b Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Wed, 29 Jul 2026 01:06:50 -0400
Subject: [PATCH 32/34] test: make checkout reinspection fixture observable

---
 tests/fm-checkout-refresh.test.sh | 40 ++++++++-----------------------
 1 file changed, 10 insertions(+), 30 deletions(-)

diff --git a/tests/fm-checkout-refresh.test.sh b/tests/fm-checkout-refresh.test.sh
index cdd102b548..06d92416e1 100755
--- a/tests/fm-checkout-refresh.test.sh
+++ b/tests/fm-checkout-refresh.test.sh
@@ -943,7 +943,7 @@ test_lock_root_failure_invalidates_coverage_before_preparation() {
 }
 
 test_reinspection_failure_invalidates_coverage_health() {
-  local remote home state_root lock_root treehouse project fakebin real_git out key alert
+  local remote home state_root lock_root treehouse project out status key alert
   local initial_head reinspection_count
   remote=$(build_origin reinspection)
   home="$TMP_ROOT/reinspection-home"
@@ -951,54 +951,34 @@ test_reinspection_failure_invalidates_coverage_health() {
   lock_root="$TMP_ROOT/reinspection-locks"
   treehouse="$TMP_ROOT/reinspection-treehouse"
   project="$home/projects/reinspection"
-  fakebin="$TMP_ROOT/reinspection-fakebin"
-  real_git=$(command -v git)
   fm_git_init_commit "$home"
-  mkdir -p "$home/projects" "$home/config" "$state_root" "$treehouse" "$fakebin"
+  mkdir -p "$home/projects" "$home/config" "$state_root" "$treehouse"
   clone_from "$remote" "$project"
   project=$(cd "$project" && pwd -P)
   home=$(cd "$home" && pwd -P)
   initial_head=$(git -C "$project" rev-parse HEAD)
   advance_origin reinspection changed-after-discovery
   printf '%s\n' manual-reinspection-heartbeat > "$state_root/heartbeat"
-  cat > "$fakebin/git" <<'SH'
-#!/usr/bin/env bash
-if [ "${1:-}" = -C ] \
-  && [ "${2:-}" = "${FM_TEST_REINSPECTION_TARGET:?}" ] \
-  && [ "${3:-}" = rev-parse ] \
-  && [ "${4:-}" = --show-toplevel ]; then
-  count=$(cat "${FM_TEST_REINSPECTION_COUNT:?}" 2>/dev/null || printf 0)
-  count=$((count + 1))
-  printf '%s\n' "$count" > "$FM_TEST_REINSPECTION_COUNT"
-  # Fail each post-discovery exact-root proof, then allow the immediately
-  # following stable-key lookup used to persist the alert. This keeps the
-  # fixture on the reinspection-failure path without making alert identity
-  # resolution fail first.
-  if [ $((count % 2)) -eq 0 ]; then
-    printf '%s\n' "${FM_TEST_REINSPECTION_ENCLOSING:?}"
-    exit 0
-  fi
-fi
-exec "${FM_TEST_REAL_GIT:?}" "$@"
-SH
-  chmod +x "$fakebin/git"
 
+  set +e
   out=$(HOME="$TEST_HOME" FM_HOME="$home" FM_ROOT_OVERRIDE="$ROOT" \
     FM_CHECKOUT_REFRESH_STATE_ROOT="$state_root" \
     FM_CHECKOUT_REFRESH_LOCK_ROOT="$lock_root" \
     FM_TREEHOUSE_ROOT="$treehouse" \
-    FM_TEST_REAL_GIT="$real_git" FM_TEST_REINSPECTION_TARGET="$project" \
-    FM_TEST_REINSPECTION_ENCLOSING="$home" \
-    FM_TEST_REINSPECTION_COUNT="$TMP_ROOT/reinspection-count" \
-    PATH="$fakebin:$PATH" \
+    FM_CHECKOUT_REFRESH_TEST=1 \
+    FM_CHECKOUT_TEST_REINSPECTION_FAILURE_AT="$project" \
+    FM_CHECKOUT_TEST_REINSPECTION_COUNT="$TMP_ROOT/reinspection-count" \
     "$ROOT/bin/fm-checkout-refresh.sh" run-once --force 2>&1)
+  status=$?
+  set -e
 
+  [ "$status" -ne 0 ] || fail "covered-checkout reinspection failure reported healthy coverage"
   assert_contains "$out" "$project: skipped: covered checkout became uninspectable during refresh" \
     "covered-checkout reinspection failure was not surfaced"
   assert_refresh_state "$state_root" unhealthy
   assert_heartbeat_value "$state_root" manual-reinspection-heartbeat
   reinspection_count=$(cat "$TMP_ROOT/reinspection-count")
-  [ "$reinspection_count" -ge 3 ] \
+  [ "$reinspection_count" -eq 2 ] \
     || fail "both post-discovery passes did not repeat the exact-root proof"
   [ "$(git -C "$project" rev-parse HEAD)" = "$initial_head" ] \
     || fail "identity-drifted covered path was refreshed through its enclosing repository"

From e0afca5f0fd7065f84d2a568059a3697b9582edc Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Wed, 29 Jul 2026 01:07:27 -0400
Subject: [PATCH 33/34] test: use observable stale lock owners

---
 tests/fm-account-routing.test.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tests/fm-account-routing.test.sh b/tests/fm-account-routing.test.sh
index f7d168a2f2..ad7b554946 100755
--- a/tests/fm-account-routing.test.sh
+++ b/tests/fm-account-routing.test.sh
@@ -5131,7 +5131,9 @@ test_account_metadata_lock_reclaims_orphans_without_overlapping_owners() {
   [ "$owner_lines" -eq 2 ] || fail "published metadata lock did not contain complete ownership"
 
   mkdir -p "$lock"
-  printf '%s\nstale-owner\n' "$$" > "$lock/owner"
+  # PID 1 is observable on both CI Linux and macOS; the deliberately mismatched
+  # start identity makes this owner stale without assuming a PID is absent.
+  printf '1\nstale-owner\n' > "$lock/owner"
   workers="$case_dir/workers.sh"
   cat > "$workers" <<'SH'
 #!/usr/bin/env bash
@@ -5170,7 +5172,7 @@ SH
   rm -rf "$lock"
 
   mkdir -p "$lock/.reclaiming"
-  printf '999999\nstale-reclaimer\n' > "$lock/.reclaiming/owner"
+  printf '1\nstale-reclaimer\n' > "$lock/.reclaiming/owner"
   touch -t 200001010000 "$lock" "$lock/.reclaiming"
   FM_ACCOUNT_META_LOCK_WAIT_SECONDS=2 FM_ACCOUNT_META_LOCK_ORPHAN_GRACE_SECONDS=0 \
     bash -c '. "$1"; held=$(fm_account_meta_lock_acquire "$2" lock-task) || exit $?; fm_account_meta_lock_release "$held"' \

From 7e18d3ee4dc142164e33f66e4491825ee9d0ecc1 Mon Sep 17 00:00:00 2001
From: Dongkeun Lee <dongkeun@rubydata.ai>
Date: Wed, 29 Jul 2026 02:15:21 -0400
Subject: [PATCH 34/34] test: isolate teardown task temp fixture

---
 tests/fm-teardown.test.sh | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/tests/fm-teardown.test.sh b/tests/fm-teardown.test.sh
index a8c8e62cb9..82163768bb 100755
--- a/tests/fm-teardown.test.sh
+++ b/tests/fm-teardown.test.sh
@@ -3212,13 +3212,15 @@ test_teardown_refuses_unsafe_tasktmp_metadata() {
 
 test_teardown_removes_safe_tasktmp_and_accepts_absence() {
   local case_dir tasktmp
-  tasktmp=/tmp/fm-task-x1
-  assert_absent "$tasktmp" "safe tasktmp fixture collided with an existing task temp root"
+  case_dir=$(make_case safe-tasktmp)
+  tasktmp="$case_dir/state/.task-tmp/fm-task-x1-safe-tasktmp"
   mkdir -p "$tasktmp/gotmp"
   printf '%s\n' leftover > "$tasktmp/gotmp/build-artifact"
 
-  case_dir=$(make_case safe-tasktmp)
   write_meta "$case_dir" local-only ship
+  sed -i.bak 's/^generation_id=.*/generation_id=spawn:safe-tasktmp/' \
+    "$case_dir/state/task-x1.meta"
+  rm -f "$case_dir/state/task-x1.meta.bak"
   printf 'tasktmp=%s\n' "$tasktmp" >> "$case_dir/state/task-x1.meta"
   run_teardown "$case_dir" > "$case_dir/stdout" 2> "$case_dir/stderr" \
     || fail "teardown rejected its exact task temp root: $(cat "$case_dir/stderr")"