diff --git a/bin/backends/cmux.sh b/bin/backends/cmux.sh
index 12dc7629eb..1a29ccdaf2 100644
--- a/bin/backends/cmux.sh
+++ b/bin/backends/cmux.sh
@@ -341,6 +341,27 @@ fm_backend_cmux_surface_id_for_workspace() {  # <workspace_id>
     | jq -r '.panes[0] // {} | .selected_surface_id // (.surface_ids[0] // empty)' 2>/dev/null
 }
 
+# fm_backend_cmux_workspace_matches_label: does <workspace_id> still carry the
+# workspace title firstmate expects for caller-facing task label <label>?
+# Looked up by exact id (never falls back to searching by label alone the
+# way fm_backend_cmux_target_ready does for its reconnect purpose), so a
+# workspace id that no longer resolves at all is a refusal, not a signal to
+# go find some other live workspace that happens to share the title.
+# Mirrors fm_backend_zellij_tab_matches_label's scoped/bare-with-ambiguity
+# rules: checks the home-scoped title first, then the legacy bare label, but
+# only when the bare title is not ambiguous across live workspaces.
+fm_backend_cmux_workspace_matches_label() {  # <workspace_id> <label>
+  local workspace_id=$1 label=$2 scoped workspaces count
+  scoped=$(fm_backend_cmux_scoped_title "$label")
+  workspaces=$(fm_backend_cmux_cli workspace list --json --id-format uuids 2>/dev/null)
+  printf '%s' "$workspaces" | jq -e --arg id "$workspace_id" --arg want "$scoped" \
+    '[.workspaces[]? | select(.id == $id and .title == $want)] | length > 0' >/dev/null 2>&1 && return 0
+  printf '%s' "$workspaces" | jq -e --arg id "$workspace_id" --arg want "$label" \
+    '[.workspaces[]? | select(.id == $id and .title == $want)] | length > 0' >/dev/null 2>&1 || return 1
+  count=$(printf '%s' "$workspaces" | jq -r --arg want "$label" '[.workspaces[]? | select(.title == $want)] | length' 2>/dev/null)
+  [ "$count" = "1" ]
+}
+
 # fm_backend_cmux_create_task: create the task's workspace (one surface),
 # refusing an existing live <label> (finding #6: cmux enforces no uniqueness
 # itself). Resolves the fresh workspace's default surface via one list-panes
@@ -403,6 +424,19 @@ fm_backend_cmux_surface_exists() {  # <workspace_id> <surface_id>
     | jq -e --arg s "$sfid" '[.panes[]? | select(.surface_ids // [] | index($s))] | length > 0' >/dev/null 2>&1
 }
 
+# fm_backend_cmux_surface_verifies_task: does <surface_id> still exist inside
+# <workspace_id>, and does that exact workspace still carry the task label
+# for <task_id>? Mirrors fm_backend_herdr_pane_verifies_task's identity-proof
+# role for legacy-metadata self-repair (bin/fm-backend.sh): both the surface
+# membership and the workspace's own title must independently hold, or this
+# refuses rather than guessing.
+fm_backend_cmux_surface_verifies_task() {  # <workspace_id> <surface_id> <task_id>
+  local workspace_id=$1 surface_id=$2 task_id=$3
+  [ -n "$workspace_id" ] && [ -n "$surface_id" ] && [ -n "$task_id" ] || return 1
+  fm_backend_cmux_surface_exists "$workspace_id" "$surface_id" || return 1
+  fm_backend_cmux_workspace_matches_label "$workspace_id" "fm-$task_id"
+}
+
 # fm_backend_cmux_target_ready: parse the target and verify it is live via
 # fm_backend_cmux_surface_exists (never read-screen - see that function's
 # header for the fresh-surface pitfall this avoids). When the caller knows
diff --git a/bin/backends/zellij.sh b/bin/backends/zellij.sh
index 20d53a3c2d..f0811cc640 100644
--- a/bin/backends/zellij.sh
+++ b/bin/backends/zellij.sh
@@ -308,6 +308,24 @@ fm_backend_zellij_tab_matches_label() {  # <session> <tab_id> <label>
   [ "$count" = "1" ]
 }
 
+# fm_backend_zellij_pane_verifies_task: does <pane_id> in <session> still
+# belong to <tab_id>, and does that tab still carry the task label for
+# <task_id>? Mirrors fm_backend_herdr_pane_verifies_task's identity-proof
+# role for legacy-metadata self-repair (bin/fm-backend.sh): the pane's
+# CURRENT owning tab is looked up fresh (never trusts the recorded tab_id
+# alone, since a pane can move tabs), then that owning tab must equal the
+# recorded tab_id, then the tab's name must match via
+# fm_backend_zellij_tab_matches_label's scoped/bare-with-ambiguity-check
+# rules. Any mismatch, including a pane that moved tabs or a tab renamed to
+# a different task's label, refuses rather than guessing.
+fm_backend_zellij_pane_verifies_task() {  # <session> <tab_id> <pane_id> <task_id>
+  local session=$1 tab_id=$2 pane_id=$3 task_id=$4 owning_tab
+  [ -n "$session" ] && [ -n "$tab_id" ] && [ -n "$pane_id" ] && [ -n "$task_id" ] || return 1
+  owning_tab=$(fm_backend_zellij_tab_for_pane "$session" "$pane_id") || return 1
+  [ -n "$owning_tab" ] && [ "$owning_tab" = "$tab_id" ] || return 1
+  fm_backend_zellij_tab_matches_label "$session" "$tab_id" "fm-$task_id"
+}
+
 # fm_backend_zellij_create_task: create the task's tab (one terminal pane) in
 # <session>, refusing an existing <label>. Zellij does NOT enforce tab-name
 # uniqueness itself (verified: two tabs can share a name), so the duplicate
diff --git a/bin/claude-account.sh b/bin/claude-account.sh
index f2b59e04a8..20d3ff0702 100755
--- a/bin/claude-account.sh
+++ b/bin/claude-account.sh
@@ -9,6 +9,30 @@
 # .credentials.json and .claude.json are never in that symlink list - they must
 # stay per-account real files or OAuth tokens leak across accounts.
 #
+# Auth model: this launcher authenticates each account with a long-lived
+# `claude setup-token` (a CLAUDE_CODE_OAUTH_TOKEN, sk-ant-oat01-...) resolved
+# from the macOS keychain, exported into the session env, and honored by current
+# Claude Code interactive sessions. Setup tokens are chosen over the interactive
+# .credentials.json / `claude /login` blob on purpose: they are ~1yr-lived and
+# never silently log out mid-fleet-run (an expired/cleared .credentials.json
+# does), and they are the same tokens the ccjuggler/juggle switcher already
+# stores, so all multi-account auth shares one source of truth.
+#
+# Token store: keychain service "ccjuggler-acc<N>", account "ccjuggler" (the
+# exact lookup `juggle`/ccjuggler.py use). Seed or rotate a token with
+# `claude setup-token` under the target account, then store it with
+#   security add-generic-password -U -s "ccjuggler-acc<N>" -a "ccjuggler" -w "<token>"
+# (or `juggle add`). The launcher validates the sk-ant-oat01- prefix and refuses
+# a missing or malformed token rather than launching into a login prompt.
+#
+# Onboarding pre-seed location (current Claude Code): when CLAUDE_CONFIG_DIR is
+# set, Claude Code reads its global config JSON from $CLAUDE_CONFIG_DIR/.claude.json
+# (path = join(CLAUDE_CONFIG_DIR ?? homedir, ".claude.json")), NOT from a
+# .claude.json in the PARENT of that dir. The onboarding gate it checks is a
+# single key, hasCompletedOnboarding===true; the first-run welcome/theme/login
+# flow (and everything under it) is skipped once that is set. We therefore write
+# the pre-seed into $CLAUDE_CONFIG_DIR/.claude.json (see below).
+#
 # flock on a per-account lock file serializes the bootstrap section below so
 # two concurrent first launches on the same account cannot race on the JSON
 # writes and corrupt .claude.json; the lock fd is closed before exec claude so
@@ -32,14 +56,30 @@ esac
 ACCOUNT_HOME="$HOME/.claude-homes/account${ACCOUNT}"
 export CLAUDE_CONFIG_DIR="$ACCOUNT_HOME/.claude"
 
-if [ ! -f "$CLAUDE_CONFIG_DIR/.credentials.json" ]; then
-  echo "error: credentials not found at $CLAUDE_CONFIG_DIR/.credentials.json" >&2
-  echo "seed them with:" >&2
-  echo "  CLAUDE_CONFIG_DIR=$CLAUDE_CONFIG_DIR claude /login" >&2
-  exit 1
-fi
+# Authenticate with the account's long-lived setup token from the keychain.
+# Refuse rather than launch into a login prompt when the token is absent or
+# malformed (a corrupt/non-oat value stored here is what silently broke acc2).
+KEYCHAIN_SERVICE="ccjuggler-acc${ACCOUNT}"
+OAUTH_TOKEN="$(security find-generic-password -s "$KEYCHAIN_SERVICE" -a "ccjuggler" -w 2>/dev/null || true)"
+case "$OAUTH_TOKEN" in
+  sk-ant-oat01-*) ;;
+  "")
+    echo "error: no setup token in keychain service '$KEYCHAIN_SERVICE' (account 'ccjuggler')" >&2
+    echo "seed it once: run 'claude setup-token' under the target account, then:" >&2
+    echo "  security add-generic-password -U -s \"$KEYCHAIN_SERVICE\" -a \"ccjuggler\" -w \"<token>\"" >&2
+    exit 1 ;;
+  *)
+    echo "error: keychain service '$KEYCHAIN_SERVICE' holds a value that is not a setup token" >&2
+    echo "(expected an sk-ant-oat01-... token). Re-store the correct token with:" >&2
+    echo "  security add-generic-password -U -s \"$KEYCHAIN_SERVICE\" -a \"ccjuggler\" -w \"<token>\"" >&2
+    exit 1 ;;
+esac
+export CLAUDE_CODE_OAUTH_TOKEN="$OAUTH_TOKEN"
 
-mkdir -p "$ACCOUNT_HOME"
+# Create the per-account config dir (not just the home) so a brand-new account -
+# one never seeded by an interactive login - has $CLAUDE_CONFIG_DIR present for
+# the symlink and .claude.json pre-seed steps below.
+mkdir -p "$CLAUDE_CONFIG_DIR"
 exec 9>"$ACCOUNT_HOME/.claude-account.lock"
 flock 9
 
@@ -53,12 +93,15 @@ for item in commands hooks skills mcp-configs settings.json settings.local.json
   fi
 done
 
-# .claude.json lives in the PARENT of CLAUDE_CONFIG_DIR - a Claude Code
-# convention, not something this pattern invented. Pre-accept onboarding and
-# the trust dialog for the working directory so a headless session doesn't
-# hang on either prompt; CLAUDE_TRUST_DIR overrides which directory gets
-# pre-trusted when it differs from the launcher's own cwd.
-CLAUDE_JSON="$ACCOUNT_HOME/.claude.json"
+# Pre-accept onboarding and the trust dialog so a session doesn't land in the
+# first-run onboarding flow or hang on the trust prompt. When CLAUDE_CONFIG_DIR
+# is set, current Claude Code reads its global config from
+# $CLAUDE_CONFIG_DIR/.claude.json (NOT a .claude.json in the parent dir, which
+# older layouts used and which CC now ignores) - so the pre-seed MUST live
+# there or onboarding is not skipped. The onboarding gate is the single key
+# hasCompletedOnboarding===true. CLAUDE_TRUST_DIR overrides which directory
+# gets pre-trusted when it differs from the launcher's own cwd.
+CLAUDE_JSON="$CLAUDE_CONFIG_DIR/.claude.json"
 CLAUDE_TRUST_DIR="${CLAUDE_TRUST_DIR:-$PWD}" python3 - "$CLAUDE_JSON" <<'PYEOF'
 import json
 import os
@@ -85,6 +128,16 @@ if not projects.get(trust_dir, {}).get("hasTrustDialogAccepted"):
     projects.setdefault(trust_dir, {})["hasTrustDialogAccepted"] = True
     changed = True
 
+# Auto-approve project-scoped (.mcp.json) MCP servers so a fresh account home
+# is not dropped into the per-server "New MCP server found" prompt on first
+# encounter. .claude.json is per-account (never symlinked, to avoid OAuth/
+# project-state leak), so an account never inherits the primary's MCP approvals
+# - this global flag is the durable equivalent of choosing "use this and all
+# future MCP servers in this project".
+if not data.get("enableAllProjectMcpServers"):
+    data["enableAllProjectMcpServers"] = True
+    changed = True
+
 if changed:
     fd, tmp = tempfile.mkstemp(dir=os.path.dirname(path) or ".", prefix=".claude-account.")
     try:
diff --git a/bin/fm-backend.sh b/bin/fm-backend.sh
index eeba1402f1..7f0b892084 100644
--- a/bin/fm-backend.sh
+++ b/bin/fm-backend.sh
@@ -483,10 +483,6 @@ fm_backend_validate_task_endpoint() {  # <meta-file> <task-id>
       fi
       ;;
     zellij)
-      [ "$binding" = "$id" ] || {
-        echo "REFUSED: legacy Zellij endpoint metadata for task $id lacks an exact task binding; preserving task state." >&2
-        return 1
-      }
       recorded_session=$(fm_backend_meta_exact_value "$meta" zellij_session) || recorded_session=
       tab=$(fm_backend_meta_exact_value "$meta" zellij_tab_id) || tab=
       pane=$(fm_backend_meta_exact_value "$meta" zellij_pane_id) || pane=
@@ -497,8 +493,29 @@ fm_backend_validate_task_endpoint() {  # <meta-file> <task-id>
         echo "REFUSED: Zellij endpoint metadata for task $id is malformed or inconsistent; preserving task state." >&2
         return 1
       fi
+      if [ "$binding" = "$id" ]; then
+        :
+      else
+        fm_backend_source zellij || return 1
+        if fm_backend_zellij_pane_verifies_task "$recorded_session" "$tab" "$pane" "$id" 2>/dev/null; then
+          echo "zellij endpoint self-repair: appending endpoint_task_id=$id to metadata for legacy task $id" >&2
+          printf 'endpoint_task_id=%s\n' "$id" >> "$meta" || return 1
+        else
+          echo "REFUSED: legacy Zellij endpoint metadata for task $id lacks an exact task binding; pane verification failed or pane does not belong to this task; preserving task state." >&2
+          return 1
+        fi
+      fi
       ;;
     orca)
+      # No legacy-metadata self-repair here, unlike herdr/zellij/cmux: Orca
+      # has no verified live-identity-check primitive to prove a recorded
+      # terminal/worktree still belongs to this exact task (see
+      # bin/backends/orca.sh's fm_backend_orca_json_get header - only
+      # worktree-id, worktree-path, terminal-handle, worktree-terminal-handle,
+      # and repo-id fields are verified real shapes; a task-owning label or
+      # title readback is not). Refusing unconditionally when the binding is
+      # absent is the correct, intended behavior here, not a gap: the brief's
+      # own rule is "refuse ONLY when it cannot be verified".
       [ "$binding" = "$id" ] || {
         echo "REFUSED: legacy Orca endpoint metadata for task $id lacks an exact task binding; preserving task state." >&2
         return 1
@@ -522,10 +539,6 @@ fm_backend_validate_task_endpoint() {  # <meta-file> <task-id>
       window=$terminal
       ;;
     cmux)
-      [ "$binding" = "$id" ] || {
-        echo "REFUSED: legacy cmux endpoint metadata for task $id lacks an exact task binding; preserving task state." >&2
-        return 1
-      }
       workspace=$(fm_backend_meta_exact_value "$meta" cmux_workspace_id) || workspace=
       surface=$(fm_backend_meta_exact_value "$meta" cmux_surface_id) || surface=
       if [ -z "$workspace" ] || [ -z "$surface" ] || [ "$window" != "$workspace:$surface" ] \
@@ -534,6 +547,18 @@ fm_backend_validate_task_endpoint() {  # <meta-file> <task-id>
         echo "REFUSED: cmux endpoint metadata for task $id is malformed or inconsistent; preserving task state." >&2
         return 1
       fi
+      if [ "$binding" = "$id" ]; then
+        :
+      else
+        fm_backend_source cmux || return 1
+        if fm_backend_cmux_surface_verifies_task "$workspace" "$surface" "$id" 2>/dev/null; then
+          echo "cmux endpoint self-repair: appending endpoint_task_id=$id to metadata for legacy task $id" >&2
+          printf 'endpoint_task_id=%s\n' "$id" >> "$meta" || return 1
+        else
+          echo "REFUSED: legacy cmux endpoint metadata for task $id lacks an exact task binding; surface verification failed or surface does not belong to this task; preserving task state." >&2
+          return 1
+        fi
+      fi
       ;;
   esac
   # shellcheck disable=SC2034 # Output globals are consumed by sourcing callers.
diff --git a/bin/fm-subagent-pretool-check.sh b/bin/fm-subagent-pretool-check.sh
index 8edb507218..4f99d3e671 100755
--- a/bin/fm-subagent-pretool-check.sh
+++ b/bin/fm-subagent-pretool-check.sh
@@ -78,6 +78,22 @@ OBSERVE_ONLY_TOOLS='taskoutput taskstop taskget tasklist cronlist bashoutput kil
 # widen by accident.
 PLAN_ONLY_TOOLS='taskcreate taskupdate'
 
+# Exact lowercase tool names that match the 'cron'/'schedul' stems but create or
+# remove a DURABLE, PERSISTENT, INSPECTABLE schedule rather than the ephemeral,
+# session-bound, fleet-invisible work the delegation guard targets. A cron
+# ROUTINE outlives the session, is not started or owned by this session's own
+# process, and is inspectable at any time through CronList (already exempt in
+# OBSERVE_ONLY_TOOLS), so the guard's stated hazard - work that "dies with this
+# session" and leaves no durable record anyone can see - simply does not fit it;
+# the /schedule skill also depends on CronCreate. This is the create/delete
+# counterpart to that observe-only CronList exemption. It is DELIBERATELY
+# NARROWER than the 'cron schedul' stems: only these two exact names are
+# released, so an unknown future cron- or schedule-noun tool (ScheduleCreate,
+# CronSchedule, a background scheduler, etc.) is still caught by the stem match
+# below and denied. Exact-name, never substring, so it cannot widen by accident,
+# and tests/fm-subagent-pretool-check.test.sh locks it at exactly these two.
+SCHEDULE_MGMT_TOOLS='croncreate crondelete'
+
 TOOL=""
 TOOL_SET=0
 CLAUDE_MODE=0
@@ -152,7 +168,7 @@ case "$TOOL" in
   mcp__*) exit 0 ;;
 esac
 
-for allowed in $OBSERVE_ONLY_TOOLS $PLAN_ONLY_TOOLS; do
+for allowed in $OBSERVE_ONLY_TOOLS $PLAN_ONLY_TOOLS $SCHEDULE_MGMT_TOOLS; do
   [ "$NORMALIZED" != "$allowed" ] || exit 0
 done
 
diff --git a/docs/cmux-backend.md b/docs/cmux-backend.md
index ac39d630fc..f12234a707 100644
--- a/docs/cmux-backend.md
+++ b/docs/cmux-backend.md
@@ -110,6 +110,20 @@ Firstmate does not attempt to close the macOS window because cmux's socket canno
 Real tests share the captain's running app rather than creating an isolated cmux session.
 `tests/cmux-test-safety.sh` permits cleanup only for an exact currently listed `fm-test-` workspace and never enumerates and closes unrelated workspaces or relaunches the app.
 
+## Endpoint metadata
+
+```text
+backend=cmux
+window=<workspace-uuid>:<surface-uuid>
+cmux_workspace_id=<workspace-uuid>
+cmux_surface_id=<surface-uuid>
+```
+
+The UUID pair is the active endpoint authority within one app run.
+Workspace UUIDs are not stable across an app relaunch, so recovery searches by the scoped title and then resolves the current surface id.
+
+Legacy cmux metadata written before `endpoint_task_id=` existed self-repairs at teardown validation time instead of refusing outright: `fm_backend_validate_task_endpoint` verifies the live surface still exists within its recorded workspace and that the workspace still carries the task's label via `fm_backend_cmux_surface_verifies_task`, and only when both the surface membership and the workspace's title are confirmed to match (using `fm_backend_cmux_workspace_matches_label`'s scoped/bare-with-ambiguity rules), appends `endpoint_task_id=<id>` to the metadata file so the task tears down with no manual editing. When the live surface or workspace does not match - for example because the surface was recycled to a different workspace or the workspace was renamed to a different task's label - validation refuses without mutating the metadata, preserving the wrong-surface safety guarantee.
+
 ## Active limits
 
 - cmux is experimental, macOS-only, GUI-first, and requires the app running.
diff --git a/docs/configuration.md b/docs/configuration.md
index b46243c05c..1e659b7c94 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -111,7 +111,8 @@ Only metadata-routed task selectors carry secondmate-marker and Codex-harness co
 These five sentences are the single owner of the task-selector vocabulary; backend guides and other documents point here instead of restating the resolution order.
 `fm-teardown.sh <id>` takes a task id directly and validates the complete metadata-only endpoint identity before any runtime dispatch or cleanup mutation.
 Missing, empty, duplicate, malformed, backend-inconsistent, or task-mismatched endpoint records are preserved and refused.
-Legacy tmux metadata remains cleanup-compatible when its exact window name is `fm-<id>`; opaque non-tmux endpoints require their recorded `endpoint_task_id=` binding, except legacy Herdr metadata lacking that binding, which self-repairs by appending it once the live pane is confirmed to still belong to the task, and otherwise refuses without mutation (see [herdr-backend.md](herdr-backend.md#endpoint-metadata)).
+Legacy tmux metadata remains cleanup-compatible when its exact window name is `fm-<id>`; opaque non-tmux endpoints require their recorded `endpoint_task_id=` binding, except legacy Herdr, Zellij, and cmux metadata lacking that binding, which self-repair by appending it once the live pane/tab/workspace is confirmed to still belong to the task (see [herdr-backend.md](herdr-backend.md#endpoint-metadata), [zellij-backend.md](zellij-backend.md#endpoint-metadata), and [cmux-backend.md](cmux-backend.md#endpoint-metadata)), and otherwise refuse without mutation.
+Orca intentionally refuses unconditionally when the binding is absent, as it has no verified live-identity-check primitive to prove a recorded terminal or worktree still belongs to the task.
 `FM_HOME` determines Herdr's home label: the primary home uses `1M-FIRSTMATE`, and a secondmate home marked by `.fm-secondmate-home` uses `2M-<SCOPE>`, uppercase and derived from its marker id.
 [`herdr-backend.md`](herdr-backend.md#watching-and-task-containers) owns launcher-bound workspace placement, the label-only fallback, collision handling, and recovery behavior, and [Mate naming convention](herdr-backend.md#mate-naming-convention) owns the exact rank/scope derivation.
 The optional local `config/herdr-presentation-spaces` presence flag instead enables Herdr's default-off disposable single-task visual projection; [Optional presentation spaces](herdr-backend.md#optional-presentation-spaces) owns its behavior, safety limits, recovery contract, and narrow locked session-start cleanup of exact restored idle-shell children.
@@ -268,14 +269,19 @@ For Pi and pi-signed secondmate launches, `fm-spawn.sh` starts the selected exec
 ## Multi-account Claude Code (bin/claude-account.sh, --account)
 
 A captain with more than one paid Claude subscription can have claude-harness crewmates draw from a second account's quota instead of competing with the primary session's own account.
-[`bin/claude-account.sh <N> [args...]`](../bin/claude-account.sh) is a standalone launcher (it works with no firstmate checkout on `PATH`) that sets `CLAUDE_CONFIG_DIR` to `~/.claude-homes/account<N>/.claude`, symlinks shared config (`commands`, `hooks`, `skills`, `mcp-configs`, `settings.json`, `settings.local.json`, `rules`, `agents`) in from `~/.claude/` idempotently, and pre-accepts the onboarding and trust-dialog prompts so a headless session doesn't hang.
-`.credentials.json` and `.claude.json` are never symlinked - they stay per-account real files, or OAuth tokens leak across accounts.
+[`bin/claude-account.sh <N> [args...]`](../bin/claude-account.sh) is a standalone launcher (it works with no firstmate checkout on `PATH`) that sets `CLAUDE_CONFIG_DIR` to `~/.claude-homes/account<N>/.claude`, symlinks shared config (`commands`, `hooks`, `skills`, `mcp-configs`, `settings.json`, `settings.local.json`, `rules`, `agents`) in from `~/.claude/` idempotently, authenticates the session with the account's long-lived setup token (below), and pre-accepts the onboarding, trust-dialog, and project-scoped MCP prompts so a session isn't dropped into a first-run or approval flow.
+`.claude.json` is never symlinked - it stays a per-account real file, or project/session state leaks across accounts.
 `bin/claude-1.sh` and `bin/claude-2.sh` are one-line direct launchers (`claude-1.sh <args>` == `claude-account.sh 1 <args>`) for a human or an orchestrator to call.
 
-Seed an account's credentials once before first use:
+Two current-Claude-Code mechanics the launcher depends on:
+
+- **Onboarding pre-seed location.** When `CLAUDE_CONFIG_DIR` is set, Claude Code reads its global config JSON from `$CLAUDE_CONFIG_DIR/.claude.json` (path = `join(CLAUDE_CONFIG_DIR ?? homedir, ".claude.json")`), *not* from a `.claude.json` in the parent of that dir. The onboarding gate is the single key `hasCompletedOnboarding: true`; once set, the whole welcome/theme/login first-run flow is skipped. The launcher writes its `hasCompletedOnboarding`, per-project `hasTrustDialogAccepted`, and `enableAllProjectMcpServers: true` pre-seed into `$CLAUDE_CONFIG_DIR/.claude.json` for exactly this reason (the last auto-approves project-scoped `.mcp.json` servers, which are never inherited across account homes).
+- **Auth = per-account setup token, exported as `CLAUDE_CODE_OAUTH_TOKEN`.** The launcher resolves a long-lived `claude setup-token` (`sk-ant-oat01-…`) from the macOS keychain - service `ccjuggler-acc<N>`, account `ccjuggler`, the exact entry the `juggle`/ccjuggler switcher uses - validates the prefix, and exports it into the session env, where current Claude Code honors it for interactive sessions. Setup tokens are used on purpose over the `.credentials.json` / `claude /login` blob: they are ~1yr-lived and never silently log out mid-fleet-run (a cleared or expired `.credentials.json` does). The launcher refuses (rather than dropping into a login prompt) when the keychain token is absent or is not an `sk-ant-oat01-` value - a malformed value stored there is what once silently broke a second account.
+
+Seed or rotate an account's setup token once before first use: run `claude setup-token` under the target account (browser flow), then store the printed token in the keychain (or use `juggle add`):
 
 ```
-CLAUDE_CONFIG_DIR=~/.claude-homes/account1/.claude claude /login
+security add-generic-password -U -s "ccjuggler-acc<N>" -a "ccjuggler" -w "<sk-ant-oat01-… token>"
 ```
 
 `fm-spawn.sh --account <N>` wires a ship or scout claude-harness spawn to a specific account: it records `account=N` in the task's `state/<id>.meta`, sets `CLAUDE_TRUST_DIR` to the task's worktree in the crewmate's launch environment so the correct directory gets pre-trusted, and launches through `bin/claude-account.sh N` instead of the plain `claude` binary.
diff --git a/docs/herdr-backend.md b/docs/herdr-backend.md
index 2a65fae9e9..dd1a009fff 100644
--- a/docs/herdr-backend.md
+++ b/docs/herdr-backend.md
@@ -190,7 +190,7 @@ A Herdr pane id contains a colon, so the adapter splits `window=` on the first c
 The recorded pane is the operational fast path.
 Workspace and tab ids support verification and cleanup but are not inferred from mutable labels during normal operation.
 
-Legacy Herdr metadata written before `endpoint_task_id=` existed self-repairs at teardown validation time instead of refusing outright: `fm_backend_validate_task_endpoint` queries the live pane's label through `fm_backend_herdr_pane_verifies_task` and, only when it still reads exactly `fm-<id>`, appends `endpoint_task_id=<id>` to the metadata file so the task tears down with no manual editing. When the live pane's label does not match - for example because the pane was recycled for a different task - validation refuses without mutating the metadata, preserving the wrong-pane safety guarantee.
+Legacy Herdr metadata written before `endpoint_task_id=` existed self-repairs at teardown validation time instead of refusing outright: `fm_backend_validate_task_endpoint` queries the live pane's label through `fm_backend_herdr_pane_verifies_task` and, only when it still reads exactly `fm-<id>`, appends `endpoint_task_id=<id>` to the metadata file so the task tears down with no manual editing. When the live pane's label does not match - for example because the pane was recycled for a different task - validation refuses without mutating the metadata, preserving the wrong-pane safety guarantee. Zellij and cmux backends support the same legacy-metadata self-repair pattern (see [zellij-backend.md](zellij-backend.md#endpoint-metadata) and [cmux-backend.md](cmux-backend.md#endpoint-metadata)); Orca intentionally refuses unconditionally as it has no verified live-identity-check primitive.
 
 ## Current transport behavior
 
diff --git a/docs/subagent-guard.md b/docs/subagent-guard.md
index 47aaf10e0f..b7b357dd79 100644
--- a/docs/subagent-guard.md
+++ b/docs/subagent-guard.md
@@ -60,8 +60,13 @@ Three exclusions keep the shape test from producing false positives.
   That list has no executor: it spawns no agent, allocates no worktree, registers no schedule, and starts nothing that could outlive the session or escape a firstmate guard.
   So it is not the "work, agent, schedule, or isolated workspace that firstmate would not know about" the guard exists to stop, and the stem match on `task` is a false positive rather than a policy.
   The cost of the false positive was concrete: the primary could not track its own plan, and the deny text told it to run `bin/fm-brief.sh` and `bin/fm-spawn.sh` to create a todo entry.
+- `SCHEDULE_MGMT_TOOLS`: the exact names `croncreate` and `crondelete` are allowed.
+  These create or remove a durable, persistent, inspectable schedule rather than the ephemeral, session-bound, fleet-invisible work the delegation guard targets.
+  A cron routine outlives the session, is not started or owned by this session's own process, and is inspectable at any time through `CronList` (already exempt in `OBSERVE_ONLY_TOOLS`), so the guard's stated hazard - work that "dies with this session" and leaves no durable record anyone can see - simply does not fit it.
+  The stem match on `cron` and `schedul` would otherwise catch many future tools that are not schedule management; this exemption is deliberately narrower than the stems, releasing only these two exact names.
+  An unknown future `ScheduleCreate`, `CronSchedule`, or other stem-matching tool is still caught and denied, preserving the future-safety of the guard.
 
-Both exclusion lists match the whole normalized name, never a substring, so neither can widen by accident: `TaskCreateAgent` and `RemoteTaskCreate` stay denied.
+All three exclusion lists match the whole normalized name, never a substring, so none can widen by accident: `TaskCreateAgent`, `RemoteTaskCreate`, and `ScheduleCreate` stay denied.
 Folding the two lists together would be the drift risk, because the observe-or-stop rationale is not true of a tool that writes.
 
 The shipped guard fires on every delegation-shaped name that reaches it, including future names that no deny list knows about yet.
diff --git a/docs/zellij-backend.md b/docs/zellij-backend.md
index c9f440b468..239bbee398 100644
--- a/docs/zellij-backend.md
+++ b/docs/zellij-backend.md
@@ -87,6 +87,22 @@ Closing a pane leaves an empty tab.
 Cleanup resolves and verifies the owning tab, then uses `close-tab-by-id` so both the task pane and tab disappear.
 Real test cleanup uses only an isolated non-`firstmate` session and the guard in `tests/zellij-test-safety.sh`; it never calls all-session deletion commands.
 
+## Endpoint metadata
+
+```text
+backend=zellij
+window=<session>:<pane-id>
+zellij_session=<session>
+zellij_tab_id=<tab-id>
+zellij_pane_id=<pane-id>
+```
+
+Recorded pane ids are numeric and are never trusted alone after a session recreation.
+Metadata-routed operations also verify the owning tab's expected scoped or unambiguous legacy title.
+An explicit raw `session:pane` target remains a pane-existence-only operator escape hatch.
+
+Legacy Zellij metadata written before `endpoint_task_id=` existed self-repairs at teardown validation time instead of refusing outright: `fm_backend_validate_task_endpoint` verifies the live pane still belongs to its recorded tab via `fm_backend_zellij_pane_verifies_task`, and only when the pane's owning tab still reads exactly `fm-<id>` (or the scoped `fm-<home-label>-<id>` with no ambiguity), appends `endpoint_task_id=<id>` to the metadata file so the task tears down with no manual editing. When the live pane's tab does not match - for example because the pane was recycled to a different tab or the tab was renamed to a different task's label - validation refuses without mutating the metadata, preserving the wrong-pane safety guarantee.
+
 ## Active limits
 
 - Zellij is experimental and explicit-only.
diff --git a/tests/claude-account.test.sh b/tests/claude-account.test.sh
index b2c373e6c2..787ee85c77 100755
--- a/tests/claude-account.test.sh
+++ b/tests/claude-account.test.sh
@@ -25,11 +25,25 @@ make_case() {
   mkdir -p "$home/.claude/skills" "$home/.claude/hooks" "$home/.claude/commands"
   printf '{}\n' > "$home/.claude/settings.json"
   mkdir -p "$home/.claude-homes/account1/.claude"
-  printf '{"token":"acct1-secret"}\n' > "$home/.claude-homes/account1/.claude/.credentials.json"
   fakebin=$(fm_fakebin "$case_dir")
+  # Mock macOS `security`: return a valid setup token ONLY for account 1's
+  # keychain service (ccjuggler-acc1); "not found" (exit 44) for any other
+  # account, so unseeded-account cases exercise the refusal path hermetically
+  # without touching the real login keychain.
+  cat > "$fakebin/security" <<'SECEOF'
+#!/usr/bin/env bash
+svc=""
+while [ $# -gt 0 ]; do
+  case "$1" in -s) svc=$2; shift 2 ;; *) shift ;; esac
+done
+[ "$svc" = "ccjuggler-acc1" ] && { printf 'sk-ant-oat01-TESTTOKEN\n'; exit 0; }
+exit 44
+SECEOF
+  chmod +x "$fakebin/security"
   cat > "$fakebin/claude" <<EOF
 #!/usr/bin/env bash
 printf 'CLAUDE_CONFIG_DIR=%s args=%s\n' "\$CLAUDE_CONFIG_DIR" "\$*" >> '$log'
+printf 'OAUTH=%s\n' "\$CLAUDE_CODE_OAUTH_TOKEN" >> '$log'
 EOF
   chmod +x "$fakebin/claude"
   : > "$log"
@@ -48,21 +62,59 @@ run_launcher() {
   HOME="$home" PATH="$fakebin:$PATH" "$LAUNCHER" "$@" 2>&1
 }
 
-test_missing_credentials_fails_loudly() {
+test_missing_setup_token_fails_loudly() {
   local rec home fakebin log out status
-  rec=$(make_case missing-creds)
+  rec=$(make_case missing-token)
   read_case_record "$rec"
   home=$CASE_HOME fakebin=$CASE_FAKEBIN log=$CASE_LOG
 
+  # Account 2 has no keychain setup token (the security mock only seeds acc1).
   out=$(run_launcher "$home" "$fakebin" 2 /status)
   status=$?
-  expect_code 1 "$status" "an unseeded account should refuse rather than launch claude"
-  assert_contains "$out" "credentials not found at $home/.claude-homes/account2/.claude/.credentials.json" \
-    "refusal did not name the expected credentials path"
-  assert_contains "$out" "CLAUDE_CONFIG_DIR=$home/.claude-homes/account2/.claude claude /login" \
-    "refusal did not show the seeding command"
-  [ ! -s "$log" ] || fail "claude should never be invoked when credentials are missing"
-  pass "missing credentials refuse loudly with a seeding command, no claude invocation"
+  expect_code 1 "$status" "an account with no keychain setup token should refuse rather than launch claude"
+  assert_contains "$out" "no setup token in keychain service 'ccjuggler-acc2'" \
+    "refusal did not name the expected keychain service"
+  assert_contains "$out" "claude setup-token" \
+    "refusal did not show how to mint a setup token"
+  assert_contains "$out" "security add-generic-password" \
+    "refusal did not show the keychain seeding command"
+  [ ! -s "$log" ] || fail "claude should never be invoked when the setup token is missing"
+  pass "a missing keychain setup token refuses loudly with setup-token seeding, no claude invocation"
+}
+
+test_auth_exports_setup_token_from_keychain() {
+  local rec home fakebin log out status
+  rec=$(make_case token-export)
+  read_case_record "$rec"
+  home=$CASE_HOME fakebin=$CASE_FAKEBIN log=$CASE_LOG
+
+  out=$(run_launcher "$home" "$fakebin" 1 /status)
+  status=$?
+  expect_code 0 "$status" "account 1 with a valid keychain setup token should launch"
+  assert_grep "OAUTH=sk-ant-oat01-TESTTOKEN" "$log" \
+    "the account's setup token was not exported as CLAUDE_CODE_OAUTH_TOKEN for claude"
+  pass "interactive auth exports the per-account setup token from the keychain as CLAUDE_CODE_OAUTH_TOKEN"
+}
+
+test_malformed_setup_token_refused() {
+  local rec home fakebin log out status
+  rec=$(make_case malformed-token)
+  read_case_record "$rec"
+  home=$CASE_HOME fakebin=$CASE_FAKEBIN log=$CASE_LOG
+  # Override the security mock so account 1 returns a NON-oat value.
+  cat > "$fakebin/security" <<'SECEOF'
+#!/usr/bin/env bash
+printf 'not-a-real-token\n'; exit 0
+SECEOF
+  chmod +x "$fakebin/security"
+
+  out=$(run_launcher "$home" "$fakebin" 1 /status)
+  status=$?
+  expect_code 1 "$status" "a non-setup-token value in the keychain must be refused, not launched"
+  assert_contains "$out" "not a setup token" \
+    "refusal did not flag the malformed keychain value"
+  [ ! -s "$log" ] || fail "claude should never be invoked with a malformed token"
+  pass "a malformed keychain value is refused with a clear message, no claude invocation"
 }
 
 test_symlinks_shared_config_idempotently() {
@@ -107,8 +159,10 @@ test_does_not_symlink_credentials_or_claude_json() {
 
   run_launcher "$home" "$fakebin" 1 /status >/dev/null
   [ ! -L "$home/.claude-homes/account1/.claude/.credentials.json" ] || fail ".credentials.json must never be a symlink"
-  [ ! -L "$home/.claude-homes/account1/.claude.json" ] || fail ".claude.json must never be a symlink"
-  assert_no_grep "acct1-secret" "$home/.claude-homes/account1/.claude.json" \
+  # .claude.json is pre-seeded inside CLAUDE_CONFIG_DIR (where current CC reads
+  # it); it must be a real per-account file, never a symlink into shared config.
+  [ ! -L "$home/.claude-homes/account1/.claude/.claude.json" ] || fail ".claude.json must never be a symlink"
+  assert_no_grep "acct1-secret" "$home/.claude-homes/account1/.claude/.claude.json" \
     ".claude.json should not have been overwritten by any shared file"
   pass "credentials and onboarding state are never symlinked from shared config"
 }
@@ -125,20 +179,28 @@ test_prewrites_onboarding_and_trust_dialog() {
   status=$?
   expect_code 0 "$status" "trust-dialog pre-write launch should succeed"
 
-  assert_present "$home/.claude-homes/account1/.claude.json" ".claude.json should exist in the parent of CLAUDE_CONFIG_DIR"
-  [ ! -L "$home/.claude-homes/account1/.claude/.claude.json" ] || fail ".claude.json must live beside, not inside, CLAUDE_CONFIG_DIR"
-  assert_grep '"hasCompletedOnboarding": true' "$home/.claude-homes/account1/.claude.json" \
-    "onboarding was not pre-accepted"
-  assert_grep "\"$trust_dir\"" "$home/.claude-homes/account1/.claude.json" \
+  # Current Claude Code reads its global config from $CLAUDE_CONFIG_DIR/.claude.json
+  # when CLAUDE_CONFIG_DIR is set - NOT from a .claude.json in the parent dir. The
+  # pre-seed must land at the path CC reads or onboarding is not skipped.
+  local seed="$home/.claude-homes/account1/.claude/.claude.json"
+  assert_present "$seed" ".claude.json pre-seed should exist inside CLAUDE_CONFIG_DIR (where current CC reads it)"
+  assert_absent "$home/.claude-homes/account1/.claude.json" \
+    "the pre-seed must NOT be written to the parent of CLAUDE_CONFIG_DIR (current CC ignores it there)"
+  [ ! -L "$seed" ] || fail ".claude.json pre-seed must be a real file, not a symlink"
+  assert_grep '"hasCompletedOnboarding": true' "$seed" \
+    "onboarding gate hasCompletedOnboarding was not pre-accepted"
+  assert_grep '"numStartups"' "$seed" \
+    "numStartups was not pre-seeded"
+  assert_grep "\"$trust_dir\"" "$seed" \
     "trust dialog was not pre-accepted for CLAUDE_TRUST_DIR"
-  assert_grep '"hasTrustDialogAccepted": true' "$home/.claude-homes/account1/.claude.json" \
+  assert_grep '"hasTrustDialogAccepted": true' "$seed" \
     "trust dialog flag was not set to true"
 
   # Idempotent: a second launch for the same trust dir must not error or duplicate.
   CLAUDE_TRUST_DIR="$trust_dir" HOME="$home" PATH="$fakebin:$PATH" "$LAUNCHER" 1 /status >/dev/null
   status=$?
   expect_code 0 "$status" "a repeat launch for an already-trusted directory should still succeed"
-  pass "onboarding and the trust dialog are pre-accepted for CLAUDE_TRUST_DIR, idempotently"
+  pass "onboarding and the trust dialog are pre-accepted inside CLAUDE_CONFIG_DIR for CLAUDE_TRUST_DIR, idempotently"
 }
 
 test_settings_json_symlink_is_never_replaced() {
@@ -178,7 +240,9 @@ test_settings_json_flag_set_when_real_per_account_file() {
   pass "a real per-account settings.json gets skipDangerousModePermissionPrompt pre-written"
 }
 
-test_missing_credentials_fails_loudly
+test_missing_setup_token_fails_loudly
+test_auth_exports_setup_token_from_keychain
+test_malformed_setup_token_refused
 test_symlinks_shared_config_idempotently
 test_does_not_symlink_credentials_or_claude_json
 test_prewrites_onboarding_and_trust_dialog
diff --git a/tests/fm-subagent-pretool-check.test.sh b/tests/fm-subagent-pretool-check.test.sh
index c1a2115897..5d44a90298 100755
--- a/tests/fm-subagent-pretool-check.test.sh
+++ b/tests/fm-subagent-pretool-check.test.sh
@@ -41,6 +41,25 @@ PLAN_ONLY_TOOLS='TaskCreate TaskUpdate'
 # assumed.
 PLAN_ONLY_NEAR_MISSES='TaskCreateAgent TaskCreateWorktree TaskUpdateAgent RemoteTaskCreate Task TaskCreator'
 
+# Durable schedule management (robots-sy7m option A). A cron ROUTINE is durable,
+# persistent, and inspectable via CronList, so creating or deleting one is not
+# the ephemeral, fleet-invisible delegation the guard targets. The guard's
+# schedule-management exemption must allow exactly these two, alongside the
+# already-exempt observe-only CronList.
+SCHEDULE_MGMT_TOOLS='CronCreate CronDelete'
+
+# Names the schedule-management exemption must NOT release. Each matches the
+# 'cron' or 'schedul' stem and still creates or manages an ephemeral off-fleet
+# schedule or agent, so each must STAY denied. "ScheduleCreate" is the explicit
+# proof (robots-sy7m) that exempting cron create/delete did not leak into a
+# blanket schedul* allow; the rest lock the exemption at exactly two names.
+SCHEDULE_MGMT_NEAR_MISSES='ScheduleCreate ScheduleDelete ScheduleWakeup CronSchedule CronJob ScheduleAgent CronCreateAgent'
+
+# The core off-fleet delegation hazards this guard exists to block. Adding the
+# cron exemption must never silently widen into disabling the guard, so every
+# one of these must stay denied after the exemption lands.
+DELEGATION_HAZARD_TOOLS='Task Agent Workflow spawn dispatch subagent Worktree SendMessage Handoff Remote'
+
 run_tool() {
   local tool=$1 rc=0
   shift
@@ -81,6 +100,9 @@ test_guard_denies_every_currently_known_delegation_tool() {
     case "$tool" in
       TaskOutput|TaskStop|TaskGet|TaskList|CronList) continue ;;
       TaskCreate|TaskUpdate) continue ;;
+      # Durable schedule management, exempt under robots-sy7m option A and
+      # covered by its own dedicated allow test below.
+      CronCreate|CronDelete) continue ;;
     esac
     expect_deny "known delegation tool" "$tool"
   done
@@ -134,6 +156,40 @@ test_plan_only_exclusion_is_exact_name() {
   pass "the plan-only exclusion releases exactly two names and nothing that merely contains them"
 }
 
+test_schedule_mgmt_exemption_allows_cron_create_delete() {
+  # robots-sy7m option A: a cron ROUTINE is durable, persistent, and inspectable
+  # through CronList, so creating or deleting one is not the ephemeral,
+  # fleet-invisible delegation the guard targets. CronList stays exempt too.
+  local tool
+  for tool in $SCHEDULE_MGMT_TOOLS CronList; do
+    expect_allow "schedule-management tool" "$tool"
+  done
+  pass "the guard allows durable schedule management: CronCreate, CronDelete, and CronList"
+}
+
+test_schedule_mgmt_exemption_is_exactly_two_names() {
+  # The exemption must release ONLY CronCreate/CronDelete, never the wider
+  # 'cron'/'schedul' stems. Every near miss still creates or manages an
+  # ephemeral off-fleet schedule or agent and must stay denied; ScheduleCreate
+  # is the explicit proof the cron exemption did not leak to the schedul stem.
+  local tool
+  for tool in $SCHEDULE_MGMT_NEAR_MISSES; do
+    expect_deny "schedule-management near miss" "$tool"
+  done
+  pass "the schedule-management exemption releases exactly CronCreate/CronDelete and nothing else on the cron or schedul stems"
+}
+
+test_cron_exemption_does_not_disable_delegation_guard() {
+  # Hard requirement (robots-sy7m): adding the cron exemption must never
+  # silently widen into disabling the guard. Every core off-fleet delegation
+  # hazard must stay blocked exactly as before.
+  local tool
+  for tool in $DELEGATION_HAZARD_TOOLS; do
+    expect_deny "delegation hazard after cron exemption" "$tool"
+  done
+  pass "the cron exemption leaves every core delegation hazard blocked: Task, Agent, Workflow, spawn, dispatch, subagent, Worktree, SendMessage, Handoff, Remote"
+}
+
 test_guard_never_classifies_mcp_tools() {
   # An MCP server names its own tools; a task or agent noun there is common and
   # has nothing to do with fleet dispatch.
@@ -281,6 +337,9 @@ test_guard_denies_hypothetical_future_tools
 test_guard_allows_ordinary_and_observe_only_tools
 test_guard_allows_session_local_todo_tools
 test_plan_only_exclusion_is_exact_name
+test_schedule_mgmt_exemption_allows_cron_create_delete
+test_schedule_mgmt_exemption_is_exactly_two_names
+test_cron_exemption_does_not_disable_delegation_guard
 test_guard_never_classifies_mcp_tools
 test_deny_message_defers_to_intake_classification
 test_escape_hatch_allows_deliberate_use
diff --git a/tests/fm-teardown-endpoint-safety.test.sh b/tests/fm-teardown-endpoint-safety.test.sh
index d1e4403c1b..8f95bc70e9 100755
--- a/tests/fm-teardown-endpoint-safety.test.sh
+++ b/tests/fm-teardown-endpoint-safety.test.sh
@@ -189,6 +189,106 @@ SH
   pass "fm_backend_validate_task_endpoint (herdr): legacy metadata self-repairs when the live pane still matches the task, and refuses without mutation when the pane now belongs to a different (recycled) task"
 }
 
+test_zellij_legacy_meta_self_repair_and_recycled_pane_refusal() {
+  local dir id rc
+  command -v jq >/dev/null 2>&1 || { echo "skip - jq not found (required by the zellij adapter)"; return 0; }
+  dir=$(make_case zellij-legacy-repair)
+  # shellcheck source=/dev/null
+  . "$ROOT/bin/fm-backend.sh"
+
+  cat > "$dir/fakebin/zellij" <<'SH'
+#!/usr/bin/env bash
+case "$*" in
+  *list-panes*)
+    printf '[{"id": %s, "tab_id": %s, "is_plugin": false}]\n' "${FM_TEST_ZELLIJ_PANE_ID:?}" "${FM_TEST_ZELLIJ_OWNING_TAB:?}"
+    exit 0
+    ;;
+  *list-tabs*)
+    printf '[{"tab_id": %s, "name": "%s"}]\n' "${FM_TEST_ZELLIJ_OWNING_TAB:?}" "${FM_TEST_ZELLIJ_TAB_NAME:?}"
+    exit 0
+    ;;
+esac
+exit 1
+SH
+  chmod +x "$dir/fakebin/zellij"
+
+  id=zellij-legacy-task
+  fm_write_meta "$dir/home/state/$id.meta" \
+    "window=lab:7" "worktree=$dir/worktree" "project=$dir/project" \
+    "backend=zellij" "zellij_session=lab" "zellij_tab_id=3" "zellij_pane_id=7"
+  PATH="$dir/fakebin:$PATH" FM_TEST_ZELLIJ_PANE_ID=7 FM_TEST_ZELLIJ_OWNING_TAB=3 FM_TEST_ZELLIJ_TAB_NAME="fm-$id" \
+    fm_backend_validate_task_endpoint "$dir/home/state/$id.meta" "$id" \
+    || fail "legacy zellij metadata with a live matching pane should self-repair, not refuse"
+  assert_grep "endpoint_task_id=$id" "$dir/home/state/$id.meta" \
+    "legacy zellij metadata was not self-repaired with endpoint_task_id"
+
+  id=zellij-recycled-task
+  fm_write_meta "$dir/home/state/$id.meta" \
+    "window=lab:8" "worktree=$dir/worktree" "project=$dir/project" \
+    "backend=zellij" "zellij_session=lab" "zellij_tab_id=4" "zellij_pane_id=8"
+  set +e
+  PATH="$dir/fakebin:$PATH" FM_TEST_ZELLIJ_PANE_ID=8 FM_TEST_ZELLIJ_OWNING_TAB=4 FM_TEST_ZELLIJ_TAB_NAME="fm-some-other-task" \
+    fm_backend_validate_task_endpoint "$dir/home/state/$id.meta" "$id"
+  rc=$?
+  set -e
+  [ "$rc" -ne 0 ] || fail "legacy zellij metadata whose live tab now belongs to a different task should refuse (recycled-pane safety)"
+  assert_no_grep "endpoint_task_id=" "$dir/home/state/$id.meta" \
+    "recycled-pane refusal must not mutate the metadata"
+
+  pass "fm_backend_validate_task_endpoint (zellij): legacy metadata self-repairs when the live pane/tab still matches the task, and refuses without mutation when the tab now belongs to a different (recycled) task"
+}
+
+test_cmux_legacy_meta_self_repair_and_recycled_pane_refusal() {
+  local dir id rc
+  command -v jq >/dev/null 2>&1 || { echo "skip - jq not found (required by the cmux adapter)"; return 0; }
+  dir=$(make_case cmux-legacy-repair)
+  # shellcheck source=/dev/null
+  . "$ROOT/bin/fm-backend.sh"
+
+  cat > "$dir/fakebin/cmux" <<'SH'
+#!/usr/bin/env bash
+case "$*" in
+  *list-panes*)
+    printf '{"panes":[{"surface_ids": ["%s"]}]}\n' "${FM_TEST_CMUX_SURFACE_ID:?}"
+    exit 0
+    ;;
+  *"workspace list"*)
+    printf '{"workspaces":[{"id":"%s","title":"%s"}]}\n' "${FM_TEST_CMUX_WORKSPACE_ID:?}" "${FM_TEST_CMUX_WORKSPACE_TITLE:?}"
+    exit 0
+    ;;
+esac
+exit 1
+SH
+  chmod +x "$dir/fakebin/cmux"
+
+  id=cmux-legacy-task
+  fm_write_meta "$dir/home/state/$id.meta" \
+    "window=workspace-1:surface-2" "worktree=$dir/worktree" "project=$dir/project" \
+    "backend=cmux" "cmux_workspace_id=workspace-1" "cmux_surface_id=surface-2"
+  PATH="$dir/fakebin:$PATH" FM_TEST_CMUX_SURFACE_ID=surface-2 FM_TEST_CMUX_WORKSPACE_ID=workspace-1 \
+    FM_TEST_CMUX_WORKSPACE_TITLE="fm-$id" \
+    fm_backend_validate_task_endpoint "$dir/home/state/$id.meta" "$id" \
+    || fail "legacy cmux metadata with a live matching surface should self-repair, not refuse"
+  assert_grep "endpoint_task_id=$id" "$dir/home/state/$id.meta" \
+    "legacy cmux metadata was not self-repaired with endpoint_task_id"
+
+  id=cmux-recycled-task
+  fm_write_meta "$dir/home/state/$id.meta" \
+    "window=workspace-9:surface-9" "worktree=$dir/worktree" "project=$dir/project" \
+    "backend=cmux" "cmux_workspace_id=workspace-9" "cmux_surface_id=surface-9"
+  set +e
+  PATH="$dir/fakebin:$PATH" FM_TEST_CMUX_SURFACE_ID=surface-9 FM_TEST_CMUX_WORKSPACE_ID=workspace-9 \
+    FM_TEST_CMUX_WORKSPACE_TITLE="fm-some-other-task" \
+    fm_backend_validate_task_endpoint "$dir/home/state/$id.meta" "$id"
+  rc=$?
+  set -e
+  [ "$rc" -ne 0 ] || fail "legacy cmux metadata whose live workspace now belongs to a different task should refuse (recycled-surface safety)"
+  assert_no_grep "endpoint_task_id=" "$dir/home/state/$id.meta" \
+    "recycled-surface refusal must not mutate the metadata"
+
+  pass "fm_backend_validate_task_endpoint (cmux): legacy metadata self-repairs when the live workspace/surface still matches the task, and refuses without mutation when the workspace now belongs to a different (recycled) task"
+}
+
 test_tmux_empty_target_refuses_without_invocation() {
   local dir rc
   dir=$(make_case direct-empty)
@@ -314,6 +414,8 @@ SH
 test_invalid_endpoint_records_refuse_before_mutation
 test_supported_backend_endpoint_records_validate
 test_herdr_legacy_meta_self_repair_and_recycled_pane_refusal
+test_zellij_legacy_meta_self_repair_and_recycled_pane_refusal
+test_cmux_legacy_meta_self_repair_and_recycled_pane_refusal
 test_tmux_empty_target_refuses_without_invocation
 test_recorded_process_identity_cleanup_is_exact
 test_isolated_tmux_invalid_and_valid_cleanup