From df8d8f407b506ed52f1cd79e9ce5028946ed3a7f Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Sun, 26 Jul 2026 10:18:32 +0300
Subject: [PATCH 01/39] feat: add optional host-root mode

---
 .agents/skills/harness-adapters/SKILL.md      |  20 +
 .../skills/secondmate-provisioning/SKILL.md   |   1 +
 AGENTS.md                                     |   5 +-
 README.md                                     |   4 +-
 bin/backends/cmux.sh                          |  40 ++
 bin/backends/herdr.sh                         |  26 +
 bin/backends/orca.sh                          |  69 +-
 bin/backends/tmux.sh                          |  23 +
 bin/backends/zellij.sh                        |  42 ++
 bin/fm-backend.sh                             |  39 ++
 bin/fm-brief.sh                               | 113 +++-
 bin/fm-check-register.sh                      |   9 +
 bin/fm-decision-hold.sh                       |  17 +
 bin/fm-gate-refuse-lib.sh                     |  28 +-
 bin/fm-host-root-lib.sh                       | 126 ++++
 bin/fm-kimi-turnend-hook.sh                   |  19 +-
 bin/fm-merge-local.sh                         |   6 +-
 bin/fm-pr-check.sh                            |   5 +
 bin/fm-pr-merge.sh                            |   3 +
 bin/fm-promote.sh                             |   7 +-
 bin/fm-review-diff.sh                         |   7 +-
 bin/fm-send.sh                                |  37 +-
 bin/fm-session-start.sh                       |  13 +-
 bin/fm-sessionstart-nudge.sh                  |   8 +-
 bin/fm-spawn.sh                               | 497 +++++++++++---
 bin/fm-supervision-instructions.sh            |  17 +-
 bin/fm-teardown.sh                            | 191 +++---
 bin/fm-x-followup.sh                          |   8 +
 bin/fm-x-link.sh                              |   4 +
 docs/architecture.md                          |   8 +
 docs/configuration.md                         |  43 +-
 docs/herdr-backend.md                         |   1 +
 docs/orca-backend.md                          |   1 +
 docs/sessionstart-nudge.md                    |   5 +-
 docs/tmux-backend.md                          |   1 +
 docs/turnend-guard.md                         |   2 +-
 docs/verification/runtime-backends.md         |  20 +
 docs/verification/supervision.md              |  27 +
 tests/fm-backend-cmux.test.sh                 |  62 ++
 tests/fm-backend-orca.test.sh                 | 172 ++++-
 tests/fm-backend-tmux-smoke.test.sh           |  10 +
 tests/fm-backend-zellij.test.sh               |  10 +-
 tests/fm-backend.test.sh                      | 163 ++++-
 tests/fm-brief.test.sh                        |  21 +
 tests/fm-decision-hold-lifecycle.test.sh      |  19 +-
 tests/fm-gate-refuse.test.sh                  |  39 +-
 tests/fm-gotmp.test.sh                        |   6 +-
 tests/fm-grok-harness.test.sh                 |   9 +-
 tests/fm-host-root-mode.test.sh               | 634 ++++++++++++++++++
 tests/fm-kimi-harness.test.sh                 |  20 +-
 tests/fm-pr-check-security.test.sh            |  44 +-
 tests/fm-session-start.test.sh                |  29 +-
 tests/fm-sessionstart-nudge.test.sh           |   3 +-
 tests/fm-tangle-guard.test.sh                 |  36 +-
 tests/fm-teardown.test.sh                     |  85 ++-
 tests/fm-turnend-guard.test.sh                |   1 +
 tests/fm-watcher-lock.test.sh                 |  11 +-
 tests/secondmate-helpers.sh                   |  19 +-
 58 files changed, 2555 insertions(+), 330 deletions(-)
 create mode 100644 bin/fm-host-root-lib.sh
 create mode 100644 tests/fm-host-root-mode.test.sh

diff --git a/.agents/skills/harness-adapters/SKILL.md b/.agents/skills/harness-adapters/SKILL.md
index 0ae4ee05b5..ff80f1c23c 100644
--- a/.agents/skills/harness-adapters/SKILL.md
+++ b/.agents/skills/harness-adapters/SKILL.md
@@ -103,6 +103,26 @@ OpenCode uses `.opencode/plugins/fm-primary-watch-arm.js`, which coordinates wit
 Pi and pi-signed use the tracked `.pi/extensions/fm-primary-turnend-guard.ts` plus the tracked `.pi/extensions/fm-primary-pi-watch.ts`, both project-local extensions the Pi engine auto-discovers once trusted.
 When changing any primary watcher adapter, update `docs/supervision-protocols/`, `docs/turnend-guard.md` if a shared idle or turn-end hook changed, and the relevant concise fact below.
 
+## Host-root task integration
+
+When `FM_HOST_ROOT` is set for an ordinary ship or scout, the harness starts from that physical host root and receives the isolated target separately as `FM_TARGET_WORKTREE`.
+The host's discovered instructions and lifecycle adapters remain authoritative; target instructions are read explicitly under the host-root brief before edits.
+FirstMate adds exactly one task turn-end signal without writing host configuration:
+
+| Harness | Additive task signal in host-root mode |
+|---|---|
+| claude | An additional state-owned settings file passed with `--settings`; Claude continues loading host project settings. |
+| codex | The existing per-launch `notify` command; host `.codex/hooks.json` remains untouched. |
+| opencode | A state-owned task plugin named through `OPENCODE_CONFIG_CONTENT`; host project plugins continue to auto-load from the launch cwd. |
+| pi | The existing explicit state-owned `-e` task extension; host project extensions continue to auto-load after host trust. |
+| grok | The guarded global FirstMate Stop hook reads a per-process `FM_GROK_TURNEND_TOKEN`; host project hooks remain untouched and no pointer is written into the host repository. |
+| kimi | The guarded global FirstMate Stop hook reads a per-process `FM_KIMI_TURNEND_TOKEN`; host configuration remains otherwise untouched and no pointer is written into the host repository. |
+
+Default worktree-root launches retain their existing hook locations and command shapes.
+Secondmate launches explicitly clear inherited `FM_HOST_ROOT` and `FM_TARGET_WORKTREE` and retain their isolated-home adapters.
+
+[`docs/verification/supervision.md`](../../../docs/verification/supervision.md#host-root-task-integration) owns the dated lifecycle evidence and current live-verification limits for these task adapters.
+
 ## Launch profile axes
 
 `bin/fm-spawn.sh` accepts concrete `--harness`, `--model`, and `--effort` values chosen by firstmate at intake.
diff --git a/.agents/skills/secondmate-provisioning/SKILL.md b/.agents/skills/secondmate-provisioning/SKILL.md
index f9e68937ab..1f0d5c6cc9 100644
--- a/.agents/skills/secondmate-provisioning/SKILL.md
+++ b/.agents/skills/secondmate-provisioning/SKILL.md
@@ -64,6 +64,7 @@ Release happens only on explicit retirement or seed rollback, never on routine r
 `bin/fm-home-seed.sh` copies the charter into the secondmate home as `data/charter.md`.
 It also writes the required `.fm-secondmate-home` identity marker, which is gitignored and must remain in place for home validation.
 `bin/fm-spawn.sh --secondmate` launches it through the secondmate harness path, resolving `config/secondmate-harness` -> `config/crew-harness` -> the primary's own harness unless an explicit per-spawn harness override is passed.
+Secondmates remain outside optional host-root mode: their launch prefix clears any inherited `FM_HOST_ROOT` and `FM_TARGET_WORKTREE`, their metadata has no `host_root=`, and their startup cwd remains the isolated FirstMate home.
 
 `config/secondmate-harness` may also pin a concrete model and effort for the secondmate agent, in the SAME file rather than a new one: the format is a single whitespace-separated line `<harness> [<model>] [<effort>]`, with only the first non-empty, non-comment line parsed.
 A bare `<harness>` (today's format, e.g. `claude`) behaves exactly as before - harness only, no model/effort flag - so this is fully backward-compatible.
diff --git a/AGENTS.md b/AGENTS.md
index ee23c840dc..63406c9264 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -48,7 +48,8 @@ Never add an agent name as a commit co-author.
 
 `docs/configuration.md` is the single owner of the top-level operational-home layout and configuration schemas; each producing script's header and help own exact child fields and mutation mechanics.
 `FM_HOME` selects an instance's private `data/`, `state/`, `config/`, and `projects/`, while scripts continue to come from their tracked code root.
-Each secondmate has a persistent isolated `FM_HOME`, including its own state, backlog, projects, and session lock.
+Optional `FM_HOST_ROOT` keeps another repository authoritative for instructions, lifecycle, and cwd while ordinary task edits stay under explicit `FM_TARGET_WORKTREE`; `docs/configuration.md` owns the four-root contract.
+Each secondmate has a persistent isolated `FM_HOME`, including its own state, backlog, projects, and session lock, and secondmate launches clear any inherited host-root variables.
 `bin/fm-send.sh` fails closed unless `FM_HOME` is explicit, so a steer cannot silently resolve against another home.
 
 Tracked files hold shared instructions and tooling; `data/` holds durable private fleet records; `state/` holds volatile runtime records and append-only status events; `config/` holds local operating choices; and `projects/` contains clones that are read-only to firstmate except under hard rule 1's concrete captain-approved project operation exception.
@@ -89,7 +90,7 @@ state/               volatile runtime signals; gitignored
   <id>.turn-ended    touched by turn-end hooks
   <id>.grok-turnend-token   firstmate-owned grok hook registry token for the task; removed by teardown
   <id>.kimi-turnend-token   firstmate-owned Kimi hook registry token for the task; removed by teardown
-  <id>.meta          written by fm-spawn: window=, endpoint_task_id=, worktree=, project=, harness=, model=, effort=, kind=, mode=, yolo=, tasktmp=; kind=secondmate also records home= and projects=; a non-default runtime backend records further backend-specific fields (docs/configuration.md "Runtime backend"; bin/fm-backend.sh, section 8); fm-pr-check, including through fm-pr-merge, records one canonical pr= and the forge's pr_head= when available (GitHub pull requests and GitLab merge requests; docs/gitlab-merge-watch.md); fm-x-link appends x_request=, x_request_ts=, x_followups=, and optional x_platform=/x_reply_max_chars= for an X-mode-originated task (section 14)
+  <id>.meta          written by fm-spawn: window=, endpoint_task_id=, worktree=, project=, harness=, model=, effort=, kind=, mode=, yolo=, tasktmp=; an ordinary host-root task also records host_root=; kind=secondmate also records home= and projects=; a non-default runtime backend records further backend-specific fields (docs/configuration.md "Runtime backend"; bin/fm-backend.sh, section 8); fm-pr-check, including through fm-pr-merge, records one canonical pr= and the forge's pr_head= when available (GitHub pull requests and GitLab merge requests; docs/gitlab-merge-watch.md); fm-x-link appends x_request=, x_request_ts=, x_followups=, and optional x_platform=/x_reply_max_chars= for an X-mode-originated task (section 14)
   <id>.herdr-presentation  quarantinable attempt and restart-binding journal for Herdr's optional visual projection; never task or endpoint authority; see docs/herdr-backend.md "Optional presentation spaces"
   <id>.check.sh      authenticated slow poll; the watcher dispatches validated PR data and the byte-identified X shim through trusted repository scripts, runs registered custom checks from hash-validated private snapshots, and rejects every other state check without execution
   <id>.check-trust   private content binding created by fm-check-register.sh for an intentional custom check
diff --git a/README.md b/README.md
index 5a03c4b9b1..cf2fcff819 100644
--- a/README.md
+++ b/README.md
@@ -44,6 +44,7 @@ Launching a supported harness inside it instantiates your first mate - and makes
 - **One liaison** - you talk only to the first mate; it dispatches, supervises, escalates only real decisions, and reports plain outcomes.
 - **A visible crew** - every crewmate works in its own tmux window, experimental herdr/zellij tab, cmux workspace, or Orca terminal you can watch or type into; the first mate reconciles.
 - **Disposable worktrees** - each task runs in a clean [treehouse](https://github.com/kunchenguid/treehouse) git worktree, or an Orca-managed worktree when `backend=orca`, so parallel work on one repo never collides.
+- **Optional host-root mode** - an explicitly integrated supervisor can keep an existing command-center repository authoritative for instructions, lifecycle hooks, and worker cwd while FirstMate retains its own code/home and every task edits an explicit isolated target worktree; see [configuration](docs/configuration.md#host-root-mode-fm_host_root).
 - **Two task shapes** - ship tasks deliver authorized changes; scout tasks leave standalone investigation reports when the intake contract warrants separate research.
 - **Explicit project modes** - each project ships via `no-mistakes`, `direct-PR`, or `local-only`, with an optional `+yolo` autonomy flag.
 - **Optional secondmates** - opt in to persistent second mates that run from isolated firstmate homes with their own `FM_HOME`, state, projects, and session lock, supervising project clones or a project-less firstmate-repo domain, kept on the primary firstmate version by guarded local fast-forwards and checked for live agent processes at session start.
@@ -82,7 +83,8 @@ git clone https://github.com/kunchenguid/firstmate
 cd firstmate
 ```
 
-Then launch one of the co-primary harnesses; AGENTS.md takes over from there:
+Then launch one of the co-primary harnesses; AGENTS.md takes over from there.
+For the low-level opt-in contract used by an explicit host integration, see [Host-root mode](docs/configuration.md#host-root-mode-fm_host_root).
 
 **Claude Code**
 
diff --git a/bin/backends/cmux.sh b/bin/backends/cmux.sh
index 12dc7629eb..203fb6b9ca 100644
--- a/bin/backends/cmux.sh
+++ b/bin/backends/cmux.sh
@@ -350,8 +350,14 @@ fm_backend_cmux_surface_id_for_workspace() {  # <workspace_id>
 # workspace/surface/pane create all default focus to false) - no
 # focus-restore dance is needed, unlike zellij. Echoes "<workspace_id>
 # <surface_id>" on success.
+# Creation-state globals are consumed by fm-spawn after direct function calls.
+# shellcheck disable=SC2034
 fm_backend_cmux_create_task() {  # <label> <cwd>
   local label=$1 cwd=$2 title dup out wsid sfid
+  FM_BACKEND_CREATE_OCCURRED=0
+  FM_BACKEND_CREATED_TARGET=
+  FM_BACKEND_CREATED_CMUX_WORKSPACE_ID=
+  FM_BACKEND_CREATED_CMUX_SURFACE_ID=
   title=$(fm_backend_cmux_scoped_title "$label")
   dup=$(fm_backend_cmux_workspace_id_for_label "$title")
   if [ -n "$dup" ]; then
@@ -362,9 +368,13 @@ fm_backend_cmux_create_task() {  # <label> <cwd>
     echo "error: cmux new-workspace failed for '$title': $out" >&2
     return 1
   }
+  FM_BACKEND_CREATE_OCCURRED=1
   wsid=$(fm_backend_cmux_workspace_id_for_label "$title")
+  FM_BACKEND_CREATED_CMUX_WORKSPACE_ID=$wsid
   [ -n "$wsid" ] || { echo "error: could not resolve a cmux workspace id for '$title' after creation" >&2; return 1; }
   sfid=$(fm_backend_cmux_surface_id_for_workspace "$wsid")
+  FM_BACKEND_CREATED_CMUX_SURFACE_ID=$sfid
+  [ -z "$sfid" ] || FM_BACKEND_CREATED_TARGET="$wsid:$sfid"
   [ -n "$sfid" ] || { echo "error: could not resolve the default surface for cmux workspace '$title' ($wsid)" >&2; return 1; }
   printf '%s %s' "$wsid" "$sfid"
 }
@@ -431,6 +441,36 @@ fm_backend_cmux_target_ready() {  # <target> [expected-label]
   fm_backend_cmux_surface_exists "$FM_BACKEND_CMUX_WORKSPACE" "$FM_BACKEND_CMUX_SURFACE"
 }
 
+# Tri-state endpoint probe for destructive cleanup. A successful workspace
+# inventory proves presence or absence; socket/auth/JSON failures stay unknown.
+fm_backend_cmux_target_state() {  # <target> [expected-label] -> present|absent|unknown
+  local expected_label=${2:-} expected_title workspaces
+  fm_backend_cmux_parse_target "$1" || { printf 'unknown'; return 0; }
+  [ "$(fm_backend_cmux_ping_state)" = ok ] || { printf 'unknown'; return 0; }
+  workspaces=$(fm_backend_cmux_cli workspace list --json --id-format uuids 2>&1) || {
+    printf 'unknown'
+    return 0
+  }
+  if ! printf '%s' "$workspaces" | jq -e '.workspaces | type == "array"' >/dev/null 2>&1; then
+    printf 'unknown'
+    return 0
+  fi
+  if printf '%s' "$workspaces" | jq -e --arg id "$FM_BACKEND_CMUX_WORKSPACE" \
+    'any(.workspaces[]?; .id == $id)' >/dev/null 2>&1; then
+    printf 'present'
+    return 0
+  fi
+  if [ -n "$expected_label" ]; then
+    expected_title=$(fm_backend_cmux_scoped_title "$expected_label")
+    if printf '%s' "$workspaces" | jq -e --arg title "$expected_title" \
+      'any(.workspaces[]?; .title == $title)' >/dev/null 2>&1; then
+      printf 'present'
+      return 0
+    fi
+  fi
+  printf 'absent'
+}
+
 # fm_backend_cmux_current_path: the live foreground process's cwd, or empty on
 # any error. Mirrors fm_backend_zellij_current_path's active pwd-marker-probe
 # workaround (bin/backends/zellij.sh:306-347) verbatim in spirit.
diff --git a/bin/backends/herdr.sh b/bin/backends/herdr.sh
index 237d2348c5..971b04fc18 100644
--- a/bin/backends/herdr.sh
+++ b/bin/backends/herdr.sh
@@ -1134,8 +1134,14 @@ fm_backend_herdr_agent_alive() {  # <target>
 # the safety argument). An ADOPTED workspace's caller always passes an empty
 # 4th arg, so this function never even queries for a prune candidate in that
 # case. Echoes "<tab_id> <pane_id>" on success.
+# Creation-state globals are consumed by fm-spawn after direct function calls.
+# shellcheck disable=SC2034
 fm_backend_herdr_create_task() {  # <container> <label> <cwd> <seeded_default_tab_id>
   local container=$1 label=$2 cwd=$3 seeded_tab_id=${4:-} session wsid list dup_tabs dup dup_pane dup_tab_ids out tab_id pane_id remaining_dup_tabs
+  FM_BACKEND_CREATE_OCCURRED=0
+  FM_BACKEND_CREATED_TARGET=
+  FM_BACKEND_CREATED_HERDR_TAB_ID=
+  FM_BACKEND_CREATED_HERDR_PANE_ID=
   session=${container%%:*}
   wsid=${container#*:}
   list=$(fm_backend_herdr_cli "$session" tab list --workspace "$wsid" 2>/dev/null) || return 1
@@ -1158,8 +1164,12 @@ $dup_tabs
 EOF
   fi
   out=$(fm_backend_herdr_cli "$session" tab create --workspace "$wsid" --cwd "$cwd" --label "$label" --no-focus 2>/dev/null) || return 1
+  FM_BACKEND_CREATE_OCCURRED=1
   tab_id=$(printf '%s' "$out" | jq -r '.result.tab.tab_id // empty' 2>/dev/null)
   pane_id=$(printf '%s' "$out" | jq -r '.result.root_pane.pane_id // empty' 2>/dev/null)
+  FM_BACKEND_CREATED_HERDR_TAB_ID=$tab_id
+  FM_BACKEND_CREATED_HERDR_PANE_ID=$pane_id
+  [ -z "$pane_id" ] || FM_BACKEND_CREATED_TARGET="$session:$pane_id"
   if [ -z "$tab_id" ] || [ -z "$pane_id" ]; then
     echo "error: could not parse tab/pane id from herdr tab create output" >&2
     return 1
@@ -2096,6 +2106,22 @@ fm_backend_herdr_send_text_submit() {  # <target> <text> <retries> <enter-sleep>
   done
 }
 
+# Tri-state endpoint probe for destructive cleanup. Only Herdr's typed
+# pane_not_found response proves absence; malformed, unreachable, or other
+# error responses stay unknown.
+fm_backend_herdr_target_state() {  # <target> -> present|absent|unknown
+  local out code pane_id
+  fm_backend_herdr_parse_target "$1" || { printf 'unknown'; return 0; }
+  out=$(fm_backend_herdr_cli "$FM_BACKEND_HERDR_SESSION" pane get "$FM_BACKEND_HERDR_PANE" 2>&1)
+  code=$(printf '%s' "$out" | jq -r '.error.code // empty' 2>/dev/null)
+  if [ -n "$code" ]; then
+    [ "$code" = pane_not_found ] && printf 'absent' || printf 'unknown'
+    return 0
+  fi
+  pane_id=$(printf '%s' "$out" | jq -r '.result.pane.pane_id // empty' 2>/dev/null)
+  [ "$pane_id" = "$FM_BACKEND_HERDR_PANE" ] && printf 'present' || printf 'unknown'
+}
+
 # fm_backend_herdr_kill: remove the task's pane, best-effort (mirrors
 # tmux-kill-window's `|| true` contract). Verified: closing a tab's only pane
 # closes the tab too, so a separate tab close is unnecessary.
diff --git a/bin/backends/orca.sh b/bin/backends/orca.sh
index dc9307de4f..ec147b181c 100644
--- a/bin/backends/orca.sh
+++ b/bin/backends/orca.sh
@@ -139,10 +139,9 @@ fm_backend_orca_worktree_create() {  # <project-path> <name>
   terminal=$(printf '%s' "$out" | fm_backend_orca_json_get worktree-terminal-handle 2>/dev/null || true)
   wt_path=$(printf '%s' "$out" | fm_backend_orca_json_get worktree-path) || {
     echo "error: orca worktree create did not return a path for $name" >&2
-    [ -z "$terminal" ] || fm_backend_orca_kill "$terminal" >/dev/null 2>&1 || true
-    if fm_backend_orca_remove_worktree "$wt_id" >/dev/null; then
-      return 1
-    fi
+    # The worktree exists, but pathless creation is not safe to clean up here:
+    # a terminal must be confirmed absent before its owning worktree can be
+    # removed. Return the recoverable ids to fm-spawn's verified rollback path.
     if [ -n "$terminal" ]; then
       printf '%s\t\t%s' "$wt_id" "$terminal"
     else
@@ -171,6 +170,47 @@ fm_backend_orca_send_text_line() {  # <terminal-id> <text>
   fm_backend_orca_run_json orca terminal send --terminal "$terminal" --text "$text" --enter --json
 }
 
+# Active marker probe used only by spawn-time cwd verification. Orca exposes no
+# structured live foreground cwd, so submit one harmless command and bound the
+# reads waiting for its unique marker pair. One invocation never injects the
+# command more than once, which prevents overlapping probes in a slow terminal.
+fm_backend_orca_current_path() {  # <terminal-id>
+  local terminal=$1 out line candidate in_block path_lines attempt
+  local attempts=${FM_ORCA_CWD_PROBE_ATTEMPTS:-10} delay=${FM_ORCA_CWD_PROBE_DELAY:-0.1}
+  local nonce="${BASHPID:-$$}_${RANDOM:-0}"
+  local begin="__FM_ORCA_CWD_BEGIN_${nonce}__" end="__FM_ORCA_CWD_END_${nonce}__"
+  case "$attempts" in ''|*[!0-9]*|0) attempts=10 ;; esac
+  fm_backend_orca_send_text_line "$terminal" "printf '%s\\n' '$begin'; pwd -P; printf '%s\\n' '$end'" || return 0
+  for ((attempt = 0; attempt < attempts; attempt += 1)); do
+    out=$(fm_backend_orca_read_text_paged "$terminal" 200 2>/dev/null || true)
+    in_block=0
+    candidate=
+    path_lines=0
+    while IFS= read -r line; do
+      if [ "$line" = "$begin" ]; then
+        in_block=1
+        candidate=
+        path_lines=0
+        continue
+      fi
+      if [ "$line" = "$end" ]; then
+        if [ "$path_lines" -eq 1 ]; then
+          case "$candidate" in
+            /*) printf '%s' "$candidate"; return 0 ;;
+          esac
+        fi
+        in_block=0
+        continue
+      fi
+      [ "$in_block" -eq 1 ] || continue
+      candidate=$line
+      path_lines=$((path_lines + 1))
+    done < <(printf '%s\n' "$out")
+    [ "$attempt" -ge $((attempts - 1)) ] || sleep "$delay"
+  done
+  return 0
+}
+
 fm_backend_orca_send_literal() {  # <terminal-id> <text>
   local terminal=$1 text=$2
   fm_backend_orca_tool_check || return 1
@@ -203,6 +243,27 @@ fm_backend_orca_capture() {  # <terminal-id> <lines>
   fm_backend_orca_json_text "$out"
 }
 
+# Tri-state endpoint probe for destructive cleanup. Only Orca's typed stale
+# handle response proves absence; every transport, parse, or other API error is
+# unknown and therefore cannot license worktree removal.
+fm_backend_orca_target_state() {  # <terminal-id> -> present|absent|unknown
+  local out
+  fm_backend_orca_tool_check || { printf 'unknown'; return 0; }
+  out=$(orca terminal read --terminal "$1" --limit 1 --json 2>&1)
+  printf '%s' "$out" | node -e '
+const fs = require("fs");
+let data;
+try { data = JSON.parse(fs.readFileSync(0, "utf8")); }
+catch { process.stdout.write("unknown"); process.exit(0); }
+if (data && data.ok === false) {
+  const code = data.error && data.error.code;
+  process.stdout.write(code === "terminal_handle_stale" ? "absent" : "unknown");
+} else {
+  process.stdout.write("present");
+}
+'
+}
+
 fm_backend_orca_json_text() {  # <json>
   printf '%s' "$1" | node -e '
 const fs = require("fs");
diff --git a/bin/backends/tmux.sh b/bin/backends/tmux.sh
index f8da21bf0d..23ed5ca86b 100644
--- a/bin/backends/tmux.sh
+++ b/bin/backends/tmux.sh
@@ -117,6 +117,29 @@ fm_backend_tmux_send_literal() {  # <target> <text>
   tmux send-keys -t "$1" -l "$2"
 }
 
+# Tri-state endpoint probe for destructive cleanup. Enumerate exact handles:
+# `display-message -t` silently falls back to the active window when a named
+# target disappeared, which would report a killed worker as still present.
+# A readable inventory proves presence/absence; control-plane failures stay unknown.
+fm_backend_tmux_target_state() {  # <target> -> present|absent|unknown
+  local target=$1 out status pane_id window_id named indexed
+  out=$(tmux list-panes -a -F '#{pane_id}|#{window_id}|#{session_name}:#{window_name}|#{session_name}:#{window_index}.#{pane_index}' 2>&1)
+  status=$?
+  if [ "$status" -eq 0 ]; then
+    while IFS='|' read -r pane_id window_id named indexed; do
+      case "$target" in
+        "$pane_id"|"$window_id"|"$named"|"$indexed") printf 'present'; return 0 ;;
+      esac
+    done <<< "$out"
+    printf 'absent'
+  else
+    case "$out" in
+      *'no server running'*|*'no sessions'*) printf 'absent' ;;
+      *) printf 'unknown' ;;
+    esac
+  fi
+}
+
 # fm_backend_tmux_kill: remove one explicitly named task window, best-effort.
 # Empty, omitted, and malformed targets return nonzero before invoking tmux so
 # tmux can never interpret an empty target as the caller's current window.
diff --git a/bin/backends/zellij.sh b/bin/backends/zellij.sh
index 20d53a3c2d..9b0e490742 100644
--- a/bin/backends/zellij.sh
+++ b/bin/backends/zellij.sh
@@ -325,8 +325,14 @@ fm_backend_zellij_tab_matches_label() {  # <session> <tab_id> <label>
 # spawn). Best-effort: a failure to restore never fails the spawn.
 #
 # Echoes "<tab_id> <pane_id>" on success.
+# Creation-state globals are consumed by fm-spawn after direct function calls.
+# shellcheck disable=SC2034
 fm_backend_zellij_create_task() {  # <session> <label> <cwd>
   local session=$1 label=$2 cwd=$3 title tabs dup prev_active tab_id pane_id
+  FM_BACKEND_CREATE_OCCURRED=0
+  FM_BACKEND_CREATED_TARGET=
+  FM_BACKEND_CREATED_ZELLIJ_TAB_ID=
+  FM_BACKEND_CREATED_ZELLIJ_PANE_ID=
   fm_backend_zellij_session_exists "$session" || { echo "error: zellij session '$session' does not exist; run container_ensure first" >&2; return 1; }
   title=$(fm_backend_zellij_scoped_title "$label")
   tabs=$(fm_backend_zellij_cli "$session" action list-tabs --json 2>/dev/null)
@@ -337,6 +343,8 @@ fm_backend_zellij_create_task() {  # <session> <label> <cwd>
   fi
   prev_active=$(printf '%s' "$tabs" | jq -r '.[]? | select(.active == true) | .tab_id' 2>/dev/null | head -1)
   tab_id=$(fm_backend_zellij_cli "$session" action new-tab --cwd "$cwd" --name "$title" 2>/dev/null | tr -d '[:space:]')
+  FM_BACKEND_CREATE_OCCURRED=1
+  FM_BACKEND_CREATED_ZELLIJ_TAB_ID=$tab_id
   case "$tab_id" in
     ''|*[!0-9]*)
       echo "error: zellij new-tab did not return a numeric tab id for '$title' (got '$tab_id'; session '$session' may not exist)" >&2
@@ -344,6 +352,8 @@ fm_backend_zellij_create_task() {  # <session> <label> <cwd>
       ;;
   esac
   pane_id=$(fm_backend_zellij_pane_for_tab "$session" "$tab_id")
+  FM_BACKEND_CREATED_ZELLIJ_PANE_ID=$pane_id
+  [ -z "$pane_id" ] || FM_BACKEND_CREATED_TARGET="$session:$pane_id"
   if [ -z "$pane_id" ]; then
     echo "error: could not find a terminal pane for zellij tab $tab_id (session '$session')" >&2
     return 1
@@ -381,6 +391,38 @@ fm_backend_zellij_target_ready() {  # <target> [expected-label]
   fm_backend_zellij_pane_exists "$FM_BACKEND_ZELLIJ_SESSION" "$FM_BACKEND_ZELLIJ_PANE"
 }
 
+# Tri-state endpoint probe for destructive cleanup. Zellij action exit codes
+# cannot prove absence, so first require a readable session list and then parse
+# the pane list structurally; malformed or unreachable output stays unknown.
+fm_backend_zellij_target_state() {  # <target> -> present|absent|unknown
+  local sessions status panes
+  fm_backend_zellij_parse_target "$1" || { printf 'unknown'; return 0; }
+  sessions=$(zellij list-sessions --short --no-formatting 2>&1)
+  status=$?
+  if [ "$status" -ne 0 ]; then
+    case "$sessions" in
+      *'No active zellij sessions found'*|*'No sessions found'*) printf 'absent' ;;
+      *) printf 'unknown' ;;
+    esac
+    return 0
+  fi
+  if ! printf '%s\n' "$sessions" | grep -qxF "$FM_BACKEND_ZELLIJ_SESSION"; then
+    printf 'absent'
+    return 0
+  fi
+  panes=$(fm_backend_zellij_cli "$FM_BACKEND_ZELLIJ_SESSION" action list-panes --json 2>&1)
+  if ! printf '%s' "$panes" | jq -e 'type == "array"' >/dev/null 2>&1; then
+    printf 'unknown'
+    return 0
+  fi
+  if printf '%s' "$panes" | jq -e --arg pane "$FM_BACKEND_ZELLIJ_PANE" \
+    '[.[]? | select((.id | tostring) == $pane and .is_plugin == false)] | length > 0' >/dev/null 2>&1; then
+    printf 'present'
+  else
+    printf 'absent'
+  fi
+}
+
 # fm_backend_zellij_current_path: the live pane's cwd, or empty on any error.
 # Mirrors tmux's pane_current_path poll used for worktree-path discovery after
 # `treehouse get`.
diff --git a/bin/fm-backend.sh b/bin/fm-backend.sh
index e505b99f75..2eb277d82b 100644
--- a/bin/fm-backend.sh
+++ b/bin/fm-backend.sh
@@ -884,6 +884,45 @@ fm_backend_target_exists() {  # <backend> <target> [expected-label]
 # classifier. Zellij remains unverified because its secondmate ghost-tab and
 # agent-process recovery path has not been empirically validated. Orca and cmux
 # do not support secondmate spawns.
+# Tri-state existence probe for destructive cleanup. Unlike the historical
+# boolean liveness helper above, an unreadable control plane is unknown rather
+# than absent and therefore cannot authorize worktree reuse.
+fm_backend_target_state() {  # <backend> <target> [expected-label] -> present|absent|unknown
+  local backend=$1 target=$2 expected_label=${3:-}
+  fm_backend_source "$backend" || { printf 'unknown'; return 0; }
+  case "$backend" in
+    tmux) fm_backend_tmux_target_state "$target" ;;
+    herdr) fm_backend_herdr_target_state "$target" ;;
+    zellij) fm_backend_zellij_target_state "$target" ;;
+    orca) fm_backend_orca_target_state "$target" ;;
+    cmux) fm_backend_cmux_target_state "$target" "$expected_label" ;;
+    *) printf 'unknown' ;;
+  esac
+}
+
+# Stop a task endpoint and prove it disappeared before any caller recycles or
+# removes the task's worktree. Kill adapters remain idempotent; this stricter
+# owner is for destructive cleanup paths that must not trust best-effort close.
+fm_backend_stop_and_verify() {  # <backend> <target> [zellij-tab-id] [expected-label]
+  local backend=$1 target=$2 expected_label=${4:-} attempts=${FM_BACKEND_STOP_ATTEMPTS:-20} delay=${FM_BACKEND_STOP_DELAY:-0.1} i=0 state=unknown
+  [ -n "$target" ] || return 0
+  case "$attempts" in ''|*[!0-9]*|0) attempts=20 ;; esac
+  fm_backend_kill "$@" || return 1
+  while [ "$i" -lt "$attempts" ]; do
+    state=$(fm_backend_target_state "$backend" "$target" "$expected_label")
+    [ "$state" = absent ] && return 0
+    i=$((i + 1))
+    [ "$i" -ge "$attempts" ] || sleep "$delay"
+  done
+  if [ "$state" = present ]; then
+    echo "error: backend endpoint $target still exists after stop; refusing destructive cleanup" >&2
+  else
+    echo "error: backend endpoint $target could not be confirmed absent after stop; refusing destructive cleanup" >&2
+  fi
+  return 1
+}
+
+# Implement the recovery-grade state contract described above.
 fm_backend_agent_state() {  # <backend> <target>
   local backend=$1 target=$2
   fm_backend_source "$backend" || { printf 'unverified'; return 0; }
diff --git a/bin/fm-brief.sh b/bin/fm-brief.sh
index 9c98723b01..da91b5ff8b 100755
--- a/bin/fm-brief.sh
+++ b/bin/fm-brief.sh
@@ -46,6 +46,8 @@
 # self-governance section when a touched project AGENTS.md lacks it.
 # Refuses to overwrite an existing brief.
 set -eu
+# Paths and names are literal replacement data; never expand '&' as the matched placeholder.
+shopt -u patsub_replacement 2>/dev/null || true
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
@@ -65,6 +67,8 @@ esac
 . "$SCRIPT_DIR/fm-marker-lib.sh"
 # shellcheck source=bin/fm-classify-lib.sh
 . "$SCRIPT_DIR/fm-classify-lib.sh"
+# shellcheck source=bin/fm-host-root-lib.sh
+. "$SCRIPT_DIR/fm-host-root-lib.sh"
 PAUSED_VERB=${FM_CLASSIFY_PAUSED_VERB:-$FM_CLASSIFY_PAUSED_VERB_DEFAULT}
 
 resolve_directory_input() {
@@ -116,6 +120,16 @@ if [ "$NO_PROJECTS" -eq 1 ] && [ "$KIND" != secondmate ]; then
   exit 1
 fi
 
+HOST_MODE=0
+HOST_ROOT=
+if fm_host_root_enabled; then
+  fm_host_root_assert_session_cwd "$FM_ROOT" || exit $?
+  if [ "$KIND" != secondmate ]; then
+    HOST_ROOT=$(fm_host_root_resolve "$FM_ROOT") || exit $?
+    HOST_MODE=1
+  fi
+fi
+
 BRIEF="$DATA/$ID/brief.md"
 [ -e "$BRIEF" ] && { echo "error: $BRIEF already exists" >&2; exit 1; }
 mkdir -p "$DATA/$ID"
@@ -127,6 +141,43 @@ shell_quote() {
 }
 
 STATUS_FILE=$(shell_quote "$STATE/$ID.status")
+CREW_INTRO='You are a crewmate: an autonomous worker agent managed by firstmate. Work on your own; do not wait for a human.'
+EXECUTION_MARKER=
+EXECUTION_SECTION=
+SETUP_LOCATION="You are in a disposable git worktree of __REPO__, at a detached HEAD on a clean default branch."
+STAY_RULE="Stay inside this worktree; modify nothing outside it."
+SCOUT_STAY_RULE="Stay inside this worktree; the only files you may write outside it are the report and the status file below."
+BRANCH_COMMAND="\`git checkout -b fm/$ID\`"
+PROJECT_MEMORY_TARGET="."
+PROJECT_MEMORY_CONTEXT='in the worktree'
+if [ "$HOST_MODE" -eq 1 ]; then
+  EXECUTION_MARKER='<!-- firstmate-execution-mode: host-root -->'
+  EXECUTION_SECTION=$(cat <<'EOF'
+# Host-root execution contract
+Your top-level process cwd is the physical host instruction root `__HOST_ROOT__`, not the target repository.
+The host root is authoritative for identity, startup, lifecycle, and cross-repository safety; keep it read-only except for effects produced by its own native lifecycle hooks.
+The isolated target worktree is the exact path in `$FM_TARGET_WORKTREE`.
+Before any edit, verify `[ "$(pwd -P)" = "$FM_HOST_ROOT" ]` and verify the physical result of `git -C "$FM_TARGET_WORKTREE" rev-parse --show-toplevel` equals the physical `$FM_TARGET_WORKTREE` path.
+Use `git -C "$FM_TARGET_WORKTREE" worktree list --porcelain` to identify the target primary clone and confirm its physical path differs from `$FM_TARGET_WORKTREE`.
+Read the target worktree root instructions and every applicable nested instruction file before editing; host instructions remain authoritative when the two surfaces conflict, and an unresolved conflict is a needs-decision rather than permission to guess.
+Use absolute paths, `git -C "$FM_TARGET_WORKTREE" ...`, or a scoped subshell for every target operation while keeping the top-level process cwd at the host root.
+Run tests, builds, GitHub tooling, and no-mistakes against `$FM_TARGET_WORKTREE` only; never run a bare target command from the host repository.
+EOF
+)
+  EXECUTION_SECTION=${EXECUTION_SECTION//__HOST_ROOT__/$HOST_ROOT}
+  CREW_INTRO="$CREW_INTRO"$'\n'"$EXECUTION_MARKER"$'\n'"$EXECUTION_SECTION"
+  # shellcheck disable=SC2016  # These variables are literal Markdown instructions for the worker.
+  SETUP_LOCATION='You are launched from the host instruction root; the disposable target git worktree is in `$FM_TARGET_WORKTREE` at a detached HEAD on a clean default branch.'
+  # shellcheck disable=SC2016
+  STAY_RULE='Keep the host root read-only and write target code only under `$FM_TARGET_WORKTREE`; the report and status file named below are the only other task artifacts you may write.'
+  # shellcheck disable=SC2016
+  SCOUT_STAY_RULE='Keep the host root read-only and write target code only under `$FM_TARGET_WORKTREE`; the report and status file below are the only other task artifacts you may write.'
+  # shellcheck disable=SC2016
+  BRANCH_COMMAND='`git -C "$FM_TARGET_WORKTREE" checkout -b fm/'"$ID"'`'
+  # shellcheck disable=SC2016
+  PROJECT_MEMORY_TARGET='"$FM_TARGET_WORKTREE"'
+  PROJECT_MEMORY_CONTEXT='for the target worktree'
+fi
 
 if [ "$KIND" = secondmate ]; then
 SECONDMATE_PROJECTS=""
@@ -214,6 +265,18 @@ exit 0
 fi
 
 REPO=${POS[1]}
+SETUP_LOCATION=${SETUP_LOCATION//__REPO__/$REPO}
+if [ "$HOST_MODE" -eq 1 ]; then
+  # shellcheck disable=SC2016  # Literal Markdown, not shell expansion.
+  ISOLATION_SECTION='**Verify isolation before anything else.** Follow the host-root execution contract above. If the host cwd or target worktree check fails, append `blocked: host-root or isolated target verification failed` and stop before branching or editing.'
+else
+  ISOLATION_SECTION=$(cat <<'EOF'
+**Verify isolation before anything else.** Run `pwd -P` and `git rev-parse --show-toplevel`; both must resolve to the disposable task worktree you were launched in, such as a treehouse pool path or an Orca-managed worktree, not the primary checkout firstmate operates from.
+The path check is authoritative: `git rev-parse --git-dir` and `git rev-parse --git-common-dir` can help inspect the repo, but they do not prove you are outside the primary checkout.
+If the top-level path is the primary checkout or not the worktree you were launched in, STOP - do not branch or commit here - append `blocked: launched in primary checkout, not an isolated worktree` to the status file and stop.
+EOF
+)
+fi
 
 if [ "$HERDR_LAB" -eq 1 ]; then
 HERDR_LAB_HELPER=$(shell_quote "$FM_ROOT/bin/fm-herdr-lab.sh")
@@ -249,7 +312,7 @@ fi
 
 if [ "$KIND" = scout ]; then
 cat > "$BRIEF" <<EOF
-You are a crewmate: an autonomous worker agent managed by firstmate. Work on your own; do not wait for a human.
+$CREW_INTRO
 
 # Task
 {TASK}
@@ -257,14 +320,14 @@ You are a crewmate: an autonomous worker agent managed by firstmate. Work on you
 $HERDR_SECTION
 
 # Setup
-You are in a disposable git worktree of $REPO, at a detached HEAD on a clean default branch.
+$SETUP_LOCATION
 This is a SCOUT task: the deliverable is a written report, not a PR.
 The worktree is your laboratory - install, run, edit, and make scratch commits freely; all of it is discarded at teardown.
 The report is the only thing that survives, so anything worth keeping must be in it.
 
 # Rules
 1. Never push to any remote and never open a PR.
-2. Stay inside this worktree; the only files you may write outside it are the report and the status file below.
+2. $SCOUT_STAY_RULE
 3. Use gh-axi for GitHub operations and chrome-devtools-axi for browser operations.
 4. Report status by appending one line:
    \`echo "{state}: {one short line}" >> $STATUS_FILE\`
@@ -327,10 +390,35 @@ The configured merge authority approves the ready branch, then firstmate merges
 EOF
     ;;
   *)  # no-mistakes (default)
-    SETUP2="
+    if [ "$HOST_MODE" -eq 1 ]; then
+      SETUP2="
+2. Run \`(cd \"\$FM_TARGET_WORKTREE\" && no-mistakes doctor)\`; if it reports the repo is not initialized there, run \`(cd \"\$FM_TARGET_WORKTREE\" && no-mistakes init)\`."
+    else
+      SETUP2="
 2. Run \`no-mistakes doctor\`; if it reports the repo is not initialized here, run \`no-mistakes init\`."
+    fi
     RULE1='1. Never push to the default branch. Never merge a PR.'
-    IFS= read -r -d '' DOD <<EOF || true
+    if [ "$HOST_MODE" -eq 1 ]; then
+      IFS= read -r -d '' DOD <<'EOF' || true
+# Definition of done
+The task is complete only when committed on your branch.
+When you believe it is complete, append `done: {summary}` to the status file and stop.
+Firstmate will then instruct you to invoke /no-mistakes for `$FM_TARGET_WORKTREE` to validate and ship a PR.
+Before invoking it, name that target explicitly and run every no-mistakes CLI command through `(cd "$FM_TARGET_WORKTREE" && no-mistakes ...)`; never let validation default to the host cwd.
+
+You drive no-mistakes by responding to its gates, not by implementing fixes.
+Follow the guidance no-mistakes itself provides for the mechanics: it loads when you invoke /no-mistakes, and `(cd "$FM_TARGET_WORKTREE" && no-mistakes axi run --help)` plus the `help` lines in each `axi` response are authoritative and version-matched to the installed binary.
+Do not hand-edit, commit, or fix findings yourself while a run is active - the pipeline applies every fix.
+
+Two firstmate-specific rules layer on top of that guidance:
+- ask-user findings are not yours to answer: escalate to firstmate (rule 6) and stop.
+  When the decision comes back, feed it to the gate through `(cd "$FM_TARGET_WORKTREE" && no-mistakes axi respond ...)` and let the pipeline apply it - do not route the question to "the user" or implement the fix yourself.
+- Avoid `--yes`: the captain, not you, owns the ask-user decisions it would silently auto-resolve.
+
+After /no-mistakes reports CI green (the CI-ready return point - do not wait for it to keep monitoring in the background until merge), append `done: PR {url} checks green` and stop. You are finished.
+EOF
+    else
+      IFS= read -r -d '' DOD <<EOF || true
 # Definition of done
 The task is complete only when committed on your branch.
 When you believe it is complete, append \`done: {summary}\` to the status file and stop.
@@ -348,6 +436,7 @@ Two firstmate-specific rules layer on top of that guidance:
 
 After /no-mistakes reports CI green (the CI-ready return point - do not wait for it to keep monitoring in the background until merge), append \`done: PR {url} checks green\` and stop. You are finished.
 EOF
+    fi
     ;;
 esac
 
@@ -357,7 +446,7 @@ esac
 DOD=${DOD%$'\n'}
 
 cat > "$BRIEF" <<EOF
-You are a crewmate: an autonomous worker agent managed by firstmate. Work on your own; do not wait for a human.
+$CREW_INTRO
 
 # Task
 {TASK}
@@ -365,17 +454,15 @@ You are a crewmate: an autonomous worker agent managed by firstmate. Work on you
 $HERDR_SECTION
 
 # Setup
-You are in a disposable git worktree of $REPO, at a detached HEAD on a clean default branch.
+$SETUP_LOCATION
 
-**Verify isolation before anything else.** Run \`pwd -P\` and \`git rev-parse --show-toplevel\`; both must resolve to the disposable task worktree you were launched in, such as a treehouse pool path or an Orca-managed worktree, not the primary checkout firstmate operates from.
-The path check is authoritative: \`git rev-parse --git-dir\` and \`git rev-parse --git-common-dir\` can help inspect the repo, but they do not prove you are outside the primary checkout.
-If the top-level path is the primary checkout or not the worktree you were launched in, STOP - do not branch or commit here - append \`blocked: launched in primary checkout, not an isolated worktree\` to the status file and stop.
+$ISOLATION_SECTION
 
-1. First action: create your branch: \`git checkout -b fm/$ID\`$SETUP2
+1. First action: create your branch: $BRANCH_COMMAND$SETUP2
 
 # Rules
 $RULE1
-2. Stay inside this worktree; modify nothing outside it.
+2. $STAY_RULE
 3. Use gh-axi for GitHub operations and chrome-devtools-axi for browser operations.
 4. Report status by appending one line:
    \`echo "{state}: {one short line}" >> $STATUS_FILE\`
@@ -399,7 +486,7 @@ $RULE1
    daemon error, append \`blocked: {the daemon error}\` and stop; only firstmate manages the daemon.
 
 # Project memory
-If \`AGENTS.md\` or \`CLAUDE.md\` already exists, or if this task produced durable project-intrinsic knowledge, run \`$FM_ROOT/bin/fm-ensure-agents-md.sh .\` in the worktree.
+If \`AGENTS.md\` or \`CLAUDE.md\` already exists, or if this task produced durable project-intrinsic knowledge, run \`$FM_ROOT/bin/fm-ensure-agents-md.sh $PROJECT_MEMORY_TARGET\` $PROJECT_MEMORY_CONTEXT.
 Record only project knowledge useful to almost every future session.
 For anything the codebase already shows, prefer a pointer to the authoritative file, command, or doc over copying the detail.
 If you touch a project \`AGENTS.md\` that lacks \`## Maintaining this file\`, add that short self-governance section from \`$FM_ROOT/bin/fm-ensure-agents-md.sh\` in the same pass.
diff --git a/bin/fm-check-register.sh b/bin/fm-check-register.sh
index d77d02b64f..4b65784003 100755
--- a/bin/fm-check-register.sh
+++ b/bin/fm-check-register.sh
@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 # Bind an intentional custom watcher check to its current bytes.
+# Host-root tasks bind to their recorded physical host cwd before trust-file mutation.
 # Usage: fm-check-register.sh <id>
 set -u
 
@@ -12,6 +13,8 @@ STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 . "$SCRIPT_DIR/fm-pr-lib.sh"
 # shellcheck source=bin/fm-check-lib.sh
 . "$SCRIPT_DIR/fm-check-lib.sh"
+# shellcheck source=bin/fm-host-root-lib.sh
+. "$SCRIPT_DIR/fm-host-root-lib.sh"
 
 if [ "$#" -ne 1 ] || ! fm_pr_task_id_valid "$1"; then
   echo "error: invalid custom check registration" >&2
@@ -19,6 +22,12 @@ if [ "$#" -ne 1 ] || ! fm_pr_task_id_valid "$1"; then
 fi
 
 ID=$1
+META="$STATE/$ID.meta"
+if [ -f "$META" ]; then
+  fm_host_root_assert_task_cwd "$FM_ROOT" "$META" || exit $?
+else
+  fm_host_root_assert_session_cwd "$FM_ROOT" || exit $?
+fi
 CHECK="$STATE/$ID.check.sh"
 TRUST="$STATE/$ID.check-trust"
 [ -d "$STATE" ] && [ ! -L "$STATE" ] || { echo "error: state directory is unavailable" >&2; exit 1; }
diff --git a/bin/fm-decision-hold.sh b/bin/fm-decision-hold.sh
index aeb140a296..2fe98bb147 100755
--- a/bin/fm-decision-hold.sh
+++ b/bin/fm-decision-hold.sh
@@ -15,6 +15,7 @@
 # is idempotent. A different decision key creates a different backlog identity.
 # All backlog mutations run in the active FM_HOME, which keeps main-home and
 # secondmate-home ownership aligned with the work that discovered the decision.
+# Host-root origins bind to their recorded physical host cwd before task or backlog activity.
 #
 # Usage:
 #   fm-decision-hold.sh id <origin-id> <decision-key>
@@ -51,6 +52,9 @@ DATA="${FM_DATA_OVERRIDE:-$FM_HOME/data}"
 # shellcheck source=bin/fm-tasks-axi-lib.sh
 # shellcheck disable=SC1091
 . "$SCRIPT_DIR/fm-tasks-axi-lib.sh"
+# shellcheck source=bin/fm-host-root-lib.sh
+# shellcheck disable=SC1091
+. "$SCRIPT_DIR/fm-host-root-lib.sh"
 
 usage() {
   awk '
@@ -80,6 +84,15 @@ validate_one_line() {  # <label> <value>
   esac
 }
 
+assert_origin_host() {  # <origin-id>
+  local origin=$1 meta="$STATE/$1.meta"
+  if [ -f "$meta" ]; then
+    fm_host_root_assert_task_cwd "$FM_ROOT" "$meta"
+  else
+    fm_host_root_assert_session_cwd "$FM_ROOT"
+  fi
+}
+
 sha256_text() {  # <text>
   if command -v shasum >/dev/null 2>&1; then
     printf '%s' "$1" | shasum -a 256 | awk '{print $1}'
@@ -243,6 +256,7 @@ command_hold() {
   done
   validate_slug origin-id "$origin"
   validate_slug decision-key "$key"
+  assert_origin_host "$origin" || exit $?
   validate_one_line title "$title"
   validate_one_line reason "$reason"
   case "$reason" in *'('*|*')'*) fail "reason must not contain parentheses (tasks-axi hold contract)" ;; esac
@@ -281,6 +295,7 @@ command_complete() {
   shift
   meta="$STATE/$origin.meta"
   [ -f "$meta" ] && has_meta=1
+  assert_origin_host "$origin" || exit $?
   require_tasks_axi
   origin_exists_here "$origin" || fail "origin $origin is not owned by the active home $FM_HOME"
   if [ "$#" -eq 1 ] && [ "$1" = --none ]; then
@@ -343,6 +358,7 @@ command_verify() {
   validate_slug origin-id "$origin"
   meta="$STATE/$origin.meta"
   [ -f "$meta" ] || fail "origin metadata is absent: $meta"
+  assert_origin_host "$origin" || exit $?
   require_tasks_axi
   reviewed=$(meta_value "$meta" decisions_reviewed)
   [ "$reviewed" = 1 ] || fail "origin $origin has no completed unresolved-decision inventory"
@@ -381,6 +397,7 @@ command_resolve() {
   done
   validate_slug origin-id "$origin"
   validate_slug decision-key "$key"
+  assert_origin_host "$origin" || exit $?
   [ -n "$decision_file" ] || fail "--decision-file is required"
   [ -f "$decision_file" ] || fail "decision file does not exist: $decision_file"
   decision=$(cat "$decision_file")
diff --git a/bin/fm-gate-refuse-lib.sh b/bin/fm-gate-refuse-lib.sh
index 8e624408a5..e8b180285b 100644
--- a/bin/fm-gate-refuse-lib.sh
+++ b/bin/fm-gate-refuse-lib.sh
@@ -67,7 +67,7 @@ FM_GATE_REFUSE_EXIT=3
 # no-mistakes gate agent. An optional root anchors the git-common-dir check;
 # callers that omit it retain the historical current-worktree behavior.
 fm_is_gate_agent() {
-  local anchor=${1:-.} common
+  local anchor=${1:-.} anchor_real common candidate
   if [ "${FM_GATE_REFUSE_BYPASS:-}" = 1 ]; then
     return 1
   fi
@@ -75,15 +75,23 @@ fm_is_gate_agent() {
     FM_GATE_REFUSE_REASON='env'
     return 0
   fi
-  common=$(cd "$anchor" 2>/dev/null \
-    && cd "$(git rev-parse --git-common-dir 2>/dev/null || echo /nonexistent)" 2>/dev/null \
-    && pwd -P || true)
-  case "$common" in
-    */.no-mistakes/repos/*.git)
-      FM_GATE_REFUSE_REASON='path'
-      FM_GATE_REFUSE_COMMON=$common
-      return 0 ;;
-  esac
+  # Check both the physical absolute FirstMate code root and the process cwd.
+  # Host mode needs the former so changing cwd cannot hide a gate around FM_ROOT;
+  # normal and gate-validation callers retain the latter backstop.
+  anchor_real=$(cd "$anchor" 2>/dev/null && pwd -P || true)
+  for candidate in "$anchor_real" .; do
+    [ -n "$candidate" ] || continue
+    common=$(cd "$candidate" 2>/dev/null \
+      && cd "$(git rev-parse --git-common-dir 2>/dev/null || echo /nonexistent)" 2>/dev/null \
+      && pwd -P || true)
+    case "$common" in
+      */.no-mistakes/repos/*.git)
+        FM_GATE_REFUSE_REASON='path'
+        FM_GATE_REFUSE_COMMON=$common
+        return 0 ;;
+    esac
+    [ "$candidate" = . ] && break
+  done
   return 1
 }
 
diff --git a/bin/fm-host-root-lib.sh b/bin/fm-host-root-lib.sh
new file mode 100644
index 0000000000..d4af99eb28
--- /dev/null
+++ b/bin/fm-host-root-lib.sh
@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# fm-host-root-lib.sh - validation and command rendering for optional host-root mode.
+#
+# FM_HOST_ROOT is opt-in. When unset or empty, every helper preserves the normal
+# FirstMate-root behavior. When set, the value must resolve to an existing
+# physical directory with the cross-harness AGENTS.md instruction surface, must
+# differ from FM_ROOT, and must be safe for line-based task metadata.
+#
+# fm_host_root_enabled
+# fm_host_root_resolve <fm-root>       # prints the physical host root
+# fm_host_root_assert_session_cwd <fm-root>
+# fm_host_root_assert_task_cwd <fm-root> <task-meta>
+# fm_host_root_paths_overlap <physical-host-root> <physical-target-root>
+# fm_host_root_command <fm-root> <repo-relative-command>
+
+fm_host_root_enabled() {
+  [ -n "${FM_HOST_ROOT:-}" ]
+}
+
+fm_host_root_resolve() {
+  local fm_root=${1:-.} host root_real host_real
+  fm_host_root_enabled || return 1
+  host=$FM_HOST_ROOT
+  case "$host" in
+    *[$'\001'-$'\037'$'\177']*)
+      echo "error: FM_HOST_ROOT contains a control character unsafe for task metadata" >&2
+      return 2
+      ;;
+  esac
+  [ -d "$host" ] || {
+    echo "error: FM_HOST_ROOT is not an existing directory: $host" >&2
+    return 2
+  }
+  host_real=$(cd "$host" 2>/dev/null && pwd -P) || {
+    echo "error: FM_HOST_ROOT cannot be resolved: $host" >&2
+    return 2
+  }
+  case "$host_real" in
+    *[$'\001'-$'\037'$'\177']*)
+      echo "error: resolved FM_HOST_ROOT contains a control character unsafe for task metadata" >&2
+      return 2
+      ;;
+  esac
+  root_real=$(cd "$fm_root" 2>/dev/null && pwd -P) || {
+    echo "error: FM_ROOT cannot be resolved while validating FM_HOST_ROOT: $fm_root" >&2
+    return 2
+  }
+  [ "$host_real" != "$root_real" ] || {
+    echo "error: FM_HOST_ROOT must differ from FM_ROOT; unset FM_HOST_ROOT for normal FirstMate-root operation" >&2
+    return 2
+  }
+  if [ ! -f "$host_real/AGENTS.md" ]; then
+    echo "error: FM_HOST_ROOT has no cross-harness instruction surface (expected AGENTS.md): $host_real" >&2
+    return 2
+  fi
+  printf '%s\n' "$host_real"
+}
+
+fm_host_root_assert_session_cwd() {
+  local fm_root=${1:-.} host cwd
+  fm_host_root_enabled || return 0
+  host=$(fm_host_root_resolve "$fm_root") || return $?
+  cwd=$(pwd -P) || return 2
+  [ "$cwd" = "$host" ] || {
+    echo "error: host-root mode requires the supervisor cwd to be $host (current physical cwd: $cwd)" >&2
+    return 2
+  }
+}
+
+fm_host_root_assert_task_cwd() {
+  local fm_root=$1 meta=$2 recorded kind host ambient cwd
+  recorded=$(sed -n 's/^host_root=//p' "$meta" 2>/dev/null | tail -1)
+  kind=$(sed -n 's/^kind=//p' "$meta" 2>/dev/null | tail -1)
+  if [ -z "$recorded" ]; then
+    if [ "$kind" = secondmate ]; then
+      fm_host_root_assert_session_cwd "$fm_root"
+      return $?
+    fi
+    if fm_host_root_enabled; then
+      echo "error: task metadata $meta has no recorded host_root; refusing ambient host-root authority" >&2
+      return 2
+    fi
+    return 0
+  fi
+  host=$(FM_HOST_ROOT=$recorded fm_host_root_resolve "$fm_root") || return $?
+  [ "$host" = "$recorded" ] || {
+    echo "error: task metadata host_root is not the recorded physical path: $recorded" >&2
+    return 2
+  }
+  if fm_host_root_enabled; then
+    ambient=$(fm_host_root_resolve "$fm_root") || return $?
+    [ "$ambient" = "$host" ] || {
+      echo "error: ambient FM_HOST_ROOT $ambient does not match task metadata host_root $host" >&2
+      return 2
+    }
+  fi
+  cwd=$(pwd -P) || return 2
+  [ "$cwd" = "$host" ] || {
+    echo "error: task action requires the recorded host root cwd $host (current physical cwd: $cwd)" >&2
+    return 2
+  }
+}
+
+fm_host_root_paths_overlap() {
+  local host=$1 target=$2
+  case "$target/" in "$host/"*) return 0 ;; esac
+  case "$host/" in "$target/"*) return 0 ;; esac
+  return 1
+}
+
+fm_host_root_shell_quote() {
+  printf "'"
+  printf '%s' "$1" | sed "s/'/'\\\\''/g"
+  printf "'"
+}
+
+fm_host_root_command() {
+  local fm_root=$1 command=$2 root_real
+  if fm_host_root_enabled; then
+    root_real=$(cd "$fm_root" 2>/dev/null && pwd -P) || return 1
+    fm_host_root_shell_quote "$root_real/$command"
+    printf '\n'
+  else
+    printf '%s\n' "$command"
+  fi
+}
diff --git a/bin/fm-kimi-turnend-hook.sh b/bin/fm-kimi-turnend-hook.sh
index 34fee869d3..3fbdba407e 100755
--- a/bin/fm-kimi-turnend-hook.sh
+++ b/bin/fm-kimi-turnend-hook.sh
@@ -8,9 +8,9 @@
 # marked, or otherwise surprising config is refused without a config write.
 #
 # The installed Stop hook always exits 0 and stays silent. It reads cwd from the
-# hook payload, checks for a .fm-kimi-turnend pointer before registry work, and
-# touches a task turn-end marker only when the pointer names a Firstmate-created
-# token in $HOME/.kimi-code/fm-turn-end.d/.
+# hook payload, accepts a launch-scoped FM_KIMI_TURNEND_TOKEN or checks for a
+# .fm-kimi-turnend pointer, and touches a task turn-end marker only when the token
+# names a Firstmate-created entry in $HOME/.kimi-code/fm-turn-end.d/.
 #
 # Usage:
 #   fm-kimi-turnend-hook.sh install
@@ -80,11 +80,14 @@ payload=
 IFS= read -r payload || [ -n "$payload" ] || exit 0
 command -v jq >/dev/null 2>&1 || exit 0
 workspace=$(jq -er 'select(.hook_event_name == "Stop") | .cwd | strings | select(length > 0)' <<< "$payload" 2>/dev/null) || exit 0
-pointer="$workspace/.fm-kimi-turnend"
-[ -f "$pointer" ] || exit 0
-first=
-IFS= read -r -n 256 first < "$pointer" 2>/dev/null || [ -n "$first" ] || exit 0
-case "$first" in token=*) token=${first#token=} ;; *) exit 0 ;; esac
+token=${FM_KIMI_TURNEND_TOKEN:-}
+if [ -z "$token" ]; then
+  pointer="$workspace/.fm-kimi-turnend"
+  [ -f "$pointer" ] || exit 0
+  first=
+  IFS= read -r -n 256 first < "$pointer" 2>/dev/null || [ -n "$first" ] || exit 0
+  case "$first" in token=*) token=${first#token=} ;; *) exit 0 ;; esac
+fi
 case "$token" in fm.????????????) : ;; *) exit 0 ;; esac
 case "$token" in *[!A-Za-z0-9._-]*) exit 0 ;; esac
 auth_dir=${HOME:-}/.kimi-code/fm-turn-end.d
diff --git a/bin/fm-merge-local.sh b/bin/fm-merge-local.sh
index fdc8011488..8edfafc431 100755
--- a/bin/fm-merge-local.sh
+++ b/bin/fm-merge-local.sh
@@ -16,10 +16,14 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
 FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
-"$FM_ROOT/bin/fm-guard.sh" || true
+# shellcheck source=bin/fm-host-root-lib.sh
+. "$SCRIPT_DIR/fm-host-root-lib.sh"
 ID=${1:?usage: fm-merge-local.sh <task-id>}
 META="$STATE/$ID.meta"
 [ -f "$META" ] || { echo "error: no meta for task $ID at $META" >&2; exit 1; }
+fm_host_root_assert_task_cwd "$FM_ROOT" "$META" || exit $?
+# The recorded host binding is established before this guard can repair state.
+"$FM_ROOT/bin/fm-guard.sh" || true
 
 PROJ=$(grep '^project=' "$META" | cut -d= -f2-)
 MODE=$(grep '^mode=' "$META" | cut -d= -f2- || true)
diff --git a/bin/fm-pr-check.sh b/bin/fm-pr-check.sh
index 57858db376..8ce7923ce0 100755
--- a/bin/fm-pr-check.sh
+++ b/bin/fm-pr-check.sh
@@ -5,6 +5,8 @@
 # live only in a private sidecar and are never interpolated into shell source.
 # A GitHub pull request URL and a GitLab merge request URL are both accepted,
 # including a merge request on a self-hosted GitLab instance.
+# Host-root tasks bind to their recorded physical host cwd before guard, metadata,
+# poll, or target-worktree activity.
 # Usage: fm-pr-check.sh <task-id> <pr-url>
 set -eu
 
@@ -15,6 +17,8 @@ STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 
 # shellcheck source=bin/fm-pr-lib.sh
 . "$SCRIPT_DIR/fm-pr-lib.sh"
+# shellcheck source=bin/fm-host-root-lib.sh
+. "$SCRIPT_DIR/fm-host-root-lib.sh"
 
 if [ "$#" -ne 2 ]; then
   echo "error: invalid PR check request" >&2
@@ -38,6 +42,7 @@ if [ ! -f "$META" ] || [ -L "$META" ] || [ "$(fm_pr_file_link_count "$META")" !=
   echo "error: task metadata is unavailable" >&2
   exit 1
 fi
+fm_host_root_assert_task_cwd "$FM_ROOT" "$META" || exit $?
 
 # A prior exact merged result may have queued its durable wake immediately
 # before interruption.
diff --git a/bin/fm-pr-merge.sh b/bin/fm-pr-merge.sh
index 8226798a67..97b4a30d0d 100755
--- a/bin/fm-pr-merge.sh
+++ b/bin/fm-pr-merge.sh
@@ -17,6 +17,8 @@ STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 
 # shellcheck source=bin/fm-pr-lib.sh
 . "$SCRIPT_DIR/fm-pr-lib.sh"
+# shellcheck source=bin/fm-host-root-lib.sh
+. "$SCRIPT_DIR/fm-host-root-lib.sh"
 
 if [ "$#" -lt 2 ]; then
   echo "error: invalid PR merge request" >&2
@@ -69,6 +71,7 @@ if [ ! -f "$META" ] || [ -L "$META" ]; then
   echo "error: task metadata is unavailable" >&2
   exit 1
 fi
+fm_host_root_assert_task_cwd "$FM_ROOT" "$META" || exit $?
 
 "$SCRIPT_DIR/fm-pr-check.sh" "$ID" "$URL"
 grep -qxF "pr=$URL" "$META" || {
diff --git a/bin/fm-promote.sh b/bin/fm-promote.sh
index 827c17998f..5a3cdee466 100755
--- a/bin/fm-promote.sh
+++ b/bin/fm-promote.sh
@@ -6,6 +6,7 @@
 # (inventory scratch state, reset to a clean default-branch base, carry over only
 # intended fix changes, create branch fm/<task-id>, implement, then report done
 # according to the project's delivery mode).
+# Host-root tasks bind to their recorded physical host cwd before guard or metadata mutation.
 # Usage: fm-promote.sh <task-id>
 set -eu
 
@@ -13,10 +14,14 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
 FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
-"$FM_ROOT/bin/fm-guard.sh" || true
+# shellcheck source=bin/fm-host-root-lib.sh
+. "$SCRIPT_DIR/fm-host-root-lib.sh"
 ID=$1
 META="$STATE/$ID.meta"
 [ -f "$META" ] || { echo "error: no meta for task $ID at $META" >&2; exit 1; }
+fm_host_root_assert_task_cwd "$FM_ROOT" "$META" || exit $?
+# The recorded host binding is established before this guard can repair state.
+"$FM_ROOT/bin/fm-guard.sh" || true
 grep -qx 'kind=scout' "$META" || { echo "error: task $ID is not a scout task (kind=scout not in meta)" >&2; exit 1; }
 
 TMP="$META.tmp"
diff --git a/bin/fm-review-diff.sh b/bin/fm-review-diff.sh
index 06e0efb5bd..891efdd501 100755
--- a/bin/fm-review-diff.sh
+++ b/bin/fm-review-diff.sh
@@ -10,6 +10,7 @@
 # only a fallback when fetch fails (stale recorded SHAs must never win over a
 # reachable remote PR head). If neither PR head can be resolved, fall back to
 # the local branch with a warning. Without pr=, compare the local branch.
+# Host-root tasks bind to their recorded physical host cwd before guard or Git activity.
 # Usage: fm-review-diff.sh <task-id> [--stat]
 #   --stat prints only the stat summary; default prints stat summary plus full diff.
 set -eu
@@ -18,7 +19,8 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
 FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
-"$FM_ROOT/bin/fm-guard.sh" || true
+# shellcheck source=bin/fm-host-root-lib.sh
+. "$SCRIPT_DIR/fm-host-root-lib.sh"
 
 usage() {
   echo "usage: fm-review-diff.sh <task-id> [--stat]" >&2
@@ -41,6 +43,9 @@ esac
 
 META="$STATE/$ID.meta"
 [ -f "$META" ] || { echo "error: no meta for task $ID at $META" >&2; exit 1; }
+fm_host_root_assert_task_cwd "$FM_ROOT" "$META" || exit $?
+# The recorded host binding is established before this guard can repair state.
+"$FM_ROOT/bin/fm-guard.sh" || true
 
 WT=$(grep '^worktree=' "$META" | cut -d= -f2-)
 PROJ=$(grep '^project=' "$META" | cut -d= -f2-)
diff --git a/bin/fm-send.sh b/bin/fm-send.sh
index dfae6f49e6..ca10b7a2d7 100755
--- a/bin/fm-send.sh
+++ b/bin/fm-send.sh
@@ -18,6 +18,9 @@
 # Submission dispatches through the target's recorded backend; the tmux adapter
 # shares its composer/submit core with the away-mode daemon via bin/fm-tmux-lib.sh.
 # Tune with FM_SEND_RETRIES (default 3) / FM_SEND_SLEEP (0.4).
+# A recorded task binds to its physical host_root= metadata before task-data
+# reads, supervision repair, or endpoint mutation; ambient host authority cannot
+# override that ownership.
 # Slash commands, and codex `$...` skill invocations resolved through harness
 # meta, get a longer pre-Enter settle so completion popups do not swallow Enter.
 #
@@ -50,9 +53,11 @@ FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
 
 # shellcheck source=bin/fm-gate-refuse-lib.sh
 . "$SCRIPT_DIR/fm-gate-refuse-lib.sh"
+# shellcheck source=bin/fm-host-root-lib.sh
+. "$SCRIPT_DIR/fm-host-root-lib.sh"
 # Fail closed before any fleet mutation: a no-mistakes gate agent must never steer
 # a crewmate (see bin/fm-gate-refuse-lib.sh).
-fm_refuse_if_gate_agent
+fm_refuse_if_gate_agent "$FM_ROOT"
 
 if [ -z "${FM_HOME+x}" ] || [ -z "${FM_HOME:-}" ]; then
   echo "error: FM_HOME is not set; fm-send refuses to resolve targets without an explicit firstmate home" >&2
@@ -76,8 +81,6 @@ fi
 # shellcheck source=bin/fm-pending-reply-lib.sh
 . "$SCRIPT_DIR/fm-pending-reply-lib.sh"
 
-FM_GUARD_CONTINUE_LINE='This is a supervision warning only; the requested message WILL still be sent.' "$SCRIPT_DIR/fm-guard.sh" || true
-
 fm_send_id_from_meta() {  # <meta-file>
   local base
   base=${1##*/}
@@ -115,6 +118,10 @@ fm_send_resolve_target() {  # <raw-target>
 
   meta=$(fm_backend_meta_for_selector "$raw" "$STATE" 2>/dev/null || true)
   if [ -n "$meta" ]; then
+    if [ "$meta" != "${BOUND_META:-}" ]; then
+      fm_host_root_assert_task_cwd "$FM_ROOT" "$meta" || return $?
+      BOUND_META=$meta
+    fi
     RESOLUTION_TRIED="meta=$meta; backend=from-meta"
     target=$(fm_backend_target_of_meta "$meta")
     if [ -z "$target" ]; then
@@ -141,6 +148,10 @@ fm_send_resolve_target() {  # <raw-target>
 
   pane_meta=$(fm_send_meta_for_key_value "$STATE" herdr_pane_id "$raw" 2>/dev/null || true)
   if [ -n "$pane_meta" ]; then
+    if [ "$pane_meta" != "${BOUND_META:-}" ]; then
+      fm_host_root_assert_task_cwd "$FM_ROOT" "$pane_meta" || return $?
+      BOUND_META=$pane_meta
+    fi
     session=$(fm_meta_get "$pane_meta" herdr_session)
     hint="${session:-<herdr-session>}:$raw"
     id=$(fm_send_id_from_meta "$pane_meta")
@@ -150,6 +161,10 @@ fm_send_resolve_target() {  # <raw-target>
 
   meta=$(fm_backend_meta_for_window "$raw" "$STATE" 2>/dev/null || true)
   if [ -n "$meta" ]; then
+    if [ "$meta" != "${BOUND_META:-}" ]; then
+      fm_host_root_assert_task_cwd "$FM_ROOT" "$meta" || return $?
+      BOUND_META=$meta
+    fi
     target=$(fm_backend_target_of_meta "$meta")
     if [ -z "$target" ]; then
       echo "error: no backend target recorded in $meta (tried explicit target '$raw' via recorded window/terminal; backend=from-meta)" >&2
@@ -187,10 +202,26 @@ fm_send_resolve_target() {  # <raw-target>
 }
 
 RAW_TARGET=$1
+CANDIDATE_META=
+BOUND_META=
+if [ -f "$STATE/$RAW_TARGET.meta" ]; then
+  CANDIDATE_META="$STATE/$RAW_TARGET.meta"
+elif [ "${RAW_TARGET#fm-}" != "$RAW_TARGET" ] && [ -f "$STATE/${RAW_TARGET#fm-}.meta" ]; then
+  CANDIDATE_META="$STATE/${RAW_TARGET#fm-}.meta"
+fi
+if [ -n "$CANDIDATE_META" ]; then
+  fm_host_root_assert_task_cwd "$FM_ROOT" "$CANDIDATE_META" || exit $?
+  BOUND_META=$CANDIDATE_META
+fi
 fm_send_resolve_target "$RAW_TARGET" || exit 1
+if [ -z "$TARGET_META" ]; then
+  fm_host_root_assert_session_cwd "$FM_ROOT" || exit $?
+fi
 T=$RESOLVED_TARGET
 shift
 
+# The recorded host binding is established before this guard can repair state.
+FM_GUARD_CONTINUE_LINE='This is a supervision warning only; the requested message WILL still be sent.' "$SCRIPT_DIR/fm-guard.sh" || true
 fm_backend_validate "$TARGET_BACKEND" || exit 1
 
 # Classify a from-firstmate -> secondmate request. Only a task selector resolved
diff --git a/bin/fm-session-start.sh b/bin/fm-session-start.sh
index 1abbace4bf..be26c31073 100755
--- a/bin/fm-session-start.sh
+++ b/bin/fm-session-start.sh
@@ -85,10 +85,11 @@
 # truly needed.
 #
 # Usage: fm-session-start.sh
-#   Prints the full ordered digest to stdout and always exits 0: this is a
-#   reporting command, not a gate. A lock refusal is reported as a loud
-#   banner inline, never a silent failure or a non-zero exit that would make
-#   an agent skip the rest of the digest.
+#   Prints the full ordered digest to stdout and normally exits 0: this is a
+#   reporting command, not a gate. Explicit host-root mode is the one preflight
+#   exception and exits 2 before mutation when its physical cwd contract fails.
+#   A lock refusal is reported as a loud banner inline, never a silent failure
+#   or a non-zero exit that would make an agent skip the rest of the digest.
 set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -97,6 +98,10 @@ FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 DATA="${FM_DATA_OVERRIDE:-$FM_HOME/data}"
 CONFIG="${FM_CONFIG_OVERRIDE:-$FM_HOME/config}"
+# shellcheck source=bin/fm-host-root-lib.sh
+. "$SCRIPT_DIR/fm-host-root-lib.sh"
+# Host mode must be validated before lock acquisition or any bootstrap mutation.
+fm_host_root_assert_session_cwd "$FM_ROOT" || exit $?
 PRIMARY_HARNESS=$("$SCRIPT_DIR/fm-harness.sh" 2>/dev/null || printf unknown)
 
 # shellcheck source=bin/fm-backend.sh
diff --git a/bin/fm-sessionstart-nudge.sh b/bin/fm-sessionstart-nudge.sh
index fccf775dd9..eabbaae545 100755
--- a/bin/fm-sessionstart-nudge.sh
+++ b/bin/fm-sessionstart-nudge.sh
@@ -16,9 +16,14 @@ STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 . "$SCRIPT_DIR/fm-primary-scope-lib.sh"
 # shellcheck source=bin/fm-operational-input.sh
 . "$SCRIPT_DIR/fm-operational-input.sh"
+# shellcheck source=bin/fm-host-root-lib.sh
+. "$SCRIPT_DIR/fm-host-root-lib.sh"
 
 fm_is_gate_agent "$FM_ROOT" && exit 0
 fm_primary_scope_matches "$FM_ROOT" "$STATE" || exit 0
+if fm_host_root_enabled; then
+  fm_host_root_assert_session_cwd "$FM_ROOT" >/dev/null 2>&1 || exit 0
+fi
 
 lock_is_in_ancestry() {
   local lock_pid pid=$$ _
@@ -37,9 +42,10 @@ lock_is_in_ancestry() {
 }
 
 lock_is_in_ancestry && exit 0
+SESSION_START=$(fm_host_root_command "$FM_ROOT" bin/fm-session-start.sh)
 nudge=
 fm_operational_input_encode session-start \
-  "Run \`bin/fm-session-start.sh\` now, exactly once, before executing any other instructions." \
+  "Run \`$SESSION_START\` now, exactly once, before executing any other instructions." \
   nudge || exit 0
 printf '%s\n' "$nudge"
 exit 0
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 3526572550..db94af5cb4 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -64,6 +64,8 @@
 #   whitespace is treated as a RAW launch command - the escape hatch for verifying
 #   new adapters. pi-signed launches that exact executable name from PATH and
 #   refuses before endpoint creation when it is unavailable; it never falls back to pi.
+#   Host-root ordinary tasks reject that escape hatch because only a
+#   named verified adapter can preserve the required task completion safeguard.
 #   config/secondmate-harness may also carry an optional model and effort as extra
 #   whitespace-separated tokens ("<harness> [<model>] [<effort>]"). For a
 #   --secondmate spawn, those tokens apply only when this spawn also resolves its
@@ -84,7 +86,13 @@
 #   Before a secondmate launch, the home is locally fast-forwarded to the primary
 #   default-branch commit when safe; skipped syncs warn and launch unchanged.
 #   Ship/scout spawns refuse to launch unless the resolved task path is a real
-#   git worktree root distinct from the primary project checkout.
+#   git worktree root distinct from the primary project checkout. With optional
+#   FM_HOST_ROOT set, validation happens before the guard or endpoint mutation;
+#   the endpoint then returns to that physical host cwd and the child receives
+#   the isolated target as FM_TARGET_WORKTREE. Failed spawns before launch submission
+#   stop and verify the endpoint before returning the isolated copy, remove task-owned
+#   pre-record artifacts on success, and retain recovery metadata when rollback is
+#   incomplete. An ambiguous final Enter retains the endpoint, worktree, and metadata.
 # Batch dispatch: pass one or more `id=repo` pairs instead of a single <id> <project>, e.g.
 #     fm-spawn.sh fix-a-k3=projects/foo add-b-q7=projects/bar [--scout]
 #   Each pair re-execs this script in single-task mode, so the single path stays the only
@@ -102,6 +110,11 @@
 #     __PITURNEND__ absolute path to .pi/extensions/fm-primary-turnend-guard.ts in a pi secondmate home
 #     __PIWATCH__   absolute path to .pi/extensions/fm-primary-pi-watch.ts in a pi secondmate home
 #     __OPINPUT__   absolute path to the canonical operational-input encoder
+#     __CLAUDESETTINGS__ state-owned host-mode Claude task settings path
+#     __CODEXNOTIFY__ shell-quoted complete Codex notify configuration
+#     __OPENCODECONFIG__ shell-quoted host-mode OpenCode config with one task plugin
+#     __GROKTOKEN__ host-mode Grok per-process task hook token
+#     __KIMITOKEN__ host-mode Kimi per-process task hook token
 # Verified per-harness turn-end hooks are installed automatically where enabled; some live outside the worktree.
 # Kimi uses one surgically installed Firstmate region in $HOME/.kimi-code/config.toml,
 # a firstmate-owned global hook and registry, and a gitignored per-task pointer.
@@ -111,6 +124,8 @@
 # mode/yolo are resolved per-project from data/projects.md for ship/scout tasks;
 # secondmate spawns record mode=secondmate, yolo=off, home=, and projects=.
 set -eu
+# Paths, flags, and tokens are literal replacement data; never expand '&' as a matched placeholder.
+shopt -u patsub_replacement 2>/dev/null || true
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
@@ -149,6 +164,8 @@ DATA="${FM_DATA_OVERRIDE:-$FM_HOME/data}"
 PROJECTS="${FM_PROJECTS_OVERRIDE:-$FM_HOME/projects}"
 CONFIG="${FM_CONFIG_OVERRIDE:-$FM_HOME/config}"
 SUB_HOME_MARKER=".fm-secondmate-home"
+# shellcheck source=bin/fm-host-root-lib.sh
+. "$SCRIPT_DIR/fm-host-root-lib.sh"
 # shellcheck source=bin/fm-ff-lib.sh
 . "$SCRIPT_DIR/fm-ff-lib.sh"
 # shellcheck source=bin/fm-wake-lib.sh
@@ -161,12 +178,6 @@ SUB_HOME_MARKER=".fm-secondmate-home"
 . "$SCRIPT_DIR/fm-gate-refuse-lib.sh"
 # shellcheck source=bin/fm-pr-lib.sh
 . "$SCRIPT_DIR/fm-pr-lib.sh"
-# Fail closed before any fleet mutation: a no-mistakes gate agent must never spawn
-# a direct report (see bin/fm-gate-refuse-lib.sh).
-fm_refuse_if_gate_agent
-# Skip the watcher guard when re-exec'd for one pair of a batch (FM_SPAWN_NO_GUARD is
-# set by the batch loop below), so the guard runs once for the batch, not once per pair.
-[ -n "${FM_SPAWN_NO_GUARD:-}" ] || "$FM_ROOT/bin/fm-guard.sh" || true
 KIND=ship
 HARNESS_ARG=
 MODEL=
@@ -217,6 +228,24 @@ case "$EFFORT" in
   *) echo "error: --effort must be one of low, medium, high, xhigh, max" >&2; exit 1 ;;
 esac
 
+HOST_MODE=0
+HOST_ROOT=
+if fm_host_root_enabled; then
+  fm_host_root_assert_session_cwd "$FM_ROOT" || exit $?
+  if [ "$KIND" != secondmate ]; then
+    HOST_ROOT=$(fm_host_root_resolve "$FM_ROOT") || exit $?
+    HOST_MODE=1
+  fi
+fi
+
+# Fail closed before any fleet mutation: a no-mistakes gate agent must never spawn
+# a direct report (see bin/fm-gate-refuse-lib.sh). Anchor to FM_ROOT because host
+# mode deliberately runs from a different repository.
+fm_refuse_if_gate_agent "$FM_ROOT"
+# Host-root validation above must precede the watcher guard because the guard may
+# repair supervision state. Batch re-execs skip it so the guard runs once per batch.
+[ -n "${FM_SPAWN_NO_GUARD:-}" ] || "$FM_ROOT/bin/fm-guard.sh" || true
+
 # Backend selection (data/fm-backend-design-d7): explicit --backend, else
 # FM_BACKEND env, else config/backend, else runtime auto-detection, else
 # default tmux (fm_backend_name). fm_backend_validate_spawn refuses unknown or
@@ -242,7 +271,18 @@ fi
 if [ "$BACKEND" = orca ]; then
   fm_backend_orca_runtime_check || exit 1
 fi
+SPAWN_ABORT_CLEANUP=0
+SPAWN_ENDPOINT_CREATED=0
+SPAWN_PRESERVE_WORKTREE=0
 ORCA_ABORT_CLEANUP=0
+SPAWN_CREATE_OUT=
+HERDR_SES=
+HERDR_WORKSPACE_ID=
+HERDR_TAB_ID=
+HERDR_PANE_ID=
+ZELLIJ_SES=
+ZELLIJ_TAB_ID=
+ZELLIJ_PANE_ID=
 ORCA_WORKTREE_ID=
 ORCA_TERMINAL=
 HERDR_PROJECTION_ABORT_CLEANUP=0
@@ -255,6 +295,8 @@ SPAWN_TASK_LOCK=
 SPAWN_TASK_LOCK_HELD=0
 CONFIG_INHERIT_LOCK=
 CONFIG_INHERIT_LOCK_HELD=0
+CMUX_WORKSPACE_ID=
+CMUX_SURFACE_ID=
 
 parse_orca_worktree_result() {
   local raw=$1 rest
@@ -273,54 +315,143 @@ parse_orca_worktree_result() {
   fi
 }
 
+# One bounded lock per live Herdr session/socket, shared across all homes.
+# <session> is required so secondmate and primary spawns serialize against the
+# same session without writing any other home's state directory.
+spawn_herdr_presentation_order_lock_acquire() {
+  local session=${1:-} attempt lock_path
+  [ -n "$session" ] || session=$(fm_backend_herdr_session)
+  lock_path=$(fm_backend_herdr_presentation_session_lock_path "$session") || return 1
+  HERDR_PRESENTATION_ORDER_LOCK="$lock_path"
+  attempt=0
+  while [ "$attempt" -lt 50 ]; do
+    if fm_lock_try_acquire "$HERDR_PRESENTATION_ORDER_LOCK"; then
+      HERDR_PRESENTATION_ORDER_LOCK_HELD=1
+      return 0
+    fi
+    sleep 0.1
+    attempt=$((attempt + 1))
+  done
+  return 1
+}
+
+spawn_herdr_presentation_order_lock_release() {
+  [ "$HERDR_PRESENTATION_ORDER_LOCK_HELD" = 1 ] || return 0
+  HERDR_PRESENTATION_ORDER_LOCK_HELD=0
+  fm_lock_release "$HERDR_PRESENTATION_ORDER_LOCK" || true
+}
+write_abort_meta() {
+  mkdir -p "$STATE" 2>/dev/null || return 0
+  {
+    echo "window=${T:-${W:-fm-$ID}}"
+    echo "worktree=${WT:-}"
+    [ "${HOST_MODE:-0}" -eq 0 ] || echo "host_root=$HOST_ROOT"
+    echo "project=${PROJ_ABS:-}"
+    echo "harness=${HARNESS:-unknown}"
+    echo "kind=$KIND"
+    echo "mode=${MODE:-no-mistakes}"
+    echo "yolo=${YOLO:-off}"
+    echo "tasktmp=${TASK_TMP:-}"
+    echo "model=${MODEL:-default}"
+    echo "effort=${EFFORT:-default}"
+    [ "$BACKEND" = tmux ] || echo "backend=$BACKEND"
+    [ -z "${HERDR_SES:-}" ] || echo "herdr_session=$HERDR_SES"
+    [ -z "${HERDR_WORKSPACE_ID:-}" ] || echo "herdr_workspace_id=$HERDR_WORKSPACE_ID"
+    [ -z "${HERDR_TAB_ID:-}" ] || echo "herdr_tab_id=$HERDR_TAB_ID"
+    [ -z "${HERDR_PANE_ID:-}" ] || echo "herdr_pane_id=$HERDR_PANE_ID"
+    [ -z "${ZELLIJ_SES:-}" ] || echo "zellij_session=$ZELLIJ_SES"
+    [ -z "${ZELLIJ_TAB_ID:-}" ] || echo "zellij_tab_id=$ZELLIJ_TAB_ID"
+    [ -z "${ZELLIJ_PANE_ID:-}" ] || echo "zellij_pane_id=$ZELLIJ_PANE_ID"
+    [ -z "${ORCA_WORKTREE_ID:-}" ] || echo "orca_worktree_id=$ORCA_WORKTREE_ID"
+    [ -z "${ORCA_TERMINAL:-}" ] || echo "terminal=$ORCA_TERMINAL"
+    [ -z "${CMUX_WORKSPACE_ID:-}" ] || echo "cmux_workspace_id=$CMUX_WORKSPACE_ID"
+    [ -z "${CMUX_SURFACE_ID:-}" ] || echo "cmux_surface_id=$CMUX_SURFACE_ID"
+  } > "$STATE/$ID.meta" 2>/dev/null || true
+}
+
+remove_spawn_artifacts() {
+  [ -z "${auth_file:-}" ] || rm -f -- "$auth_file"
+  [ -z "${SPAWN_CREATE_OUT:-}" ] || rm -f -- "$SPAWN_CREATE_OUT"
+  if [ "$KIND" != secondmate ] && [ -n "${WT:-}" ] && [ -d "${WT:-}" ]; then
+    rm -f -- "$WT/.claude/settings.local.json" "$WT/.opencode/plugins/fm-turn-end.js" \
+      "$WT/.fm-grok-turnend" "$WT/.fm-kimi-turnend"
+  fi
+  rm -f -- "$STATE/$ID.status" "$STATE/$ID.turn-ended" "$STATE/$ID.meta" \
+    "$STATE/$ID.pi-ext.ts" "$STATE/$ID.grok-turnend-token" "$STATE/$ID.kimi-turnend-token" \
+    "$STATE/$ID.claude-settings.json" "$STATE/$ID.opencode-turn-end.js"
+  [ -z "${TASK_TMP:-}" ] || rm -rf -- "$TASK_TMP"
+}
+
 spawn_abort_cleanup() {
-  local status=$?
-  if [ "$HERDR_PROJECTION_ABORT_CLEANUP" = 1 ] \
-     && [ "$HERDR_PRESENTATION_ORDER_LOCK_HELD" != 1 ]; then
-    if ! spawn_herdr_presentation_order_lock_acquire "${HERDR_PROJECTION_ABORT_SESSION:-}"; then
-      echo "warning: herdr presentation focus lock unavailable; retaining the projection journal and refusing concurrent abort cleanup" >&2
-      HERDR_PROJECTION_ABORT_CLEANUP=0
+  local status=$? cleanup_failed=0 endpoint_stopped=1
+  if [ "$ORCA_ABORT_CLEANUP" != 1 ] \
+     && [ "$SPAWN_ABORT_CLEANUP" != 1 ] \
+     && [ "$HERDR_PROJECTION_ABORT_CLEANUP" != 1 ]; then
+    spawn_herdr_presentation_order_lock_release
+    if [ "$SPAWN_TASK_LOCK_HELD" = 1 ]; then
+      SPAWN_TASK_LOCK_HELD=0
+      fm_lock_release "$SPAWN_TASK_LOCK" || true
+    fi
+    if [ "$CONFIG_INHERIT_LOCK_HELD" = 1 ]; then
+      CONFIG_INHERIT_LOCK_HELD=0
+      fm_lock_release "$CONFIG_INHERIT_LOCK" || true
     fi
+    return "$status"
   fi
-  if [ "$HERDR_PROJECTION_ABORT_CLEANUP" = 1 ]; then
+  if [ "$HERDR_PROJECTION_ABORT_CLEANUP" = 1 ] \
+     && [ "$HERDR_PRESENTATION_ORDER_LOCK_HELD" != 1 ] \
+     && ! spawn_herdr_presentation_order_lock_acquire "${HERDR_PROJECTION_ABORT_SESSION:-}"; then
+    echo "warning: herdr presentation focus lock unavailable; retaining the projection journal and refusing concurrent abort cleanup" >&2
+    cleanup_failed=1
+  fi
+  if [ "$HERDR_PROJECTION_ABORT_CLEANUP" = 1 ] \
+     && [ "$HERDR_PRESENTATION_ORDER_LOCK_HELD" = 1 ]; then
     HERDR_PROJECTION_ABORT_CLEANUP=0
     fm_backend_herdr_projection_cleanup_exact \
       "$HERDR_PROJECTION_ABORT_SESSION" \
       "$HERDR_PROJECTION_ABORT_TASK_PANE" \
-      "$HERDR_PROJECTION_ABORT_SEEDED_PANE" || true
-  fi
-  if [ "$HERDR_PRESENTATION_ORDER_LOCK_HELD" = 1 ]; then
-    HERDR_PRESENTATION_ORDER_LOCK_HELD=0
-    fm_lock_release "$HERDR_PRESENTATION_ORDER_LOCK" || true
+      "$HERDR_PROJECTION_ABORT_SEEDED_PANE" || cleanup_failed=1
   fi
   if [ "$ORCA_ABORT_CLEANUP" = 1 ]; then
     ORCA_ABORT_CLEANUP=0
-    if [ -n "${ORCA_TERMINAL:-}" ]; then
-      fm_backend_kill orca "$ORCA_TERMINAL" 2>/dev/null || true
+    if [ -n "${ORCA_TERMINAL:-}" ] && ! fm_backend_stop_and_verify orca "$ORCA_TERMINAL"; then
+      cleanup_failed=1
+      endpoint_stopped=0
     fi
-    if [ -n "${ORCA_WORKTREE_ID:-}" ]; then
-      if ! fm_backend_remove_worktree orca "$ORCA_WORKTREE_ID" 2>/dev/null; then
-        mkdir -p "$STATE" 2>/dev/null || true
-        if [ -d "$STATE" ]; then
-          {
-            echo "window=$W"
-            echo "worktree=${WT:-}"
-            echo "project=$PROJ_ABS"
-            echo "harness=$HARNESS"
-            echo "kind=$KIND"
-            echo "mode=${MODE:-no-mistakes}"
-            echo "yolo=${YOLO:-off}"
-            echo "tasktmp=${TASK_TMP:-}"
-            echo "model=${MODEL:-default}"
-            echo "effort=${EFFORT:-default}"
-            echo "backend=orca"
-            echo "orca_worktree_id=$ORCA_WORKTREE_ID"
-            [ -z "${ORCA_TERMINAL:-}" ] || echo "terminal=$ORCA_TERMINAL"
-          } > "$STATE/$ID.meta" 2>/dev/null || true
-        fi
+    if [ "$endpoint_stopped" -eq 1 ] && [ -n "${ORCA_WORKTREE_ID:-}" ]; then
+      if [ "$SPAWN_PRESERVE_WORKTREE" = 1 ]; then
+        cleanup_failed=1
+      else
+        fm_backend_remove_worktree orca "$ORCA_WORKTREE_ID" 2>/dev/null || cleanup_failed=1
       fi
     fi
+  elif [ "$SPAWN_ABORT_CLEANUP" = 1 ]; then
+    SPAWN_ABORT_CLEANUP=0
+    if [ "$SPAWN_ENDPOINT_CREATED" = 1 ] && [ -z "${T:-}" ]; then
+      # The adapter confirmed creation but could not recover an addressable
+      # endpoint id. Preserve partial ids/labels for manual recovery; never
+      # recycle a worktree while endpoint absence is unknown.
+      cleanup_failed=1
+      endpoint_stopped=0
+    elif [ -n "${T:-}" ] && ! fm_backend_stop_and_verify "$BACKEND" "$T" "${ZELLIJ_TAB_ID:-}" "${W:-fm-$ID}"; then
+      cleanup_failed=1
+      endpoint_stopped=0
+    fi
+    if [ "$endpoint_stopped" -eq 1 ] && [ "$KIND" != secondmate ] && [ -n "${WT:-}" ] && [ -d "${WT:-}" ]; then
+      if [ "$SPAWN_PRESERVE_WORKTREE" = 1 ]; then
+        cleanup_failed=1
+      else
+        (cd "$PROJ_ABS" && treehouse return --force "$WT") >/dev/null 2>&1 || cleanup_failed=1
+      fi
+    fi
+  fi
+  if [ "$cleanup_failed" -ne 0 ]; then
+    write_abort_meta
+    echo "error: spawn cleanup was incomplete; recoverable task metadata remains at $STATE/$ID.meta" >&2
+  else
+    remove_spawn_artifacts
   fi
+  spawn_herdr_presentation_order_lock_release
   if [ "$SPAWN_TASK_LOCK_HELD" = 1 ]; then
     SPAWN_TASK_LOCK_HELD=0
     fm_lock_release "$SPAWN_TASK_LOCK" || true
@@ -333,30 +464,19 @@ spawn_abort_cleanup() {
 }
 trap spawn_abort_cleanup EXIT
 
-# One bounded lock per live Herdr session/socket, shared across all homes.
-# <session> is required so secondmate and primary spawns serialize against the
-# same session without writing any other home's state directory.
-spawn_herdr_presentation_order_lock_acquire() {
-  local session=${1:-} attempt lock_path
-  [ -n "$session" ] || session=$(fm_backend_herdr_session)
-  lock_path=$(fm_backend_herdr_presentation_session_lock_path "$session") || return 1
-  HERDR_PRESENTATION_ORDER_LOCK="$lock_path"
-  attempt=0
-  while [ "$attempt" -lt 50 ]; do
-    if fm_lock_try_acquire "$HERDR_PRESENTATION_ORDER_LOCK"; then
-      HERDR_PRESENTATION_ORDER_LOCK_HELD=1
-      return 0
-    fi
-    sleep 0.1
-    attempt=$((attempt + 1))
-  done
-  return 1
-}
-
-spawn_herdr_presentation_order_lock_release() {
-  [ "$HERDR_PRESENTATION_ORDER_LOCK_HELD" = 1 ] || return 0
-  HERDR_PRESENTATION_ORDER_LOCK_HELD=0
-  fm_lock_release "$HERDR_PRESENTATION_ORDER_LOCK" || true
+capture_backend_create() {  # <output-var> <adapter-function> [args...]
+  local output_var=$1 status
+  shift
+  SPAWN_CREATE_OUT=$(mktemp "${TMPDIR:-/tmp}/fm-spawn-create.XXXXXX") || return 1
+  if "$@" > "$SPAWN_CREATE_OUT"; then
+    status=0
+  else
+    status=$?
+  fi
+  printf -v "$output_var" '%s' "$(cat "$SPAWN_CREATE_OUT")"
+  rm -f -- "$SPAWN_CREATE_OUT"
+  SPAWN_CREATE_OUT=
+  return "$status"
 }
 
 # Batch dispatch (see header): when the first positional is an `id=repo` pair, treat every
@@ -446,15 +566,27 @@ launch_template() {
     # does NOT suppress the interactive ghost text (verified empirically), so the env
     # var is the correct control. The dim-aware composer reader in fm-tmux-lib.sh is
     # the defense-in-depth backstop for any pane this flag cannot reach.
-    claude) printf '%s' 'CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false claude --dangerously-skip-permissions __MODELFLAG____EFFORTFLAG__"$(__OPINPUT__ encode launch-brief < __BRIEF__)"' ;;
+    claude)
+      if [ "$HOST_MODE" -eq 1 ] && [ "$kind" != secondmate ]; then
+        printf '%s' 'CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false claude --settings __CLAUDESETTINGS__ --dangerously-skip-permissions __MODELFLAG____EFFORTFLAG__"$(__OPINPUT__ encode launch-brief < __BRIEF__)"'
+      else
+        printf '%s' 'CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false claude --dangerously-skip-permissions __MODELFLAG____EFFORTFLAG__"$(__OPINPUT__ encode launch-brief < __BRIEF__)"'
+      fi
+      ;;
     codex)
       if [ "$kind" = secondmate ]; then
         printf '%s' 'codex __MODELFLAG____EFFORTFLAG__--dangerously-bypass-approvals-and-sandbox "$(__OPINPUT__ encode launch-brief < __BRIEF__)"'
       else
-        printf '%s' 'codex __MODELFLAG____EFFORTFLAG__--dangerously-bypass-approvals-and-sandbox -c "notify=[\"bash\",\"-c\",\"touch __TURNEND__\"]" "$(__OPINPUT__ encode launch-brief < __BRIEF__)"'
+        printf '%s' 'codex __MODELFLAG____EFFORTFLAG__--dangerously-bypass-approvals-and-sandbox -c __CODEXNOTIFY__ "$(__OPINPUT__ encode launch-brief < __BRIEF__)"'
+      fi
+      ;;
+    opencode)
+      if [ "$HOST_MODE" -eq 1 ] && [ "$kind" != secondmate ]; then
+        printf '%s' 'OPENCODE_CONFIG_CONTENT=__OPENCODECONFIG__ opencode __MODELFLAG__--prompt "$(__OPINPUT__ encode launch-brief < __BRIEF__)"'
+      else
+        printf '%s' 'OPENCODE_CONFIG_CONTENT='\''{"permission":{"*":"allow"}}'\'' opencode __MODELFLAG__--prompt "$(__OPINPUT__ encode launch-brief < __BRIEF__)"'
       fi
       ;;
-    opencode) printf '%s' 'OPENCODE_CONFIG_CONTENT='\''{"permission":{"*":"allow"}}'\'' opencode __MODELFLAG__--prompt "$(__OPINPUT__ encode launch-brief < __BRIEF__)"' ;;
     pi|pi-signed)
       if [ "$kind" = secondmate ]; then
         printf '%s%s' "$harness" ' __MODELFLAG____EFFORTFLAG__-e __PITURNEND__ -e __PIWATCH__ "$(__OPINPUT__ encode launch-brief < __BRIEF__)"'
@@ -469,18 +601,32 @@ launch_template() {
     # --dangerously-skip-permissions. grok's turn-end signal does NOT ride the
     # launch command - it is a Stop-event hook installed below (global hook +
     # per-task pointer), so the template is identical for ship/scout/secondmate.
-    grok) printf '%s' 'grok --always-approve __MODELFLAG____EFFORTFLAG__"$(__OPINPUT__ encode launch-brief < __BRIEF__)"' ;;
+    grok)
+      if [ "$HOST_MODE" -eq 1 ] && [ "$kind" != secondmate ]; then
+        printf '%s' 'FM_GROK_TURNEND_TOKEN=__GROKTOKEN__ grok --always-approve __MODELFLAG____EFFORTFLAG__"$(__OPINPUT__ encode launch-brief < __BRIEF__)"'
+      else
+        printf '%s' 'grok --always-approve __MODELFLAG____EFFORTFLAG__"$(__OPINPUT__ encode launch-brief < __BRIEF__)"'
+      fi
+      ;;
     # Kimi Code rejects a positional prompt, so it launches bare and receives
     # only an absolute brief pointer after the TUI readiness gate below.
-    # Its turn-end signal is a globally configured Stop hook plus a guarded
-    # per-task worktree token, so no launch placeholder belongs here.
-    kimi) printf '%s' '__KIMIBIN__ __MODELFLAG__--auto' ;;
+    kimi)
+      if [ "$HOST_MODE" -eq 1 ] && [ "$kind" != secondmate ]; then
+        printf '%s' 'FM_KIMI_TURNEND_TOKEN=__KIMITOKEN__ __KIMIBIN__ __MODELFLAG__--auto'
+      else
+        printf '%s' '__KIMIBIN__ __MODELFLAG__--auto'
+      fi
+      ;;
     *) return 1 ;;
   esac
 }
 
 case "$ARG3" in
   *' '*)  # raw launch command (unverified-adapter escape hatch)
+    if [ "$HOST_MODE" -eq 1 ]; then
+      echo "error: host-root mode requires a named verified harness so its task completion safeguard cannot be bypassed" >&2
+      exit 2
+    fi
     LAUNCH=$ARG3
     HARNESS=""
     for word in $LAUNCH; do
@@ -835,6 +981,10 @@ fi
 [ -f "$BRIEF" ] || { echo "error: no brief at $BRIEF" >&2; exit 1; }
 BRIEF_DIR_REAL=$(cd "$(dirname "$BRIEF")" && pwd -P)
 BRIEF_REAL="$BRIEF_DIR_REAL/$(basename "$BRIEF")"
+if [ "$HOST_MODE" -eq 1 ] && ! grep -qxF '<!-- firstmate-execution-mode: host-root -->' "$BRIEF"; then
+  echo "error: host-root mode requires a host-root brief; regenerate $BRIEF with FM_HOST_ROOT set" >&2
+  exit 1
+fi
 
 # PROJ_ABS can still carry a symlinked path component (e.g. macOS's /tmp ->
 # /private/tmp) when it came from the ship/scout branch's logical `pwd` above.
@@ -865,6 +1015,15 @@ real_path_or_raw() {  # <path>
 # herdr-sm-spaces-k4). Both branches converge on the same $T ("target") string
 # that every downstream operation (send/capture/kill) already treats as opaque
 # per-backend routing (fm_backend_resolve_selector).
+spawn_path_is_isolated_worktree() {  # <candidate-path>
+  local candidate=$1 candidate_real top top_real
+  [ -n "$candidate" ] || return 1
+  candidate_real=$(cd "$candidate" 2>/dev/null && pwd -P) || return 1
+  top=$(git -C "$candidate" rev-parse --show-toplevel 2>/dev/null || true)
+  top_real=$(cd "$top" 2>/dev/null && pwd -P) || return 1
+  [ "$candidate_real" = "$top_real" ] && [ "$candidate_real" != "$PROJ_ABS_REAL" ]
+}
+
 validate_spawn_worktree() {  # <source> <inspect-target>
   local source=$1 inspect_target=$2 wt_real proj_real wt_top wt_top_real
   wt_real=
@@ -881,6 +1040,32 @@ validate_spawn_worktree() {  # <source> <inspect-target>
     echo "error: $source did not yield an isolated worktree (resolved '$WT'; worktree root '${wt_top:-none}'; primary '$PROJ_ABS'); refusing to launch to avoid tangling the primary checkout. Inspect target $inspect_target" >&2
     exit 1
   fi
+  if [ "$HOST_MODE" -eq 1 ] && fm_host_root_paths_overlap "$HOST_ROOT" "$wt_real"; then
+    SPAWN_PRESERVE_WORKTREE=1
+    echo "error: $source resolved overlapping host and target roots (host '$HOST_ROOT'; target '$wt_real'); stopping the endpoint but preserving the path for manual recovery" >&2
+    exit 1
+  fi
+}
+
+arm_created_endpoint_rollback() {
+  [ "${FM_BACKEND_CREATE_OCCURRED:-0}" = 1 ] || return 0
+  SPAWN_ENDPOINT_CREATED=1
+  case "$BACKEND" in
+    herdr)
+      HERDR_TAB_ID=${FM_BACKEND_CREATED_HERDR_TAB_ID:-}
+      HERDR_PANE_ID=${FM_BACKEND_CREATED_HERDR_PANE_ID:-}
+      ;;
+    zellij)
+      ZELLIJ_TAB_ID=${FM_BACKEND_CREATED_ZELLIJ_TAB_ID:-}
+      ZELLIJ_PANE_ID=${FM_BACKEND_CREATED_ZELLIJ_PANE_ID:-}
+      ;;
+    cmux)
+      CMUX_WORKSPACE_ID=${FM_BACKEND_CREATED_CMUX_WORKSPACE_ID:-}
+      CMUX_SURFACE_ID=${FM_BACKEND_CREATED_CMUX_SURFACE_ID:-}
+      ;;
+  esac
+  T=${FM_BACKEND_CREATED_TARGET:-}
+  SPAWN_ABORT_CLEANUP=1
 }
 
 herdr_projection_meta_field_exact() {  # <meta> <key>
@@ -1104,7 +1289,11 @@ case "$BACKEND" in
       HERDR_SEEDED_DEFAULT_TAB_ID=${HERDR_CONTAINER_RAW#*$'\t'}
       HERDR_SES=${CONTAINER%%:*}
       HERDR_WORKSPACE_ID=${CONTAINER#*:}
-      HERDR_TASK_IDS=$(FM_HOME="$HERDR_LABEL_HOME" fm_backend_herdr_create_task "$CONTAINER" "$W" "$PROJ_ABS" "$HERDR_SEEDED_DEFAULT_TAB_ID") || exit 1
+      if ! FM_HOME="$HERDR_LABEL_HOME" capture_backend_create HERDR_TASK_IDS \
+        fm_backend_herdr_create_task "$CONTAINER" "$W" "$PROJ_ABS" "$HERDR_SEEDED_DEFAULT_TAB_ID"; then
+        arm_created_endpoint_rollback
+        exit 1
+      fi
       read -r HERDR_TAB_ID HERDR_PANE_ID <<EOF
 $HERDR_TASK_IDS
 EOF
@@ -1117,7 +1306,10 @@ EOF
     ;;
   zellij)
     ZELLIJ_SES=$(fm_backend_zellij_container_ensure) || exit 1
-    ZELLIJ_TASK_IDS=$(fm_backend_zellij_create_task "$ZELLIJ_SES" "$W" "$PROJ_ABS") || exit 1
+    if ! capture_backend_create ZELLIJ_TASK_IDS fm_backend_zellij_create_task "$ZELLIJ_SES" "$W" "$PROJ_ABS"; then
+      arm_created_endpoint_rollback
+      exit 1
+    fi
     read -r ZELLIJ_TAB_ID ZELLIJ_PANE_ID <<EOF
 $ZELLIJ_TASK_IDS
 EOF
@@ -1129,7 +1321,10 @@ EOF
     ;;
   cmux)
     fm_backend_cmux_container_ensure || exit 1
-    CMUX_TASK_IDS=$(fm_backend_cmux_create_task "$W" "$PROJ_ABS") || exit 1
+    if ! capture_backend_create CMUX_TASK_IDS fm_backend_cmux_create_task "$W" "$PROJ_ABS"; then
+      arm_created_endpoint_rollback
+      exit 1
+    fi
     read -r CMUX_WORKSPACE_ID CMUX_SURFACE_ID <<EOF
 $CMUX_TASK_IDS
 EOF
@@ -1146,9 +1341,8 @@ EOF
     set -e
     if [ "$ORCA_WT_STATUS" -ne 0 ]; then
       if [ "$ORCA_WT_STATUS" -eq 2 ] && [ -n "$ORCA_WT_RAW" ]; then
-        if parse_orca_worktree_result "$ORCA_WT_RAW" && [ -n "$ORCA_WORKTREE_ID" ]; then
-          ORCA_ABORT_CLEANUP=1
-        fi
+        parse_orca_worktree_result "$ORCA_WT_RAW" || true
+        [ -z "$ORCA_WORKTREE_ID" ] || ORCA_ABORT_CLEANUP=1
       fi
       exit 1
     fi
@@ -1165,6 +1359,14 @@ EOF
     T="$ORCA_TERMINAL"
     ;;
 esac
+# Arm generic rollback only after this invocation demonstrably created its
+# endpoint. Adapter create functions expose partial post-create state so a
+# verification failure cannot leave an unrecorded live endpoint; a duplicate
+# preflight failure leaves FM_BACKEND_CREATE_OCCURRED=0 and owns nothing.
+if [ "$BACKEND" != orca ]; then
+  SPAWN_ENDPOINT_CREATED=1
+  SPAWN_ABORT_CLEANUP=1
+fi
 # #134 robustness: only tmux needs a worktree-detection target distinct from $T -
 # its rename-safe stable window id, set as WT_TARGET=$WID in the tmux branch above.
 # Every other backend addresses its pane/surface by the id already in $T, so default
@@ -1185,6 +1387,7 @@ spawn_current_path() {  # <target>
     tmux) fm_backend_tmux_current_path "$1" ;;
     herdr) fm_backend_herdr_current_path "$1" ;;
     zellij) fm_backend_zellij_current_path "$1" "$W" ;;
+    orca) fm_backend_orca_current_path "$1" ;;
     cmux) fm_backend_cmux_current_path "$1" "$W" ;;
   esac
 }
@@ -1281,33 +1484,49 @@ if [ "$KIND" != secondmate ] && [ "$BACKEND" != orca ]; then
   # a mismatch just becomes the new candidate rather than resetting the wait, so a
   # pane that is already settled by the first real read only costs the one existing
   # inter-poll sleep as confirmation, not a whole extra cycle on top.
+  WORKTREE_CWD_ATTEMPTS=${FM_WORKTREE_CWD_ATTEMPTS:-60}
+  WORKTREE_CWD_DELAY=${FM_WORKTREE_CWD_DELAY:-1}
+  case "$WORKTREE_CWD_ATTEMPTS" in ''|*[!0-9]*|0) WORKTREE_CWD_ATTEMPTS=60 ;; esac
   candidate=""
-  for _ in $(seq 1 60); do
+  for _ in $(seq 1 "$WORKTREE_CWD_ATTEMPTS"); do
     p=$(spawn_current_path "$WT_TARGET" || true)
-    if [ -n "$p" ]; then
+    if spawn_path_is_isolated_worktree "$p"; then
       p_real=$(real_path_or_raw "$p")
-      if [ "$p_real" != "$PROJ_ABS_REAL" ]; then
-        if [ -n "$candidate" ] && [ "$p_real" = "$candidate" ]; then
-          WT="$p"
-          break
-        fi
-        candidate="$p_real"
-      else
-        candidate=""
+      if [ -n "$candidate" ] && [ "$p_real" = "$candidate" ]; then
+        WT="$p"
+        break
       fi
+      candidate="$p_real"
     else
       candidate=""
     fi
-    sleep 1
+    sleep "$WORKTREE_CWD_DELAY"
   done
   if [ -z "$WT" ]; then
-    echo "error: treehouse get did not enter a worktree within 60s; inspect window $T" >&2
+    echo "error: treehouse get did not yield an isolated worktree within $WORKTREE_CWD_ATTEMPTS probes (last cwd '${p:-none}'); inspect window $T" >&2
     exit 1
   fi
 
   validate_spawn_worktree "treehouse get" "$T"
 fi
 
+if [ "$HOST_MODE" -eq 1 ]; then
+  HOST_CWD_ATTEMPTS=${FM_HOST_CWD_ATTEMPTS:-30}
+  HOST_CWD_DELAY=${FM_HOST_CWD_DELAY:-1}
+  case "$HOST_CWD_ATTEMPTS" in ''|*[!0-9]*|0) HOST_CWD_ATTEMPTS=30 ;; esac
+  spawn_send_text_line "$T" "cd -- $(shell_quote "$HOST_ROOT")"
+  for _ in $(seq 1 "$HOST_CWD_ATTEMPTS"); do
+    p=$(spawn_current_path "$T" || true)
+    [ "$(real_path_or_raw "$p")" = "$HOST_ROOT" ] && break
+    p=
+    sleep "$HOST_CWD_DELAY"
+  done
+  if [ -z "${p:-}" ] || [ "$(real_path_or_raw "$p")" != "$HOST_ROOT" ]; then
+    echo "error: backend endpoint did not enter FM_HOST_ROOT $HOST_ROOT; inspect target $T" >&2
+    exit 1
+  fi
+fi
+
 # Per-task temp root: /tmp/fm-<id>/ with Go's build temp nested at gotmp/. Go won't
 # create GOTMPDIR, so mkdir before it is used; fm-teardown removes the whole root.
 # Nested (not a bare /tmp/fm-<id>/gotmp) so other per-task temp can live alongside
@@ -1330,25 +1549,46 @@ exclude_path() {
   mkdir -p "$(dirname "$EXCL")"
   grep -qxF "$rel" "$EXCL" 2>/dev/null || echo "$rel" >> "$EXCL"
 }
+GROK_TASK_TOKEN=
+KIMI_TASK_TOKEN=
 if [ "$KIND" != secondmate ]; then
   case "$HARNESS" in
     claude*)
-      mkdir -p "$WT/.claude"
-      cat > "$WT/.claude/settings.local.json" <<EOF
+      if [ "$HOST_MODE" -eq 1 ]; then
+        hook_command=$(json_escape "touch -- $(shell_quote "$TURNEND")")
+        printf '{"hooks":{"Stop":[{"hooks":[{"type":"command","command":"%s"}]}]}}\n' "$hook_command" > "$STATE/$ID.claude-settings.json"
+      else
+        mkdir -p "$WT/.claude"
+        cat > "$WT/.claude/settings.local.json" <<EOF
 {"hooks":{"Stop":[{"hooks":[{"type":"command","command":"touch '$TURNEND'"}]}]}}
 EOF
-      exclude_path '.claude/settings.local.json'
+        exclude_path '.claude/settings.local.json'
+      fi
       ;;
     opencode*)
-      mkdir -p "$WT/.opencode/plugins"
-      cat > "$WT/.opencode/plugins/fm-turn-end.js" <<EOF
+      if [ "$HOST_MODE" -eq 1 ]; then
+        OPENCODE_TASK_PLUGIN="$STATE/$ID.opencode-turn-end.js"
+        turnend_js=$(json_escape "$TURNEND")
+        cat > "$OPENCODE_TASK_PLUGIN" <<EOF
+import { closeSync, openSync } from "node:fs"
+export const FmTurnEnd = async () => ({
+  event: async ({ event }) => {
+    if (event.type === "session.idle") closeSync(openSync("$turnend_js", "a"))
+  },
+})
+EOF
+      else
+        mkdir -p "$WT/.opencode/plugins"
+        OPENCODE_TASK_PLUGIN="$WT/.opencode/plugins/fm-turn-end.js"
+        cat > "$OPENCODE_TASK_PLUGIN" <<EOF
 export const FmTurnEnd = async ({ \$ }) => ({
   event: async ({ event }) => {
     if (event.type === "session.idle") await \$\`touch $TURNEND\`
   },
 })
 EOF
-      exclude_path '.opencode/plugins/fm-turn-end.js'
+        exclude_path '.opencode/plugins/fm-turn-end.js'
+      fi
       ;;
     pi|pi-signed)
       # Written OUTSIDE the worktree: pi's project-trust gate fires on any extension
@@ -1397,13 +1637,16 @@ EOF
 #!/usr/bin/env bash
 set -u
 auth_dir=$sq_grok_auth_dir
-workspace=\${GROK_WORKSPACE_ROOT:-}
-[ -n "\$workspace" ] || exit 0
-p="\$workspace/.fm-grok-turnend"
-[ -f "\$p" ] || exit 0
-first=
-IFS= read -r -n 256 first < "\$p" 2>/dev/null || [ -n "\$first" ] || exit 0
-case "\$first" in token=*) token=\${first#token=} ;; *) exit 0 ;; esac
+token=\${FM_GROK_TURNEND_TOKEN:-}
+if [ -z "\$token" ]; then
+  workspace=\${GROK_WORKSPACE_ROOT:-}
+  [ -n "\$workspace" ] || exit 0
+  p="\$workspace/.fm-grok-turnend"
+  [ -f "\$p" ] || exit 0
+  first=
+  IFS= read -r -n 256 first < "\$p" 2>/dev/null || [ -n "\$first" ] || exit 0
+  case "\$first" in token=*) token=\${first#token=} ;; *) exit 0 ;; esac
+fi
 case "\$token" in fm.????????????) : ;; *) exit 0 ;; esac
 case "\$token" in *[!A-Za-z0-9._-]*) exit 0 ;; esac
 t=\$(cat "\$auth_dir/\$token" 2>/dev/null) || exit 0
@@ -1414,8 +1657,11 @@ EOF
       chmod +x "$GROK_HOOKS_DIR/fm-turn-end.sh"
       hook_command=$(json_escape "bash $(shell_quote "$GROK_HOOKS_DIR/fm-turn-end.sh")")
       printf '{"hooks":{"Stop":[{"hooks":[{"type":"command","command":"%s"}]}]}}\n' "$hook_command" > "$GROK_HOOKS_DIR/fm-turn-end.json"
-      printf 'token=%s\n' "${auth_file##*/}" > "$WT/.fm-grok-turnend"
-      exclude_path '.fm-grok-turnend'
+      GROK_TASK_TOKEN=${auth_file##*/}
+      if [ "$HOST_MODE" -eq 0 ]; then
+        printf 'token=%s\n' "$GROK_TASK_TOKEN" > "$WT/.fm-grok-turnend"
+        exclude_path '.fm-grok-turnend'
+      fi
       ;;
     kimi*)
       # Kimi's Stop hook is global, but it is inert unless cwd contains this
@@ -1429,8 +1675,11 @@ EOF
       umask "$old_umask"
       printf '%s\n' "$TURNEND" > "$auth_file"
       printf '%s\n' "${auth_file##*/}" > "$STATE/$ID.kimi-turnend-token"
-      printf 'token=%s\n' "${auth_file##*/}" > "$WT/.fm-kimi-turnend"
-      exclude_path '.fm-kimi-turnend'
+      KIMI_TASK_TOKEN=${auth_file##*/}
+      if [ "$HOST_MODE" -eq 0 ]; then
+        printf 'token=%s\n' "$KIMI_TASK_TOKEN" > "$WT/.fm-kimi-turnend"
+        exclude_path '.fm-kimi-turnend'
+      fi
       ;;
   esac
 fi
@@ -1457,6 +1706,7 @@ META_WINDOW=$T
   echo "window=$META_WINDOW"
   echo "endpoint_task_id=$ID"
   echo "worktree=$WT"
+  [ "$HOST_MODE" -eq 0 ] || echo "host_root=$HOST_ROOT"
   echo "project=$PROJ_ABS"
   echo "harness=$HARNESS"
   echo "kind=$KIND"
@@ -1493,7 +1743,6 @@ META_WINDOW=$T
     echo "projects=$SECONDMATE_PROJECTS"
   fi
 } > "$STATE/$ID.meta"
-[ "$BACKEND" = orca ] && ORCA_ABORT_CLEANUP=0
 
 sq_brief=$(shell_quote "$BRIEF")
 sq_turnend=$(shell_quote "$TURNEND")
@@ -1501,6 +1750,16 @@ sq_piext=$(shell_quote "$STATE/$ID.pi-ext.ts")
 sq_piturnend=$(shell_quote "$PROJ_ABS/.pi/extensions/fm-primary-turnend-guard.ts")
 sq_piwatch=$(shell_quote "$PROJ_ABS/.pi/extensions/fm-primary-pi-watch.ts")
 sq_opinput=$(shell_quote "$FM_ROOT/bin/fm-operational-input.sh")
+sq_claude_settings=$(shell_quote "$STATE/$ID.claude-settings.json")
+sq_codex_notify=$(shell_quote "notify=[\"bash\",\"-c\",\"touch -- $sq_turnend\"]")
+sq_opencode_config=
+if [ "$HOST_MODE" -eq 1 ] && [ "$HARNESS" = opencode ]; then
+  opencode_plugin_url=$(node -e 'process.stdout.write(require("node:url").pathToFileURL(process.argv[1]).href)' \
+    "$OPENCODE_TASK_PLUGIN")
+  opencode_config=$(printf '{"permission":{"*":"allow"},"plugin":["%s"]}' \
+    "$(json_escape "$opencode_plugin_url")")
+  sq_opencode_config=$(shell_quote "$opencode_config")
+fi
 MODELFLAG=$(model_flag_for_harness "$HARNESS" "$MODEL")
 EFFORTFLAG=$(effort_flag_for_harness "$HARNESS" "$EFFORT")
 LAUNCH=${LAUNCH//__MODELFLAG__/$MODELFLAG}
@@ -1511,6 +1770,11 @@ LAUNCH=${LAUNCH//__PIEXT__/$sq_piext}
 LAUNCH=${LAUNCH//__PITURNEND__/$sq_piturnend}
 LAUNCH=${LAUNCH//__PIWATCH__/$sq_piwatch}
 LAUNCH=${LAUNCH//__OPINPUT__/$sq_opinput}
+LAUNCH=${LAUNCH//__CLAUDESETTINGS__/$sq_claude_settings}
+LAUNCH=${LAUNCH//__CODEXNOTIFY__/$sq_codex_notify}
+LAUNCH=${LAUNCH//__OPENCODECONFIG__/$sq_opencode_config}
+LAUNCH=${LAUNCH//__GROKTOKEN__/$GROK_TASK_TOKEN}
+LAUNCH=${LAUNCH//__KIMITOKEN__/$KIMI_TASK_TOKEN}
 # Crewmate panes are created by a long-lived tmux/herdr daemon that does not
 # inherit firstmate's current environment, so a bare `claude` in the pane falls
 # back to the default ~/.claude store even when firstmate itself runs under a
@@ -1523,7 +1787,13 @@ if [ "$HARNESS" = claude ] && [ -n "${CLAUDE_CONFIG_DIR:-}" ]; then
 fi
 if [ "$KIND" = secondmate ]; then
   sq_home=$(shell_quote "$PROJ_ABS")
-  LAUNCH="FM_ROOT_OVERRIDE= FM_STATE_OVERRIDE= FM_DATA_OVERRIDE= FM_PROJECTS_OVERRIDE= FM_CONFIG_OVERRIDE= FM_HOME=$sq_home $LAUNCH"
+  secondmate_root_clear=
+  if [ "${FM_HOST_ROOT+x}" = x ] || [ "${FM_TARGET_WORKTREE+x}" = x ]; then
+    secondmate_root_clear='FM_HOST_ROOT= FM_TARGET_WORKTREE= '
+  fi
+  LAUNCH="${secondmate_root_clear}FM_ROOT_OVERRIDE= FM_STATE_OVERRIDE= FM_DATA_OVERRIDE= FM_PROJECTS_OVERRIDE= FM_CONFIG_OVERRIDE= FM_HOME=$sq_home $LAUNCH"
+elif [ "$HOST_MODE" -eq 1 ]; then
+  LAUNCH="FM_ROOT_OVERRIDE=$(shell_quote "$FM_ROOT") FM_HOME=$(shell_quote "$FM_HOME") FM_HOST_ROOT=$(shell_quote "$HOST_ROOT") FM_TARGET_WORKTREE=$(shell_quote "$WT") $LAUNCH"
 fi
 # Export GOTMPDIR into the crewmate's pane shell so the agent and every child
 # process (go build, go test, ...) inherit it. Sent before the launch command so
@@ -1536,7 +1806,14 @@ if [ "${HERDR_PROJECTED:-0}" -eq 1 ]; then
   HERDR_PROJECTION_ABORT_CLEANUP=0
   spawn_herdr_presentation_order_lock_release
 fi
-spawn_send_key "$T" Enter
+# Enter may reach the shell even when the backend reports an error.
+# Keep the recorded endpoint and worktree instead of risking cleanup after execution began.
+ORCA_ABORT_CLEANUP=0
+SPAWN_ABORT_CLEANUP=0
+if ! spawn_send_key "$T" Enter; then
+  echo "error: launch submission could not be confirmed; endpoint and task metadata were retained for recovery" >&2
+  exit 1
+fi
 if [ "$HARNESS" = kimi ]; then
   if ! kimi_wait_for_ready; then
     kimi_spawn_fail "kimi did not show a verified ready signal before brief delivery"
diff --git a/bin/fm-supervision-instructions.sh b/bin/fm-supervision-instructions.sh
index 6cd87699b0..356274e168 100755
--- a/bin/fm-supervision-instructions.sh
+++ b/bin/fm-supervision-instructions.sh
@@ -2,6 +2,8 @@
 # Render the primary-harness supervision operating block for session start and
 # the short repair line used by guards and turn-end hooks.
 set -eu
+# Rendered paths are literal replacement data; never expand '&' as the matched placeholder.
+shopt -u patsub_replacement 2>/dev/null || true
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
@@ -9,6 +11,9 @@ FM_ROOT="${FM_ROOT_OVERRIDE:-$REPO_ROOT}"
 FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
 CONFIG="${FM_CONFIG_OVERRIDE:-$FM_HOME/config}"
 DOC_DIR="$REPO_ROOT/docs/supervision-protocols"
+# shellcheck source=bin/fm-host-root-lib.sh
+. "$SCRIPT_DIR/fm-host-root-lib.sh"
+FM_BIN_PREFIX=bin
 
 HARNESS=
 READ_ONLY=0
@@ -98,6 +103,7 @@ shell_quote() {
   printf "'"
 }
 
+fm_host_root_enabled && FM_BIN_PREFIX=$(shell_quote "$FM_ROOT/bin")
 x_mode_env_sh=$(shell_quote "$x_mode_env")
 
 if [ "$X_MODE" -eq 0 ] && [ -f "$x_mode_env" ]; then
@@ -111,6 +117,9 @@ render_snippet() {
     line=${line//__FM_PI_TURNEND_EXT__/$pi_turnend_ext}
     line=${line//__FM_X_MODE_ENV_SH__/$x_mode_env_sh}
     line=${line//__FM_X_MODE_ENV__/$x_mode_env}
+    if fm_host_root_enabled; then
+      line=${line//bin\/fm-/$FM_BIN_PREFIX/fm-}
+    fi
     printf '%s\n' "$line"
   done < "$SNIPPET"
 }
@@ -135,19 +144,19 @@ repair_line() {
 
   case "$HARNESS" in
     claude)
-      printf '%s%s\n' "$prefix" 'repair missing watcher supervision with bin/fm-watch-arm.sh as its own Claude Code background task, never shell &.'
+      printf '%srepair missing watcher supervision with %s/fm-watch-arm.sh as its own Claude Code background task, never shell &.\n' "$prefix" "$FM_BIN_PREFIX"
       ;;
     codex)
-      printf '%s%s%s%s\n' "$prefix" 'repair missing watcher supervision with a foreground checkpoint: bin/fm-watch-checkpoint.sh --seconds ' "$checkpoint_seconds" '.'
+      printf '%srepair missing watcher supervision with a foreground checkpoint: %s/fm-watch-checkpoint.sh --seconds %s.\n' "$prefix" "$FM_BIN_PREFIX" "$checkpoint_seconds"
       ;;
     pi|pi-signed)
       printf '%s%s%s%s%s%s\n' "$prefix" 'repair a missing or failed watcher cycle with the Pi tool fm_watch_arm_pi, or restart Pi with -e ' "$pi_turnend_ext" ' -e ' "$pi_ext" ' if the extensions are not loaded.'
       ;;
     opencode)
-      printf '%s%s\n' "$prefix" 'repair missing watcher supervision by letting the OpenCode TUI plugin arm after idle; use bin/fm-watch-arm.sh only as a manual recovery probe if the plugin reports failure.'
+      printf '%srepair missing watcher supervision by letting the OpenCode TUI plugin arm after idle; use %s/fm-watch-arm.sh only as a manual recovery probe if the plugin reports failure.\n' "$prefix" "$FM_BIN_PREFIX"
       ;;
     grok)
-      printf '%s%s\n' "$prefix" 'repair missing watcher supervision with bin/fm-watch-arm.sh as its own Grok tracked background task, never shell &.'
+      printf '%srepair missing watcher supervision with %s/fm-watch-arm.sh as its own Grok tracked background task, never shell &.\n' "$prefix" "$FM_BIN_PREFIX"
       ;;
     *)
       printf '%s%s\n' "$prefix" 'repair missing watcher supervision according to the session-start block for this harness; do not use shell &.'
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index 6164ebdd78..ed1c9fdaed 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -34,6 +34,8 @@
 # device. It refuses and preserves task state when that proof fails; otherwise
 # it removes the task's check, trust record, PR sidecar, publication record, and
 # quarantine entries with the rest of the volatile state.
+# Every task endpoint is stopped and verified absent before its isolated copy is
+# changed, returned, or removed.
 # Orca tasks use the same safety checks, then close the recorded terminal and
 # remove the recorded worktree through `orca worktree rm`; teardown never guesses
 # an Orca target from ambient CLI state.
@@ -53,6 +55,8 @@
 # never left leased forever. If the treehouse return fails, teardown leaves the
 # leased home and state in place instead of hiding a still-held lease.
 # Usage: fm-teardown.sh <task-id> [--force]
+#   Host-root task actions bind to the physical host_root= recorded in task
+#   metadata before supervision repair, task-data reads, or cleanup mutation.
 #   --force skips ordinary-task dirty and landed-work checks, skips scout report
 #   checks, and discards secondmate child work for kind=secondmate. Only use it
 #   when the captain has explicitly said to discard the work.
@@ -104,6 +108,8 @@ SUB_HOME_MARKER=".fm-secondmate-home"
 . "$SCRIPT_DIR/fm-lock-lib.sh"
 # shellcheck source=bin/fm-gate-refuse-lib.sh
 . "$SCRIPT_DIR/fm-gate-refuse-lib.sh"
+# shellcheck source=bin/fm-host-root-lib.sh
+. "$SCRIPT_DIR/fm-host-root-lib.sh"
 # shellcheck source=bin/fm-pr-lib.sh
 . "$SCRIPT_DIR/fm-pr-lib.sh"
 if [ "$#" -lt 1 ] || ! fm_task_id_path_safe "$1"; then
@@ -114,11 +120,11 @@ ID=$1
 FORCE=${2:-}
 # Fail closed before any fleet mutation: a no-mistakes gate agent must never tear
 # down a worktree (see bin/fm-gate-refuse-lib.sh).
-fm_refuse_if_gate_agent
-FM_LOCK_LOG_PREFIX=teardown
+fm_refuse_if_gate_agent "$FM_ROOT"
 
 META="$STATE/$ID.meta"
 [ -f "$META" ] || { echo "error: no meta for task $ID at $META" >&2; exit 1; }
+fm_host_root_assert_task_cwd "$FM_ROOT" "$META" || exit $?
 # This is the first cleanup authorization check. It is metadata-only and must
 # complete before fm-guard, a backend command, file removal, branch deletion,
 # worktree return, registry change, or process termination can run.
@@ -129,7 +135,8 @@ WT=$(fm_meta_get "$META" worktree)
 PROJ=$(fm_meta_get "$META" project)
 T_ORCA=
 [ "$BACKEND" != orca ] || T_ORCA=$T
-"$FM_ROOT/bin/fm-guard.sh" || true
+# The recorded host binding and endpoint identity are established before this guard can repair state.
+FM_LOCK_LOG_PREFIX=teardown "$FM_ROOT/bin/fm-guard.sh" || true
 HOME_PATH=$(grep '^home=' "$META" | cut -d= -f2- || true)
 PR_URL=$(grep '^pr=' "$META" | tail -1 | cut -d= -f2- || true)
 # tasktmp is recorded by fm-spawn for tasks that set up a per-task temp root
@@ -732,6 +739,21 @@ validate_worktree_teardown_safety() {
   fi
 }
 
+validate_worktree_teardown_safety_with_lock_cleanup() {
+  local safety_rc
+  if validate_worktree_teardown_safety; then
+    return 0
+  else
+    safety_rc=$?
+  fi
+  if [ "$safety_rc" -eq "$TEARDOWN_WORKTREE_SAFETY_LOCK_BLOCKED" ]; then
+    cleanup_stale_lock_for_safety_check "$WT" || return 1
+    validate_worktree_teardown_safety
+  else
+    return "$safety_rc"
+  fi
+}
+
 require_orca_worktree_path_match() {
   local worktree_id=$1 inspected=$2 resolved inspected_abs resolved_abs
   resolved=$(fm_backend_worktree_path orca "$worktree_id") || {
@@ -995,13 +1017,15 @@ cleanup_firstmate_home_children() {
       fi
     fi
     if [ -n "$child_t" ]; then
-      if [ "$child_backend" = zellij ]; then
-        # Zellij titles are scoped by the owning home tag, so forced secondmate
-        # cleanup must verify child tabs as that child home, not the parent.
-        ( unset FM_ROOT_OVERRIDE; FM_HOME=$home FM_ROOT=$home fm_backend_kill "$child_backend" "$child_t" "$(meta_value "$child_meta" zellij_tab_id)" "fm-$child_id" ) 2>/dev/null || true
-      else
-        fm_backend_kill "$child_backend" "$child_t" "$(meta_value "$child_meta" zellij_tab_id)" "fm-$child_id" 2>/dev/null || true
-      fi
+      case "$child_backend" in
+        zellij|cmux)
+          # These adapters scope labels and optional socket configuration to the owning home.
+          ( unset FM_ROOT_OVERRIDE FM_CONFIG_OVERRIDE; FM_HOME=$home FM_ROOT=$home fm_backend_stop_and_verify "$child_backend" "$child_t" "$(meta_value "$child_meta" zellij_tab_id)" "fm-$child_id" ) || return 1
+          ;;
+        *)
+          fm_backend_stop_and_verify "$child_backend" "$child_t" "$(meta_value "$child_meta" zellij_tab_id)" "fm-$child_id" || return 1
+          ;;
+      esac
     fi
     if [ "$child_kind" = secondmate ]; then
       child_home=$(meta_value "$child_meta" home)
@@ -1040,7 +1064,8 @@ cleanup_firstmate_home_children() {
     remove_pr_poll_artifacts "$sub_state" "$child_id" || return 1
     rm -f "$sub_state/$child_id.status" "$sub_state/$child_id.turn-ended" \
       "$sub_state/$child_id.meta" "$sub_state/$child_id.pi-ext.ts" \
-      "$sub_state/$child_id.grok-turnend-token" "$sub_state/$child_id.kimi-turnend-token"
+      "$sub_state/$child_id.grok-turnend-token" "$sub_state/$child_id.kimi-turnend-token" \
+      "$sub_state/$child_id.claude-settings.json" "$sub_state/$child_id.opencode-turn-end.js"
   done
 }
 
@@ -1074,10 +1099,6 @@ if [ "$KIND" = secondmate ] && [ "$FORCE" != "--force" ]; then
   fi
 fi
 
-if [ "$KIND" = secondmate ] && [ "$FORCE" = "--force" ]; then
-  cleanup_firstmate_home_children "$HOME_PATH"
-fi
-
 if [ "$KIND" = scout ] && [ "$FORCE" != "--force" ]; then
   REPORT="$DATA/$ID/report.md"
   if [ ! -f "$REPORT" ]; then
@@ -1103,21 +1124,78 @@ if [ "$BACKEND" = orca ] && [ "$KIND" != scout ] && [ "$KIND" != secondmate ] &&
   ORCA_PATH_MATCH_VERIFIED=1
 fi
 
-if [ -d "$WT" ] && [ "$FORCE" != "--force" ]; then
-  if validate_worktree_teardown_safety; then
-    :
-  else
-    safety_rc=$?
-    if [ "$safety_rc" -eq "$TEARDOWN_WORKTREE_SAFETY_LOCK_BLOCKED" ]; then
-      cleanup_stale_lock_for_safety_check "$WT" || exit 1
-      validate_worktree_teardown_safety || exit 1
-    else
-      exit 1
-    fi
+HERDR_PRESENTATION_JOURNAL="$STATE/$ID.herdr-presentation"
+HERDR_PRESENTATION_RETIRE_CANDIDATE=0
+HERDR_PRESENTATION_SESSION=
+HERDR_PRESENTATION_PANE=
+if [ "$BACKEND" = herdr ] \
+   && { [ -e "$HERDR_PRESENTATION_JOURNAL" ] || [ -L "$HERDR_PRESENTATION_JOURNAL" ]; }; then
+  fm_backend_source herdr || true
+  HERDR_PRESENTATION_SESSION=$(meta_value "$META" herdr_session)
+  HERDR_PRESENTATION_WORKSPACE=$(meta_value "$META" herdr_workspace_id)
+  HERDR_PRESENTATION_PANE=$(meta_value "$META" herdr_pane_id)
+  if [ -n "$HERDR_PRESENTATION_SESSION" ] \
+     && [ -n "$HERDR_PRESENTATION_WORKSPACE" ] \
+     && [ -n "$HERDR_PRESENTATION_PANE" ] \
+     && [ "$T" = "$HERDR_PRESENTATION_SESSION:$HERDR_PRESENTATION_PANE" ] \
+     && fm_backend_herdr_projection_endpoint_matches_journal \
+       "$HERDR_PRESENTATION_SESSION" "$HERDR_PRESENTATION_WORKSPACE" \
+       "$HERDR_PRESENTATION_JOURNAL" "$ID"; then
+    HERDR_PRESENTATION_RETIRE_CANDIDATE=1
   fi
 fi
 
-# Best-effort: drop the local task branch so the shared repo does not accumulate refs.
+stop_task_endpoint_and_verify() {
+  local focus_lock='' focus_lock_held=0 attempt=0 endpoint_state
+  if [ "$HERDR_PRESENTATION_RETIRE_CANDIDATE" != 1 ]; then
+    fm_backend_stop_and_verify "$BACKEND" "$T" "$(meta_value "$META" zellij_tab_id)" "fm-$ID"
+    return
+  fi
+
+  # shellcheck source=bin/fm-wake-lib.sh
+  . "$SCRIPT_DIR/fm-wake-lib.sh"
+  if focus_lock=$(fm_backend_herdr_presentation_session_lock_path "$HERDR_PRESENTATION_SESSION"); then
+    while [ "$attempt" -lt 50 ]; do
+      if fm_lock_try_acquire "$focus_lock"; then
+        focus_lock_held=1
+        break
+      fi
+      sleep 0.1
+      attempt=$((attempt + 1))
+    done
+  fi
+  if [ "$focus_lock_held" != 1 ]; then
+    echo "error: herdr presentation focus lock unavailable; refusing a concurrent focus-unsafe pane close" >&2
+    return 1
+  fi
+  fm_backend_herdr_projection_close_pane_focus_preserving \
+    "$HERDR_PRESENTATION_SESSION" "$HERDR_PRESENTATION_PANE" 2>/dev/null || true
+  fm_lock_release "$focus_lock" || true
+  endpoint_state=$(fm_backend_target_state herdr "$T" "" 2>/dev/null)
+  if [ "$endpoint_state" != absent ]; then
+    echo "error: exact herdr task pane could not be confirmed absent; refusing destructive cleanup" >&2
+    return 1
+  fi
+  rm -f "$HERDR_PRESENTATION_JOURNAL"
+}
+
+if [ -d "$WT" ] && [ "$FORCE" != "--force" ]; then
+  validate_worktree_teardown_safety_with_lock_cleanup || exit 1
+fi
+
+if [ "$BACKEND" = orca ] && [ "$KIND" != secondmate ] && [ "$ORCA_PATH_MATCH_VERIFIED" != 1 ]; then
+  require_orca_worktree_path_match_if_present "$ORCA_WORKTREE_ID" "$WT" || exit 1
+  ORCA_PATH_MATCH_VERIFIED=1
+fi
+stop_task_endpoint_and_verify || exit 1
+if [ "$BACKEND" = orca ] && [ -d "$WT" ] && [ "$FORCE" != "--force" ]; then
+  validate_worktree_teardown_safety_with_lock_cleanup || exit 1
+fi
+if [ "$KIND" = secondmate ] && [ "$FORCE" = "--force" ]; then
+  cleanup_firstmate_home_children "$HOME_PATH"
+fi
+
+# The worker is confirmed stopped before the task branch or isolated copy changes.
 if [ "$BACKEND" = orca ] && [ "$KIND" != secondmate ]; then
   if [ "$ORCA_PATH_MATCH_VERIFIED" != 1 ]; then
     require_orca_worktree_path_match_if_present "$ORCA_WORKTREE_ID" "$WT" || exit 1
@@ -1133,7 +1211,6 @@ if [ "$BACKEND" = orca ] && [ "$KIND" != secondmate ]; then
     rm -f "$WT/.claude/settings.local.json" "$WT/.opencode/plugins/fm-turn-end.js" \
       "$WT/.fm-grok-turnend" "$WT/.fm-kimi-turnend"
   fi
-  [ -z "$T_ORCA" ] || fm_backend_kill "$BACKEND" "$T" "$(meta_value "$META" zellij_tab_id)" "fm-$ID" 2>/dev/null || true
   fm_backend_remove_worktree "$BACKEND" "$ORCA_WORKTREE_ID"
 elif [ -d "$WT" ] && [ "$KIND" != secondmate ]; then
   branch=$(git -C "$WT" rev-parse --abbrev-ref HEAD 2>/dev/null || echo HEAD)
@@ -1159,62 +1236,9 @@ elif [ -d "$WT" ] && [ "$KIND" != secondmate ]; then
   }
 fi
 
-HERDR_PRESENTATION_JOURNAL="$STATE/$ID.herdr-presentation"
-HERDR_PRESENTATION_RETIRE_CANDIDATE=0
-HERDR_PRESENTATION_SESSION=
-HERDR_PRESENTATION_PANE=
 if [ "$BACKEND" = herdr ] \
+   && [ "$HERDR_PRESENTATION_RETIRE_CANDIDATE" != 1 ] \
    && { [ -e "$HERDR_PRESENTATION_JOURNAL" ] || [ -L "$HERDR_PRESENTATION_JOURNAL" ]; }; then
-  fm_backend_source herdr || true
-  HERDR_PRESENTATION_SESSION=$(meta_value "$META" herdr_session)
-  HERDR_PRESENTATION_WORKSPACE=$(meta_value "$META" herdr_workspace_id)
-  HERDR_PRESENTATION_PANE=$(meta_value "$META" herdr_pane_id)
-  if [ -n "$HERDR_PRESENTATION_SESSION" ] \
-     && [ -n "$HERDR_PRESENTATION_WORKSPACE" ] \
-     && [ -n "$HERDR_PRESENTATION_PANE" ] \
-     && [ "$T" = "$HERDR_PRESENTATION_SESSION:$HERDR_PRESENTATION_PANE" ] \
-     && fm_backend_herdr_projection_endpoint_matches_journal \
-       "$HERDR_PRESENTATION_SESSION" "$HERDR_PRESENTATION_WORKSPACE" \
-       "$HERDR_PRESENTATION_JOURNAL" "$ID"; then
-    HERDR_PRESENTATION_RETIRE_CANDIDATE=1
-  fi
-fi
-
-if [ "$HERDR_PRESENTATION_RETIRE_CANDIDATE" = 1 ]; then
-  # shellcheck source=bin/fm-wake-lib.sh
-  . "$SCRIPT_DIR/fm-wake-lib.sh"
-  HERDR_PRESENTATION_FOCUS_LOCK=
-  HERDR_PRESENTATION_FOCUS_LOCK_HELD=0
-  HERDR_PRESENTATION_FOCUS_LOCK_ATTEMPT=0
-  if HERDR_PRESENTATION_FOCUS_LOCK=$(fm_backend_herdr_presentation_session_lock_path "$HERDR_PRESENTATION_SESSION"); then
-    while [ "$HERDR_PRESENTATION_FOCUS_LOCK_ATTEMPT" -lt 50 ]; do
-      if fm_lock_try_acquire "$HERDR_PRESENTATION_FOCUS_LOCK"; then
-        HERDR_PRESENTATION_FOCUS_LOCK_HELD=1
-        break
-      fi
-      sleep 0.1
-      HERDR_PRESENTATION_FOCUS_LOCK_ATTEMPT=$((HERDR_PRESENTATION_FOCUS_LOCK_ATTEMPT + 1))
-    done
-  fi
-  if [ "$HERDR_PRESENTATION_FOCUS_LOCK_HELD" = 1 ]; then
-    fm_backend_herdr_projection_close_pane_focus_preserving \
-      "$HERDR_PRESENTATION_SESSION" "$HERDR_PRESENTATION_PANE" 2>/dev/null || true
-    HERDR_PRESENTATION_FOCUS_LOCK_HELD=0
-    fm_lock_release "$HERDR_PRESENTATION_FOCUS_LOCK" || true
-  else
-    echo "warning: herdr presentation focus lock unavailable; refusing a concurrent focus-unsafe pane close" >&2
-  fi
-elif [ "$BACKEND" != orca ]; then
-  fm_backend_kill "$BACKEND" "$T" "$(meta_value "$META" zellij_tab_id)" "fm-$ID" 2>/dev/null || true
-fi
-if [ "$HERDR_PRESENTATION_RETIRE_CANDIDATE" = 1 ]; then
-  if [ "$(fm_backend_herdr_pane_agent_state "$HERDR_PRESENTATION_SESSION" "$HERDR_PRESENTATION_PANE")" = dead ]; then
-    rm -f "$HERDR_PRESENTATION_JOURNAL"
-  else
-    echo "warning: exact herdr task-pane close could not be confirmed for $ID; retaining the presentation journal and attempting no workspace cleanup" >&2
-  fi
-elif [ "$BACKEND" = herdr ] \
-     && { [ -e "$HERDR_PRESENTATION_JOURNAL" ] || [ -L "$HERDR_PRESENTATION_JOURNAL" ]; }; then
   echo "warning: herdr presentation journal for $ID remains quarantined; no workspace cleanup was attempted" >&2
 fi
 if [ "$KIND" = secondmate ]; then
@@ -1231,7 +1255,8 @@ fm_backend_clear_transition "$BACKEND" "$STATE" "$T" || true
 remove_pr_poll_artifacts "$STATE" "$ID" || exit 1
 rm -f "$STATE/$ID.status" "$STATE/$ID.turn-ended" "$STATE/$ID.meta" \
   "$STATE/$ID.pi-ext.ts" "$STATE/$ID.grok-turnend-token" \
-  "$STATE/$ID.kimi-turnend-token"
+  "$STATE/$ID.kimi-turnend-token" \
+  "$STATE/$ID.claude-settings.json" "$STATE/$ID.opencode-turn-end.js"
 if [ "$KIND" != scout ] && [ "$KIND" != secondmate ] && [ "$MODE" != local-only ]; then
   "$FM_ROOT/bin/fm-fleet-sync.sh" "$PROJ" || true
 fi
diff --git a/bin/fm-x-followup.sh b/bin/fm-x-followup.sh
index 603678cfca..2dbff6928d 100755
--- a/bin/fm-x-followup.sh
+++ b/bin/fm-x-followup.sh
@@ -55,6 +55,7 @@
 # The window is FMX_FOLLOWUP_MAX_AGE_SECS (default 604800, 7 days). The cap is
 # FMX_FOLLOWUP_MAX_COUNT (default 3). FMX_NOW_OVERRIDE pins "now" for
 # deterministic tests. Meta read/write lives in fm-x-lib.sh.
+# Host-root tasks bind to their recorded physical host cwd before metadata or post activity.
 set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -63,6 +64,8 @@ FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 # shellcheck source=bin/fm-x-lib.sh
 . "$SCRIPT_DIR/fm-x-lib.sh"
+# shellcheck source=bin/fm-host-root-lib.sh
+. "$SCRIPT_DIR/fm-host-root-lib.sh"
 
 usage() {
   echo "usage: fm-x-followup.sh --check <task-id> | <task-id> [--image <path>] [--final] --text-file <path> | <task-id> [--image <path>] [--final] -" >&2
@@ -144,6 +147,11 @@ case "$ID" in
 esac
 
 META="$STATE/$ID.meta"
+if [ -f "$META" ]; then
+  fm_host_root_assert_task_cwd "$FM_ROOT" "$META" || exit $?
+else
+  fm_host_root_assert_session_cwd "$FM_ROOT" || exit $?
+fi
 RID=$(fmx_meta_get "$META" x_request)
 TS=$(fmx_meta_get "$META" x_request_ts)
 COUNT=$(fmx_meta_get "$META" x_followups)
diff --git a/bin/fm-x-link.sh b/bin/fm-x-link.sh
index 5301359a45..a9167fdff3 100755
--- a/bin/fm-x-link.sh
+++ b/bin/fm-x-link.sh
@@ -35,6 +35,7 @@
 #
 # Both ids are relay/firstmate slugs that compose a filename, so they are guarded
 # against path traversal even though they come from trusted callers.
+# Host-root tasks bind to their recorded physical host cwd before metadata mutation.
 set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -45,6 +46,8 @@ STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 . "$SCRIPT_DIR/fm-x-lib.sh"
 # shellcheck source=bin/fm-pr-lib.sh
 . "$SCRIPT_DIR/fm-pr-lib.sh"
+# shellcheck source=bin/fm-host-root-lib.sh
+. "$SCRIPT_DIR/fm-host-root-lib.sh"
 
 usage() {
   echo "usage: fm-x-link.sh <task-id> <request_id> [--carry-count <n> --carry-ts <epoch> [--carry-platform <x|discord>] [--carry-max <n>]]" >&2
@@ -124,6 +127,7 @@ if [ ! -f "$META" ]; then
   echo "fm-x-link: no such task: state/$ID.meta" >&2
   exit 1
 fi
+fm_host_root_assert_task_cwd "$FM_ROOT" "$META" || exit $?
 
 command -v jq >/dev/null 2>&1 || { echo "fm-x-link: jq not found" >&2; exit 1; }
 fmx_load_config
diff --git a/docs/architecture.md b/docs/architecture.md
index bf8b5cb3ec..1f6bb5a796 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -114,6 +114,14 @@ Codex App support is recorded in `docs/codex-app-backend.md`; it is not selectab
 
 ## Worktrees, not branches in your checkout
 
+The default launch cwd remains the isolated task worktree.
+When optional `FM_HOST_ROOT` mode is enabled, FirstMate separates its tracked code root, operational home, host instruction root, and target worktree instead: the backend acquires and validates the isolated target first, records it as `worktree=`, returns the endpoint to the physical host root, verifies that cwd, then launches the harness with exact `FM_HOST_ROOT` and `FM_TARGET_WORKTREE` values.
+The target is rejected if it resolves to the host, and a failed host transition cleans the new endpoint and worktree or leaves recoverable metadata when cleanup itself fails.
+Host instructions and native lifecycle hooks remain authoritative because the harness starts from the host root, while the host-root brief requires applicable target instructions before edits and scopes every target operation explicitly.
+FirstMate task completion signals are added through harness launch configuration or per-process identity rather than by writing host hook files.
+Secondmates keep their isolated-home launch shape and clear both host variables.
+The full four-root contract and validation rules are owned by [configuration.md](configuration.md#host-root-mode-fm_host_root).
+
 Crewmates never intentionally touch your project clone; [treehouse](https://github.com/kunchenguid/treehouse) pools clean worktrees for tmux, herdr, zellij, and cmux tasks, while Orca creates its own worktrees for `backend=orca`.
 For ship and scout work, `fm-spawn.sh` refuses to launch unless the resolved task path is a real git worktree root that is distinct from the project primary checkout.
 
diff --git a/docs/configuration.md b/docs/configuration.md
index b2f80b8e6d..d17e25b52b 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -177,6 +177,44 @@ The full zellij home label also includes a short hash of the resolved `FM_ROOT`
 For the cmux backend, `FM_CONFIG_OVERRIDE` overrides where `config/cmux-socket-password` is read from, while `FM_HOME` determines the default config path and readable home prefix embedded in workspace titles.
 The full cmux home label also includes a short hash of the resolved `FM_ROOT` path, and there is no per-home container split.
 
+## Host-root mode (FM_HOST_ROOT)
+
+`FM_HOST_ROOT` is an optional physical instruction root and harness startup cwd for a primary FirstMate home.
+It is a low-level runtime contract for an explicit host integration, not an installer: setting the variable alone does not load FirstMate's supervisor policy or adapters into another repository.
+Unset or empty preserves the normal behavior in which FirstMate runs from its tracked code root.
+When set, the caller must already have loaded the FirstMate policy and required harness adapters additively, the value must resolve to an existing directory containing the cross-harness `AGENTS.md` instruction surface, it must differ from `FM_ROOT`, and the supervisor must be launched with its physical cwd at that directory.
+`bin/fm-session-start.sh` validates that contract before lock acquisition or any bootstrap mutation.
+
+Host mode separates four roots:
+
+- `FM_ROOT` is the tracked FirstMate code, skill, documentation, and script root.
+- `FM_HOME` is the private FirstMate operational home that owns `data/`, `state/`, `config/`, and `projects/`.
+- `FM_HOST_ROOT` is the host repository whose instructions, native lifecycle, and cwd remain authoritative.
+- `FM_TARGET_WORKTREE` is the per-task isolated target repository where code changes, Git operations, tests, builds, GitHub operations, and no-mistakes run.
+
+The physical target worktree must differ from both the target project's primary checkout and `FM_HOST_ROOT`.
+Ordinary ship and scout endpoints still acquire and validate their isolated target worktree first, retain it as `worktree=` metadata, then return the endpoint shell to the physical host root before launching the harness.
+A failed host transition stops and verifies the new endpoint before returning the acquired worktree, removes every task-owned pre-record artifact on successful rollback, and retains recovery metadata and the isolated path when endpoint termination or resource cleanup cannot be confirmed.
+An overlap refusal stops the endpoint but never returns or removes the overlapping path automatically.
+An unconfirmed final launch submission retains the endpoint, worktree, task safeguards, and metadata because the worker may already be running.
+The child receives exact `FM_HOST_ROOT` and `FM_TARGET_WORKTREE` values, while task actions bind to the recorded physical `host_root=` before reading or changing task data and review, merge, evidence, and teardown continue to use the recorded `worktree=` path.
+Teardown stops and verifies the recorded worker endpoint before changing or returning its isolated copy.
+Orca ship teardown repeats worktree safety checks after the terminal is confirmed stopped and before forced worktree removal.
+Host-root briefs carry `<!-- firstmate-execution-mode: host-root -->`, require the worker to read host instructions first and applicable target instructions before edits, keep the host read-only except for host-owned lifecycle effects, and require explicit target paths or scoped subshells.
+The same target scoping applies to the complete no-mistakes lifecycle, including doctor, initialization, run, gate responses, and follow-up help commands; no validation command may default to the host cwd.
+Spawn rejects a cwd-relative legacy brief in host mode rather than weakening that contract silently.
+
+Harness integration is additive.
+Claude receives an additional task settings file through `--settings`, Codex retains its launch-command notification, OpenCode receives an explicit task plugin in addition to host project plugins, Pi receives its explicit task extension, and Grok and Kimi use per-process task tokens consumed by their guarded global hooks.
+None of these paths writes or replaces host hook configuration, and each task signal is installed once.
+The host repository's own lifecycle hooks continue to load from the host cwd.
+Host-root ordinary tasks reject raw launch commands because an unverified command cannot guarantee the required task completion safeguard.
+
+Secondmates are intentionally outside host-root mode.
+Creating a secondmate from a host-mode primary still requires the physical host cwd before brief or spawn mutation.
+A secondmate still launches from its isolated FirstMate home, receives neither `host_root=` metadata nor host-root brief semantics, and its launch explicitly clears inherited `FM_HOST_ROOT` and `FM_TARGET_WORKTREE`.
+A secondmate's own ordinary crews can opt in only through that home's own independently configured primary environment; the main home's roots never leak across the boundary.
+
 ## Harness support
 
 claude, codex, opencode, pi, pi-signed, grok, and kimi are empirically verified for crewmate and secondmate launches; [README requirements](../README.md#requirements) own the set supported for the primary session.
@@ -203,7 +241,8 @@ The inherited-local-material contract is owned by [`secondmate-provisioning`](..
 Those inherited values are defaults and rules only; `fm-spawn` still permits a consciously chosen explicit runtime outside the config.
 `config/secondmate-harness` is not inherited because secondmates do not launch secondmates.
 For grok, `fm-spawn.sh` installs one firstmate-owned global turn-end hook under `$GROK_HOME/hooks/`, or `~/.grok/hooks/` when `GROK_HOME` is unset, and drops a per-task `.fm-grok-turnend` pointer in the worktree, with teardown removing the task token and pointer.
-For Kimi crews, `fm-spawn.sh` runs `fm-kimi-turnend-hook.sh install`, drops a per-task `.fm-kimi-turnend` pointer in the worktree, and records the matching private registry token for teardown.
+For Kimi crews, `fm-spawn.sh` runs `fm-kimi-turnend-hook.sh install` and records a private registry token for teardown.
+Default launches also drop a per-task `.fm-kimi-turnend` pointer in the worktree, while host-root launches pass the same token only through `FM_KIMI_TURNEND_TOKEN` and never write a pointer into the host repository.
 Kimi continues to use the captain's normal Kimi home, including the existing config, skills, and memory; Firstmate does not create an isolated Kimi home.
 The Kimi installer requires an existing regular non-symlink `~/.kimi-code/config.toml`, `python3` with `tomllib`, and `jq`; it validates but never serializes the captain's TOML and refuses before writing when the config is missing, malformed, or surprising or when either tool requirement is unavailable.
 Its `remove` action excises only the marker-delimited Firstmate region and removes Firstmate's hook files.
@@ -371,6 +410,8 @@ Runtime tuning via environment variables (defaults shown):
 
 ```sh
 FM_HOME=                 # optional operational home for most scripts, unset means this repo root; fm-send requires it explicitly
+FM_HOST_ROOT=            # optional physical host instruction root and primary/ordinary-worker cwd; unset preserves normal behavior
+FM_TARGET_WORKTREE=      # spawn-owned exact isolated target path for a host-root worker; secondmates clear it
 FM_ROOT_OVERRIDE=        # override firstmate repo root, tangle-guard target, and zellij/cmux home-title hash; also legacy whole-root override when FM_HOME is unset
 FM_STATE_OVERRIDE=       # alternate state dir, mainly for tests
 FM_DATA_OVERRIDE=        # alternate data dir, mainly for tests
diff --git a/docs/herdr-backend.md b/docs/herdr-backend.md
index 91047bcc6f..4d29485f91 100644
--- a/docs/herdr-backend.md
+++ b/docs/herdr-backend.md
@@ -284,3 +284,4 @@ tests/fm-afk-pi-herdr-return-e2e.test.sh
 
 Real Herdr tests use the named lab helper and default-session tripwire.
 [`verification/runtime-backends.md`](verification/runtime-backends.md#herdr) records the active version, CLI, projection, event, and lifecycle evidence without task-specific chronology.
+`tests/fm-host-root-mode.test.sh` covers the backend-independent host-root contract with fake adapters.
diff --git a/docs/orca-backend.md b/docs/orca-backend.md
index 9812993e83..4d88dc8497 100644
--- a/docs/orca-backend.md
+++ b/docs/orca-backend.md
@@ -52,6 +52,7 @@ Exact command flags and response parsing are owned by `bin/backends/orca.sh` and
 `fm-send.sh` types and verifies composer clearance, follows `oldestCursor` when Orca returns a limited page, and retries Enter without retyping when a slash popup first fills an argument placeholder.
 A bare shell row is `unknown`, not an empty agent composer.
 The watcher has no native Orca busy signal and uses the shared terminal-tail fallback.
+In host-root mode, spawn verifies the terminal's physical cwd after moving it to `FM_HOST_ROOT`, then launches with the Orca worktree retained as `FM_TARGET_WORKTREE`.
 
 Cleanup keeps all shared Firstmate safety checks.
 A scout still requires its report and completed decision inventory.
diff --git a/docs/sessionstart-nudge.md b/docs/sessionstart-nudge.md
index c39c814925..873cc060e5 100644
--- a/docs/sessionstart-nudge.md
+++ b/docs/sessionstart-nudge.md
@@ -2,7 +2,9 @@
 
 AGENTS.md section 3 is the authoritative behavioral contract for session start.
 The tracked native adapters inject one instruction and never run the digest, acquire the lock, perform bootstrap work, drain notifications, or arm supervision themselves.
-The payload starts with U+2063 and the stable `FIRSTMATE_OP: ` label, carries the current `session-start` protocol kind, and retains exactly ``Run `bin/fm-session-start.sh` now, exactly once, before executing any other instructions.`` as its body.
+The payload starts with U+2063 and the stable `FIRSTMATE_OP: ` label and carries the current `session-start` protocol kind.
+Its body is exactly ``Run `bin/fm-session-start.sh` now, exactly once, before executing any other instructions.`` in default mode.
+In host-root mode the body uses the absolute `FM_ROOT/bin/fm-session-start.sh` path because the authoritative cwd deliberately has no FirstMate-relative `bin/`.
 The Ahoy skill owns the rule that this marked operational input is never a captain-authored session boundary, including its narrow legacy compatibility cases.
 
 ## Shared wrapper and safety
@@ -12,6 +14,7 @@ It sources `bin/fm-gate-refuse-lib.sh` and stays silent for a no-mistakes gate a
 It shares `bin/fm-primary-scope-lib.sh` with `bin/fm-turnend-guard.sh`, so the hooks use one primary-detection owner.
 The Shared Predicate section of [`turnend-guard.md`](turnend-guard.md#shared-predicate) owns marker validation, plain-checkout detection, and required Firstmate-shaped paths.
 
+When `FM_HOST_ROOT` is set, the wrapper also verifies the hook process is running from that physical host root and stays silent on mismatch.
 Before printing, the wrapper reads `state/.lock` and walks at most eight parents from its own pid in its own separate, hard-coded loop, independent of `bin/fm-lock.sh`'s ancestry walk (`fm_harness_ancestry_pid()` in `bin/fm-session-lock-lib.sh`, which now walks up to sixteen parents and can extend past a claude-named match to a still-more-ancestral one) and of Pi's `lockOwnership()`.
 If the lock names a live pid in that ancestry, session start already ran in this harness session and the wrapper stays silent.
 Every path exits 0, including malformed state and adapter errors, because a Claude SessionStart exit 2 blocks session initialization.
diff --git a/docs/tmux-backend.md b/docs/tmux-backend.md
index 3bf20fe9d1..5d21e80cc5 100644
--- a/docs/tmux-backend.md
+++ b/docs/tmux-backend.md
@@ -86,6 +86,7 @@ tests/fm-composer-ghost.test.sh
 tests/fm-kimi-harness.test.sh
 tests/fm-tmux-submit-busy.test.sh
 tests/fm-bootstrap.test.sh
+tests/fm-host-root-mode.test.sh
 ```
 
 [`verification/runtime-backends.md`](verification/runtime-backends.md#tmux) records the active foreground-process and submit evidence.
diff --git a/docs/turnend-guard.md b/docs/turnend-guard.md
index 8ee750de39..6101d0aa93 100644
--- a/docs/turnend-guard.md
+++ b/docs/turnend-guard.md
@@ -82,7 +82,7 @@ That warning uses `bin/fm-supervision-instructions.sh --repair-line`, so it alwa
 - Kimi Code CLI 0.29.1 exposes only global `[[hooks]]` configuration in `~/.kimi-code/config.toml`, including a `Stop` event with snake_case payload fields `hook_event_name`, `session_id`, `cwd`, and `stop_hook_active`.
 - Kimi has no project-level hook configuration and remains outside the primary guard integrations above.
 - Captain-approved Kimi crew wake support uses `bin/fm-kimi-turnend-hook.sh` to edit only one marker-delimited Firstmate region in that global config and install a silent always-zero hook.
-- The hook remains inert unless the payload `cwd` contains a per-task token pointer that resolves through Firstmate's private registry to one `state/<id>.turn-ended` marker.
+- The hook remains inert unless a launch-scoped `FM_KIMI_TURNEND_TOKEN` or the payload `cwd`'s per-task token pointer resolves through Firstmate's private registry to one `state/<id>.turn-ended` marker.
 - Installation refuses before writing unless `python3` with `tomllib` and `jq` are available.
 - If `jq` is removed after installation, the hook remains silent and exits 0, turn-end wakes stop, and Kimi crews fall back to idle detection.
 - Unreadable hook input remains fail-open.
diff --git a/docs/verification/runtime-backends.md b/docs/verification/runtime-backends.md
index 65152100f4..84a18ee1bc 100644
--- a/docs/verification/runtime-backends.md
+++ b/docs/verification/runtime-backends.md
@@ -117,6 +117,26 @@ Valid cleanup removed only the exact task-bound target and left the control wind
 The metadata-only validation covers tmux, Herdr, Zellij, Orca, and cmux before backend dispatch.
 Claude, Codex, OpenCode, Pi, pi-signed, Grok, and Kimi share that backend cleanup boundary; their harness-specific hook files and token cleanup run only after it, so no harness needs a separate endpoint parser.
 
+### Host-root task routing
+
+The rebased host-root path was live-verified on 2026-07-26 with tmux 3.7b, Treehouse 2.0.0, and Codex CLI 0.145.0 on Linux.
+The command shape was:
+
+```sh
+cd "$host"
+TMUX_TMPDIR="$socket_dir" \
+FM_ROOT_OVERRIDE="$firstmate_root" \
+FM_HOME="$firstmate_home" \
+FM_HOST_ROOT="$host" \
+FM_BACKEND=tmux \
+  "$firstmate_root/bin/fm-spawn.sh" "$task_id" "$target_primary" \
+    --harness codex --scout
+```
+
+The worker observed its physical cwd equal to `FM_HOST_ROOT`, its target Git root equal to the physical `FM_TARGET_WORKTREE`, and the target as a detached linked worktree distinct from the clean primary checkout.
+It loaded the host and target `AGENTS.md` files, completed the decision inventory, wrote the scout report outside both repositories, and cleaned up through `bin/fm-teardown.sh`.
+The host's native startup lifecycle remained active, so host-owned lifecycle effects were allowed rather than treated as task edits.
+
 ## Herdr
 
 The compatibility floor is protocol 14.
diff --git a/docs/verification/supervision.md b/docs/verification/supervision.md
index 20f415e456..fcab4f1ca5 100644
--- a/docs/verification/supervision.md
+++ b/docs/verification/supervision.md
@@ -60,6 +60,33 @@ The Ahoy first-message boundary was reverified on 2026-07-22 with Pi 0.81.1 and
 Marked current operational input and the two exact legacy compatibility shapes selected Bearings, while genuine near-miss captain messages remained real boundaries.
 The detailed reconciliation and task chronology stay in the private audit report and PR evidence.
 
+## Host-root task integration
+
+The additive task lifecycle adapters were checked on Linux on 2026-07-19 with Codex 0.144.5, OpenCode 1.17.14, Pi 0.80.10, and Claude Code 2.1.214.
+Codex and OpenCode each loaded the host `AGENTS.md`, emitted one host session-start event, one host completion event, and one task completion event when launched with the state-owned adapter configuration rendered by `bin/fm-spawn.sh`.
+Pi loaded one host extension and one explicit task extension once each for a single-turn probe, and a trusted FirstMate-root run confirmed project extension discovery coexists with an explicit task extension.
+The exact Claude probe was:
+
+```sh
+claude -p --settings "$task_settings" --dangerously-skip-permissions \
+  'Complete one turn and exit.'
+```
+
+The host project `SessionStart` hook fired once, proving `--settings` remains additive to project settings, but organization policy blocked model access before Stop and prevented live task-hook confirmation.
+Grok was unavailable, so its launch-scoped host-root token remains generated and focused-test verified rather than live verified.
+Kimi 0.29.1 launch and global-hook mechanics were live-verified on 2026-07-25, while its launch-scoped host-root token remains focused-test verified rather than live lifecycle verified.
+The reusable deterministic entry points are:
+
+```sh
+tests/fm-host-root-mode.test.sh
+tests/fm-grok-harness.test.sh
+tests/fm-kimi-harness.test.sh
+```
+
+A rebased Codex 0.145.0 scout repeated the integrated path on 2026-07-26 through tmux 3.7b.
+It loaded the host and target instruction surfaces, preserved the separate target worktree, completed the decision inventory, emitted its task completion, retained the report, and cleaned up while the host's native startup lifecycle remained active.
+[`runtime-backends.md`](runtime-backends.md#host-root-task-routing) owns the exact spawn command and path-routing evidence.
+
 ## Turn-end guard
 
 The direct and passive mechanisms were validated across all five harnesses on 2026-07-08 through 2026-07-12, with Claude's replacement Stop-owned path revalidated on 2026-07-24.
diff --git a/tests/fm-backend-cmux.test.sh b/tests/fm-backend-cmux.test.sh
index 152f78eb7c..ccf1a7f6cb 100755
--- a/tests/fm-backend-cmux.test.sh
+++ b/tests/fm-backend-cmux.test.sh
@@ -989,6 +989,67 @@ test_list_live_filters_by_title_prefix() {
   pass "fm_backend_cmux_list_live: lists only this home's scoped task workspaces using plain fm-<id> labels"
 }
 
+# --- fm-teardown.sh: secondmate child-home cleanup ---------------------------
+
+test_forced_secondmate_teardown_uses_child_cmux_config() {
+  local dir state data config home project fb out status child_title
+  dir="$TMP_ROOT/teardown-cmux-secondmate-child"
+  state="$dir/state"; data="$dir/data"; config="$dir/config"; home="$dir/secondmate-home"; project="$dir/project"
+  mkdir -p "$state" "$data" "$config" "$home/state" "$home/data" "$home/config" "$home/projects" "$project" "$dir/responses"
+  printf 'smc\n' > "$home/.fm-secondmate-home"
+  printf 'parent-secret\n' > "$config/cmux-socket-password"
+  printf 'child-secret\n' > "$home/config/cmux-socket-password"
+  fm_write_meta "$state/smc.meta" \
+    "window=firstmate:99" \
+    "worktree=$home" \
+    "project=$home" \
+    "kind=secondmate" \
+    "mode=secondmate" \
+    "home=$home"
+  fm_write_meta "$home/state/childc.meta" \
+    "window=ws-child:sf-child" \
+    "backend=cmux" \
+    "cmux_workspace_id=ws-child" \
+    "cmux_surface_id=sf-child" \
+    "worktree=$dir/missing-child-worktree" \
+    "project=$project" \
+    "kind=scout"
+  child_title=$(cmux_expected_scoped_title fm-childc "$home" "$home")
+  cmux_workspace_list_response "$dir" 1 ws-child "$child_title" ws-other default
+  cmux_panes_response "$dir" 2 sf-child
+  cmux_workspace_list_response "$dir" 3 ws-child "$child_title" ws-other default
+  cmux_panes_response "$dir" 4 sf-child
+  cmux_windows_response "$dir" 5 win-child 2
+  cmux_workspace_list_response "$dir" 6 ws-child "$child_title" ws-other default
+  : > "$dir/responses/7.out"
+  printf '{"workspaces":[]}' > "$dir/responses/8.out"
+  fb=$(make_cmux_fakebin "$dir")
+  cat > "$fb/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+stopped="${FM_CMUX_LOG}.tmux-stopped"
+case "${1:-}" in
+  kill-window) : > "$stopped" ;;
+  display-message) [ ! -e "$stopped" ] && printf '%%1\n' ;;
+  list-panes) exit 0 ;;
+  *) exit 0 ;;
+esac
+SH
+  chmod +x "$fb/tmux"
+  out=$( PATH="$fb:$PATH" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
+    FM_ROOT_OVERRIDE="$ROOT" FM_CMUX_LOG="$dir/log" FM_CMUX_RESPONSES="$dir/responses" \
+    "$ROOT/bin/fm-teardown.sh" smc --force 2>&1 )
+  status=$?
+  expect_code 0 "$status" "fm-teardown should force-retire a secondmate with a cmux child: $out"
+  assert_contains "$(cat "$dir/log")" $'close-workspace\x1f--workspace\x1fws-child' \
+    "forced secondmate teardown did not close the child cmux workspace"
+  assert_contains "$(cat "$dir/log")" 'CMUX_SOCKET_PASSWORD=child-secret' \
+    "forced secondmate teardown did not use the child home's cmux password"
+  assert_not_contains "$(cat "$dir/log")" 'CMUX_SOCKET_PASSWORD=parent-secret' \
+    "forced secondmate teardown leaked the parent cmux password into child cleanup"
+  pass "fm-teardown.sh: force cleanup uses the child home for cmux workers"
+}
+
 # --- fm-spawn.sh: --secondmate refuses backend=cmux --------------------------
 
 test_secondmate_spawn_refuses_cmux_backend() {
@@ -1060,4 +1121,5 @@ test_kill_adds_sibling_when_last_in_window
 test_kill_is_best_effort_when_close_workspace_fails
 test_kill_recovers_stale_target_by_label
 test_list_live_filters_by_title_prefix
+test_forced_secondmate_teardown_uses_child_cmux_config
 test_secondmate_spawn_refuses_cmux_backend
diff --git a/tests/fm-backend-orca.test.sh b/tests/fm-backend-orca.test.sh
index a54e448d10..3d12ba0bdb 100755
--- a/tests/fm-backend-orca.test.sh
+++ b/tests/fm-backend-orca.test.sh
@@ -23,6 +23,9 @@ next=$(( $(cat "$COUNT_FILE" 2>/dev/null || echo 0) + 1 ))
   for a in "$@"; do printf '\x1f%s' "$a"; done
   printf '\n'
 } >> "$LOG"
+if [ "${1:-}" = terminal ] && [ "${2:-}" = close ] && [ -n "${FM_ORCA_CLOSE_MUTATION:-}" ]; then
+  printf 'late worker edit\n' > "$FM_ORCA_CLOSE_MUTATION"
+fi
 if [ "${1:-}" = status ] && [ "${FM_ORCA_STATUS_RESPONSE:-ready}" != sequence ]; then
   printf '{"ok":true,"result":{"runtime":{"reachable":true,"state":"ready"}}}\n'
   exit 0
@@ -65,12 +68,17 @@ add_tmux_fake() {
 #!/usr/bin/env bash
 set -u
 LOG="${FM_ORCA_LOG:?}"
+stopped="${0}.stopped"
 {
   printf 'tmux'
   for a in "$@"; do printf '\x1f%s' "$a"; done
   printf '\n'
 } >> "$LOG"
-exit 0
+case "${1:-}" in
+  kill-window) : > "$stopped" ;;
+  display-message) [ ! -e "$stopped" ] ;;
+  *) exit 0 ;;
+esac
 SH
   chmod +x "$fb/tmux"
 }
@@ -130,7 +138,54 @@ test_runtime_check_refuses_unready_orca_status() {
   status=$?
   [ "$status" -ne 0 ] || fail "runtime_check should fail when Orca runtime is not ready"
   assert_contains "$out" "requires a ready Orca runtime" "runtime_check should explain the readiness requirement"
-  pass "fm_backend_orca_runtime_check: fails closed when runtime is not ready"
+  pass "fm_backend_orca_runtime_check: fails closed when Orca runtime is not ready"
+}
+
+test_current_path_probe_sends_once_and_bounds_reads() {
+  local out counts
+  out=$(FM_ORCA_CWD_PROBE_ATTEMPTS=3 FM_ORCA_CWD_PROBE_DELAY=0 bash -c '
+    . "$1/bin/backends/orca.sh"
+    count_file=$2
+    printf "0\n" > "$count_file"
+    sends=0
+    fm_backend_orca_send_text_line() {
+      sends=$((sends + 1))
+      markers=$(printf "%s\n" "$2" | grep -o "__FM_ORCA_CWD_[A-Z]*_[A-Za-z0-9_]*__")
+      begin=$(printf "%s\n" "$markers" | head -1)
+      end=$(printf "%s\n" "$markers" | tail -1)
+    }
+    fm_backend_orca_read_text_paged() {
+      reads=$(( $(cat "$count_file") + 1 ))
+      printf "%s\n" "$reads" > "$count_file"
+      [ "$reads" -lt 2 ] || printf "%s\n" "$begin" "/tmp/orca root with spaces" "$end"
+    }
+    probe_out=$(mktemp)
+    fm_backend_orca_current_path terminal-1 > "$probe_out"
+    printf "%s\n%s:%s\n" "$(cat "$probe_out")" "$sends" "$(cat "$count_file")"
+    rm -f "$probe_out"
+  ' _ "$ROOT" "$TMP_ROOT/current-path-count")
+  counts=$(printf '%s\n' "$out" | tail -1)
+  [ "$(printf '%s\n' "$out" | head -1)" = '/tmp/orca root with spaces' ] \
+    || fail "current_path did not return the single physical path line"
+  [ "$counts" = '1:2' ] || fail "current_path should send once and stop after the matching read, got $counts"
+
+  out=$(FM_ORCA_CWD_PROBE_ATTEMPTS=3 FM_ORCA_CWD_PROBE_DELAY=0 bash -c '
+    . "$1/bin/backends/orca.sh"
+    count_file=$2
+    printf "0\n" > "$count_file"
+    sends=0
+    fm_backend_orca_send_text_line() { sends=$((sends + 1)); }
+    fm_backend_orca_read_text_paged() {
+      reads=$(( $(cat "$count_file") + 1 ))
+      printf "%s\n" "$reads" > "$count_file"
+    }
+    probe_out=$(mktemp)
+    fm_backend_orca_current_path terminal-2 > "$probe_out"
+    printf "%s:%s:%s\n" "$(cat "$probe_out")" "$sends" "$(cat "$count_file")"
+    rm -f "$probe_out"
+  ' _ "$ROOT" "$TMP_ROOT/current-path-empty-count")
+  [ "$out" = ':1:3' ] || fail "current_path probe was not bounded to one send and three reads, got $out"
+  pass "fm_backend_orca_current_path: one command, unique markers, bounded reads"
 }
 
 test_send_text_submit_verifies_empty_composer_after_enter() {
@@ -415,7 +470,7 @@ test_worktree_and_terminal_helpers_parse_json() {
   pass "Orca lifecycle helpers: register repo, create worktree, create terminal, parse stable ids"
 }
 
-test_worktree_create_removes_worktree_when_path_missing() {
+test_worktree_create_defers_pathless_cleanup_to_verified_rollback() {
   local out status
   orca_case lifecycle-missing-path
   printf '1\n' > "$RESP/1.exit"
@@ -427,11 +482,48 @@ test_worktree_create_removes_worktree_when_path_missing() {
   [ "$status" -ne 0 ] || fail "worktree helper should fail when Orca omits the worktree path"
   assert_contains "$out" "orca worktree create did not return a path for fm-task" \
     "worktree helper did not explain the missing path"
-  assert_contains "$(cat "$LOG")" $'orca\x1f''terminal'$'\x1f''close'$'\x1f''--terminal'$'\x1f''term-no-path'$'\x1f''--json' \
-    "worktree helper did not close the implicit terminal when path parsing failed"
-  assert_contains "$(cat "$LOG")" $'orca\x1f''worktree'$'\x1f''rm'$'\x1f''--worktree'$'\x1f''id:wt-no-path'$'\x1f''--force'$'\x1f''--json' \
-    "worktree helper did not remove the pathless Orca worktree"
-  pass "fm_backend_orca_worktree_create: removes created worktree when path is missing"
+  assert_contains "$out" $'wt-no-path\t\tterm-no-path' \
+    "worktree helper did not return recoverable worktree/terminal ids"
+  assert_no_grep $'orca\x1fterminal\x1fclose' "$LOG" \
+    "pathless helper bypassed verified rollback by closing the terminal itself"
+  assert_no_grep $'orca\x1fworktree\x1frm' "$LOG" \
+    "pathless helper removed a worktree before terminal absence was confirmed"
+  pass "fm_backend_orca_worktree_create: defers pathless cleanup to verified rollback"
+}
+
+test_spawn_preserves_pathless_orca_worktree_when_terminal_stop_is_unknown() {
+  local proj data state config id out status log_text
+  id="orcapathless-termz7"
+  proj="$TMP_ROOT/pathless-terminal-project"
+  data="$TMP_ROOT/pathless-terminal-data"
+  state="$TMP_ROOT/pathless-terminal-state"
+  config="$TMP_ROOT/pathless-terminal-config"
+  fm_git_init_commit "$proj"
+  mkdir -p "$data/$id" "$state" "$config"
+  printf 'brief\n' > "$data/$id/brief.md"
+  touch "$state/.last-watcher-beat"
+  orca_case pathless-terminal-unknown
+  printf '1\n' > "$RESP/1.exit"
+  printf '{"ok":true,"result":{"repo":{"id":"repo-pathless-terminal"}}}\n' > "$RESP/2.out"
+  printf '{"ok":true,"result":{"worktree":{"id":"wt-pathless-terminal"},"terminal":{"handle":"term-pathless-terminal"}}}\n' > "$RESP/3.out"
+  printf '{"ok":true,"result":{}}\n' > "$RESP/4.out"
+  printf 'not-json\n' > "$RESP/5.out"
+  out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
+    FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 \
+    FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
+    FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" FM_SPAWN_NO_GUARD=1 \
+    "$ROOT/bin/fm-spawn.sh" "$id" "$proj" claude --backend orca 2>&1 )
+  status=$?
+  [ "$status" -ne 0 ] || fail "Orca spawn should fail when path parsing fails"
+  log_text=$(cat "$LOG")
+  assert_contains "$log_text" $'orca\x1f''terminal'$'\x1f''close'$'\x1f''--terminal'$'\x1f''term-pathless-terminal'$'\x1f''--json' \
+    "verified rollback did not attempt to stop the pathless terminal"
+  assert_no_grep $'orca\x1fworktree\x1frm' "$LOG" \
+    "unknown terminal state allowed destructive pathless worktree removal"
+  assert_present "$state/$id.meta" "unknown terminal state should preserve recovery metadata"
+  assert_grep 'orca_worktree_id=wt-pathless-terminal' "$state/$id.meta" "metadata missing pathless worktree id"
+  assert_grep 'terminal=term-pathless-terminal' "$state/$id.meta" "metadata missing pathless terminal id"
+  pass "fm-spawn.sh --backend orca: unknown terminal stop preserves pathless worktree and metadata"
 }
 
 test_spawn_preserves_orca_metadata_when_pathless_worktree_cleanup_fails() {
@@ -579,6 +671,9 @@ test_spawn_refuses_orca_nonisolated_worktree() {
   printf '1\n' > "$RESP/1.exit"
   printf '{"ok":true,"result":{"repo":{"id":"repo-bad"}}}\n' > "$RESP/2.out"
   printf '{"ok":true,"result":{"worktree":{"id":"wt-bad","path":"%s"},"terminal":{"handle":"term-bad"}}}\n' "$proj" > "$RESP/3.out"
+  printf '{"ok":true}\n' > "$RESP/4.out"
+  printf '{"ok":false,"error":{"code":"terminal_handle_stale","message":"terminal gone"}}\n' > "$RESP/5.out"
+  printf '{"ok":true}\n' > "$RESP/6.out"
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" FM_SPAWN_NO_GUARD=1 \
@@ -680,6 +775,9 @@ test_spawn_releases_orca_resources_when_metadata_write_fails() {
   printf '{"ok":true,"result":{"repo":{"id":"repo-meta-fail"}}}\n' > "$RESP/2.out"
   printf '{"ok":true,"result":{"worktree":{"id":"wt-meta-fail","path":"%s"}}}\n' "$wt" > "$RESP/3.out"
   printf '{"ok":true,"result":{"terminal":{"handle":"term-meta-fail"}}}\n' > "$RESP/4.out"
+  printf '{"ok":true}\n' > "$RESP/5.out"
+  printf '{"ok":false,"error":{"code":"terminal_handle_stale","message":"terminal gone"}}\n' > "$RESP/6.out"
+  printf '{"ok":true}\n' > "$RESP/7.out"
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" FM_SPAWN_NO_GUARD=1 \
@@ -791,6 +889,9 @@ test_scout_teardown_removes_orca_worktree_via_helper() {
     "decisions_reviewed=1" "decision_keys="
   orca_case teardown
   printf '{"ok":true,"result":{"worktree":{"id":"wt-teardown","path":"%s"}}}\n' "$wt" > "$RESP/1.out"
+  printf '{"ok":true}\n' > "$RESP/2.out"
+  printf '{"ok":false,"error":{"code":"terminal_handle_stale","message":"terminal gone"}}\n' > "$RESP/3.out"
+  printf '{"ok":true}\n' > "$RESP/4.out"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
   set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
@@ -863,6 +964,9 @@ test_teardown_removes_orca_worktree_when_path_missing() {
     "backend=orca" "orca_worktree_id=wt-missing-path" \
     "decisions_reviewed=1" "decision_keys="
   orca_case missing-path
+  printf '{"ok":true}\n' > "$RESP/1.out"
+  printf '{"ok":false,"error":{"code":"terminal_handle_stale","message":"terminal gone"}}\n' > "$RESP/2.out"
+  printf '{"ok":true}\n' > "$RESP/3.out"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
   set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
@@ -896,8 +1000,9 @@ test_teardown_preserves_metadata_when_orca_remove_error_json() {
     "backend=orca" "orca_worktree_id=wt-remove-error" \
     "decisions_reviewed=1" "decision_keys="
   orca_case remove-error-teardown
-  printf '{"ok":true,"result":{}}\n' > "$RESP/1.out"
-  printf '{"ok":false,"error":{"code":"worktree_not_removed","message":"worktree not removed"}}\n' > "$RESP/2.out"
+  printf '{"ok":true}\n' > "$RESP/1.out"
+  printf '{"ok":false,"error":{"code":"terminal_handle_stale","message":"terminal gone"}}\n' > "$RESP/2.out"
+  printf '{"ok":false,"error":{"code":"worktree_not_removed","message":"worktree not removed"}}\n' > "$RESP/3.out"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
   set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
@@ -988,6 +1093,9 @@ test_ship_teardown_removes_orca_worktree_when_id_path_matches() {
     "backend=orca" "orca_worktree_id=wt-ship-match"
   orca_case ship-match
   printf '{"ok":true,"result":{"worktree":{"id":"wt-ship-match","path":"%s"}}}\n' "$wt" > "$RESP/1.out"
+  printf '{"ok":true}\n' > "$RESP/2.out"
+  printf '{"ok":false,"error":{"code":"terminal_handle_stale","message":"terminal gone"}}\n' > "$RESP/3.out"
+  printf '{"ok":true}\n' > "$RESP/4.out"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
   set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
@@ -1006,6 +1114,42 @@ test_ship_teardown_removes_orca_worktree_when_id_path_matches() {
   pass "fm-teardown.sh backend=orca: ship teardown requires a matching Orca id path"
 }
 
+test_ship_teardown_rechecks_safety_after_terminal_stop() {
+  local proj wt data state config id out rc neutral
+  id="orcashipracez9"
+  proj="$TMP_ROOT/ship-race-project"
+  wt="$TMP_ROOT/ship-race-wt"
+  data="$TMP_ROOT/ship-race-data"
+  state="$TMP_ROOT/ship-race-state"
+  config="$TMP_ROOT/ship-race-config"
+  fm_git_worktree "$proj" "$wt" "fm/$id"
+  mkdir -p "$data/$id" "$state" "$config"
+  touch "$state/.last-watcher-beat"
+  fm_write_meta "$state/$id.meta" \
+    "window=fm-$id" "terminal=term-ship-race" "worktree=$wt" "project=$proj" \
+    "harness=claude" "kind=ship" "mode=no-mistakes" "yolo=off" \
+    "backend=orca" "orca_worktree_id=wt-ship-race"
+  orca_case ship-race
+  printf '{"ok":true,"result":{"worktree":{"id":"wt-ship-race","path":"%s"}}}\n' "$wt" > "$RESP/1.out"
+  printf '{"ok":true}\n' > "$RESP/2.out"
+  printf '{"ok":false,"error":{"code":"terminal_handle_stale","message":"terminal gone"}}\n' > "$RESP/3.out"
+  neutral=$(neutral_fm_root "$CASE_DIR/neutral")
+  set +e
+  out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
+    FM_ORCA_CLOSE_MUTATION="$wt/late-edit.txt" FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 \
+    FM_ROOT_OVERRIDE="$neutral" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
+    "$ROOT/bin/fm-teardown.sh" "$id" 2>&1 )
+  rc=$?
+  set -e
+  [ "$rc" -ne 0 ] || fail "Orca ship teardown discarded an edit written during terminal stop (log: $(tr '\n' ';' < "$LOG"); status: $(git -C "$wt" status --porcelain 2>/dev/null | tr '\n' ';'))"
+  assert_contains "$out" "uncommitted changes" "post-stop safety refusal did not explain the late edit"
+  assert_present "$wt/late-edit.txt" "post-stop safety refusal lost the late worker edit"
+  assert_present "$state/$id.meta" "post-stop safety refusal removed task metadata"
+  assert_not_contains "$(cat "$LOG")" $'orca\x1f''worktree'$'\x1f''rm' \
+    "post-stop safety refusal removed the Orca worktree"
+  pass "fm-teardown.sh backend=orca: rechecks worktree safety after stopping the terminal"
+}
+
 test_ship_teardown_refuses_orca_unresolvable_worktree_id() {
   local proj wt data state config id out rc neutral
   id="orcashipunresolvedz1"
@@ -1168,6 +1312,9 @@ test_secondmate_force_teardown_removes_orca_child_via_orca() {
     "backend=orca" "orca_worktree_id=wt-child-cleanup"
   orca_case secondmate-child-cleanup
   printf '{"ok":true,"result":{"worktree":{"id":"wt-child-cleanup","path":"%s"}}}\n' "$childwt" > "$RESP/1.out"
+  printf '{"ok":true}\n' > "$RESP/2.out"
+  printf '{"ok":false,"error":{"code":"terminal_handle_stale","message":"terminal gone"}}\n' > "$RESP/3.out"
+  printf '{"ok":true}\n' > "$RESP/4.out"
   add_tmux_fake "$FB"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
   set +e
@@ -1281,6 +1428,7 @@ test_capture_falls_back_to_text_fields
 test_capture_fails_on_orca_error_json
 test_runtime_check_accepts_ready_orca_status
 test_runtime_check_refuses_unready_orca_status
+test_current_path_probe_sends_once_and_bounds_reads
 test_send_text_submit_verifies_empty_composer_after_enter
 test_send_text_submit_keeps_current_tail_when_limited
 test_send_text_submit_retries_when_composer_stays_pending
@@ -1300,7 +1448,8 @@ test_worktree_path_resolves_id
 test_dispatcher_sources_orca_and_routes_primitives
 test_json_get_ignores_undocumented_terminal_id_shapes
 test_worktree_and_terminal_helpers_parse_json
-test_worktree_create_removes_worktree_when_path_missing
+test_worktree_create_defers_pathless_cleanup_to_verified_rollback
+test_spawn_preserves_pathless_orca_worktree_when_terminal_stop_is_unknown
 test_spawn_preserves_orca_metadata_when_pathless_worktree_cleanup_fails
 test_spawn_writes_orca_metadata_and_launches_harness
 test_spawn_refuses_orca_secondmate_before_home_mutation
@@ -1319,6 +1468,7 @@ test_teardown_preserves_metadata_when_orca_remove_error_json
 test_scout_teardown_refuses_orca_missing_report_when_path_missing
 test_ship_teardown_refuses_orca_missing_worktree_path
 test_ship_teardown_removes_orca_worktree_when_id_path_matches
+test_ship_teardown_rechecks_safety_after_terminal_stop
 test_ship_teardown_refuses_orca_unresolvable_worktree_id
 test_ship_teardown_refuses_orca_id_path_mismatch
 test_teardown_refuses_orca_missing_worktree_id
diff --git a/tests/fm-backend-tmux-smoke.test.sh b/tests/fm-backend-tmux-smoke.test.sh
index aa1e07c326..adb5dd4531 100755
--- a/tests/fm-backend-tmux-smoke.test.sh
+++ b/tests/fm-backend-tmux-smoke.test.sh
@@ -75,6 +75,16 @@ pass "real tmux: fm_backend_tmux_create_task creates a window and refuses a dupl
 
 # --- send text + Enter -------------------------------------------------------
 
+# The operator's tmux default-command may be fish/zsh; make this Bash behavior
+# test explicit instead of assuming the login shell understands Bash syntax.
+tmux send-keys -t "$TARGET" "exec bash --noprofile --norc" Enter
+for _ in $(seq 1 30); do
+  [ "$(tmux display-message -p -t "$TARGET" '#{pane_current_command}')" = bash ] && break
+  sleep 0.1
+done
+[ "$(tmux display-message -p -t "$TARGET" '#{pane_current_command}')" = bash ] \
+  || fail "real tmux: task window did not enter the explicit Bash test shell"
+
 # A newly-created interactive shell can exist before its startup files and line
 # editor are ready to accept Enter. Prove command execution with an output token
 # that does not appear contiguously in the command, retrying the harmless probe
diff --git a/tests/fm-backend-zellij.test.sh b/tests/fm-backend-zellij.test.sh
index ae4be257bd..f8aeef5c2e 100755
--- a/tests/fm-backend-zellij.test.sh
+++ b/tests/fm-backend-zellij.test.sh
@@ -808,6 +808,7 @@ test_teardown_passes_recorded_tab_id_to_zellij_kill() {
     "decision_keys="
   printf '[]\n' > "$dir/responses/1.out"
   printf '[{"tab_id":3,"name":"fm-zghost"}]\n' > "$dir/responses/2.out"
+  printf '[]\n' > "$dir/responses/4.out"
   fb=$(make_zellij_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_ZELLIJ_LOG="$dir/log" FM_ZELLIJ_RESPONSES="$dir/responses" FM_ZELLIJ_SESSION_LIST="firstmate" \
@@ -851,9 +852,12 @@ test_forced_secondmate_teardown_kills_zellij_children_with_child_home_tag() {
     "project=$project" \
     "kind=scout"
   child_title=$(zellij_expected_scoped_title fm-childz "$home" "$home")
-  zellij_pane_response "$dir" 1 7 4
-  zellij_tab_response "$dir" 2 4 "$child_title"
-  printf '[]\n' > "$dir/responses/3.out"
+  printf '[]\n' > "$dir/responses/1.out"
+  printf '[]\n' > "$dir/responses/2.out"
+  zellij_pane_response "$dir" 3 7 4
+  zellij_tab_response "$dir" 4 4 "$child_title"
+  printf '[]\n' > "$dir/responses/5.out"
+  printf '[]\n' > "$dir/responses/6.out"
   fb=$(make_zellij_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_ROOT_OVERRIDE="$ROOT" \
diff --git a/tests/fm-backend.test.sh b/tests/fm-backend.test.sh
index 7ac873f087..4323bf4b42 100755
--- a/tests/fm-backend.test.sh
+++ b/tests/fm-backend.test.sh
@@ -141,7 +141,7 @@ resolve_permissive_tmux_kill_ref() {
 # hence the dispatcher is a copied sibling, while the tmux adapter is extracted
 # from BASE_REF so conformance tests retain the exact historical behavior even
 # when this branch changes tmux dispatch semantics.
-OLD_BIN_UNCHANGED_SIBLINGS="fm-gate-refuse-lib.sh fm-guard.sh fm-lock-lib.sh fm-tasks-axi-lib.sh fm-pr-lib.sh fm-tangle-lib.sh fm-tmux-lib.sh fm-composer-lib.sh fm-wake-lib.sh fm-classify-lib.sh fm-supervision-lib.sh fm-ff-lib.sh fm-config-inherit-lib.sh fm-project-mode.sh fm-harness.sh fm-crew-state.sh fm-decision-hold.sh fm-backend.sh fm-operational-input.sh"
+OLD_BIN_UNCHANGED_SIBLINGS="fm-gate-refuse-lib.sh fm-guard.sh fm-lock-lib.sh fm-tasks-axi-lib.sh fm-pr-lib.sh fm-tangle-lib.sh fm-tmux-lib.sh fm-composer-lib.sh fm-wake-lib.sh fm-classify-lib.sh fm-supervision-lib.sh fm-ff-lib.sh fm-config-inherit-lib.sh fm-project-mode.sh fm-harness.sh fm-crew-state.sh fm-decision-hold.sh fm-host-root-lib.sh fm-backend.sh fm-operational-input.sh"
 # A pull-request merge may add a new main-only dependency that the branch's older baseline does not have yet.
 OLD_BIN_OPTIONAL_SIBLINGS="fm-pending-reply-lib.sh"
 OLD_BIN_REFACTORED="fm-send.sh fm-peek.sh fm-watch.sh fm-spawn.sh fm-teardown.sh fm-marker-lib.sh"
@@ -931,8 +931,13 @@ make_teardown_fakebin() {  # <dir> -> echoes fakebin dir; logs tmux+treehouse ca
   cat > "$fb/tmux" <<'SH'
 #!/usr/bin/env bash
 set -u
+stopped="${0}.stopped"
 { printf 'tmux'; for a in "$@"; do printf '\x1f%s' "$a"; done; printf '\n'; } >> "${FM_TMUX_LOG:?}"
-exit 0
+case "${1:-}" in
+  kill-window) : > "$stopped" ;;
+  display-message) [ ! -e "$stopped" ] ;;
+  *) exit 0 ;;
+esac
 SH
   cat > "$fb/treehouse" <<'SH'
 #!/usr/bin/env bash
@@ -1020,6 +1025,157 @@ test_teardown_conformance_old_vs_new() {
   pass "fm-teardown.sh: treehouse return remains compatible while tmux cleanup uses exact selectors"
 }
 
+test_adapter_post_create_failure_records_ownership() {
+  local out counter="$TMP_ROOT/cmux-create-counter"
+  out=$(bash -c '
+    . "$1/bin/fm-backend.sh"; fm_backend_source herdr
+    fm_backend_herdr_cli() {
+      case "$*" in
+        *"tab list"*) printf "%s" "{\"result\":{\"tabs\":[]}}" ;;
+        *"tab create"*) printf "%s" "{\"result\":{\"tab\":{\"tab_id\":\"tab-7\"}}}" ;;
+      esac
+    }
+    fm_backend_herdr_create_task session:ws fm-task /tmp "" >/dev/null 2>&1
+    rc=$?
+    printf "%s|%s|%s|%s" "$rc" "$FM_BACKEND_CREATE_OCCURRED" "$FM_BACKEND_CREATED_HERDR_TAB_ID" "$FM_BACKEND_CREATED_TARGET"
+  ' _ "$ROOT")
+  [ "$out" = "1|1|tab-7|" ] || fail "herdr did not retain partial post-create ownership: '$out'"
+
+  out=$(bash -c '
+    . "$1/bin/fm-backend.sh"; fm_backend_source zellij
+    fm_backend_zellij_session_exists() { return 0; }
+    fm_backend_zellij_cli() {
+      case "$*" in
+        *"list-tabs"*) printf "%s" "[]" ;;
+        *"new-tab"*) printf "7\n" ;;
+        *"list-panes"*) printf "%s" "[]" ;;
+      esac
+    }
+    fm_backend_zellij_create_task firstmate fm-task /tmp >/dev/null 2>&1
+    rc=$?
+    printf "%s|%s|%s|%s" "$rc" "$FM_BACKEND_CREATE_OCCURRED" "$FM_BACKEND_CREATED_ZELLIJ_TAB_ID" "$FM_BACKEND_CREATED_TARGET"
+  ' _ "$ROOT")
+  [ "$out" = "1|1|7|" ] || fail "zellij did not retain partial post-create ownership: '$out'"
+
+  printf '0\n' > "$counter"
+  out=$(FM_CMUX_CREATE_COUNTER="$counter" bash -c '
+    . "$1/bin/fm-backend.sh"; fm_backend_source cmux
+    fm_backend_cmux_cli() {
+      case "$*" in
+        *"workspace list"*)
+          n=$(cat "$FM_CMUX_CREATE_COUNTER"); n=$((n + 1)); printf "%s" "$n" > "$FM_CMUX_CREATE_COUNTER"
+          if [ "$n" -eq 1 ]; then printf "%s" "{\"workspaces\":[]}"; else printf "%s" "{\"workspaces\":[{\"id\":\"ws-7\",\"title\":\"fm-task\"}]}"; fi
+          ;;
+        *"new-workspace"*) return 0 ;;
+        *"list-panes"*) printf "%s" "{\"panes\":[]}" ;;
+      esac
+    }
+    fm_backend_cmux_scoped_title() { printf fm-task; }
+    fm_backend_cmux_create_task fm-task /tmp >/dev/null 2>&1
+    rc=$?
+    printf "%s|%s|%s|%s" "$rc" "$FM_BACKEND_CREATE_OCCURRED" "$FM_BACKEND_CREATED_CMUX_WORKSPACE_ID" "$FM_BACKEND_CREATED_TARGET"
+  ' _ "$ROOT")
+  [ "$out" = "1|1|ws-7|" ] || fail "cmux did not retain partial post-create ownership: '$out'"
+  pass "post-create adapter failures retain partial endpoint ownership for verified spawn rollback"
+}
+
+test_adapter_target_state_matrices() {
+  local out
+  out=$(bash -c '
+    . "$1/bin/fm-backend.sh"; fm_backend_source tmux
+    tmux() {
+      case "$CASE:${1:-}" in
+        present:list-panes) printf "%%7|@3|session:fm-task|session:3.0\n"; return 0 ;;
+        absent:list-panes) printf "%%1|@1|session:captain|session:1.0\n"; return 0 ;;
+        unknown:list-panes) printf "transport failure\n" >&2; return 1 ;;
+      esac
+    }
+    for CASE in present absent unknown; do fm_backend_tmux_target_state session:fm-task; printf " "; done
+  ' _ "$ROOT")
+  [ "$out" = "present absent unknown " ] || fail "tmux exact-inventory tri-state matrix drifted: '$out'"
+
+  out=$(bash -c '
+    . "$1/bin/fm-backend.sh"; fm_backend_source herdr
+    fm_backend_herdr_cli() {
+      case "$CASE" in
+        present) printf "%s" "{\"result\":{\"pane\":{\"pane_id\":\"w:p\"}}}" ;;
+        absent) printf "%s" "{\"error\":{\"code\":\"pane_not_found\"}}" ;;
+        unknown) printf "%s" "not-json" ;;
+      esac
+    }
+    for CASE in present absent unknown; do fm_backend_herdr_target_state session:w:p; printf " "; done
+  ' _ "$ROOT")
+  [ "$out" = "present absent unknown " ] || fail "herdr tri-state matrix drifted: '$out'"
+
+  out=$(bash -c '
+    . "$1/bin/fm-backend.sh"; fm_backend_source zellij
+    zellij() {
+      if [ "$CASE" = absent ]; then printf "No active zellij sessions found\n"; return 1; fi
+      printf "firstmate\n"
+    }
+    fm_backend_zellij_cli() {
+      case "$CASE" in
+        present) printf "%s" "[{\"id\":7,\"is_plugin\":false}]" ;;
+        unknown) printf "%s" "{\"malformed\":true}" ;;
+      esac
+    }
+    for CASE in present absent unknown; do fm_backend_zellij_target_state firstmate:7; printf " "; done
+  ' _ "$ROOT")
+  [ "$out" = "present absent unknown " ] || fail "zellij tri-state matrix drifted: '$out'"
+
+  out=$(bash -c '
+    . "$1/bin/fm-backend.sh"; fm_backend_source orca
+    fm_backend_orca_tool_check() { return 0; }
+    orca() {
+      case "$CASE" in
+        present) printf "%s" "{\"ok\":true,\"result\":{}}" ;;
+        absent) printf "%s" "{\"ok\":false,\"error\":{\"code\":\"terminal_handle_stale\"}}" ;;
+        unknown) printf "%s" "not-json" ;;
+      esac
+    }
+    for CASE in present absent unknown; do fm_backend_orca_target_state term-7; printf " "; done
+  ' _ "$ROOT")
+  [ "$out" = "present absent unknown " ] || fail "orca tri-state matrix drifted: '$out'"
+
+  out=$(bash -c '
+    . "$1/bin/fm-backend.sh"; fm_backend_source cmux
+    fm_backend_cmux_ping_state() { printf ok; }
+    fm_backend_cmux_cli() {
+      case "$CASE" in
+        present) printf "%s" "{\"workspaces\":[{\"id\":\"ws-7\"}]}" ;;
+        absent) printf "%s" "{\"workspaces\":[]}" ;;
+        unknown) printf "%s" "not-json" ;;
+      esac
+    }
+    for CASE in present absent unknown; do fm_backend_cmux_target_state ws-7:surface-7; printf " "; done
+  ' _ "$ROOT")
+  [ "$out" = "present absent unknown " ] || fail "cmux tri-state matrix drifted: '$out'"
+  pass "all five backend adapters distinguish present, typed absent, and unreadable control planes"
+}
+
+test_stop_and_verify_requires_confirmed_absence() {
+  local out status=0
+  out=$(FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 bash -c '
+    . "$1/bin/fm-backend.sh"
+    fm_backend_kill() { return 0; }
+    fm_backend_target_state() { printf unknown; }
+    fm_backend_stop_and_verify tmux session:fm-task
+  ' _ "$ROOT" 2>&1) || status=$?
+  expect_code 1 "$status" "an unknown post-stop probe must refuse destructive cleanup"
+  assert_contains "$out" 'could not be confirmed absent' "unknown stop verification did not explain the refusal"
+
+  status=0
+  out=$(FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 bash -c '
+    . "$1/bin/fm-backend.sh"
+    fm_backend_kill() { return 0; }
+    fm_backend_target_state() { printf absent; }
+    fm_backend_stop_and_verify tmux session:fm-task
+  ' _ "$ROOT" 2>&1) || status=$?
+  expect_code 0 "$status" "a confirmed absent endpoint should permit cleanup"
+  [ -z "$out" ] || fail "confirmed absence emitted unexpected output: $out"
+  pass "fm_backend_stop_and_verify distinguishes confirmed absence from an unreadable backend"
+}
+
 # --- backend selection loudly refuses an unknown backend --------------------
 
 test_spawn_refuses_unknown_backend_flag() {
@@ -1155,6 +1311,9 @@ test_send_conformance_old_vs_new
 test_peek_conformance_old_vs_new
 test_spawn_symlinked_project_prefix_avoids_false_refusal
 test_teardown_conformance_old_vs_new
+test_adapter_post_create_failure_records_ownership
+test_adapter_target_state_matrices
+test_stop_and_verify_requires_confirmed_absence
 test_spawn_refuses_unknown_backend_flag
 test_spawn_refuses_codex_app_backend_flag
 test_spawn_refuses_unknown_fm_backend_env
diff --git a/tests/fm-brief.test.sh b/tests/fm-brief.test.sh
index 0199311824..f22e575bfd 100755
--- a/tests/fm-brief.test.sh
+++ b/tests/fm-brief.test.sh
@@ -264,6 +264,26 @@ test_no_mistakes_dod_wording() {
   pass "fm-brief.sh: no-mistakes DOD keeps its apostrophe prose, now parse-safe"
 }
 
+test_unset_and_empty_host_mode_match() {
+  local home="$TMP_ROOT/default-host-home" expected kind args
+  mkdir -p "$home/data"
+  for kind in ship scout; do
+    args=()
+    [ "$kind" = ship ] || args+=(--scout)
+    env -u FM_HOST_ROOT FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
+      "$ROOT/bin/fm-brief.sh" byte-compat sample "${args[@]}" >/dev/null 2>&1
+    expected="$TMP_ROOT/$kind-default-brief.md"
+    cp "$home/data/byte-compat/brief.md" "$expected"
+    rm -rf "$home/data/byte-compat"
+    FM_HOST_ROOT='' FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
+      "$ROOT/bin/fm-brief.sh" byte-compat sample "${args[@]}" >/dev/null 2>&1
+    cmp -s "$expected" "$home/data/byte-compat/brief.md" \
+      || fail "$kind brief differs between unset and explicitly empty host mode"
+    rm -rf "$home/data/byte-compat"
+  done
+  pass "fm-brief.sh: unset and empty host mode preserve the same default scaffold"
+}
+
 test_ship_project_memory_wording() {
   local home id brief
   home="$TMP_ROOT/project-memory-home"
@@ -624,6 +644,7 @@ test_help_includes_entire_header
 test_ship_modes_generate_clean_briefs
 test_faster_paths_use_configured_authority_without_stacked_review
 test_no_mistakes_dod_wording
+test_unset_and_empty_host_mode_match
 test_ship_project_memory_wording
 test_herdr_lab_contract_is_explicit_and_complete
 test_herdr_lab_contract_quotes_foreign_firstmate_path
diff --git a/tests/fm-decision-hold-lifecycle.test.sh b/tests/fm-decision-hold-lifecycle.test.sh
index 0ef84c4a6f..a1bb74c2ea 100755
--- a/tests/fm-decision-hold-lifecycle.test.sh
+++ b/tests/fm-decision-hold-lifecycle.test.sh
@@ -15,6 +15,19 @@ TASKS_AXI_BIN=$(command -v tasks-axi || true)
 command -v jq >/dev/null 2>&1 || { echo "skip: jq not found"; exit 0; }
 command -v tasks-axi >/dev/null 2>&1 || { echo "skip: tasks-axi not found"; exit 0; }
 
+write_stop_aware_tmux() {
+  cat > "$1/tmux" <<'SH'
+#!/usr/bin/env bash
+stopped="${0}.stopped"
+case "${1:-}" in
+  kill-window) : > "$stopped" ;;
+  display-message) [ ! -e "$stopped" ] ;;
+  *) exit 0 ;;
+esac
+SH
+  chmod +x "$1/tmux"
+}
+
 make_home() {  # <name>
   local home="$TMP_ROOT/$1" fakebin
   mkdir -p "$home/data" "$home/state" "$home/config" "$home/projects"
@@ -27,7 +40,8 @@ make_home() {  # <name>
 ## Done
 EOF
   fakebin=$(fm_fakebin "$home")
-  fm_fake_exit0 "$fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_fake_exit0 "$fakebin" treehouse no-mistakes gh gh-axi
+  write_stop_aware_tmux "$fakebin"
   printf '%s\n' "$home"
 }
 
@@ -426,7 +440,8 @@ test_secondmate_hold_stays_in_authoritative_home() {
 ## Done
 EOF
   fakebin=$(fm_fakebin "$mate")
-  fm_fake_exit0 "$fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_fake_exit0 "$fakebin" treehouse no-mistakes gh gh-axi
+  write_stop_aware_tmux "$fakebin"
   origin=sample-mate-review
   mkdir -p "$mate/data/$origin"
   tasks_in "$mate" add "$origin" "Investigate secondmate sample" --kind scout --repo sample --start >/dev/null
diff --git a/tests/fm-gate-refuse.test.sh b/tests/fm-gate-refuse.test.sh
index aff57ab18e..a7f0147f6c 100755
--- a/tests/fm-gate-refuse.test.sh
+++ b/tests/fm-gate-refuse.test.sh
@@ -86,6 +86,7 @@ run_guard_lib() {
   (
     cd "$cwd" || exit 111
     unset NO_MISTAKES_GATE FM_GATE_REFUSE_BYPASS
+    # shellcheck disable=SC2030  # The marker is intentionally scoped to this probe subshell.
     case "$marker" in
       set) export NO_MISTAKES_GATE=1 ;;
       empty) export NO_MISTAKES_GATE= ;;
@@ -131,6 +132,25 @@ test_helper_normal_is_noop() {
   pass "fm-gate-refuse-lib: no-op for a normal session (neither signal, set -eu clean)"
 }
 
+test_helper_checks_physical_absolute_root_from_other_cwd() {
+  local root_link="$TMP/gate-root-link" out rc
+  ln -s "$GATE_WT" "$root_link"
+  out=$(
+    (
+      cd "$NORMAL_CWD" || exit 111
+      unset NO_MISTAKES_GATE FM_GATE_REFUSE_BYPASS
+      set -eu
+      # shellcheck source=bin/fm-gate-refuse-lib.sh
+      . "$GATE_LIB"
+      fm_refuse_if_gate_agent "$root_link"
+    ) 2>&1
+  )
+  rc=$?
+  expect_code 3 "$rc" "helper: an explicit gate-root anchor must refuse from a normal cwd"
+  assert_contains "$out" "$PATH_MSG" "helper: explicit physical root check did not identify the gate worktree"
+  pass "fm-gate-refuse-lib: checks the physical absolute FM_ROOT independently of cwd"
+}
+
 # --- fm-spawn ---------------------------------------------------------------
 
 # A fake tmux/treehouse so fm-spawn resolves the crew worktree from a controlled
@@ -282,13 +302,21 @@ test_send_refuses_and_admits() {
 # task (HEAD reachable from origin), so a normal teardown genuinely succeeds and a
 # refused one leaves the task untouched (mirrors tests/fm-teardown make_case).
 make_teardown_case() {
-  local name=$1 case_dir fakebin t
+  local name=$1 case_dir fakebin
   case_dir="$TMP/$name"; fakebin="$case_dir/fakebin"
   mkdir -p "$case_dir/state" "$case_dir/config" "$fakebin"
-  for t in treehouse tmux; do
-    printf '#!/usr/bin/env bash\nexit 0\n' > "$fakebin/$t"
-    chmod +x "$fakebin/$t"
-  done
+  printf '#!/usr/bin/env bash\nexit 0\n' > "$fakebin/treehouse"
+  chmod +x "$fakebin/treehouse"
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+stopped="${0}.stopped"
+case "${1:-}" in
+  kill-window) : > "$stopped" ;;
+  display-message) [ ! -e "$stopped" ] ;;
+  *) exit 0 ;;
+esac
+SH
+  chmod +x "$fakebin/tmux"
   cat > "$fakebin/gh-axi" <<'SH'
 #!/usr/bin/env bash
 case "${1:-} ${2:-}" in
@@ -365,6 +393,7 @@ test_helper_env_marker_refuses
 test_helper_empty_env_marker_refuses
 test_helper_path_backstop_refuses
 test_helper_normal_is_noop
+test_helper_checks_physical_absolute_root_from_other_cwd
 test_spawn_refuses_and_admits
 test_send_refuses_and_admits
 test_teardown_refuses_and_admits
diff --git a/tests/fm-gotmp.test.sh b/tests/fm-gotmp.test.sh
index 2fc7c8d78c..5a101708c8 100755
--- a/tests/fm-gotmp.test.sh
+++ b/tests/fm-gotmp.test.sh
@@ -60,8 +60,9 @@ make_fake_root() {
   ln -s "$ROOT/bin/fm-composer-lib.sh" "$fake/bin/fm-composer-lib.sh"
   # fm-lock-lib.sh: teardown sources it for the shared lock-staleness proof.
   ln -s "$ROOT/bin/fm-lock-lib.sh" "$fake/bin/fm-lock-lib.sh"
-  # fm-gate-refuse-lib.sh: teardown sources it before any fleet mutation.
+  # Gate and host-root libraries are sourced before any teardown mutation.
   ln -s "$ROOT/bin/fm-gate-refuse-lib.sh" "$fake/bin/fm-gate-refuse-lib.sh"
+  ln -s "$ROOT/bin/fm-host-root-lib.sh" "$fake/bin/fm-host-root-lib.sh"
   # fm-pr-lib.sh: teardown uses its canonical task-ID validator for poll cleanup.
   ln -s "$ROOT/bin/fm-pr-lib.sh" "$fake/bin/fm-pr-lib.sh"
   # fm-guard.sh: stub (teardown calls it with `|| true`).
@@ -126,8 +127,9 @@ test_teardown_skips_gracefully_without_tasktmp() {
   ln -s "$ROOT/bin/fm-tmux-lib.sh" "$fake/bin/fm-tmux-lib.sh"
   ln -s "$ROOT/bin/fm-composer-lib.sh" "$fake/bin/fm-composer-lib.sh"
   ln -s "$ROOT/bin/fm-lock-lib.sh" "$fake/bin/fm-lock-lib.sh"
-  # fm-gate-refuse-lib.sh: teardown sources it before any fleet mutation.
+  # Gate and host-root libraries are sourced before any teardown mutation.
   ln -s "$ROOT/bin/fm-gate-refuse-lib.sh" "$fake/bin/fm-gate-refuse-lib.sh"
+  ln -s "$ROOT/bin/fm-host-root-lib.sh" "$fake/bin/fm-host-root-lib.sh"
   # fm-pr-lib.sh: teardown uses its canonical task-ID validator for poll cleanup.
   ln -s "$ROOT/bin/fm-pr-lib.sh" "$fake/bin/fm-pr-lib.sh"
   cat > "$fake/bin/fm-guard.sh" <<'SH'
diff --git a/tests/fm-grok-harness.test.sh b/tests/fm-grok-harness.test.sh
index edb5001b9a..f560d41d59 100755
--- a/tests/fm-grok-harness.test.sh
+++ b/tests/fm-grok-harness.test.sh
@@ -15,13 +15,16 @@ make_spawn_fakebin() {
   cat > "$fakebin/tmux" <<'SH'
 #!/usr/bin/env bash
 set -u
+stopped="${0}.stopped"
 case "$*" in
-  *"#{pane_current_path}"*) printf '%s\n' "${FM_FAKE_PANE_PATH:-}"; exit 0 ;;
+  *"#{pane_current_path}"*) [ ! -e "$stopped" ] && printf '%s\n' "${FM_FAKE_PANE_PATH:-}"; exit $? ;;
 esac
 case "${1:-}" in
-  display-message) printf 'firstmate\n'; exit 0 ;;
+  display-message) [ ! -e "$stopped" ] && printf 'firstmate\n'; exit $? ;;
   list-windows) exit 0 ;;
-  has-session|new-session|new-window|send-keys|kill-window) exit 0 ;;
+  new-window) rm -f "$stopped"; exit 0 ;;
+  kill-window) : > "$stopped"; exit 0 ;;
+  has-session|new-session|send-keys) exit 0 ;;
 esac
 exit 0
 SH
diff --git a/tests/fm-host-root-mode.test.sh b/tests/fm-host-root-mode.test.sh
new file mode 100644
index 0000000000..8cb443a188
--- /dev/null
+++ b/tests/fm-host-root-mode.test.sh
@@ -0,0 +1,634 @@
+#!/usr/bin/env bash
+# Focused behavior tests for the opt-in FM_HOST_ROOT four-root contract.
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+TMP=$(fm_test_tmproot fm-host-root-mode)
+LIB="$ROOT/bin/fm-host-root-lib.sh"
+fm_git_identity fmtest fmtest@example.invalid
+
+make_host() {
+  local path=$1
+  fm_git_init_commit "$path"
+  : > "$path/AGENTS.md"
+  git -C "$path" add AGENTS.md
+  git -C "$path" -c user.name='Firstmate Tests' -c user.email='tests@example.invalid' commit -qm instructions
+}
+
+resolve_host() {
+  FM_HOST_ROOT=$1 bash -c '. "$1"; fm_host_root_resolve "$2"' _ "$LIB" "$ROOT"
+}
+
+paths_overlap() {
+  bash -c '. "$1"; fm_host_root_paths_overlap "$2" "$3"' _ "$LIB" "$1" "$2"
+}
+
+test_resolution_and_validation() {
+  local host="$TMP/host with spaces and apostrophe's" link="$TMP/host-link" unsafe_target out status=0
+  make_host "$host"
+  ln -s "$host" "$link"
+  out=$(resolve_host "$link") || status=$?
+  expect_code 0 "$status" "symlinked host root should resolve"
+  [ "$out" = "$(cd "$host" && pwd -P)" ] || fail "host root did not resolve physically: $out"
+
+  status=0
+  FM_HOST_ROOT="$TMP/missing" bash -c '. "$1"; fm_host_root_resolve "$2"' _ "$LIB" "$ROOT" >/dev/null 2>&1 || status=$?
+  expect_code 2 "$status" "missing host root must fail"
+  status=0
+  FM_HOST_ROOT="$ROOT" bash -c '. "$1"; fm_host_root_resolve "$2"' _ "$LIB" "$ROOT" >/dev/null 2>&1 || status=$?
+  expect_code 2 "$status" "host root equal to FM_ROOT must fail"
+  status=0
+  FM_HOST_ROOT=$'bad\nroot' bash -c '. "$1"; fm_host_root_resolve "$2"' _ "$LIB" "$ROOT" >/dev/null 2>&1 || status=$?
+  expect_code 2 "$status" "newline-unsafe host root must fail"
+  status=0
+  FM_HOST_ROOT=$'bad\aroot' bash -c '. "$1"; fm_host_root_resolve "$2"' _ "$LIB" "$ROOT" >/dev/null 2>&1 || status=$?
+  expect_code 2 "$status" "all metadata-unsafe control characters must fail"
+  unsafe_target="$TMP/resolved"$'\n'"host"
+  make_host "$unsafe_target"
+  ln -s "$unsafe_target" "$TMP/clean-host-link"
+  status=0
+  FM_HOST_ROOT="$TMP/clean-host-link" bash -c '. "$1"; fm_host_root_resolve "$2"' _ "$LIB" "$ROOT" >/dev/null 2>&1 || status=$?
+  expect_code 2 "$status" "control characters introduced by physical resolution must fail"
+  mkdir -p "$TMP/claude-only-host"
+  : > "$TMP/claude-only-host/CLAUDE.md"
+  status=0
+  FM_HOST_ROOT="$TMP/claude-only-host" bash -c '. "$1"; fm_host_root_resolve "$2"' _ "$LIB" "$ROOT" >/dev/null 2>&1 || status=$?
+  expect_code 2 "$status" "a Claude-only instruction surface must not admit non-Claude workers"
+  paths_overlap "$host" "$host" || fail "equal host and target roots were not classified as overlapping"
+  paths_overlap "$host" "$host/nested-target" || fail "target nested under host was not classified as overlapping"
+  paths_overlap "$host/nested-host" "$host" || fail "host nested under target was not classified as overlapping"
+  if paths_overlap "$host" "$TMP/host-with-similar-prefix"; then
+    fail "sibling paths with a shared prefix were classified as overlapping"
+  fi
+  pass "host-root library resolves physical paths and rejects unsafe, harness-specific, or overlapping roots"
+}
+
+test_session_cwd_mismatch_precedes_mutation() {
+  local host="$TMP/session-host" home="$TMP/session-home" other="$TMP/session-other" fake_root out status=0
+  make_host "$host"; mkdir -p "$home/state" "$home/data" "$home/config" "$other"
+  out=$(cd "$other" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-session-start.sh" 2>&1) || status=$?
+  expect_code 2 "$status" "session-start host cwd mismatch must fail"
+  assert_contains "$out" 'requires the supervisor cwd' "session-start mismatch did not explain the host cwd"
+  [ -z "$(find "$home/state" -mindepth 1 -print -quit)" ] || fail "session-start mismatch mutated state before refusal"
+
+  fake_root="$TMP/guard-root"
+  mkdir -p "$fake_root/bin"
+  : > "$fake_root/AGENTS.md"
+  cat > "$fake_root/bin/fm-guard.sh" <<'SH'
+#!/usr/bin/env bash
+: > "$FM_GUARD_MUTATION"
+SH
+  chmod +x "$fake_root/bin/fm-guard.sh"
+  status=0
+  (cd "$other" && FM_GUARD_MUTATION="$TMP/guard-ran" FM_ROOT_OVERRIDE="$fake_root" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    "$ROOT/bin/fm-spawn.sh" guarded "$TMP/missing-project" codex >/dev/null 2>&1) || status=$?
+  expect_code 2 "$status" "spawn host cwd mismatch must fail"
+  assert_absent "$TMP/guard-ran" "spawn ran the supervision guard before host validation"
+
+  status=0
+  (cd "$other" && FM_ROOT_OVERRIDE="$fake_root" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    "$ROOT/bin/fm-brief.sh" guarded-mate --secondmate --no-projects >/dev/null 2>&1) || status=$?
+  expect_code 2 "$status" "secondmate brief host cwd mismatch must fail"
+  assert_absent "$home/data/guarded-mate" "secondmate brief mutated task data before host validation"
+
+  status=0
+  (cd "$other" && FM_GUARD_MUTATION="$TMP/guard-ran" FM_ROOT_OVERRIDE="$fake_root" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    "$ROOT/bin/fm-spawn.sh" guarded-mate "$TMP/missing-home" codex --secondmate >/dev/null 2>&1) || status=$?
+  expect_code 2 "$status" "secondmate spawn host cwd mismatch must fail"
+  assert_absent "$TMP/guard-ran" "secondmate spawn ran the supervision guard before host validation"
+  pass "host cwd mismatch is rejected before session, brief, or spawn mutation"
+}
+
+test_host_command_rendering() {
+  local host="$TMP/render & host" home="$TMP/render-home" fake_root="$TMP/FirstMate & root's copy" rendered supervision command argv
+  make_host "$host"; mkdir -p "$home/state" "$home/config" "$fake_root/bin"
+  argv="$TMP/rendered-argv"
+  cat > "$fake_root/bin/argv-probe" <<'SH'
+#!/usr/bin/env bash
+printf '%s\n' "$@" > "$FM_ARGV_LOG"
+SH
+  cp "$fake_root/bin/argv-probe" "$fake_root/bin/fm-watch-checkpoint.sh"
+  chmod +x "$fake_root/bin/argv-probe" "$fake_root/bin/fm-watch-checkpoint.sh"
+  rendered=$(FM_HOST_ROOT="$host" bash -c '. "$1"; fm_host_root_command "$2" bin/argv-probe' _ "$LIB" "$fake_root")
+  FM_ARGV_LOG="$argv" bash -c "$rendered one 'two words' \"apostrophe's\""
+  [ "$(cat "$argv")" = $'one\ntwo words\napostrophe\x27s' ] || fail "quoted host command did not preserve argv"
+
+  supervision=$(FM_ROOT_OVERRIDE="$fake_root" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    "$ROOT/bin/fm-supervision-instructions.sh" --harness codex --repair-line)
+  assert_contains "$supervision" "FirstMate & root'\\''s copy/bin'/fm-watch-checkpoint.sh" \
+    "host supervision did not shell-quote its absolute command"
+  command=$(printf '%s\n' "$supervision" | sed -n 's/.*checkpoint: \(.*\) --seconds.*/\1/p')
+  FM_ARGV_LOG="$argv" bash -c "$command --seconds 7"
+  [ "$(cat "$argv")" = $'--seconds\n7' ] || fail "rendered supervision command did not preserve argv"
+  pass "host mode shell-quotes absolute commands and preserves argv"
+}
+
+test_brief_variants() {
+  local host="$TMP/brief & host" home="$TMP/brief-home" brief normal_home="$TMP/normal-home"
+  make_host "$host"
+  mkdir -p "$home/data" "$normal_home/data"
+  (cd "$host" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-brief.sh" lane-host alpha >/dev/null 2>&1)
+  brief="$home/data/lane-host/brief.md"
+  assert_grep '<!-- firstmate-execution-mode: host-root -->' "$brief" "host brief marker missing"
+  assert_contains "$(cat "$brief")" "$host" "host brief corrupted the literal host path"
+  # shellcheck disable=SC2016  # Assertions intentionally match literal worker variables.
+  assert_contains "$(cat "$brief")" 'git -C "$FM_TARGET_WORKTREE"' "host brief does not scope Git to the target"
+  assert_grep 'Read the target worktree root instructions' "$brief" "host brief does not require target instructions"
+  assert_grep 'top-level process cwd at the host root' "$brief" "host brief does not preserve host cwd"
+  # shellcheck disable=SC2016
+  assert_contains "$(cat "$brief")" '(cd "$FM_TARGET_WORKTREE" && no-mistakes doctor)' "host brief does not scope no-mistakes setup"
+  # shellcheck disable=SC2016
+  assert_contains "$(cat "$brief")" '(cd "$FM_TARGET_WORKTREE" && no-mistakes axi run --help)' "host brief does not scope no-mistakes help"
+  # shellcheck disable=SC2016
+  assert_contains "$(cat "$brief")" '(cd "$FM_TARGET_WORKTREE" && no-mistakes axi respond ...)' "host brief does not scope no-mistakes responses"
+  assert_no_grep '`no-mistakes axi' "$brief" "host brief leaves a bare no-mistakes CLI command"
+
+  FM_HOME="$normal_home" "$ROOT/bin/fm-brief.sh" lane-normal 'alpha & beta' >/dev/null 2>&1
+  assert_no_grep 'firstmate-execution-mode: host-root' "$normal_home/data/lane-normal/brief.md" "default brief changed execution mode"
+  assert_contains "$(cat "$normal_home/data/lane-normal/brief.md")" 'alpha & beta' "default brief corrupted the literal repository name"
+  assert_grep 'git checkout -b fm/lane-normal' "$normal_home/data/lane-normal/brief.md" "default brief lost its normal branch command"
+  pass "brief scaffolding has an explicit host variant and unchanged default variant"
+}
+
+make_fakebin() {
+  local dir=$1 fb
+  fb=$(fm_fakebin "$dir")
+  cat > "$fb/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+printf '%s\037' "$@" >> "$FM_TMUX_LOG"; printf '\n' >> "$FM_TMUX_LOG"
+endpoint=${FM_ENDPOINT_ALIVE:-$FM_CURRENT_PATH.endpoint}
+if [ "${1:-}" = send-keys ] && printf '%s\n' "$*" | grep -q -- ' -l '; then
+  case "${*: -1}" in
+    'Read the brief at '*' and follow it exactly.') : ;;
+    *) printf '%s' "${*: -1}" > "$FM_LAUNCH_FILE" ;;
+  esac
+  : > "$FM_LAUNCH_FILE.literal"
+  [ "${FM_FAIL_LAUNCH_SEND:-0}" != 1 ] || exit 91
+fi
+if [ "${1:-}" = send-keys ] && [ "${*: -1}" = Enter ] && [ -f "$FM_LAUNCH_FILE.literal" ]; then
+  [ "${FM_FAIL_LAUNCH_ENTER:-0}" != 1 ] || exit 92
+fi
+case "${1:-}" in
+  display-message)
+    case "$*" in
+      *'#{pane_current_path}'*) [ -f "$endpoint" ] && cat "$FM_CURRENT_PATH" ;;
+      *'#{cursor_y}'*) printf '0\n' ;;
+      *'#{window_id}'*) [ -f "$endpoint" ] && printf '%%1\n' ;;
+      *'#{pane_id}'*) [ -f "$endpoint" ] && printf '%%1\n' ;;
+      *) printf 'test-session\n' ;;
+    esac
+    ;;
+  capture-pane)
+    if [ "${FM_FAKE_KIMI:-0}" = 1 ]; then
+      printf 'Welcome to Kimi Code!\n│ > │\ncontext: 1%%\n'
+    fi
+    ;;
+  list-windows) [ -z "${FM_EXISTING_WINDOW:-}" ] || printf '%s\n' "$FM_EXISTING_WINDOW" ;;
+  list-panes) [ ! -f "$endpoint" ] || printf '%%1|@1|test-session:fm-rollback-stuck|test-session:1.0\n' ;;
+  has-session|new-session|set-window-option) ;;
+  new-window) : > "$endpoint"; printf '%%1\n' ;;
+  kill-window) [ "${FM_REFUSE_STOP:-0}" = 1 ] || rm -f "$endpoint" ;;
+  send-keys)
+    case "$*" in
+      *'treehouse get'*) printf '%s\n' "$FM_TARGET_PATH" > "$FM_CURRENT_PATH" ;;
+      *'cd -- '* ) [ "${FM_REFUSE_HOST_MOVE:-0}" = 1 ] || printf '%s\n' "$FM_HOST_PATH" > "$FM_CURRENT_PATH" ;;
+    esac
+    ;;
+esac
+SH
+  chmod +x "$fb/tmux"
+  cat > "$fb/treehouse" <<'SH'
+#!/usr/bin/env bash
+set -u
+[ -z "${FM_TREEHOUSE_LOG:-}" ] || printf '%s\n' "$*" >> "$FM_TREEHOUSE_LOG"
+exit 0
+SH
+  chmod +x "$fb/treehouse"
+  cat > "$fb/codex" <<'SH'
+#!/usr/bin/env bash
+set -u
+[ -z "${FM_CODEX_ARGV:-}" ] || printf '%s\0' "$@" > "$FM_CODEX_ARGV"
+printf 'cwd=%s\nhost=%s\ntarget=%s\n' "$(pwd -P)" "${FM_HOST_ROOT:-}" "${FM_TARGET_WORKTREE:-}" > "$FM_WORKER_OBS"
+printf 'target edit\n' > "$FM_TARGET_WORKTREE/worker-edit.txt"
+SH
+  chmod +x "$fb/codex"
+  cat > "$fb/kimi" <<'SH'
+#!/usr/bin/env bash
+exit 0
+SH
+  chmod +x "$fb/kimi"
+  printf '%s\n' "$fb"
+}
+
+test_spawn_separates_roots() {
+  local host="$TMP/spawn & host" home="$TMP/spawn home's & #%?" project="$TMP/target & repo" wt="$TMP/target & worktree" fb log current launch obs argv turnend meta before after tree_line cd_line launch_line
+  make_host "$host"
+  mkdir -p "$home/data/lane" "$home/state" "$home/config"
+  fm_git_init_commit "$project"
+  git -C "$project" worktree add -q --detach "$wt"
+  (cd "$host" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-brief.sh" lane "$(basename "$project")" >/dev/null 2>&1)
+  fb=$(make_fakebin "$TMP/fake")
+  log="$TMP/tmux.log"; current="$TMP/current"; launch="$TMP/launch"; obs="$TMP/worker-observation"; argv="$TMP/codex.argv"
+  printf '%s\n' "$project" > "$current"
+  before=$(git -C "$host" status --porcelain)
+  (cd "$host" && PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH="$wt" FM_HOST_PATH="$host" TMUX=fake \
+    "$ROOT/bin/fm-spawn.sh" lane "$project" codex > "$TMP/spawn.out" 2>&1) \
+    || fail "host-root spawn failed: $(cat "$TMP/spawn.out")"
+  meta="$home/state/lane.meta"
+  assert_grep "worktree=$wt" "$meta" "spawn meta lost target worktree"
+  assert_grep "host_root=$host" "$meta" "spawn meta lost host root"
+  assert_contains "$(cat "$log")" "FM_TARGET_WORKTREE='$wt'" "child launch did not export exact target worktree"
+  assert_contains "$(cat "$log")" "FM_HOST_ROOT='$host'" "child launch did not export exact host root"
+  assert_contains "$(cat "$log")" 'notify=[' "Codex FirstMate turn-end safeguard was not retained"
+  [ "$(cat "$current")" = "$host" ] || fail "endpoint did not finish at physical host root"
+  tree_line=$(grep -nF 'treehouse get' "$log" | head -1 | cut -d: -f1)
+  cd_line=$(grep -nF 'cd --' "$log" | head -1 | cut -d: -f1)
+  launch_line=$(grep -nF 'FM_TARGET_WORKTREE=' "$log" | head -1 | cut -d: -f1)
+  [ "$tree_line" -lt "$cd_line" ] && [ "$cd_line" -lt "$launch_line" ] || fail "spawn order was not worktree then host root then harness"
+  (cd "$host" && PATH="$fb:$PATH" FM_WORKER_OBS="$obs" FM_CODEX_ARGV="$argv" bash -c "$(cat "$launch")")
+  assert_grep "cwd=$host" "$obs" "worker harness did not start from the host root"
+  assert_grep "host=$host" "$obs" "worker did not receive the exact host root"
+  assert_grep "target=$wt" "$obs" "worker did not receive the exact target worktree"
+  turnend="$(cd "$home/state" && pwd -P)/lane.turn-ended"
+  python3 - "$argv" "$turnend" <<'PY' || fail "Codex notify argv did not preserve the hostile turn-end path"
+import pathlib, subprocess, sys
+args = pathlib.Path(sys.argv[1]).read_bytes().split(b"\0")
+args = [a.decode() for a in args if a]
+assert args.count("-c") == 1, args
+i = args.index("-c")
+config = args[i + 1]
+assert config.startswith('notify=["bash","-c","touch -- '), config
+assert config.endswith('"]'), config
+subprocess.run(["bash", "-c", config[len('notify=["bash","-c","'):-2]], check=True)
+PY
+  assert_present "$turnend" "Codex notify command did not touch the exact hostile path"
+  assert_present "$wt/worker-edit.txt" "disposable worker probe did not edit the target worktree"
+  assert_absent "$host/worker-edit.txt" "disposable worker probe edited the host root"
+  after=$(git -C "$host" status --porcelain)
+  [ "$before" = "$after" ] || fail "host working tree changed during spawn or worker probe"
+  pass "spawn orders and separates host cwd, target metadata, child environment, and target-only edits"
+}
+
+test_duplicate_spawn_preserves_existing_task() {
+  local host="$TMP/duplicate-host" home="$TMP/duplicate-home" project="$TMP/duplicate-target" fb log current launch out status=0
+  make_host "$host"
+  fm_git_init_commit "$project"
+  mkdir -p "$home/data/lane" "$home/state" "$home/config"
+  (cd "$host" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    "$ROOT/bin/fm-brief.sh" lane target >/dev/null 2>&1)
+  printf 'window=test-session:fm-lane\nworktree=/tmp/existing-worktree\nhost_root=%s\nproject=%s\nkind=ship\n' \
+    "$host" "$project" > "$home/state/lane.meta"
+  printf 'working: existing task\n' > "$home/state/lane.status"
+  cp "$home/state/lane.meta" "$TMP/existing.meta"
+  cp "$home/state/lane.status" "$TMP/existing.status"
+  fb=$(make_fakebin "$TMP/fake-duplicate")
+  log="$TMP/duplicate.log"; current="$TMP/duplicate.current"; launch="$TMP/duplicate.launch"
+  printf '%s\n' "$project" > "$current"
+  : > "$current.endpoint"
+
+  out=$(cd "$host" && PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    FM_EXISTING_WINDOW=fm-lane FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$launch" FM_CURRENT_PATH="$current" \
+    FM_TARGET_PATH=/tmp/unused FM_HOST_PATH="$host" TMUX=fake \
+    "$ROOT/bin/fm-spawn.sh" lane "$project" codex 2>&1) || status=$?
+  [ "$status" -ne 0 ] || fail "duplicate spawn unexpectedly succeeded"
+  assert_contains "$out" 'window test-session:fm-lane already exists' "duplicate spawn refusal was not explicit"
+  assert_no_grep 'kill-window' "$log" "duplicate spawn killed the existing task endpoint"
+  cmp -s "$TMP/existing.meta" "$home/state/lane.meta" || fail "duplicate spawn changed existing metadata"
+  cmp -s "$TMP/existing.status" "$home/state/lane.status" || fail "duplicate spawn changed existing status"
+  assert_present "$current.endpoint" "duplicate spawn removed the existing endpoint"
+  pass "duplicate spawn preserves the existing endpoint and task records"
+}
+
+test_spawn_rejects_host_as_target_and_cleans_failed_transition() {
+  local host="$TMP/refusal-host" home="$TMP/refusal-home" project="$TMP/refusal-target" wt="$TMP/refusal-wt" fb log current tree_log out status=0
+  make_host "$host"
+  mkdir -p "$home/data/host-target" "$home/data/move-fail" "$home/state" "$home/config"
+  fm_git_init_commit "$project"
+  git -C "$project" worktree add -q --detach "$wt"
+  (cd "$host" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-brief.sh" host-target target >/dev/null 2>&1)
+  (cd "$host" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-brief.sh" move-fail target >/dev/null 2>&1)
+  fb=$(make_fakebin "$TMP/fake-refusals")
+  log="$TMP/refusals.log"; current="$TMP/refusals.current"; tree_log="$TMP/treehouse.log"
+
+  printf '%s\n' "$project" > "$current"
+  out=$(cd "$host" && PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$TMP/refusal.launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH="$host" \
+    FM_HOST_PATH="$host" FM_TREEHOUSE_LOG="$tree_log" TMUX=fake \
+    "$ROOT/bin/fm-spawn.sh" host-target "$project" codex 2>&1) || status=$?
+  [ "$status" -ne 0 ] || fail "spawn accepted FM_HOST_ROOT as the target worktree"
+  assert_contains "$out" 'overlapping host and target roots' "host-as-target refusal was not explicit"
+  assert_contains "$(cat "$log")" 'kill-window' "host-as-target refusal leaked its tmux endpoint"
+  assert_no_grep 'return --force' "$tree_log" "host-as-target refusal tried to recycle the authoritative host path"
+  assert_present "$home/state/host-target.meta" "host-as-target refusal lost recovery metadata for the preserved path"
+
+  : > "$log"; : > "$tree_log"; printf '%s\n' "$project" > "$current"; status=0
+  out=$(cd "$host" && PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    FM_HOST_CWD_ATTEMPTS=1 FM_HOST_CWD_DELAY=0 FM_REFUSE_HOST_MOVE=1 \
+    FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$TMP/move-fail.launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH="$wt" \
+    FM_HOST_PATH="$host" FM_TREEHOUSE_LOG="$tree_log" TMUX=fake \
+    "$ROOT/bin/fm-spawn.sh" move-fail "$project" codex 2>&1) || status=$?
+  [ "$status" -ne 0 ] || fail "spawn accepted a backend that never entered FM_HOST_ROOT"
+  assert_contains "$out" 'did not enter FM_HOST_ROOT' "host transition failure was not explicit"
+  assert_contains "$(cat "$log")" 'kill-window' "failed host transition leaked its tmux endpoint"
+  assert_grep 'return --force' "$tree_log" "failed host transition did not return the acquired worktree"
+  assert_absent "$home/state/move-fail.meta" "successful transition cleanup left recovery metadata"
+  pass "host overlap preserves the path while ordinary transition failures clean their resources"
+}
+
+test_orca_active_cwd_probe() {
+  local out
+  out=$(bash -c '
+    . "$1/bin/backends/orca.sh"
+    fm_backend_orca_send_text_line() {
+      markers=$(printf "%s\n" "$2" | grep -o "__FM_ORCA_CWD_[A-Z]*_[A-Za-z0-9_]*__")
+      begin=$(printf "%s\n" "$markers" | head -1)
+      end=$(printf "%s\n" "$markers" | tail -1)
+    }
+    fm_backend_orca_read_text_paged() {
+      printf "%s\n" "$begin" "/tmp/orca host" "$end"
+    }
+    fm_backend_orca_current_path terminal-1
+  ' _ "$ROOT")
+  [ "$out" = "/tmp/orca host" ] || fail "Orca active cwd probe returned '$out'"
+  pass "Orca backend reads the live shell cwd through a bounded marker probe"
+}
+
+test_all_harnesses_add_one_task_safeguard() {
+  local host="$TMP/adapters-host" home="$TMP/adapter home's #%?" project="$TMP/adapters-target" before after harness id wt fb log current launch text count out status=0
+  make_host "$host"
+  fm_git_init_commit "$project"
+  mkdir -p "$home/data" "$home/state" "$home/config"
+  mkdir -p "$TMP/harness-home/.kimi-code"
+  printf 'default_model = "test"\n' > "$TMP/harness-home/.kimi-code/config.toml"
+  before=$(git -C "$host" status --porcelain)
+  for harness in claude codex opencode pi grok kimi; do
+    id="adapter-$harness"
+    wt="$TMP/$id-wt"
+    git -C "$project" worktree add -q --detach "$wt"
+    (cd "$host" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-brief.sh" "$id" "$(basename "$project")" >/dev/null 2>&1)
+    fb=$(make_fakebin "$TMP/fake-$harness")
+    log="$TMP/$id.log"; current="$TMP/$id.current"; launch="$TMP/$id.launch"
+    printf '%s\n' "$project" > "$current"
+    (cd "$host" && HOME="$TMP/harness-home" PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+      FM_FAKE_KIMI=1 FM_KIMI_READY_POLLS=1 FM_KIMI_DELIVERY_POLLS=1 FM_KIMI_POLL_INTERVAL=0 \
+      FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH="$wt" FM_HOST_PATH="$host" TMUX=fake \
+      "$ROOT/bin/fm-spawn.sh" "$id" "$project" "$harness" >/dev/null)
+    text=$(cat "$launch")
+    bash -n -c "$text" || fail "$harness host-root launch is not valid shell"
+    case "$harness" in
+      claude)
+        count=$(printf '%s' "$text" | grep -o -- '--settings' | wc -l | tr -d ' ')
+        [ "$count" -eq 1 ] || fail "Claude task settings appeared $count times"
+        assert_present "$home/state/$id.claude-settings.json" "Claude task settings file missing"
+        node -e 'JSON.parse(require("fs").readFileSync(process.argv[1], "utf8"))' "$home/state/$id.claude-settings.json" \
+          || fail "Claude task settings are invalid JSON"
+        ;;
+      codex)
+        count=$(printf '%s' "$text" | grep -oF 'notify=[' | wc -l | tr -d ' ')
+        [ "$count" -eq 1 ] || fail "Codex notify safeguard appeared $count times"
+        ;;
+      opencode)
+        count=$(printf '%s' "$text" | grep -oF 'opencode-turn-end.js' | wc -l | tr -d ' ')
+        [ "$count" -eq 1 ] || fail "OpenCode task plugin appeared $count times"
+        assert_present "$home/state/$id.opencode-turn-end.js" "OpenCode task plugin missing"
+        assert_contains "$text" '%23%25%3F' "OpenCode task plugin file URL did not encode path metacharacters"
+        node --check "$home/state/$id.opencode-turn-end.js" >/dev/null \
+          || fail "OpenCode task plugin is invalid JavaScript"
+        ;;
+      pi)
+        count=$(printf '%s' "$text" | grep -oF "$id.pi-ext.ts" | wc -l | tr -d ' ')
+        [ "$count" -eq 1 ] || fail "Pi task extension appeared $count times"
+        assert_present "$home/state/$id.pi-ext.ts" "Pi task extension missing"
+        ;;
+      grok)
+        count=$(printf '%s' "$text" | grep -oF 'FM_GROK_TURNEND_TOKEN=' | wc -l | tr -d ' ')
+        [ "$count" -eq 1 ] || fail "Grok task token appeared $count times"
+        assert_absent "$host/.fm-grok-turnend" "Grok host launch wrote a task pointer into the host"
+        ;;
+      kimi)
+        count=$(printf '%s' "$text" | grep -oF 'FM_KIMI_TURNEND_TOKEN=' | wc -l | tr -d ' ')
+        [ "$count" -eq 1 ] || fail "Kimi task token appeared $count times"
+        assert_present "$home/state/$id.kimi-turnend-token" "Kimi task token state is missing"
+        assert_absent "$host/.fm-kimi-turnend" "Kimi host launch wrote a task pointer into the host"
+        ;;
+    esac
+    rm -rf "/tmp/fm-$id"
+  done
+
+  id=adapter-raw
+  (cd "$host" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    "$ROOT/bin/fm-brief.sh" "$id" "$(basename "$project")" >/dev/null 2>&1)
+  out=$(cd "$host" && FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    "$ROOT/bin/fm-spawn.sh" "$id" "$project" 'claude --dangerously-skip-permissions' 2>&1) || status=$?
+  expect_code 2 "$status" "host mode must reject a raw launch command without a verified task safeguard"
+  assert_contains "$out" 'requires a named verified harness' "raw host launch refusal was not explicit"
+  assert_absent "$home/state/$id.meta" "raw host launch mutated task state before refusal"
+
+  after=$(git -C "$host" status --porcelain)
+  [ "$before" = "$after" ] || fail "harness integration rewrote host configuration"
+  pass "all six harnesses add one task safeguard without changing host hooks"
+}
+
+test_mutators_require_host_cwd() {
+  local host="$TMP/mutator-host" other="$TMP/mutator-other" home="$TMP/mutator-home" out status=0
+  make_host "$host"
+  mkdir -p "$other" "$home/state"
+  printf 'window=fake:fm-lane\nworktree=/tmp/target\nhost_root=%s\nproject=/tmp/project\nkind=ship\n' "$host" > "$home/state/lane.meta"
+  printf 'window=fake:fm-scout\nworktree=/tmp/scout\nhost_root=%s\nproject=/tmp/project\nkind=scout\n' "$host" > "$home/state/scout.meta"
+  out=$(cd "$other" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-send.sh" lane hello 2>&1) || status=$?
+  expect_code 2 "$status" "fm-send must reject a host cwd mismatch"
+  assert_contains "$out" 'requires the recorded host root cwd' "fm-send host mismatch was not explicit"
+  status=0
+  out=$(cd "$other" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-teardown.sh" lane 2>&1) || status=$?
+  expect_code 2 "$status" "fm-teardown must reject a host cwd mismatch"
+  assert_present "$home/state/lane.meta" "teardown mutated task state before host validation"
+  printf 'mode=local-only\n' >> "$home/state/lane.meta"
+  status=0
+  out=$(cd "$other" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-merge-local.sh" lane 2>&1) || status=$?
+  expect_code 2 "$status" "fm-merge-local must reject a host cwd mismatch"
+  assert_present "$home/state/lane.meta" "local merge mutated task state before host validation"
+  status=0
+  out=$(cd "$other" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-pr-merge.sh" lane https://github.com/example/repo/pull/1 2>&1) || status=$?
+  expect_code 2 "$status" "fm-pr-merge must reject a host cwd mismatch"
+  assert_present "$home/state/lane.meta" "PR merge mutated task state before host validation"
+  status=0
+  out=$(cd "$other" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-pr-check.sh" lane https://github.com/example/repo/pull/1 2>&1) || status=$?
+  expect_code 2 "$status" "fm-pr-check must reject a host cwd mismatch"
+  if grep -q '^pr=' "$home/state/lane.meta"; then
+    fail "PR check mutated task metadata before host validation"
+  fi
+  status=0
+  out=$(cd "$other" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-review-diff.sh" lane --stat 2>&1) || status=$?
+  expect_code 2 "$status" "fm-review-diff must reject a host cwd mismatch"
+  status=0
+  out=$(cd "$other" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-promote.sh" scout 2>&1) || status=$?
+  expect_code 2 "$status" "fm-promote must reject a host cwd mismatch"
+  grep -qx 'kind=scout' "$home/state/scout.meta" || fail "promote mutated task metadata before host validation"
+  status=0
+  out=$(cd "$other" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-check-register.sh" lane 2>&1) || status=$?
+  expect_code 2 "$status" "fm-check-register must reject a host cwd mismatch"
+  assert_absent "$home/state/lane.check-trust" "check registration mutated trust state before host validation"
+  status=0
+  out=$(cd "$other" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-decision-hold.sh" complete lane --none 2>&1) || status=$?
+  expect_code 2 "$status" "fm-decision-hold must reject a host cwd mismatch"
+  status=0
+  out=$(cd "$other" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-x-followup.sh" --check lane 2>&1) || status=$?
+  expect_code 2 "$status" "fm-x-followup must reject a host cwd mismatch"
+  status=0
+  out=$(cd "$other" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-x-link.sh" lane request-1 2>&1) || status=$?
+  expect_code 2 "$status" "fm-x-link must reject a host cwd mismatch"
+  pass "task lifecycle actions reject host cwd mismatch before mutation"
+}
+
+test_secondmate_actions_keep_supervisor_host_authority() {
+  local host="$TMP/secondmate-action-host" other="$TMP/secondmate-action-other" meta="$TMP/secondmate-action.meta" ordinary="$TMP/ordinary-action.meta" out status=0
+  make_host "$host"
+  mkdir -p "$other"
+  printf 'window=fm-mate\nworktree=/tmp/mate\nkind=secondmate\n' > "$meta"
+  printf 'window=fm-task\nworktree=/tmp/task\nkind=ship\n' > "$ordinary"
+
+  (cd "$host" && FM_HOST_ROOT="$host" bash -c '. "$1"; fm_host_root_assert_task_cwd "$2" "$3"' _ "$LIB" "$ROOT" "$meta") \
+    || status=$?
+  expect_code 0 "$status" "secondmate action should use the primary supervisor host cwd without host_root metadata"
+
+  status=0
+  out=$(cd "$other" && FM_HOST_ROOT="$host" bash -c '. "$1"; fm_host_root_assert_task_cwd "$2" "$3"' _ "$LIB" "$ROOT" "$meta" 2>&1) \
+    || status=$?
+  expect_code 2 "$status" "secondmate action must still reject a supervisor host cwd mismatch"
+  assert_contains "$out" 'requires the supervisor cwd' "secondmate cwd mismatch did not preserve primary host authority"
+
+  status=0
+  out=$(cd "$host" && FM_HOST_ROOT="$host" bash -c '. "$1"; fm_host_root_assert_task_cwd "$2" "$3"' _ "$LIB" "$ROOT" "$ordinary" 2>&1) \
+    || status=$?
+  expect_code 2 "$status" "ordinary task without host_root metadata must remain rejected"
+  assert_contains "$out" 'has no recorded host_root' "secondmate exception weakened ordinary task ownership"
+  pass "secondmate actions retain primary host cwd authority without inheriting host_root metadata"
+}
+
+test_spawn_rollback_is_transactional() {
+  local host="$TMP/rollback-host" home="$TMP/rollback-home" project="$TMP/rollback-target" wt="$TMP/rollback-wt" stuck_wt="$TMP/rollback-stuck-wt" uncertain_wt="$TMP/rollback-uncertain-wt" fb log current tree_log out status=0
+  make_host "$host"; mkdir -p "$home/data" "$home/state" "$home/config"; fm_git_init_commit "$project"
+  git -C "$project" worktree add -q --detach "$wt"
+  git -C "$project" worktree add -q --detach "$stuck_wt"
+  git -C "$project" worktree add -q --detach "$uncertain_wt"
+  for id in rollback-clean rollback-stuck rollback-uncertain; do
+    (cd "$host" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+      "$ROOT/bin/fm-brief.sh" "$id" target >/dev/null 2>&1)
+  done
+  fb=$(make_fakebin "$TMP/fake-rollback")
+  log="$TMP/rollback.log"; current="$TMP/rollback.current"; tree_log="$TMP/rollback-treehouse.log"
+  printf '%s\n' "$project" > "$current"
+  out=$(cd "$host" && PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    FM_FAIL_LAUNCH_SEND=1 FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$TMP/rollback.launch" \
+    FM_CURRENT_PATH="$current" FM_TARGET_PATH="$wt" FM_HOST_PATH="$host" FM_TREEHOUSE_LOG="$tree_log" TMUX=fake \
+    "$ROOT/bin/fm-spawn.sh" rollback-clean "$project" pi 2>&1) || status=$?
+  [ "$status" -ne 0 ] || fail "injected launch failure unexpectedly succeeded"
+  assert_grep 'return --force' "$tree_log" "successful rollback did not return the isolated copy"
+  assert_absent "$home/state/rollback-clean.meta" "successful rollback left metadata"
+  assert_absent "$home/state/rollback-clean.pi-ext.ts" "successful rollback left its pre-record Pi artifact"
+  assert_absent "/tmp/fm-rollback-clean" "successful rollback left its task temp root"
+
+  : > "$log"; : > "$tree_log"; printf '%s\n' "$project" > "$current"; status=0
+  out=$(cd "$host" && PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    FM_FAIL_LAUNCH_SEND=1 FM_REFUSE_STOP=1 FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 FM_TMUX_LOG="$log" \
+    FM_LAUNCH_FILE="$TMP/rollback-stuck.launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH="$stuck_wt" FM_HOST_PATH="$host" \
+    FM_TREEHOUSE_LOG="$tree_log" TMUX=fake "$ROOT/bin/fm-spawn.sh" rollback-stuck "$project" pi 2>&1) || status=$?
+  [ "$status" -ne 0 ] || fail "injected stop failure unexpectedly succeeded"
+  assert_contains "$out" 'still exists after stop' "failed endpoint termination was not explicit (backend log: $(tr '\n' ';' < "$log"))"
+  assert_no_grep 'return --force' "$tree_log" "rollback reused the isolated copy after unconfirmed termination"
+  assert_present "$home/state/rollback-stuck.meta" "failed rollback lost recovery metadata"
+  assert_present "$home/state/rollback-stuck.pi-ext.ts" "failed rollback discarded a recoverable pre-record artifact"
+  assert_present "/tmp/fm-rollback-stuck" "failed rollback discarded its recoverable task temp root"
+  rm -rf "/tmp/fm-rollback-stuck"
+  rm -f "$home/state/rollback-stuck.meta" "$home/state/rollback-stuck.pi-ext.ts" "$current.endpoint"
+
+  : > "$log"; : > "$tree_log"; printf '%s\n' "$project" > "$current"; status=0
+  out=$(cd "$host" && PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    FM_FAIL_LAUNCH_ENTER=1 FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$TMP/rollback-uncertain.launch" \
+    FM_CURRENT_PATH="$current" FM_TARGET_PATH="$uncertain_wt" FM_HOST_PATH="$host" FM_TREEHOUSE_LOG="$tree_log" TMUX=fake \
+    "$ROOT/bin/fm-spawn.sh" rollback-uncertain "$project" pi 2>&1) || status=$?
+  [ "$status" -ne 0 ] || fail "ambiguous Enter failure unexpectedly succeeded"
+  assert_contains "$out" 'launch submission could not be confirmed' "ambiguous Enter failure did not explain the retained task"
+  assert_no_grep 'kill-window' "$log" "ambiguous Enter failure killed a possibly running worker"
+  assert_no_grep 'return --force' "$tree_log" "ambiguous Enter failure recycled a possibly active worktree"
+  assert_present "$home/state/rollback-uncertain.meta" "ambiguous Enter failure lost task metadata"
+  assert_present "$home/state/rollback-uncertain.pi-ext.ts" "ambiguous Enter failure lost its task safeguard"
+  assert_present "/tmp/fm-rollback-uncertain" "ambiguous Enter failure removed its task temp root"
+  rm -rf "/tmp/fm-rollback-uncertain"
+  rm -f "$home/state/rollback-uncertain.meta" "$home/state/rollback-uncertain.pi-ext.ts" "$current.endpoint"
+  pass "spawn rollback cleans pre-launch failures and preserves ambiguous launch submissions"
+}
+
+test_task_actions_use_recorded_host_root() {
+  local host="$TMP/recorded-host" wrong="$TMP/wrong-host" home="$TMP/recorded-home" fb log current out status=0
+  make_host "$host"; make_host "$wrong"; mkdir -p "$home/state" "$home/config"
+  printf 'window=test-session:fm-lane\nworktree=/tmp/target\nhost_root=%s\nproject=/tmp/project\nkind=ship\n' "$host" > "$home/state/lane.meta"
+  fb=$(make_fakebin "$TMP/fake-recorded-host")
+  log="$TMP/recorded-host.log"; current="$TMP/recorded-host.current"
+  : > "$log"; printf '%s\n' "$host" > "$current"; : > "$current.endpoint"
+  out=$(cd "$wrong" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$wrong" \
+    FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$TMP/unused.launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH=/tmp/target FM_HOST_PATH="$host" \
+    "$ROOT/bin/fm-send.sh" lane hello 2>&1) || status=$?
+  expect_code 2 "$status" "send must reject an ambient host that differs from task ownership"
+  assert_contains "$out" 'does not match task metadata host_root' "send did not identify recorded host ownership"
+  assert_no_grep 'send-keys' "$log" "send touched the endpoint before recorded-host validation"
+  status=0
+  out=$(cd "$wrong" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$wrong" \
+    FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$TMP/unused.launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH=/tmp/target FM_HOST_PATH="$host" \
+    "$ROOT/bin/fm-teardown.sh" lane --force 2>&1) || status=$?
+  expect_code 2 "$status" "teardown must reject an ambient host that differs from task ownership"
+  assert_present "$home/state/lane.meta" "teardown changed task data before recorded-host validation"
+  pass "task actions bind to recorded physical host ownership before endpoint or task mutation"
+}
+
+test_spawn_rejects_old_brief_and_secondmate_clears_roots() {
+  local host="$TMP/reject-host" home="$TMP/reject-home" project="$TMP/reject-target" subhome="$TMP/secondmate-home" fb log current launch meta out status=0
+  make_host "$host"; mkdir -p "$home/data/old" "$home/state" "$home/config"; printf 'old brief\n' > "$home/data/old/brief.md"; fm_git_init_commit "$project"
+  out=$(cd "$host" && FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-spawn.sh" old "$project" codex 2>&1) || status=$?
+  [ "$status" -ne 0 ] || fail "host spawn accepted a cwd-relative old brief"
+  assert_contains "$out" 'requires a host-root brief' "old-brief rejection was not explicit"
+
+  mkdir -p "$subhome/bin" "$subhome/data"
+  printf '# Secondmate\n' > "$subhome/AGENTS.md"
+  printf 'mate\n' > "$subhome/.fm-secondmate-home"
+  printf 'charter\n' > "$subhome/data/charter.md"
+  fb=$(make_fakebin "$TMP/fake-secondmate")
+  log="$TMP/secondmate.log"; current="$TMP/secondmate.current"; launch="$TMP/secondmate.launch"
+  printf '%s\n' "$subhome" > "$current"
+  (cd "$host" && PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
+    FM_HOST_ROOT="$host" FM_TARGET_WORKTREE=/should-not-leak FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$launch" \
+    FM_CURRENT_PATH="$current" FM_TARGET_PATH="$subhome" FM_HOST_PATH="$host" TMUX=fake \
+    "$ROOT/bin/fm-spawn.sh" mate "$subhome" codex --secondmate >/dev/null 2>&1)
+  assert_contains "$(cat "$launch")" 'FM_HOST_ROOT= FM_TARGET_WORKTREE=' "secondmate launch did not clear both host variables"
+  meta="$home/state/mate.meta"
+  assert_no_grep '^host_root=' "$meta" "secondmate metadata inherited host_root"
+  assert_grep "worktree=$subhome" "$meta" "secondmate lost its isolated-home worktree"
+
+  : > "$launch"; printf '%s\n' "$subhome" > "$current"
+  (cd "$host" && env -u FM_HOST_ROOT -u FM_TARGET_WORKTREE PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 \
+    FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$launch" \
+    FM_CURRENT_PATH="$current" FM_TARGET_PATH="$subhome" FM_HOST_PATH="$host" TMUX=fake \
+    "$ROOT/bin/fm-spawn.sh" mate-unset "$subhome" codex --secondmate >/dev/null 2>&1)
+  assert_not_contains "$(cat "$launch")" 'FM_HOST_ROOT=' "unset-mode secondmate launch changed its historical environment prefix"
+  assert_not_contains "$(cat "$launch")" 'FM_TARGET_WORKTREE=' "unset-mode secondmate launch set a new empty target variable"
+  pass "host spawn rejects old briefs, clears inherited secondmate roots, and preserves unset launches"
+}
+
+test_resolution_and_validation
+test_session_cwd_mismatch_precedes_mutation
+test_host_command_rendering
+test_brief_variants
+test_spawn_separates_roots
+test_duplicate_spawn_preserves_existing_task
+test_spawn_rejects_host_as_target_and_cleans_failed_transition
+test_orca_active_cwd_probe
+test_all_harnesses_add_one_task_safeguard
+test_mutators_require_host_cwd
+test_secondmate_actions_keep_supervisor_host_authority
+test_spawn_rollback_is_transactional
+test_task_actions_use_recorded_host_root
+test_spawn_rejects_old_brief_and_secondmate_clears_roots
diff --git a/tests/fm-kimi-harness.test.sh b/tests/fm-kimi-harness.test.sh
index 8e27052d8c..c532490e3f 100755
--- a/tests/fm-kimi-harness.test.sh
+++ b/tests/fm-kimi-harness.test.sh
@@ -27,8 +27,10 @@ make_spawn_fakebin() {
   cat > "$fakebin/tmux" <<'SH'
 #!/usr/bin/env bash
 set -u
-printf '%s\n' "$*" >> "$FM_FAKE_TMUX_CALL_LOG"
-state=$(cat "$FM_FAKE_KIMI_STATE" 2>/dev/null || true)
+call_log=${FM_FAKE_TMUX_CALL_LOG:-/dev/null}
+state_file=${FM_FAKE_KIMI_STATE:-/dev/null}
+printf '%s\n' "$*" >> "$call_log"
+state=$(cat "$state_file" 2>/dev/null || true)
 fake_screen() {
   case "$state" in
     ready)
@@ -379,6 +381,14 @@ test_kimi_hook_is_silent_and_requires_registered_workspace_token() {
   [ "$snapshot_before" = "$snapshot_after" ] || fail "Kimi hook wrote inside a tokenless workspace"
   assert_absent "$target" "tokenless Kimi hook invocation touched a task marker"
 
+  out=$(printf '{"hook_event_name":"Stop","session_id":"host-root-crew","cwd":"%s","stop_hook_active":false}\n' "$no_token" \
+    | HOME="$HOME_DIR" FM_KIMI_TURNEND_TOKEN="$token" bash "$hook" 2>&1)
+  rc=$?
+  expect_code 0 "$rc" "launch-scoped Kimi hook invocation did not exit zero"
+  [ -z "$out" ] || fail "launch-scoped Kimi hook invocation printed output: $out"
+  assert_present "$target" "launch-scoped Kimi token did not touch the turn-end marker"
+  rm "$target"
+
   printf 'token=%s\n' "$token" > "$WT_DIR/.fm-kimi-turnend"
   out=$(printf '{"hook_event_name":"Stop","session_id":"crew","cwd":"%s","stop_hook_active":false}\n' "$WT_DIR" \
     | HOME="$HOME_DIR" bash "$hook" 2>&1)
@@ -396,7 +406,7 @@ test_kimi_hook_is_silent_and_requires_registered_workspace_token() {
   expect_code 0 "$rc" "Kimi hook without jq must still exit zero"
   [ -z "$out" ] || fail "Kimi hook without jq printed output: $out"
   assert_absent "$target" "Kimi hook without jq touched the turn-end marker"
-  pass "Kimi hook stays silent and inert without a Firstmate registry token"
+  pass "Kimi hook accepts launch-scoped or workspace tokens and stays inert without either"
 }
 
 test_kimi_spawn_refuses_unsafe_global_config_before_pane_creation() {
@@ -425,11 +435,11 @@ test_kimi_teardown_removes_pointer_and_registry_token() {
   expect_code 0 "$rc" "Kimi spawn should succeed before teardown"
   token=$(sed -n 's/^token=//p' "$WT_DIR/.fm-kimi-turnend")
 
-  HOME="$HOME_DIR" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$HOME_DIR" \
+  out=$(HOME="$HOME_DIR" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$HOME_DIR" \
     FM_STATE_OVERRIDE="$HOME_DIR/state" FM_DATA_OVERRIDE="$HOME_DIR/data" \
     FM_PROJECTS_OVERRIDE="$HOME_DIR/projects" FM_CONFIG_OVERRIDE="$HOME_DIR/config" \
     FM_SPAWN_NO_GUARD=1 PATH="$FAKEBIN_DIR:$BASE_PATH" \
-    "$TEARDOWN" "$id" --force >/dev/null 2>&1 || fail "Kimi teardown failed"
+    "$TEARDOWN" "$id" --force 2>&1) || fail "Kimi teardown failed: $out"
   assert_absent "$WT_DIR/.fm-kimi-turnend" "Kimi token pointer survived teardown"
   assert_absent "$HOME_DIR/.kimi-code/fm-turn-end.d/$token" "Kimi registry token survived teardown"
   assert_absent "$HOME_DIR/state/$id.kimi-turnend-token" "Kimi token state survived teardown"
diff --git a/tests/fm-pr-check-security.test.sh b/tests/fm-pr-check-security.test.sh
index 1b21e5d6a8..1081eab5c3 100755
--- a/tests/fm-pr-check-security.test.sh
+++ b/tests/fm-pr-check-security.test.sh
@@ -35,6 +35,20 @@ file_mode() {
   fi
 }
 
+write_stop_aware_tmux() {
+  local path=$1
+  cat > "$path" <<'SH'
+#!/usr/bin/env bash
+stopped="${0}.stopped"
+case "${1:-}" in
+  kill-window) : > "$stopped" ;;
+  display-message) [ ! -e "$stopped" ] ;;
+  *) exit 0 ;;
+esac
+SH
+  chmod 0700 "$path"
+}
+
 state_snapshot() {
   local state=$1 file
   (
@@ -578,11 +592,7 @@ test_valid_recording_and_merge_derivation() {
   fm_pr_poll_artifacts_valid "$dir/home/state" Task_A.1 "$POLL" \
     || fail "safe lifecycle-compatible task ID did not publish an authenticated poll"
   rm -rf "$dir/wt"
-  cat > "$dir/fakebin/tmux" <<'SH'
-#!/usr/bin/env bash
-exit 0
-SH
-  chmod 0700 "$dir/fakebin/tmux"
+  write_stop_aware_tmux "$dir/fakebin/tmux"
   touch "$dir/home/state/.last-watcher-beat"
   FM_HOME="$dir/home" FM_ROOT_OVERRIDE="$ROOT" PATH="$dir/fakebin:$BASE_PATH" \
     "$TEARDOWN" Task_A.1 --force > "$dir/teardown.out" 2> "$dir/teardown.err" \
@@ -604,11 +614,7 @@ SH
     printf 'reserved migration evidence\n' \
       > "$dir/home/state/.pr-check-quarantine/!noncanonical.check.evidence"
     chmod 0600 "$dir/home/state/.pr-check-quarantine/!noncanonical.check.evidence"
-    cat > "$dir/fakebin/tmux" <<'SH'
-#!/usr/bin/env bash
-exit 0
-SH
-    chmod 0700 "$dir/fakebin/tmux"
+    write_stop_aware_tmux "$dir/fakebin/tmux"
     touch "$dir/home/state/.last-watcher-beat"
     mkdir "$dir/home/state/$id.check.sh"
     set +e
@@ -1845,11 +1851,7 @@ test_obligation_namespace_compatibility() {
     "project=$dir/project" \
     'kind=ship' \
     'mode=local-only'
-  cat > "$dir/fakebin/tmux" <<'SH'
-#!/usr/bin/env bash
-exit 0
-SH
-  chmod 0700 "$dir/fakebin/tmux"
+  write_stop_aware_tmux "$dir/fakebin/tmux"
   touch "$state/.last-watcher-beat"
   set +e
   FM_HOME="$dir/home" FM_ROOT_OVERRIDE="$ROOT" PATH="$dir/fakebin:$BASE_PATH" \
@@ -2621,11 +2623,7 @@ test_teardown_removes_poll_artifacts() {
   chmod 0700 "$dir/home/state/.pr-check-quarantine"
   printf 'legacy\n' > "$dir/home/state/.pr-check-quarantine/task-a.check.abc123"
   chmod 0600 "$dir/home/state/.pr-check-quarantine/task-a.check.abc123"
-  cat > "$fakebin/tmux" <<'SH'
-#!/usr/bin/env bash
-exit 0
-SH
-  chmod +x "$fakebin/tmux"
+  write_stop_aware_tmux "$fakebin/tmux"
   touch "$dir/home/state/.last-watcher-beat"
 
   FM_HOME="$dir/home" FM_ROOT_OVERRIDE="$ROOT" PATH="$fakebin:$BASE_PATH" \
@@ -2681,11 +2679,7 @@ SH
   printf 'noncanonical evidence\n' > "$dir/home/state/.pr-check-quarantine/!noncanonical.check.abc123"
   chmod 0600 "$dir/home/state/.pr-check-quarantine/invalid.check.abc123" \
     "$dir/home/state/.pr-check-quarantine/!noncanonical.check.abc123"
-  cat > "$fakebin/tmux" <<'SH'
-#!/usr/bin/env bash
-exit 0
-SH
-  chmod +x "$fakebin/tmux"
+  write_stop_aware_tmux "$fakebin/tmux"
   touch "$dir/home/state/.last-watcher-beat"
 
   FM_HOME="$dir/home" FM_ROOT_OVERRIDE="$ROOT" PATH="$fakebin:$BASE_PATH" \
diff --git a/tests/fm-session-start.test.sh b/tests/fm-session-start.test.sh
index 9bcf04eddb..8b4079be54 100755
--- a/tests/fm-session-start.test.sh
+++ b/tests/fm-session-start.test.sh
@@ -754,19 +754,29 @@ SH
 # --- output ordering ----------------------------------------------------------
 
 test_output_ordering_diagnostics_lead() {
-  local rec root home fakebin out lock_line boot_line wake_line context_line fleet_line next_line
+  local rec root home fakebin mask out lock_line boot_line wake_line context_line fleet_line next_line
   rec=$(new_world ordering)
   IFS='|' read -r root home fakebin <<EOF
 $rec
 EOF
   make_fake_toolchain "$fakebin"
   make_fake_ps_claude "$fakebin"
-  # Force a MISSING diagnostic line so the bootstrap section is non-trivial.
+  # Force a MISSING diagnostic even when the machine has system node later in
+  # BASE_PATH; bootstrap uses command -v, so mask only that lookup in this case.
   rm -f "$fakebin/node"
+  mask="$home/mask-node.bash"
+  cat > "$mask" <<'SH'
+command() {
+  if [ "${1:-}" = -v ] && [ "${2:-}" = node ]; then
+    return 1
+  fi
+  builtin command "$@"
+}
+SH
 
   printf 'window=fm-sess:w1\nkind=ship\n' > "$home/state/task-a.meta"
 
-  out=$(run_session_start "$home" "$root" "$fakebin:$BASE_PATH")
+  out=$(BASH_ENV="$mask" run_session_start "$home" "$root" "$fakebin:$BASE_PATH")
 
   lock_line=$(printf '%s\n' "$out" | grep -n '^LOCK$' | head -1 | cut -d: -f1)
   boot_line=$(printf '%s\n' "$out" | grep -n '^BOOTSTRAP$' | head -1 | cut -d: -f1)
@@ -1037,7 +1047,7 @@ EOF
 # --- composition: real scripts run, not reimplemented ------------------------
 
 test_composition_invokes_real_scripts() {
-  local rec root home fakebin out
+  local rec root home fakebin mask out
   rec=$(new_world composition)
   IFS='|' read -r root home fakebin <<EOF
 $rec
@@ -1045,11 +1055,20 @@ EOF
   make_fake_toolchain "$fakebin"
   make_fake_ps_claude "$fakebin"
   rm -f "$fakebin/node"
+  mask="$home/mask-node.bash"
+  cat > "$mask" <<'SH'
+command() {
+  if [ "${1:-}" = -v ] && [ "${2:-}" = node ]; then
+    return 1
+  fi
+  builtin command "$@"
+}
+SH
 
   printf 'needs-decision: pick a library\n' > "$home/state/task-z.status"
   append_wake "$home/state" signal task-z.status "needs-decision: pick a library"
 
-  out=$(run_session_start "$home" "$root" "$fakebin:$BASE_PATH")
+  out=$(BASH_ENV="$mask" run_session_start "$home" "$root" "$fakebin:$BASE_PATH")
 
   # fm-lock.sh's own exact success text.
   assert_contains "$out" "lock acquired: harness pid" "fm-lock.sh's real output did not appear (composition, not reimplementation)"
diff --git a/tests/fm-sessionstart-nudge.test.sh b/tests/fm-sessionstart-nudge.test.sh
index 878295cba5..c72d7bbd3a 100755
--- a/tests/fm-sessionstart-nudge.test.sh
+++ b/tests/fm-sessionstart-nudge.test.sh
@@ -113,7 +113,8 @@ test_opencode_plugin_delivers_exact_nudge_once() {
   local root="$TMP_ROOT/opencode-primary" out status=0
   make_primary "$root"
   cp "$ROOT/bin/fm-sessionstart-nudge.sh" "$ROOT/bin/fm-primary-scope-lib.sh" \
-    "$ROOT/bin/fm-gate-refuse-lib.sh" "$ROOT/bin/fm-operational-input.sh" "$root/bin/"
+    "$ROOT/bin/fm-gate-refuse-lib.sh" "$ROOT/bin/fm-host-root-lib.sh" \
+    "$ROOT/bin/fm-operational-input.sh" "$root/bin/"
   chmod +x "$root/bin/fm-sessionstart-nudge.sh"
   out=$(PLUGIN="$ROOT/.opencode/plugins/fm-primary-sessionstart-nudge.js" \
     WORKTREE="$root" EXPECTED="$NUDGE_LINE" node --input-type=module 2>&1 <<'EOF'
diff --git a/tests/fm-tangle-guard.test.sh b/tests/fm-tangle-guard.test.sh
index 4df2706121..6cd3ed46e5 100755
--- a/tests/fm-tangle-guard.test.sh
+++ b/tests/fm-tangle-guard.test.sh
@@ -158,13 +158,28 @@ make_spawn_fakebin() {
   cat > "$fakebin/tmux" <<'SH'
 #!/usr/bin/env bash
 set -u
+stopped="${0}.stopped"
+[ "${1:-}" != list-panes ] || exit 0
 case "$*" in
-  *"#{pane_current_path}"*) printf '%s\n' "${FM_FAKE_PANE_PATH:-}"; exit 0 ;;
+  *"#{pane_current_path}"*)
+    [ ! -e "$stopped" ] || exit 1
+    if [ -n "${FM_FAKE_PANE_SEQUENCE:-}" ] && [ -s "$FM_FAKE_PANE_SEQUENCE" ]; then
+      head -1 "$FM_FAKE_PANE_SEQUENCE"
+      tail -n +2 "$FM_FAKE_PANE_SEQUENCE" > "$FM_FAKE_PANE_SEQUENCE.next"
+      mv "$FM_FAKE_PANE_SEQUENCE.next" "$FM_FAKE_PANE_SEQUENCE"
+    else
+      printf '%s\n' "${FM_FAKE_PANE_PATH:-}"
+    fi
+    exit 0
+    ;;
+  *"#{pane_id}"*) [ ! -e "$stopped" ] && printf '%%1\n'; exit $? ;;
 esac
 case "${1:-}" in
   display-message) printf 'firstmate\n'; exit 0 ;;
   list-windows) exit 0 ;;
-  has-session|new-session|new-window|send-keys) exit 0 ;;
+  new-window) rm -f "$stopped"; exit 0 ;;
+  kill-window) : > "$stopped"; exit 0 ;;
+  has-session|new-session|send-keys) exit 0 ;;
 esac
 exit 0
 SH
@@ -180,8 +195,8 @@ run_spawn() {
   FM_ROOT_OVERRIDE='' FM_HOME="$home" \
     FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
     FM_PROJECTS_OVERRIDE="$home/projects" FM_CONFIG_OVERRIDE="$home/config" \
-    FM_SPAWN_NO_GUARD=1 FM_FAKE_PANE_PATH="$pane" TMUX="fake,1,0" \
-    PATH="$fakebin:$PATH" \
+    FM_SPAWN_NO_GUARD=1 FM_WORKTREE_CWD_ATTEMPTS="${FM_WORKTREE_CWD_ATTEMPTS:-2}" FM_WORKTREE_CWD_DELAY=0 \
+    FM_FAKE_PANE_PATH="$pane" TMUX="fake,1,0" PATH="$fakebin:$PATH" \
     "$ROOT/bin/fm-spawn.sh" "$id" "$proj" codex 2>&1
 }
 
@@ -211,7 +226,18 @@ test_spawn_isolation_abort() {
   expect_code 0 "$status" "spawn into a genuine isolated worktree should succeed"
   assert_contains "$out" "spawned ok-isolated-ff6" "isolated spawn did not report success"
   assert_not_contains "$out" "did not yield an isolated worktree" "isolated spawn wrongly tripped the guard"
-  pass "fm-spawn: aborts unless the resolved worktree is a genuine, isolated worktree"
+
+  # A real Treehouse shell may briefly traverse a non-repository container
+  # directory before entering the linked worktree. Keep polling that transient
+  # cwd instead of treating the first project-external path as final.
+  mkdir -p "$TMP_ROOT/transient-container"
+  printf '%s\n%s\n' "$TMP_ROOT/transient-container" "$TMP_ROOT/spawn-wt" > "$TMP_ROOT/pane-sequence"
+  status=0
+  out=$(FM_FAKE_PANE_SEQUENCE="$TMP_ROOT/pane-sequence" FM_WORKTREE_CWD_ATTEMPTS=3 \
+    run_spawn "$home" transient-isolated-gg7 "$proj" "$TMP_ROOT/spawn-wt" "$fakebin"); status=$?
+  expect_code 0 "$status" "spawn should poll past a transient non-worktree cwd"
+  assert_contains "$out" "spawned transient-isolated-gg7" "transient cwd recovery did not complete the spawn"
+  pass "fm-spawn: requires a genuine isolated worktree and polls past transient container cwd values"
 }
 
 # --- GUARD 1c: fm-spawn tmux window construction ----------------------------
diff --git a/tests/fm-teardown.test.sh b/tests/fm-teardown.test.sh
index a57a08f6b3..cbb2088e87 100755
--- a/tests/fm-teardown.test.sh
+++ b/tests/fm-teardown.test.sh
@@ -83,9 +83,15 @@ exit 0
 SH
   cat > "$fakebin/tmux" <<'SH'
 #!/usr/bin/env bash
-# tmux kill-window etc.: succeed silently.
-exit 0
+state="${0%/*}/tmux-live"
+case "${1:-}" in
+  display-message) [ -f "$state" ] ;;
+  list-panes) [ ! -f "$state" ] || printf '%%1|@1|firstmate:fm-task-x1|firstmate:1.0\n' ;;
+  kill-window) [ "${FM_FAKE_TMUX_STOP_FAIL:-0}" = 1 ] || rm -f "$state" ;;
+  *) exit 0 ;;
+esac
 SH
+  : > "$fakebin/tmux-live"
   # Default gh-axi mock: no PR is associated with the branch, and viewing any PR
   # number fails. This keeps the landed-work check hermetic (never reaching the real
   # gh-axi) and represents the common "no GitHub PR" baseline. Tests that need a
@@ -515,6 +521,23 @@ test_local_only_fork_remote_allows() {
   pass "local-only worktree with HEAD on a fork remote is torn down (fix holds)"
 }
 
+test_teardown_removes_host_root_adapter_state() {
+  local case_dir artifact
+  case_dir=$(make_case host-adapter-state-cleanup)
+  write_meta "$case_dir" local-only ship
+  wt_commit "$case_dir" "host-root adapter cleanup"
+  add_fork_with_pushed_branch "$case_dir"
+  : > "$case_dir/state/task-x1.claude-settings.json"
+  : > "$case_dir/state/task-x1.opencode-turn-end.js"
+
+  run_teardown "$case_dir" > "$case_dir/stdout" 2> "$case_dir/stderr" \
+    || fail "host-adapter-state-cleanup: teardown failed"
+  for artifact in task-x1.claude-settings.json task-x1.opencode-turn-end.js; do
+    assert_absent "$case_dir/state/$artifact" "teardown left host-root adapter state $artifact"
+  done
+  pass "teardown removes state-owned Claude and OpenCode host-root adapters"
+}
+
 test_teardown_prompts_tasks_axi_done_when_compatible() {
   local case_dir out
   case_dir=$(make_case tasks-axi-reminder)
@@ -1243,6 +1266,29 @@ test_local_only_force_overrides_unpushed() {
   pass "local-only worktree with unpushed work is torn down under --force (escape hatch)"
 }
 
+test_unconfirmed_stop_preserves_worktree() {
+  local case_dir rc tree_log
+  case_dir=$(make_case stop-unconfirmed)
+  write_meta "$case_dir" local-only ship
+  tree_log="$case_dir/treehouse.log"
+  cat > "$case_dir/fakebin/treehouse" <<'SH'
+#!/usr/bin/env bash
+printf '%s\n' "$*" >> "$FM_TREEHOUSE_LOG"
+SH
+  chmod +x "$case_dir/fakebin/treehouse"
+  set +e
+  FM_FAKE_TMUX_STOP_FAIL=1 FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 FM_TREEHOUSE_LOG="$tree_log" \
+    run_teardown "$case_dir" --force > "$case_dir/stdout" 2> "$case_dir/stderr"
+  rc=$?
+  set -e
+  expect_code 1 "$rc" "stop-unconfirmed: teardown must fail when endpoint termination cannot be confirmed"
+  assert_grep 'still exists after stop' "$case_dir/stderr" "stop-unconfirmed: refusal did not explain the live endpoint"
+  assert_present "$case_dir/state/task-x1.meta" "stop-unconfirmed: teardown removed recoverable metadata"
+  assert_present "$case_dir/wt" "stop-unconfirmed: teardown recycled the isolated copy"
+  [ ! -s "$tree_log" ] || fail "stop-unconfirmed: teardown invoked treehouse before confirming termination"
+  pass "teardown preserves the isolated copy and task record when worker termination is unconfirmed"
+}
+
 test_herdr_teardown_clears_escalation_marker() {
   local case_dir marker
   case_dir=$(make_case herdr-marker-cleanup)
@@ -1257,14 +1303,28 @@ test_herdr_teardown_clears_escalation_marker() {
     'herdr_pane_id=wG:pQ' >> "$case_dir/state/task-x1.meta"
   cat > "$case_dir/fakebin/herdr" <<'SH'
 #!/usr/bin/env bash
-exit 0
+state="${0%/*}/herdr-live"
+case " $* " in
+  *' status --json '*) printf '%s\n' '{"server":{"running":true}}' ;;
+  *' pane close '*) rm -f "$state" ;;
+  *' pane get '*)
+    if [ -f "$state" ]; then
+      printf '%s\n' '{"result":{"pane":{"pane_id":"pQ"}}}'
+    else
+      printf '%s\n' '{"error":{"code":"pane_not_found"}}' >&2
+      exit 1
+    fi
+    ;;
+  *) exit 0 ;;
+esac
 SH
+  : > "$case_dir/fakebin/herdr-live"
   chmod +x "$case_dir/fakebin/herdr"
   marker="$case_dir/state/.herdr-escalated-default_wG_pQ"
   : > "$marker"
 
   run_teardown "$case_dir" --force > "$case_dir/stdout" 2> "$case_dir/stderr" \
-    || fail "herdr-marker-cleanup: forced teardown failed"
+    || fail "herdr-marker-cleanup: forced teardown failed: $(cat "$case_dir/stderr")"
   [ ! -e "$marker" ] || fail "herdr-marker-cleanup: teardown left the pane's escalation marker behind"
   pass "herdr teardown removes pane-owned escalation dedupe state"
 }
@@ -1359,7 +1419,7 @@ test_herdr_projection_teardown_retires_journal_only_after_confirmed_close() {
 }
 
 test_herdr_projection_teardown_retains_journal_when_close_unconfirmed() {
-  local case_dir log closed restored
+  local case_dir log closed restored status=0
   case_dir=$(make_case herdr-projection-unconfirmed-close)
   write_meta "$case_dir" local-only ship
   configure_herdr_projection_teardown_case "$case_dir"
@@ -1367,17 +1427,23 @@ test_herdr_projection_teardown_retains_journal_when_close_unconfirmed() {
 
   FM_FAKE_HERDR_LOG="$log" FM_FAKE_HERDR_CLOSED="$closed" FM_FAKE_HERDR_RESTORED="$restored" FM_FAKE_HERDR_CLOSE_FAIL=1 \
     run_teardown "$case_dir" --force > "$case_dir/stdout" 2> "$case_dir/stderr" \
-    || fail "herdr-projection-unconfirmed-close: teardown should preserve best-effort endpoint semantics"
+    || status=$?
+  [ "$status" -ne 0 ] || fail "herdr-projection-unconfirmed-close: teardown accepted an unconfirmed endpoint stop"
   [ -e "$case_dir/state/task-x1.herdr-presentation" ] \
     || fail "unconfirmed task-pane close incorrectly retired the presentation journal"
-  assert_grep "close could not be confirmed" "$case_dir/stderr" \
-    "unconfirmed projected close did not explain why the journal was retained"
+  assert_present "$case_dir/state/task-x1.meta" \
+    "unconfirmed projected close removed the recovery metadata"
+  assert_present "$case_dir/wt" \
+    "unconfirmed projected close removed the isolated worktree"
+  assert_grep "could not be confirmed absent" "$case_dir/stderr" \
+    "unconfirmed projected close did not explain the destructive-cleanup refusal"
   assert_not_contains "$(cat "$log")" "workspace close" \
     "unconfirmed projected close must not escalate to workspace cleanup"
-  pass "herdr projection teardown retains the stale journal and attempts no workspace cleanup when exact-pane close is unconfirmed"
+  pass "herdr projection teardown retains task state and refuses destructive cleanup when exact-pane close is unconfirmed"
 }
 
 test_local_only_fork_remote_allows
+test_teardown_removes_host_root_adapter_state
 test_teardown_prompts_tasks_axi_done_when_compatible
 test_teardown_manual_backend_prompts_hand_edit_even_when_tasks_axi_present
 test_local_only_truly_unpushed_refuses
@@ -1385,6 +1451,7 @@ test_local_only_merged_to_local_main_allows
 test_no_mistakes_origin_remote_allows
 test_no_mistakes_truly_unpushed_refuses
 test_local_only_force_overrides_unpushed
+test_unconfirmed_stop_preserves_worktree
 test_herdr_teardown_clears_escalation_marker
 test_herdr_projection_teardown_retires_journal_only_after_confirmed_close
 test_herdr_projection_teardown_retains_journal_when_close_unconfirmed
diff --git a/tests/fm-turnend-guard.test.sh b/tests/fm-turnend-guard.test.sh
index 242407c1a3..d573402184 100755
--- a/tests/fm-turnend-guard.test.sh
+++ b/tests/fm-turnend-guard.test.sh
@@ -103,6 +103,7 @@ install_guard_scripts() {
   cp "$ROOT/bin/fm-turnend-guard-grok.sh" "$dir/bin/fm-turnend-guard-grok.sh"
   cp "$ROOT/bin/fm-operational-input.sh" "$dir/bin/fm-operational-input.sh"
   cp "$ROOT/bin/fm-supervision-instructions.sh" "$dir/bin/fm-supervision-instructions.sh"
+  cp "$ROOT/bin/fm-host-root-lib.sh" "$dir/bin/fm-host-root-lib.sh"
   cp "$ROOT/bin/fm-harness.sh" "$dir/bin/fm-harness.sh"
   cp "$ROOT/bin/fm-primary-scope-lib.sh" "$dir/bin/fm-primary-scope-lib.sh"
   cp "$ROOT/bin/fm-supervision-lib.sh" "$dir/bin/fm-supervision-lib.sh"
diff --git a/tests/fm-watcher-lock.test.sh b/tests/fm-watcher-lock.test.sh
index e741ec21e8..ddb6f65151 100755
--- a/tests/fm-watcher-lock.test.sh
+++ b/tests/fm-watcher-lock.test.sh
@@ -438,14 +438,21 @@ test_watch_restart_rejects_reused_pid() {
 }
 
 test_watch_restart_attaches_to_healthy_peer() {
-  local dir state fakebin out peer identity armpid status i
+  local dir state fakebin out ready peer identity armpid status i
   dir=$(make_case restart-healthy-peer)
   state="$dir/state"
   fakebin="$dir/fakebin"
   out="$dir/restart.out"
+  ready="$dir/peer-ready"
   mark_pr_check_migration_complete "$state"
-  node -e 'process.on("SIGTERM", () => {}); setTimeout(() => {}, 300000)' &
+  node -e 'const fs = require("fs"); process.on("SIGTERM", () => {}); fs.writeFileSync(process.argv[1], "ready"); setTimeout(() => {}, 300000)' "$ready" &
   peer=$!
+  i=0
+  while [ "$i" -lt 50 ] && [ ! -e "$ready" ]; do
+    sleep 0.1
+    i=$((i + 1))
+  done
+  [ -e "$ready" ] || fail "TERM-resistant peer did not finish installing its signal handler"
   identity=$(FM_STATE_OVERRIDE="$state" bash -c '. "$1"; fm_pid_identity "$2"' _ "$LIB" "$peer") || fail "could not identify peer pid"
   mkdir "$state/.watch.lock"
   printf '%s\n' "$peer" > "$state/.watch.lock/pid"
diff --git a/tests/secondmate-helpers.sh b/tests/secondmate-helpers.sh
index b80a432fcb..ac74d93d87 100644
--- a/tests/secondmate-helpers.sh
+++ b/tests/secondmate-helpers.sh
@@ -23,8 +23,19 @@ make_fake_tmux() {
   cat > "$fakebin/tmux" <<'SH'
 #!/usr/bin/env bash
 set -u
+stopped="${0}.stopped"
 case "${1:-}" in
-  has-session|new-session|new-window|send-keys|kill-window)
+  has-session|new-session|send-keys)
+    printf '%s\n' "$*" >> "$FM_FAKE_TMUX_LOG"
+    exit 0
+    ;;
+  new-window)
+    rm -f "$stopped"
+    printf '%s\n' "$*" >> "$FM_FAKE_TMUX_LOG"
+    exit 0
+    ;;
+  kill-window)
+    : > "$stopped"
     printf '%s\n' "$*" >> "$FM_FAKE_TMUX_LOG"
     exit 0
     ;;
@@ -35,12 +46,18 @@ case "${1:-}" in
     exit 0
     ;;
   display-message)
+    [ ! -e "$stopped" ] || exit 1
     case "$*" in
       *'#{cursor_y}'*) printf '0\n' ;;
       *) printf 'firstmate\n' ;;
     esac
     exit 0
     ;;
+  list-panes)
+    [ -e "$stopped" ] && exit 0
+    printf '%%1\n'
+    exit 0
+    ;;
   capture-pane)
     printf '%s\n' "$*" >> "$FM_FAKE_TMUX_LOG"
     cat "$FM_FAKE_TMUX_CAPTURE"

From bafae131db37599a13c022c752064c4eff87b91b Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Sun, 26 Jul 2026 11:10:38 +0300
Subject: [PATCH 02/39] no-mistakes(review): Scope host-root lifecycle
 safeguards correctly

---
 bin/fm-decision-hold.sh            |  25 ++++++-
 bin/fm-host-root-lib.sh            |   7 +-
 bin/fm-merge-local.sh              |   4 ++
 bin/fm-promote.sh                  |   7 +-
 bin/fm-spawn.sh                    |   3 +-
 bin/fm-supervision-instructions.sh |   6 +-
 bin/fm-teardown.sh                 |  80 ++++++++++++++++-----
 tests/fm-backend.test.sh           |  13 +++-
 tests/fm-host-root-mode.test.sh    | 111 +++++++++++++++++++++++++++--
 tests/fm-teardown.test.sh          |  22 ++++--
 10 files changed, 239 insertions(+), 39 deletions(-)

diff --git a/bin/fm-decision-hold.sh b/bin/fm-decision-hold.sh
index 2fe98bb147..7175fb0321 100755
--- a/bin/fm-decision-hold.sh
+++ b/bin/fm-decision-hold.sh
@@ -85,14 +85,30 @@ validate_one_line() {  # <label> <value>
 }
 
 assert_origin_host() {  # <origin-id>
-  local origin=$1 meta="$STATE/$1.meta"
+  local origin=$1 meta="$STATE/$1.meta" owner="$DATA/$1/host-root"
   if [ -f "$meta" ]; then
     fm_host_root_assert_task_cwd "$FM_ROOT" "$meta"
-  else
-    fm_host_root_assert_session_cwd "$FM_ROOT"
+  elif [ -e "$owner" ] || [ -L "$owner" ]; then
+    [ -f "$owner" ] && [ ! -L "$owner" ] || fail "origin host owner is not a regular file: $owner"
+    fm_host_root_assert_task_cwd "$FM_ROOT" "$owner"
+  elif fm_host_root_enabled; then
+    fail "origin $origin has no durable recorded host owner"
   fi
 }
 
+record_origin_host() {  # <origin-id> <meta>
+  local origin=$1 meta=$2 recorded owner="$DATA/$1/host-root"
+  recorded=$(meta_value "$meta" host_root)
+  [ -n "$recorded" ] || return 0
+  if [ -e "$owner" ] || [ -L "$owner" ]; then
+    [ -f "$owner" ] && [ ! -L "$owner" ] || fail "origin host owner is not a regular file: $owner"
+    [ "$(cat "$owner")" = "host_root=$recorded" ] || fail "origin host owner does not match task metadata: $owner"
+    return 0
+  fi
+  (umask 077; printf 'host_root=%s\n' "$recorded" > "$owner") \
+    || fail "could not persist origin host owner: $owner"
+}
+
 sha256_text() {  # <text>
   if command -v shasum >/dev/null 2>&1; then
     printf '%s' "$1" | shasum -a 256 | awk '{print $1}'
@@ -332,6 +348,9 @@ EOF
 $open
 EOF
 
+  if [ "$has_meta" = 1 ]; then
+    record_origin_host "$origin" "$meta"
+  fi
   if [ "$has_meta" = 1 ]; then
     if [ "$(meta_value "$meta" decisions_reviewed)" != 1 ] || [ "$previous" != "$keys" ]; then
       printf 'decisions_reviewed=1\ndecision_keys=%s\n' "$keys" >> "$meta"
diff --git a/bin/fm-host-root-lib.sh b/bin/fm-host-root-lib.sh
index d4af99eb28..5973109253 100644
--- a/bin/fm-host-root-lib.sh
+++ b/bin/fm-host-root-lib.sh
@@ -103,8 +103,11 @@ fm_host_root_assert_task_cwd() {
 
 fm_host_root_paths_overlap() {
   local host=$1 target=$2
-  case "$target/" in "$host/"*) return 0 ;; esac
-  case "$host/" in "$target/"*) return 0 ;; esac
+  [ "$host" = "$target" ] && return 0
+  [ "$host" = / ] && return 0
+  [ "$target" = / ] && return 0
+  case "$target" in "$host"/*) return 0 ;; esac
+  case "$host" in "$target"/*) return 0 ;; esac
   return 1
 }
 
diff --git a/bin/fm-merge-local.sh b/bin/fm-merge-local.sh
index 8edfafc431..dafd2faa05 100755
--- a/bin/fm-merge-local.sh
+++ b/bin/fm-merge-local.sh
@@ -22,6 +22,10 @@ ID=${1:?usage: fm-merge-local.sh <task-id>}
 META="$STATE/$ID.meta"
 [ -f "$META" ] || { echo "error: no meta for task $ID at $META" >&2; exit 1; }
 fm_host_root_assert_task_cwd "$FM_ROOT" "$META" || exit $?
+if grep -q '^host_root=.' "$META"; then
+  echo "error: local-only merge is unavailable for host-root task $ID" >&2
+  exit 1
+fi
 # The recorded host binding is established before this guard can repair state.
 "$FM_ROOT/bin/fm-guard.sh" || true
 
diff --git a/bin/fm-promote.sh b/bin/fm-promote.sh
index 5a3cdee466..2efc524883 100755
--- a/bin/fm-promote.sh
+++ b/bin/fm-promote.sh
@@ -30,5 +30,10 @@ echo "kind=ship" >> "$TMP"
 mv "$TMP" "$META"
 
 HOME_Q=$(printf '%q' "$FM_HOME")
+SEND=bin/fm-send.sh
+if grep -q '^host_root=.' "$META"; then
+  FM_ROOT_REAL=$(cd "$FM_ROOT" && pwd -P)
+  SEND=$(fm_host_root_shell_quote "$FM_ROOT_REAL/bin/fm-send.sh")
+fi
 echo "promoted $ID to ship (teardown protection restored)"
-echo "next: FM_HOME=$HOME_Q bin/fm-send.sh fm-$ID '<ship instructions: review scratch state with git status and git log; reset to a clean default-branch base; carry over only intended fix changes; create branch fm/$ID; implement; report done>'"
+echo "next: FM_HOME=$HOME_Q $SEND fm-$ID '<ship instructions: review scratch state with git status and git log; reset to a clean default-branch base; carry over only intended fix changes; create branch fm/$ID; implement; report done>'"
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index db94af5cb4..921e2037d6 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -1048,6 +1048,7 @@ validate_spawn_worktree() {  # <source> <inspect-target>
 }
 
 arm_created_endpoint_rollback() {
+  [ "$HOST_MODE" -eq 1 ] && [ "$KIND" != secondmate ] || return 0
   [ "${FM_BACKEND_CREATE_OCCURRED:-0}" = 1 ] || return 0
   SPAWN_ENDPOINT_CREATED=1
   case "$BACKEND" in
@@ -1363,7 +1364,7 @@ esac
 # endpoint. Adapter create functions expose partial post-create state so a
 # verification failure cannot leave an unrecorded live endpoint; a duplicate
 # preflight failure leaves FM_BACKEND_CREATE_OCCURRED=0 and owns nothing.
-if [ "$BACKEND" != orca ]; then
+if [ "$HOST_MODE" -eq 1 ] && [ "$KIND" != secondmate ] && [ "$BACKEND" != orca ]; then
   SPAWN_ENDPOINT_CREATED=1
   SPAWN_ABORT_CLEANUP=1
 fi
diff --git a/bin/fm-supervision-instructions.sh b/bin/fm-supervision-instructions.sh
index 356274e168..b3be1d66e0 100755
--- a/bin/fm-supervision-instructions.sh
+++ b/bin/fm-supervision-instructions.sh
@@ -167,10 +167,10 @@ repair_line() {
 ordinary_wake_line() {
   case "$HARNESS" in
     claude)
-      printf '%s\n' '- Ordinary wake: the Stop-owned auto-arm (bin/fm-claude-stop-autoarm.sh) already owns watcher continuity; drain and handle the wake, and do not arm another cycle yourself.'
+      printf '%s%s%s\n' '- Ordinary wake: the Stop-owned auto-arm (' "$FM_BIN_PREFIX" '/fm-claude-stop-autoarm.sh) already owns watcher continuity; drain and handle the wake, and do not arm another cycle yourself.'
       ;;
     codex)
-      printf '%s\n' '- Ordinary wake: take the next foreground bin/fm-watch-checkpoint.sh checkpoint as directed below.'
+      printf '%s%s%s\n' '- Ordinary wake: take the next foreground ' "$FM_BIN_PREFIX" '/fm-watch-checkpoint.sh checkpoint as directed below.'
       ;;
     pi|pi-signed)
       printf '%s\n' '- Ordinary wake: the Pi extension already owns watcher continuity; do not arm another cycle.'
@@ -179,7 +179,7 @@ ordinary_wake_line() {
       printf '%s\n' '- Ordinary wake: the OpenCode TUI plugin already owns watcher continuity; do not arm manually.'
       ;;
     grok)
-      printf '%s\n' '- Ordinary wake: re-arm exactly one bin/fm-watch-arm.sh Grok tracked background task as directed below.'
+      printf '%s%s%s\n' '- Ordinary wake: re-arm exactly one ' "$FM_BIN_PREFIX" '/fm-watch-arm.sh Grok tracked background task as directed below.'
       ;;
     *)
       printf '%s\n' '- Ordinary wake: follow the continuation in the harness protocol below; do not use shell &.'
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index ed1c9fdaed..8fd6c158f6 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -34,8 +34,8 @@
 # device. It refuses and preserves task state when that proof fails; otherwise
 # it removes the task's check, trust record, PR sidecar, publication record, and
 # quarantine entries with the rest of the volatile state.
-# Every task endpoint is stopped and verified absent before its isolated copy is
-# changed, returned, or removed.
+# Every host-root task endpoint is stopped and verified absent before its
+# isolated copy is changed, returned, or removed.
 # Orca tasks use the same safety checks, then close the recorded terminal and
 # remove the recorded worktree through `orca worktree rm`; teardown never guesses
 # an Orca target from ambient CLI state.
@@ -149,6 +149,8 @@ KIND=$(grep '^kind=' "$META" | cut -d= -f2- || true)
 [ -n "$KIND" ] || KIND=ship
 MODE=$(grep '^mode=' "$META" | cut -d= -f2- || true)
 [ -n "$MODE" ] || MODE=no-mistakes
+TASK_HOST_MODE=0
+grep -q '^host_root=.' "$META" && TASK_HOST_MODE=1
 
 default_branch() {
   local ref branch
@@ -1099,6 +1101,10 @@ if [ "$KIND" = secondmate ] && [ "$FORCE" != "--force" ]; then
   fi
 fi
 
+if [ "$TASK_HOST_MODE" -eq 0 ] && [ "$KIND" = secondmate ] && [ "$FORCE" = "--force" ]; then
+  cleanup_firstmate_home_children "$HOME_PATH"
+fi
+
 if [ "$KIND" = scout ] && [ "$FORCE" != "--force" ]; then
   REPORT="$DATA/$ID/report.md"
   if [ ! -f "$REPORT" ]; then
@@ -1183,19 +1189,21 @@ if [ -d "$WT" ] && [ "$FORCE" != "--force" ]; then
   validate_worktree_teardown_safety_with_lock_cleanup || exit 1
 fi
 
-if [ "$BACKEND" = orca ] && [ "$KIND" != secondmate ] && [ "$ORCA_PATH_MATCH_VERIFIED" != 1 ]; then
-  require_orca_worktree_path_match_if_present "$ORCA_WORKTREE_ID" "$WT" || exit 1
-  ORCA_PATH_MATCH_VERIFIED=1
-fi
-stop_task_endpoint_and_verify || exit 1
-if [ "$BACKEND" = orca ] && [ -d "$WT" ] && [ "$FORCE" != "--force" ]; then
-  validate_worktree_teardown_safety_with_lock_cleanup || exit 1
-fi
-if [ "$KIND" = secondmate ] && [ "$FORCE" = "--force" ]; then
-  cleanup_firstmate_home_children "$HOME_PATH"
+if [ "$TASK_HOST_MODE" -eq 1 ]; then
+  if [ "$BACKEND" = orca ] && [ "$KIND" != secondmate ] && [ "$ORCA_PATH_MATCH_VERIFIED" != 1 ]; then
+    require_orca_worktree_path_match_if_present "$ORCA_WORKTREE_ID" "$WT" || exit 1
+    ORCA_PATH_MATCH_VERIFIED=1
+  fi
+  stop_task_endpoint_and_verify || exit 1
+  if [ "$BACKEND" = orca ] && [ -d "$WT" ] && [ "$FORCE" != "--force" ]; then
+    validate_worktree_teardown_safety_with_lock_cleanup || exit 1
+  fi
+  if [ "$KIND" = secondmate ] && [ "$FORCE" = "--force" ]; then
+    cleanup_firstmate_home_children "$HOME_PATH"
+  fi
 fi
 
-# The worker is confirmed stopped before the task branch or isolated copy changes.
+# Host-root tasks reach this point with the worker confirmed stopped.
 if [ "$BACKEND" = orca ] && [ "$KIND" != secondmate ]; then
   if [ "$ORCA_PATH_MATCH_VERIFIED" != 1 ]; then
     require_orca_worktree_path_match_if_present "$ORCA_WORKTREE_ID" "$WT" || exit 1
@@ -1211,6 +1219,9 @@ if [ "$BACKEND" = orca ] && [ "$KIND" != secondmate ]; then
     rm -f "$WT/.claude/settings.local.json" "$WT/.opencode/plugins/fm-turn-end.js" \
       "$WT/.fm-grok-turnend" "$WT/.fm-kimi-turnend"
   fi
+  if [ "$TASK_HOST_MODE" -eq 0 ] && [ -n "$T" ]; then
+    fm_backend_kill "$BACKEND" "$T" "$(meta_value "$META" zellij_tab_id)" "fm-$ID" 2>/dev/null || true
+  fi
   fm_backend_remove_worktree "$BACKEND" "$ORCA_WORKTREE_ID"
 elif [ -d "$WT" ] && [ "$KIND" != secondmate ]; then
   branch=$(git -C "$WT" rev-parse --abbrev-ref HEAD 2>/dev/null || echo HEAD)
@@ -1236,9 +1247,46 @@ elif [ -d "$WT" ] && [ "$KIND" != secondmate ]; then
   }
 fi
 
-if [ "$BACKEND" = herdr ] \
-   && [ "$HERDR_PRESENTATION_RETIRE_CANDIDATE" != 1 ] \
-   && { [ -e "$HERDR_PRESENTATION_JOURNAL" ] || [ -L "$HERDR_PRESENTATION_JOURNAL" ]; }; then
+if [ "$TASK_HOST_MODE" -eq 0 ]; then
+  if [ "$HERDR_PRESENTATION_RETIRE_CANDIDATE" = 1 ]; then
+    . "$SCRIPT_DIR/fm-wake-lib.sh"
+    HERDR_PRESENTATION_FOCUS_LOCK=
+    HERDR_PRESENTATION_FOCUS_LOCK_HELD=0
+    HERDR_PRESENTATION_FOCUS_LOCK_ATTEMPT=0
+    if HERDR_PRESENTATION_FOCUS_LOCK=$(fm_backend_herdr_presentation_session_lock_path "$HERDR_PRESENTATION_SESSION"); then
+      while [ "$HERDR_PRESENTATION_FOCUS_LOCK_ATTEMPT" -lt 50 ]; do
+        if fm_lock_try_acquire "$HERDR_PRESENTATION_FOCUS_LOCK"; then
+          HERDR_PRESENTATION_FOCUS_LOCK_HELD=1
+          break
+        fi
+        sleep 0.1
+        HERDR_PRESENTATION_FOCUS_LOCK_ATTEMPT=$((HERDR_PRESENTATION_FOCUS_LOCK_ATTEMPT + 1))
+      done
+    fi
+    if [ "$HERDR_PRESENTATION_FOCUS_LOCK_HELD" = 1 ]; then
+      fm_backend_herdr_projection_close_pane_focus_preserving \
+        "$HERDR_PRESENTATION_SESSION" "$HERDR_PRESENTATION_PANE" 2>/dev/null || true
+      HERDR_PRESENTATION_FOCUS_LOCK_HELD=0
+      fm_lock_release "$HERDR_PRESENTATION_FOCUS_LOCK" || true
+    else
+      echo "warning: herdr presentation focus lock unavailable; refusing a concurrent focus-unsafe pane close" >&2
+    fi
+  elif [ "$BACKEND" != orca ]; then
+    fm_backend_kill "$BACKEND" "$T" "$(meta_value "$META" zellij_tab_id)" "fm-$ID" 2>/dev/null || true
+  fi
+  if [ "$HERDR_PRESENTATION_RETIRE_CANDIDATE" = 1 ]; then
+    if [ "$(fm_backend_herdr_pane_agent_state "$HERDR_PRESENTATION_SESSION" "$HERDR_PRESENTATION_PANE")" = dead ]; then
+      rm -f "$HERDR_PRESENTATION_JOURNAL"
+    else
+      echo "warning: exact herdr task-pane close could not be confirmed for $ID; retaining the presentation journal and attempting no workspace cleanup" >&2
+    fi
+  elif [ "$BACKEND" = herdr ] \
+       && { [ -e "$HERDR_PRESENTATION_JOURNAL" ] || [ -L "$HERDR_PRESENTATION_JOURNAL" ]; }; then
+    echo "warning: herdr presentation journal for $ID remains quarantined; no workspace cleanup was attempted" >&2
+  fi
+elif [ "$BACKEND" = herdr ] \
+     && [ "$HERDR_PRESENTATION_RETIRE_CANDIDATE" != 1 ] \
+     && { [ -e "$HERDR_PRESENTATION_JOURNAL" ] || [ -L "$HERDR_PRESENTATION_JOURNAL" ]; }; then
   echo "warning: herdr presentation journal for $ID remains quarantined; no workspace cleanup was attempted" >&2
 fi
 if [ "$KIND" = secondmate ]; then
diff --git a/tests/fm-backend.test.sh b/tests/fm-backend.test.sh
index 4323bf4b42..3dbe9402b3 100755
--- a/tests/fm-backend.test.sh
+++ b/tests/fm-backend.test.sh
@@ -965,7 +965,7 @@ run_teardown_case() {
 }
 
 test_teardown_conformance_old_vs_new() {
-  local old_bin fb proj wt id old_tmux_ref saved_base_ref
+  local old_bin fb proj wt id old_tmux_ref saved_base_ref kill_line return_line old_kill_line old_return_line
   local state_old state_new config_old config_new data log_old log_new out_old out_new rc_old rc_new
   # Force the post-squash topology inside this case: merge-base with main may
   # equal HEAD on default-branch CI, and that must not make the legacy kill
@@ -1021,8 +1021,15 @@ test_teardown_conformance_old_vs_new() {
     "legacy teardown fixture did not exercise tmux window cleanup for the task"
   assert_contains "$(cat "$log_new")" "tmux"$'\x1f''kill-window'$'\x1f''-t'$'\x1f'"=firstmate:=fm-$id" \
     "teardown did not call tmux kill-window with exact session and window selectors"
-
-  pass "fm-teardown.sh: treehouse return remains compatible while tmux cleanup uses exact selectors"
+  kill_line=$(grep -n $'^tmux\x1fkill-window\x1f' "$log_new" | head -1 | cut -d: -f1)
+  return_line=$(grep -n $'^treehouse\x1freturn\x1f' "$log_new" | head -1 | cut -d: -f1)
+  old_kill_line=$(grep -n $'^tmux\x1fkill-window\x1f' "$log_old" | head -1 | cut -d: -f1)
+  old_return_line=$(grep -n $'^treehouse\x1freturn\x1f' "$log_old" | head -1 | cut -d: -f1)
+  [ -n "$kill_line" ] && [ -n "$return_line" ] && [ "$return_line" -lt "$kill_line" ] \
+    && [ -n "$old_kill_line" ] && [ -n "$old_return_line" ] && [ "$old_return_line" -lt "$old_kill_line" ] \
+    || fail "unset teardown no longer returns the isolated copy before best-effort endpoint cleanup"
+
+  pass "fm-teardown.sh preserves unset-mode cleanup ordering and exact endpoint selectors"
 }
 
 test_adapter_post_create_failure_records_ownership() {
diff --git a/tests/fm-host-root-mode.test.sh b/tests/fm-host-root-mode.test.sh
index 8cb443a188..30f277483d 100644
--- a/tests/fm-host-root-mode.test.sh
+++ b/tests/fm-host-root-mode.test.sh
@@ -62,6 +62,8 @@ test_resolution_and_validation() {
   if paths_overlap "$host" "$TMP/host-with-similar-prefix"; then
     fail "sibling paths with a shared prefix were classified as overlapping"
   fi
+  paths_overlap / "$host" || fail "filesystem root was not classified as an ancestor"
+  paths_overlap "$host" / || fail "filesystem root was not classified as an enclosing target"
   pass "host-root library resolves physical paths and rejects unsafe, harness-specific, or overlapping roots"
 }
 
@@ -102,7 +104,7 @@ SH
 }
 
 test_host_command_rendering() {
-  local host="$TMP/render & host" home="$TMP/render-home" fake_root="$TMP/FirstMate & root's copy" rendered supervision command argv
+  local host="$TMP/render & host" home="$TMP/render-home" fake_root="$TMP/FirstMate & root's copy" rendered supervision command argv harness
   make_host "$host"; mkdir -p "$home/state" "$home/config" "$fake_root/bin"
   argv="$TMP/rendered-argv"
   cat > "$fake_root/bin/argv-probe" <<'SH'
@@ -122,6 +124,12 @@ SH
   command=$(printf '%s\n' "$supervision" | sed -n 's/.*checkpoint: \(.*\) --seconds.*/\1/p')
   FM_ARGV_LOG="$argv" bash -c "$command --seconds 7"
   [ "$(cat "$argv")" = $'--seconds\n7' ] || fail "rendered supervision command did not preserve argv"
+  for harness in claude codex grok; do
+    supervision=$(FM_ROOT_OVERRIDE="$fake_root" FM_HOME="$home" FM_HOST_ROOT="$host" \
+      "$ROOT/bin/fm-supervision-instructions.sh" --harness "$harness")
+    assert_contains "$supervision" "FirstMate & root'\\''s copy/bin'/fm-" \
+      "$harness ordinary-wake command did not use the absolute FirstMate path"
+  done
   pass "host mode shell-quotes absolute commands and preserves argv"
 }
 
@@ -187,7 +195,7 @@ case "${1:-}" in
     fi
     ;;
   list-windows) [ -z "${FM_EXISTING_WINDOW:-}" ] || printf '%s\n' "$FM_EXISTING_WINDOW" ;;
-  list-panes) [ ! -f "$endpoint" ] || printf '%%1|@1|test-session:fm-rollback-stuck|test-session:1.0\n' ;;
+  list-panes) [ ! -f "$endpoint" ] || printf '%%1|@1|%s|test-session:1.0\n' "${FM_ENDPOINT_TARGET:-test-session:fm-rollback-stuck}" ;;
   has-session|new-session|set-window-option) ;;
   new-window) : > "$endpoint"; printf '%%1\n' ;;
   kill-window) [ "${FM_REFUSE_STOP:-0}" = 1 ] || rm -f "$endpoint" ;;
@@ -452,6 +460,10 @@ test_mutators_require_host_cwd() {
   expect_code 2 "$status" "fm-merge-local must reject a host cwd mismatch"
   assert_present "$home/state/lane.meta" "local merge mutated task state before host validation"
   status=0
+  out=$(cd "$host" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-merge-local.sh" lane 2>&1) || status=$?
+  expect_code 1 "$status" "fm-merge-local must refuse host-root local-only tasks"
+  assert_contains "$out" 'local-only merge is unavailable for host-root task' "host-root local merge refusal was not explicit"
+  status=0
   out=$(cd "$other" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-pr-merge.sh" lane https://github.com/example/repo/pull/1 2>&1) || status=$?
   expect_code 2 "$status" "fm-pr-merge must reject a host cwd mismatch"
   assert_present "$home/state/lane.meta" "PR merge mutated task state before host validation"
@@ -469,6 +481,10 @@ test_mutators_require_host_cwd() {
   expect_code 2 "$status" "fm-promote must reject a host cwd mismatch"
   grep -qx 'kind=scout' "$home/state/scout.meta" || fail "promote mutated task metadata before host validation"
   status=0
+  out=$(cd "$host" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-promote.sh" scout 2>&1) || status=$?
+  expect_code 0 "$status" "fm-promote rejected a recorded host-root scout"
+  assert_contains "$out" "'$ROOT/bin/fm-send.sh'" "host-root promotion did not print a quoted absolute fm-send path"
+  status=0
   out=$(cd "$other" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-check-register.sh" lane 2>&1) || status=$?
   expect_code 2 "$status" "fm-check-register must reject a host cwd mismatch"
   assert_absent "$home/state/lane.check-trust" "check registration mutated trust state before host validation"
@@ -510,11 +526,12 @@ test_secondmate_actions_keep_supervisor_host_authority() {
 }
 
 test_spawn_rollback_is_transactional() {
-  local host="$TMP/rollback-host" home="$TMP/rollback-home" project="$TMP/rollback-target" wt="$TMP/rollback-wt" stuck_wt="$TMP/rollback-stuck-wt" uncertain_wt="$TMP/rollback-uncertain-wt" fb log current tree_log out status=0
+  local host="$TMP/rollback-host" home="$TMP/rollback-home" project="$TMP/rollback-target" wt="$TMP/rollback-wt" stuck_wt="$TMP/rollback-stuck-wt" uncertain_wt="$TMP/rollback-uncertain-wt" unset_wt="$TMP/rollback-unset-wt" fb log current tree_log out status=0
   make_host "$host"; mkdir -p "$home/data" "$home/state" "$home/config"; fm_git_init_commit "$project"
   git -C "$project" worktree add -q --detach "$wt"
   git -C "$project" worktree add -q --detach "$stuck_wt"
   git -C "$project" worktree add -q --detach "$uncertain_wt"
+  git -C "$project" worktree add -q --detach "$unset_wt"
   for id in rollback-clean rollback-stuck rollback-uncertain; do
     (cd "$host" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
       "$ROOT/bin/fm-brief.sh" "$id" target >/dev/null 2>&1)
@@ -560,7 +577,91 @@ test_spawn_rollback_is_transactional() {
   assert_present "/tmp/fm-rollback-uncertain" "ambiguous Enter failure removed its task temp root"
   rm -rf "/tmp/fm-rollback-uncertain"
   rm -f "$home/state/rollback-uncertain.meta" "$home/state/rollback-uncertain.pi-ext.ts" "$current.endpoint"
-  pass "spawn rollback cleans pre-launch failures and preserves ambiguous launch submissions"
+
+  env -u FM_HOST_ROOT FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
+    "$ROOT/bin/fm-brief.sh" rollback-unset target >/dev/null 2>&1
+  : > "$log"; : > "$tree_log"; printf '%s\n' "$project" > "$current"; status=0
+  out=$(cd "$host" && env -u FM_HOST_ROOT PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
+    FM_FAIL_LAUNCH_SEND=1 FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$TMP/rollback-unset.launch" \
+    FM_CURRENT_PATH="$current" FM_TARGET_PATH="$unset_wt" FM_HOST_PATH="$host" FM_TREEHOUSE_LOG="$tree_log" TMUX=fake \
+    "$ROOT/bin/fm-spawn.sh" rollback-unset "$project" pi 2>&1) || status=$?
+  [ "$status" -ne 0 ] || fail "unset-mode injected launch failure unexpectedly succeeded"
+  assert_no_grep 'kill-window' "$log" "unset-mode launch failure changed upstream endpoint cleanup"
+  assert_no_grep 'return --force' "$tree_log" "unset-mode launch failure changed upstream worktree cleanup"
+  assert_present "$home/state/rollback-unset.meta" "unset-mode launch failure removed upstream task metadata"
+  assert_present "$current.endpoint" "unset-mode launch failure stopped the endpoint"
+  rm -rf "/tmp/fm-rollback-unset"
+  rm -f "$home/state/rollback-unset.meta" "$home/state/rollback-unset.pi-ext.ts" "$current.endpoint"
+  pass "spawn rollback stays host-scoped and preserves ambiguous launch submissions"
+}
+
+test_decision_actions_use_durable_host_owner() {
+  local host="$TMP/decision-host" home="$TMP/decision-home" id=decision-scout fb owner out status=0
+  make_host "$host"
+  mkdir -p "$home/data/$id" "$home/state" "$home/config"
+  printf '# Decision report\n' > "$home/data/$id/report.md"
+  printf 'done: report complete\n' > "$home/state/$id.status"
+  printf 'window=fake:fm-%s\nworktree=/tmp/decision-target\nhost_root=%s\nproject=/tmp/project\nkind=scout\n' \
+    "$id" "$host" > "$home/state/$id.meta"
+  fb=$(fm_fakebin "$TMP/fake-decision-owner")
+  cat > "$fb/tasks-axi" <<'SH'
+#!/usr/bin/env bash
+case "${1:-} ${2:-}" in
+  "--version ") printf '%s\n' 'tasks-axi 0.2.2' ;;
+  "update --help") printf '%s\n' '--archive-body' ;;
+  "mv --help") printf '%s\n' '[<id>...]' ;;
+  "hold --help") printf '%s\n' '--kind captain' ;;
+esac
+SH
+  chmod +x "$fb/tasks-axi"
+  (cd "$host" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    "$ROOT/bin/fm-decision-hold.sh" complete "$id" --none >/dev/null) \
+    || fail "live host-root completion could not persist ownership"
+  owner="$home/data/$id/host-root"
+  assert_grep "host_root=$host" "$owner" "completion did not persist the recorded host owner"
+  rm "$home/state/$id.meta"
+  (cd "$host" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    "$ROOT/bin/fm-decision-hold.sh" complete "$id" --none >/dev/null) \
+    || fail "post-metadata completion rejected its durable host owner"
+  rm "$owner"
+  out=$(cd "$host" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    "$ROOT/bin/fm-decision-hold.sh" complete "$id" --none 2>&1) || status=$?
+  expect_code 1 "$status" "post-metadata completion trusted ambient host authority"
+  assert_contains "$out" 'has no durable recorded host owner' "missing durable host owner refusal was not explicit"
+  pass "post-metadata decision actions require durable recorded host ownership"
+}
+
+test_host_teardown_requires_confirmed_stop() {
+  local host="$TMP/teardown-host" home="$TMP/teardown-home" project="$TMP/teardown-project" wt="$TMP/teardown-wt" fb log current tree_log out status=0 kill_line verify_line return_line
+  make_host "$host"; mkdir -p "$home/data" "$home/state" "$home/config"; fm_git_init_commit "$project"
+  git -C "$project" worktree add -q --detach "$wt"
+  printf 'window=test-session:fm-host-teardown\nworktree=%s\nhost_root=%s\nproject=%s\nkind=ship\nmode=local-only\n' \
+    "$wt" "$host" "$project" > "$home/state/host-teardown.meta"
+  fb=$(make_fakebin "$TMP/fake-host-teardown")
+  log="$TMP/host-teardown.log"; current="$TMP/host-teardown.current"; tree_log="$TMP/host-teardown-treehouse.log"
+  printf '%s\n' "$host" > "$current"; : > "$current.endpoint"; : > "$log"; : > "$tree_log"
+  out=$(cd "$host" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    FM_REFUSE_STOP=1 FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 FM_TMUX_LOG="$log" \
+    FM_ENDPOINT_TARGET=test-session:fm-host-teardown FM_LAUNCH_FILE="$TMP/unused.launch" FM_CURRENT_PATH="$current" \
+    FM_TARGET_PATH="$wt" FM_HOST_PATH="$host" FM_TREEHOUSE_LOG="$tree_log" TMUX=fake \
+    "$ROOT/bin/fm-teardown.sh" host-teardown --force 2>&1) || status=$?
+  [ "$status" -ne 0 ] || fail "host-root teardown accepted an unconfirmed endpoint stop"
+  assert_no_grep 'return --force' "$tree_log" "host-root teardown recycled work before confirming endpoint absence"
+  assert_present "$home/state/host-teardown.meta" "host-root teardown removed recovery metadata after stop refusal"
+
+  : > "$log"; : > "$tree_log"; status=0
+  out=$(cd "$host" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 FM_TMUX_LOG="$log" \
+    FM_ENDPOINT_TARGET=test-session:fm-host-teardown FM_LAUNCH_FILE="$TMP/unused.launch" FM_CURRENT_PATH="$current" \
+    FM_TARGET_PATH="$wt" FM_HOST_PATH="$host" FM_TREEHOUSE_LOG="$tree_log" TMUX=fake \
+    "$ROOT/bin/fm-teardown.sh" host-teardown --force 2>&1) || status=$?
+  expect_code 0 "$status" "host-root teardown failed after confirmed endpoint stop: $out"
+  kill_line=$(grep -n 'kill-window' "$log" | tail -1 | cut -d: -f1)
+  verify_line=$(awk -v start="$kill_line" 'NR > start && /list-panes/ { print NR; exit }' "$log")
+  return_line=$(grep -n 'return --force' "$tree_log" | head -1 | cut -d: -f1)
+  [ -n "$kill_line" ] && [ -n "$verify_line" ] && [ -n "$return_line" ] \
+    || fail "host-root teardown did not stop, verify, and return its isolated copy"
+  pass "host-root teardown confirms endpoint absence before worktree cleanup"
 }
 
 test_task_actions_use_recorded_host_root() {
@@ -630,5 +731,7 @@ test_all_harnesses_add_one_task_safeguard
 test_mutators_require_host_cwd
 test_secondmate_actions_keep_supervisor_host_authority
 test_spawn_rollback_is_transactional
+test_decision_actions_use_durable_host_owner
+test_host_teardown_requires_confirmed_stop
 test_task_actions_use_recorded_host_root
 test_spawn_rejects_old_brief_and_secondmate_clears_roots
diff --git a/tests/fm-teardown.test.sh b/tests/fm-teardown.test.sh
index cbb2088e87..d3ece2f94f 100755
--- a/tests/fm-teardown.test.sh
+++ b/tests/fm-teardown.test.sh
@@ -1267,9 +1267,13 @@ test_local_only_force_overrides_unpushed() {
 }
 
 test_unconfirmed_stop_preserves_worktree() {
-  local case_dir rc tree_log
+  local case_dir rc tree_log host
   case_dir=$(make_case stop-unconfirmed)
   write_meta "$case_dir" local-only ship
+  host="$case_dir/host"
+  mkdir -p "$host"
+  : > "$host/AGENTS.md"
+  printf 'host_root=%s\n' "$host" >> "$case_dir/state/task-x1.meta"
   tree_log="$case_dir/treehouse.log"
   cat > "$case_dir/fakebin/treehouse" <<'SH'
 #!/usr/bin/env bash
@@ -1277,8 +1281,9 @@ printf '%s\n' "$*" >> "$FM_TREEHOUSE_LOG"
 SH
   chmod +x "$case_dir/fakebin/treehouse"
   set +e
-  FM_FAKE_TMUX_STOP_FAIL=1 FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 FM_TREEHOUSE_LOG="$tree_log" \
-    run_teardown "$case_dir" --force > "$case_dir/stdout" 2> "$case_dir/stderr"
+  (cd "$host" && FM_HOST_ROOT="$host" FM_FAKE_TMUX_STOP_FAIL=1 FM_BACKEND_STOP_ATTEMPTS=1 \
+    FM_BACKEND_STOP_DELAY=0 FM_TREEHOUSE_LOG="$tree_log" \
+    run_teardown "$case_dir" --force > "$case_dir/stdout" 2> "$case_dir/stderr")
   rc=$?
   set -e
   expect_code 1 "$rc" "stop-unconfirmed: teardown must fail when endpoint termination cannot be confirmed"
@@ -1419,14 +1424,19 @@ test_herdr_projection_teardown_retires_journal_only_after_confirmed_close() {
 }
 
 test_herdr_projection_teardown_retains_journal_when_close_unconfirmed() {
-  local case_dir log closed restored status=0
+  local case_dir log closed restored host status=0
   case_dir=$(make_case herdr-projection-unconfirmed-close)
   write_meta "$case_dir" local-only ship
+  host="$case_dir/host"
+  mkdir -p "$host"
+  : > "$host/AGENTS.md"
+  printf 'host_root=%s\n' "$host" >> "$case_dir/state/task-x1.meta"
   configure_herdr_projection_teardown_case "$case_dir"
   log="$case_dir/herdr.log"; closed="$case_dir/closed"; restored="$case_dir/restored"; : > "$log"
 
-  FM_FAKE_HERDR_LOG="$log" FM_FAKE_HERDR_CLOSED="$closed" FM_FAKE_HERDR_RESTORED="$restored" FM_FAKE_HERDR_CLOSE_FAIL=1 \
-    run_teardown "$case_dir" --force > "$case_dir/stdout" 2> "$case_dir/stderr" \
+  (cd "$host" && FM_HOST_ROOT="$host" FM_FAKE_HERDR_LOG="$log" FM_FAKE_HERDR_CLOSED="$closed" \
+    FM_FAKE_HERDR_RESTORED="$restored" FM_FAKE_HERDR_CLOSE_FAIL=1 \
+    run_teardown "$case_dir" --force > "$case_dir/stdout" 2> "$case_dir/stderr") \
     || status=$?
   [ "$status" -ne 0 ] || fail "herdr-projection-unconfirmed-close: teardown accepted an unconfirmed endpoint stop"
   [ -e "$case_dir/state/task-x1.herdr-presentation" ] \

From 2a41b8132e79c8acc358184c58a25f1699d57101 Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Sun, 26 Jul 2026 11:59:00 +0300
Subject: [PATCH 03/39] no-mistakes(document): Document host-root overlap and
 forge scoping

---
 bin/fm-teardown.sh              | 11 ++++++++---
 docs/architecture.md            |  2 +-
 docs/configuration.md           |  4 ++--
 tests/fm-backend-orca.test.sh   | 34 +++++++++++----------------------
 tests/fm-backend-zellij.test.sh |  9 +++------
 5 files changed, 25 insertions(+), 35 deletions(-)

diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index 8fd6c158f6..4cb5c88bfa 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -1020,12 +1020,17 @@ cleanup_firstmate_home_children() {
     fi
     if [ -n "$child_t" ]; then
       case "$child_backend" in
-        zellij|cmux)
-          # These adapters scope labels and optional socket configuration to the owning home.
+        zellij)
+          # Zellij titles are scoped by the owning home tag, so forced secondmate
+          # cleanup must verify child tabs as that child home, not the parent.
+          ( unset FM_ROOT_OVERRIDE; FM_HOME=$home FM_ROOT=$home fm_backend_kill "$child_backend" "$child_t" "$(meta_value "$child_meta" zellij_tab_id)" "fm-$child_id" ) 2>/dev/null || true
+          ;;
+        cmux)
+          # Cmux labels and socket configuration are scoped to the owning home.
           ( unset FM_ROOT_OVERRIDE FM_CONFIG_OVERRIDE; FM_HOME=$home FM_ROOT=$home fm_backend_stop_and_verify "$child_backend" "$child_t" "$(meta_value "$child_meta" zellij_tab_id)" "fm-$child_id" ) || return 1
           ;;
         *)
-          fm_backend_stop_and_verify "$child_backend" "$child_t" "$(meta_value "$child_meta" zellij_tab_id)" "fm-$child_id" || return 1
+          fm_backend_kill "$child_backend" "$child_t" "$(meta_value "$child_meta" zellij_tab_id)" "fm-$child_id" 2>/dev/null || true
           ;;
       esac
     fi
diff --git a/docs/architecture.md b/docs/architecture.md
index 1f6bb5a796..0389182dd4 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -116,7 +116,7 @@ Codex App support is recorded in `docs/codex-app-backend.md`; it is not selectab
 
 The default launch cwd remains the isolated task worktree.
 When optional `FM_HOST_ROOT` mode is enabled, FirstMate separates its tracked code root, operational home, host instruction root, and target worktree instead: the backend acquires and validates the isolated target first, records it as `worktree=`, returns the endpoint to the physical host root, verifies that cwd, then launches the harness with exact `FM_HOST_ROOT` and `FM_TARGET_WORKTREE` values.
-The target is rejected if it resolves to the host, and a failed host transition cleans the new endpoint and worktree or leaves recoverable metadata when cleanup itself fails.
+The target is rejected if it overlaps the host, and a failed host transition cleans the new endpoint and worktree or leaves recoverable metadata when cleanup itself fails.
 Host instructions and native lifecycle hooks remain authoritative because the harness starts from the host root, while the host-root brief requires applicable target instructions before edits and scopes every target operation explicitly.
 FirstMate task completion signals are added through harness launch configuration or per-process identity rather than by writing host hook files.
 Secondmates keep their isolated-home launch shape and clear both host variables.
diff --git a/docs/configuration.md b/docs/configuration.md
index d17e25b52b..68792fb94d 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -190,9 +190,9 @@ Host mode separates four roots:
 - `FM_ROOT` is the tracked FirstMate code, skill, documentation, and script root.
 - `FM_HOME` is the private FirstMate operational home that owns `data/`, `state/`, `config/`, and `projects/`.
 - `FM_HOST_ROOT` is the host repository whose instructions, native lifecycle, and cwd remain authoritative.
-- `FM_TARGET_WORKTREE` is the per-task isolated target repository where code changes, Git operations, tests, builds, GitHub operations, and no-mistakes run.
+- `FM_TARGET_WORKTREE` is the per-task isolated target repository where code changes, Git operations, tests, builds, forge operations, and no-mistakes run.
 
-The physical target worktree must differ from both the target project's primary checkout and `FM_HOST_ROOT`.
+The physical target worktree must differ from the target project's primary checkout and must not overlap `FM_HOST_ROOT`.
 Ordinary ship and scout endpoints still acquire and validate their isolated target worktree first, retain it as `worktree=` metadata, then return the endpoint shell to the physical host root before launching the harness.
 A failed host transition stops and verifies the new endpoint before returning the acquired worktree, removes every task-owned pre-record artifact on successful rollback, and retains recovery metadata and the isolated path when endpoint termination or resource cleanup cannot be confirmed.
 An overlap refusal stops the endpoint but never returns or removes the overlapping path automatically.
diff --git a/tests/fm-backend-orca.test.sh b/tests/fm-backend-orca.test.sh
index 3d12ba0bdb..e1539475f6 100755
--- a/tests/fm-backend-orca.test.sh
+++ b/tests/fm-backend-orca.test.sh
@@ -889,9 +889,6 @@ test_scout_teardown_removes_orca_worktree_via_helper() {
     "decisions_reviewed=1" "decision_keys="
   orca_case teardown
   printf '{"ok":true,"result":{"worktree":{"id":"wt-teardown","path":"%s"}}}\n' "$wt" > "$RESP/1.out"
-  printf '{"ok":true}\n' > "$RESP/2.out"
-  printf '{"ok":false,"error":{"code":"terminal_handle_stale","message":"terminal gone"}}\n' > "$RESP/3.out"
-  printf '{"ok":true}\n' > "$RESP/4.out"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
   set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
@@ -964,9 +961,6 @@ test_teardown_removes_orca_worktree_when_path_missing() {
     "backend=orca" "orca_worktree_id=wt-missing-path" \
     "decisions_reviewed=1" "decision_keys="
   orca_case missing-path
-  printf '{"ok":true}\n' > "$RESP/1.out"
-  printf '{"ok":false,"error":{"code":"terminal_handle_stale","message":"terminal gone"}}\n' > "$RESP/2.out"
-  printf '{"ok":true}\n' > "$RESP/3.out"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
   set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
@@ -1000,9 +994,7 @@ test_teardown_preserves_metadata_when_orca_remove_error_json() {
     "backend=orca" "orca_worktree_id=wt-remove-error" \
     "decisions_reviewed=1" "decision_keys="
   orca_case remove-error-teardown
-  printf '{"ok":true}\n' > "$RESP/1.out"
-  printf '{"ok":false,"error":{"code":"terminal_handle_stale","message":"terminal gone"}}\n' > "$RESP/2.out"
-  printf '{"ok":false,"error":{"code":"worktree_not_removed","message":"worktree not removed"}}\n' > "$RESP/3.out"
+  printf '{"ok":false,"error":{"code":"worktree_not_removed","message":"worktree not removed"}}\n' > "$RESP/1.out"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
   set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
@@ -1093,9 +1085,6 @@ test_ship_teardown_removes_orca_worktree_when_id_path_matches() {
     "backend=orca" "orca_worktree_id=wt-ship-match"
   orca_case ship-match
   printf '{"ok":true,"result":{"worktree":{"id":"wt-ship-match","path":"%s"}}}\n' "$wt" > "$RESP/1.out"
-  printf '{"ok":true}\n' > "$RESP/2.out"
-  printf '{"ok":false,"error":{"code":"terminal_handle_stale","message":"terminal gone"}}\n' > "$RESP/3.out"
-  printf '{"ok":true}\n' > "$RESP/4.out"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
   set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
@@ -1114,30 +1103,32 @@ test_ship_teardown_removes_orca_worktree_when_id_path_matches() {
   pass "fm-teardown.sh backend=orca: ship teardown requires a matching Orca id path"
 }
 
-test_ship_teardown_rechecks_safety_after_terminal_stop() {
-  local proj wt data state config id out rc neutral
+test_host_ship_teardown_rechecks_safety_after_terminal_stop() {
+  local host proj wt data state config id out rc neutral
   id="orcashipracez9"
+  host="$TMP_ROOT/ship-race-host"
   proj="$TMP_ROOT/ship-race-project"
   wt="$TMP_ROOT/ship-race-wt"
   data="$TMP_ROOT/ship-race-data"
   state="$TMP_ROOT/ship-race-state"
   config="$TMP_ROOT/ship-race-config"
   fm_git_worktree "$proj" "$wt" "fm/$id"
-  mkdir -p "$data/$id" "$state" "$config"
+  mkdir -p "$host" "$data/$id" "$state" "$config"
+  : > "$host/AGENTS.md"
   touch "$state/.last-watcher-beat"
   fm_write_meta "$state/$id.meta" \
     "window=fm-$id" "terminal=term-ship-race" "worktree=$wt" "project=$proj" \
     "harness=claude" "kind=ship" "mode=no-mistakes" "yolo=off" \
-    "backend=orca" "orca_worktree_id=wt-ship-race"
+    "backend=orca" "orca_worktree_id=wt-ship-race" "host_root=$host"
   orca_case ship-race
   printf '{"ok":true,"result":{"worktree":{"id":"wt-ship-race","path":"%s"}}}\n' "$wt" > "$RESP/1.out"
   printf '{"ok":true}\n' > "$RESP/2.out"
   printf '{"ok":false,"error":{"code":"terminal_handle_stale","message":"terminal gone"}}\n' > "$RESP/3.out"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
   set +e
-  out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
+  out=$( cd "$host" && PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ORCA_CLOSE_MUTATION="$wt/late-edit.txt" FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 \
-    FM_ROOT_OVERRIDE="$neutral" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
+    FM_ROOT_OVERRIDE="$neutral" FM_HOST_ROOT="$host" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     "$ROOT/bin/fm-teardown.sh" "$id" 2>&1 )
   rc=$?
   set -e
@@ -1147,7 +1138,7 @@ test_ship_teardown_rechecks_safety_after_terminal_stop() {
   assert_present "$state/$id.meta" "post-stop safety refusal removed task metadata"
   assert_not_contains "$(cat "$LOG")" $'orca\x1f''worktree'$'\x1f''rm' \
     "post-stop safety refusal removed the Orca worktree"
-  pass "fm-teardown.sh backend=orca: rechecks worktree safety after stopping the terminal"
+  pass "fm-teardown.sh host-root backend=orca: rechecks worktree safety after stopping the terminal"
 }
 
 test_ship_teardown_refuses_orca_unresolvable_worktree_id() {
@@ -1312,9 +1303,6 @@ test_secondmate_force_teardown_removes_orca_child_via_orca() {
     "backend=orca" "orca_worktree_id=wt-child-cleanup"
   orca_case secondmate-child-cleanup
   printf '{"ok":true,"result":{"worktree":{"id":"wt-child-cleanup","path":"%s"}}}\n' "$childwt" > "$RESP/1.out"
-  printf '{"ok":true}\n' > "$RESP/2.out"
-  printf '{"ok":false,"error":{"code":"terminal_handle_stale","message":"terminal gone"}}\n' > "$RESP/3.out"
-  printf '{"ok":true}\n' > "$RESP/4.out"
   add_tmux_fake "$FB"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
   set +e
@@ -1468,7 +1456,7 @@ test_teardown_preserves_metadata_when_orca_remove_error_json
 test_scout_teardown_refuses_orca_missing_report_when_path_missing
 test_ship_teardown_refuses_orca_missing_worktree_path
 test_ship_teardown_removes_orca_worktree_when_id_path_matches
-test_ship_teardown_rechecks_safety_after_terminal_stop
+test_host_ship_teardown_rechecks_safety_after_terminal_stop
 test_ship_teardown_refuses_orca_unresolvable_worktree_id
 test_ship_teardown_refuses_orca_id_path_mismatch
 test_teardown_refuses_orca_missing_worktree_id
diff --git a/tests/fm-backend-zellij.test.sh b/tests/fm-backend-zellij.test.sh
index f8aeef5c2e..042d31aa34 100755
--- a/tests/fm-backend-zellij.test.sh
+++ b/tests/fm-backend-zellij.test.sh
@@ -852,12 +852,9 @@ test_forced_secondmate_teardown_kills_zellij_children_with_child_home_tag() {
     "project=$project" \
     "kind=scout"
   child_title=$(zellij_expected_scoped_title fm-childz "$home" "$home")
-  printf '[]\n' > "$dir/responses/1.out"
-  printf '[]\n' > "$dir/responses/2.out"
-  zellij_pane_response "$dir" 3 7 4
-  zellij_tab_response "$dir" 4 4 "$child_title"
-  printf '[]\n' > "$dir/responses/5.out"
-  printf '[]\n' > "$dir/responses/6.out"
+  zellij_pane_response "$dir" 1 7 4
+  zellij_tab_response "$dir" 2 4 "$child_title"
+  printf '[]\n' > "$dir/responses/3.out"
   fb=$(make_zellij_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_ROOT_OVERRIDE="$ROOT" \

From 732ebfea56039dbd98abc0fd31afe81ac28ddd3b Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Sun, 26 Jul 2026 12:06:36 +0300
Subject: [PATCH 04/39] no-mistakes(lint): Annotate dynamic wake library source
 for lint

---
 bin/fm-teardown.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index 4cb5c88bfa..fcbe49be20 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -1254,6 +1254,7 @@ fi
 
 if [ "$TASK_HOST_MODE" -eq 0 ]; then
   if [ "$HERDR_PRESENTATION_RETIRE_CANDIDATE" = 1 ]; then
+    # shellcheck source=bin/fm-wake-lib.sh
     . "$SCRIPT_DIR/fm-wake-lib.sh"
     HERDR_PRESENTATION_FOCUS_LOCK=
     HERDR_PRESENTATION_FOCUS_LOCK_HELD=0

From 7506d74615f1819507c70e8e5609b6a4da5e956c Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Sun, 26 Jul 2026 12:45:41 +0300
Subject: [PATCH 05/39] no-mistakes(review): Captain: harden host-root cleanup
 and task admission

---
 bin/fm-backend.sh               |  2 +-
 bin/fm-brief.sh                 | 17 ++++++++++-
 bin/fm-review-diff.sh           |  8 +++--
 bin/fm-spawn.sh                 | 47 +++++++++++++++++++++++++++--
 bin/fm-teardown.sh              |  2 +-
 docs/configuration.md           |  3 +-
 tests/fm-backend-orca.test.sh   | 45 ++++++++++++++--------------
 tests/fm-backend.test.sh        | 10 +++++++
 tests/fm-host-root-mode.test.sh | 52 ++++++++++++++++++++++++++++++++-
 tests/fm-review-diff.test.sh    | 41 ++++++++++++++++++++++++++
 10 files changed, 194 insertions(+), 33 deletions(-)

diff --git a/bin/fm-backend.sh b/bin/fm-backend.sh
index 2eb277d82b..5a77ce41d1 100644
--- a/bin/fm-backend.sh
+++ b/bin/fm-backend.sh
@@ -905,7 +905,7 @@ fm_backend_target_state() {  # <backend> <target> [expected-label] -> present|ab
 # owner is for destructive cleanup paths that must not trust best-effort close.
 fm_backend_stop_and_verify() {  # <backend> <target> [zellij-tab-id] [expected-label]
   local backend=$1 target=$2 expected_label=${4:-} attempts=${FM_BACKEND_STOP_ATTEMPTS:-20} delay=${FM_BACKEND_STOP_DELAY:-0.1} i=0 state=unknown
-  [ -n "$target" ] || return 0
+  [ -n "$target" ] || { echo "error: missing backend endpoint id; refusing destructive cleanup" >&2; return 1; }
   case "$attempts" in ''|*[!0-9]*|0) attempts=20 ;; esac
   fm_backend_kill "$@" || return 1
   while [ "$i" -lt "$attempts" ]; do
diff --git a/bin/fm-brief.sh b/bin/fm-brief.sh
index da91b5ff8b..30d0b625a7 100755
--- a/bin/fm-brief.sh
+++ b/bin/fm-brief.sh
@@ -130,6 +130,17 @@ if fm_host_root_enabled; then
   fi
 fi
 
+HOST_SHIP_MODE=
+if [ "$HOST_MODE" -eq 1 ] && [ "$KIND" = ship ] && [ -n "${POS[1]:-}" ]; then
+  read -r HOST_SHIP_MODE _ <<EOF
+$("$FM_ROOT/bin/fm-project-mode.sh" "${POS[1]}")
+EOF
+  if [ "$HOST_SHIP_MODE" = local-only ]; then
+    echo "error: host-root mode does not support local-only project ${POS[1]}" >&2
+    exit 1
+  fi
+fi
+
 BRIEF="$DATA/$ID/brief.md"
 [ -e "$BRIEF" ] && { echo "error: $BRIEF already exists" >&2; exit 1; }
 mkdir -p "$DATA/$ID"
@@ -361,9 +372,13 @@ fi
 # Ship task: shape Setup / Rule 1 / Definition of done by the project's delivery mode.
 # yolo does not affect the brief because the worker never owns approval decisions;
 # firstmate applies the authority contract in AGENTS.md section 7, so discard it.
-read -r MODE _ <<EOF
+if [ -n "$HOST_SHIP_MODE" ]; then
+  MODE=$HOST_SHIP_MODE
+else
+  read -r MODE _ <<EOF
 $("$FM_ROOT/bin/fm-project-mode.sh" "$REPO")
 EOF
+fi
 
 case "$MODE" in
   direct-PR)
diff --git a/bin/fm-review-diff.sh b/bin/fm-review-diff.sh
index 891efdd501..5335fc791a 100755
--- a/bin/fm-review-diff.sh
+++ b/bin/fm-review-diff.sh
@@ -53,16 +53,18 @@ PROJ=$(grep '^project=' "$META" | cut -d= -f2-)
 [ -n "$PROJ" ] || { echo "error: meta for task $ID is missing project=" >&2; exit 1; }
 [ -d "$WT" ] || { echo "error: worktree for task $ID is missing: $WT" >&2; exit 1; }
 [ -d "$PROJ" ] || { echo "error: project for task $ID is missing: $PROJ" >&2; exit 1; }
+GIT_ROOT=$PROJ
+grep -q '^host_root=.' "$META" && GIT_ROOT=$WT
 
 default_branch() {
   local ref branch
-  ref=$(git -C "$PROJ" symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null || true)
+  ref=$(git -C "$GIT_ROOT" symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null || true)
   if [ -n "$ref" ]; then
     echo "${ref#origin/}"
     return 0
   fi
   for branch in main master; do
-    if git -C "$PROJ" show-ref --verify --quiet "refs/heads/$branch"; then
+    if git -C "$GIT_ROOT" show-ref --verify --quiet "refs/heads/$branch"; then
       echo "$branch"
       return 0
     fi
@@ -138,7 +140,7 @@ if [ -n "$PR_URL" ]; then
   fi
 fi
 
-if git -C "$PROJ" remote get-url origin >/dev/null 2>&1; then
+if git -C "$GIT_ROOT" remote get-url origin >/dev/null 2>&1; then
   # Update the remote-tracking ref itself; a bare single-branch fetch can leave
   # origin/<default> stale on some Git versions and only refresh FETCH_HEAD.
   git -C "$WT" fetch origin "+refs/heads/$DEFAULT:refs/remotes/origin/$DEFAULT" --quiet
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 921e2037d6..775ac21ae6 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -230,6 +230,8 @@ esac
 
 HOST_MODE=0
 HOST_ROOT=
+MODE=
+YOLO=
 if fm_host_root_enabled; then
   fm_host_root_assert_session_cwd "$FM_ROOT" || exit $?
   if [ "$KIND" != secondmate ]; then
@@ -238,6 +240,42 @@ if fm_host_root_enabled; then
   fi
 fi
 
+if [ "$HOST_MODE" -eq 1 ] && [ "$KIND" = ship ]; then
+  host_idpart=${POS[0]:-}
+  host_idpart=${host_idpart%%=*}
+  host_projects=()
+  if [ "${#POS[@]}" -gt 0 ] && [ "${POS[0]}" != "$host_idpart" ] \
+     && case "$host_idpart" in */*) false ;; *) true ;; esac; then
+    for host_pair in "${POS[@]}"; do
+      case "$host_pair" in *=*) host_projects+=("${host_pair#*=}") ;; esac
+    done
+  else
+    host_projects+=("${POS[1]:-}")
+  fi
+  for host_project in "${host_projects[@]}"; do
+    [ -n "$host_project" ] || continue
+    host_project_path=$host_project
+    case "$host_project_path" in
+      projects/*) host_project_path="$PROJECTS/${host_project_path#projects/}" ;;
+    esac
+    host_project_name=$(basename "$host_project")
+    if [ -d "$host_project_path" ]; then
+      host_project_name=$(basename "$(cd "$host_project_path" && pwd -P)")
+    fi
+    read -r host_mode host_yolo <<EOF
+$("$FM_ROOT/bin/fm-project-mode.sh" "$host_project_name")
+EOF
+    if [ "$host_mode" = local-only ]; then
+      echo "error: host-root mode does not support local-only project $host_project_name" >&2
+      exit 1
+    fi
+    if [ "${#host_projects[@]}" -eq 1 ]; then
+      MODE=$host_mode
+      YOLO=$host_yolo
+    fi
+  done
+fi
+
 # Fail closed before any fleet mutation: a no-mistakes gate agent must never spawn
 # a direct report (see bin/fm-gate-refuse-lib.sh). Anchor to FM_ROOT because host
 # mode deliberately runs from a different repository.
@@ -414,7 +452,10 @@ spawn_abort_cleanup() {
   fi
   if [ "$ORCA_ABORT_CLEANUP" = 1 ]; then
     ORCA_ABORT_CLEANUP=0
-    if [ -n "${ORCA_TERMINAL:-}" ] && ! fm_backend_stop_and_verify orca "$ORCA_TERMINAL"; then
+    if [ -z "${ORCA_TERMINAL:-}" ]; then
+      cleanup_failed=1
+      endpoint_stopped=0
+    elif ! fm_backend_stop_and_verify orca "$ORCA_TERMINAL"; then
       cleanup_failed=1
       endpoint_stopped=0
     fi
@@ -1696,9 +1737,11 @@ if [ "$KIND" = secondmate ]; then
   SECONDMATE_PROJECTS=$(secondmate_registry_value "$ID" projects || true)
 else
   PROJ_NAME=$(basename "$PROJ_ABS")
-  read -r MODE YOLO <<EOF
+  if [ -z "$MODE" ]; then
+    read -r MODE YOLO <<EOF
 $("$FM_ROOT/bin/fm-project-mode.sh" "$PROJ_NAME")
 EOF
+  fi
 fi
 
 META_WINDOW=$T
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index fcbe49be20..4773b81e43 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -1200,7 +1200,7 @@ if [ "$TASK_HOST_MODE" -eq 1 ]; then
     ORCA_PATH_MATCH_VERIFIED=1
   fi
   stop_task_endpoint_and_verify || exit 1
-  if [ "$BACKEND" = orca ] && [ -d "$WT" ] && [ "$FORCE" != "--force" ]; then
+  if [ -d "$WT" ] && [ "$FORCE" != "--force" ]; then
     validate_worktree_teardown_safety_with_lock_cleanup || exit 1
   fi
   if [ "$KIND" = secondmate ] && [ "$FORCE" = "--force" ]; then
diff --git a/docs/configuration.md b/docs/configuration.md
index 68792fb94d..731745d47b 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -199,10 +199,11 @@ An overlap refusal stops the endpoint but never returns or removes the overlappi
 An unconfirmed final launch submission retains the endpoint, worktree, task safeguards, and metadata because the worker may already be running.
 The child receives exact `FM_HOST_ROOT` and `FM_TARGET_WORKTREE` values, while task actions bind to the recorded physical `host_root=` before reading or changing task data and review, merge, evidence, and teardown continue to use the recorded `worktree=` path.
 Teardown stops and verifies the recorded worker endpoint before changing or returning its isolated copy.
-Orca ship teardown repeats worktree safety checks after the terminal is confirmed stopped and before forced worktree removal.
+Every non-forced host-root ship teardown repeats worktree safety checks after the endpoint is confirmed stopped and before branch deletion or worktree return.
 Host-root briefs carry `<!-- firstmate-execution-mode: host-root -->`, require the worker to read host instructions first and applicable target instructions before edits, keep the host read-only except for host-owned lifecycle effects, and require explicit target paths or scoped subshells.
 The same target scoping applies to the complete no-mistakes lifecycle, including doctor, initialization, run, gate responses, and follow-up help commands; no validation command may default to the host cwd.
 Spawn rejects a cwd-relative legacy brief in host mode rather than weakening that contract silently.
+Host-root ship tasks support `no-mistakes` and `direct-PR` delivery; brief generation and spawn reject `local-only` because its guarded landing path changes the target project's primary checkout.
 
 Harness integration is additive.
 Claude receives an additional task settings file through `--settings`, Codex retains its launch-command notification, OpenCode receives an explicit task plugin in addition to host project plugins, Pi receives its explicit task extension, and Grok and Kimi use per-process task tokens consumed by their guarded global hooks.
diff --git a/tests/fm-backend-orca.test.sh b/tests/fm-backend-orca.test.sh
index e1539475f6..361ace25b1 100755
--- a/tests/fm-backend-orca.test.sh
+++ b/tests/fm-backend-orca.test.sh
@@ -526,7 +526,7 @@ test_spawn_preserves_pathless_orca_worktree_when_terminal_stop_is_unknown() {
   pass "fm-spawn.sh --backend orca: unknown terminal stop preserves pathless worktree and metadata"
 }
 
-test_spawn_preserves_orca_metadata_when_pathless_worktree_cleanup_fails() {
+test_spawn_preserves_pathless_orca_worktree_without_terminal_proof() {
   local proj data state config id out status
   id="orcapathlessz6"
   proj="$TMP_ROOT/pathless-cleanup-project"
@@ -541,8 +541,6 @@ test_spawn_preserves_orca_metadata_when_pathless_worktree_cleanup_fails() {
   printf '1\n' > "$RESP/1.exit"
   printf '{"ok":true,"result":{"repo":{"id":"repo-pathless-cleanup"}}}\n' > "$RESP/2.out"
   printf '{"ok":true,"result":{"worktree":{"id":"wt-pathless-cleanup"}}}\n' > "$RESP/3.out"
-  printf '{"ok":false,"error":{"code":"worktree_not_removed","message":"worktree not removed"}}\n' > "$RESP/4.out"
-  printf '{"ok":false,"error":{"code":"worktree_not_removed","message":"worktree not removed"}}\n' > "$RESP/5.out"
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" FM_SPAWN_NO_GUARD=1 \
@@ -551,14 +549,14 @@ test_spawn_preserves_orca_metadata_when_pathless_worktree_cleanup_fails() {
   [ "$status" -ne 0 ] || fail "Orca spawn should fail when path parsing and cleanup fail"
   assert_contains "$out" "orca worktree create did not return a path" \
     "pathless worktree failure should explain the missing path"
-  assert_contains "$(cat "$LOG")" $'orca\x1f''worktree'$'\x1f''rm'$'\x1f''--worktree'$'\x1f''id:wt-pathless-cleanup'$'\x1f''--force'$'\x1f''--json' \
-    "pathless cleanup should attempt helper-backed worktree removal"
-  assert_present "$state/$id.meta" "failed pathless cleanup should preserve metadata"
+  assert_not_contains "$(cat "$LOG")" $'orca\x1f''worktree'$'\x1f''rm' \
+    "pathless cleanup removed a worktree without terminal absence proof"
+  assert_present "$state/$id.meta" "pathless cleanup should preserve recovery metadata"
   assert_grep "window=fm-$id" "$state/$id.meta" "preserved pathless metadata missing stable window alias"
   assert_grep "backend=orca" "$state/$id.meta" "preserved pathless metadata missing backend=orca"
   assert_grep "orca_worktree_id=wt-pathless-cleanup" "$state/$id.meta" "preserved pathless metadata missing Orca worktree id"
   assert_no_grep "terminal=" "$state/$id.meta" "preserved pathless metadata should not invent a terminal handle"
-  pass "fm-spawn.sh --backend orca: preserves metadata when pathless cleanup fails"
+  pass "fm-spawn.sh --backend orca: preserves a pathless worktree without terminal absence proof"
 }
 
 test_spawn_writes_orca_metadata_and_launches_harness() {
@@ -692,7 +690,7 @@ test_spawn_refuses_orca_nonisolated_worktree() {
   pass "fm-spawn.sh --backend orca: refuses non-isolated worktrees and closes implicit terminals"
 }
 
-test_spawn_removes_orca_worktree_when_terminal_create_fails() {
+test_spawn_preserves_orca_worktree_when_terminal_create_fails_without_handle() {
   local proj wt data state config id out status
   id="orcatermfailz8"
   proj="$TMP_ROOT/terminal-fail-project"
@@ -715,17 +713,19 @@ test_spawn_removes_orca_worktree_when_terminal_create_fails() {
     "$ROOT/bin/fm-spawn.sh" "$id" "$proj" claude --backend orca 2>&1 )
   status=$?
   [ "$status" -ne 0 ] || fail "Orca spawn should fail when terminal creation fails"
-  assert_absent "$state/$id.meta" "terminal-create abort should not record metadata after successful cleanup"
+  assert_present "$state/$id.meta" "terminal-create failure should preserve recovery metadata without absence proof"
+  assert_grep "orca_worktree_id=wt-terminal-fail" "$state/$id.meta" "preserved metadata missing Orca worktree id"
+  assert_no_grep "terminal=" "$state/$id.meta" "terminal-create failure should not invent a terminal handle"
   assert_contains "$(cat "$LOG")" $'orca\x1f''terminal'$'\x1f''create'$'\x1f''--worktree'$'\x1f''id:wt-terminal-fail'$'\x1f''--title'$'\x1f'"fm-$id"$'\x1f''--json' \
     "Orca spawn should attempt terminal creation before abort cleanup"
-  assert_contains "$(cat "$LOG")" $'orca\x1f''worktree'$'\x1f''rm'$'\x1f''--worktree'$'\x1f''id:wt-terminal-fail'$'\x1f''--force'$'\x1f''--json' \
-    "Orca spawn should remove the worktree when terminal creation fails"
+  assert_not_contains "$(cat "$LOG")" $'orca\x1f''worktree'$'\x1f''rm' \
+    "Orca spawn removed a worktree after terminal creation may have succeeded without a handle"
   assert_not_contains "$(cat "$LOG")" $'orca\x1f''terminal'$'\x1f''close' \
     "Orca spawn should not close a terminal when no handle was recorded"
-  pass "fm-spawn.sh --backend orca: removes worktree when terminal creation fails"
+  pass "fm-spawn.sh --backend orca: preserves worktree when terminal creation fails without a handle"
 }
 
-test_spawn_preserves_orca_metadata_when_abort_cleanup_fails() {
+test_spawn_preserves_orca_metadata_when_terminal_response_has_no_handle() {
   local proj wt data state config id out status
   id="orcacleanupleakz0"
   proj="$TMP_ROOT/cleanup-fail-project"
@@ -741,22 +741,21 @@ test_spawn_preserves_orca_metadata_when_abort_cleanup_fails() {
   printf '1\n' > "$RESP/1.exit"
   printf '{"ok":true,"result":{"repo":{"id":"repo-cleanup-fail"}}}\n' > "$RESP/2.out"
   printf '{"ok":true,"result":{"worktree":{"id":"wt-cleanup-fail","path":"%s"}}}\n' "$wt" > "$RESP/3.out"
-  printf '1\n' > "$RESP/4.exit"
-  printf '1\n' > "$RESP/5.exit"
+  printf '{"ok":true,"result":{"terminal":{"title":"fm-%s"}}}\n' "$id" > "$RESP/4.out"
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" FM_SPAWN_NO_GUARD=1 \
     "$ROOT/bin/fm-spawn.sh" "$id" "$proj" claude --backend orca 2>&1 )
   status=$?
-  [ "$status" -ne 0 ] || fail "Orca spawn should fail when terminal creation and abort cleanup fail"
-  assert_contains "$(cat "$LOG")" $'orca\x1f''worktree'$'\x1f''rm'$'\x1f''--worktree'$'\x1f''id:wt-cleanup-fail'$'\x1f''--force'$'\x1f''--json' \
-    "Orca spawn should attempt helper cleanup before preserving metadata"
-  assert_present "$state/$id.meta" "failed Orca abort cleanup should preserve metadata"
+  [ "$status" -ne 0 ] || fail "Orca spawn should fail when terminal creation returns no handle"
+  assert_not_contains "$(cat "$LOG")" $'orca\x1f''worktree'$'\x1f''rm' \
+    "Orca spawn removed a worktree after an unparseable terminal-create response"
+  assert_present "$state/$id.meta" "unparseable terminal-create response should preserve metadata"
   assert_grep "window=fm-$id" "$state/$id.meta" "preserved metadata missing stable window alias"
   assert_grep "backend=orca" "$state/$id.meta" "preserved metadata missing backend=orca"
   assert_grep "orca_worktree_id=wt-cleanup-fail" "$state/$id.meta" "preserved metadata missing Orca worktree id"
   assert_no_grep "terminal=" "$state/$id.meta" "preserved metadata should not invent a terminal handle"
-  pass "fm-spawn.sh --backend orca: preserves metadata when abort cleanup fails"
+  pass "fm-spawn.sh --backend orca: preserves metadata when terminal response has no handle"
 }
 
 test_spawn_releases_orca_resources_when_metadata_write_fails() {
@@ -1438,13 +1437,13 @@ test_json_get_ignores_undocumented_terminal_id_shapes
 test_worktree_and_terminal_helpers_parse_json
 test_worktree_create_defers_pathless_cleanup_to_verified_rollback
 test_spawn_preserves_pathless_orca_worktree_when_terminal_stop_is_unknown
-test_spawn_preserves_orca_metadata_when_pathless_worktree_cleanup_fails
+test_spawn_preserves_pathless_orca_worktree_without_terminal_proof
 test_spawn_writes_orca_metadata_and_launches_harness
 test_spawn_refuses_orca_secondmate_before_home_mutation
 test_spawn_refuses_orca_when_runtime_not_ready
 test_spawn_refuses_orca_nonisolated_worktree
-test_spawn_removes_orca_worktree_when_terminal_create_fails
-test_spawn_preserves_orca_metadata_when_abort_cleanup_fails
+test_spawn_preserves_orca_worktree_when_terminal_create_fails_without_handle
+test_spawn_preserves_orca_metadata_when_terminal_response_has_no_handle
 test_spawn_releases_orca_resources_when_metadata_write_fails
 test_peek_send_and_crew_state_route_through_orca_meta
 test_peek_and_crew_state_fail_closed_on_orca_error_json
diff --git a/tests/fm-backend.test.sh b/tests/fm-backend.test.sh
index 3dbe9402b3..d045a07474 100755
--- a/tests/fm-backend.test.sh
+++ b/tests/fm-backend.test.sh
@@ -1162,6 +1162,16 @@ test_adapter_target_state_matrices() {
 
 test_stop_and_verify_requires_confirmed_absence() {
   local out status=0
+  out=$(bash -c '
+    . "$1/bin/fm-backend.sh"
+    fm_backend_kill() { printf called; }
+    fm_backend_stop_and_verify tmux ""
+  ' _ "$ROOT" 2>&1) || status=$?
+  expect_code 1 "$status" "a missing endpoint id must refuse destructive cleanup"
+  assert_contains "$out" 'missing backend endpoint id' "missing endpoint refusal did not explain the unsafe metadata"
+  assert_not_contains "$out" 'called' "missing endpoint refusal invoked a backend kill"
+
+  status=0
   out=$(FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 bash -c '
     . "$1/bin/fm-backend.sh"
     fm_backend_kill() { return 0; }
diff --git a/tests/fm-host-root-mode.test.sh b/tests/fm-host-root-mode.test.sh
index 30f277483d..2621186d76 100644
--- a/tests/fm-host-root-mode.test.sh
+++ b/tests/fm-host-root-mode.test.sh
@@ -160,6 +160,39 @@ test_brief_variants() {
   pass "brief scaffolding has an explicit host variant and unchanged default variant"
 }
 
+test_host_local_only_rejected_before_mutation() {
+  local host="$TMP/local-only-host" home="$TMP/local-only-home" project="$TMP/local-only-target" fake_root="$TMP/local-only-root" guard_marker="$TMP/local-only-guard" out status=0
+  make_host "$host"
+  fm_git_init_commit "$project"
+  mkdir -p "$home/data" "$home/state" "$home/config" "$fake_root/bin"
+  printf '%s\n' "- $(basename "$project") [local-only] - local target (added 2026-07-26)" > "$home/data/projects.md"
+
+  out=$(cd "$host" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    "$ROOT/bin/fm-brief.sh" local-brief "$(basename "$project")" 2>&1) || status=$?
+  expect_code 1 "$status" "host-root brief must reject local-only delivery"
+  assert_contains "$out" "host-root mode does not support local-only project" "host-root brief refusal was not explicit"
+  assert_absent "$home/data/local-brief" "host-root brief created task data before rejecting local-only delivery"
+
+  cp "$ROOT/bin/fm-project-mode.sh" "$fake_root/bin/fm-project-mode.sh"
+  cat > "$fake_root/bin/fm-guard.sh" <<'SH'
+#!/usr/bin/env bash
+: > "$FM_GUARD_MUTATION"
+SH
+  chmod +x "$fake_root/bin/fm-project-mode.sh" "$fake_root/bin/fm-guard.sh"
+  : > "$fake_root/AGENTS.md"
+  mkdir -p "$home/data/local-spawn"
+  printf '<!-- firstmate-execution-mode: host-root -->\n' > "$home/data/local-spawn/brief.md"
+  status=0
+  out=$(cd "$host" && FM_GUARD_MUTATION="$guard_marker" FM_ROOT_OVERRIDE="$fake_root" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    "$ROOT/bin/fm-spawn.sh" local-spawn "$project" codex 2>&1) || status=$?
+  expect_code 1 "$status" "host-root spawn must reject local-only delivery"
+  assert_contains "$out" "host-root mode does not support local-only project" "host-root spawn refusal was not explicit"
+  assert_absent "$guard_marker" "host-root spawn ran the fleet guard before rejecting local-only delivery"
+  assert_absent "$home/state/.spawn-local-spawn.lock" "host-root spawn acquired task state before rejecting local-only delivery"
+  assert_absent "$home/state/local-spawn.meta" "host-root spawn wrote task metadata before rejecting local-only delivery"
+  pass "host-root local-only tasks are rejected before brief or fleet mutation"
+}
+
 make_fakebin() {
   local dir=$1 fb
   fb=$(fm_fakebin "$dir")
@@ -198,7 +231,10 @@ case "${1:-}" in
   list-panes) [ ! -f "$endpoint" ] || printf '%%1|@1|%s|test-session:1.0\n' "${FM_ENDPOINT_TARGET:-test-session:fm-rollback-stuck}" ;;
   has-session|new-session|set-window-option) ;;
   new-window) : > "$endpoint"; printf '%%1\n' ;;
-  kill-window) [ "${FM_REFUSE_STOP:-0}" = 1 ] || rm -f "$endpoint" ;;
+  kill-window)
+    [ -z "${FM_TMUX_KILL_MUTATION:-}" ] || printf 'late worker edit\n' > "$FM_TMUX_KILL_MUTATION"
+    [ "${FM_REFUSE_STOP:-0}" = 1 ] || rm -f "$endpoint"
+    ;;
   send-keys)
     case "$*" in
       *'treehouse get'*) printf '%s\n' "$FM_TARGET_PATH" > "$FM_CURRENT_PATH" ;;
@@ -649,6 +685,19 @@ test_host_teardown_requires_confirmed_stop() {
   assert_no_grep 'return --force' "$tree_log" "host-root teardown recycled work before confirming endpoint absence"
   assert_present "$home/state/host-teardown.meta" "host-root teardown removed recovery metadata after stop refusal"
 
+  : > "$log"; : > "$tree_log"; status=0
+  out=$(cd "$host" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    FM_TMUX_KILL_MUTATION="$wt/late-edit.txt" FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 FM_TMUX_LOG="$log" \
+    FM_ENDPOINT_TARGET=test-session:fm-host-teardown FM_LAUNCH_FILE="$TMP/unused.launch" FM_CURRENT_PATH="$current" \
+    FM_TARGET_PATH="$wt" FM_HOST_PATH="$host" FM_TREEHOUSE_LOG="$tree_log" TMUX=fake \
+    "$ROOT/bin/fm-teardown.sh" host-teardown 2>&1) || status=$?
+  [ "$status" -ne 0 ] || fail "host-root tmux teardown discarded an edit written during endpoint stop"
+  assert_contains "$out" "uncommitted changes" "post-stop tmux safety refusal did not explain the late edit"
+  assert_present "$wt/late-edit.txt" "post-stop tmux safety refusal lost the late worker edit"
+  assert_present "$home/state/host-teardown.meta" "post-stop tmux safety refusal removed task metadata"
+  assert_no_grep 'return --force' "$tree_log" "post-stop tmux safety refusal returned the worktree"
+  rm -f "$wt/late-edit.txt"
+
   : > "$log"; : > "$tree_log"; status=0
   out=$(cd "$host" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
     FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 FM_TMUX_LOG="$log" \
@@ -723,6 +772,7 @@ test_resolution_and_validation
 test_session_cwd_mismatch_precedes_mutation
 test_host_command_rendering
 test_brief_variants
+test_host_local_only_rejected_before_mutation
 test_spawn_separates_roots
 test_duplicate_spawn_preserves_existing_task
 test_spawn_rejects_host_as_target_and_cleans_failed_transition
diff --git a/tests/fm-review-diff.test.sh b/tests/fm-review-diff.test.sh
index 2193772b9d..7ecc68428a 100755
--- a/tests/fm-review-diff.test.sh
+++ b/tests/fm-review-diff.test.sh
@@ -169,8 +169,49 @@ test_unreachable_pr_head_falls_back_with_warning() {
   pass "fm-review-diff falls back to local branch with a warning when PR head is unreachable"
 }
 
+test_host_mode_scopes_every_git_command_to_worktree() {
+  local case_dir host fake_root fb git_log real_git out
+  case_dir=$(make_case host-scoped)
+  host="$case_dir/host"
+  fake_root="$case_dir/fake-root"
+  fb="$case_dir/fakebin"
+  git_log="$case_dir/git.log"
+  real_git=$(command -v git)
+  mkdir -p "$host" "$fake_root/bin" "$fb"
+  : > "$host/AGENTS.md"
+  cat > "$fake_root/bin/fm-guard.sh" <<'SH'
+#!/usr/bin/env bash
+exit 0
+SH
+  chmod +x "$fake_root/bin/fm-guard.sh"
+  cat > "$fb/git" <<'SH'
+#!/usr/bin/env bash
+printf 'git' >> "$FM_GIT_LOG"
+for arg in "$@"; do printf '\037%s' "$arg" >> "$FM_GIT_LOG"; done
+printf '\n' >> "$FM_GIT_LOG"
+exec "$FM_REAL_GIT" "$@"
+SH
+  chmod +x "$fb/git"
+  printf 'host-scoped\n' > "$case_dir/wt/feature.txt"
+  git -C "$case_dir/wt" add feature.txt
+  git -C "$case_dir/wt" commit -qm "host scoped review"
+  write_task_meta "$case_dir" "host_root=$host"
+
+  out=$(cd "$host" && PATH="$fb:$PATH" FM_REAL_GIT="$real_git" FM_GIT_LOG="$git_log" \
+    FM_ROOT_OVERRIDE="$fake_root" FM_STATE_OVERRIDE="$case_dir/state" FM_HOST_ROOT="$host" \
+    "$REVIEW_DIFF" task-x1 --stat)
+
+  assert_contains "$out" "feature.txt" "host-scoped review did not inspect the task branch"
+  assert_contains "$(cat "$git_log")" $'git\x1f-C\x1f'"$case_dir/wt" \
+    "host-scoped review issued no Git command against the target worktree"
+  assert_not_contains "$(cat "$git_log")" $'git\x1f-C\x1f'"$case_dir/project" \
+    "host-scoped review issued a Git command against the primary project checkout"
+  pass "fm-review-diff scopes every host-mode Git command to the target worktree"
+}
+
 test_pr_meta_uses_pr_head_not_stale_local
 test_pr_meta_fetches_pull_head_without_recorded_sha
 test_stale_recorded_pr_head_loses_to_fetched_pull_head
 test_no_pr_meta_uses_local_branch
 test_unreachable_pr_head_falls_back_with_warning
+test_host_mode_scopes_every_git_command_to_worktree

From 36ffb1a00a30c02e974dd3bc2e94ca036b81f59b Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Sun, 26 Jul 2026 13:16:33 +0300
Subject: [PATCH 06/39] no-mistakes(review): Harden host-root promotion and
 logical project resolution

---
 bin/fm-promote.sh               |  8 ++++++-
 bin/fm-spawn.sh                 |  7 -------
 docs/configuration.md           |  2 +-
 tests/fm-host-root-mode.test.sh | 37 +++++++++++++++++++++++++++------
 4 files changed, 39 insertions(+), 15 deletions(-)

diff --git a/bin/fm-promote.sh b/bin/fm-promote.sh
index 2efc524883..50464ffd5e 100755
--- a/bin/fm-promote.sh
+++ b/bin/fm-promote.sh
@@ -20,6 +20,10 @@ ID=$1
 META="$STATE/$ID.meta"
 [ -f "$META" ] || { echo "error: no meta for task $ID at $META" >&2; exit 1; }
 fm_host_root_assert_task_cwd "$FM_ROOT" "$META" || exit $?
+if grep -q '^host_root=.' "$META" && grep -qx 'mode=local-only' "$META"; then
+  echo "error: host-root mode does not support promoting local-only scout $ID" >&2
+  exit 1
+fi
 # The recorded host binding is established before this guard can repair state.
 "$FM_ROOT/bin/fm-guard.sh" || true
 grep -qx 'kind=scout' "$META" || { echo "error: task $ID is not a scout task (kind=scout not in meta)" >&2; exit 1; }
@@ -31,9 +35,11 @@ mv "$TMP" "$META"
 
 HOME_Q=$(printf '%q' "$FM_HOME")
 SEND=bin/fm-send.sh
+SHIP_INSTRUCTIONS="review scratch state with git status and git log; reset to a clean default-branch base; carry over only intended fix changes; create branch fm/$ID; implement; report done"
 if grep -q '^host_root=.' "$META"; then
   FM_ROOT_REAL=$(cd "$FM_ROOT" && pwd -P)
   SEND=$(fm_host_root_shell_quote "$FM_ROOT_REAL/bin/fm-send.sh")
+  SHIP_INSTRUCTIONS='review scratch state with git -C "$FM_TARGET_WORKTREE" status and git -C "$FM_TARGET_WORKTREE" log; reset "$FM_TARGET_WORKTREE" to a clean default-branch base using git -C "$FM_TARGET_WORKTREE"; carry over only intended fix changes under "$FM_TARGET_WORKTREE"; create branch fm/'"$ID"' with git -C "$FM_TARGET_WORKTREE" checkout -b fm/'"$ID"'; implement under "$FM_TARGET_WORKTREE"; run every remaining Git command with git -C "$FM_TARGET_WORKTREE" and every test, build, and validation command through (cd "$FM_TARGET_WORKTREE" && ...); report done'
 fi
 echo "promoted $ID to ship (teardown protection restored)"
-echo "next: FM_HOME=$HOME_Q $SEND fm-$ID '<ship instructions: review scratch state with git status and git log; reset to a clean default-branch base; carry over only intended fix changes; create branch fm/$ID; implement; report done>'"
+echo "next: FM_HOME=$HOME_Q $SEND fm-$ID '<ship instructions: $SHIP_INSTRUCTIONS>'"
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 775ac21ae6..b7a9c6aed1 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -254,14 +254,7 @@ if [ "$HOST_MODE" -eq 1 ] && [ "$KIND" = ship ]; then
   fi
   for host_project in "${host_projects[@]}"; do
     [ -n "$host_project" ] || continue
-    host_project_path=$host_project
-    case "$host_project_path" in
-      projects/*) host_project_path="$PROJECTS/${host_project_path#projects/}" ;;
-    esac
     host_project_name=$(basename "$host_project")
-    if [ -d "$host_project_path" ]; then
-      host_project_name=$(basename "$(cd "$host_project_path" && pwd -P)")
-    fi
     read -r host_mode host_yolo <<EOF
 $("$FM_ROOT/bin/fm-project-mode.sh" "$host_project_name")
 EOF
diff --git a/docs/configuration.md b/docs/configuration.md
index 731745d47b..619b4e42b9 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -203,7 +203,7 @@ Every non-forced host-root ship teardown repeats worktree safety checks after th
 Host-root briefs carry `<!-- firstmate-execution-mode: host-root -->`, require the worker to read host instructions first and applicable target instructions before edits, keep the host read-only except for host-owned lifecycle effects, and require explicit target paths or scoped subshells.
 The same target scoping applies to the complete no-mistakes lifecycle, including doctor, initialization, run, gate responses, and follow-up help commands; no validation command may default to the host cwd.
 Spawn rejects a cwd-relative legacy brief in host mode rather than weakening that contract silently.
-Host-root ship tasks support `no-mistakes` and `direct-PR` delivery; brief generation and spawn reject `local-only` because its guarded landing path changes the target project's primary checkout.
+Host-root ship tasks support `no-mistakes` and `direct-PR` delivery; brief generation, spawn, and scout promotion reject `local-only` because its guarded landing path changes the target project's primary checkout.
 
 Harness integration is additive.
 Claude receives an additional task settings file through `--settings`, Codex retains its launch-command notification, OpenCode receives an explicit task plugin in addition to host project plugins, Pi receives its explicit task extension, and Grok and Kimi use per-process task tokens consumed by their guarded global hooks.
diff --git a/tests/fm-host-root-mode.test.sh b/tests/fm-host-root-mode.test.sh
index 2621186d76..777e85428e 100644
--- a/tests/fm-host-root-mode.test.sh
+++ b/tests/fm-host-root-mode.test.sh
@@ -161,14 +161,17 @@ test_brief_variants() {
 }
 
 test_host_local_only_rejected_before_mutation() {
-  local host="$TMP/local-only-host" home="$TMP/local-only-home" project="$TMP/local-only-target" fake_root="$TMP/local-only-root" guard_marker="$TMP/local-only-guard" out status=0
+  local host="$TMP/local-only-host" home="$TMP/local-only-home" project="$TMP/local-only-physical" alias="$TMP/local-only-alias" fake_root="$TMP/local-only-root" guard_marker="$TMP/local-only-guard" out status=0
   make_host "$host"
   fm_git_init_commit "$project"
+  ln -s "$project" "$alias"
   mkdir -p "$home/data" "$home/state" "$home/config" "$fake_root/bin"
-  printf '%s\n' "- $(basename "$project") [local-only] - local target (added 2026-07-26)" > "$home/data/projects.md"
+  printf '%s\n%s\n' \
+    "- $(basename "$alias") [local-only] - local target (added 2026-07-26)" \
+    "- $(basename "$project") [no-mistakes] - physical target (added 2026-07-26)" > "$home/data/projects.md"
 
   out=$(cd "$host" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
-    "$ROOT/bin/fm-brief.sh" local-brief "$(basename "$project")" 2>&1) || status=$?
+    "$ROOT/bin/fm-brief.sh" local-brief "$(basename "$alias")" 2>&1) || status=$?
   expect_code 1 "$status" "host-root brief must reject local-only delivery"
   assert_contains "$out" "host-root mode does not support local-only project" "host-root brief refusal was not explicit"
   assert_absent "$home/data/local-brief" "host-root brief created task data before rejecting local-only delivery"
@@ -184,7 +187,7 @@ SH
   printf '<!-- firstmate-execution-mode: host-root -->\n' > "$home/data/local-spawn/brief.md"
   status=0
   out=$(cd "$host" && FM_GUARD_MUTATION="$guard_marker" FM_ROOT_OVERRIDE="$fake_root" FM_HOME="$home" FM_HOST_ROOT="$host" \
-    "$ROOT/bin/fm-spawn.sh" local-spawn "$project" codex 2>&1) || status=$?
+    "$ROOT/bin/fm-spawn.sh" local-spawn "$alias" codex 2>&1) || status=$?
   expect_code 1 "$status" "host-root spawn must reject local-only delivery"
   assert_contains "$out" "host-root mode does not support local-only project" "host-root spawn refusal was not explicit"
   assert_absent "$guard_marker" "host-root spawn ran the fleet guard before rejecting local-only delivery"
@@ -478,9 +481,9 @@ test_all_harnesses_add_one_task_safeguard() {
 }
 
 test_mutators_require_host_cwd() {
-  local host="$TMP/mutator-host" other="$TMP/mutator-other" home="$TMP/mutator-home" out status=0
+  local host="$TMP/mutator-host" other="$TMP/mutator-other" home="$TMP/mutator-home" fake_root="$TMP/mutator-root" guard_marker="$TMP/mutator-guard" out status=0
   make_host "$host"
-  mkdir -p "$other" "$home/state"
+  mkdir -p "$other" "$home/state" "$fake_root/bin"
   printf 'window=fake:fm-lane\nworktree=/tmp/target\nhost_root=%s\nproject=/tmp/project\nkind=ship\n' "$host" > "$home/state/lane.meta"
   printf 'window=fake:fm-scout\nworktree=/tmp/scout\nhost_root=%s\nproject=/tmp/project\nkind=scout\n' "$host" > "$home/state/scout.meta"
   out=$(cd "$other" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-send.sh" lane hello 2>&1) || status=$?
@@ -516,10 +519,32 @@ test_mutators_require_host_cwd() {
   out=$(cd "$other" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-promote.sh" scout 2>&1) || status=$?
   expect_code 2 "$status" "fm-promote must reject a host cwd mismatch"
   grep -qx 'kind=scout' "$home/state/scout.meta" || fail "promote mutated task metadata before host validation"
+  printf 'mode=local-only\n' >> "$home/state/scout.meta"
+  cat > "$fake_root/bin/fm-guard.sh" <<'SH'
+#!/usr/bin/env bash
+: > "$FM_GUARD_MUTATION"
+SH
+  chmod +x "$fake_root/bin/fm-guard.sh"
+  status=0
+  out=$(cd "$host" && FM_GUARD_MUTATION="$guard_marker" FM_ROOT_OVERRIDE="$fake_root" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-promote.sh" scout 2>&1) || status=$?
+  expect_code 1 "$status" "fm-promote must reject a host-root local-only scout"
+  assert_contains "$out" 'host-root mode does not support promoting local-only scout' "host-root local-only promotion refusal was not explicit"
+  assert_absent "$guard_marker" "host-root promotion ran the fleet guard before rejecting local-only delivery"
+  grep -qx 'kind=scout' "$home/state/scout.meta" || fail "local-only promotion mutated task metadata"
+  sed -i '/^mode=local-only$/d' "$home/state/scout.meta"
   status=0
   out=$(cd "$host" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-promote.sh" scout 2>&1) || status=$?
   expect_code 0 "$status" "fm-promote rejected a recorded host-root scout"
   assert_contains "$out" "'$ROOT/bin/fm-send.sh'" "host-root promotion did not print a quoted absolute fm-send path"
+  assert_contains "$out" 'git -C "$FM_TARGET_WORKTREE" status' "host-root promotion did not scope scratch status"
+  assert_contains "$out" 'git -C "$FM_TARGET_WORKTREE" log' "host-root promotion did not scope scratch history"
+  assert_contains "$out" 'git -C "$FM_TARGET_WORKTREE" checkout -b fm/scout' "host-root promotion did not scope branch creation"
+  assert_contains "$out" '(cd "$FM_TARGET_WORKTREE" && ...)' "host-root promotion did not scope validation commands"
+  printf 'window=fake:fm-plain\nworktree=/tmp/plain\nproject=/tmp/project\nkind=scout\n' > "$home/state/plain.meta"
+  status=0
+  out=$(cd "$other" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" "$ROOT/bin/fm-promote.sh" plain 2>&1) || status=$?
+  expect_code 0 "$status" "fm-promote changed default-mode promotion"
+  assert_contains "$out" '<ship instructions: review scratch state with git status and git log; reset to a clean default-branch base; carry over only intended fix changes; create branch fm/plain; implement; report done>' "default-mode promotion instructions changed"
   status=0
   out=$(cd "$other" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-check-register.sh" lane 2>&1) || status=$?
   expect_code 2 "$status" "fm-check-register must reject a host cwd mismatch"

From 316bf85a5575fbdf78efaed79a7bdc948ac806ee Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Sun, 26 Jul 2026 13:42:39 +0300
Subject: [PATCH 07/39] no-mistakes(document): Consolidate host-root
 documentation ownership

---
 docs/architecture.md         | 7 +------
 docs/configuration.md        | 3 +--
 tests/fm-gate-refuse.test.sh | 5 +++--
 3 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/docs/architecture.md b/docs/architecture.md
index 0389182dd4..abfb0a68e3 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -115,12 +115,7 @@ Codex App support is recorded in `docs/codex-app-backend.md`; it is not selectab
 ## Worktrees, not branches in your checkout
 
 The default launch cwd remains the isolated task worktree.
-When optional `FM_HOST_ROOT` mode is enabled, FirstMate separates its tracked code root, operational home, host instruction root, and target worktree instead: the backend acquires and validates the isolated target first, records it as `worktree=`, returns the endpoint to the physical host root, verifies that cwd, then launches the harness with exact `FM_HOST_ROOT` and `FM_TARGET_WORKTREE` values.
-The target is rejected if it overlaps the host, and a failed host transition cleans the new endpoint and worktree or leaves recoverable metadata when cleanup itself fails.
-Host instructions and native lifecycle hooks remain authoritative because the harness starts from the host root, while the host-root brief requires applicable target instructions before edits and scopes every target operation explicitly.
-FirstMate task completion signals are added through harness launch configuration or per-process identity rather than by writing host hook files.
-Secondmates keep their isolated-home launch shape and clear both host variables.
-The full four-root contract and validation rules are owned by [configuration.md](configuration.md#host-root-mode-fm_host_root).
+The optional host-root exception is owned by [configuration.md's four-root runtime contract](configuration.md#host-root-mode-fm_host_root).
 
 Crewmates never intentionally touch your project clone; [treehouse](https://github.com/kunchenguid/treehouse) pools clean worktrees for tmux, herdr, zellij, and cmux tasks, while Orca creates its own worktrees for `backend=orca`.
 For ship and scout work, `fm-spawn.sh` refuses to launch unless the resolved task path is a real git worktree root that is distinct from the project primary checkout.
diff --git a/docs/configuration.md b/docs/configuration.md
index 619b4e42b9..8cdaefd636 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -206,8 +206,7 @@ Spawn rejects a cwd-relative legacy brief in host mode rather than weakening tha
 Host-root ship tasks support `no-mistakes` and `direct-PR` delivery; brief generation, spawn, and scout promotion reject `local-only` because its guarded landing path changes the target project's primary checkout.
 
 Harness integration is additive.
-Claude receives an additional task settings file through `--settings`, Codex retains its launch-command notification, OpenCode receives an explicit task plugin in addition to host project plugins, Pi receives its explicit task extension, and Grok and Kimi use per-process task tokens consumed by their guarded global hooks.
-None of these paths writes or replaces host hook configuration, and each task signal is installed once.
+The [`harness-adapters` skill](../.agents/skills/harness-adapters/SKILL.md#host-root-task-integration) owns each harness's task-signal shape; none writes or replaces host hook configuration, and each signal is installed once.
 The host repository's own lifecycle hooks continue to load from the host cwd.
 Host-root ordinary tasks reject raw launch commands because an unverified command cannot guarantee the required task completion safeguard.
 
diff --git a/tests/fm-gate-refuse.test.sh b/tests/fm-gate-refuse.test.sh
index a7f0147f6c..506e43651f 100755
--- a/tests/fm-gate-refuse.test.sh
+++ b/tests/fm-gate-refuse.test.sh
@@ -74,6 +74,7 @@ make_normal_repo() {
 
 GATE_WT=$(make_gate_worktree "$TMP/gate")
 NORMAL_CWD=$(make_normal_repo "$TMP/normal-cwd")
+ln -s "$ROOT/bin" "$NORMAL_CWD/bin"
 
 # --- the shared helper, tested directly -------------------------------------
 
@@ -182,7 +183,7 @@ run_spawn() {
   mkdir -p "$home/data/$id"
   printf 'brief\n' > "$home/data/$id/brief.md"
   ( cd "$cwd" && env -u NO_MISTAKES_GATE -u FM_GATE_REFUSE_BYPASS \
-      "FM_ROOT_OVERRIDE=" "FM_HOME=$home" \
+      "FM_ROOT_OVERRIDE=$NORMAL_CWD" "FM_HOME=$home" \
       "FM_STATE_OVERRIDE=$home/state" "FM_DATA_OVERRIDE=$home/data" \
       "FM_PROJECTS_OVERRIDE=$home/projects" "FM_CONFIG_OVERRIDE=$home/config" \
       "FM_SPAWN_NO_GUARD=1" "FM_FAKE_PANE_PATH=$pane" "TMUX=fake,1,0" \
@@ -357,7 +358,7 @@ SH
 run_teardown() {
   local cwd=$1 case_dir=$2; shift 2
   ( cd "$cwd" && env -u NO_MISTAKES_GATE -u FM_GATE_REFUSE_BYPASS \
-      "FM_ROOT_OVERRIDE=$ROOT" "FM_STATE_OVERRIDE=$case_dir/state" \
+      "FM_ROOT_OVERRIDE=$NORMAL_CWD" "FM_STATE_OVERRIDE=$case_dir/state" \
       "FM_CONFIG_OVERRIDE=$case_dir/config" "PATH=$case_dir/fakebin:$PATH" "$@" \
       "$TEARDOWN" task-x1 ) 2>&1
 }

From cca78f79027f77eedd10709efbc076a76cdf7001 Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Sun, 26 Jul 2026 13:49:28 +0300
Subject: [PATCH 08/39] no-mistakes(lint): Suppress intentional literal-dollar
 ShellCheck warnings

---
 bin/fm-promote.sh               | 1 +
 tests/fm-host-root-mode.test.sh | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/bin/fm-promote.sh b/bin/fm-promote.sh
index 50464ffd5e..c320506f0c 100755
--- a/bin/fm-promote.sh
+++ b/bin/fm-promote.sh
@@ -39,6 +39,7 @@ SHIP_INSTRUCTIONS="review scratch state with git status and git log; reset to a
 if grep -q '^host_root=.' "$META"; then
   FM_ROOT_REAL=$(cd "$FM_ROOT" && pwd -P)
   SEND=$(fm_host_root_shell_quote "$FM_ROOT_REAL/bin/fm-send.sh")
+  # shellcheck disable=SC2016  # These variables are literal worker instructions.
   SHIP_INSTRUCTIONS='review scratch state with git -C "$FM_TARGET_WORKTREE" status and git -C "$FM_TARGET_WORKTREE" log; reset "$FM_TARGET_WORKTREE" to a clean default-branch base using git -C "$FM_TARGET_WORKTREE"; carry over only intended fix changes under "$FM_TARGET_WORKTREE"; create branch fm/'"$ID"' with git -C "$FM_TARGET_WORKTREE" checkout -b fm/'"$ID"'; implement under "$FM_TARGET_WORKTREE"; run every remaining Git command with git -C "$FM_TARGET_WORKTREE" and every test, build, and validation command through (cd "$FM_TARGET_WORKTREE" && ...); report done'
 fi
 echo "promoted $ID to ship (teardown protection restored)"
diff --git a/tests/fm-host-root-mode.test.sh b/tests/fm-host-root-mode.test.sh
index 777e85428e..659aa1bb24 100644
--- a/tests/fm-host-root-mode.test.sh
+++ b/tests/fm-host-root-mode.test.sh
@@ -536,9 +536,13 @@ SH
   out=$(cd "$host" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-promote.sh" scout 2>&1) || status=$?
   expect_code 0 "$status" "fm-promote rejected a recorded host-root scout"
   assert_contains "$out" "'$ROOT/bin/fm-send.sh'" "host-root promotion did not print a quoted absolute fm-send path"
+  # shellcheck disable=SC2016  # Assertions intentionally match literal worker variables.
   assert_contains "$out" 'git -C "$FM_TARGET_WORKTREE" status' "host-root promotion did not scope scratch status"
+  # shellcheck disable=SC2016
   assert_contains "$out" 'git -C "$FM_TARGET_WORKTREE" log' "host-root promotion did not scope scratch history"
+  # shellcheck disable=SC2016
   assert_contains "$out" 'git -C "$FM_TARGET_WORKTREE" checkout -b fm/scout' "host-root promotion did not scope branch creation"
+  # shellcheck disable=SC2016
   assert_contains "$out" '(cd "$FM_TARGET_WORKTREE" && ...)' "host-root promotion did not scope validation commands"
   printf 'window=fake:fm-plain\nworktree=/tmp/plain\nproject=/tmp/project\nkind=scout\n' > "$home/state/plain.meta"
   status=0

From a1086912e31e728d3ccb1f19d1307c89d6406994 Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Sun, 26 Jul 2026 14:57:00 +0300
Subject: [PATCH 09/39] no-mistakes(review): Preserve logical host scout
 delivery modes

---
 bin/fm-spawn.sh                 |  4 ++--
 tests/fm-host-root-mode.test.sh | 31 +++++++++++++++++++++++++++++++
 2 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index b7a9c6aed1..14eaeac3a1 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -240,7 +240,7 @@ if fm_host_root_enabled; then
   fi
 fi
 
-if [ "$HOST_MODE" -eq 1 ] && [ "$KIND" = ship ]; then
+if [ "$HOST_MODE" -eq 1 ]; then
   host_idpart=${POS[0]:-}
   host_idpart=${host_idpart%%=*}
   host_projects=()
@@ -258,7 +258,7 @@ if [ "$HOST_MODE" -eq 1 ] && [ "$KIND" = ship ]; then
     read -r host_mode host_yolo <<EOF
 $("$FM_ROOT/bin/fm-project-mode.sh" "$host_project_name")
 EOF
-    if [ "$host_mode" = local-only ]; then
+    if [ "$KIND" = ship ] && [ "$host_mode" = local-only ]; then
       echo "error: host-root mode does not support local-only project $host_project_name" >&2
       exit 1
     fi
diff --git a/tests/fm-host-root-mode.test.sh b/tests/fm-host-root-mode.test.sh
index 659aa1bb24..6a87e173f3 100644
--- a/tests/fm-host-root-mode.test.sh
+++ b/tests/fm-host-root-mode.test.sh
@@ -270,6 +270,36 @@ SH
   printf '%s\n' "$fb"
 }
 
+test_host_scout_records_logical_project_mode() {
+  local host="$TMP/scout-mode-host" home="$TMP/scout-mode-home" project="$TMP/scout-mode-physical" alias="$TMP/scout-mode-alias" wt="$TMP/scout-mode-wt" fb log current launch meta out status=0
+  make_host "$host"
+  fm_git_init_commit "$project"
+  ln -s "$project" "$alias"
+  git -C "$project" worktree add -q --detach "$wt"
+  mkdir -p "$home/data" "$home/state" "$home/config"
+  printf '%s\n%s\n' \
+    "- $(basename "$alias") [local-only +yolo] - logical target (added 2026-07-26)" \
+    "- $(basename "$project") [no-mistakes] - physical target (added 2026-07-26)" > "$home/data/projects.md"
+  (cd "$host" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    "$ROOT/bin/fm-brief.sh" scout-mode "$(basename "$alias")" --scout >/dev/null 2>&1)
+  fb=$(make_fakebin "$TMP/fake-scout-mode")
+  log="$TMP/scout-mode.log"; current="$TMP/scout-mode.current"; launch="$TMP/scout-mode.launch"
+  printf '%s\n' "$alias" > "$current"
+  (cd "$host" && PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH="$wt" FM_HOST_PATH="$host" TMUX=fake \
+    "$ROOT/bin/fm-spawn.sh" scout-mode "$alias" codex --scout >/dev/null 2>&1)
+  meta="$home/state/scout-mode.meta"
+  assert_grep 'kind=scout' "$meta" "host-root scout lost its scout kind"
+  assert_grep 'mode=local-only' "$meta" "host-root scout recorded the physical project's mode"
+  assert_grep 'yolo=on' "$meta" "host-root scout lost the logical project's yolo setting"
+  out=$(cd "$host" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    "$ROOT/bin/fm-promote.sh" scout-mode 2>&1) || status=$?
+  expect_code 1 "$status" "host-root local-only scout promotion must be rejected"
+  assert_contains "$out" 'host-root mode does not support promoting local-only scout' "host-root local-only scout promotion refusal was not explicit"
+  assert_grep 'kind=scout' "$meta" "rejected promotion changed the scout kind"
+  pass "host-root scouts retain logical project delivery mode through promotion"
+}
+
 test_spawn_separates_roots() {
   local host="$TMP/spawn & host" home="$TMP/spawn home's & #%?" project="$TMP/target & repo" wt="$TMP/target & worktree" fb log current launch obs argv turnend meta before after tree_line cd_line launch_line
   make_host "$host"
@@ -802,6 +832,7 @@ test_session_cwd_mismatch_precedes_mutation
 test_host_command_rendering
 test_brief_variants
 test_host_local_only_rejected_before_mutation
+test_host_scout_records_logical_project_mode
 test_spawn_separates_roots
 test_duplicate_spawn_preserves_existing_task
 test_spawn_rejects_host_as_target_and_cleans_failed_transition

From 42ace8759392e940d5ac82c771efe8072cf433ee Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Sun, 26 Jul 2026 15:14:07 +0300
Subject: [PATCH 10/39] no-mistakes(document): Clarify local-only host-root
 scout documentation

---
 docs/configuration.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/docs/configuration.md b/docs/configuration.md
index 8cdaefd636..60bd7c5ac3 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -203,7 +203,8 @@ Every non-forced host-root ship teardown repeats worktree safety checks after th
 Host-root briefs carry `<!-- firstmate-execution-mode: host-root -->`, require the worker to read host instructions first and applicable target instructions before edits, keep the host read-only except for host-owned lifecycle effects, and require explicit target paths or scoped subshells.
 The same target scoping applies to the complete no-mistakes lifecycle, including doctor, initialization, run, gate responses, and follow-up help commands; no validation command may default to the host cwd.
 Spawn rejects a cwd-relative legacy brief in host mode rather than weakening that contract silently.
-Host-root ship tasks support `no-mistakes` and `direct-PR` delivery; brief generation, spawn, and scout promotion reject `local-only` because its guarded landing path changes the target project's primary checkout.
+Host-root ship brief generation and spawn support `no-mistakes` and `direct-PR` delivery but reject `local-only` because its guarded landing path changes the target project's primary checkout.
+Host-root scouts may inspect `local-only` targets and retain their configured mode and autonomy, but promotion rejects them while that mode remains active.
 
 Harness integration is additive.
 The [`harness-adapters` skill](../.agents/skills/harness-adapters/SKILL.md#host-root-task-integration) owns each harness's task-signal shape; none writes or replaces host hook configuration, and each signal is installed once.

From 7b03ed8007efb60588b9dc1b5fd168eaa025c586 Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Sun, 26 Jul 2026 15:46:31 +0300
Subject: [PATCH 11/39] no-mistakes(review): Captain: Protect retained metadata
 and host-bound reads

---
 bin/fm-crew-state.sh            |  3 ++
 bin/fm-peek.sh                  | 14 +++++++-
 bin/fm-spawn.sh                 |  4 +++
 tests/fm-host-root-mode.test.sh | 63 ++++++++++++++++++++++++++++++---
 4 files changed, 78 insertions(+), 6 deletions(-)

diff --git a/bin/fm-crew-state.sh b/bin/fm-crew-state.sh
index 32dff23668..cd7c6051eb 100755
--- a/bin/fm-crew-state.sh
+++ b/bin/fm-crew-state.sh
@@ -60,6 +60,8 @@ STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 . "$SCRIPT_DIR/fm-tmux-lib.sh"
 # shellcheck source=bin/fm-backend.sh
 . "$SCRIPT_DIR/fm-backend.sh"
+# shellcheck source=bin/fm-host-root-lib.sh
+. "$SCRIPT_DIR/fm-host-root-lib.sh"
 # shellcheck source=bin/fm-classify-lib.sh
 . "$SCRIPT_DIR/fm-classify-lib.sh"
 
@@ -89,6 +91,7 @@ emit() {  # <state> <source> [detail]
 # --- meta resolution --------------------------------------------------------
 
 [ -f "$META" ] || emit unknown none "no metadata for $ID"
+fm_host_root_assert_task_cwd "$FM_ROOT" "$META" || exit $?
 
 meta_value() {  # <key>
   grep "^$1=" "$META" 2>/dev/null | tail -1 | cut -d= -f2- || true
diff --git a/bin/fm-peek.sh b/bin/fm-peek.sh
index 97d2ffe2d2..845e44d5ab 100755
--- a/bin/fm-peek.sh
+++ b/bin/fm-peek.sh
@@ -12,10 +12,22 @@ STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 
 # shellcheck source=bin/fm-backend.sh
 . "$SCRIPT_DIR/fm-backend.sh"
+# shellcheck source=bin/fm-host-root-lib.sh
+. "$SCRIPT_DIR/fm-host-root-lib.sh"
+
+RAW_TARGET=$1
+TASK_META=$(fm_backend_meta_for_selector "$RAW_TARGET" "$STATE" 2>/dev/null || true)
+if [ -z "$TASK_META" ]; then
+  TASK_META=$(fm_backend_meta_for_window "$RAW_TARGET" "$STATE" 2>/dev/null || true)
+fi
+if [ -n "$TASK_META" ]; then
+  fm_host_root_assert_task_cwd "$FM_ROOT" "$TASK_META" || exit $?
+else
+  fm_host_root_assert_session_cwd "$FM_ROOT" || exit $?
+fi
 
 "$SCRIPT_DIR/fm-guard.sh" || true
 
-RAW_TARGET=$1
 T=$(fm_backend_resolve_selector "$RAW_TARGET" "$STATE")
 N=${2:-40}
 
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 14eaeac3a1..a0bca54967 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -557,6 +557,10 @@ if ! fm_lock_try_acquire "$SPAWN_TASK_LOCK"; then
   exit 1
 fi
 SPAWN_TASK_LOCK_HELD=1
+if [ -e "$STATE/$ID.meta" ] || [ -L "$STATE/$ID.meta" ]; then
+  echo "error: task metadata already exists for $ID; reconcile or tear down the retained task before spawning" >&2
+  exit 1
+fi
 PROJ=
 ARG3=
 FIRSTMATE_HOME=
diff --git a/tests/fm-host-root-mode.test.sh b/tests/fm-host-root-mode.test.sh
index 6a87e173f3..53d2f4a054 100644
--- a/tests/fm-host-root-mode.test.sh
+++ b/tests/fm-host-root-mode.test.sh
@@ -251,6 +251,7 @@ SH
 #!/usr/bin/env bash
 set -u
 [ -z "${FM_TREEHOUSE_LOG:-}" ] || printf '%s\n' "$*" >> "$FM_TREEHOUSE_LOG"
+[ "${FM_REFUSE_RETURN:-0}" != 1 ] || exit 93
 exit 0
 SH
   chmod +x "$fb/treehouse"
@@ -372,12 +373,24 @@ test_duplicate_spawn_preserves_existing_task() {
     FM_TARGET_PATH=/tmp/unused FM_HOST_PATH="$host" TMUX=fake \
     "$ROOT/bin/fm-spawn.sh" lane "$project" codex 2>&1) || status=$?
   [ "$status" -ne 0 ] || fail "duplicate spawn unexpectedly succeeded"
-  assert_contains "$out" 'window test-session:fm-lane already exists' "duplicate spawn refusal was not explicit"
+  assert_contains "$out" 'task metadata already exists for lane' "duplicate spawn refusal was not explicit"
   assert_no_grep 'kill-window' "$log" "duplicate spawn killed the existing task endpoint"
   cmp -s "$TMP/existing.meta" "$home/state/lane.meta" || fail "duplicate spawn changed existing metadata"
   cmp -s "$TMP/existing.status" "$home/state/lane.status" || fail "duplicate spawn changed existing status"
   assert_present "$current.endpoint" "duplicate spawn removed the existing endpoint"
-  pass "duplicate spawn preserves the existing endpoint and task records"
+  rm -f "$current.endpoint"
+  : > "$log"
+  status=0
+  out=$(cd "$host" && PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$launch" FM_CURRENT_PATH="$current" \
+    FM_TARGET_PATH=/tmp/unused FM_HOST_PATH="$host" TMUX=fake \
+    "$ROOT/bin/fm-spawn.sh" lane "$project" codex 2>&1) || status=$?
+  [ "$status" -ne 0 ] || fail "retained metadata admitted a same-id spawn after its endpoint disappeared"
+  assert_contains "$out" 'task metadata already exists for lane' "retained metadata refusal was not explicit"
+  [ ! -s "$log" ] || fail "retained metadata retry inspected or created a backend endpoint"
+  cmp -s "$TMP/existing.meta" "$home/state/lane.meta" || fail "retained metadata retry changed the recovery record"
+  cmp -s "$TMP/existing.status" "$home/state/lane.status" || fail "retained metadata retry changed existing status"
+  pass "duplicate spawn preserves live and endpoint-free retained task records"
 }
 
 test_spawn_rejects_host_as_target_and_cleans_failed_transition() {
@@ -511,11 +524,28 @@ test_all_harnesses_add_one_task_safeguard() {
 }
 
 test_mutators_require_host_cwd() {
-  local host="$TMP/mutator-host" other="$TMP/mutator-other" home="$TMP/mutator-home" fake_root="$TMP/mutator-root" guard_marker="$TMP/mutator-guard" out status=0
+  local host="$TMP/mutator-host" other="$TMP/mutator-other" home="$TMP/mutator-home" fake_root="$TMP/mutator-root" guard_marker="$TMP/mutator-guard" fb log current out status=0
   make_host "$host"
   mkdir -p "$other" "$home/state" "$fake_root/bin"
   printf 'window=fake:fm-lane\nworktree=/tmp/target\nhost_root=%s\nproject=/tmp/project\nkind=ship\n' "$host" > "$home/state/lane.meta"
   printf 'window=fake:fm-scout\nworktree=/tmp/scout\nhost_root=%s\nproject=/tmp/project\nkind=scout\n' "$host" > "$home/state/scout.meta"
+  fb=$(make_fakebin "$TMP/fake-mutator-read")
+  log="$TMP/mutator-read.log"
+  current="$TMP/mutator-read.current"
+  : > "$log"
+  printf '%s\n' "$host" > "$current"
+  out=$(cd "$other" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    FM_TMUX_LOG="$log" FM_CURRENT_PATH="$current" "$ROOT/bin/fm-peek.sh" lane 2>&1) || status=$?
+  expect_code 2 "$status" "fm-peek must reject a host cwd mismatch"
+  assert_contains "$out" 'requires the recorded host root cwd' "fm-peek host mismatch was not explicit"
+  [ ! -s "$log" ] || fail "fm-peek inspected the endpoint before host validation"
+  status=0
+  out=$(cd "$other" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    FM_TMUX_LOG="$log" FM_CURRENT_PATH="$current" "$ROOT/bin/fm-crew-state.sh" lane 2>&1) || status=$?
+  expect_code 2 "$status" "fm-crew-state must reject a host cwd mismatch"
+  assert_contains "$out" 'requires the recorded host root cwd' "fm-crew-state host mismatch was not explicit"
+  [ ! -s "$log" ] || fail "fm-crew-state inspected the endpoint before host validation"
+  status=0
   out=$(cd "$other" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-send.sh" lane hello 2>&1) || status=$?
   expect_code 2 "$status" "fm-send must reject a host cwd mismatch"
   assert_contains "$out" 'requires the recorded host root cwd' "fm-send host mismatch was not explicit"
@@ -621,13 +651,14 @@ test_secondmate_actions_keep_supervisor_host_authority() {
 }
 
 test_spawn_rollback_is_transactional() {
-  local host="$TMP/rollback-host" home="$TMP/rollback-home" project="$TMP/rollback-target" wt="$TMP/rollback-wt" stuck_wt="$TMP/rollback-stuck-wt" uncertain_wt="$TMP/rollback-uncertain-wt" unset_wt="$TMP/rollback-unset-wt" fb log current tree_log out status=0
+  local host="$TMP/rollback-host" home="$TMP/rollback-home" project="$TMP/rollback-target" wt="$TMP/rollback-wt" stuck_wt="$TMP/rollback-stuck-wt" uncertain_wt="$TMP/rollback-uncertain-wt" retained_wt="$TMP/rollback-retained-wt" unset_wt="$TMP/rollback-unset-wt" fb log current tree_log out status=0
   make_host "$host"; mkdir -p "$home/data" "$home/state" "$home/config"; fm_git_init_commit "$project"
   git -C "$project" worktree add -q --detach "$wt"
   git -C "$project" worktree add -q --detach "$stuck_wt"
   git -C "$project" worktree add -q --detach "$uncertain_wt"
+  git -C "$project" worktree add -q --detach "$retained_wt"
   git -C "$project" worktree add -q --detach "$unset_wt"
-  for id in rollback-clean rollback-stuck rollback-uncertain; do
+  for id in rollback-clean rollback-stuck rollback-uncertain rollback-retained; do
     (cd "$host" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
       "$ROOT/bin/fm-brief.sh" "$id" target >/dev/null 2>&1)
   done
@@ -673,6 +704,28 @@ test_spawn_rollback_is_transactional() {
   rm -rf "/tmp/fm-rollback-uncertain"
   rm -f "$home/state/rollback-uncertain.meta" "$home/state/rollback-uncertain.pi-ext.ts" "$current.endpoint"
 
+  : > "$log"; : > "$tree_log"; printf '%s\n' "$project" > "$current"; status=0
+  out=$(cd "$host" && PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    FM_FAIL_LAUNCH_SEND=1 FM_REFUSE_RETURN=1 FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 FM_TMUX_LOG="$log" \
+    FM_LAUNCH_FILE="$TMP/rollback-retained.launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH="$retained_wt" FM_HOST_PATH="$host" \
+    FM_TREEHOUSE_LOG="$tree_log" TMUX=fake "$ROOT/bin/fm-spawn.sh" rollback-retained "$project" pi 2>&1) || status=$?
+  [ "$status" -ne 0 ] || fail "injected worktree return failure unexpectedly succeeded"
+  assert_present "$home/state/rollback-retained.meta" "worktree return failure lost recovery metadata"
+  assert_absent "$current.endpoint" "worktree return failure left the stopped endpoint alive"
+  cp "$home/state/rollback-retained.meta" "$TMP/rollback-retained.meta"
+  : > "$log"; : > "$tree_log"; printf '%s\n' "$project" > "$current"; status=0
+  out=$(cd "$host" && PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$TMP/rollback-retained-retry.launch" FM_CURRENT_PATH="$current" \
+    FM_TARGET_PATH="$wt" FM_HOST_PATH="$host" FM_TREEHOUSE_LOG="$tree_log" TMUX=fake \
+    "$ROOT/bin/fm-spawn.sh" rollback-retained "$project" pi 2>&1) || status=$?
+  [ "$status" -ne 0 ] || fail "same-id retry overwrote retained cleanup metadata"
+  assert_contains "$out" 'task metadata already exists for rollback-retained' "retained cleanup retry refusal was not explicit"
+  [ ! -s "$log" ] || fail "retained cleanup retry inspected or created an endpoint"
+  [ ! -s "$tree_log" ] || fail "retained cleanup retry allocated or returned a worktree"
+  cmp -s "$TMP/rollback-retained.meta" "$home/state/rollback-retained.meta" || fail "retained cleanup retry changed the recovery record"
+  rm -rf "/tmp/fm-rollback-retained"
+  rm -f "$home/state/rollback-retained.meta" "$home/state/rollback-retained.pi-ext.ts"
+
   env -u FM_HOST_ROOT FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
     "$ROOT/bin/fm-brief.sh" rollback-unset target >/dev/null 2>&1
   : > "$log"; : > "$tree_log"; printf '%s\n' "$project" > "$current"; status=0

From 826c93a97b4208f67d0f23c2ae49c532bb4b1c75 Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Mon, 27 Jul 2026 09:44:20 +0300
Subject: [PATCH 12/39] fix(host-root): preserve recovery and bind tmux aliases

---
 bin/backends/tmux.sh                 | 18 +++++++
 bin/fm-backend.sh                    | 78 +++++++++++++++++++---------
 bin/fm-bootstrap.sh                  |  3 +-
 bin/fm-peek.sh                       |  2 +-
 bin/fm-send.sh                       |  4 +-
 bin/fm-spawn.sh                      | 14 ++++-
 tests/fm-host-root-mode.test.sh      | 22 +++++++-
 tests/fm-secondmate-liveness.test.sh | 18 +++++++
 8 files changed, 128 insertions(+), 31 deletions(-)

diff --git a/bin/backends/tmux.sh b/bin/backends/tmux.sh
index 23ed5ca86b..df7dab7166 100644
--- a/bin/backends/tmux.sh
+++ b/bin/backends/tmux.sh
@@ -117,6 +117,24 @@ fm_backend_tmux_send_literal() {  # <target> <text>
   tmux send-keys -t "$1" -l "$2"
 }
 
+# Resolve any exact tmux handle accepted for a recorded task window to its
+# server-global window id. Inventory matching avoids display-message's dangerous
+# fallback to the active window when a named target has disappeared.
+fm_backend_tmux_canonical_window() {  # <target> -> @<window-id>
+  local target=$1 out pane_id window_id named named_pane indexed
+  out=$(tmux list-panes -a -F '#{pane_id}|#{window_id}|#{session_name}:#{window_name}|#{session_name}:#{window_name}.#{pane_index}|#{session_name}:#{window_index}.#{pane_index}') \
+    || return 1
+  while IFS='|' read -r pane_id window_id named named_pane indexed; do
+    case "$target" in
+      "$pane_id"|"$window_id"|"$named"|"$named_pane"|"$indexed")
+        printf '%s' "$window_id"
+        return 0
+        ;;
+    esac
+  done <<< "$out"
+  return 1
+}
+
 # Tri-state endpoint probe for destructive cleanup. Enumerate exact handles:
 # `display-message -t` silently falls back to the active window when a named
 # target disappeared, which would report a killed worker as still present.
diff --git a/bin/fm-backend.sh b/bin/fm-backend.sh
index 5a77ce41d1..70799ff2d8 100644
--- a/bin/fm-backend.sh
+++ b/bin/fm-backend.sh
@@ -544,6 +544,45 @@ fm_backend_meta_for_window() {  # <target> <state-dir>
   return 1
 }
 
+# Match an exact recorded target first, then recognize equivalent explicit tmux
+# handles by their inventory-backed window id. Bare names remain on the legacy
+# resolver because they can be ambiguous across sessions.
+fm_backend_meta_for_target() {  # <target> <state-dir>
+  local target=$1 state=$2 meta canonical recorded recorded_canonical host_meta=0
+  meta=$(fm_backend_meta_for_window "$target" "$state" 2>/dev/null || true)
+  if [ -n "$meta" ]; then
+    printf '%s' "$meta"
+    return 0
+  fi
+  case "$target" in
+    *:*:*) return 1 ;; # Herdr uses session:workspace:pane and is never a tmux alias.
+    *:*|%*|@*) ;;
+    *) return 1 ;;
+  esac
+  for meta in "$state"/*.meta; do
+    [ -e "$meta" ] || continue
+    [ "$(fm_backend_of_meta "$meta")" = tmux ] || continue
+    grep -q '^host_root=.' "$meta" 2>/dev/null || continue
+    host_meta=1
+    break
+  done
+  [ "$host_meta" = 1 ] || return 1
+  fm_backend_source tmux >/dev/null 2>&1 || return 1
+  canonical=$(fm_backend_tmux_canonical_window "$target" 2>/dev/null) || return 1
+  for meta in "$state"/*.meta; do
+    [ -e "$meta" ] || continue
+    [ "$(fm_backend_of_meta "$meta")" = tmux ] || continue
+    grep -q '^host_root=.' "$meta" 2>/dev/null || continue
+    recorded=$(fm_backend_target_of_meta "$meta")
+    [ -n "$recorded" ] || continue
+    recorded_canonical=$(fm_backend_tmux_canonical_window "$recorded" 2>/dev/null) || continue
+    [ "$recorded_canonical" = "$canonical" ] || continue
+    printf '%s' "$meta"
+    return 0
+  done
+  return 1
+}
+
 fm_backend_task_id_for_selector() {  # <raw-target> <state-dir>
   local raw=$1 state=$2 id
   case "$raw" in
@@ -635,30 +674,24 @@ fm_backend_source() {  # <name>
 }
 
 # fm_backend_resolve_selector: resolve a raw fm-send.sh/fm-peek.sh style
-# selector to a live session-provider target. Four forms, in order:
-#   target with ":"   used as-is (the escape hatch for a window/pane outside
-#                      this firstmate home) - backend-independent, a literal string.
+# selector to a live session-provider target. Five forms, in order:
 #   exact task id      routed through <state-dir>/<id>.meta's backend target
-#                      (`window=` normally, `terminal=` for Orca) -
-#                      backend-independent, a stored value, NOT re-verified
-#                      against a live backend inventory (matches today's
-#                      behavior: tmux window names can be trusted from meta
-#                      without a live re-check).
+#                      (`window=` normally, `terminal=` for Orca).
 #   "fm-<id>"          legacy task window label fallback routed through
 #                      <state-dir>/<id>.meta when no exact
 #                      <state-dir>/fm-<id>.meta exists.
-#   anything else      first matched against recorded `window=`/`terminal=`
-#                      metadata, then treated as an ad hoc bare window name and
-#                      resolved by searching the legacy tmux live inventory.
+#   recorded target    exact target or equivalent explicit tmux handle routed
+#                      through the owning metadata before external fallback.
+#   target with ":"   otherwise used as-is as the escape hatch for an endpoint
+#                      outside this firstmate home.
+#   anything else      treated as an ad hoc bare window name and resolved by
+#                      searching the legacy tmux live inventory.
 fm_backend_resolve_selector() {  # <raw-target> <state-dir>
   local raw=$1 state=$2 meta window
-  case "$raw" in
-    *:*)
-      printf '%s' "$raw"
-      return 0
-      ;;
-  esac
   meta=$(fm_backend_meta_for_selector "$raw" "$state" 2>/dev/null || true)
+  if [ -z "$meta" ]; then
+    meta=$(fm_backend_meta_for_target "$raw" "$state" 2>/dev/null || true)
+  fi
   if [ -n "$meta" ]; then
     window=$(fm_backend_target_of_meta "$meta")
     [ -n "$window" ] || { echo "error: no backend target recorded in $meta" >&2; return 1; }
@@ -666,18 +699,15 @@ fm_backend_resolve_selector() {  # <raw-target> <state-dir>
     return 0
   fi
   case "$raw" in
+    *:*)
+      printf '%s' "$raw"
+      return 0
+      ;;
     fm-*)
       echo "error: no metadata for $raw in $state; pass session:window to target a window outside this firstmate home" >&2
       return 1
       ;;
     *)
-      meta=$(fm_backend_meta_for_window "$raw" "$state" 2>/dev/null || true)
-      if [ -n "$meta" ]; then
-        window=$(fm_backend_target_of_meta "$meta")
-        [ -n "$window" ] || { echo "error: no backend target recorded in $meta" >&2; return 1; }
-        printf '%s' "$window"
-        return 0
-      fi
       fm_backend_source tmux || return 1
       fm_backend_tmux_resolve_bare_selector "$raw"
       ;;
diff --git a/bin/fm-bootstrap.sh b/bin/fm-bootstrap.sh
index fef86ba383..e03b1afc73 100755
--- a/bin/fm-bootstrap.sh
+++ b/bin/fm-bootstrap.sh
@@ -455,7 +455,8 @@ secondmate_liveness_sweep() {
         else
           cause="recorded endpoint confidently missing"
         fi
-        if out=$(FM_SPAWN_NO_GUARD=1 "$FM_ROOT/bin/fm-spawn.sh" "$id" --secondmate 2>&1); then
+        if out=$(FM_SPAWN_NO_GUARD=1 FM_SPAWN_SECOND_MATE_RECOVERY=1 \
+          "$FM_ROOT/bin/fm-spawn.sh" "$id" --secondmate 2>&1); then
           SECONDMATE_RESPAWNED_IDS="$SECONDMATE_RESPAWNED_IDS $id"
           if [ "${FM_BOOTSTRAP_VERBOSE_FACTS:-0}" = 1 ]; then
             echo "BOOTSTRAP_INFO: secondmate $id relaunched after $cause (backend=$backend)"
diff --git a/bin/fm-peek.sh b/bin/fm-peek.sh
index 845e44d5ab..2fed803394 100755
--- a/bin/fm-peek.sh
+++ b/bin/fm-peek.sh
@@ -18,7 +18,7 @@ STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 RAW_TARGET=$1
 TASK_META=$(fm_backend_meta_for_selector "$RAW_TARGET" "$STATE" 2>/dev/null || true)
 if [ -z "$TASK_META" ]; then
-  TASK_META=$(fm_backend_meta_for_window "$RAW_TARGET" "$STATE" 2>/dev/null || true)
+  TASK_META=$(fm_backend_meta_for_target "$RAW_TARGET" "$STATE" 2>/dev/null || true)
 fi
 if [ -n "$TASK_META" ]; then
   fm_host_root_assert_task_cwd "$FM_ROOT" "$TASK_META" || exit $?
diff --git a/bin/fm-send.sh b/bin/fm-send.sh
index ca10b7a2d7..95a0e1726b 100755
--- a/bin/fm-send.sh
+++ b/bin/fm-send.sh
@@ -159,7 +159,7 @@ fm_send_resolve_target() {  # <raw-target>
     return 1
   fi
 
-  meta=$(fm_backend_meta_for_window "$raw" "$STATE" 2>/dev/null || true)
+  meta=$(fm_backend_meta_for_target "$raw" "$STATE" 2>/dev/null || true)
   if [ -n "$meta" ]; then
     if [ "$meta" != "${BOUND_META:-}" ]; then
       fm_host_root_assert_task_cwd "$FM_ROOT" "$meta" || return $?
@@ -213,7 +213,7 @@ if [ -n "$CANDIDATE_META" ]; then
   fm_host_root_assert_task_cwd "$FM_ROOT" "$CANDIDATE_META" || exit $?
   BOUND_META=$CANDIDATE_META
 fi
-fm_send_resolve_target "$RAW_TARGET" || exit 1
+fm_send_resolve_target "$RAW_TARGET" || exit $?
 if [ -z "$TARGET_META" ]; then
   fm_host_root_assert_session_cwd "$FM_ROOT" || exit $?
 fi
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index a0bca54967..736926478b 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -85,6 +85,9 @@
 #   provisioned firstmate home; the default is kind=ship.
 #   Before a secondmate launch, the home is locally fast-forwarded to the primary
 #   default-branch commit when safe; skipped syncs warn and launch unchanged.
+#   FM_SPAWN_SECOND_MATE_RECOVERY=1 is reserved for the session-start liveness
+#   sweep after it proves a recorded secondmate dead or missing; only that path
+#   may replace retained kind=secondmate metadata during a relaunch.
 #   Ship/scout spawns refuse to launch unless the resolved task path is a real
 #   git worktree root distinct from the primary project checkout. With optional
 #   FM_HOST_ROOT set, validation happens before the guard or endpoint mutation;
@@ -558,8 +561,15 @@ if ! fm_lock_try_acquire "$SPAWN_TASK_LOCK"; then
 fi
 SPAWN_TASK_LOCK_HELD=1
 if [ -e "$STATE/$ID.meta" ] || [ -L "$STATE/$ID.meta" ]; then
-  echo "error: task metadata already exists for $ID; reconcile or tear down the retained task before spawning" >&2
-  exit 1
+  if [ "${FM_SPAWN_SECOND_MATE_RECOVERY:-0}" = 1 ] \
+    && [ "$KIND" = secondmate ] \
+    && [ -f "$STATE/$ID.meta" ] \
+    && grep -qx 'kind=secondmate' "$STATE/$ID.meta"; then
+    : # The liveness sweep already proved this exact recorded secondmate recoverable.
+  else
+    echo "error: task metadata already exists for $ID; reconcile or tear down the retained task before spawning" >&2
+    exit 1
+  fi
 fi
 PROJ=
 ARG3=
diff --git a/tests/fm-host-root-mode.test.sh b/tests/fm-host-root-mode.test.sh
index 53d2f4a054..c5062bb7e6 100644
--- a/tests/fm-host-root-mode.test.sh
+++ b/tests/fm-host-root-mode.test.sh
@@ -231,7 +231,8 @@ case "${1:-}" in
     fi
     ;;
   list-windows) [ -z "${FM_EXISTING_WINDOW:-}" ] || printf '%s\n' "$FM_EXISTING_WINDOW" ;;
-  list-panes) [ ! -f "$endpoint" ] || printf '%%1|@1|%s|test-session:1.0\n' "${FM_ENDPOINT_TARGET:-test-session:fm-rollback-stuck}" ;;
+  list-panes) [ ! -f "$endpoint" ] || printf '%%1|@1|%s|%s\n' \
+    "${FM_ENDPOINT_TARGET:-test-session:fm-rollback-stuck}" "${FM_ENDPOINT_ALIAS:-test-session:1.0}" ;;
   has-session|new-session|set-window-option) ;;
   new-window) : > "$endpoint"; printf '%%1\n' ;;
   kill-window)
@@ -838,6 +839,25 @@ test_task_actions_use_recorded_host_root() {
   expect_code 2 "$status" "send must reject an ambient host that differs from task ownership"
   assert_contains "$out" 'does not match task metadata host_root' "send did not identify recorded host ownership"
   assert_no_grep 'send-keys' "$log" "send touched the endpoint before recorded-host validation"
+
+  : > "$log"; status=0
+  out=$(cd "$wrong" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$wrong" \
+    FM_TMUX_LOG="$log" FM_ENDPOINT_TARGET=test-session:fm-lane FM_ENDPOINT_ALIAS=test-session:fm-lane.0 \
+    FM_LAUNCH_FILE="$TMP/unused.launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH=/tmp/target FM_HOST_PATH="$host" \
+    "$ROOT/bin/fm-peek.sh" test-session:fm-lane.0 2>&1) || status=$?
+  expect_code 2 "$status" "peek must bind an equivalent tmux pane alias to recorded task ownership"
+  assert_contains "$out" 'does not match task metadata host_root' "peek alias did not identify recorded host ownership"
+  assert_no_grep 'capture-pane' "$log" "peek alias captured the endpoint before recorded-host validation"
+
+  : > "$log"; status=0
+  out=$(cd "$wrong" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$wrong" \
+    FM_TMUX_LOG="$log" FM_ENDPOINT_TARGET=test-session:fm-lane FM_ENDPOINT_ALIAS=test-session:fm-lane.0 \
+    FM_LAUNCH_FILE="$TMP/unused.launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH=/tmp/target FM_HOST_PATH="$host" \
+    "$ROOT/bin/fm-send.sh" test-session:fm-lane.0 hello 2>&1) || status=$?
+  expect_code 2 "$status" "send must bind an equivalent tmux pane alias to recorded task ownership"
+  assert_contains "$out" 'does not match task metadata host_root' "send alias did not identify recorded host ownership"
+  assert_no_grep 'send-keys' "$log" "send alias touched the endpoint before recorded-host validation"
+
   status=0
   out=$(cd "$wrong" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$wrong" \
     FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$TMP/unused.launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH=/tmp/target FM_HOST_PATH="$host" \
diff --git a/tests/fm-secondmate-liveness.test.sh b/tests/fm-secondmate-liveness.test.sh
index ed35663896..60efe23344 100755
--- a/tests/fm-secondmate-liveness.test.sh
+++ b/tests/fm-secondmate-liveness.test.sh
@@ -356,6 +356,23 @@ test_sweep_respawns_confirmed_dead_secondmate() {
   pass "sweep: a confirmed-dead secondmate endpoint is killed and respawned"
 }
 
+test_direct_secondmate_respawn_cannot_bypass_retained_metadata() {
+  local w fb tmuxfb log out status=0
+  w=$(new_world direct-duplicate)
+  add_sm_home "$w" sm1 firstmate:fm-sm1
+  fb=$(make_toolchain "$w"); tmuxfb=$(make_liveness_tmux "$w")
+  log="$w/calls.log"; : > "$log"
+
+  out=$(PATH="$tmuxfb:$fb:$BASE_PATH" FM_HOME="$w/home" FM_SPAWN_NO_GUARD=1 \
+    "$ROOT/bin/fm-spawn.sh" sm1 --secondmate 2>&1) || status=$?
+
+  [ "$status" -ne 0 ] || fail "direct same-id secondmate respawn bypassed retained metadata"
+  assert_contains "$out" "task metadata already exists for sm1" \
+    "direct secondmate duplicate refusal was not explicit"
+  [ ! -s "$log" ] || fail "direct secondmate duplicate inspected or created an endpoint: $(cat "$log")"
+  pass "sweep: only recovery-classified secondmate relaunches may replace retained metadata"
+}
+
 test_sweep_leaves_alive_secondmate_untouched() {
   local w fb tmuxfb log out
   w=$(new_world sweep-alive)
@@ -531,6 +548,7 @@ test_tmux_agent_state_rejects_malformed_targets_before_probe
 test_herdr_agent_state_preserves_husk_classifier
 test_agent_state_dispatcher_and_compatibility
 test_sweep_respawns_confirmed_dead_secondmate
+test_direct_secondmate_respawn_cannot_bypass_retained_metadata
 test_sweep_leaves_alive_secondmate_untouched
 test_sweep_respawns_authoritatively_missing_pi_secondmate
 test_sweep_respawns_authoritatively_missing_pi_signed_secondmate

From 98a51e3dda8718e5a17fd0ba0bbe32675cbfcfe5 Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Mon, 27 Jul 2026 10:03:16 +0300
Subject: [PATCH 13/39] no-mistakes(review): Captain: protect host teardown and
 preserve Herdr recovery

---
 bin/fm-spawn.sh                 |  2 +-
 bin/fm-teardown.sh              | 12 +++++
 tests/fm-host-root-mode.test.sh | 82 +++++++++++++++++++++++++++++++++
 3 files changed, 95 insertions(+), 1 deletion(-)

diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 736926478b..ddf5a1d4af 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -566,7 +566,7 @@ if [ -e "$STATE/$ID.meta" ] || [ -L "$STATE/$ID.meta" ]; then
     && [ -f "$STATE/$ID.meta" ] \
     && grep -qx 'kind=secondmate' "$STATE/$ID.meta"; then
     : # The liveness sweep already proved this exact recorded secondmate recoverable.
-  else
+  elif [ "$HOST_MODE" -eq 1 ] || [ "$KIND" = secondmate ]; then
     echo "error: task metadata already exists for $ID; reconcile or tear down the retained task before spawning" >&2
     exit 1
   fi
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index 4773b81e43..d2548f1023 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -173,6 +173,18 @@ meta_value() {
   fm_meta_get "$meta" "$key"
 }
 
+if [ "$TASK_HOST_MODE" -eq 1 ]; then
+  RECORDED_HOST_ROOT=$(meta_value "$META" host_root)
+  RECORDED_TARGET_ROOT=$WT
+  if [ -d "$WT" ]; then
+    RECORDED_TARGET_ROOT=$(cd "$WT" 2>/dev/null && pwd -P) || exit 1
+  fi
+  if fm_host_root_paths_overlap "$RECORDED_HOST_ROOT" "$RECORDED_TARGET_ROOT"; then
+    echo "error: recorded host and target roots overlap (host '$RECORDED_HOST_ROOT'; target '$RECORDED_TARGET_ROOT'); refusing teardown and preserving recovery metadata" >&2
+    exit 1
+  fi
+fi
+
 require_orca_worktree_id() {
   local meta=$1 id
   id=$(meta_value "$meta" orca_worktree_id)
diff --git a/tests/fm-host-root-mode.test.sh b/tests/fm-host-root-mode.test.sh
index c5062bb7e6..e96dad39a8 100644
--- a/tests/fm-host-root-mode.test.sh
+++ b/tests/fm-host-root-mode.test.sh
@@ -394,6 +394,52 @@ test_duplicate_spawn_preserves_existing_task() {
   pass "duplicate spawn preserves live and endpoint-free retained task records"
 }
 
+test_unset_herdr_retry_reaches_existing_identity_checks() {
+  local home="$TMP/unset-herdr-home" project="$TMP/unset-herdr-project" fb out status=0
+  fm_git_init_commit "$project"
+  mkdir -p "$home/data/herdr-retry" "$home/state" "$home/config"
+  printf 'Retry existing Herdr task.\n' > "$home/data/herdr-retry/brief.md"
+  : > "$home/config/herdr-presentation-spaces"
+  {
+    printf 'window=default:old-pane\n'
+    printf 'worktree=/tmp/old-herdr-worktree\n'
+    printf 'project=%s\n' "$project"
+    printf 'harness=codex\n'
+    printf 'kind=ship\n'
+    printf 'mode=no-mistakes\n'
+    printf 'backend=herdr\n'
+    printf 'herdr_session=default\n'
+    printf 'herdr_workspace_id=old-workspace\n'
+    printf 'herdr_tab_id=old-tab\n'
+    printf 'herdr_pane_id=old-pane\n'
+  } > "$home/state/herdr-retry.meta"
+  printf 'journal\n' > "$home/state/herdr-retry.herdr-presentation"
+  cp "$home/state/herdr-retry.meta" "$TMP/unset-herdr.meta"
+  fb=$(fm_fakebin "$TMP/fake-unset-herdr")
+  cat > "$fb/herdr" <<'SH'
+#!/usr/bin/env bash
+case " $* " in
+  *' status --json '*) printf '%s\n' '{"server":{"running":true}}' ;;
+  *' session list --json '*) printf '%s\n' '{"sessions":[{"name":"default","running":true,"socket_path":"/tmp/fake-herdr.sock"}]}' ;;
+  *' pane get old-pane '*) printf '%s\n' '{"result":{"pane":{"pane_id":"old-pane"}}}' ;;
+  *' agent get old-pane '*) printf '%s\n' '{"result":{"agent":{"agent_status":"idle"}}}' ;;
+  *) exit 1 ;;
+esac
+SH
+  chmod +x "$fb/herdr"
+
+  out=$(env -u FM_HOST_ROOT PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
+    "$ROOT/bin/fm-spawn.sh" herdr-retry "$project" codex --backend herdr 2>&1) || status=$?
+  [ "$status" -ne 0 ] || fail "unset-mode Herdr retry bypassed its live-endpoint refusal"
+  assert_contains "$out" 'existing herdr endpoint for herdr-retry is live' \
+    "unset-mode retry did not reach the established Herdr identity classifier"
+  assert_not_contains "$out" 'task metadata already exists for herdr-retry' \
+    "host-root metadata protection leaked into unset-mode Herdr recovery"
+  cmp -s "$TMP/unset-herdr.meta" "$home/state/herdr-retry.meta" \
+    || fail "unset-mode Herdr identity refusal changed existing metadata"
+  pass "unset-mode Herdr retries retain their established same-identity recovery checks"
+}
+
 test_spawn_rejects_host_as_target_and_cleans_failed_transition() {
   local host="$TMP/refusal-host" home="$TMP/refusal-home" project="$TMP/refusal-target" wt="$TMP/refusal-wt" fb log current tree_log out status=0
   make_host "$host"
@@ -826,6 +872,40 @@ test_host_teardown_requires_confirmed_stop() {
   pass "host-root teardown confirms endpoint absence before worktree cleanup"
 }
 
+test_host_teardown_refuses_recorded_overlap_before_mutation() {
+  local host="$TMP/overlap-teardown-host" home="$TMP/overlap-teardown-home" project="$TMP/overlap-teardown-project" fb log current tree_log out status=0 branch
+  make_host "$host"
+  fm_git_init_commit "$project"
+  mkdir -p "$home/state" "$home/config"
+  printf 'window=test-session:fm-overlap-teardown\nworktree=%s\nhost_root=%s\nproject=%s\nkind=ship\nmode=local-only\n' \
+    "$host" "$host" "$project" > "$home/state/overlap-teardown.meta"
+  cp "$home/state/overlap-teardown.meta" "$TMP/overlap-teardown.meta"
+  touch "$home/state/.last-watcher-beat"
+  fb=$(make_fakebin "$TMP/fake-overlap-teardown")
+  log="$TMP/overlap-teardown.log"
+  current="$TMP/overlap-teardown.current"
+  tree_log="$TMP/overlap-teardown-treehouse.log"
+  printf '%s\n' "$host" > "$current"
+  : > "$current.endpoint"
+  : > "$log"
+  : > "$tree_log"
+  branch=$(git -C "$host" symbolic-ref --short HEAD)
+
+  out=$(cd "$host" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$TMP/unused.launch" FM_CURRENT_PATH="$current" \
+    FM_TARGET_PATH="$host" FM_HOST_PATH="$host" FM_TREEHOUSE_LOG="$tree_log" TMUX=fake \
+    "$ROOT/bin/fm-teardown.sh" overlap-teardown --force 2>&1) || status=$?
+  [ "$status" -ne 0 ] || fail "teardown accepted recorded overlapping host and target roots"
+  assert_contains "$out" 'recorded host and target roots overlap' "overlap refusal was not explicit"
+  assert_present "$current.endpoint" "overlap refusal stopped the recorded endpoint"
+  [ ! -s "$log" ] || fail "overlap refusal touched the recorded endpoint"
+  [ ! -s "$tree_log" ] || fail "overlap refusal invoked treehouse"
+  [ "$(git -C "$host" symbolic-ref --short HEAD)" = "$branch" ] || fail "overlap refusal changed the host Git branch"
+  cmp -s "$TMP/overlap-teardown.meta" "$home/state/overlap-teardown.meta" \
+    || fail "overlap refusal changed recovery metadata"
+  pass "host-root teardown preserves recorded overlaps before endpoint or Git mutation"
+}
+
 test_task_actions_use_recorded_host_root() {
   local host="$TMP/recorded-host" wrong="$TMP/wrong-host" home="$TMP/recorded-home" fb log current out status=0
   make_host "$host"; make_host "$wrong"; mkdir -p "$home/state" "$home/config"
@@ -908,6 +988,7 @@ test_host_local_only_rejected_before_mutation
 test_host_scout_records_logical_project_mode
 test_spawn_separates_roots
 test_duplicate_spawn_preserves_existing_task
+test_unset_herdr_retry_reaches_existing_identity_checks
 test_spawn_rejects_host_as_target_and_cleans_failed_transition
 test_orca_active_cwd_probe
 test_all_harnesses_add_one_task_safeguard
@@ -916,5 +997,6 @@ test_secondmate_actions_keep_supervisor_host_authority
 test_spawn_rollback_is_transactional
 test_decision_actions_use_durable_host_owner
 test_host_teardown_requires_confirmed_stop
+test_host_teardown_refuses_recorded_overlap_before_mutation
 test_task_actions_use_recorded_host_root
 test_spawn_rejects_old_brief_and_secondmate_clears_roots

From 78605975032b9515f6264a4280f91abaa9c630f8 Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Mon, 27 Jul 2026 10:13:22 +0300
Subject: [PATCH 14/39] no-mistakes(review): Captain: preserve retained host
 metadata across unset retries

---
 bin/fm-spawn.sh                 |  9 +++++++--
 tests/fm-host-root-mode.test.sh | 11 +++++++++++
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index ddf5a1d4af..83d5908ac9 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -561,12 +561,17 @@ if ! fm_lock_try_acquire "$SPAWN_TASK_LOCK"; then
 fi
 SPAWN_TASK_LOCK_HELD=1
 if [ -e "$STATE/$ID.meta" ] || [ -L "$STATE/$ID.meta" ]; then
+  RETAINED_HOST_MODE=0
+  if [ -f "$STATE/$ID.meta" ] && grep -q '^host_root=.' "$STATE/$ID.meta"; then
+    RETAINED_HOST_MODE=1
+  fi
   if [ "${FM_SPAWN_SECOND_MATE_RECOVERY:-0}" = 1 ] \
     && [ "$KIND" = secondmate ] \
     && [ -f "$STATE/$ID.meta" ] \
-    && grep -qx 'kind=secondmate' "$STATE/$ID.meta"; then
+    && grep -qx 'kind=secondmate' "$STATE/$ID.meta" \
+    && [ "$RETAINED_HOST_MODE" -eq 0 ]; then
     : # The liveness sweep already proved this exact recorded secondmate recoverable.
-  elif [ "$HOST_MODE" -eq 1 ] || [ "$KIND" = secondmate ]; then
+  elif [ "$HOST_MODE" -eq 1 ] || [ "$KIND" = secondmate ] || [ "$RETAINED_HOST_MODE" -eq 1 ]; then
     echo "error: task metadata already exists for $ID; reconcile or tear down the retained task before spawning" >&2
     exit 1
   fi
diff --git a/tests/fm-host-root-mode.test.sh b/tests/fm-host-root-mode.test.sh
index e96dad39a8..0899b1b1ac 100644
--- a/tests/fm-host-root-mode.test.sh
+++ b/tests/fm-host-root-mode.test.sh
@@ -770,6 +770,17 @@ test_spawn_rollback_is_transactional() {
   [ ! -s "$log" ] || fail "retained cleanup retry inspected or created an endpoint"
   [ ! -s "$tree_log" ] || fail "retained cleanup retry allocated or returned a worktree"
   cmp -s "$TMP/rollback-retained.meta" "$home/state/rollback-retained.meta" || fail "retained cleanup retry changed the recovery record"
+
+  : > "$log"; : > "$tree_log"; status=0
+  out=$(cd "$host" && env -u FM_HOST_ROOT PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
+    FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$TMP/rollback-retained-unset-retry.launch" FM_CURRENT_PATH="$current" \
+    FM_TARGET_PATH="$wt" FM_HOST_PATH="$host" FM_TREEHOUSE_LOG="$tree_log" TMUX=fake \
+    "$ROOT/bin/fm-spawn.sh" rollback-retained "$project" pi 2>&1) || status=$?
+  [ "$status" -ne 0 ] || fail "unset retry overwrote retained host cleanup metadata"
+  assert_contains "$out" 'task metadata already exists for rollback-retained' "unset retained-host retry refusal was not explicit"
+  [ ! -s "$log" ] || fail "unset retained-host retry inspected or created an endpoint"
+  [ ! -s "$tree_log" ] || fail "unset retained-host retry allocated or returned a worktree"
+  cmp -s "$TMP/rollback-retained.meta" "$home/state/rollback-retained.meta" || fail "unset retry changed the retained host recovery record"
   rm -rf "/tmp/fm-rollback-retained"
   rm -f "$home/state/rollback-retained.meta" "$home/state/rollback-retained.pi-ext.ts"
 

From 768e4f79cabc3ce168330774da72a9ccd844f40e Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Mon, 27 Jul 2026 10:29:38 +0300
Subject: [PATCH 15/39] test(host-root): run nudge from synthetic root

---
 tests/fm-sessionstart-nudge.test.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/fm-sessionstart-nudge.test.sh b/tests/fm-sessionstart-nudge.test.sh
index c72d7bbd3a..3593d3f4b3 100755
--- a/tests/fm-sessionstart-nudge.test.sh
+++ b/tests/fm-sessionstart-nudge.test.sh
@@ -26,7 +26,7 @@ make_primary() {
 
 run_nudge() {
   local root=$1
-  FM_GATE_REFUSE_BYPASS=0 FM_ROOT_OVERRIDE="$root" FM_HOME="$root" "$NUDGE"
+  (cd "$root" && FM_GATE_REFUSE_BYPASS=0 FM_ROOT_OVERRIDE="$root" FM_HOME="$root" "$NUDGE")
 }
 
 expect_silent_zero() {

From d08a6a42874d8fa72aa31e41b98e79e8df426a5b Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Mon, 27 Jul 2026 10:59:07 +0300
Subject: [PATCH 16/39] no-mistakes(review): Captain, preserve host authority
 across aliases and teardown

---
 bin/backends/tmux.sh            |  8 +--
 bin/fm-decision-hold.sh         | 15 +-----
 bin/fm-host-root-lib.sh         | 22 ++++++++
 bin/fm-teardown.sh              |  1 +
 tests/fm-host-root-mode.test.sh | 89 ++++++++++++++++++++++++++++++---
 tests/fm-teardown.test.sh       |  2 +-
 6 files changed, 112 insertions(+), 25 deletions(-)

diff --git a/bin/backends/tmux.sh b/bin/backends/tmux.sh
index df7dab7166..26f4201cc0 100644
--- a/bin/backends/tmux.sh
+++ b/bin/backends/tmux.sh
@@ -121,12 +121,12 @@ fm_backend_tmux_send_literal() {  # <target> <text>
 # server-global window id. Inventory matching avoids display-message's dangerous
 # fallback to the active window when a named target has disappeared.
 fm_backend_tmux_canonical_window() {  # <target> -> @<window-id>
-  local target=$1 out pane_id window_id named named_pane indexed
-  out=$(tmux list-panes -a -F '#{pane_id}|#{window_id}|#{session_name}:#{window_name}|#{session_name}:#{window_name}.#{pane_index}|#{session_name}:#{window_index}.#{pane_index}') \
+  local target=$1 out pane_id window_id named named_pane indexed_window indexed_pane
+  out=$(tmux list-panes -a -F '#{pane_id}|#{window_id}|#{session_name}:#{window_name}|#{session_name}:#{window_name}.#{pane_index}|#{session_name}:#{window_index}|#{session_name}:#{window_index}.#{pane_index}') \
     || return 1
-  while IFS='|' read -r pane_id window_id named named_pane indexed; do
+  while IFS='|' read -r pane_id window_id named named_pane indexed_window indexed_pane; do
     case "$target" in
-      "$pane_id"|"$window_id"|"$named"|"$named_pane"|"$indexed")
+      "$pane_id"|"$window_id"|"$named"|"$named_pane"|"$indexed_window"|"$indexed_pane")
         printf '%s' "$window_id"
         return 0
         ;;
diff --git a/bin/fm-decision-hold.sh b/bin/fm-decision-hold.sh
index 7175fb0321..a924ea7ff2 100755
--- a/bin/fm-decision-hold.sh
+++ b/bin/fm-decision-hold.sh
@@ -96,19 +96,6 @@ assert_origin_host() {  # <origin-id>
   fi
 }
 
-record_origin_host() {  # <origin-id> <meta>
-  local origin=$1 meta=$2 recorded owner="$DATA/$1/host-root"
-  recorded=$(meta_value "$meta" host_root)
-  [ -n "$recorded" ] || return 0
-  if [ -e "$owner" ] || [ -L "$owner" ]; then
-    [ -f "$owner" ] && [ ! -L "$owner" ] || fail "origin host owner is not a regular file: $owner"
-    [ "$(cat "$owner")" = "host_root=$recorded" ] || fail "origin host owner does not match task metadata: $owner"
-    return 0
-  fi
-  (umask 077; printf 'host_root=%s\n' "$recorded" > "$owner") \
-    || fail "could not persist origin host owner: $owner"
-}
-
 sha256_text() {  # <text>
   if command -v shasum >/dev/null 2>&1; then
     printf '%s' "$1" | shasum -a 256 | awk '{print $1}'
@@ -349,7 +336,7 @@ $open
 EOF
 
   if [ "$has_meta" = 1 ]; then
-    record_origin_host "$origin" "$meta"
+    fm_host_root_persist_task_owner "$meta" "$DATA/$origin/host-root" || exit $?
   fi
   if [ "$has_meta" = 1 ]; then
     if [ "$(meta_value "$meta" decisions_reviewed)" != 1 ] || [ "$previous" != "$keys" ]; then
diff --git a/bin/fm-host-root-lib.sh b/bin/fm-host-root-lib.sh
index 5973109253..b0e294bdb5 100644
--- a/bin/fm-host-root-lib.sh
+++ b/bin/fm-host-root-lib.sh
@@ -10,6 +10,7 @@
 # fm_host_root_resolve <fm-root>       # prints the physical host root
 # fm_host_root_assert_session_cwd <fm-root>
 # fm_host_root_assert_task_cwd <fm-root> <task-meta>
+# fm_host_root_persist_task_owner <task-meta> <owner-file>
 # fm_host_root_paths_overlap <physical-host-root> <physical-target-root>
 # fm_host_root_command <fm-root> <repo-relative-command>
 
@@ -101,6 +102,27 @@ fm_host_root_assert_task_cwd() {
   }
 }
 
+fm_host_root_persist_task_owner() {
+  local meta=$1 owner=$2 recorded
+  recorded=$(sed -n 's/^host_root=//p' "$meta" 2>/dev/null | tail -1)
+  [ -n "$recorded" ] || return 0
+  if [ -e "$owner" ] || [ -L "$owner" ]; then
+    [ -f "$owner" ] && [ ! -L "$owner" ] || {
+      echo "error: host owner is not a regular file: $owner" >&2
+      return 2
+    }
+    [ "$(cat "$owner")" = "host_root=$recorded" ] || {
+      echo "error: host owner does not match task metadata: $owner" >&2
+      return 2
+    }
+    return 0
+  fi
+  (umask 077; printf 'host_root=%s\n' "$recorded" > "$owner") || {
+    echo "error: could not persist host owner: $owner" >&2
+    return 2
+  }
+}
+
 fm_host_root_paths_overlap() {
   local host=$1 target=$2
   [ "$host" = "$target" ] && return 0
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index d2548f1023..7eb7ceb7a2 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -183,6 +183,7 @@ if [ "$TASK_HOST_MODE" -eq 1 ]; then
     echo "error: recorded host and target roots overlap (host '$RECORDED_HOST_ROOT'; target '$RECORDED_TARGET_ROOT'); refusing teardown and preserving recovery metadata" >&2
     exit 1
   fi
+  fm_host_root_persist_task_owner "$META" "$DATA/$ID/host-root" || exit $?
 fi
 
 require_orca_worktree_id() {
diff --git a/tests/fm-host-root-mode.test.sh b/tests/fm-host-root-mode.test.sh
index 0899b1b1ac..543667a56f 100644
--- a/tests/fm-host-root-mode.test.sh
+++ b/tests/fm-host-root-mode.test.sh
@@ -231,8 +231,24 @@ case "${1:-}" in
     fi
     ;;
   list-windows) [ -z "${FM_EXISTING_WINDOW:-}" ] || printf '%s\n' "$FM_EXISTING_WINDOW" ;;
-  list-panes) [ ! -f "$endpoint" ] || printf '%%1|@1|%s|%s\n' \
-    "${FM_ENDPOINT_TARGET:-test-session:fm-rollback-stuck}" "${FM_ENDPOINT_ALIAS:-test-session:1.0}" ;;
+  list-panes)
+    if [ -f "$endpoint" ]; then
+      case "$*" in
+        *'#{window_name}.#{pane_index}'*)
+          printf '%%1|@1|%s|%s|%s|%s\n' \
+            "${FM_ENDPOINT_TARGET:-test-session:fm-rollback-stuck}" \
+            "${FM_ENDPOINT_ALIAS:-test-session:fm-rollback-stuck.0}" \
+            "${FM_ENDPOINT_INDEX_ALIAS:-test-session:1}" \
+            "${FM_ENDPOINT_INDEX_PANE_ALIAS:-test-session:1.0}"
+          ;;
+        *)
+          printf '%%1|@1|%s|%s\n' \
+            "${FM_ENDPOINT_TARGET:-test-session:fm-rollback-stuck}" \
+            "${FM_ENDPOINT_INDEX_PANE_ALIAS:-test-session:1.0}"
+          ;;
+      esac
+    fi
+    ;;
   has-session|new-session|set-window-option) ;;
   new-window) : > "$endpoint"; printf '%%1\n' ;;
   kill-window)
@@ -802,14 +818,15 @@ test_spawn_rollback_is_transactional() {
 }
 
 test_decision_actions_use_durable_host_owner() {
-  local host="$TMP/decision-host" home="$TMP/decision-home" id=decision-scout fb owner out status=0
+  local host="$TMP/decision-host" wrong="$TMP/decision-wrong" home="$TMP/decision-home" id=decision-scout action action_id fb owner out status=0 current log tree_log
   make_host "$host"
+  make_host "$wrong"
   mkdir -p "$home/data/$id" "$home/state" "$home/config"
   printf '# Decision report\n' > "$home/data/$id/report.md"
   printf 'done: report complete\n' > "$home/state/$id.status"
   printf 'window=fake:fm-%s\nworktree=/tmp/decision-target\nhost_root=%s\nproject=/tmp/project\nkind=scout\n' \
     "$id" "$host" > "$home/state/$id.meta"
-  fb=$(fm_fakebin "$TMP/fake-decision-owner")
+  fb=$(make_fakebin "$TMP/fake-decision-owner")
   cat > "$fb/tasks-axi" <<'SH'
 #!/usr/bin/env bash
 case "${1:-} ${2:-}" in
@@ -834,12 +851,54 @@ SH
     "$ROOT/bin/fm-decision-hold.sh" complete "$id" --none 2>&1) || status=$?
   expect_code 1 "$status" "post-metadata completion trusted ambient host authority"
   assert_contains "$out" 'has no durable recorded host owner' "missing durable host owner refusal was not explicit"
-  pass "post-metadata decision actions require durable recorded host ownership"
+
+  current="$TMP/decision.current"
+  log="$TMP/decision.log"
+  tree_log="$TMP/decision-treehouse.log"
+  for action in hold complete resolve; do
+    action_id="decision-post-teardown-$action"
+    mkdir -p "$home/data/$action_id"
+    printf 'window=test-session:fm-%s\nworktree=/tmp/decision-target\nhost_root=%s\nproject=/tmp/project\nkind=ship\nmode=local-only\n' \
+      "$action_id" "$host" > "$home/state/$action_id.meta"
+    printf '%s\n' "$host" > "$current"
+    : > "$current.endpoint"
+    : > "$log"
+    : > "$tree_log"
+    (cd "$host" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+      FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 FM_TMUX_LOG="$log" \
+      FM_ENDPOINT_TARGET="test-session:fm-$action_id" FM_LAUNCH_FILE="$TMP/unused.launch" \
+      FM_CURRENT_PATH="$current" FM_TARGET_PATH=/tmp/decision-target FM_HOST_PATH="$host" \
+      FM_TREEHOUSE_LOG="$tree_log" TMUX=fake "$ROOT/bin/fm-teardown.sh" "$action_id" --force >/dev/null) \
+      || fail "host-root teardown failed before the first post-teardown $action action"
+    assert_absent "$home/state/$action_id.meta" "teardown retained metadata before the $action authority check"
+    assert_grep "host_root=$host" "$home/data/$action_id/host-root" \
+      "teardown did not persist ownership before the $action authority check"
+    status=0
+    case "$action" in
+      hold)
+        out=$(cd "$wrong" && env -u FM_HOST_ROOT PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
+          "$ROOT/bin/fm-decision-hold.sh" hold "$action_id" choice --title Choice --reason required 2>&1) || status=$?
+        ;;
+      complete)
+        out=$(cd "$wrong" && env -u FM_HOST_ROOT PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
+          "$ROOT/bin/fm-decision-hold.sh" complete "$action_id" --none 2>&1) || status=$?
+        ;;
+      resolve)
+        out=$(cd "$wrong" && env -u FM_HOST_ROOT PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
+          "$ROOT/bin/fm-decision-hold.sh" resolve "$action_id" choice \
+            --decision-file "$TMP/missing-decision" --routed-to routed-task 2>&1) || status=$?
+        ;;
+    esac
+    expect_code 2 "$status" "first post-teardown $action action trusted a non-host cwd"
+    assert_contains "$out" 'requires the recorded host root cwd' \
+      "first post-teardown $action action did not enforce durable host ownership"
+  done
+  pass "post-teardown decision actions require durable recorded host ownership"
 }
 
 test_host_teardown_requires_confirmed_stop() {
   local host="$TMP/teardown-host" home="$TMP/teardown-home" project="$TMP/teardown-project" wt="$TMP/teardown-wt" fb log current tree_log out status=0 kill_line verify_line return_line
-  make_host "$host"; mkdir -p "$home/data" "$home/state" "$home/config"; fm_git_init_commit "$project"
+  make_host "$host"; mkdir -p "$home/data/host-teardown" "$home/state" "$home/config"; fm_git_init_commit "$project"
   git -C "$project" worktree add -q --detach "$wt"
   printf 'window=test-session:fm-host-teardown\nworktree=%s\nhost_root=%s\nproject=%s\nkind=ship\nmode=local-only\n' \
     "$wt" "$host" "$project" > "$home/state/host-teardown.meta"
@@ -949,6 +1008,24 @@ test_task_actions_use_recorded_host_root() {
   assert_contains "$out" 'does not match task metadata host_root' "send alias did not identify recorded host ownership"
   assert_no_grep 'send-keys' "$log" "send alias touched the endpoint before recorded-host validation"
 
+  : > "$log"; status=0
+  out=$(cd "$wrong" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$wrong" \
+    FM_TMUX_LOG="$log" FM_ENDPOINT_TARGET=test-session:fm-lane FM_ENDPOINT_INDEX_ALIAS=test-session:1 \
+    FM_LAUNCH_FILE="$TMP/unused.launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH=/tmp/target FM_HOST_PATH="$host" \
+    "$ROOT/bin/fm-peek.sh" test-session:1 2>&1) || status=$?
+  expect_code 2 "$status" "peek must bind a tmux window-index alias to recorded task ownership"
+  assert_contains "$out" 'does not match task metadata host_root' "peek window-index alias lost recorded host ownership"
+  assert_no_grep 'capture-pane' "$log" "peek window-index alias captured the endpoint before recorded-host validation"
+
+  : > "$log"; status=0
+  out=$(cd "$wrong" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$wrong" \
+    FM_TMUX_LOG="$log" FM_ENDPOINT_TARGET=test-session:fm-lane FM_ENDPOINT_INDEX_ALIAS=test-session:1 \
+    FM_LAUNCH_FILE="$TMP/unused.launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH=/tmp/target FM_HOST_PATH="$host" \
+    "$ROOT/bin/fm-send.sh" test-session:1 hello 2>&1) || status=$?
+  expect_code 2 "$status" "send must bind a tmux window-index alias to recorded task ownership"
+  assert_contains "$out" 'does not match task metadata host_root' "send window-index alias lost recorded host ownership"
+  assert_no_grep 'send-keys' "$log" "send window-index alias touched the endpoint before recorded-host validation"
+
   status=0
   out=$(cd "$wrong" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$wrong" \
     FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$TMP/unused.launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH=/tmp/target FM_HOST_PATH="$host" \
diff --git a/tests/fm-teardown.test.sh b/tests/fm-teardown.test.sh
index d3ece2f94f..1dfd8ce9a2 100755
--- a/tests/fm-teardown.test.sh
+++ b/tests/fm-teardown.test.sh
@@ -72,7 +72,7 @@ make_case() {
   local name=$1 case_dir fakebin
   case_dir="$TMP_ROOT/$name"
   fakebin="$case_dir/fakebin"
-  mkdir -p "$case_dir/state" "$case_dir/config" "$fakebin"
+  mkdir -p "$case_dir/data/task-x1" "$case_dir/state" "$case_dir/config" "$fakebin"
 
   # Mocks for the post-check teardown steps. Refuse logic exits before these
   # run; the ALLOW cases need them so the script can complete cleanly.

From 87673c695fb15dcde3eb51bc3e2bada72eddf041 Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Mon, 27 Jul 2026 11:11:22 +0300
Subject: [PATCH 17/39] no-mistakes(review): Captain, preserve host children
 during recursive teardown

---
 bin/fm-teardown.sh              |  8 +++--
 tests/fm-host-root-mode.test.sh | 60 +++++++++++++++++++++++++++++++++
 2 files changed, 66 insertions(+), 2 deletions(-)

diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index 7eb7ceb7a2..f365d80d8e 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -1009,7 +1009,7 @@ validate_firstmate_home_children_removal() {
 }
 
 cleanup_firstmate_home_children() {
-  local home=$1 sub_state child_meta child_id child_t child_wt child_proj child_kind child_home child_backend child_orca_worktree_id child_return_rc
+  local home=$1 sub_state child_meta child_id child_t child_wt child_proj child_kind child_home child_backend child_host_mode child_orca_worktree_id child_return_rc
   sub_state="$home/state"
   [ -d "$sub_state" ] || return 0
   for child_meta in "$sub_state"/*.meta; do
@@ -1020,6 +1020,8 @@ cleanup_firstmate_home_children() {
     child_kind=$(meta_value "$child_meta" kind)
     [ -n "$child_kind" ] || child_kind=ship
     child_backend=$(fm_backend_of_meta "$child_meta")
+    child_host_mode=0
+    grep -q '^host_root=.' "$child_meta" && child_host_mode=1
     if [ "$child_backend" = orca ]; then
       child_t=$(meta_value "$child_meta" terminal)
     else
@@ -1031,7 +1033,9 @@ cleanup_firstmate_home_children() {
         validate_child_worktree_for_removal "$child_wt" "$child_proj" >/dev/null || return 1
       fi
     fi
-    if [ -n "$child_t" ]; then
+    if [ "$child_host_mode" -eq 1 ]; then
+      ( unset FM_ROOT_OVERRIDE FM_CONFIG_OVERRIDE; FM_HOME=$home FM_ROOT=$home fm_backend_stop_and_verify "$child_backend" "$child_t" "$(meta_value "$child_meta" zellij_tab_id)" "fm-$child_id" ) || return 1
+    elif [ -n "$child_t" ]; then
       case "$child_backend" in
         zellij)
           # Zellij titles are scoped by the owning home tag, so forced secondmate
diff --git a/tests/fm-host-root-mode.test.sh b/tests/fm-host-root-mode.test.sh
index 543667a56f..ae360861e5 100644
--- a/tests/fm-host-root-mode.test.sh
+++ b/tests/fm-host-root-mode.test.sh
@@ -976,6 +976,65 @@ test_host_teardown_refuses_recorded_overlap_before_mutation() {
   pass "host-root teardown preserves recorded overlaps before endpoint or Git mutation"
 }
 
+test_secondmate_force_teardown_preserves_host_children_on_unconfirmed_stop() {
+  local backend case_root home subhome childproj childwt host fb log current tree_log target out status
+  for backend in tmux herdr; do
+    case_root="$TMP/recursive-host-child-$backend"
+    home="$case_root/home"
+    subhome="$case_root/subhome"
+    childproj="$subhome/projects/alpha"
+    childwt="$case_root/child-worktree"
+    host="$case_root/host"
+    mkdir -p "$home/state" "$home/data" "$home/config" "$subhome/state" "$host"
+    : > "$host/AGENTS.md"
+    fm_git_worktree "$childproj" "$childwt" "recursive-$backend"
+    printf 'domain\n' > "$subhome/.fm-secondmate-home"
+    fm_write_meta "$home/state/domain.meta" \
+      'window=test-session:fm-domain' "worktree=$subhome" "project=$subhome" \
+      'harness=echo' 'kind=secondmate' 'mode=secondmate' "home=$subhome" 'projects=alpha'
+    target=test-session:fm-child
+    [ "$backend" != herdr ] || target=child-session:w1:p2
+    fm_write_meta "$subhome/state/child.meta" \
+      "window=$target" "worktree=$childwt" "project=$childproj" \
+      "backend=$backend" "host_root=$host" 'harness=echo' 'kind=ship' 'mode=no-mistakes'
+    fb=$(make_fakebin "$case_root/fake")
+    if [ "$backend" = herdr ]; then
+      cat > "$fb/herdr" <<'SH'
+#!/usr/bin/env bash
+case "${1:-} ${2:-}" in
+  "status --json") printf '%s\n' '{"server":{"running":true}}' ;;
+  "pane close") exit 0 ;;
+  "pane get") printf '%s\n' '{"result":{"pane":{"pane_id":"w1:p2"}}}' ;;
+  *) exit 0 ;;
+esac
+SH
+      chmod +x "$fb/herdr"
+    fi
+    log="$case_root/backend.log"
+    current="$case_root/current"
+    tree_log="$case_root/treehouse.log"
+    printf '%s\n' "$host" > "$current"
+    : > "$current.endpoint"
+    : > "$log"
+    : > "$tree_log"
+    status=0
+    out=$(PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
+      FM_REFUSE_STOP=1 FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 \
+      FM_TMUX_LOG="$log" FM_ENDPOINT_TARGET="$target" FM_LAUNCH_FILE="$case_root/unused.launch" \
+      FM_CURRENT_PATH="$current" FM_TARGET_PATH="$childwt" FM_HOST_PATH="$host" \
+      FM_TREEHOUSE_LOG="$tree_log" "$ROOT/bin/fm-teardown.sh" domain --force 2>&1) || status=$?
+    [ "$status" -ne 0 ] || fail "forced secondmate teardown accepted an unconfirmed $backend host-child stop"
+    assert_present "$subhome/state/child.meta" "unconfirmed $backend host-child stop removed child metadata"
+    assert_present "$childwt" "unconfirmed $backend host-child stop removed the child worktree"
+    assert_present "$home/state/domain.meta" "unconfirmed $backend host-child stop removed parent metadata"
+    assert_contains "$out" 'refusing destructive cleanup' \
+      "unconfirmed $backend host-child stop did not explain the cleanup refusal"
+    assert_no_grep 'return --force' "$tree_log" \
+      "unconfirmed $backend host-child stop recycled a worktree"
+  done
+  pass "forced secondmate teardown preserves tmux and Herdr host children until their endpoints are confirmed absent"
+}
+
 test_task_actions_use_recorded_host_root() {
   local host="$TMP/recorded-host" wrong="$TMP/wrong-host" home="$TMP/recorded-home" fb log current out status=0
   make_host "$host"; make_host "$wrong"; mkdir -p "$home/state" "$home/config"
@@ -1086,5 +1145,6 @@ test_spawn_rollback_is_transactional
 test_decision_actions_use_durable_host_owner
 test_host_teardown_requires_confirmed_stop
 test_host_teardown_refuses_recorded_overlap_before_mutation
+test_secondmate_force_teardown_preserves_host_children_on_unconfirmed_stop
 test_task_actions_use_recorded_host_root
 test_spawn_rejects_old_brief_and_secondmate_clears_roots

From 9b1c69a29621c3728875cc41809677d98a007d02 Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Mon, 27 Jul 2026 11:21:33 +0300
Subject: [PATCH 18/39] no-mistakes(review): Captain, preserve indexed tmux and
 projected Herdr cleanup

---
 bin/backends/tmux.sh            |  8 +++---
 bin/fm-teardown.sh              |  7 ++++-
 tests/fm-host-root-mode.test.sh | 50 ++++++++++++++++++++++++---------
 3 files changed, 46 insertions(+), 19 deletions(-)

diff --git a/bin/backends/tmux.sh b/bin/backends/tmux.sh
index 26f4201cc0..bb1a9df04a 100644
--- a/bin/backends/tmux.sh
+++ b/bin/backends/tmux.sh
@@ -140,13 +140,13 @@ fm_backend_tmux_canonical_window() {  # <target> -> @<window-id>
 # target disappeared, which would report a killed worker as still present.
 # A readable inventory proves presence/absence; control-plane failures stay unknown.
 fm_backend_tmux_target_state() {  # <target> -> present|absent|unknown
-  local target=$1 out status pane_id window_id named indexed
-  out=$(tmux list-panes -a -F '#{pane_id}|#{window_id}|#{session_name}:#{window_name}|#{session_name}:#{window_index}.#{pane_index}' 2>&1)
+  local target=$1 out status pane_id window_id named indexed_window indexed_pane
+  out=$(tmux list-panes -a -F '#{pane_id}|#{window_id}|#{session_name}:#{window_name}|#{session_name}:#{window_index}|#{session_name}:#{window_index}.#{pane_index}' 2>&1)
   status=$?
   if [ "$status" -eq 0 ]; then
-    while IFS='|' read -r pane_id window_id named indexed; do
+    while IFS='|' read -r pane_id window_id named indexed_window indexed_pane; do
       case "$target" in
-        "$pane_id"|"$window_id"|"$named"|"$indexed") printf 'present'; return 0 ;;
+        "$pane_id"|"$window_id"|"$named"|"$indexed_window"|"$indexed_pane") printf 'present'; return 0 ;;
       esac
     done <<< "$out"
     printf 'absent'
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index f365d80d8e..9c4e9f2b0a 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -1033,7 +1033,12 @@ cleanup_firstmate_home_children() {
         validate_child_worktree_for_removal "$child_wt" "$child_proj" >/dev/null || return 1
       fi
     fi
-    if [ "$child_host_mode" -eq 1 ]; then
+    if [ "$child_host_mode" -eq 1 ] \
+       && [ "$child_backend" = herdr ] \
+       && { [ -e "$sub_state/$child_id.herdr-presentation" ] || [ -L "$sub_state/$child_id.herdr-presentation" ]; }; then
+      echo "error: herdr presentation state for child $child_id requires direct child teardown; refusing destructive cleanup" >&2
+      return 1
+    elif [ "$child_host_mode" -eq 1 ]; then
       ( unset FM_ROOT_OVERRIDE FM_CONFIG_OVERRIDE; FM_HOME=$home FM_ROOT=$home fm_backend_stop_and_verify "$child_backend" "$child_t" "$(meta_value "$child_meta" zellij_tab_id)" "fm-$child_id" ) || return 1
     elif [ -n "$child_t" ]; then
       case "$child_backend" in
diff --git a/tests/fm-host-root-mode.test.sh b/tests/fm-host-root-mode.test.sh
index ae360861e5..fedf099d89 100644
--- a/tests/fm-host-root-mode.test.sh
+++ b/tests/fm-host-root-mode.test.sh
@@ -242,8 +242,9 @@ case "${1:-}" in
             "${FM_ENDPOINT_INDEX_PANE_ALIAS:-test-session:1.0}"
           ;;
         *)
-          printf '%%1|@1|%s|%s\n' \
+          printf '%%1|@1|%s|%s|%s\n' \
             "${FM_ENDPOINT_TARGET:-test-session:fm-rollback-stuck}" \
+            "${FM_ENDPOINT_INDEX_ALIAS:-test-session:1}" \
             "${FM_ENDPOINT_INDEX_PANE_ALIAS:-test-session:1.0}"
           ;;
       esac
@@ -976,8 +977,8 @@ test_host_teardown_refuses_recorded_overlap_before_mutation() {
   pass "host-root teardown preserves recorded overlaps before endpoint or Git mutation"
 }
 
-test_secondmate_force_teardown_preserves_host_children_on_unconfirmed_stop() {
-  local backend case_root home subhome childproj childwt host fb log current tree_log target out status
+test_secondmate_force_teardown_preserves_host_children_during_recursive_cleanup() {
+  local backend case_root home subhome childproj childwt host fb log current tree_log target endpoint_named out status
   for backend in tmux herdr; do
     case_root="$TMP/recursive-host-child-$backend"
     home="$case_root/home"
@@ -992,15 +993,29 @@ test_secondmate_force_teardown_preserves_host_children_on_unconfirmed_stop() {
     fm_write_meta "$home/state/domain.meta" \
       'window=test-session:fm-domain' "worktree=$subhome" "project=$subhome" \
       'harness=echo' 'kind=secondmate' 'mode=secondmate' "home=$subhome" 'projects=alpha'
-    target=test-session:fm-child
-    [ "$backend" != herdr ] || target=child-session:w1:p2
+    target=test-session:1
+    endpoint_named=test-session:fm-child
+    if [ "$backend" = herdr ]; then
+      target=child-session:w1:p2
+      endpoint_named=$target
+    fi
     fm_write_meta "$subhome/state/child.meta" \
       "window=$target" "worktree=$childwt" "project=$childproj" \
       "backend=$backend" "host_root=$host" 'harness=echo' 'kind=ship' 'mode=no-mistakes'
     fb=$(make_fakebin "$case_root/fake")
     if [ "$backend" = herdr ]; then
+      printf '%s\n' \
+        'herdr_session=child-session' \
+        'herdr_workspace_id=w1' \
+        'herdr_tab_id=w1:t2' \
+        'herdr_pane_id=w1:p2' >> "$subhome/state/child.meta"
+      printf '%s\n' \
+        'version=1' \
+        'task_id=child' \
+        'projection_id=AbCdEfGhIjKlMnOpQrStUv' > "$subhome/state/child.herdr-presentation"
       cat > "$fb/herdr" <<'SH'
 #!/usr/bin/env bash
+printf '%s\n' "$*" >> "$FM_FAKE_HERDR_LOG"
 case "${1:-} ${2:-}" in
   "status --json") printf '%s\n' '{"server":{"running":true}}' ;;
   "pane close") exit 0 ;;
@@ -1020,19 +1035,26 @@ SH
     status=0
     out=$(PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
       FM_REFUSE_STOP=1 FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 \
-      FM_TMUX_LOG="$log" FM_ENDPOINT_TARGET="$target" FM_LAUNCH_FILE="$case_root/unused.launch" \
+      FM_TMUX_LOG="$log" FM_FAKE_HERDR_LOG="$log" FM_ENDPOINT_TARGET="$endpoint_named" \
+      FM_ENDPOINT_INDEX_ALIAS="$target" FM_LAUNCH_FILE="$case_root/unused.launch" \
       FM_CURRENT_PATH="$current" FM_TARGET_PATH="$childwt" FM_HOST_PATH="$host" \
       FM_TREEHOUSE_LOG="$tree_log" "$ROOT/bin/fm-teardown.sh" domain --force 2>&1) || status=$?
-    [ "$status" -ne 0 ] || fail "forced secondmate teardown accepted an unconfirmed $backend host-child stop"
-    assert_present "$subhome/state/child.meta" "unconfirmed $backend host-child stop removed child metadata"
-    assert_present "$childwt" "unconfirmed $backend host-child stop removed the child worktree"
-    assert_present "$home/state/domain.meta" "unconfirmed $backend host-child stop removed parent metadata"
+    [ "$status" -ne 0 ] || fail "forced secondmate teardown accepted unsafe $backend host-child cleanup"
+    assert_present "$subhome/state/child.meta" "recursive $backend host-child cleanup removed child metadata"
+    assert_present "$childwt" "recursive $backend host-child cleanup removed the child worktree"
+    assert_present "$home/state/domain.meta" "recursive $backend host-child cleanup removed parent metadata"
     assert_contains "$out" 'refusing destructive cleanup' \
-      "unconfirmed $backend host-child stop did not explain the cleanup refusal"
+      "recursive $backend host-child cleanup did not explain the refusal"
     assert_no_grep 'return --force' "$tree_log" \
-      "unconfirmed $backend host-child stop recycled a worktree"
+      "recursive $backend host-child cleanup recycled a worktree"
+    if [ "$backend" = herdr ]; then
+      assert_present "$subhome/state/child.herdr-presentation" \
+        "recursive Herdr cleanup removed the presentation journal"
+      assert_no_grep 'pane close' "$log" \
+        "recursive Herdr cleanup bypassed direct focus-preserving teardown"
+    fi
   done
-  pass "forced secondmate teardown preserves tmux and Herdr host children until their endpoints are confirmed absent"
+  pass "forced secondmate teardown preserves tmux aliases and projected Herdr children during recursive cleanup"
 }
 
 test_task_actions_use_recorded_host_root() {
@@ -1145,6 +1167,6 @@ test_spawn_rollback_is_transactional
 test_decision_actions_use_durable_host_owner
 test_host_teardown_requires_confirmed_stop
 test_host_teardown_refuses_recorded_overlap_before_mutation
-test_secondmate_force_teardown_preserves_host_children_on_unconfirmed_stop
+test_secondmate_force_teardown_preserves_host_children_during_recursive_cleanup
 test_task_actions_use_recorded_host_root
 test_spawn_rejects_old_brief_and_secondmate_clears_roots

From ae2a85517ae232f8fe77fd8e79e926ad178cb075 Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Mon, 27 Jul 2026 11:38:32 +0300
Subject: [PATCH 19/39] no-mistakes(review): Captain, stabilize tmux authority
 and teardown identity

---
 bin/backends/tmux.sh            | 24 ++++++++---
 bin/fm-backend.sh               | 19 +++++++--
 tests/fm-backend.test.sh        |  6 ++-
 tests/fm-host-root-mode.test.sh | 75 +++++++++++++++++++++++++--------
 4 files changed, 97 insertions(+), 27 deletions(-)

diff --git a/bin/backends/tmux.sh b/bin/backends/tmux.sh
index bb1a9df04a..7528e45e99 100644
--- a/bin/backends/tmux.sh
+++ b/bin/backends/tmux.sh
@@ -121,18 +121,32 @@ fm_backend_tmux_send_literal() {  # <target> <text>
 # server-global window id. Inventory matching avoids display-message's dangerous
 # fallback to the active window when a named target has disappeared.
 fm_backend_tmux_canonical_window() {  # <target> -> @<window-id>
-  local target=$1 out pane_id window_id named named_pane indexed_window indexed_pane
-  out=$(tmux list-panes -a -F '#{pane_id}|#{window_id}|#{session_name}:#{window_name}|#{session_name}:#{window_name}.#{pane_index}|#{session_name}:#{window_index}|#{session_name}:#{window_index}.#{pane_index}') \
-    || return 1
+  local target=$1 out status pane_id window_id named named_pane indexed_window indexed_pane
+  out=$(tmux list-panes -a -F '#{pane_id}|#{window_id}|#{session_name}:#{window_name}|#{session_name}:#{window_name}.#{pane_index}|#{session_name}:#{window_index}|#{session_name}:#{window_index}.#{pane_index}' 2>&1)
+  status=$?
+  if [ "$status" -ne 0 ]; then
+    case "$out" in
+      *'no server running'*|*'no sessions'*) return 2 ;;
+      *) return 1 ;;
+    esac
+  fi
+  while IFS='|' read -r pane_id window_id named named_pane indexed_window indexed_pane; do
+    case "$target" in
+      "$pane_id"|"$window_id"|"$indexed_window"|"$indexed_pane")
+        printf '%s' "$window_id"
+        return 0
+        ;;
+    esac
+  done <<< "$out"
   while IFS='|' read -r pane_id window_id named named_pane indexed_window indexed_pane; do
     case "$target" in
-      "$pane_id"|"$window_id"|"$named"|"$named_pane"|"$indexed_window"|"$indexed_pane")
+      "$named"|"$named_pane")
         printf '%s' "$window_id"
         return 0
         ;;
     esac
   done <<< "$out"
-  return 1
+  return 2
 }
 
 # Tri-state endpoint probe for destructive cleanup. Enumerate exact handles:
diff --git a/bin/fm-backend.sh b/bin/fm-backend.sh
index 70799ff2d8..4b497cd772 100644
--- a/bin/fm-backend.sh
+++ b/bin/fm-backend.sh
@@ -934,12 +934,25 @@ fm_backend_target_state() {  # <backend> <target> [expected-label] -> present|ab
 # removes the task's worktree. Kill adapters remain idempotent; this stricter
 # owner is for destructive cleanup paths that must not trust best-effort close.
 fm_backend_stop_and_verify() {  # <backend> <target> [zellij-tab-id] [expected-label]
-  local backend=$1 target=$2 expected_label=${4:-} attempts=${FM_BACKEND_STOP_ATTEMPTS:-20} delay=${FM_BACKEND_STOP_DELAY:-0.1} i=0 state=unknown
+  local backend=$1 target=$2 expected_label=${4:-} attempts=${FM_BACKEND_STOP_ATTEMPTS:-20} delay=${FM_BACKEND_STOP_DELAY:-0.1} i=0 state=unknown stop_target=$2 resolve_status
   [ -n "$target" ] || { echo "error: missing backend endpoint id; refusing destructive cleanup" >&2; return 1; }
   case "$attempts" in ''|*[!0-9]*|0) attempts=20 ;; esac
-  fm_backend_kill "$@" || return 1
+  if [ "$backend" = tmux ]; then
+    fm_backend_source tmux || return 1
+    stop_target=$(fm_backend_tmux_canonical_window "$target" 2>/dev/null) || {
+      resolve_status=$?
+      [ "$resolve_status" -eq 2 ] && return 0
+      echo "error: backend endpoint $target could not be resolved to a stable tmux window; refusing destructive cleanup" >&2
+      return 1
+    }
+  fi
+  if [ "$stop_target" = "$target" ]; then
+    fm_backend_kill "$@" || return 1
+  else
+    fm_backend_kill "$backend" "$stop_target" "${3:-}" "${4:-}" || return 1
+  fi
   while [ "$i" -lt "$attempts" ]; do
-    state=$(fm_backend_target_state "$backend" "$target" "$expected_label")
+    state=$(fm_backend_target_state "$backend" "$stop_target" "$expected_label")
     [ "$state" = absent ] && return 0
     i=$((i + 1))
     [ "$i" -ge "$attempts" ] || sleep "$delay"
diff --git a/tests/fm-backend.test.sh b/tests/fm-backend.test.sh
index d045a07474..4d9206a995 100755
--- a/tests/fm-backend.test.sh
+++ b/tests/fm-backend.test.sh
@@ -1173,7 +1173,8 @@ test_stop_and_verify_requires_confirmed_absence() {
 
   status=0
   out=$(FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 bash -c '
-    . "$1/bin/fm-backend.sh"
+    . "$1/bin/fm-backend.sh"; fm_backend_source tmux
+    fm_backend_tmux_canonical_window() { printf @1; }
     fm_backend_kill() { return 0; }
     fm_backend_target_state() { printf unknown; }
     fm_backend_stop_and_verify tmux session:fm-task
@@ -1183,7 +1184,8 @@ test_stop_and_verify_requires_confirmed_absence() {
 
   status=0
   out=$(FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 bash -c '
-    . "$1/bin/fm-backend.sh"
+    . "$1/bin/fm-backend.sh"; fm_backend_source tmux
+    fm_backend_tmux_canonical_window() { printf @1; }
     fm_backend_kill() { return 0; }
     fm_backend_target_state() { printf absent; }
     fm_backend_stop_and_verify tmux session:fm-task
diff --git a/tests/fm-host-root-mode.test.sh b/tests/fm-host-root-mode.test.sh
index fedf099d89..82286992a3 100644
--- a/tests/fm-host-root-mode.test.sh
+++ b/tests/fm-host-root-mode.test.sh
@@ -232,7 +232,36 @@ case "${1:-}" in
     ;;
   list-windows) [ -z "${FM_EXISTING_WINDOW:-}" ] || printf '%s\n' "$FM_EXISTING_WINDOW" ;;
   list-panes)
-    if [ -f "$endpoint" ]; then
+    if [ "${FM_TMUX_NUMERIC_NAME_COLLISION:-0}" = 1 ]; then
+      printf '%%9|@9|test-session:1|test-session:1.0|test-session:0|test-session:0.0\n'
+      printf '%%1|@1|%s|%s|%s|%s\n' \
+        "${FM_ENDPOINT_TARGET:-test-session:fm-rollback-stuck}" \
+        "${FM_ENDPOINT_ALIAS:-test-session:fm-rollback-stuck.0}" \
+        "${FM_ENDPOINT_INDEX_ALIAS:-test-session:1}" \
+        "${FM_ENDPOINT_INDEX_PANE_ALIAS:-test-session:1.0}"
+    elif [ "${FM_TMUX_RENUMBER_ON_STOP:-0}" = 1 ]; then
+      case "$*" in
+        *'#{window_name}.#{pane_index}'*)
+          if [ -f "$endpoint" ]; then
+            printf '%%1|@1|%s|%s|test-session:1|test-session:1.0\n' \
+              "${FM_ENDPOINT_TARGET:-test-session:fm-rollback-stuck}" \
+              "${FM_ENDPOINT_ALIAS:-test-session:fm-rollback-stuck.0}"
+            printf '%%2|@2|test-session:survivor|test-session:survivor.0|test-session:2|test-session:2.0\n'
+          else
+            printf '%%2|@2|test-session:survivor|test-session:survivor.0|test-session:1|test-session:1.0\n'
+          fi
+          ;;
+        *)
+          if [ -f "$endpoint" ]; then
+            printf '%%1|@1|%s|test-session:1|test-session:1.0\n' \
+              "${FM_ENDPOINT_TARGET:-test-session:fm-rollback-stuck}"
+            printf '%%2|@2|test-session:survivor|test-session:2|test-session:2.0\n'
+          else
+            printf '%%2|@2|test-session:survivor|test-session:1|test-session:1.0\n'
+          fi
+          ;;
+      esac
+    elif [ -f "$endpoint" ]; then
       case "$*" in
         *'#{window_name}.#{pane_index}'*)
           printf '%%1|@1|%s|%s|%s|%s\n' \
@@ -470,7 +499,8 @@ test_spawn_rejects_host_as_target_and_cleans_failed_transition() {
 
   printf '%s\n' "$project" > "$current"
   out=$(cd "$host" && PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
-    FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$TMP/refusal.launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH="$host" \
+    FM_TMUX_LOG="$log" FM_ENDPOINT_TARGET=test-session:fm-host-target \
+    FM_LAUNCH_FILE="$TMP/refusal.launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH="$host" \
     FM_HOST_PATH="$host" FM_TREEHOUSE_LOG="$tree_log" TMUX=fake \
     "$ROOT/bin/fm-spawn.sh" host-target "$project" codex 2>&1) || status=$?
   [ "$status" -ne 0 ] || fail "spawn accepted FM_HOST_ROOT as the target worktree"
@@ -482,7 +512,8 @@ test_spawn_rejects_host_as_target_and_cleans_failed_transition() {
   : > "$log"; : > "$tree_log"; printf '%s\n' "$project" > "$current"; status=0
   out=$(cd "$host" && PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
     FM_HOST_CWD_ATTEMPTS=1 FM_HOST_CWD_DELAY=0 FM_REFUSE_HOST_MOVE=1 \
-    FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$TMP/move-fail.launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH="$wt" \
+    FM_TMUX_LOG="$log" FM_ENDPOINT_TARGET=test-session:fm-move-fail \
+    FM_LAUNCH_FILE="$TMP/move-fail.launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH="$wt" \
     FM_HOST_PATH="$host" FM_TREEHOUSE_LOG="$tree_log" TMUX=fake \
     "$ROOT/bin/fm-spawn.sh" move-fail "$project" codex 2>&1) || status=$?
   [ "$status" -ne 0 ] || fail "spawn accepted a backend that never entered FM_HOST_ROOT"
@@ -730,7 +761,8 @@ test_spawn_rollback_is_transactional() {
   log="$TMP/rollback.log"; current="$TMP/rollback.current"; tree_log="$TMP/rollback-treehouse.log"
   printf '%s\n' "$project" > "$current"
   out=$(cd "$host" && PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
-    FM_FAIL_LAUNCH_SEND=1 FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$TMP/rollback.launch" \
+    FM_FAIL_LAUNCH_SEND=1 FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 FM_TMUX_LOG="$log" \
+    FM_ENDPOINT_TARGET=test-session:fm-rollback-clean FM_LAUNCH_FILE="$TMP/rollback.launch" \
     FM_CURRENT_PATH="$current" FM_TARGET_PATH="$wt" FM_HOST_PATH="$host" FM_TREEHOUSE_LOG="$tree_log" TMUX=fake \
     "$ROOT/bin/fm-spawn.sh" rollback-clean "$project" pi 2>&1) || status=$?
   [ "$status" -ne 0 ] || fail "injected launch failure unexpectedly succeeded"
@@ -742,7 +774,8 @@ test_spawn_rollback_is_transactional() {
   : > "$log"; : > "$tree_log"; printf '%s\n' "$project" > "$current"; status=0
   out=$(cd "$host" && PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
     FM_FAIL_LAUNCH_SEND=1 FM_REFUSE_STOP=1 FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 FM_TMUX_LOG="$log" \
-    FM_LAUNCH_FILE="$TMP/rollback-stuck.launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH="$stuck_wt" FM_HOST_PATH="$host" \
+    FM_ENDPOINT_TARGET=test-session:fm-rollback-stuck FM_LAUNCH_FILE="$TMP/rollback-stuck.launch" \
+    FM_CURRENT_PATH="$current" FM_TARGET_PATH="$stuck_wt" FM_HOST_PATH="$host" \
     FM_TREEHOUSE_LOG="$tree_log" TMUX=fake "$ROOT/bin/fm-spawn.sh" rollback-stuck "$project" pi 2>&1) || status=$?
   [ "$status" -ne 0 ] || fail "injected stop failure unexpectedly succeeded"
   assert_contains "$out" 'still exists after stop' "failed endpoint termination was not explicit (backend log: $(tr '\n' ';' < "$log"))"
@@ -771,7 +804,8 @@ test_spawn_rollback_is_transactional() {
   : > "$log"; : > "$tree_log"; printf '%s\n' "$project" > "$current"; status=0
   out=$(cd "$host" && PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
     FM_FAIL_LAUNCH_SEND=1 FM_REFUSE_RETURN=1 FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 FM_TMUX_LOG="$log" \
-    FM_LAUNCH_FILE="$TMP/rollback-retained.launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH="$retained_wt" FM_HOST_PATH="$host" \
+    FM_ENDPOINT_TARGET=test-session:fm-rollback-retained FM_LAUNCH_FILE="$TMP/rollback-retained.launch" \
+    FM_CURRENT_PATH="$current" FM_TARGET_PATH="$retained_wt" FM_HOST_PATH="$host" \
     FM_TREEHOUSE_LOG="$tree_log" TMUX=fake "$ROOT/bin/fm-spawn.sh" rollback-retained "$project" pi 2>&1) || status=$?
   [ "$status" -ne 0 ] || fail "injected worktree return failure unexpectedly succeeded"
   assert_present "$home/state/rollback-retained.meta" "worktree return failure lost recovery metadata"
@@ -928,13 +962,18 @@ test_host_teardown_requires_confirmed_stop() {
   assert_no_grep 'return --force' "$tree_log" "post-stop tmux safety refusal returned the worktree"
   rm -f "$wt/late-edit.txt"
 
-  : > "$log"; : > "$tree_log"; status=0
+  : > "$current.endpoint"; : > "$log"; : > "$tree_log"; status=0
+  sed -i.bak 's/^window=.*/window=test-session:1/' "$home/state/host-teardown.meta"
+  rm -f "$home/state/host-teardown.meta.bak"
   out=$(cd "$host" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
-    FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 FM_TMUX_LOG="$log" \
-    FM_ENDPOINT_TARGET=test-session:fm-host-teardown FM_LAUNCH_FILE="$TMP/unused.launch" FM_CURRENT_PATH="$current" \
+    FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 FM_TMUX_LOG="$log" FM_TMUX_RENUMBER_ON_STOP=1 \
+    FM_ENDPOINT_TARGET=test-session:fm-host-teardown FM_ENDPOINT_INDEX_ALIAS=test-session:1 \
+    FM_LAUNCH_FILE="$TMP/unused.launch" FM_CURRENT_PATH="$current" \
     FM_TARGET_PATH="$wt" FM_HOST_PATH="$host" FM_TREEHOUSE_LOG="$tree_log" TMUX=fake \
     "$ROOT/bin/fm-teardown.sh" host-teardown --force 2>&1) || status=$?
   expect_code 0 "$status" "host-root teardown failed after confirmed endpoint stop: $out"
+  assert_grep $'kill-window\037-t\037@1' "$log" \
+    "host-root teardown did not stop the immutable tmux window id"
   kill_line=$(grep -n 'kill-window' "$log" | tail -1 | cut -d: -f1)
   verify_line=$(awk -v start="$kill_line" 'NR > start && /list-panes/ { print NR; exit }' "$log")
   return_line=$(grep -n 'return --force' "$tree_log" | head -1 | cut -d: -f1)
@@ -1091,21 +1130,23 @@ test_task_actions_use_recorded_host_root() {
 
   : > "$log"; status=0
   out=$(cd "$wrong" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$wrong" \
-    FM_TMUX_LOG="$log" FM_ENDPOINT_TARGET=test-session:fm-lane FM_ENDPOINT_INDEX_ALIAS=test-session:1 \
+    FM_TMUX_LOG="$log" FM_TMUX_NUMERIC_NAME_COLLISION=1 \
+    FM_ENDPOINT_TARGET=test-session:fm-lane FM_ENDPOINT_INDEX_ALIAS=test-session:1 \
     FM_LAUNCH_FILE="$TMP/unused.launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH=/tmp/target FM_HOST_PATH="$host" \
     "$ROOT/bin/fm-peek.sh" test-session:1 2>&1) || status=$?
-  expect_code 2 "$status" "peek must bind a tmux window-index alias to recorded task ownership"
-  assert_contains "$out" 'does not match task metadata host_root' "peek window-index alias lost recorded host ownership"
-  assert_no_grep 'capture-pane' "$log" "peek window-index alias captured the endpoint before recorded-host validation"
+  expect_code 2 "$status" "peek must prefer a tmux window index over a colliding numeric name"
+  assert_contains "$out" 'does not match task metadata host_root' "peek numeric collision lost recorded host ownership"
+  assert_no_grep 'capture-pane' "$log" "peek numeric collision captured the endpoint before recorded-host validation"
 
   : > "$log"; status=0
   out=$(cd "$wrong" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$wrong" \
-    FM_TMUX_LOG="$log" FM_ENDPOINT_TARGET=test-session:fm-lane FM_ENDPOINT_INDEX_ALIAS=test-session:1 \
+    FM_TMUX_LOG="$log" FM_TMUX_NUMERIC_NAME_COLLISION=1 \
+    FM_ENDPOINT_TARGET=test-session:fm-lane FM_ENDPOINT_INDEX_ALIAS=test-session:1 \
     FM_LAUNCH_FILE="$TMP/unused.launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH=/tmp/target FM_HOST_PATH="$host" \
     "$ROOT/bin/fm-send.sh" test-session:1 hello 2>&1) || status=$?
-  expect_code 2 "$status" "send must bind a tmux window-index alias to recorded task ownership"
-  assert_contains "$out" 'does not match task metadata host_root' "send window-index alias lost recorded host ownership"
-  assert_no_grep 'send-keys' "$log" "send window-index alias touched the endpoint before recorded-host validation"
+  expect_code 2 "$status" "send must prefer a tmux window index over a colliding numeric name"
+  assert_contains "$out" 'does not match task metadata host_root' "send numeric collision lost recorded host ownership"
+  assert_no_grep 'send-keys' "$log" "send numeric collision touched the endpoint before recorded-host validation"
 
   status=0
   out=$(cd "$wrong" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$wrong" \

From 9c08e8c1f6c5e44b72b9b2bb150ebeabef406453 Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Mon, 27 Jul 2026 12:59:21 +0300
Subject: [PATCH 20/39] no-mistakes(review): Harden host-root cleanup and
 endpoint identity

---
 bin/backends/cmux.sh            | 32 ++++++++-----
 bin/backends/tmux.sh            | 45 +++++++++++++------
 bin/backends/zellij.sh          | 35 ++++++++++++---
 bin/fm-backend.sh               | 17 ++++---
 bin/fm-host-root-lib.sh         | 11 ++++-
 bin/fm-spawn.sh                 |  4 +-
 bin/fm-teardown.sh              | 73 +++++++++++++++++++++---------
 tests/fm-backend-cmux.test.sh   | 38 +++++++++++++++-
 tests/fm-backend-zellij.test.sh | 49 ++++++++++++++++++++
 tests/fm-backend.test.sh        | 72 ++++++++++++++++++++++++++---
 tests/fm-host-root-mode.test.sh | 80 ++++++++++++++++++++++++++++++++-
 tests/fm-teardown.test.sh       | 62 +++++++++++++++++++++++++
 12 files changed, 448 insertions(+), 70 deletions(-)

diff --git a/bin/backends/cmux.sh b/bin/backends/cmux.sh
index 203fb6b9ca..75a7ef58bb 100644
--- a/bin/backends/cmux.sh
+++ b/bin/backends/cmux.sh
@@ -444,30 +444,40 @@ fm_backend_cmux_target_ready() {  # <target> [expected-label]
 # Tri-state endpoint probe for destructive cleanup. A successful workspace
 # inventory proves presence or absence; socket/auth/JSON failures stay unknown.
 fm_backend_cmux_target_state() {  # <target> [expected-label] -> present|absent|unknown
-  local expected_label=${2:-} expected_title workspaces
+  local expected_label=${2:-} expected_title windows window_ids window_id workspaces
   fm_backend_cmux_parse_target "$1" || { printf 'unknown'; return 0; }
   [ "$(fm_backend_cmux_ping_state)" = ok ] || { printf 'unknown'; return 0; }
-  workspaces=$(fm_backend_cmux_cli workspace list --json --id-format uuids 2>&1) || {
+  windows=$(fm_backend_cmux_cli list-windows --json --id-format uuids 2>&1) || {
     printf 'unknown'
     return 0
   }
-  if ! printf '%s' "$workspaces" | jq -e '.workspaces | type == "array"' >/dev/null 2>&1; then
+  if ! printf '%s' "$windows" | jq -e 'type == "array"' >/dev/null 2>&1; then
     printf 'unknown'
     return 0
   fi
-  if printf '%s' "$workspaces" | jq -e --arg id "$FM_BACKEND_CMUX_WORKSPACE" \
-    'any(.workspaces[]?; .id == $id)' >/dev/null 2>&1; then
-    printf 'present'
-    return 0
-  fi
+  window_ids=$(printf '%s' "$windows" | jq -r '.[]? | .id // empty' 2>/dev/null)
   if [ -n "$expected_label" ]; then
     expected_title=$(fm_backend_cmux_scoped_title "$expected_label")
-    if printf '%s' "$workspaces" | jq -e --arg title "$expected_title" \
-      'any(.workspaces[]?; .title == $title)' >/dev/null 2>&1; then
+  fi
+  while IFS= read -r window_id; do
+    [ -n "$window_id" ] || continue
+    workspaces=$(fm_backend_cmux_cli workspace list --json --id-format uuids --window "$window_id" 2>&1) || {
+      printf 'unknown'
+      return 0
+    }
+    if ! printf '%s' "$workspaces" | jq -e '.workspaces | type == "array"' >/dev/null 2>&1; then
+      printf 'unknown'
+      return 0
+    fi
+    if printf '%s' "$workspaces" | jq -e \
+      --arg id "$FM_BACKEND_CMUX_WORKSPACE" --arg title "${expected_title:-}" \
+      'any(.workspaces[]?; .id == $id or ($title != "" and .title == $title))' >/dev/null 2>&1; then
       printf 'present'
       return 0
     fi
-  fi
+  done <<EOF
+$window_ids
+EOF
   printf 'absent'
 }
 
diff --git a/bin/backends/tmux.sh b/bin/backends/tmux.sh
index 7528e45e99..4f4d56c48c 100644
--- a/bin/backends/tmux.sh
+++ b/bin/backends/tmux.sh
@@ -121,7 +121,7 @@ fm_backend_tmux_send_literal() {  # <target> <text>
 # server-global window id. Inventory matching avoids display-message's dangerous
 # fallback to the active window when a named target has disappeared.
 fm_backend_tmux_canonical_window() {  # <target> -> @<window-id>
-  local target=$1 out status pane_id window_id named named_pane indexed_window indexed_pane
+  local target=$1 out status pane_id window_id named named_pane indexed_window indexed_pane matched=
   out=$(tmux list-panes -a -F '#{pane_id}|#{window_id}|#{session_name}:#{window_name}|#{session_name}:#{window_name}.#{pane_index}|#{session_name}:#{window_index}|#{session_name}:#{window_index}.#{pane_index}' 2>&1)
   status=$?
   if [ "$status" -ne 0 ]; then
@@ -141,11 +141,17 @@ fm_backend_tmux_canonical_window() {  # <target> -> @<window-id>
   while IFS='|' read -r pane_id window_id named named_pane indexed_window indexed_pane; do
     case "$target" in
       "$named"|"$named_pane")
-        printf '%s' "$window_id"
-        return 0
+        if [ -n "$matched" ] && [ "$matched" != "$window_id" ]; then
+          return 1
+        fi
+        matched=$window_id
         ;;
     esac
   done <<< "$out"
+  if [ -n "$matched" ]; then
+    printf '%s' "$matched"
+    return 0
+  fi
   return 2
 }
 
@@ -215,20 +221,28 @@ fm_backend_tmux_current_command() {  # <target>
 fm_backend_tmux_agent_state() {  # <target>
   local target=$1 comm session window windows inventory_status
   case "$target" in
+    @*)
+      if windows=$(LC_ALL=C tmux list-panes -a -F '#{window_id}' 2>&1); then
+        inventory_status=0
+      else
+        inventory_status=$?
+      fi
+      ;;
     *:*:*|'':*|*:'') printf 'unreadable'; return 0 ;;
-    *:*) ;;
+    *:*)
+      session=${target%%:*}
+      window=${target#*:}
+      if windows=$(LC_ALL=C tmux list-windows -t "$session" -F '#{window_name}' 2>&1); then
+        inventory_status=0
+      else
+        inventory_status=$?
+      fi
+      ;;
     *) printf 'unreadable'; return 0 ;;
   esac
-  session=${target%%:*}
-  window=${target#*:}
-  if windows=$(LC_ALL=C tmux list-windows -t "$session" -F '#{window_name}' 2>&1); then
-    inventory_status=0
-  else
-    inventory_status=$?
-  fi
   if [ "$inventory_status" -ne 0 ]; then
     case "$windows" in
-      *"can't find session:"*|*"no server running on "*|*"error connecting to "*" (No such file or directory)"|*"error connecting to "*" (Connection refused)")
+      *"can't find session:"*|*"no server running on "*|*"no sessions"*|*"error connecting to "*" (No such file or directory)"|*"error connecting to "*" (Connection refused)")
         printf 'missing'
         ;;
       *)
@@ -237,10 +251,13 @@ fm_backend_tmux_agent_state() {  # <target>
     esac
     return 0
   fi
-  if ! printf '%s\n' "$windows" | grep -Fqx "$window"; then
+  case "$target" in
+    @*) printf '%s\n' "$windows" | grep -Fqx "$target" ;;
+    *) printf '%s\n' "$windows" | grep -Fqx "$window" ;;
+  esac || {
     printf 'missing'
     return 0
-  fi
+  }
 
   comm=$(fm_backend_tmux_current_command "$target") || {
     printf 'unreadable'
diff --git a/bin/backends/zellij.sh b/bin/backends/zellij.sh
index 9b0e490742..51bc731fb4 100644
--- a/bin/backends/zellij.sh
+++ b/bin/backends/zellij.sh
@@ -394,8 +394,8 @@ fm_backend_zellij_target_ready() {  # <target> [expected-label]
 # Tri-state endpoint probe for destructive cleanup. Zellij action exit codes
 # cannot prove absence, so first require a readable session list and then parse
 # the pane list structurally; malformed or unreachable output stays unknown.
-fm_backend_zellij_target_state() {  # <target> -> present|absent|unknown
-  local sessions status panes
+fm_backend_zellij_target_state() {  # <target> [tab-id] [expected-label] -> present|absent|unknown
+  local recorded_tab=${2:-} expected_label=${3:-} sessions status panes tabs scoped
   fm_backend_zellij_parse_target "$1" || { printf 'unknown'; return 0; }
   sessions=$(zellij list-sessions --short --no-formatting 2>&1)
   status=$?
@@ -418,9 +418,32 @@ fm_backend_zellij_target_state() {  # <target> -> present|absent|unknown
   if printf '%s' "$panes" | jq -e --arg pane "$FM_BACKEND_ZELLIJ_PANE" \
     '[.[]? | select((.id | tostring) == $pane and .is_plugin == false)] | length > 0' >/dev/null 2>&1; then
     printf 'present'
-  else
+    return 0
+  fi
+  [ -n "$recorded_tab" ] || [ -n "$expected_label" ] || {
     printf 'absent'
+    return 0
+  }
+  tabs=$(fm_backend_zellij_cli "$FM_BACKEND_ZELLIJ_SESSION" action list-tabs --json 2>&1)
+  if ! printf '%s' "$tabs" | jq -e 'type == "array"' >/dev/null 2>&1; then
+    printf 'unknown'
+    return 0
+  fi
+  if [ -n "$recorded_tab" ] \
+     && printf '%s' "$tabs" | jq -e --arg tab "$recorded_tab" \
+       'any(.[]?; (.tab_id | tostring) == $tab)' >/dev/null 2>&1; then
+    printf 'present'
+    return 0
+  fi
+  if [ -n "$expected_label" ]; then
+    scoped=$(fm_backend_zellij_scoped_title "$expected_label")
+    if printf '%s' "$tabs" | jq -e --arg scoped "$scoped" --arg legacy "$expected_label" \
+      'any(.[]?; .name == $scoped or .name == $legacy)' >/dev/null 2>&1; then
+      printf 'present'
+      return 0
+    fi
   fi
+  printf 'absent'
 }
 
 # fm_backend_zellij_current_path: the live pane's cwd, or empty on any error.
@@ -563,8 +586,8 @@ fm_backend_zellij_send_text_submit() {  # <target> <text> <retries> <enter-sleep
   done
 }
 
-# fm_backend_zellij_kill: remove the task's tab, best-effort (mirrors
-# tmux-kill-window's/herdr-pane-close's `|| true` contract). Verified: unlike
+# fm_backend_zellij_kill: remove the task's tab idempotently while propagating
+# a close failure to callers that require verified teardown. Verified: unlike
 # herdr, closing a zellij tab's only PANE does NOT close the tab itself (an
 # empty tab survives in list-tabs); `close-tab-by-id` on a live tab DOES
 # cleanly remove both the pane and the tab in one call, verified to need no
@@ -591,7 +614,7 @@ fm_backend_zellij_kill() {  # <target> [tab_id] [expected_label]
       ;;
   esac
   if [ -n "$tab_id" ]; then
-    fm_backend_zellij_cli "$FM_BACKEND_ZELLIJ_SESSION" action close-tab-by-id "$tab_id" >/dev/null 2>&1 || true
+    fm_backend_zellij_cli "$FM_BACKEND_ZELLIJ_SESSION" action close-tab-by-id "$tab_id" >/dev/null 2>&1
   elif [ -z "$expected_label" ]; then
     fm_backend_zellij_cli "$FM_BACKEND_ZELLIJ_SESSION" action close-pane --pane-id "$FM_BACKEND_ZELLIJ_PANE" >/dev/null 2>&1 || true
   fi
diff --git a/bin/fm-backend.sh b/bin/fm-backend.sh
index 4b497cd772..28acf865f4 100644
--- a/bin/fm-backend.sh
+++ b/bin/fm-backend.sh
@@ -917,13 +917,13 @@ fm_backend_target_exists() {  # <backend> <target> [expected-label]
 # Tri-state existence probe for destructive cleanup. Unlike the historical
 # boolean liveness helper above, an unreadable control plane is unknown rather
 # than absent and therefore cannot authorize worktree reuse.
-fm_backend_target_state() {  # <backend> <target> [expected-label] -> present|absent|unknown
-  local backend=$1 target=$2 expected_label=${3:-}
+fm_backend_target_state() {  # <backend> <target> [zellij-tab-id] [expected-label] -> present|absent|unknown
+  local backend=$1 target=$2 zellij_tab_id=${3:-} expected_label=${4:-}
   fm_backend_source "$backend" || { printf 'unknown'; return 0; }
   case "$backend" in
     tmux) fm_backend_tmux_target_state "$target" ;;
     herdr) fm_backend_herdr_target_state "$target" ;;
-    zellij) fm_backend_zellij_target_state "$target" ;;
+    zellij) fm_backend_zellij_target_state "$target" "$zellij_tab_id" "$expected_label" ;;
     orca) fm_backend_orca_target_state "$target" ;;
     cmux) fm_backend_cmux_target_state "$target" "$expected_label" ;;
     *) printf 'unknown' ;;
@@ -933,15 +933,18 @@ fm_backend_target_state() {  # <backend> <target> [expected-label] -> present|ab
 # Stop a task endpoint and prove it disappeared before any caller recycles or
 # removes the task's worktree. Kill adapters remain idempotent; this stricter
 # owner is for destructive cleanup paths that must not trust best-effort close.
-fm_backend_stop_and_verify() {  # <backend> <target> [zellij-tab-id] [expected-label]
-  local backend=$1 target=$2 expected_label=${4:-} attempts=${FM_BACKEND_STOP_ATTEMPTS:-20} delay=${FM_BACKEND_STOP_DELAY:-0.1} i=0 state=unknown stop_target=$2 resolve_status
+fm_backend_stop_and_verify() {  # <backend> <target> [zellij-tab-id] [expected-label] [require-stable-tmux-id]
+  local backend=$1 target=$2 expected_label=${4:-} require_stable_tmux_id=${5:-0} attempts=${FM_BACKEND_STOP_ATTEMPTS:-20} delay=${FM_BACKEND_STOP_DELAY:-0.1} i=0 state=unknown stop_target=$2 resolve_status
   [ -n "$target" ] || { echo "error: missing backend endpoint id; refusing destructive cleanup" >&2; return 1; }
   case "$attempts" in ''|*[!0-9]*|0) attempts=20 ;; esac
   if [ "$backend" = tmux ]; then
     fm_backend_source tmux || return 1
     stop_target=$(fm_backend_tmux_canonical_window "$target" 2>/dev/null) || {
       resolve_status=$?
-      [ "$resolve_status" -eq 2 ] && return 0
+      if [ "$resolve_status" -eq 2 ]; then
+        case "$target" in @*) return 0 ;; esac
+        [ "$require_stable_tmux_id" = 1 ] || return 0
+      fi
       echo "error: backend endpoint $target could not be resolved to a stable tmux window; refusing destructive cleanup" >&2
       return 1
     }
@@ -952,7 +955,7 @@ fm_backend_stop_and_verify() {  # <backend> <target> [zellij-tab-id] [expected-l
     fm_backend_kill "$backend" "$stop_target" "${3:-}" "${4:-}" || return 1
   fi
   while [ "$i" -lt "$attempts" ]; do
-    state=$(fm_backend_target_state "$backend" "$stop_target" "$expected_label")
+    state=$(fm_backend_target_state "$backend" "$stop_target" "${3:-}" "$expected_label")
     [ "$state" = absent ] && return 0
     i=$((i + 1))
     [ "$i" -ge "$attempts" ] || sleep "$delay"
diff --git a/bin/fm-host-root-lib.sh b/bin/fm-host-root-lib.sh
index b0e294bdb5..3f4f2c9803 100644
--- a/bin/fm-host-root-lib.sh
+++ b/bin/fm-host-root-lib.sh
@@ -103,7 +103,7 @@ fm_host_root_assert_task_cwd() {
 }
 
 fm_host_root_persist_task_owner() {
-  local meta=$1 owner=$2 recorded
+  local meta=$1 owner=$2 recorded tmp
   recorded=$(sed -n 's/^host_root=//p' "$meta" 2>/dev/null | tail -1)
   [ -n "$recorded" ] || return 0
   if [ -e "$owner" ] || [ -L "$owner" ]; then
@@ -117,10 +117,17 @@ fm_host_root_persist_task_owner() {
     }
     return 0
   fi
-  (umask 077; printf 'host_root=%s\n' "$recorded" > "$owner") || {
+  tmp=$(umask 077; mktemp "$owner.tmp.XXXXXX" 2>/dev/null) || {
     echo "error: could not persist host owner: $owner" >&2
     return 2
   }
+  if ! printf 'host_root=%s\n' "$recorded" > "$tmp" \
+     || ! chmod 0600 "$tmp" 2>/dev/null \
+     || ! mv -f -- "$tmp" "$owner" 2>/dev/null; then
+    rm -f -- "$tmp"
+    echo "error: could not persist host owner: $owner" >&2
+    return 2
+  fi
 }
 
 fm_host_root_paths_overlap() {
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 83d5908ac9..566902ccf3 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -1207,10 +1207,10 @@ case "$BACKEND" in
     # id and pins the window name (automatic-rename/allow-rename off) so a captain's
     # non-default tmux config cannot rename the window away from fm-<id> once
     # treehouse cd's into the worktree. WT_TARGET carries that stable id for the
-    # rename-critical worktree-detection steps below; the persisted window= handle
-    # stays $T (the name form), which is safe now that rename is disabled.
+    # rename-critical worktree-detection steps below.
     WID=$(fm_backend_tmux_create_task "$SES" "$W" "$PROJ_ABS") || exit 1
     WT_TARGET="$WID"
+    [ "$HOST_MODE" -eq 0 ] || T=$WID
     ;;
   herdr)
     # fm_backend_herdr_workspace_label resolves the target workspace from
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index 9c4e9f2b0a..8322e626f4 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -891,10 +891,20 @@ validate_firstmate_operational_dirs_for_removal() {
 }
 
 validate_child_worktree_for_removal() {
-  local target=$1 project=$2 abs_target abs_home abs_root
+  local target=$1 project=$2 host_root=${3:-} abs_target abs_host abs_home abs_root
   [ -n "$target" ] || return 0
   [ -e "$target" ] || return 0
   abs_target=$(validate_removal_target "$target" "child worktree") || return 1
+  if [ -n "$host_root" ]; then
+    abs_host=$(cd "$host_root" 2>/dev/null && pwd -P) || {
+      echo "REFUSED: child host root $host_root cannot be resolved; preserving child recovery metadata" >&2
+      return 1
+    }
+    if fm_host_root_paths_overlap "$abs_host" "$abs_target"; then
+      echo "REFUSED: child host and target roots overlap (host '$abs_host'; target '$abs_target'); preserving child recovery metadata" >&2
+      return 1
+    fi
+  fi
   if abs_home=$(cd "$FM_HOME" 2>/dev/null && pwd -P); then
     if path_is_ancestor_of "$abs_home" "$abs_target"; then
       echo "REFUSED: unsafe child worktree removal target $target is inside the active firstmate home" >&2
@@ -920,8 +930,8 @@ safe_rm_rf() {
 }
 
 safe_rm_rf_child_worktree() {
-  local target=$1 project=$2
-  validate_child_worktree_for_removal "$target" "$project" >/dev/null || return 1
+  local target=$1 project=$2 host_root=${3:-}
+  validate_child_worktree_for_removal "$target" "$project" "$host_root" >/dev/null || return 1
   rm -rf -- "$target"
 }
 
@@ -977,7 +987,7 @@ remove_firstmate_home() {
 }
 
 validate_firstmate_home_children_removal() {
-  local home=$1 sub_state child_meta child_id child_wt child_proj child_kind child_home child_backend child_orca_worktree_id
+  local home=$1 sub_state child_meta child_id child_wt child_proj child_kind child_home child_backend child_host_root child_orca_worktree_id
   sub_state="$home/state"
   [ -d "$sub_state" ] || return 0
   for child_meta in "$sub_state"/*.meta; do
@@ -989,6 +999,7 @@ validate_firstmate_home_children_removal() {
     child_kind=$(meta_value "$child_meta" kind)
     [ -n "$child_kind" ] || child_kind=ship
     child_backend=$(fm_backend_of_meta "$child_meta")
+    child_host_root=$(meta_value "$child_meta" host_root)
     if [ "$child_kind" = secondmate ]; then
       child_home=$(meta_value "$child_meta" home)
       [ -n "$child_home" ] || child_home=$child_wt
@@ -998,18 +1009,18 @@ validate_firstmate_home_children_removal() {
       child_orca_worktree_id=$(require_orca_worktree_id "$child_meta") || return 1
       if [ -n "$child_wt" ] && [ -e "$child_wt" ]; then
         child_proj=$(meta_value "$child_meta" project)
-        validate_child_worktree_for_removal "$child_wt" "$child_proj" >/dev/null || return 1
+        validate_child_worktree_for_removal "$child_wt" "$child_proj" "$child_host_root" >/dev/null || return 1
         require_orca_worktree_path_match "$child_orca_worktree_id" "$child_wt" || return 1
       fi
     elif [ -n "$child_wt" ] && [ -e "$child_wt" ]; then
       child_proj=$(meta_value "$child_meta" project)
-      validate_child_worktree_for_removal "$child_wt" "$child_proj" >/dev/null || return 1
+      validate_child_worktree_for_removal "$child_wt" "$child_proj" "$child_host_root" >/dev/null || return 1
     fi
   done
 }
 
 cleanup_firstmate_home_children() {
-  local home=$1 sub_state child_meta child_id child_t child_wt child_proj child_kind child_home child_backend child_host_mode child_orca_worktree_id child_return_rc
+  local home=$1 sub_state child_meta child_id child_t child_wt child_proj child_kind child_home child_backend child_host_mode child_host_root child_orca_worktree_id child_return_rc
   sub_state="$home/state"
   [ -d "$sub_state" ] || return 0
   for child_meta in "$sub_state"/*.meta; do
@@ -1022,6 +1033,7 @@ cleanup_firstmate_home_children() {
     child_backend=$(fm_backend_of_meta "$child_meta")
     child_host_mode=0
     grep -q '^host_root=.' "$child_meta" && child_host_mode=1
+    child_host_root=$(meta_value "$child_meta" host_root)
     if [ "$child_backend" = orca ]; then
       child_t=$(meta_value "$child_meta" terminal)
     else
@@ -1030,7 +1042,7 @@ cleanup_firstmate_home_children() {
     if [ "$child_backend" = orca ] && [ "$child_kind" != secondmate ]; then
       child_orca_worktree_id=$(require_orca_worktree_id "$child_meta") || return 1
       if [ -n "$child_wt" ] && [ -e "$child_wt" ]; then
-        validate_child_worktree_for_removal "$child_wt" "$child_proj" >/dev/null || return 1
+        validate_child_worktree_for_removal "$child_wt" "$child_proj" "$child_host_root" >/dev/null || return 1
       fi
     fi
     if [ "$child_host_mode" -eq 1 ] \
@@ -1039,7 +1051,8 @@ cleanup_firstmate_home_children() {
       echo "error: herdr presentation state for child $child_id requires direct child teardown; refusing destructive cleanup" >&2
       return 1
     elif [ "$child_host_mode" -eq 1 ]; then
-      ( unset FM_ROOT_OVERRIDE FM_CONFIG_OVERRIDE; FM_HOME=$home FM_ROOT=$home fm_backend_stop_and_verify "$child_backend" "$child_t" "$(meta_value "$child_meta" zellij_tab_id)" "fm-$child_id" ) || return 1
+      ( unset FM_ROOT_OVERRIDE FM_CONFIG_OVERRIDE; FM_HOME=$home FM_ROOT=$home \
+        fm_backend_stop_and_verify "$child_backend" "$child_t" "$(meta_value "$child_meta" zellij_tab_id)" "fm-$child_id" 1 ) || return 1
     elif [ -n "$child_t" ]; then
       case "$child_backend" in
         zellij)
@@ -1065,13 +1078,13 @@ cleanup_firstmate_home_children() {
       fi
     elif [ "$child_backend" = orca ]; then
       if [ -n "$child_wt" ] && [ -d "$child_wt" ]; then
-        validate_child_worktree_for_removal "$child_wt" "$child_proj" >/dev/null || return 1
+        validate_child_worktree_for_removal "$child_wt" "$child_proj" "$child_host_root" >/dev/null || return 1
         rm -f "$child_wt/.claude/settings.local.json" "$child_wt/.opencode/plugins/fm-turn-end.js" \
           "$child_wt/.fm-grok-turnend" "$child_wt/.fm-kimi-turnend"
       fi
       fm_backend_remove_worktree "$child_backend" "$child_orca_worktree_id" || return 1
     elif [ -n "$child_wt" ] && [ -d "$child_wt" ]; then
-      validate_child_worktree_for_removal "$child_wt" "$child_proj" >/dev/null || return 1
+      validate_child_worktree_for_removal "$child_wt" "$child_proj" "$child_host_root" >/dev/null || return 1
       rm -f "$child_wt/.claude/settings.local.json" "$child_wt/.opencode/plugins/fm-turn-end.js" \
         "$child_wt/.fm-grok-turnend" "$child_wt/.fm-kimi-turnend"
       if [ -n "$child_proj" ] && [ -d "$child_proj" ] && command -v treehouse >/dev/null 2>&1; then
@@ -1082,10 +1095,10 @@ cleanup_firstmate_home_children() {
           if [ "$child_return_rc" -eq "$TEARDOWN_TREEHOUSE_LOCK_REFUSED" ]; then
             return "$child_return_rc"
           fi
-          safe_rm_rf_child_worktree "$child_wt" "$child_proj"
+          safe_rm_rf_child_worktree "$child_wt" "$child_proj" "$child_host_root"
         fi
       else
-        safe_rm_rf_child_worktree "$child_wt" "$child_proj"
+        safe_rm_rf_child_worktree "$child_wt" "$child_proj" "$child_host_root"
       fi
     fi
     remove_grok_turnend_auth "$sub_state" "$child_id"
@@ -1158,11 +1171,13 @@ if [ "$BACKEND" = orca ] && [ "$KIND" != scout ] && [ "$KIND" != secondmate ] &&
 fi
 
 HERDR_PRESENTATION_JOURNAL="$STATE/$ID.herdr-presentation"
+HERDR_PRESENTATION_JOURNAL_PRESENT=0
 HERDR_PRESENTATION_RETIRE_CANDIDATE=0
 HERDR_PRESENTATION_SESSION=
 HERDR_PRESENTATION_PANE=
 if [ "$BACKEND" = herdr ] \
    && { [ -e "$HERDR_PRESENTATION_JOURNAL" ] || [ -L "$HERDR_PRESENTATION_JOURNAL" ]; }; then
+  HERDR_PRESENTATION_JOURNAL_PRESENT=1
   fm_backend_source herdr || true
   HERDR_PRESENTATION_SESSION=$(meta_value "$META" herdr_session)
   HERDR_PRESENTATION_WORKSPACE=$(meta_value "$META" herdr_workspace_id)
@@ -1179,11 +1194,22 @@ if [ "$BACKEND" = herdr ] \
 fi
 
 stop_task_endpoint_and_verify() {
-  local focus_lock='' focus_lock_held=0 attempt=0 endpoint_state
-  if [ "$HERDR_PRESENTATION_RETIRE_CANDIDATE" != 1 ]; then
-    fm_backend_stop_and_verify "$BACKEND" "$T" "$(meta_value "$META" zellij_tab_id)" "fm-$ID"
+  local focus_lock='' focus_lock_held=0 attempt=0 endpoint_state close_status=0
+  if [ "$BACKEND" != herdr ] || [ "$HERDR_PRESENTATION_JOURNAL_PRESENT" != 1 ]; then
+    fm_backend_stop_and_verify "$BACKEND" "$T" "$(meta_value "$META" zellij_tab_id)" "fm-$ID" "$TASK_HOST_MODE"
     return
   fi
+  if [ -z "$HERDR_PRESENTATION_SESSION" ] \
+     || [ -z "$HERDR_PRESENTATION_PANE" ] \
+     || [ "$T" != "$HERDR_PRESENTATION_SESSION:$HERDR_PRESENTATION_PANE" ]; then
+    echo "error: herdr presentation metadata cannot identify the exact recorded pane; refusing destructive cleanup" >&2
+    return 1
+  fi
+  endpoint_state=$(fm_backend_target_state herdr "$T" "" "" 2>/dev/null)
+  if [ "$endpoint_state" = absent ]; then
+    [ "$HERDR_PRESENTATION_RETIRE_CANDIDATE" != 1 ] || rm -f "$HERDR_PRESENTATION_JOURNAL"
+    return 0
+  fi
 
   # shellcheck source=bin/fm-wake-lib.sh
   . "$SCRIPT_DIR/fm-wake-lib.sh"
@@ -1202,14 +1228,21 @@ stop_task_endpoint_and_verify() {
     return 1
   fi
   fm_backend_herdr_projection_close_pane_focus_preserving \
-    "$HERDR_PRESENTATION_SESSION" "$HERDR_PRESENTATION_PANE" 2>/dev/null || true
-  fm_lock_release "$focus_lock" || true
-  endpoint_state=$(fm_backend_target_state herdr "$T" "" 2>/dev/null)
+    "$HERDR_PRESENTATION_SESSION" "$HERDR_PRESENTATION_PANE" || close_status=$?
+  fm_lock_release "$focus_lock" || {
+    echo "error: herdr presentation focus lock could not be released; preserving cleanup records" >&2
+    return 1
+  }
+  if [ "$close_status" -ne 0 ]; then
+    echo "error: exact herdr task pane could not be confirmed absent; refusing destructive cleanup" >&2
+    return 1
+  fi
+  endpoint_state=$(fm_backend_target_state herdr "$T" "" "" 2>/dev/null)
   if [ "$endpoint_state" != absent ]; then
     echo "error: exact herdr task pane could not be confirmed absent; refusing destructive cleanup" >&2
     return 1
   fi
-  rm -f "$HERDR_PRESENTATION_JOURNAL"
+  [ "$HERDR_PRESENTATION_RETIRE_CANDIDATE" != 1 ] || rm -f "$HERDR_PRESENTATION_JOURNAL"
 }
 
 if [ -d "$WT" ] && [ "$FORCE" != "--force" ]; then
diff --git a/tests/fm-backend-cmux.test.sh b/tests/fm-backend-cmux.test.sh
index ccf1a7f6cb..e4e5081d22 100755
--- a/tests/fm-backend-cmux.test.sh
+++ b/tests/fm-backend-cmux.test.sh
@@ -844,6 +844,40 @@ test_send_text_submit_send_failed_when_target_absent() {
 
 # --- window_of_workspace: which window holds a workspace, and its count ------
 
+test_target_state_scans_every_window() {
+  local dir fb out
+  dir="$TMP_ROOT/target-state-all-windows"; mkdir -p "$dir/responses"
+  cmux_windows_response "$dir" 1 window-1 1 window-2 1
+  cmux_workspace_list_response "$dir" 2 workspace-other other
+  cmux_workspace_list_response "$dir" 3 workspace-target task
+  fb=$(make_cmux_fakebin "$dir")
+  out=$(PATH="$fb:$PATH" FM_CMUX_LOG="$dir/log" FM_CMUX_RESPONSES="$dir/responses" \
+    bash -c '. "$0/bin/backends/cmux.sh"; fm_backend_cmux_target_state workspace-target:surface-target' "$ROOT")
+  [ "$out" = present ] || fail "target_state missed a workspace in another cmux window: '$out'"
+  assert_contains "$(cat "$dir/log")" $'\x1f''--window'$'\x1f''window-1' \
+    "target_state did not scan the first cmux window"
+  assert_contains "$(cat "$dir/log")" $'\x1f''--window'$'\x1f''window-2' \
+    "target_state did not scan the second cmux window"
+
+  dir="$TMP_ROOT/target-state-all-windows-absent"; mkdir -p "$dir/responses"
+  cmux_windows_response "$dir" 1 window-1 1 window-2 1
+  cmux_workspace_list_response "$dir" 2 workspace-one one
+  cmux_workspace_list_response "$dir" 3 workspace-two two
+  fb=$(make_cmux_fakebin "$dir")
+  out=$(PATH="$fb:$PATH" FM_CMUX_LOG="$dir/log" FM_CMUX_RESPONSES="$dir/responses" \
+    bash -c '. "$0/bin/backends/cmux.sh"; fm_backend_cmux_target_state workspace-target:surface-target' "$ROOT")
+  [ "$out" = absent ] || fail "target_state did not prove absence across every cmux window: '$out'"
+
+  dir="$TMP_ROOT/target-state-window-unreadable"; mkdir -p "$dir/responses"
+  cmux_windows_response "$dir" 1 window-1 1
+  printf '1\n' > "$dir/responses/2.exit"
+  fb=$(make_cmux_fakebin "$dir")
+  out=$(PATH="$fb:$PATH" FM_CMUX_LOG="$dir/log" FM_CMUX_RESPONSES="$dir/responses" \
+    bash -c '. "$0/bin/backends/cmux.sh"; fm_backend_cmux_target_state workspace-target:surface-target' "$ROOT")
+  [ "$out" = unknown ] || fail "target_state treated an unreadable cmux window as absence: '$out'"
+  pass "fm_backend_cmux_target_state scans every window before proving absence"
+}
+
 test_window_of_workspace_finds_window_and_count() {
   local dir fb out
   dir="$TMP_ROOT/win-of-ws"; mkdir -p "$dir/responses"
@@ -1022,7 +1056,8 @@ test_forced_secondmate_teardown_uses_child_cmux_config() {
   cmux_windows_response "$dir" 5 win-child 2
   cmux_workspace_list_response "$dir" 6 ws-child "$child_title" ws-other default
   : > "$dir/responses/7.out"
-  printf '{"workspaces":[]}' > "$dir/responses/8.out"
+  cmux_windows_response "$dir" 8 win-child 1
+  cmux_workspace_list_response "$dir" 9 ws-other default
   fb=$(make_cmux_fakebin "$dir")
   cat > "$fb/tmux" <<'SH'
 #!/usr/bin/env bash
@@ -1114,6 +1149,7 @@ test_send_text_submit_detects_landed_send
 test_send_text_submit_detects_swallowed_enter
 test_send_text_submit_popup_autocomplete_requires_second_enter
 test_send_text_submit_send_failed_when_target_absent
+test_target_state_scans_every_window
 test_window_of_workspace_finds_window_and_count
 test_window_of_workspace_empty_when_not_found
 test_kill_closes_workspace_directly_when_not_last
diff --git a/tests/fm-backend-zellij.test.sh b/tests/fm-backend-zellij.test.sh
index 042d31aa34..76e9168df2 100755
--- a/tests/fm-backend-zellij.test.sh
+++ b/tests/fm-backend-zellij.test.sh
@@ -705,6 +705,37 @@ test_current_path_ignores_tilde_prefixed_banner_lines() {
   pass "fm_backend_zellij_current_path: never picks up a ~-prefixed banner line as the answer"
 }
 
+test_target_state_requires_tab_absence() {
+  local dir fb out
+  dir="$TMP_ROOT/target-state-tab-present"; mkdir -p "$dir/responses"
+  printf '[]\n' > "$dir/responses/1.out"
+  zellij_tab_response "$dir" 2 3 other
+  fb=$(make_zellij_fakebin "$dir")
+  out=$(PATH="$fb:$PATH" FM_ZELLIJ_LOG="$dir/log" FM_ZELLIJ_RESPONSES="$dir/responses" \
+    FM_ZELLIJ_SESSION_LIST=firstmate \
+    bash -c '. "$0/bin/backends/zellij.sh"; fm_backend_zellij_target_state firstmate:7 3 fm-zghost' "$ROOT")
+  [ "$out" = present ] || fail "target_state treated a surviving recorded tab as absent: '$out'"
+
+  dir="$TMP_ROOT/target-state-label-present"; mkdir -p "$dir/responses"
+  printf '[]\n' > "$dir/responses/1.out"
+  zellij_tab_response "$dir" 2 4 fm-zghost
+  fb=$(make_zellij_fakebin "$dir")
+  out=$(PATH="$fb:$PATH" FM_ZELLIJ_LOG="$dir/log" FM_ZELLIJ_RESPONSES="$dir/responses" \
+    FM_ZELLIJ_SESSION_LIST=firstmate \
+    bash -c '. "$0/bin/backends/zellij.sh"; fm_backend_zellij_target_state firstmate:7 3 fm-zghost' "$ROOT")
+  [ "$out" = present ] || fail "target_state treated a replacement task-labeled tab as absent: '$out'"
+
+  dir="$TMP_ROOT/target-state-tab-absent"; mkdir -p "$dir/responses"
+  printf '[]\n' > "$dir/responses/1.out"
+  printf '[]\n' > "$dir/responses/2.out"
+  fb=$(make_zellij_fakebin "$dir")
+  out=$(PATH="$fb:$PATH" FM_ZELLIJ_LOG="$dir/log" FM_ZELLIJ_RESPONSES="$dir/responses" \
+    FM_ZELLIJ_SESSION_LIST=firstmate \
+    bash -c '. "$0/bin/backends/zellij.sh"; fm_backend_zellij_target_state firstmate:7 3 fm-zghost' "$ROOT")
+  [ "$out" = absent ] || fail "target_state did not prove pane and tab absence: '$out'"
+  pass "fm_backend_zellij_target_state proves both recorded pane and tab absence"
+}
+
 test_kill_resolves_tab_and_closes_by_id() {
   local dir fb
   dir="$TMP_ROOT/kill"; mkdir -p "$dir/responses"
@@ -722,6 +753,22 @@ test_kill_resolves_tab_and_closes_by_id() {
   pass "fm_backend_zellij_kill: resolves the owning tab id fresh and calls close-tab-by-id (never a bare close-pane)"
 }
 
+test_kill_propagates_close_tab_failure() {
+  local dir fb status=0
+  dir="$TMP_ROOT/kill-close-failure"; mkdir -p "$dir/responses"
+  zellij_pane_response "$dir" 1 7 3
+  printf '1\n' > "$dir/responses/2.exit"
+  fb=$(make_zellij_fakebin "$dir")
+  PATH="$fb:$PATH" FM_ZELLIJ_LOG="$dir/log" FM_ZELLIJ_RESPONSES="$dir/responses" \
+    FM_ZELLIJ_SESSION_LIST=firstmate \
+    bash -c '. "$0/bin/backends/zellij.sh"; fm_backend_zellij_kill firstmate:7' "$ROOT" \
+    || status=$?
+  expect_code 1 "$status" "kill must propagate a close-tab-by-id failure"
+  assert_contains "$(cat "$dir/log")" $'\x1f''close-tab-by-id'$'\x1f''3' \
+    "kill did not attempt the recorded tab close"
+  pass "fm_backend_zellij_kill propagates close-tab-by-id failures"
+}
+
 test_kill_falls_back_to_close_pane_when_tab_lookup_empty() {
   local dir fb
   dir="$TMP_ROOT/kill-fallback"; mkdir -p "$dir/responses"
@@ -1061,7 +1108,9 @@ test_expected_label_allows_matching_task_tab
 test_expected_label_rejects_reused_pane_id
 test_current_path_probes_with_marker_and_ignores_prompt_paths
 test_current_path_ignores_tilde_prefixed_banner_lines
+test_target_state_requires_tab_absence
 test_kill_resolves_tab_and_closes_by_id
+test_kill_propagates_close_tab_failure
 test_kill_falls_back_to_close_pane_when_tab_lookup_empty
 test_kill_closes_recorded_tab_when_pane_already_gone
 test_kill_skips_recorded_tab_when_label_mismatches
diff --git a/tests/fm-backend.test.sh b/tests/fm-backend.test.sh
index 4d9206a995..17d4e42225 100755
--- a/tests/fm-backend.test.sh
+++ b/tests/fm-backend.test.sh
@@ -1148,11 +1148,17 @@ test_adapter_target_state_matrices() {
     . "$1/bin/fm-backend.sh"; fm_backend_source cmux
     fm_backend_cmux_ping_state() { printf ok; }
     fm_backend_cmux_cli() {
-      case "$CASE" in
-        present) printf "%s" "{\"workspaces\":[{\"id\":\"ws-7\"}]}" ;;
-        absent) printf "%s" "{\"workspaces\":[]}" ;;
-        unknown) printf "%s" "not-json" ;;
-      esac
+      if [ "$1" = list-windows ]; then
+        case "$CASE" in
+          present|absent) printf "%s" "[{\"id\":\"window-1\"}]" ;;
+          unknown) printf "%s" "not-json" ;;
+        esac
+      else
+        case "$CASE" in
+          present) printf "%s" "{\"workspaces\":[{\"id\":\"ws-7\"}]}" ;;
+          absent) printf "%s" "{\"workspaces\":[]}" ;;
+        esac
+      fi
     }
     for CASE in present absent unknown; do fm_backend_cmux_target_state ws-7:surface-7; printf " "; done
   ' _ "$ROOT")
@@ -1171,6 +1177,62 @@ test_stop_and_verify_requires_confirmed_absence() {
   assert_contains "$out" 'missing backend endpoint id' "missing endpoint refusal did not explain the unsafe metadata"
   assert_not_contains "$out" 'called' "missing endpoint refusal invoked a backend kill"
 
+  status=0
+  out=$(bash -c '
+    . "$1/bin/fm-backend.sh"; fm_backend_source tmux
+    fm_backend_tmux_canonical_window() { return 2; }
+    fm_backend_kill() { printf called; }
+    fm_backend_stop_and_verify tmux session:renamed "" "" 1
+  ' _ "$ROOT" 2>&1) || status=$?
+  expect_code 1 "$status" "an unresolved legacy tmux alias must not prove absence"
+  assert_contains "$out" 'could not be resolved to a stable tmux window' \
+    "unresolved legacy tmux alias did not explain the refusal"
+  assert_not_contains "$out" 'called' "unresolved legacy tmux alias invoked a backend kill"
+
+  status=0
+  out=$(bash -c '
+    . "$1/bin/fm-backend.sh"; fm_backend_source tmux
+    fm_backend_tmux_canonical_window() { return 2; }
+    fm_backend_kill() { printf called; }
+    fm_backend_stop_and_verify tmux session:renamed
+  ' _ "$ROOT" 2>&1) || status=$?
+  expect_code 0 "$status" "unset-mode teardown must preserve legacy missing-alias behavior"
+  [ -z "$out" ] || fail "unset-mode legacy missing alias emitted unexpected output: $out"
+
+  status=0
+  out=$(bash -c '
+    . "$1/bin/fm-backend.sh"; fm_backend_source tmux
+    fm_backend_tmux_canonical_window() { return 2; }
+    fm_backend_kill() { printf called; }
+    fm_backend_stop_and_verify tmux @7
+  ' _ "$ROOT" 2>&1) || status=$?
+  expect_code 0 "$status" "a missing immutable tmux window id should prove absence"
+  [ -z "$out" ] || fail "missing immutable tmux window id emitted unexpected output: $out"
+
+  status=0
+  bash -c '
+    . "$1/bin/fm-backend.sh"; fm_backend_source tmux
+    tmux() {
+      printf "%s\n" \
+        "%1|@1|session:duplicate|session:duplicate.0|session:1|session:1.0" \
+        "%2|@2|session:duplicate|session:duplicate.0|session:2|session:2.0"
+    }
+    fm_backend_tmux_canonical_window session:duplicate >/dev/null
+  ' _ "$ROOT" || status=$?
+  expect_code 1 "$status" "duplicate tmux names must not resolve to an arbitrary window"
+
+  out=$(bash -c '
+    . "$1/bin/fm-backend.sh"; fm_backend_source tmux
+    tmux() {
+      case "$1" in
+        list-panes) printf "@7\n" ;;
+        display-message) printf "codex\n" ;;
+      esac
+    }
+    fm_backend_agent_state tmux @7
+  ' _ "$ROOT")
+  [ "$out" = alive ] || fail "stable tmux window id agent state drifted: '$out'"
+
   status=0
   out=$(FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 bash -c '
     . "$1/bin/fm-backend.sh"; fm_backend_source tmux
diff --git a/tests/fm-host-root-mode.test.sh b/tests/fm-host-root-mode.test.sh
index 82286992a3..21e30efcb1 100644
--- a/tests/fm-host-root-mode.test.sh
+++ b/tests/fm-host-root-mode.test.sh
@@ -67,6 +67,38 @@ test_resolution_and_validation() {
   pass "host-root library resolves physical paths and rejects unsafe, harness-specific, or overlapping roots"
 }
 
+test_host_owner_publication_is_atomic() {
+  local dir="$TMP/owner-publication" meta owner out status=0 mode
+  mkdir -p "$dir/fakebin"
+  meta="$dir/task.meta"
+  owner="$dir/host-root"
+  printf 'host_root=%s\n' "$dir/host" > "$meta"
+  cat > "$dir/fakebin/mv" <<'SH'
+#!/usr/bin/env bash
+exit 1
+SH
+  chmod +x "$dir/fakebin/mv"
+
+  out=$(PATH="$dir/fakebin:$PATH" bash -c \
+    '. "$1"; fm_host_root_persist_task_owner "$2" "$3"' _ "$LIB" "$meta" "$owner" 2>&1) || status=$?
+  expect_code 2 "$status" "failed host-owner publication must be reported"
+  assert_contains "$out" 'could not persist host owner' "failed host-owner publication was not explicit"
+  assert_absent "$owner" "failed host-owner publication left a partial durable record"
+  [ -z "$(find "$dir" -name 'host-root.tmp.*' -print -quit)" ] \
+    || fail "failed host-owner publication left its temporary file"
+
+  bash -c '. "$1"; fm_host_root_persist_task_owner "$2" "$3"' _ "$LIB" "$meta" "$owner" \
+    || fail "atomic host-owner publication failed"
+  assert_grep "host_root=$dir/host" "$owner" "atomic host-owner publication lost its value"
+  if [ "$(uname -s)" = Darwin ]; then
+    mode=$(stat -f '%Lp' "$owner")
+  else
+    mode=$(stat -c '%a' "$owner")
+  fi
+  [ "$mode" = 600 ] || fail "host-owner publication used mode $mode instead of 600"
+  pass "host-owner publication is atomic and leaves no partial durable record"
+}
+
 test_session_cwd_mismatch_precedes_mutation() {
   local host="$TMP/session-host" home="$TMP/session-home" other="$TMP/session-other" fake_root out status=0
   make_host "$host"; mkdir -p "$home/state" "$home/data" "$home/config" "$other"
@@ -220,7 +252,7 @@ case "${1:-}" in
     case "$*" in
       *'#{pane_current_path}'*) [ -f "$endpoint" ] && cat "$FM_CURRENT_PATH" ;;
       *'#{cursor_y}'*) printf '0\n' ;;
-      *'#{window_id}'*) [ -f "$endpoint" ] && printf '%%1\n' ;;
+      *'#{window_id}'*) [ -f "$endpoint" ] && printf '@1\n' ;;
       *'#{pane_id}'*) [ -f "$endpoint" ] && printf '%%1\n' ;;
       *) printf 'test-session\n' ;;
     esac
@@ -280,7 +312,7 @@ case "${1:-}" in
     fi
     ;;
   has-session|new-session|set-window-option) ;;
-  new-window) : > "$endpoint"; printf '%%1\n' ;;
+  new-window) : > "$endpoint"; printf '@1\n' ;;
   kill-window)
     [ -z "${FM_TMUX_KILL_MUTATION:-}" ] || printf 'late worker edit\n' > "$FM_TMUX_KILL_MUTATION"
     [ "${FM_REFUSE_STOP:-0}" = 1 ] || rm -f "$endpoint"
@@ -366,6 +398,7 @@ test_spawn_separates_roots() {
   meta="$home/state/lane.meta"
   assert_grep "worktree=$wt" "$meta" "spawn meta lost target worktree"
   assert_grep "host_root=$host" "$meta" "spawn meta lost host root"
+  assert_grep 'window=@1' "$meta" "host-root spawn did not persist the immutable tmux window id"
   assert_contains "$(cat "$log")" "FM_TARGET_WORKTREE='$wt'" "child launch did not export exact target worktree"
   assert_contains "$(cat "$log")" "FM_HOST_ROOT='$host'" "child launch did not export exact host root"
   assert_contains "$(cat "$log")" 'notify=[' "Codex FirstMate turn-end safeguard was not retained"
@@ -1096,6 +1129,47 @@ SH
   pass "forced secondmate teardown preserves tmux aliases and projected Herdr children during recursive cleanup"
 }
 
+test_secondmate_force_teardown_refuses_recursive_host_overlap_before_mutation() {
+  local case_root="$TMP/recursive-host-overlap" home subhome childproj host fb log current tree_log out status=0
+  home="$case_root/home"
+  subhome="$case_root/subhome"
+  childproj="$subhome/projects/alpha"
+  host="$case_root/host"
+  mkdir -p "$home/state" "$home/data" "$home/config" "$subhome/state"
+  fm_git_worktree "$childproj" "$host" recursive-overlap
+  : > "$host/AGENTS.md"
+  printf 'domain\n' > "$subhome/.fm-secondmate-home"
+  fm_write_meta "$home/state/domain.meta" \
+    'window=test-session:fm-domain' "worktree=$subhome" "project=$subhome" \
+    'harness=echo' 'kind=secondmate' 'mode=secondmate' "home=$subhome" 'projects=alpha'
+  fm_write_meta "$subhome/state/child.meta" \
+    'window=@1' "worktree=$host" "project=$childproj" \
+    "host_root=$host" 'harness=echo' 'kind=ship' 'mode=no-mistakes'
+  fb=$(make_fakebin "$case_root/fake")
+  log="$case_root/backend.log"
+  current="$case_root/current"
+  tree_log="$case_root/treehouse.log"
+  printf '%s\n' "$host" > "$current"
+  : > "$current.endpoint"
+  : > "$log"
+  : > "$tree_log"
+
+  out=$(PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
+    FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$case_root/unused.launch" FM_CURRENT_PATH="$current" \
+    FM_TARGET_PATH="$host" FM_HOST_PATH="$host" FM_TREEHOUSE_LOG="$tree_log" \
+    "$ROOT/bin/fm-teardown.sh" domain --force 2>&1) || status=$?
+  [ "$status" -ne 0 ] || fail "recursive teardown accepted an overlapping child host and target"
+  assert_contains "$out" 'child host and target roots overlap' \
+    "recursive overlap refusal did not explain the unsafe child roots"
+  assert_present "$current.endpoint" "recursive overlap refusal stopped the child endpoint"
+  assert_present "$subhome/state/child.meta" "recursive overlap refusal removed child recovery metadata"
+  assert_present "$home/state/domain.meta" "recursive overlap refusal removed parent recovery metadata"
+  assert_present "$host" "recursive overlap refusal removed the authoritative host"
+  [ ! -s "$log" ] || fail "recursive overlap refusal touched the child endpoint"
+  [ ! -s "$tree_log" ] || fail "recursive overlap refusal invoked treehouse"
+  pass "recursive teardown rejects overlapping child host and target before mutation"
+}
+
 test_task_actions_use_recorded_host_root() {
   local host="$TMP/recorded-host" wrong="$TMP/wrong-host" home="$TMP/recorded-home" fb log current out status=0
   make_host "$host"; make_host "$wrong"; mkdir -p "$home/state" "$home/config"
@@ -1191,6 +1265,7 @@ test_spawn_rejects_old_brief_and_secondmate_clears_roots() {
 }
 
 test_resolution_and_validation
+test_host_owner_publication_is_atomic
 test_session_cwd_mismatch_precedes_mutation
 test_host_command_rendering
 test_brief_variants
@@ -1209,5 +1284,6 @@ test_decision_actions_use_durable_host_owner
 test_host_teardown_requires_confirmed_stop
 test_host_teardown_refuses_recorded_overlap_before_mutation
 test_secondmate_force_teardown_preserves_host_children_during_recursive_cleanup
+test_secondmate_force_teardown_refuses_recursive_host_overlap_before_mutation
 test_task_actions_use_recorded_host_root
 test_spawn_rejects_old_brief_and_secondmate_clears_roots
diff --git a/tests/fm-teardown.test.sh b/tests/fm-teardown.test.sh
index 1dfd8ce9a2..16facdfe13 100755
--- a/tests/fm-teardown.test.sh
+++ b/tests/fm-teardown.test.sh
@@ -499,6 +499,7 @@ run_teardown() {
   local case_dir=$1; shift
   FM_ROOT_OVERRIDE="$ROOT" \
   FM_STATE_OVERRIDE="$case_dir/state" \
+  FM_DATA_OVERRIDE="$case_dir/data" \
   FM_CONFIG_OVERRIDE="$case_dir/config" \
   PATH="$case_dir/fakebin:$PATH" \
     "$TEARDOWN" task-x1 "$@"
@@ -1392,6 +1393,7 @@ case "${1:-} ${2:-}" in
     printf '%s\n' '{"result":{"tab":{"tab_id":"w2:t2","workspace_id":"w2"}}}'
     ;;
   "tab focus")
+    [ "${FM_FAKE_HERDR_RESTORE_FAIL:-0}" != 1 ] || exit 1
     : > "${FM_FAKE_HERDR_RESTORED:?}"
     printf '%s\n' '{"result":{"tab":{"tab_id":"w2:t2","workspace_id":"w2","focused":true}}}'
     ;;
@@ -1452,6 +1454,64 @@ test_herdr_projection_teardown_retains_journal_when_close_unconfirmed() {
   pass "herdr projection teardown retains task state and refuses destructive cleanup when exact-pane close is unconfirmed"
 }
 
+test_herdr_projection_teardown_uses_focus_safe_close_without_token_correlation() {
+  local case_dir log closed restored host
+  case_dir=$(make_case herdr-projection-token-mismatch)
+  write_meta "$case_dir" local-only ship
+  host="$case_dir/host"
+  mkdir -p "$host"
+  : > "$host/AGENTS.md"
+  printf 'host_root=%s\n' "$host" >> "$case_dir/state/task-x1.meta"
+  configure_herdr_projection_teardown_case "$case_dir"
+  sed -i.bak 's/^projection_id=.*/projection_id=ZyXwVuTsRqPoNmLkJiHgFe/' \
+    "$case_dir/state/task-x1.herdr-presentation"
+  rm -f "$case_dir/state/task-x1.herdr-presentation.bak"
+  log="$case_dir/herdr.log"; closed="$case_dir/closed"; restored="$case_dir/restored"; : > "$log"
+
+  (cd "$host" && FM_HOST_ROOT="$host" FM_FAKE_HERDR_LOG="$log" FM_FAKE_HERDR_CLOSED="$closed" \
+    FM_FAKE_HERDR_RESTORED="$restored" \
+    run_teardown "$case_dir" --force > "$case_dir/stdout" 2> "$case_dir/stderr") \
+    || fail "herdr-projection-token-mismatch: focus-safe teardown failed"
+  assert_contains "$(cat "$log")" "pane close w1:p2" \
+    "token-mismatched journal bypassed the exact focus-safe pane close"
+  assert_contains "$(cat "$log")" "tab focus w2:t2" \
+    "token-mismatched journal did not restore the exact pre-close active tab"
+  assert_not_contains "$(cat "$log")" "workspace close" \
+    "token-mismatched journal attempted workspace cleanup"
+  assert_present "$case_dir/state/task-x1.herdr-presentation" \
+    "token-mismatched journal was retired without correlation"
+  pass "journal-backed Herdr teardown preserves focus even without token correlation"
+}
+
+test_herdr_projection_teardown_retains_cleanup_when_focus_restore_fails() {
+  local case_dir log closed restored host status=0
+  case_dir=$(make_case herdr-projection-restore-failure)
+  write_meta "$case_dir" local-only ship
+  host="$case_dir/host"
+  mkdir -p "$host"
+  : > "$host/AGENTS.md"
+  printf 'host_root=%s\n' "$host" >> "$case_dir/state/task-x1.meta"
+  configure_herdr_projection_teardown_case "$case_dir"
+  log="$case_dir/herdr.log"; closed="$case_dir/closed"; restored="$case_dir/restored"; : > "$log"
+
+  (cd "$host" && FM_HOST_ROOT="$host" FM_FAKE_HERDR_LOG="$log" FM_FAKE_HERDR_CLOSED="$closed" \
+    FM_FAKE_HERDR_RESTORED="$restored" FM_FAKE_HERDR_RESTORE_FAIL=1 \
+    run_teardown "$case_dir" --force > "$case_dir/stdout" 2> "$case_dir/stderr") \
+    || status=$?
+  [ "$status" -ne 0 ] || fail "herdr-projection-restore-failure: teardown ignored failed focus restoration"
+  assert_present "$case_dir/state/task-x1.herdr-presentation" \
+    "failed focus restoration retired the presentation journal"
+  assert_present "$case_dir/state/task-x1.meta" \
+    "failed focus restoration removed recovery metadata"
+  assert_present "$case_dir/wt" \
+    "failed focus restoration removed the isolated worktree"
+  assert_grep 'exact-tab restoration failed' "$case_dir/stderr" \
+    "failed focus restoration did not explain the cleanup refusal"
+  assert_not_contains "$(cat "$log")" "workspace close" \
+    "failed focus restoration escalated to workspace cleanup"
+  pass "Herdr teardown retains cleanup records when focus restoration fails"
+}
+
 test_local_only_fork_remote_allows
 test_teardown_removes_host_root_adapter_state
 test_teardown_prompts_tasks_axi_done_when_compatible
@@ -1465,6 +1525,8 @@ test_unconfirmed_stop_preserves_worktree
 test_herdr_teardown_clears_escalation_marker
 test_herdr_projection_teardown_retires_journal_only_after_confirmed_close
 test_herdr_projection_teardown_retains_journal_when_close_unconfirmed
+test_herdr_projection_teardown_uses_focus_safe_close_without_token_correlation
+test_herdr_projection_teardown_retains_cleanup_when_focus_restore_fails
 test_squash_merged_branch_deleted_allows
 test_squash_merged_pr_allows_when_head_ancestor_of_pr_head
 test_no_pr_recorded_discovers_merged_pr_by_branch_allows

From 6d7baa48c653e5d1c82c2d7daeef2f40398ef71a Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Mon, 27 Jul 2026 13:22:28 +0300
Subject: [PATCH 21/39] no-mistakes(review): Bind tmux identity and close
 cross-window cmux tasks

---
 bin/backends/cmux.sh            | 118 +++++++++++++++++++-------------
 bin/backends/tmux.sh            |  77 +++++++++++++++------
 bin/fm-backend.sh               |  43 +++++++++---
 bin/fm-peek.sh                  |   1 +
 bin/fm-send.sh                  |   1 +
 bin/fm-spawn.sh                 |  15 +++-
 bin/fm-teardown.sh              |   4 +-
 tests/fm-backend-cmux.test.sh   |  33 ++++-----
 tests/fm-backend.test.sh        |  37 +++++++++-
 tests/fm-host-root-mode.test.sh |  68 ++++++++++++------
 10 files changed, 270 insertions(+), 127 deletions(-)

diff --git a/bin/backends/cmux.sh b/bin/backends/cmux.sh
index 75a7ef58bb..b7689d6dcf 100644
--- a/bin/backends/cmux.sh
+++ b/bin/backends/cmux.sh
@@ -389,6 +389,50 @@ fm_backend_cmux_parse_target() {  # <target>
   [ -n "$FM_BACKEND_CMUX_WORKSPACE" ] && [ -n "$FM_BACKEND_CMUX_SURFACE" ] && [ "$FM_BACKEND_CMUX_SURFACE" != "$target" ]
 }
 
+fm_backend_cmux_workspace_across_windows() {  # <workspace_id> [expected-title] -> "<workspace_id>\t<window_id>\t<count>"
+  local wsid=$1 expected_title=${2:-} wins window_ids window_id workspaces count
+  local current_id title id_match= label_match= id_count=0 label_count=0 id_conflict=0
+  wins=$(fm_backend_cmux_cli list-windows --json --id-format uuids 2>&1) || return 1
+  printf '%s' "$wins" | jq -e 'type == "array" and all(.[]?; .id | type == "string")' >/dev/null 2>&1 || return 1
+  window_ids=$(printf '%s' "$wins" | jq -r '.[].id' 2>/dev/null) || return 1
+  while IFS= read -r window_id; do
+    [ -n "$window_id" ] || continue
+    workspaces=$(fm_backend_cmux_cli workspace list --json --id-format uuids --window "$window_id" 2>&1) || return 1
+    printf '%s' "$workspaces" | jq -e '
+      (.workspaces | type == "array")
+      and all(.workspaces[]?; (.id | type == "string") and ((.title // "") | type == "string"))
+    ' >/dev/null 2>&1 || return 1
+    count=$(printf '%s' "$workspaces" | jq -r '.workspaces | length' 2>/dev/null) || return 1
+    while IFS=$'\t' read -r current_id title; do
+      [ -n "$current_id" ] || continue
+      if [ "$current_id" = "$wsid" ]; then
+        id_count=$((id_count + 1))
+        if [ -n "$expected_title" ] && [ "$title" != "$expected_title" ]; then
+          id_conflict=1
+        else
+          id_match=$(printf '%s\t%s\t%s' "$current_id" "$window_id" "$count")
+        fi
+      fi
+      if [ -n "$expected_title" ] && [ "$title" = "$expected_title" ]; then
+        label_count=$((label_count + 1))
+        label_match=$(printf '%s\t%s\t%s' "$current_id" "$window_id" "$count")
+      fi
+    done < <(printf '%s' "$workspaces" | jq -r '.workspaces[]? | [.id, (.title // "")] | @tsv' 2>/dev/null)
+  done <<EOF
+$window_ids
+EOF
+  [ "$id_count" -le 1 ] && [ "$label_count" -le 1 ] && [ "$id_conflict" -eq 0 ] || return 1
+  if [ -n "$id_match" ]; then
+    printf '%s' "$id_match"
+    return 0
+  fi
+  if [ -n "$label_match" ]; then
+    printf '%s' "$label_match"
+    return 0
+  fi
+  return 2
+}
+
 # fm_backend_cmux_surface_exists: does <surface_id> currently appear as one of
 # <workspace_id>'s surfaces, per list-panes? Structural existence check, never
 # a content read.
@@ -444,41 +488,19 @@ fm_backend_cmux_target_ready() {  # <target> [expected-label]
 # Tri-state endpoint probe for destructive cleanup. A successful workspace
 # inventory proves presence or absence; socket/auth/JSON failures stay unknown.
 fm_backend_cmux_target_state() {  # <target> [expected-label] -> present|absent|unknown
-  local expected_label=${2:-} expected_title windows window_ids window_id workspaces
+  local expected_label=${2:-} expected_title state
   fm_backend_cmux_parse_target "$1" || { printf 'unknown'; return 0; }
   [ "$(fm_backend_cmux_ping_state)" = ok ] || { printf 'unknown'; return 0; }
-  windows=$(fm_backend_cmux_cli list-windows --json --id-format uuids 2>&1) || {
-    printf 'unknown'
-    return 0
-  }
-  if ! printf '%s' "$windows" | jq -e 'type == "array"' >/dev/null 2>&1; then
-    printf 'unknown'
-    return 0
-  fi
-  window_ids=$(printf '%s' "$windows" | jq -r '.[]? | .id // empty' 2>/dev/null)
   if [ -n "$expected_label" ]; then
     expected_title=$(fm_backend_cmux_scoped_title "$expected_label")
   fi
-  while IFS= read -r window_id; do
-    [ -n "$window_id" ] || continue
-    workspaces=$(fm_backend_cmux_cli workspace list --json --id-format uuids --window "$window_id" 2>&1) || {
-      printf 'unknown'
-      return 0
-    }
-    if ! printf '%s' "$workspaces" | jq -e '.workspaces | type == "array"' >/dev/null 2>&1; then
-      printf 'unknown'
-      return 0
-    fi
-    if printf '%s' "$workspaces" | jq -e \
-      --arg id "$FM_BACKEND_CMUX_WORKSPACE" --arg title "${expected_title:-}" \
-      'any(.workspaces[]?; .id == $id or ($title != "" and .title == $title))' >/dev/null 2>&1; then
-      printf 'present'
-      return 0
-    fi
-  done <<EOF
-$window_ids
-EOF
-  printf 'absent'
+  fm_backend_cmux_workspace_across_windows "$FM_BACKEND_CMUX_WORKSPACE" "${expected_title:-}" >/dev/null
+  state=$?
+  case "$state" in
+    0) printf 'present' ;;
+    2) printf 'absent' ;;
+    *) printf 'unknown' ;;
+  esac
 }
 
 # fm_backend_cmux_current_path: the live foreground process's cwd, or empty on
@@ -655,19 +677,12 @@ fm_backend_cmux_send_text_submit() {  # <target> <text> <retries> <enter-sleep>
 # window from `list-windows --json` and asking each for its own scoped list.
 # The count comes from the same scoped workspace list that confirms membership.
 fm_backend_cmux_window_of_workspace() {  # <workspace_id> -> "<window_id> <count>"
-  local wsid=$1 wins wid wss count
-  wins=$(fm_backend_cmux_cli list-windows --json --id-format uuids 2>/dev/null) || return 0
-  while IFS= read -r wid; do
-    [ -n "$wid" ] || continue
-    wss=$(fm_backend_cmux_cli workspace list --json --id-format uuids --window "$wid" 2>/dev/null) || continue
-    count=$(printf '%s' "$wss" | jq -er --arg id "$wsid" '
-      (.workspaces // []) as $workspaces
-      | select(any($workspaces[]?; .id == $id))
-      | ($workspaces | length)
-    ' 2>/dev/null) || continue
-    printf '%s %s' "$wid" "$count"
-    return 0
-  done < <(printf '%s' "$wins" | jq -r '.[]? | .id' 2>/dev/null)
+  local match wsid win count
+  match=$(fm_backend_cmux_workspace_across_windows "$1") || return 0
+  IFS=$'\t' read -r wsid win count <<EOF
+$match
+EOF
+  printf '%s %s' "$win" "$count"
 }
 
 # fm_backend_cmux_kill: remove the task's whole workspace, best-effort (mirrors
@@ -687,16 +702,21 @@ fm_backend_cmux_window_of_workspace() {  # <workspace_id> -> "<window_id> <count
 # leaving that window a fresh default workspace (never an fm-<home>- title, so
 # recovery/list_live ignore it) - cmux's own "closed the last tab" outcome.
 fm_backend_cmux_kill() {  # <target> [unused] [expected-label]
-  local expected_label=${3:-} wsid wininfo win count
+  local expected_label=${3:-} expected_title match wsid wininfo win count
   if [ -n "$expected_label" ]; then
-    fm_backend_cmux_target_ready "$1" "$expected_label" || return 0
+    fm_backend_cmux_parse_target "$1" || return 0
+    expected_title=$(fm_backend_cmux_scoped_title "$expected_label")
+    match=$(fm_backend_cmux_workspace_across_windows "$FM_BACKEND_CMUX_WORKSPACE" "$expected_title") || return 0
+    IFS=$'\t' read -r wsid win count <<EOF
+$match
+EOF
   else
     fm_backend_cmux_parse_target "$1" || return 0
+    wsid=$FM_BACKEND_CMUX_WORKSPACE
+    wininfo=$(fm_backend_cmux_window_of_workspace "$wsid")
+    win=${wininfo%% *}
+    count=${wininfo##* }
   fi
-  wsid=$FM_BACKEND_CMUX_WORKSPACE
-  wininfo=$(fm_backend_cmux_window_of_workspace "$wsid")
-  win=${wininfo%% *}
-  count=${wininfo##* }
   if [ -n "$win" ] && [ "$count" = 1 ]; then
     fm_backend_cmux_cli new-workspace --window "$win" --focus false --id-format uuids >/dev/null 2>&1 || true
   fi
diff --git a/bin/backends/tmux.sh b/bin/backends/tmux.sh
index 4f4d56c48c..c8b81e3f6e 100644
--- a/bin/backends/tmux.sh
+++ b/bin/backends/tmux.sh
@@ -67,6 +67,17 @@ fm_backend_tmux_container_ensure() {
   fi
 }
 
+fm_backend_tmux_task_marker() {
+  local token
+  token=$(dd if=/dev/urandom bs=16 count=1 2>/dev/null \
+    | base64 \
+    | tr '+/' '-_' \
+    | tr -d '=\r\n') || return 1
+  [ "${#token}" -eq 22 ] || return 1
+  case "$token" in *[!A-Za-z0-9_-]*) return 1 ;; esac
+  printf 'fm-%s' "$token"
+}
+
 # fm_backend_tmux_create_task: create the task's window in <proj-abs>,
 # refusing an existing <window-name> in <session>. Mirrors fm-spawn.sh's
 # duplicate-check-then-new-window sequence, including the exact error text
@@ -82,13 +93,17 @@ fm_backend_tmux_container_ensure() {
 #     treehouse cd's into the worktree, which would break name-based targeting.
 # The returned window id lets callers target the window even if its name is ever
 # lost, so worktree discovery cannot fall back to the active client's window.
-fm_backend_tmux_create_task() {  # <session> <window-name> <proj-abs> -> prints window id
-  local ses=$1 wname=$2 proj_abs=$3 wid
+fm_backend_tmux_create_task() {  # <session> <window-name> <proj-abs> [task-marker] -> prints window id
+  local ses=$1 wname=$2 proj_abs=$3 marker=${4:-} wid
   if tmux list-windows -t "$ses" -F '#{window_name}' | grep -qx "$wname"; then
     echo "error: window $ses:$wname already exists" >&2
     return 1
   fi
   wid=$(tmux new-window -dP -F '#{window_id}' -t "$ses:" -n "$wname" -c "$proj_abs") || return 1
+  if [ -n "$marker" ] && ! tmux set-window-option -t "$wid" @firstmate_task_marker "$marker" 2>/dev/null; then
+    tmux kill-window -t "$wid" 2>/dev/null || true
+    return 1
+  fi
   tmux set-window-option -t "$wid" automatic-rename off 2>/dev/null || true
   tmux set-window-option -t "$wid" allow-rename off 2>/dev/null || true
   printf '%s\n' "$wid"
@@ -120,9 +135,9 @@ fm_backend_tmux_send_literal() {  # <target> <text>
 # Resolve any exact tmux handle accepted for a recorded task window to its
 # server-global window id. Inventory matching avoids display-message's dangerous
 # fallback to the active window when a named target has disappeared.
-fm_backend_tmux_canonical_window() {  # <target> -> @<window-id>
-  local target=$1 out status pane_id window_id named named_pane indexed_window indexed_pane matched=
-  out=$(tmux list-panes -a -F '#{pane_id}|#{window_id}|#{session_name}:#{window_name}|#{session_name}:#{window_name}.#{pane_index}|#{session_name}:#{window_index}|#{session_name}:#{window_index}.#{pane_index}' 2>&1)
+fm_backend_tmux_canonical_window() {  # <target> [task-marker] -> @<window-id>
+  local target=$1 expected_marker=${2:-} out status pane_id window_id named named_pane indexed_window indexed_pane marker matched= named_seen=0
+  out=$(tmux list-panes -a -F '#{pane_id}|#{window_id}|#{session_name}:#{window_name}|#{session_name}:#{window_name}.#{pane_index}|#{session_name}:#{window_index}|#{session_name}:#{window_index}.#{pane_index}|#{@firstmate_task_marker}' 2>&1)
   status=$?
   if [ "$status" -ne 0 ]; then
     case "$out" in
@@ -130,17 +145,20 @@ fm_backend_tmux_canonical_window() {  # <target> -> @<window-id>
       *) return 1 ;;
     esac
   fi
-  while IFS='|' read -r pane_id window_id named named_pane indexed_window indexed_pane; do
+  while IFS='|' read -r pane_id window_id named named_pane indexed_window indexed_pane marker; do
     case "$target" in
       "$pane_id"|"$window_id"|"$indexed_window"|"$indexed_pane")
+        [ -z "$expected_marker" ] || [ "$marker" = "$expected_marker" ] || return 1
         printf '%s' "$window_id"
         return 0
         ;;
     esac
   done <<< "$out"
-  while IFS='|' read -r pane_id window_id named named_pane indexed_window indexed_pane; do
+  while IFS='|' read -r pane_id window_id named named_pane indexed_window indexed_pane marker; do
     case "$target" in
       "$named"|"$named_pane")
+        named_seen=1
+        [ -z "$expected_marker" ] || [ "$marker" = "$expected_marker" ] || continue
         if [ -n "$matched" ] && [ "$matched" != "$window_id" ]; then
           return 1
         fi
@@ -152,6 +170,7 @@ fm_backend_tmux_canonical_window() {  # <target> -> @<window-id>
     printf '%s' "$matched"
     return 0
   fi
+  [ "$named_seen" -eq 0 ] || [ -z "$expected_marker" ] || return 1
   return 2
 }
 
@@ -159,14 +178,21 @@ fm_backend_tmux_canonical_window() {  # <target> -> @<window-id>
 # `display-message -t` silently falls back to the active window when a named
 # target disappeared, which would report a killed worker as still present.
 # A readable inventory proves presence/absence; control-plane failures stay unknown.
-fm_backend_tmux_target_state() {  # <target> -> present|absent|unknown
-  local target=$1 out status pane_id window_id named indexed_window indexed_pane
-  out=$(tmux list-panes -a -F '#{pane_id}|#{window_id}|#{session_name}:#{window_name}|#{session_name}:#{window_index}|#{session_name}:#{window_index}.#{pane_index}' 2>&1)
+fm_backend_tmux_target_state() {  # <target> [task-marker] -> present|absent|unknown
+  local target=$1 expected_marker=${2:-} out status pane_id window_id named indexed_window indexed_pane marker
+  out=$(tmux list-panes -a -F '#{pane_id}|#{window_id}|#{session_name}:#{window_name}|#{session_name}:#{window_index}|#{session_name}:#{window_index}.#{pane_index}|#{@firstmate_task_marker}' 2>&1)
   status=$?
   if [ "$status" -eq 0 ]; then
-    while IFS='|' read -r pane_id window_id named indexed_window indexed_pane; do
+    while IFS='|' read -r pane_id window_id named indexed_window indexed_pane marker; do
       case "$target" in
-        "$pane_id"|"$window_id"|"$named"|"$indexed_window"|"$indexed_pane") printf 'present'; return 0 ;;
+        "$pane_id"|"$window_id"|"$named"|"$indexed_window"|"$indexed_pane")
+          if [ -n "$expected_marker" ] && [ "$marker" != "$expected_marker" ]; then
+            printf 'unknown'
+          else
+            printf 'present'
+          fi
+          return 0
+          ;;
       esac
     done <<< "$out"
     printf 'absent'
@@ -218,11 +244,11 @@ fm_backend_tmux_current_command() {  # <target>
 # An omitted window or a definitive missing-session/server response is
 # `missing`; any other inventory or pane read failure is `unreadable`, so a
 # transient tmux problem never licenses a duplicate.
-fm_backend_tmux_agent_state() {  # <target>
-  local target=$1 comm session window windows inventory_status
+fm_backend_tmux_agent_state() {  # <target> [task-marker]
+  local target=$1 expected_marker=${2:-} comm session window windows inventory_status found=0 marker=
   case "$target" in
     @*)
-      if windows=$(LC_ALL=C tmux list-panes -a -F '#{window_id}' 2>&1); then
+      if windows=$(LC_ALL=C tmux list-panes -a -F '#{window_id}|#{@firstmate_task_marker}' 2>&1); then
         inventory_status=0
       else
         inventory_status=$?
@@ -232,7 +258,7 @@ fm_backend_tmux_agent_state() {  # <target>
     *:*)
       session=${target%%:*}
       window=${target#*:}
-      if windows=$(LC_ALL=C tmux list-windows -t "$session" -F '#{window_name}' 2>&1); then
+      if windows=$(LC_ALL=C tmux list-windows -t "$session" -F '#{window_name}|#{@firstmate_task_marker}' 2>&1); then
         inventory_status=0
       else
         inventory_status=$?
@@ -251,13 +277,22 @@ fm_backend_tmux_agent_state() {  # <target>
     esac
     return 0
   fi
-  case "$target" in
-    @*) printf '%s\n' "$windows" | grep -Fqx "$target" ;;
-    *) printf '%s\n' "$windows" | grep -Fqx "$window" ;;
-  esac || {
+  while IFS='|' read -r candidate marker; do
+    case "$target" in
+      @*) [ "$candidate" = "$target" ] || continue ;;
+      *) [ "$candidate" = "$window" ] || continue ;;
+    esac
+    found=1
+    break
+  done <<< "$windows"
+  if [ "$found" -eq 0 ]; then
     printf 'missing'
     return 0
-  }
+  fi
+  if [ -n "$expected_marker" ] && [ "$marker" != "$expected_marker" ]; then
+    printf 'unreadable'
+    return 0
+  fi
 
   comm=$(fm_backend_tmux_current_command "$target") || {
     printf 'unreadable'
diff --git a/bin/fm-backend.sh b/bin/fm-backend.sh
index 28acf865f4..98d1ef9990 100644
--- a/bin/fm-backend.sh
+++ b/bin/fm-backend.sh
@@ -531,6 +531,23 @@ fm_backend_validate_task_endpoint() {  # <meta-file> <task-id>
   return 0
 }
 
+fm_backend_assert_recorded_endpoint_identity() {
+  local meta=$1 target marker
+  [ "$(fm_backend_of_meta "$meta")" = tmux ] || return 0
+  grep -q '^host_root=.' "$meta" 2>/dev/null || return 0
+  target=$(fm_backend_target_of_meta "$meta")
+  marker=$(fm_meta_get "$meta" tmux_window_marker)
+  if [ -z "$target" ] || [ -z "$marker" ]; then
+    echo "error: host-root tmux metadata has no task-owned window identity: $meta" >&2
+    return 2
+  fi
+  fm_backend_source tmux || return 2
+  if ! fm_backend_tmux_canonical_window "$target" "$marker" >/dev/null 2>&1; then
+    echo "error: recorded tmux window identity does not match the live endpoint: $target" >&2
+    return 2
+  fi
+}
+
 fm_backend_meta_for_window() {  # <target> <state-dir>
   local target=$1 state=$2 meta window terminal
   for meta in "$state"/*.meta; do
@@ -917,11 +934,11 @@ fm_backend_target_exists() {  # <backend> <target> [expected-label]
 # Tri-state existence probe for destructive cleanup. Unlike the historical
 # boolean liveness helper above, an unreadable control plane is unknown rather
 # than absent and therefore cannot authorize worktree reuse.
-fm_backend_target_state() {  # <backend> <target> [zellij-tab-id] [expected-label] -> present|absent|unknown
-  local backend=$1 target=$2 zellij_tab_id=${3:-} expected_label=${4:-}
+fm_backend_target_state() {  # <backend> <target> [zellij-tab-id] [expected-label] [tmux-marker] -> present|absent|unknown
+  local backend=$1 target=$2 zellij_tab_id=${3:-} expected_label=${4:-} tmux_marker=${5:-}
   fm_backend_source "$backend" || { printf 'unknown'; return 0; }
   case "$backend" in
-    tmux) fm_backend_tmux_target_state "$target" ;;
+    tmux) fm_backend_tmux_target_state "$target" "$tmux_marker" ;;
     herdr) fm_backend_herdr_target_state "$target" ;;
     zellij) fm_backend_zellij_target_state "$target" "$zellij_tab_id" "$expected_label" ;;
     orca) fm_backend_orca_target_state "$target" ;;
@@ -933,13 +950,17 @@ fm_backend_target_state() {  # <backend> <target> [zellij-tab-id] [expected-labe
 # Stop a task endpoint and prove it disappeared before any caller recycles or
 # removes the task's worktree. Kill adapters remain idempotent; this stricter
 # owner is for destructive cleanup paths that must not trust best-effort close.
-fm_backend_stop_and_verify() {  # <backend> <target> [zellij-tab-id] [expected-label] [require-stable-tmux-id]
-  local backend=$1 target=$2 expected_label=${4:-} require_stable_tmux_id=${5:-0} attempts=${FM_BACKEND_STOP_ATTEMPTS:-20} delay=${FM_BACKEND_STOP_DELAY:-0.1} i=0 state=unknown stop_target=$2 resolve_status
+fm_backend_stop_and_verify() {  # <backend> <target> [zellij-tab-id] [expected-label] [require-stable-tmux-id] [tmux-marker]
+  local backend=$1 target=$2 expected_label=${4:-} require_stable_tmux_id=${5:-0} tmux_marker=${6:-} attempts=${FM_BACKEND_STOP_ATTEMPTS:-20} delay=${FM_BACKEND_STOP_DELAY:-0.1} i=0 state=unknown stop_target=$2 resolve_status
   [ -n "$target" ] || { echo "error: missing backend endpoint id; refusing destructive cleanup" >&2; return 1; }
   case "$attempts" in ''|*[!0-9]*|0) attempts=20 ;; esac
   if [ "$backend" = tmux ]; then
     fm_backend_source tmux || return 1
-    stop_target=$(fm_backend_tmux_canonical_window "$target" 2>/dev/null) || {
+    if [ "$require_stable_tmux_id" = 1 ] && [ -z "$tmux_marker" ]; then
+      echo "error: backend endpoint $target has no task-owned tmux window marker; refusing destructive cleanup" >&2
+      return 1
+    fi
+    stop_target=$(fm_backend_tmux_canonical_window "$target" "$tmux_marker" 2>/dev/null) || {
       resolve_status=$?
       if [ "$resolve_status" -eq 2 ]; then
         case "$target" in @*) return 0 ;; esac
@@ -955,7 +976,7 @@ fm_backend_stop_and_verify() {  # <backend> <target> [zellij-tab-id] [expected-l
     fm_backend_kill "$backend" "$stop_target" "${3:-}" "${4:-}" || return 1
   fi
   while [ "$i" -lt "$attempts" ]; do
-    state=$(fm_backend_target_state "$backend" "$stop_target" "${3:-}" "$expected_label")
+    state=$(fm_backend_target_state "$backend" "$stop_target" "${3:-}" "$expected_label" "$tmux_marker")
     [ "$state" = absent ] && return 0
     i=$((i + 1))
     [ "$i" -ge "$attempts" ] || sleep "$delay"
@@ -969,11 +990,11 @@ fm_backend_stop_and_verify() {  # <backend> <target> [zellij-tab-id] [expected-l
 }
 
 # Implement the recovery-grade state contract described above.
-fm_backend_agent_state() {  # <backend> <target>
-  local backend=$1 target=$2
+fm_backend_agent_state() {  # <backend> <target> [tmux-marker]
+  local backend=$1 target=$2 tmux_marker=${3:-}
   fm_backend_source "$backend" || { printf 'unverified'; return 0; }
   case "$backend" in
-    tmux) fm_backend_tmux_agent_state "$target" ;;
+    tmux) fm_backend_tmux_agent_state "$target" "$tmux_marker" ;;
     herdr) fm_backend_herdr_agent_state "$target" ;;
     *) printf 'unverified' ;;
   esac
@@ -983,7 +1004,7 @@ fm_backend_agent_state() {  # <backend> <target>
 # authoritatively missing endpoint is confidently not a live agent, while every
 # ambiguous, unreadable, or unverified result stays unknown.
 fm_backend_agent_alive() {  # <backend> <target>
-  case "$(fm_backend_agent_state "$1" "$2")" in
+  case "$(fm_backend_agent_state "$@")" in
     alive) printf 'alive' ;;
     dead|missing) printf 'dead' ;;
     *) printf 'unknown' ;;
diff --git a/bin/fm-peek.sh b/bin/fm-peek.sh
index 2fed803394..2b871cc49a 100755
--- a/bin/fm-peek.sh
+++ b/bin/fm-peek.sh
@@ -27,6 +27,7 @@ else
 fi
 
 "$SCRIPT_DIR/fm-guard.sh" || true
+[ -z "$TASK_META" ] || fm_backend_assert_recorded_endpoint_identity "$TASK_META" || exit $?
 
 T=$(fm_backend_resolve_selector "$RAW_TARGET" "$STATE")
 N=${2:-40}
diff --git a/bin/fm-send.sh b/bin/fm-send.sh
index 95a0e1726b..03c27602ca 100755
--- a/bin/fm-send.sh
+++ b/bin/fm-send.sh
@@ -223,6 +223,7 @@ shift
 # The recorded host binding is established before this guard can repair state.
 FM_GUARD_CONTINUE_LINE='This is a supervision warning only; the requested message WILL still be sent.' "$SCRIPT_DIR/fm-guard.sh" || true
 fm_backend_validate "$TARGET_BACKEND" || exit 1
+[ -z "$TARGET_META" ] || fm_backend_assert_recorded_endpoint_identity "$TARGET_META" || exit $?
 
 # Classify a from-firstmate -> secondmate request. Only a task selector resolved
 # through this home's meta whose authoritative kind is secondmate is marked: the
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 566902ccf3..98795c5b02 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -331,6 +331,7 @@ CONFIG_INHERIT_LOCK=
 CONFIG_INHERIT_LOCK_HELD=0
 CMUX_WORKSPACE_ID=
 CMUX_SURFACE_ID=
+TMUX_WINDOW_MARKER=
 
 parse_orca_worktree_result() {
   local raw=$1 rest
@@ -400,6 +401,7 @@ write_abort_meta() {
     [ -z "${ORCA_TERMINAL:-}" ] || echo "terminal=$ORCA_TERMINAL"
     [ -z "${CMUX_WORKSPACE_ID:-}" ] || echo "cmux_workspace_id=$CMUX_WORKSPACE_ID"
     [ -z "${CMUX_SURFACE_ID:-}" ] || echo "cmux_surface_id=$CMUX_SURFACE_ID"
+    [ -z "${TMUX_WINDOW_MARKER:-}" ] || echo "tmux_window_marker=$TMUX_WINDOW_MARKER"
   } > "$STATE/$ID.meta" 2>/dev/null || true
 }
 
@@ -470,7 +472,7 @@ spawn_abort_cleanup() {
       # recycle a worktree while endpoint absence is unknown.
       cleanup_failed=1
       endpoint_stopped=0
-    elif [ -n "${T:-}" ] && ! fm_backend_stop_and_verify "$BACKEND" "$T" "${ZELLIJ_TAB_ID:-}" "${W:-fm-$ID}"; then
+    elif [ -n "${T:-}" ] && ! fm_backend_stop_and_verify "$BACKEND" "$T" "${ZELLIJ_TAB_ID:-}" "${W:-fm-$ID}" "$HOST_MODE" "${TMUX_WINDOW_MARKER:-}"; then
       cleanup_failed=1
       endpoint_stopped=0
     fi
@@ -1188,7 +1190,12 @@ herdr_projection_existing_meta_allows_flat() {  # <meta>
         ;;
     esac
   fi
-  old_state=$(fm_backend_agent_alive "$old_backend" "$old_target")
+  if [ "$old_backend" = tmux ] && grep -q '^host_root=.' "$meta" 2>/dev/null \
+     && [ -z "$(fm_meta_get "$meta" tmux_window_marker)" ]; then
+    echo "error: existing host-root tmux metadata for $ID has no task-owned window identity; refusing duplicate launch" >&2
+    return 1
+  fi
+  old_state=$(fm_backend_agent_alive "$old_backend" "$old_target" "$(fm_meta_get "$meta" tmux_window_marker)")
   case "$old_state" in
     dead) return 0 ;;
     alive|unknown)
@@ -1208,7 +1215,8 @@ case "$BACKEND" in
     # non-default tmux config cannot rename the window away from fm-<id> once
     # treehouse cd's into the worktree. WT_TARGET carries that stable id for the
     # rename-critical worktree-detection steps below.
-    WID=$(fm_backend_tmux_create_task "$SES" "$W" "$PROJ_ABS") || exit 1
+    [ "$HOST_MODE" -eq 0 ] || TMUX_WINDOW_MARKER=$(fm_backend_tmux_task_marker) || exit 1
+    WID=$(fm_backend_tmux_create_task "$SES" "$W" "$PROJ_ABS" "$TMUX_WINDOW_MARKER") || exit 1
     WT_TARGET="$WID"
     [ "$HOST_MODE" -eq 0 ] || T=$WID
     ;;
@@ -1775,6 +1783,7 @@ META_WINDOW=$T
   # default path's meta stays byte-identical (absent backend= means tmux;
   # data/fm-backend-design-d7's P1 compatibility contract).
   [ "$BACKEND" = tmux ] || echo "backend=$BACKEND"
+  [ -z "$TMUX_WINDOW_MARKER" ] || echo "tmux_window_marker=$TMUX_WINDOW_MARKER"
   if [ "$BACKEND" = herdr ]; then
     echo "herdr_session=$HERDR_SES"
     echo "herdr_workspace_id=$HERDR_WORKSPACE_ID"
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index 8322e626f4..0841d92e42 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -1052,7 +1052,7 @@ cleanup_firstmate_home_children() {
       return 1
     elif [ "$child_host_mode" -eq 1 ]; then
       ( unset FM_ROOT_OVERRIDE FM_CONFIG_OVERRIDE; FM_HOME=$home FM_ROOT=$home \
-        fm_backend_stop_and_verify "$child_backend" "$child_t" "$(meta_value "$child_meta" zellij_tab_id)" "fm-$child_id" 1 ) || return 1
+        fm_backend_stop_and_verify "$child_backend" "$child_t" "$(meta_value "$child_meta" zellij_tab_id)" "fm-$child_id" 1 "$(meta_value "$child_meta" tmux_window_marker)" ) || return 1
     elif [ -n "$child_t" ]; then
       case "$child_backend" in
         zellij)
@@ -1196,7 +1196,7 @@ fi
 stop_task_endpoint_and_verify() {
   local focus_lock='' focus_lock_held=0 attempt=0 endpoint_state close_status=0
   if [ "$BACKEND" != herdr ] || [ "$HERDR_PRESENTATION_JOURNAL_PRESENT" != 1 ]; then
-    fm_backend_stop_and_verify "$BACKEND" "$T" "$(meta_value "$META" zellij_tab_id)" "fm-$ID" "$TASK_HOST_MODE"
+    fm_backend_stop_and_verify "$BACKEND" "$T" "$(meta_value "$META" zellij_tab_id)" "fm-$ID" "$TASK_HOST_MODE" "$(meta_value "$META" tmux_window_marker)"
     return
   fi
   if [ -z "$HERDR_PRESENTATION_SESSION" ] \
diff --git a/tests/fm-backend-cmux.test.sh b/tests/fm-backend-cmux.test.sh
index e4e5081d22..be1fc3c3c8 100755
--- a/tests/fm-backend-cmux.test.sh
+++ b/tests/fm-backend-cmux.test.sh
@@ -979,14 +979,13 @@ test_kill_recovers_stale_target_by_label() {
   local dir fb title
   dir="$TMP_ROOT/kill-stale-target"; mkdir -p "$dir/responses"
   title=$(cmux_expected_scoped_title fm-label)
-  # target_ready label recovery: 1 workspace list (title lookup, misses stale id),
-  # 2 workspace list (id-for-label -> refreshed id), 3 list-panes (surface id).
-  cmux_workspace_list_response "$dir" 1 "cccccccc-2222-2222-2222-222222222222" "$title"
-  cmux_workspace_list_response "$dir" 2 "cccccccc-2222-2222-2222-222222222222" "$title"
-  cmux_panes_response "$dir" 3 "dddddddd-3333-3333-3333-333333333333"
-  # window_of_workspace on the REFRESHED id: 4 list-windows (not last), 5 workspace list --window.
-  cmux_windows_response "$dir" 4 "eeeeeeee-0000-0000-0000-000000000000" 2
-  cmux_workspace_list_response "$dir" 5 "cccccccc-2222-2222-2222-222222222222" "$title" "ffffffff-0000-0000-0000-000000000000" "other"
+  cmux_windows_response "$dir" 1 \
+    "eeeeeeee-0000-0000-0000-000000000000" 1 \
+    "eeeeeeee-1111-1111-1111-111111111111" 2
+  cmux_workspace_list_response "$dir" 2 "ffffffff-0000-0000-0000-000000000000" "other"
+  cmux_workspace_list_response "$dir" 3 \
+    "cccccccc-2222-2222-2222-222222222222" "$title" \
+    "ffffffff-1111-1111-1111-111111111111" "other"
   fb=$(make_cmux_fakebin "$dir")
   PATH="$fb:$PATH" FM_CMUX_LOG="$dir/log" FM_CMUX_RESPONSES="$dir/responses" \
     bash -c '. "$0/bin/backends/cmux.sh"; fm_backend_cmux_kill "aaaaaaaa-0000-0000-0000-000000000000:bbbbbbbb-1111-1111-1111-111111111111" "" fm-label' "$ROOT"
@@ -997,7 +996,9 @@ test_kill_recovers_stale_target_by_label() {
     "kill should not target the stale cmux workspace id after label recovery"
   assert_not_contains "$(cat "$dir/log")" $'\x1f''close-surface' \
     "kill should not call close-surface"
-  pass "fm_backend_cmux_kill: recovers stale workspace/surface ids by expected label"
+  assert_contains "$(cat "$dir/log")" $'\x1f''--window'$'\x1f''eeeeeeee-1111-1111-1111-111111111111' \
+    "kill did not scan outside the current cmux window"
+  pass "fm_backend_cmux_kill: recovers and closes a stale target across cmux windows"
 }
 
 # --- list_live: label-based orphan discovery ---------------------------------
@@ -1049,15 +1050,11 @@ test_forced_secondmate_teardown_uses_child_cmux_config() {
     "project=$project" \
     "kind=scout"
   child_title=$(cmux_expected_scoped_title fm-childc "$home" "$home")
-  cmux_workspace_list_response "$dir" 1 ws-child "$child_title" ws-other default
-  cmux_panes_response "$dir" 2 sf-child
-  cmux_workspace_list_response "$dir" 3 ws-child "$child_title" ws-other default
-  cmux_panes_response "$dir" 4 sf-child
-  cmux_windows_response "$dir" 5 win-child 2
-  cmux_workspace_list_response "$dir" 6 ws-child "$child_title" ws-other default
-  : > "$dir/responses/7.out"
-  cmux_windows_response "$dir" 8 win-child 1
-  cmux_workspace_list_response "$dir" 9 ws-other default
+  cmux_windows_response "$dir" 1 win-child 2
+  cmux_workspace_list_response "$dir" 2 ws-child "$child_title" ws-other default
+  : > "$dir/responses/3.out"
+  cmux_windows_response "$dir" 4 win-child 1
+  cmux_workspace_list_response "$dir" 5 ws-other default
   fb=$(make_cmux_fakebin "$dir")
   cat > "$fb/tmux" <<'SH'
 #!/usr/bin/env bash
diff --git a/tests/fm-backend.test.sh b/tests/fm-backend.test.sh
index 17d4e42225..2369e8826b 100755
--- a/tests/fm-backend.test.sh
+++ b/tests/fm-backend.test.sh
@@ -1182,7 +1182,7 @@ test_stop_and_verify_requires_confirmed_absence() {
     . "$1/bin/fm-backend.sh"; fm_backend_source tmux
     fm_backend_tmux_canonical_window() { return 2; }
     fm_backend_kill() { printf called; }
-    fm_backend_stop_and_verify tmux session:renamed "" "" 1
+    fm_backend_stop_and_verify tmux session:renamed "" "" 1 marker
   ' _ "$ROOT" 2>&1) || status=$?
   expect_code 1 "$status" "an unresolved legacy tmux alias must not prove absence"
   assert_contains "$out" 'could not be resolved to a stable tmux window' \
@@ -1209,6 +1209,29 @@ test_stop_and_verify_requires_confirmed_absence() {
   expect_code 0 "$status" "a missing immutable tmux window id should prove absence"
   [ -z "$out" ] || fail "missing immutable tmux window id emitted unexpected output: $out"
 
+  status=0
+  out=$(bash -c '
+    . "$1/bin/fm-backend.sh"; fm_backend_source tmux
+    fm_backend_kill() { printf called; }
+    fm_backend_stop_and_verify tmux @7 "" "" 1
+  ' _ "$ROOT" 2>&1) || status=$?
+  expect_code 1 "$status" "host-root teardown must require a task-owned tmux marker"
+  assert_contains "$out" 'has no task-owned tmux window marker' "missing tmux marker refusal was not explicit"
+  assert_not_contains "$out" 'called' "missing tmux marker invoked a backend kill"
+
+  status=0
+  out=$(bash -c '
+    . "$1/bin/fm-backend.sh"; fm_backend_source tmux
+    tmux() {
+      printf "%%7|@7|session:task|session:task.0|session:7|session:7.0|other-task\n"
+    }
+    fm_backend_kill() { printf called; }
+    fm_backend_stop_and_verify tmux @7 "" "" 1 expected-task
+  ' _ "$ROOT" 2>&1) || status=$?
+  expect_code 1 "$status" "host-root teardown trusted a reused tmux window id"
+  assert_contains "$out" 'could not be resolved to a stable tmux window' "reused tmux id refusal was not explicit"
+  assert_not_contains "$out" 'called' "reused tmux id invoked a backend kill"
+
   status=0
   bash -c '
     . "$1/bin/fm-backend.sh"; fm_backend_source tmux
@@ -1233,6 +1256,18 @@ test_stop_and_verify_requires_confirmed_absence() {
   ' _ "$ROOT")
   [ "$out" = alive ] || fail "stable tmux window id agent state drifted: '$out'"
 
+  out=$(bash -c '
+    . "$1/bin/fm-backend.sh"; fm_backend_source tmux
+    tmux() {
+      case "$1" in
+        list-panes) printf "@7|other-task\n" ;;
+        display-message) printf "codex\n" ;;
+      esac
+    }
+    fm_backend_agent_state tmux @7 expected-task
+  ' _ "$ROOT")
+  [ "$out" = unreadable ] || fail "tmux agent state trusted a reused server-local window id: '$out'"
+
   status=0
   out=$(FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 bash -c '
     . "$1/bin/fm-backend.sh"; fm_backend_source tmux
diff --git a/tests/fm-host-root-mode.test.sh b/tests/fm-host-root-mode.test.sh
index 21e30efcb1..4da53c2f8a 100644
--- a/tests/fm-host-root-mode.test.sh
+++ b/tests/fm-host-root-mode.test.sh
@@ -236,6 +236,8 @@ make_fakebin() {
 set -u
 printf '%s\037' "$@" >> "$FM_TMUX_LOG"; printf '\n' >> "$FM_TMUX_LOG"
 endpoint=${FM_ENDPOINT_ALIVE:-$FM_CURRENT_PATH.endpoint}
+marker_file=${FM_TMUX_MARKER_FILE:-$endpoint.marker}
+marker=$(cat "$marker_file" 2>/dev/null || true)
 if [ "${1:-}" = send-keys ] && printf '%s\n' "$*" | grep -q -- ' -l '; then
   case "${*: -1}" in
     'Read the brief at '*' and follow it exactly.') : ;;
@@ -264,54 +266,59 @@ case "${1:-}" in
     ;;
   list-windows) [ -z "${FM_EXISTING_WINDOW:-}" ] || printf '%s\n' "$FM_EXISTING_WINDOW" ;;
   list-panes)
-    if [ "${FM_TMUX_NUMERIC_NAME_COLLISION:-0}" = 1 ]; then
-      printf '%%9|@9|test-session:1|test-session:1.0|test-session:0|test-session:0.0\n'
-      printf '%%1|@1|%s|%s|%s|%s\n' \
+    if [[ "$*" == *'#{window_id}|#{@firstmate_task_marker}'* ]] && [[ "$*" != *'#{pane_id}'* ]]; then
+      [ -f "$endpoint" ] && printf '@1|%s\n' "$marker"
+    elif [ "${FM_TMUX_NUMERIC_NAME_COLLISION:-0}" = 1 ]; then
+      printf '%%9|@9|test-session:1|test-session:1.0|test-session:0|test-session:0.0|other\n'
+      printf '%%1|@1|%s|%s|%s|%s|%s\n' \
         "${FM_ENDPOINT_TARGET:-test-session:fm-rollback-stuck}" \
         "${FM_ENDPOINT_ALIAS:-test-session:fm-rollback-stuck.0}" \
         "${FM_ENDPOINT_INDEX_ALIAS:-test-session:1}" \
-        "${FM_ENDPOINT_INDEX_PANE_ALIAS:-test-session:1.0}"
+        "${FM_ENDPOINT_INDEX_PANE_ALIAS:-test-session:1.0}" "$marker"
     elif [ "${FM_TMUX_RENUMBER_ON_STOP:-0}" = 1 ]; then
       case "$*" in
         *'#{window_name}.#{pane_index}'*)
           if [ -f "$endpoint" ]; then
-            printf '%%1|@1|%s|%s|test-session:1|test-session:1.0\n' \
+            printf '%%1|@1|%s|%s|test-session:1|test-session:1.0|%s\n' \
               "${FM_ENDPOINT_TARGET:-test-session:fm-rollback-stuck}" \
-              "${FM_ENDPOINT_ALIAS:-test-session:fm-rollback-stuck.0}"
-            printf '%%2|@2|test-session:survivor|test-session:survivor.0|test-session:2|test-session:2.0\n'
+              "${FM_ENDPOINT_ALIAS:-test-session:fm-rollback-stuck.0}" "$marker"
+            printf '%%2|@2|test-session:survivor|test-session:survivor.0|test-session:2|test-session:2.0|other\n'
           else
-            printf '%%2|@2|test-session:survivor|test-session:survivor.0|test-session:1|test-session:1.0\n'
+            printf '%%2|@2|test-session:survivor|test-session:survivor.0|test-session:1|test-session:1.0|other\n'
           fi
           ;;
         *)
           if [ -f "$endpoint" ]; then
-            printf '%%1|@1|%s|test-session:1|test-session:1.0\n' \
-              "${FM_ENDPOINT_TARGET:-test-session:fm-rollback-stuck}"
-            printf '%%2|@2|test-session:survivor|test-session:2|test-session:2.0\n'
+            printf '%%1|@1|%s|test-session:1|test-session:1.0|%s\n' \
+              "${FM_ENDPOINT_TARGET:-test-session:fm-rollback-stuck}" "$marker"
+            printf '%%2|@2|test-session:survivor|test-session:2|test-session:2.0|other\n'
           else
-            printf '%%2|@2|test-session:survivor|test-session:1|test-session:1.0\n'
+            printf '%%2|@2|test-session:survivor|test-session:1|test-session:1.0|other\n'
           fi
           ;;
       esac
     elif [ -f "$endpoint" ]; then
       case "$*" in
         *'#{window_name}.#{pane_index}'*)
-          printf '%%1|@1|%s|%s|%s|%s\n' \
+          printf '%%1|@1|%s|%s|%s|%s|%s\n' \
             "${FM_ENDPOINT_TARGET:-test-session:fm-rollback-stuck}" \
             "${FM_ENDPOINT_ALIAS:-test-session:fm-rollback-stuck.0}" \
             "${FM_ENDPOINT_INDEX_ALIAS:-test-session:1}" \
-            "${FM_ENDPOINT_INDEX_PANE_ALIAS:-test-session:1.0}"
+            "${FM_ENDPOINT_INDEX_PANE_ALIAS:-test-session:1.0}" "$marker"
           ;;
         *)
-          printf '%%1|@1|%s|%s|%s\n' \
+          printf '%%1|@1|%s|%s|%s|%s\n' \
             "${FM_ENDPOINT_TARGET:-test-session:fm-rollback-stuck}" \
             "${FM_ENDPOINT_INDEX_ALIAS:-test-session:1}" \
-            "${FM_ENDPOINT_INDEX_PANE_ALIAS:-test-session:1.0}"
+            "${FM_ENDPOINT_INDEX_PANE_ALIAS:-test-session:1.0}" "$marker"
           ;;
       esac
     fi
     ;;
-  has-session|new-session|set-window-option) ;;
+  set-window-option)
+    [ "${*: -2:1}" != @firstmate_task_marker ] || printf '%s' "${*: -1}" > "$marker_file"
+    ;;
+  has-session|new-session) ;;
   new-window) : > "$endpoint"; printf '@1\n' ;;
   kill-window)
     [ -z "${FM_TMUX_KILL_MUTATION:-}" ] || printf 'late worker edit\n' > "$FM_TMUX_KILL_MUTATION"
@@ -381,7 +388,7 @@ test_host_scout_records_logical_project_mode() {
 }
 
 test_spawn_separates_roots() {
-  local host="$TMP/spawn & host" home="$TMP/spawn home's & #%?" project="$TMP/target & repo" wt="$TMP/target & worktree" fb log current launch obs argv turnend meta before after tree_line cd_line launch_line
+  local host="$TMP/spawn & host" home="$TMP/spawn home's & #%?" project="$TMP/target & repo" wt="$TMP/target & worktree" fb log current launch obs argv turnend meta marker marker_file out status=0 before after tree_line cd_line launch_line
   make_host "$host"
   mkdir -p "$home/data/lane" "$home/state" "$home/config"
   fm_git_init_commit "$project"
@@ -399,6 +406,10 @@ test_spawn_separates_roots() {
   assert_grep "worktree=$wt" "$meta" "spawn meta lost target worktree"
   assert_grep "host_root=$host" "$meta" "spawn meta lost host root"
   assert_grep 'window=@1' "$meta" "host-root spawn did not persist the immutable tmux window id"
+  marker=$(sed -n 's/^tmux_window_marker=//p' "$meta")
+  marker_file="$current.endpoint.marker"
+  [ -n "$marker" ] || fail "host-root spawn did not persist a task-owned tmux marker"
+  [ "$(cat "$marker_file")" = "$marker" ] || fail "host-root spawn did not bind the live tmux window to its recorded marker"
   assert_contains "$(cat "$log")" "FM_TARGET_WORKTREE='$wt'" "child launch did not export exact target worktree"
   assert_contains "$(cat "$log")" "FM_HOST_ROOT='$host'" "child launch did not export exact host root"
   assert_contains "$(cat "$log")" 'notify=[' "Codex FirstMate turn-end safeguard was not retained"
@@ -428,7 +439,15 @@ PY
   assert_absent "$host/worker-edit.txt" "disposable worker probe edited the host root"
   after=$(git -C "$host" status --porcelain)
   [ "$before" = "$after" ] || fail "host working tree changed during spawn or worker probe"
-  pass "spawn orders and separates host cwd, target metadata, child environment, and target-only edits"
+  printf 'another-task' > "$marker_file"
+  : > "$log"
+  out=$(cd "$host" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    FM_TMUX_LOG="$log" FM_LAUNCH_FILE="$launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH="$wt" FM_HOST_PATH="$host" \
+    "$ROOT/bin/fm-send.sh" lane hello 2>&1) || status=$?
+  expect_code 2 "$status" "host-root send trusted a reused tmux window id"
+  assert_contains "$out" 'recorded tmux window identity does not match' "reused tmux window refusal was not explicit"
+  assert_no_grep 'send-keys' "$log" "host-root send targeted a tmux window owned by another task"
+  pass "spawn binds host-root tmux actions to a task-owned window marker"
 }
 
 test_duplicate_spawn_preserves_existing_task() {
@@ -926,10 +945,11 @@ SH
   for action in hold complete resolve; do
     action_id="decision-post-teardown-$action"
     mkdir -p "$home/data/$action_id"
-    printf 'window=test-session:fm-%s\nworktree=/tmp/decision-target\nhost_root=%s\nproject=/tmp/project\nkind=ship\nmode=local-only\n' \
+    printf 'window=test-session:fm-%s\nworktree=/tmp/decision-target\nhost_root=%s\nproject=/tmp/project\nkind=ship\nmode=local-only\ntmux_window_marker=decision-marker\n' \
       "$action_id" "$host" > "$home/state/$action_id.meta"
     printf '%s\n' "$host" > "$current"
     : > "$current.endpoint"
+    printf 'decision-marker' > "$current.endpoint.marker"
     : > "$log"
     : > "$tree_log"
     (cd "$host" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
@@ -968,11 +988,11 @@ test_host_teardown_requires_confirmed_stop() {
   local host="$TMP/teardown-host" home="$TMP/teardown-home" project="$TMP/teardown-project" wt="$TMP/teardown-wt" fb log current tree_log out status=0 kill_line verify_line return_line
   make_host "$host"; mkdir -p "$home/data/host-teardown" "$home/state" "$home/config"; fm_git_init_commit "$project"
   git -C "$project" worktree add -q --detach "$wt"
-  printf 'window=test-session:fm-host-teardown\nworktree=%s\nhost_root=%s\nproject=%s\nkind=ship\nmode=local-only\n' \
+  printf 'window=test-session:fm-host-teardown\nworktree=%s\nhost_root=%s\nproject=%s\nkind=ship\nmode=local-only\ntmux_window_marker=teardown-marker\n' \
     "$wt" "$host" "$project" > "$home/state/host-teardown.meta"
   fb=$(make_fakebin "$TMP/fake-host-teardown")
   log="$TMP/host-teardown.log"; current="$TMP/host-teardown.current"; tree_log="$TMP/host-teardown-treehouse.log"
-  printf '%s\n' "$host" > "$current"; : > "$current.endpoint"; : > "$log"; : > "$tree_log"
+  printf '%s\n' "$host" > "$current"; : > "$current.endpoint"; printf 'teardown-marker' > "$current.endpoint.marker"; : > "$log"; : > "$tree_log"
   out=$(cd "$host" && PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
     FM_REFUSE_STOP=1 FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 FM_TMUX_LOG="$log" \
     FM_ENDPOINT_TARGET=test-session:fm-host-teardown FM_LAUNCH_FILE="$TMP/unused.launch" FM_CURRENT_PATH="$current" \
@@ -1074,6 +1094,9 @@ test_secondmate_force_teardown_preserves_host_children_during_recursive_cleanup(
     fm_write_meta "$subhome/state/child.meta" \
       "window=$target" "worktree=$childwt" "project=$childproj" \
       "backend=$backend" "host_root=$host" 'harness=echo' 'kind=ship' 'mode=no-mistakes'
+    if [ "$backend" = tmux ]; then
+      printf 'tmux_window_marker=child-marker\n' >> "$subhome/state/child.meta"
+    fi
     fb=$(make_fakebin "$case_root/fake")
     if [ "$backend" = herdr ]; then
       printf '%s\n' \
@@ -1102,6 +1125,7 @@ SH
     tree_log="$case_root/treehouse.log"
     printf '%s\n' "$host" > "$current"
     : > "$current.endpoint"
+    [ "$backend" != tmux ] || printf 'child-marker' > "$current.endpoint.marker"
     : > "$log"
     : > "$tree_log"
     status=0

From 4ac87413fb31cb852874cf34cf181dde82b52b2e Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Mon, 27 Jul 2026 14:05:24 +0300
Subject: [PATCH 22/39] no-mistakes(review): Bind host tmux tasks to their
 creating sockets

---
 bin/backends/tmux.sh            |  62 +++++++++++-------
 bin/fm-backend.sh               | 108 +++++++++++++++++++++++---------
 bin/fm-crew-state.sh            |   9 +--
 bin/fm-fleet-snapshot.sh        |   3 +-
 bin/fm-peek.sh                  |  11 +++-
 bin/fm-send.sh                  |  11 +++-
 bin/fm-session-start.sh         |   3 +-
 bin/fm-spawn.sh                 |  31 ++++++---
 bin/fm-teardown.sh              |   6 +-
 bin/fm-tmux-lib.sh              |  20 ++++--
 bin/fm-watch.sh                 |  25 +++++++-
 tests/fm-backend.test.sh        |  48 +++++++++++++-
 tests/fm-host-root-mode.test.sh |  16 +++--
 tests/fm-teardown.test.sh       |  17 ++++-
 14 files changed, 284 insertions(+), 86 deletions(-)

diff --git a/bin/backends/tmux.sh b/bin/backends/tmux.sh
index c8b81e3f6e..23f17374a1 100644
--- a/bin/backends/tmux.sh
+++ b/bin/backends/tmux.sh
@@ -28,22 +28,22 @@
 # fm-send.sh's and fm-peek.sh's own (until now duplicated) resolve().
 fm_backend_tmux_resolve_bare_selector() {  # <name>
   local name=$1
-  tmux list-windows -a -F '#{session_name}:#{window_name}' | grep -m1 ":$name\$" \
+  fm_tmux_cli list-windows -a -F '#{session_name}:#{window_name}' | grep -m1 ":$name\$" \
     || { echo "error: no window named $name" >&2; return 1; }
 }
 
 # fm_backend_tmux_capture: bounded plain-text pane capture. Mirrors
 # fm-peek.sh's and fm-watch.sh's `tmux capture-pane -p -t "$T" -S -"$N"`.
 fm_backend_tmux_capture() {  # <target> <lines>
-  tmux capture-pane -p -t "$1" -S -"$2"
+  fm_tmux_cli capture-pane -p -t "$1" -S -"$2"
 }
 
 # fm_backend_tmux_send_key: one named key. Mirrors fm-send.sh's --key path:
 # `tmux display-message -p -t "$T" '#{pane_id}' >/dev/null`, then
 # `tmux send-keys -t "$T" "$2"`.
 fm_backend_tmux_send_key() {  # <target> <key>
-  tmux display-message -p -t "$1" '#{pane_id}' >/dev/null
-  tmux send-keys -t "$1" "$2"
+  fm_tmux_cli display-message -p -t "$1" '#{pane_id}' >/dev/null
+  fm_tmux_cli send-keys -t "$1" "$2"
 }
 
 # fm_backend_tmux_send_text_submit: type <text> into <target> once, then
@@ -60,9 +60,9 @@ fm_backend_tmux_send_text_submit() {  # <target> <text> <retries> <enter-sleep>
 # prints the resolved session name.
 fm_backend_tmux_container_ensure() {
   if [ -n "${TMUX:-}" ]; then
-    tmux display-message -p '#S'
+    fm_tmux_cli display-message -p '#S'
   else
-    tmux has-session -t firstmate 2>/dev/null || tmux new-session -d -s firstmate
+    fm_tmux_cli has-session -t firstmate 2>/dev/null || fm_tmux_cli new-session -d -s firstmate
     printf 'firstmate'
   fi
 }
@@ -78,6 +78,24 @@ fm_backend_tmux_task_marker() {
   printf 'fm-%s' "$token"
 }
 
+fm_backend_tmux_use_socket() {
+  case "$1" in
+    /*) ;;
+    *) return 1 ;;
+  esac
+  case "$1" in
+    *$'\n'*|*$'\r'*) return 1 ;;
+  esac
+  FM_BACKEND_TMUX_SOCKET=$1
+}
+
+fm_backend_tmux_socket_path() {
+  local path
+  path=$(fm_tmux_cli display-message -p '#{socket_path}' 2>/dev/null) || return 1
+  fm_backend_tmux_use_socket "$path" || return 1
+  printf '%s' "$path"
+}
+
 # fm_backend_tmux_create_task: create the task's window in <proj-abs>,
 # refusing an existing <window-name> in <session>. Mirrors fm-spawn.sh's
 # duplicate-check-then-new-window sequence, including the exact error text
@@ -95,17 +113,17 @@ fm_backend_tmux_task_marker() {
 # lost, so worktree discovery cannot fall back to the active client's window.
 fm_backend_tmux_create_task() {  # <session> <window-name> <proj-abs> [task-marker] -> prints window id
   local ses=$1 wname=$2 proj_abs=$3 marker=${4:-} wid
-  if tmux list-windows -t "$ses" -F '#{window_name}' | grep -qx "$wname"; then
+  if fm_tmux_cli list-windows -t "$ses" -F '#{window_name}' | grep -qx "$wname"; then
     echo "error: window $ses:$wname already exists" >&2
     return 1
   fi
-  wid=$(tmux new-window -dP -F '#{window_id}' -t "$ses:" -n "$wname" -c "$proj_abs") || return 1
-  if [ -n "$marker" ] && ! tmux set-window-option -t "$wid" @firstmate_task_marker "$marker" 2>/dev/null; then
-    tmux kill-window -t "$wid" 2>/dev/null || true
+  wid=$(fm_tmux_cli new-window -dP -F '#{window_id}' -t "$ses:" -n "$wname" -c "$proj_abs") || return 1
+  if [ -n "$marker" ] && ! fm_tmux_cli set-window-option -t "$wid" @firstmate_task_marker "$marker" 2>/dev/null; then
+    fm_tmux_cli kill-window -t "$wid" 2>/dev/null || true
     return 1
   fi
-  tmux set-window-option -t "$wid" automatic-rename off 2>/dev/null || true
-  tmux set-window-option -t "$wid" allow-rename off 2>/dev/null || true
+  fm_tmux_cli set-window-option -t "$wid" automatic-rename off 2>/dev/null || true
+  fm_tmux_cli set-window-option -t "$wid" allow-rename off 2>/dev/null || true
   printf '%s\n' "$wid"
 }
 
@@ -113,7 +131,7 @@ fm_backend_tmux_create_task() {  # <session> <window-name> <proj-abs> [task-mark
 # empty on any tmux error. Mirrors fm-spawn.sh's worktree-discovery poll:
 # `tmux display-message -p -t "$T" '#{pane_current_path}'`.
 fm_backend_tmux_current_path() {  # <target>
-  tmux display-message -p -t "$1" '#{pane_current_path}' 2>/dev/null
+  fm_tmux_cli display-message -p -t "$1" '#{pane_current_path}' 2>/dev/null
 }
 
 # fm_backend_tmux_send_text_line: send one line of TEXT then Enter, with no
@@ -121,7 +139,7 @@ fm_backend_tmux_current_path() {  # <target>
 # (`treehouse get`, the GOTMPDIR export) that already ran this exact sequence
 # inline in fm-spawn.sh. Mirrors `tmux send-keys -t "$T" "<text>" Enter`.
 fm_backend_tmux_send_text_line() {  # <target> <text>
-  tmux send-keys -t "$1" "$2" Enter
+  fm_tmux_cli send-keys -t "$1" "$2" Enter
 }
 
 # fm_backend_tmux_send_literal: send TEXT as literal bytes with no
@@ -129,7 +147,7 @@ fm_backend_tmux_send_text_line() {  # <target> <text>
 # send pauses between the literal send and Enter for the harness to settle).
 # Mirrors `tmux send-keys -t "$T" -l "<text>"`.
 fm_backend_tmux_send_literal() {  # <target> <text>
-  tmux send-keys -t "$1" -l "$2"
+  fm_tmux_cli send-keys -t "$1" -l "$2"
 }
 
 # Resolve any exact tmux handle accepted for a recorded task window to its
@@ -137,7 +155,7 @@ fm_backend_tmux_send_literal() {  # <target> <text>
 # fallback to the active window when a named target has disappeared.
 fm_backend_tmux_canonical_window() {  # <target> [task-marker] -> @<window-id>
   local target=$1 expected_marker=${2:-} out status pane_id window_id named named_pane indexed_window indexed_pane marker matched= named_seen=0
-  out=$(tmux list-panes -a -F '#{pane_id}|#{window_id}|#{session_name}:#{window_name}|#{session_name}:#{window_name}.#{pane_index}|#{session_name}:#{window_index}|#{session_name}:#{window_index}.#{pane_index}|#{@firstmate_task_marker}' 2>&1)
+  out=$(fm_tmux_cli list-panes -a -F '#{pane_id}|#{window_id}|#{session_name}:#{window_name}|#{session_name}:#{window_name}.#{pane_index}|#{session_name}:#{window_index}|#{session_name}:#{window_index}.#{pane_index}|#{@firstmate_task_marker}' 2>&1)
   status=$?
   if [ "$status" -ne 0 ]; then
     case "$out" in
@@ -180,7 +198,7 @@ fm_backend_tmux_canonical_window() {  # <target> [task-marker] -> @<window-id>
 # A readable inventory proves presence/absence; control-plane failures stay unknown.
 fm_backend_tmux_target_state() {  # <target> [task-marker] -> present|absent|unknown
   local target=$1 expected_marker=${2:-} out status pane_id window_id named indexed_window indexed_pane marker
-  out=$(tmux list-panes -a -F '#{pane_id}|#{window_id}|#{session_name}:#{window_name}|#{session_name}:#{window_index}|#{session_name}:#{window_index}.#{pane_index}|#{@firstmate_task_marker}' 2>&1)
+  out=$(fm_tmux_cli list-panes -a -F '#{pane_id}|#{window_id}|#{session_name}:#{window_name}|#{session_name}:#{window_index}|#{session_name}:#{window_index}.#{pane_index}|#{@firstmate_task_marker}' 2>&1)
   status=$?
   if [ "$status" -eq 0 ]; then
     while IFS='|' read -r pane_id window_id named indexed_window indexed_pane marker; do
@@ -219,7 +237,7 @@ fm_backend_tmux_kill() {  # <target>
   case "$session:$window" in
     :*|*:|*:*:*) return 1 ;;
   esac
-  tmux kill-window -t "=$session:=$window" 2>/dev/null || true
+  fm_tmux_cli kill-window -t "=$session:=$window" 2>/dev/null || true
 }
 
 # fm_backend_tmux_current_command: <target>'s live foreground process name -
@@ -232,7 +250,7 @@ fm_backend_tmux_kill() {  # <target>
 # own name throughout; the value reverts to the shell's own name only once
 # the foreground command actually exits). Empty on any tmux error.
 fm_backend_tmux_current_command() {  # <target>
-  tmux display-message -p -t "$1" '#{pane_current_command}' 2>/dev/null
+  fm_tmux_cli display-message -p -t "$1" '#{pane_current_command}' 2>/dev/null
 }
 
 # fm_backend_tmux_agent_state: recovery-grade harness-agent state for one
@@ -248,7 +266,7 @@ fm_backend_tmux_agent_state() {  # <target> [task-marker]
   local target=$1 expected_marker=${2:-} comm session window windows inventory_status found=0 marker=
   case "$target" in
     @*)
-      if windows=$(LC_ALL=C tmux list-panes -a -F '#{window_id}|#{@firstmate_task_marker}' 2>&1); then
+      if windows=$(LC_ALL=C fm_tmux_cli list-panes -a -F '#{window_id}|#{@firstmate_task_marker}' 2>&1); then
         inventory_status=0
       else
         inventory_status=$?
@@ -258,7 +276,7 @@ fm_backend_tmux_agent_state() {  # <target> [task-marker]
     *:*)
       session=${target%%:*}
       window=${target#*:}
-      if windows=$(LC_ALL=C tmux list-windows -t "$session" -F '#{window_name}|#{@firstmate_task_marker}' 2>&1); then
+      if windows=$(LC_ALL=C fm_tmux_cli list-windows -t "$session" -F '#{window_name}|#{@firstmate_task_marker}' 2>&1); then
         inventory_status=0
       else
         inventory_status=$?
@@ -310,7 +328,7 @@ fm_backend_tmux_agent_state() {  # <target> [task-marker]
 # Backward-compatible three-state view for callers that only need a yes/no
 # agent verdict. The detailed state contract is owned by fm_backend_agent_state.
 fm_backend_tmux_agent_alive() {  # <target>
-  case "$(fm_backend_tmux_agent_state "$1")" in
+  case "$(fm_backend_tmux_agent_state "$@")" in
     alive) printf 'alive' ;;
     dead|missing) printf 'dead' ;;
     *) printf 'unknown' ;;
diff --git a/bin/fm-backend.sh b/bin/fm-backend.sh
index 98d1ef9990..4ab71d3024 100644
--- a/bin/fm-backend.sh
+++ b/bin/fm-backend.sh
@@ -531,6 +531,25 @@ fm_backend_validate_task_endpoint() {  # <meta-file> <task-id>
   return 0
 }
 
+fm_backend_bind_meta_context() {
+  local meta=$1 socket
+  [ "$(fm_backend_of_meta "$meta")" = tmux ] || return 0
+  socket=$(fm_meta_get "$meta" tmux_socket_path)
+  if grep -q '^host_root=.' "$meta" 2>/dev/null && [ -z "$socket" ]; then
+    echo "error: host-root tmux metadata has no creating socket path: $meta" >&2
+    return 2
+  fi
+  if [ -z "$socket" ]; then
+    unset FM_BACKEND_TMUX_SOCKET
+    return 0
+  fi
+  fm_backend_source tmux || return 2
+  fm_backend_tmux_use_socket "$socket" || {
+    echo "error: host-root tmux metadata has an invalid creating socket path: $meta" >&2
+    return 2
+  }
+}
+
 fm_backend_assert_recorded_endpoint_identity() {
   local meta=$1 target marker
   [ "$(fm_backend_of_meta "$meta")" = tmux ] || return 0
@@ -541,7 +560,7 @@ fm_backend_assert_recorded_endpoint_identity() {
     echo "error: host-root tmux metadata has no task-owned window identity: $meta" >&2
     return 2
   fi
-  fm_backend_source tmux || return 2
+  fm_backend_bind_meta_context "$meta" || return $?
   if ! fm_backend_tmux_canonical_window "$target" "$marker" >/dev/null 2>&1; then
     echo "error: recorded tmux window identity does not match the live endpoint: $target" >&2
     return 2
@@ -549,55 +568,59 @@ fm_backend_assert_recorded_endpoint_identity() {
 }
 
 fm_backend_meta_for_window() {  # <target> <state-dir>
-  local target=$1 state=$2 meta window terminal
+  local target=$1 state=$2 meta window terminal matched=
   for meta in "$state"/*.meta; do
     [ -e "$meta" ] || continue
     window=$(fm_meta_get "$meta" window)
     terminal=$(fm_meta_get "$meta" terminal)
     { [ -n "$window" ] && [ "$window" = "$target" ]; } || { [ -n "$terminal" ] && [ "$terminal" = "$target" ]; } || continue
-    printf '%s' "$meta"
-    return 0
+    [ -z "$matched" ] || return 2
+    matched=$meta
   done
-  return 1
+  [ -n "$matched" ] || return 1
+  printf '%s' "$matched"
 }
 
 # Match an exact recorded target first, then recognize equivalent explicit tmux
 # handles by their inventory-backed window id. Bare names remain on the legacy
 # resolver because they can be ambiguous across sessions.
 fm_backend_meta_for_target() {  # <target> <state-dir>
-  local target=$1 state=$2 meta canonical recorded recorded_canonical host_meta=0
-  meta=$(fm_backend_meta_for_window "$target" "$state" 2>/dev/null || true)
-  if [ -n "$meta" ]; then
+  local target=$1 state=$2 meta canonical recorded recorded_canonical socket marker matched= status
+  local FM_BACKEND_TMUX_SOCKET=
+  if meta=$(fm_backend_meta_for_window "$target" "$state" 2>/dev/null); then
     printf '%s' "$meta"
     return 0
+  else
+    status=$?
   fi
+  [ "$status" -ne 2 ] || return 2
   case "$target" in
     *:*:*) return 1 ;; # Herdr uses session:workspace:pane and is never a tmux alias.
     *:*|%*|@*) ;;
     *) return 1 ;;
   esac
-  for meta in "$state"/*.meta; do
-    [ -e "$meta" ] || continue
-    [ "$(fm_backend_of_meta "$meta")" = tmux ] || continue
-    grep -q '^host_root=.' "$meta" 2>/dev/null || continue
-    host_meta=1
-    break
-  done
-  [ "$host_meta" = 1 ] || return 1
   fm_backend_source tmux >/dev/null 2>&1 || return 1
-  canonical=$(fm_backend_tmux_canonical_window "$target" 2>/dev/null) || return 1
   for meta in "$state"/*.meta; do
     [ -e "$meta" ] || continue
     [ "$(fm_backend_of_meta "$meta")" = tmux ] || continue
     grep -q '^host_root=.' "$meta" 2>/dev/null || continue
+    socket=$(fm_meta_get "$meta" tmux_socket_path)
+    marker=$(fm_meta_get "$meta" tmux_window_marker)
+    if [ -n "$socket" ] && [ -n "$marker" ]; then
+      fm_backend_tmux_use_socket "$socket" || continue
+    else
+      FM_BACKEND_TMUX_SOCKET=
+    fi
+    canonical=$(fm_backend_tmux_canonical_window "$target" 2>/dev/null) || continue
     recorded=$(fm_backend_target_of_meta "$meta")
     [ -n "$recorded" ] || continue
-    recorded_canonical=$(fm_backend_tmux_canonical_window "$recorded" 2>/dev/null) || continue
+    recorded_canonical=$(fm_backend_tmux_canonical_window "$recorded" "$marker" 2>/dev/null) || continue
     [ "$recorded_canonical" = "$canonical" ] || continue
-    printf '%s' "$meta"
-    return 0
+    [ -z "$matched" ] || return 2
+    matched=$meta
   done
-  return 1
+  [ -n "$matched" ] || return 1
+  printf '%s' "$matched"
 }
 
 fm_backend_task_id_for_selector() {  # <raw-target> <state-dir>
@@ -704,10 +727,19 @@ fm_backend_source() {  # <name>
 #   anything else      treated as an ad hoc bare window name and resolved by
 #                      searching the legacy tmux live inventory.
 fm_backend_resolve_selector() {  # <raw-target> <state-dir>
-  local raw=$1 state=$2 meta window
+  local raw=$1 state=$2 meta window status
   meta=$(fm_backend_meta_for_selector "$raw" "$state" 2>/dev/null || true)
   if [ -z "$meta" ]; then
-    meta=$(fm_backend_meta_for_target "$raw" "$state" 2>/dev/null || true)
+    if meta=$(fm_backend_meta_for_target "$raw" "$state" 2>/dev/null); then
+      :
+    else
+      status=$?
+      [ "$status" -ne 2 ] || {
+        echo "error: backend target '$raw' matches multiple task records" >&2
+        return 2
+      }
+      meta=
+    fi
   fi
   if [ -n "$meta" ]; then
     window=$(fm_backend_target_of_meta "$meta")
@@ -881,7 +913,8 @@ fm_backend_target_exists() {  # <backend> <target> [expected-label]
   local backend=$1 target=$2 expected_label=${3:-} session pane
   case "$backend" in
     tmux)
-      tmux display-message -p -t "$target" '#{pane_id}' >/dev/null 2>&1
+      fm_backend_source tmux || return 1
+      fm_tmux_cli display-message -p -t "$target" '#{pane_id}' >/dev/null 2>&1
       ;;
     herdr)
       fm_backend_source herdr || return 1
@@ -950,8 +983,9 @@ fm_backend_target_state() {  # <backend> <target> [zellij-tab-id] [expected-labe
 # Stop a task endpoint and prove it disappeared before any caller recycles or
 # removes the task's worktree. Kill adapters remain idempotent; this stricter
 # owner is for destructive cleanup paths that must not trust best-effort close.
-fm_backend_stop_and_verify() {  # <backend> <target> [zellij-tab-id] [expected-label] [require-stable-tmux-id] [tmux-marker]
-  local backend=$1 target=$2 expected_label=${4:-} require_stable_tmux_id=${5:-0} tmux_marker=${6:-} attempts=${FM_BACKEND_STOP_ATTEMPTS:-20} delay=${FM_BACKEND_STOP_DELAY:-0.1} i=0 state=unknown stop_target=$2 resolve_status
+fm_backend_stop_and_verify() {  # <backend> <target> [zellij-tab-id] [expected-label] [require-stable-tmux-id] [tmux-marker] [tmux-socket-path]
+  local backend=$1 target=$2 expected_label=${4:-} require_stable_tmux_id=${5:-0} tmux_marker=${6:-} tmux_socket=${7:-} attempts=${FM_BACKEND_STOP_ATTEMPTS:-20} delay=${FM_BACKEND_STOP_DELAY:-0.1} i=0 state=unknown stop_target=$2 resolve_status
+  local FM_BACKEND_TMUX_SOCKET=
   [ -n "$target" ] || { echo "error: missing backend endpoint id; refusing destructive cleanup" >&2; return 1; }
   case "$attempts" in ''|*[!0-9]*|0) attempts=20 ;; esac
   if [ "$backend" = tmux ]; then
@@ -960,6 +994,14 @@ fm_backend_stop_and_verify() {  # <backend> <target> [zellij-tab-id] [expected-l
       echo "error: backend endpoint $target has no task-owned tmux window marker; refusing destructive cleanup" >&2
       return 1
     fi
+    if [ "$require_stable_tmux_id" = 1 ] && [ -z "$tmux_socket" ]; then
+      echo "error: backend endpoint $target has no creating tmux socket path; refusing destructive cleanup" >&2
+      return 1
+    fi
+    [ -z "$tmux_socket" ] || fm_backend_tmux_use_socket "$tmux_socket" || {
+      echo "error: backend endpoint $target has an invalid creating tmux socket path; refusing destructive cleanup" >&2
+      return 1
+    }
     stop_target=$(fm_backend_tmux_canonical_window "$target" "$tmux_marker" 2>/dev/null) || {
       resolve_status=$?
       if [ "$resolve_status" -eq 2 ]; then
@@ -990,11 +1032,19 @@ fm_backend_stop_and_verify() {  # <backend> <target> [zellij-tab-id] [expected-l
 }
 
 # Implement the recovery-grade state contract described above.
-fm_backend_agent_state() {  # <backend> <target> [tmux-marker]
-  local backend=$1 target=$2 tmux_marker=${3:-}
+fm_backend_agent_state() {  # <backend> <target> [tmux-marker] [tmux-socket-path]
+  local backend=$1 target=$2 tmux_marker=${3:-} tmux_socket=${4:-}
+  local FM_BACKEND_TMUX_SOCKET=
   fm_backend_source "$backend" || { printf 'unverified'; return 0; }
   case "$backend" in
-    tmux) fm_backend_tmux_agent_state "$target" "$tmux_marker" ;;
+    tmux)
+      if { [ -n "$tmux_marker" ] && [ -z "$tmux_socket" ]; } \
+         || { [ -n "$tmux_socket" ] && ! fm_backend_tmux_use_socket "$tmux_socket"; }; then
+        printf 'unreadable'
+      else
+        fm_backend_tmux_agent_state "$target" "$tmux_marker"
+      fi
+      ;;
     herdr) fm_backend_herdr_agent_state "$target" ;;
     *) printf 'unverified' ;;
   esac
diff --git a/bin/fm-crew-state.sh b/bin/fm-crew-state.sh
index cd7c6051eb..d5160f925d 100755
--- a/bin/fm-crew-state.sh
+++ b/bin/fm-crew-state.sh
@@ -146,11 +146,11 @@ LOG_VERB=$(status_line_verb "$LOG_LINE")
 TASK_BACKEND=$(fm_backend_of_meta "$META")
 BACKEND_TARGET=$(fm_backend_target_of_meta "$META")
 EXPECTED_LABEL="fm-$ID"
+TASK_BACKEND_CONTEXT_OK=1
+fm_backend_bind_meta_context "$META" >/dev/null 2>&1 || TASK_BACKEND_CONTEXT_OK=0
 pane_readable() {  # <target>
-  case "$TASK_BACKEND" in
-    tmux) tmux display-message -p -t "$1" '#{pane_id}' >/dev/null 2>&1 ;;
-    *) fm_backend_capture "$TASK_BACKEND" "$1" 1 "$EXPECTED_LABEL" >/dev/null 2>&1 ;;
-  esac
+  [ "$TASK_BACKEND_CONTEXT_OK" -eq 1 ] || return 1
+  fm_backend_target_exists "$TASK_BACKEND" "$1" "$EXPECTED_LABEL" >/dev/null 2>&1
 }
 # crew_pane_is_busy: the busy-signature fallback, backend-aware the same way -
 # fm_backend_busy_state's native semantic state (herdr's agent.get) when
@@ -177,6 +177,7 @@ pane_readable() {  # <target>
 # dialog, not mid-tool-call) does not render the busy banner, so this
 # corroboration does not mask that case: it stays correctly not-busy.
 crew_pane_is_busy() {  # <target>
+  [ "$TASK_BACKEND_CONTEXT_OK" -eq 1 ] || return 1
   case "$TASK_BACKEND" in
     tmux) fm_pane_is_busy "$1" "$HARNESS" ;;
     *)
diff --git a/bin/fm-fleet-snapshot.sh b/bin/fm-fleet-snapshot.sh
index 1dee81bb84..3e3d26ac65 100755
--- a/bin/fm-fleet-snapshot.sh
+++ b/bin/fm-fleet-snapshot.sh
@@ -469,7 +469,8 @@ task_json_lines() {
 
     endpoint_exists=null
     if [ -n "$target" ]; then
-      if fm_backend_target_exists "$backend" "$target" "fm-$id" >/dev/null 2>&1; then
+      if ( fm_backend_bind_meta_context "$meta" >/dev/null 2>&1 \
+        && fm_backend_target_exists "$backend" "$target" "fm-$id" >/dev/null 2>&1 ); then
         endpoint_exists=true
       else
         endpoint_exists=false
diff --git a/bin/fm-peek.sh b/bin/fm-peek.sh
index 2b871cc49a..423e83c272 100755
--- a/bin/fm-peek.sh
+++ b/bin/fm-peek.sh
@@ -18,7 +18,16 @@ STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 RAW_TARGET=$1
 TASK_META=$(fm_backend_meta_for_selector "$RAW_TARGET" "$STATE" 2>/dev/null || true)
 if [ -z "$TASK_META" ]; then
-  TASK_META=$(fm_backend_meta_for_target "$RAW_TARGET" "$STATE" 2>/dev/null || true)
+  if TASK_META=$(fm_backend_meta_for_target "$RAW_TARGET" "$STATE" 2>/dev/null); then
+    :
+  else
+    status=$?
+    [ "$status" -ne 2 ] || {
+      echo "error: backend target '$RAW_TARGET' matches multiple task records" >&2
+      exit 2
+    }
+    TASK_META=
+  fi
 fi
 if [ -n "$TASK_META" ]; then
   fm_host_root_assert_task_cwd "$FM_ROOT" "$TASK_META" || exit $?
diff --git a/bin/fm-send.sh b/bin/fm-send.sh
index 03c27602ca..1e1e275329 100755
--- a/bin/fm-send.sh
+++ b/bin/fm-send.sh
@@ -159,7 +159,16 @@ fm_send_resolve_target() {  # <raw-target>
     return 1
   fi
 
-  meta=$(fm_backend_meta_for_target "$raw" "$STATE" 2>/dev/null || true)
+  if meta=$(fm_backend_meta_for_target "$raw" "$STATE" 2>/dev/null); then
+    :
+  else
+    status=$?
+    [ "$status" -ne 2 ] || {
+      echo "error: backend target '$raw' matches multiple task records" >&2
+      return 2
+    }
+    meta=
+  fi
   if [ -n "$meta" ]; then
     if [ "$meta" != "${BOUND_META:-}" ]; then
       fm_host_root_assert_task_cwd "$FM_ROOT" "$meta" || return $?
diff --git a/bin/fm-session-start.sh b/bin/fm-session-start.sh
index be26c31073..7302da4ff0 100755
--- a/bin/fm-session-start.sh
+++ b/bin/fm-session-start.sh
@@ -362,7 +362,8 @@ for meta in "$STATE"/*.meta; do
   target=$(fm_backend_target_of_meta "$meta")
   if [ -n "$window" ]; then
     backend=$(fm_backend_of_meta "$meta")
-    if fm_backend_target_exists "$backend" "${target:-$window}" "fm-$id"; then
+    if ( fm_backend_bind_meta_context "$meta" >/dev/null 2>&1 \
+      && fm_backend_target_exists "$backend" "${target:-$window}" "fm-$id" ); then
       printf 'endpoint: alive (backend=%s window=%s)\n' "$backend" "$window"
     else
       printf 'endpoint: dead (backend=%s window=%s)\n' "$backend" "$window"
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 98795c5b02..70b9186c5f 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -332,6 +332,8 @@ CONFIG_INHERIT_LOCK_HELD=0
 CMUX_WORKSPACE_ID=
 CMUX_SURFACE_ID=
 TMUX_WINDOW_MARKER=
+TMUX_SOCKET_PATH=
+FM_BACKEND_TMUX_SOCKET=
 
 parse_orca_worktree_result() {
   local raw=$1 rest
@@ -402,6 +404,7 @@ write_abort_meta() {
     [ -z "${CMUX_WORKSPACE_ID:-}" ] || echo "cmux_workspace_id=$CMUX_WORKSPACE_ID"
     [ -z "${CMUX_SURFACE_ID:-}" ] || echo "cmux_surface_id=$CMUX_SURFACE_ID"
     [ -z "${TMUX_WINDOW_MARKER:-}" ] || echo "tmux_window_marker=$TMUX_WINDOW_MARKER"
+    [ -z "${TMUX_SOCKET_PATH:-}" ] || echo "tmux_socket_path=$TMUX_SOCKET_PATH"
   } > "$STATE/$ID.meta" 2>/dev/null || true
 }
 
@@ -472,7 +475,7 @@ spawn_abort_cleanup() {
       # recycle a worktree while endpoint absence is unknown.
       cleanup_failed=1
       endpoint_stopped=0
-    elif [ -n "${T:-}" ] && ! fm_backend_stop_and_verify "$BACKEND" "$T" "${ZELLIJ_TAB_ID:-}" "${W:-fm-$ID}" "$HOST_MODE" "${TMUX_WINDOW_MARKER:-}"; then
+    elif [ -n "${T:-}" ] && ! fm_backend_stop_and_verify "$BACKEND" "$T" "${ZELLIJ_TAB_ID:-}" "${W:-fm-$ID}" "$HOST_MODE" "${TMUX_WINDOW_MARKER:-}" "${TMUX_SOCKET_PATH:-}"; then
       cleanup_failed=1
       endpoint_stopped=0
     fi
@@ -1190,12 +1193,18 @@ herdr_projection_existing_meta_allows_flat() {  # <meta>
         ;;
     esac
   fi
-  if [ "$old_backend" = tmux ] && grep -q '^host_root=.' "$meta" 2>/dev/null \
-     && [ -z "$(fm_meta_get "$meta" tmux_window_marker)" ]; then
-    echo "error: existing host-root tmux metadata for $ID has no task-owned window identity; refusing duplicate launch" >&2
-    return 1
+  if [ "$old_backend" = tmux ] && grep -q '^host_root=.' "$meta" 2>/dev/null; then
+    if [ -z "$(fm_meta_get "$meta" tmux_window_marker)" ]; then
+      echo "error: existing host-root tmux metadata for $ID has no task-owned window identity; refusing duplicate launch" >&2
+      return 1
+    fi
+    if [ -z "$(fm_meta_get "$meta" tmux_socket_path)" ]; then
+      echo "error: existing host-root tmux metadata for $ID has no creating socket path; refusing duplicate launch" >&2
+      return 1
+    fi
   fi
-  old_state=$(fm_backend_agent_alive "$old_backend" "$old_target" "$(fm_meta_get "$meta" tmux_window_marker)")
+  old_state=$(fm_backend_agent_alive "$old_backend" "$old_target" \
+    "$(fm_meta_get "$meta" tmux_window_marker)" "$(fm_meta_get "$meta" tmux_socket_path)")
   case "$old_state" in
     dead) return 0 ;;
     alive|unknown)
@@ -1215,7 +1224,14 @@ case "$BACKEND" in
     # non-default tmux config cannot rename the window away from fm-<id> once
     # treehouse cd's into the worktree. WT_TARGET carries that stable id for the
     # rename-critical worktree-detection steps below.
-    [ "$HOST_MODE" -eq 0 ] || TMUX_WINDOW_MARKER=$(fm_backend_tmux_task_marker) || exit 1
+    if [ "$HOST_MODE" -eq 1 ]; then
+      TMUX_WINDOW_MARKER=$(fm_backend_tmux_task_marker) || exit 1
+      TMUX_SOCKET_PATH=$(fm_backend_tmux_socket_path) || {
+        echo "error: could not resolve the creating tmux socket path" >&2
+        exit 1
+      }
+      fm_backend_tmux_use_socket "$TMUX_SOCKET_PATH" || exit 1
+    fi
     WID=$(fm_backend_tmux_create_task "$SES" "$W" "$PROJ_ABS" "$TMUX_WINDOW_MARKER") || exit 1
     WT_TARGET="$WID"
     [ "$HOST_MODE" -eq 0 ] || T=$WID
@@ -1784,6 +1800,7 @@ META_WINDOW=$T
   # data/fm-backend-design-d7's P1 compatibility contract).
   [ "$BACKEND" = tmux ] || echo "backend=$BACKEND"
   [ -z "$TMUX_WINDOW_MARKER" ] || echo "tmux_window_marker=$TMUX_WINDOW_MARKER"
+  [ -z "$TMUX_SOCKET_PATH" ] || echo "tmux_socket_path=$TMUX_SOCKET_PATH"
   if [ "$BACKEND" = herdr ]; then
     echo "herdr_session=$HERDR_SES"
     echo "herdr_workspace_id=$HERDR_WORKSPACE_ID"
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index 0841d92e42..15d86d5240 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -1052,7 +1052,8 @@ cleanup_firstmate_home_children() {
       return 1
     elif [ "$child_host_mode" -eq 1 ]; then
       ( unset FM_ROOT_OVERRIDE FM_CONFIG_OVERRIDE; FM_HOME=$home FM_ROOT=$home \
-        fm_backend_stop_and_verify "$child_backend" "$child_t" "$(meta_value "$child_meta" zellij_tab_id)" "fm-$child_id" 1 "$(meta_value "$child_meta" tmux_window_marker)" ) || return 1
+        fm_backend_stop_and_verify "$child_backend" "$child_t" "$(meta_value "$child_meta" zellij_tab_id)" "fm-$child_id" 1 \
+          "$(meta_value "$child_meta" tmux_window_marker)" "$(meta_value "$child_meta" tmux_socket_path)" ) || return 1
     elif [ -n "$child_t" ]; then
       case "$child_backend" in
         zellij)
@@ -1196,7 +1197,8 @@ fi
 stop_task_endpoint_and_verify() {
   local focus_lock='' focus_lock_held=0 attempt=0 endpoint_state close_status=0
   if [ "$BACKEND" != herdr ] || [ "$HERDR_PRESENTATION_JOURNAL_PRESENT" != 1 ]; then
-    fm_backend_stop_and_verify "$BACKEND" "$T" "$(meta_value "$META" zellij_tab_id)" "fm-$ID" "$TASK_HOST_MODE" "$(meta_value "$META" tmux_window_marker)"
+    fm_backend_stop_and_verify "$BACKEND" "$T" "$(meta_value "$META" zellij_tab_id)" "fm-$ID" "$TASK_HOST_MODE" \
+      "$(meta_value "$META" tmux_window_marker)" "$(meta_value "$META" tmux_socket_path)"
     return
   fi
   if [ -z "$HERDR_PRESENTATION_SESSION" ] \
diff --git a/bin/fm-tmux-lib.sh b/bin/fm-tmux-lib.sh
index cf8c3f7fa5..46c8e445b0 100755
--- a/bin/fm-tmux-lib.sh
+++ b/bin/fm-tmux-lib.sh
@@ -60,6 +60,14 @@
 # shellcheck source=bin/fm-composer-lib.sh
 . "$(dirname -- "${BASH_SOURCE[0]}")/fm-composer-lib.sh"
 
+fm_tmux_cli() {
+  if [ -n "${FM_BACKEND_TMUX_SOCKET:-}" ]; then
+    tmux -S "$FM_BACKEND_TMUX_SOCKET" "$@"
+  else
+    tmux "$@"
+  fi
+}
+
 # Busy footers per harness (mirror fm-watch.sh). claude/codex: "esc to
 # interrupt"; opencode: "esc interrupt"; pi: "Working..."; grok: "Ctrl+c:cancel".
 # Claude's current spinner has a rotating glyph and word, but every active-turn
@@ -310,9 +318,9 @@ EOF
 fm_tmux_composer_state() {  # <target> -> empty|pending|pending-unproven|unknown
   local target=$1 cy raw pane plain box box_status top bottom geometry_ambiguous
   local row row_raw state unknown_seen=0
-  cy=$(tmux display-message -p -t "$target" '#{cursor_y}' 2>/dev/null) || { printf 'unknown'; return 0; }
+  cy=$(fm_tmux_cli display-message -p -t "$target" '#{cursor_y}' 2>/dev/null) || { printf 'unknown'; return 0; }
   case "$cy" in ''|*[!0-9]*) printf 'unknown'; return 0 ;; esac
-  pane=$(tmux capture-pane -e -p -t "$target" -S 0 -E - 2>/dev/null) || { printf 'unknown'; return 0; }
+  pane=$(fm_tmux_cli capture-pane -e -p -t "$target" -S 0 -E - 2>/dev/null) || { printf 'unknown'; return 0; }
   plain=$(printf '%s\n' "$pane" | fm_composer_strip_ansi)
   if box=$(fm_tmux_find_composer_box "$cy" "$plain"); then
     top=${box%% *}
@@ -349,7 +357,7 @@ fm_tmux_composer_state() {  # <target> -> empty|pending|pending-unproven|unknown
       return 0
     fi
   fi
-  raw=$(tmux capture-pane -e -p -t "$target" -S "$cy" -E "$cy" 2>/dev/null) \
+  raw=$(fm_tmux_cli capture-pane -e -p -t "$target" -S "$cy" -E "$cy" 2>/dev/null) \
     || { printf 'unknown'; return 0; }
   if fm_tmux_row_has_composer_edge "$(printf '%s\n' "$raw" | fm_composer_strip_ansi)"; then
     printf 'unknown'
@@ -368,7 +376,7 @@ fm_pane_input_pending() {  # <target>
 # (an agent mid-turn). Scans a 40-line tail like fm-watch.sh.
 fm_pane_is_busy() {  # <target> [harness]
   local win=$1 harness=${2:-} tail40
-  tail40=$(tmux capture-pane -p -t "$win" -S -40 2>/dev/null) || return 1
+  tail40=$(fm_tmux_cli capture-pane -p -t "$win" -S -40 2>/dev/null) || return 1
   printf '%s' "$tail40" | grep -v '^[[:space:]]*$' | tail -12 \
     | fm_busy_lines_match "$harness"
 }
@@ -389,7 +397,7 @@ fm_pane_is_busy() {  # <target> [harness]
 fm_tmux_submit_enter_core() {  # <target> <retries> <enter-sleep>
   local target=$1 retries=$2 sleep_s=$3 i=0 state
   while :; do
-    tmux send-keys -t "$target" Enter 2>/dev/null || true
+    fm_tmux_cli send-keys -t "$target" Enter 2>/dev/null || true
     sleep "$sleep_s"
     state=$(fm_tmux_composer_state "$target")
     case "$state" in
@@ -417,7 +425,7 @@ fm_tmux_submit_enter_core() {  # <target> <retries> <enter-sleep>
 
 fm_tmux_submit_core() {  # <target> <text> <retries> <enter-sleep> <settle>
   local target=$1 text=$2 retries=$3 sleep_s=$4 settle=$5
-  tmux send-keys -t "$target" -l "$text" 2>/dev/null || { printf 'send-failed'; return 0; }
+  fm_tmux_cli send-keys -t "$target" -l "$text" 2>/dev/null || { printf 'send-failed'; return 0; }
   sleep "$settle"
   fm_tmux_submit_enter_core "$target" "$retries" "$sleep_s"
 }
diff --git a/bin/fm-watch.sh b/bin/fm-watch.sh
index e5501f852b..681693d5c8 100755
--- a/bin/fm-watch.sh
+++ b/bin/fm-watch.sh
@@ -244,6 +244,24 @@ window_label() {
   [ -n "$task" ] && printf 'fm-%s' "$task"
 }
 
+window_bind_context() {
+  local meta
+  meta=$(fm_backend_meta_for_window "$1" "$STATE" 2>/dev/null || true)
+  [ -n "$meta" ] || return 0
+  fm_backend_bind_meta_context "$meta"
+}
+
+window_agent_alive() {
+  local meta backend marker socket
+  meta=$(fm_backend_meta_for_window "$1" "$STATE" 2>/dev/null || true)
+  backend=$(window_backend "$1")
+  if [ -n "$meta" ]; then
+    marker=$(fm_meta_get "$meta" tmux_window_marker)
+    socket=$(fm_meta_get "$meta" tmux_socket_path)
+  fi
+  fm_backend_agent_alive "$backend" "$1" "${marker:-}" "${socket:-}"
+}
+
 recorded_windows() {
   local meta w seen=
   for meta in "$STATE"/*.meta; do
@@ -382,7 +400,7 @@ pause_state_class() {  # <window> <task>
   fi
   if [ -e "$STATE/.paused-$key" ] && [ "$(age_of "$recheck_file")" -lt "$STALE_ESCALATE_SECS" ]; then
     if [ "$(window_kind "$win")" != secondmate ]; then
-      agent_alive=$(fm_backend_agent_alive "$(window_backend "$win")" "$win" 2>/dev/null) || agent_alive=unknown
+      agent_alive=$(window_agent_alive "$win" 2>/dev/null) || agent_alive=unknown
       if [ "$agent_alive" != dead ]; then
         rm -f "$recheck_file"
         printf 'none'
@@ -399,7 +417,7 @@ pause_state_class() {  # <window> <task>
     return
   fi
   if [ "$(window_kind "$win")" != secondmate ]; then
-    agent_alive=$(fm_backend_agent_alive "$(window_backend "$win")" "$win" 2>/dev/null) || agent_alive=unknown
+    agent_alive=$(window_agent_alive "$win" 2>/dev/null) || agent_alive=unknown
     if [ "$agent_alive" != dead ]; then
       rm -f "$recheck_file"
       printf 'none'
@@ -877,7 +895,8 @@ EOF
     if [ "$kind" = secondmate ] && ! status_is_paused "$last"; then
       continue
     fi
-    tail40=$(fm_backend_capture "$(window_backend "$w")" "$w" 40 "$(window_label "$w")" 2>/dev/null) || continue
+    tail40=$( ( window_bind_context "$w" \
+      && fm_backend_capture "$(window_backend "$w")" "$w" 40 "$(window_label "$w")" ) 2>/dev/null) || continue
     h=$(printf '%s' "$tail40" | hash_pane)
     key=$(printf '%s' "$w" | tr ':/.' '___')
     hf="$STATE/.hash-$key"
diff --git a/tests/fm-backend.test.sh b/tests/fm-backend.test.sh
index 2369e8826b..0af9b2f5bd 100755
--- a/tests/fm-backend.test.sh
+++ b/tests/fm-backend.test.sh
@@ -1182,7 +1182,7 @@ test_stop_and_verify_requires_confirmed_absence() {
     . "$1/bin/fm-backend.sh"; fm_backend_source tmux
     fm_backend_tmux_canonical_window() { return 2; }
     fm_backend_kill() { printf called; }
-    fm_backend_stop_and_verify tmux session:renamed "" "" 1 marker
+    fm_backend_stop_and_verify tmux session:renamed "" "" 1 marker /owner.sock
   ' _ "$ROOT" 2>&1) || status=$?
   expect_code 1 "$status" "an unresolved legacy tmux alias must not prove absence"
   assert_contains "$out" 'could not be resolved to a stable tmux window' \
@@ -1219,6 +1219,16 @@ test_stop_and_verify_requires_confirmed_absence() {
   assert_contains "$out" 'has no task-owned tmux window marker' "missing tmux marker refusal was not explicit"
   assert_not_contains "$out" 'called' "missing tmux marker invoked a backend kill"
 
+  status=0
+  out=$(bash -c '
+    . "$1/bin/fm-backend.sh"; fm_backend_source tmux
+    fm_backend_kill() { printf called; }
+    fm_backend_stop_and_verify tmux @7 "" "" 1 expected-task
+  ' _ "$ROOT" 2>&1) || status=$?
+  expect_code 1 "$status" "host-root teardown must require its creating tmux socket"
+  assert_contains "$out" 'has no creating tmux socket path' "missing tmux socket refusal was not explicit"
+  assert_not_contains "$out" 'called' "missing tmux socket invoked a backend kill"
+
   status=0
   out=$(bash -c '
     . "$1/bin/fm-backend.sh"; fm_backend_source tmux
@@ -1226,7 +1236,7 @@ test_stop_and_verify_requires_confirmed_absence() {
       printf "%%7|@7|session:task|session:task.0|session:7|session:7.0|other-task\n"
     }
     fm_backend_kill() { printf called; }
-    fm_backend_stop_and_verify tmux @7 "" "" 1 expected-task
+    fm_backend_stop_and_verify tmux @7 "" "" 1 expected-task /owner.sock
   ' _ "$ROOT" 2>&1) || status=$?
   expect_code 1 "$status" "host-root teardown trusted a reused tmux window id"
   assert_contains "$out" 'could not be resolved to a stable tmux window' "reused tmux id refusal was not explicit"
@@ -1259,15 +1269,47 @@ test_stop_and_verify_requires_confirmed_absence() {
   out=$(bash -c '
     . "$1/bin/fm-backend.sh"; fm_backend_source tmux
     tmux() {
+      [ "${1:-}" != -S ] || shift 2
       case "$1" in
         list-panes) printf "@7|other-task\n" ;;
         display-message) printf "codex\n" ;;
       esac
     }
-    fm_backend_agent_state tmux @7 expected-task
+    fm_backend_agent_state tmux @7 expected-task /owner.sock
   ' _ "$ROOT")
   [ "$out" = unreadable ] || fail "tmux agent state trusted a reused server-local window id: '$out'"
 
+  local socket_dir="$TMP_ROOT/tmux-owner-socket"
+  mkdir -p "$socket_dir"
+  status=0
+  out=$(FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 bash -c '
+    . "$1/bin/fm-backend.sh"; fm_backend_source tmux
+    tmux() {
+      local socket=ambient
+      if [ "${1:-}" = -S ]; then
+        socket=$2
+        shift 2
+      fi
+      { printf "%s" "$socket"; for arg in "$@"; do printf "\037%s" "$arg"; done; printf "\n"; } >> "$FM_SOCKET_TEST_LOG"
+      case "$1" in
+        list-panes)
+          if [ "$socket" = /owner.sock ] && [ ! -e "$FM_SOCKET_TEST_STOPPED" ]; then
+            case "$*" in
+              *"#{pane_id}"*) printf "%%7|@7|session:task|session:task.0|session:7|session:7.0|expected-task\n" ;;
+              *) printf "@7|expected-task\n" ;;
+            esac
+          fi
+          ;;
+        kill-window) : > "$FM_SOCKET_TEST_STOPPED" ;;
+      esac
+    }
+    export FM_SOCKET_TEST_LOG=$2 FM_SOCKET_TEST_STOPPED=$3
+    fm_backend_stop_and_verify tmux @7 "" "" 1 expected-task /owner.sock
+  ' _ "$ROOT" "$socket_dir/log" "$socket_dir/stopped" 2>&1) || status=$?
+  expect_code 0 "$status" "host-root teardown did not use the creating tmux socket: $out"
+  assert_present "$socket_dir/stopped" "creating-socket teardown left the owning tmux window alive"
+  assert_no_grep '^ambient' "$socket_dir/log" "creating-socket teardown consulted ambient tmux"
+
   status=0
   out=$(FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 bash -c '
     . "$1/bin/fm-backend.sh"; fm_backend_source tmux
diff --git a/tests/fm-host-root-mode.test.sh b/tests/fm-host-root-mode.test.sh
index 4da53c2f8a..0dffad26cd 100644
--- a/tests/fm-host-root-mode.test.sh
+++ b/tests/fm-host-root-mode.test.sh
@@ -238,6 +238,10 @@ printf '%s\037' "$@" >> "$FM_TMUX_LOG"; printf '\n' >> "$FM_TMUX_LOG"
 endpoint=${FM_ENDPOINT_ALIVE:-$FM_CURRENT_PATH.endpoint}
 marker_file=${FM_TMUX_MARKER_FILE:-$endpoint.marker}
 marker=$(cat "$marker_file" 2>/dev/null || true)
+socket_path=${FM_TMUX_SOCKET_PATH:-$FM_CURRENT_PATH.tmux-socket}
+if [ "${1:-}" = -S ]; then
+  shift 2
+fi
 if [ "${1:-}" = send-keys ] && printf '%s\n' "$*" | grep -q -- ' -l '; then
   case "${*: -1}" in
     'Read the brief at '*' and follow it exactly.') : ;;
@@ -252,6 +256,7 @@ fi
 case "${1:-}" in
   display-message)
     case "$*" in
+      *'#{socket_path}'*) printf '%s\n' "$socket_path" ;;
       *'#{pane_current_path}'*) [ -f "$endpoint" ] && cat "$FM_CURRENT_PATH" ;;
       *'#{cursor_y}'*) printf '0\n' ;;
       *'#{window_id}'*) [ -f "$endpoint" ] && printf '@1\n' ;;
@@ -388,7 +393,7 @@ test_host_scout_records_logical_project_mode() {
 }
 
 test_spawn_separates_roots() {
-  local host="$TMP/spawn & host" home="$TMP/spawn home's & #%?" project="$TMP/target & repo" wt="$TMP/target & worktree" fb log current launch obs argv turnend meta marker marker_file out status=0 before after tree_line cd_line launch_line
+  local host="$TMP/spawn & host" home="$TMP/spawn home's & #%?" project="$TMP/target & repo" wt="$TMP/target & worktree" fb log current launch obs argv turnend meta marker marker_file socket out status=0 before after tree_line cd_line launch_line
   make_host "$host"
   mkdir -p "$home/data/lane" "$home/state" "$home/config"
   fm_git_init_commit "$project"
@@ -407,9 +412,12 @@ test_spawn_separates_roots() {
   assert_grep "host_root=$host" "$meta" "spawn meta lost host root"
   assert_grep 'window=@1' "$meta" "host-root spawn did not persist the immutable tmux window id"
   marker=$(sed -n 's/^tmux_window_marker=//p' "$meta")
+  socket=$(sed -n 's/^tmux_socket_path=//p' "$meta")
   marker_file="$current.endpoint.marker"
   [ -n "$marker" ] || fail "host-root spawn did not persist a task-owned tmux marker"
+  [ "$socket" = "$current.tmux-socket" ] || fail "host-root spawn did not persist its creating tmux socket"
   [ "$(cat "$marker_file")" = "$marker" ] || fail "host-root spawn did not bind the live tmux window to its recorded marker"
+  assert_grep $'-S\037'"$socket" "$log" "host-root spawn did not keep task operations on the creating tmux socket"
   assert_contains "$(cat "$log")" "FM_TARGET_WORKTREE='$wt'" "child launch did not export exact target worktree"
   assert_contains "$(cat "$log")" "FM_HOST_ROOT='$host'" "child launch did not export exact host root"
   assert_contains "$(cat "$log")" 'notify=[' "Codex FirstMate turn-end safeguard was not retained"
@@ -945,7 +953,7 @@ SH
   for action in hold complete resolve; do
     action_id="decision-post-teardown-$action"
     mkdir -p "$home/data/$action_id"
-    printf 'window=test-session:fm-%s\nworktree=/tmp/decision-target\nhost_root=%s\nproject=/tmp/project\nkind=ship\nmode=local-only\ntmux_window_marker=decision-marker\n' \
+    printf 'window=test-session:fm-%s\nworktree=/tmp/decision-target\nhost_root=%s\nproject=/tmp/project\nkind=ship\nmode=local-only\ntmux_window_marker=decision-marker\ntmux_socket_path=/tmp/fm-test.sock\n' \
       "$action_id" "$host" > "$home/state/$action_id.meta"
     printf '%s\n' "$host" > "$current"
     : > "$current.endpoint"
@@ -988,7 +996,7 @@ test_host_teardown_requires_confirmed_stop() {
   local host="$TMP/teardown-host" home="$TMP/teardown-home" project="$TMP/teardown-project" wt="$TMP/teardown-wt" fb log current tree_log out status=0 kill_line verify_line return_line
   make_host "$host"; mkdir -p "$home/data/host-teardown" "$home/state" "$home/config"; fm_git_init_commit "$project"
   git -C "$project" worktree add -q --detach "$wt"
-  printf 'window=test-session:fm-host-teardown\nworktree=%s\nhost_root=%s\nproject=%s\nkind=ship\nmode=local-only\ntmux_window_marker=teardown-marker\n' \
+  printf 'window=test-session:fm-host-teardown\nworktree=%s\nhost_root=%s\nproject=%s\nkind=ship\nmode=local-only\ntmux_window_marker=teardown-marker\ntmux_socket_path=/tmp/fm-test.sock\n' \
     "$wt" "$host" "$project" > "$home/state/host-teardown.meta"
   fb=$(make_fakebin "$TMP/fake-host-teardown")
   log="$TMP/host-teardown.log"; current="$TMP/host-teardown.current"; tree_log="$TMP/host-teardown-treehouse.log"
@@ -1095,7 +1103,7 @@ test_secondmate_force_teardown_preserves_host_children_during_recursive_cleanup(
       "window=$target" "worktree=$childwt" "project=$childproj" \
       "backend=$backend" "host_root=$host" 'harness=echo' 'kind=ship' 'mode=no-mistakes'
     if [ "$backend" = tmux ]; then
-      printf 'tmux_window_marker=child-marker\n' >> "$subhome/state/child.meta"
+      printf 'tmux_window_marker=child-marker\ntmux_socket_path=/tmp/fm-test.sock\n' >> "$subhome/state/child.meta"
     fi
     fb=$(make_fakebin "$case_root/fake")
     if [ "$backend" = herdr ]; then
diff --git a/tests/fm-teardown.test.sh b/tests/fm-teardown.test.sh
index 16facdfe13..427f526afd 100755
--- a/tests/fm-teardown.test.sh
+++ b/tests/fm-teardown.test.sh
@@ -84,9 +84,21 @@ SH
   cat > "$fakebin/tmux" <<'SH'
 #!/usr/bin/env bash
 state="${0%/*}/tmux-live"
+if [ "${1:-}" = -S ]; then
+  shift 2
+fi
 case "${1:-}" in
   display-message) [ -f "$state" ] ;;
-  list-panes) [ ! -f "$state" ] || printf '%%1|@1|firstmate:fm-task-x1|firstmate:1.0\n' ;;
+  list-panes)
+    [ ! -f "$state" ] || case "$*" in
+      *'#{window_name}.#{pane_index}'*)
+        printf '%%1|@1|firstmate:fm-task-x1|firstmate:fm-task-x1.0|firstmate:1|firstmate:1.0|teardown-marker\n'
+        ;;
+      *)
+        printf '%%1|@1|firstmate:fm-task-x1|firstmate:1|firstmate:1.0|teardown-marker\n'
+        ;;
+    esac
+    ;;
   kill-window) [ "${FM_FAKE_TMUX_STOP_FAIL:-0}" = 1 ] || rm -f "$state" ;;
   *) exit 0 ;;
 esac
@@ -1274,7 +1286,8 @@ test_unconfirmed_stop_preserves_worktree() {
   host="$case_dir/host"
   mkdir -p "$host"
   : > "$host/AGENTS.md"
-  printf 'host_root=%s\n' "$host" >> "$case_dir/state/task-x1.meta"
+  printf 'host_root=%s\ntmux_window_marker=teardown-marker\ntmux_socket_path=/tmp/fm-test.sock\n' \
+    "$host" >> "$case_dir/state/task-x1.meta"
   tree_log="$case_dir/treehouse.log"
   cat > "$case_dir/fakebin/treehouse" <<'SH'
 #!/usr/bin/env bash

From 5838064bebc48174579c0e74b7a272195c536b83 Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Mon, 27 Jul 2026 14:39:08 +0300
Subject: [PATCH 23/39] no-mistakes(review): Scope tmux supervision and
 recognize vanished sockets

---
 bin/backends/tmux.sh          |   4 +-
 bin/fm-backend.sh             |  24 ++++
 bin/fm-supervise-daemon.sh    | 118 ++++++++++++--------
 bin/fm-watch.sh               | 199 ++++++++++++++++++----------------
 tests/fm-backend.test.sh      |  26 +++++
 tests/fm-daemon.test.sh       |  35 ++++++
 tests/fm-watch-triage.test.sh |  37 +++++++
 7 files changed, 301 insertions(+), 142 deletions(-)

diff --git a/bin/backends/tmux.sh b/bin/backends/tmux.sh
index 23f17374a1..97e7a9101f 100644
--- a/bin/backends/tmux.sh
+++ b/bin/backends/tmux.sh
@@ -159,7 +159,7 @@ fm_backend_tmux_canonical_window() {  # <target> [task-marker] -> @<window-id>
   status=$?
   if [ "$status" -ne 0 ]; then
     case "$out" in
-      *'no server running'*|*'no sessions'*) return 2 ;;
+      *'no server running'*|*'no sessions'*|*'No such file or directory'*|*'Connection refused'*) return 2 ;;
       *) return 1 ;;
     esac
   fi
@@ -216,7 +216,7 @@ fm_backend_tmux_target_state() {  # <target> [task-marker] -> present|absent|unk
     printf 'absent'
   else
     case "$out" in
-      *'no server running'*|*'no sessions'*) printf 'absent' ;;
+      *'no server running'*|*'no sessions'*|*'No such file or directory'*|*'Connection refused'*) printf 'absent' ;;
       *) printf 'unknown' ;;
     esac
   fi
diff --git a/bin/fm-backend.sh b/bin/fm-backend.sh
index 4ab71d3024..238a7a9bc3 100644
--- a/bin/fm-backend.sh
+++ b/bin/fm-backend.sh
@@ -531,6 +531,30 @@ fm_backend_validate_task_endpoint() {  # <meta-file> <task-id>
   return 0
 }
 
+fm_backend_supervision_ref_of_meta() {
+  local meta=$1 target task
+  target=$(fm_backend_target_of_meta "$meta")
+  [ -n "$target" ] || return 1
+  if [ "$(fm_backend_of_meta "$meta")" = tmux ] \
+     && grep -q '^host_root=.' "$meta" 2>/dev/null \
+     && [ -n "$(fm_meta_get "$meta" tmux_socket_path)" ]; then
+    task=$(basename "$meta")
+    printf '%s' "${task%.meta}"
+  else
+    printf '%s' "$target"
+  fi
+}
+
+fm_backend_meta_for_supervision_ref() {
+  local ref=$1 state=$2
+  if [ -f "$state/$ref.meta" ] \
+     && [ "$(fm_backend_supervision_ref_of_meta "$state/$ref.meta" 2>/dev/null)" = "$ref" ]; then
+    printf '%s' "$state/$ref.meta"
+    return 0
+  fi
+  fm_backend_meta_for_window "$ref" "$state"
+}
+
 fm_backend_bind_meta_context() {
   local meta=$1 socket
   [ "$(fm_backend_of_meta "$meta")" = tmux ] || return 0
diff --git a/bin/fm-supervise-daemon.sh b/bin/fm-supervise-daemon.sh
index 30554edbbd..d323e9b3e0 100755
--- a/bin/fm-supervise-daemon.sh
+++ b/bin/fm-supervise-daemon.sh
@@ -358,12 +358,32 @@ classify_signal() {  # <reason-after-colon> <state>
   fi
 }
 
+stale_ref_meta() {
+  fm_backend_meta_for_supervision_ref "$1" "$2"
+}
+
+stale_ref_task() {
+  local ref=$1 state=$2 meta task status
+  if meta=$(stale_ref_meta "$ref" "$state" 2>/dev/null); then
+    task=$(basename "$meta")
+    printf '%s' "${task%.meta}"
+    return 0
+  else
+    status=$?
+  fi
+  [ "$status" -ne 2 ] || return 2
+  window_to_task "$ref" "$state"
+}
+
 # classify_stale decides the WAKE itself (one-shot per distinct hash). On a
 # first sight of a non-terminal stale it returns "self" and the caller records a
 # timestamp marker; persistence is escalated by housekeeping's recheck, not here.
-classify_stale() {  # <window> <state>
+classify_stale() {  # <ref> <state>
   local win=$1 state=$2 task last seen
-  task=$(window_to_task "$win" "$state")
+  task=$(stale_ref_task "$win" "$state") || {
+    printf 'escalate|stale endpoint identity is ambiguous: %s' "$win"
+    return
+  }
   last=$(last_status_line "$state/$task.status")
   if [ -n "$last" ] && status_is_paused "$last"; then
     # A DECLARED external-wait pause (fm-classify-lib.sh): an idle pane is EXPECTED,
@@ -426,16 +446,18 @@ classify_unknown() {  # <reason>
 
 _stale_key() { printf '%s' "$1" | tr ':/.' '___'; }
 
-stale_marker_record() {  # <window> <state>  — create if absent
-  local win=$1 state=$2 key marker
-  key=$(_stale_key "$(window_to_task "$win" "$state")")
+stale_marker_record() {  # <ref> <state>  — create if absent
+  local win=$1 state=$2 task key marker
+  task=$(stale_ref_task "$win" "$state") || return 1
+  key=$(_stale_key "$task")
   marker="$state/.subsuper-stale-$key"
   [ -e "$marker" ] || _now > "$marker"
 }
 
-stale_marker_remove() {  # <window> <state>
-  local win=$1 state=$2 key
-  key=$(_stale_key "$(window_to_task "$win" "$state")")
+stale_marker_remove() {  # <ref> <state>
+  local win=$1 state=$2 task key
+  task=$(stale_ref_task "$win" "$state") || return 1
+  key=$(_stale_key "$task")
   rm -f "$state/.subsuper-stale-$key"
 }
 
@@ -444,22 +466,24 @@ stale_marker_remove() {  # <window> <state>
 # longer than a wedge) and re-surfaces the pause once per window. Recording is
 # create-if-absent so the timestamp is stable across a churny idle pane (many
 # distinct stale hashes map to one marker), keeping the cadence hash-immune.
-pause_marker_record() {  # <window> <state> - create if absent
-  local win=$1 state=$2 key marker
-  key=$(_stale_key "$(window_to_task "$win" "$state")")
+pause_marker_record() {  # <ref> <state> - create if absent
+  local win=$1 state=$2 task key marker
+  task=$(stale_ref_task "$win" "$state") || return 1
+  key=$(_stale_key "$task")
   marker="$state/.subsuper-paused-$key"
   [ -e "$marker" ] || _now > "$marker"
 }
 
-pause_marker_remove() {  # <window> <state>
-  local win=$1 state=$2 key
-  key=$(_stale_key "$(window_to_task "$win" "$state")")
+pause_marker_remove() {  # <ref> <state>
+  local win=$1 state=$2 task key
+  task=$(stale_ref_task "$win" "$state") || return 1
+  key=$(_stale_key "$task")
   rm -f "$state/.subsuper-paused-$key"
 }
 
-clear_pause_tracking() {  # <window> <state>
+clear_pause_tracking() {  # <ref> <state>
   local win=$1 state=$2 task key watcher_key
-  task=$(window_to_task "$win" "$state")
+  task=$(stale_ref_task "$win" "$state") || return 1
   key=$(_stale_key "$task")
   watcher_key=$(_stale_key "$win")
   rm -f "$state/.subsuper-paused-$key" "$state/.subsuper-stale-$key" \
@@ -467,9 +491,9 @@ clear_pause_tracking() {  # <window> <state>
     "$state/.stale-$watcher_key" "$state/.stale-since-$watcher_key" "$state/.wedge-escalations-$watcher_key"
 }
 
-reconcile_pause_tracking() {  # <window> <state> <last-status-line>
+reconcile_pause_tracking() {  # <ref> <state> <last-status-line>
   local win=$1 state=$2 last=$3 task key marker watcher_key
-  task=$(window_to_task "$win" "$state")
+  task=$(stale_ref_task "$win" "$state") || return 1
   key=$(_stale_key "$task")
   marker="$state/.subsuper-paused-$key"
   watcher_key=$(_stale_key "$win")
@@ -485,7 +509,7 @@ migrate_watcher_pause_markers() {  # <state>
   local state=$1 meta win task key last watcher_key
   for meta in "$state"/*.meta; do
     [ -e "$meta" ] || continue
-    win=$(fm_backend_target_of_meta "$meta")
+    win=$(fm_backend_supervision_ref_of_meta "$meta")
     [ -n "$win" ] || continue
     task=$(basename "$meta"); task=${task%.meta}
     key=$(_stale_key "$task")
@@ -537,7 +561,7 @@ mark_escalated_seen() {  # <kind> <arg> <state>
         mark_status_seen "$state" "$task" "$last"
       done ;;
     stale)
-      task=$(window_to_task "$arg" "$state")
+      task=$(stale_ref_task "$arg" "$state") || return
       last=$(last_status_line "$state/$task.status")
       [ -n "$last" ] && status_is_captain_relevant "$last" \
         && mark_status_seen "$state" "$task" "$last" ;;
@@ -582,27 +606,28 @@ pane_input_pending() {  # <target> [backend]
   [ "$(fm_backend_composer_state "$backend" "$target" 2>/dev/null)" != empty ]
 }
 
-task_window_backend() {  # <window> <state>
-  local win=$1 state=$2 task meta
-  task=$(window_to_task "$win" "$state")
-  meta="$state/$task.meta"
-  fm_backend_of_meta "$meta"
-}
-
-task_window_harness() {  # <window> <state>
-  local win=$1 state=$2 task meta
-  task=$(window_to_task "$win" "$state")
-  meta="$state/$task.meta"
-  grep '^harness=' "$meta" | cut -d= -f2- || true
-}
-
-stale_window_is_busy() {  # <window> <state>
-  local win=$1 state=$2 backend harness label tail40 bs
-  backend=$(task_window_backend "$win" "$state")
-  harness=$(task_window_harness "$win" "$state")
-  label="fm-$(window_to_task "$win" "$state")"
-  tail40=$(fm_backend_capture "$backend" "$win" 40 "$label" 2>/dev/null) || return 2
-  bs=$(fm_backend_busy_state "$backend" "$win" 2>/dev/null)
+stale_window_is_busy() {  # <ref> <state>
+  local win=$1 state=$2 meta task target backend harness label tail40 bs status
+  if meta=$(stale_ref_meta "$win" "$state" 2>/dev/null); then
+    task=$(basename "$meta")
+    task=${task%.meta}
+    target=$(fm_backend_target_of_meta "$meta")
+    [ -n "$target" ] || return 1
+    fm_backend_bind_meta_context "$meta" >/dev/null 2>&1 || return 1
+    backend=$(fm_backend_of_meta "$meta")
+    harness=$(grep '^harness=' "$meta" | cut -d= -f2- || true)
+  else
+    status=$?
+    [ "$status" -ne 2 ] || return 1
+    task=$(window_to_task "$win" "$state")
+    target=$win
+    backend=tmux
+    harness=
+    unset FM_BACKEND_TMUX_SOCKET
+  fi
+  label="fm-$task"
+  tail40=$(fm_backend_capture "$backend" "$target" 40 "$label" 2>/dev/null) || return 2
+  bs=$(fm_backend_busy_state "$backend" "$target" 2>/dev/null)
   case "$bs" in
     busy) return 0 ;;
   esac
@@ -982,7 +1007,7 @@ housekeeping() {  # <state>
       # Window gone (task torn down): drop the marker, nothing to escalate.
       rm -f "$marker"; continue
     fi
-    task=$(window_to_task "$win" "$state")
+    task=$(stale_ref_task "$win" "$state") || continue
     last=$(last_status_line "$state/$task.status")
     if [ -n "$last" ] && status_is_paused "$last"; then
       reconcile_pause_tracking "$win" "$state" "$last"
@@ -1013,7 +1038,7 @@ housekeeping() {  # <state>
     if [ -z "$win" ]; then
       rm -f "$marker"; continue
     fi
-    task=$(window_to_task "$win" "$state")
+    task=$(stale_ref_task "$win" "$state") || continue
     last=$(last_status_line "$state/$task.status")
     if [ -z "$last" ] || ! status_is_paused "$last"; then
       reconcile_pause_tracking "$win" "$state" "$last"
@@ -1061,7 +1086,7 @@ window_for_task() {  # <task-key> [state]
     [ -e "$meta" ] || continue
     task=$(basename "$meta"); task=${task%.meta}
     [ "$(_stale_key "$task")" = "$key" ] || continue
-    w=$(fm_backend_target_of_meta "$meta")
+    w=$(fm_backend_supervision_ref_of_meta "$meta")
     [ -n "$w" ] && { printf '%s' "$w"; return 0; }
   done
   for w in $(tmux list-windows -a -F '#{session_name}:#{window_name}' 2>/dev/null | grep ':fm-' || true); do
@@ -1231,7 +1256,10 @@ handle_wake() {  # <reason> <state>
       # pause reverts to normal wedge aging). The persistence recheck, not this
       # wake, escalates a wedge.
       if [ "$kind" = "stale" ]; then
-        task=$(window_to_task "$arg" "$state")
+        task=$(stale_ref_task "$arg" "$state") || {
+          escalate_add "$state" "stale endpoint identity is ambiguous: $arg"
+          return
+        }
         last=$(last_status_line "$state/$task.status")
         # Clear wedge aging only for terminal (or legacy free-text) captain lines.
         # Nonterminal progress verbs keep possible-wedge markers even if free text
diff --git a/bin/fm-watch.sh b/bin/fm-watch.sh
index 681693d5c8..be960ef7bf 100755
--- a/bin/fm-watch.sh
+++ b/bin/fm-watch.sh
@@ -14,7 +14,7 @@
 #   signal: <file>...      status/turn-end signals, surfaced when a listed status
 #                          has a captain-relevant verb OR a no-verb signal's crew
 #                          is not provably working, unless afk is active
-#   stale: <window>        a provably-working stale is ALWAYS absorbed (with a wedge
+#   stale: <task-or-window> a provably-working stale is ALWAYS absorbed (with a wedge
 #                          timer) regardless of what the status log says - an active
 #                          run-step or busy pane outranks even a captain-relevant log
 #                          line, since the crew's own log gets no new entry once
@@ -186,15 +186,16 @@ hash_pane() {
 # falls back to the recorded harness's verified pane-tail signature. <tail40> is
 # the same bounded capture already read for hashing, so this adds no extra
 # backend calls on the regex-fallback path.
-window_is_busy() {  # <window> <tail40>
-  local w=$1 tail40=$2 bs harness lines
-  bs=$(fm_backend_busy_state "$(window_backend "$w")" "$w" 2>/dev/null)
+window_is_busy() {  # <window> <tail40> [task]
+  local w=$1 tail40=$2 task=${3:-} bs harness lines
+  window_bind_context "$w" "$task" >/dev/null 2>&1 || return 1
+  bs=$(fm_backend_busy_state "$(window_backend "$w" "$task")" "$w" 2>/dev/null)
   case "$bs" in
     busy) return 0 ;;
     idle) return 1 ;;
     *)
       lines=$(printf '%s' "$tail40" | grep -v '^[[:space:]]*$' | tail -12)
-      harness=$(window_harness "$w")
+      harness=$(window_harness "$w" "$task")
       if [ -n "${FM_BUSY_REGEX:-}" ]; then
         printf '%s' "$lines" | grep -qiE "$BUSY_REGEX"
       else
@@ -204,9 +205,18 @@ window_is_busy() {  # <window> <tail40>
   esac
 }
 
+window_meta() {
+  local w=$1 task=${2:-}
+  if [ -n "$task" ] && [ -f "$STATE/$task.meta" ]; then
+    printf '%s' "$STATE/$task.meta"
+  else
+    fm_backend_meta_for_window "$w" "$STATE"
+  fi
+}
+
 window_kind() {
-  local w=$1 meta kind
-  meta=$(fm_backend_meta_for_window "$w" "$STATE" 2>/dev/null || true)
+  local w=$1 task=${2:-} meta kind
+  meta=$(window_meta "$w" "$task" 2>/dev/null || true)
   if [ -n "$meta" ]; then
     kind=$(grep '^kind=' "$meta" | cut -d= -f2- || true)
     [ -n "$kind" ] || kind=ship
@@ -220,8 +230,8 @@ window_kind() {
 # defaulting to tmux (absent backend= means tmux; the P1 compatibility
 # contract) when no matching meta carries the field, or none matches at all.
 window_backend() {
-  local w=$1 meta backend
-  meta=$(fm_backend_meta_for_window "$w" "$STATE" 2>/dev/null || true)
+  local w=$1 task=${2:-} meta backend
+  meta=$(window_meta "$w" "$task" 2>/dev/null || true)
   if [ -n "$meta" ]; then
     backend=$(grep '^backend=' "$meta" | cut -d= -f2- || true)
     [ -n "$backend" ] || backend=tmux
@@ -232,29 +242,29 @@ window_backend() {
 }
 
 window_harness() {
-  local w=$1 meta
-  meta=$(fm_backend_meta_for_window "$w" "$STATE" 2>/dev/null || true)
+  local w=$1 task=${2:-} meta
+  meta=$(window_meta "$w" "$task" 2>/dev/null || true)
   [ -n "$meta" ] || return 0
   grep '^harness=' "$meta" | cut -d= -f2- || true
 }
 
 window_label() {
-  local w=$1 task
-  task=$(window_to_task "$w" "$STATE")
+  local w=$1 task=${2:-}
+  [ -n "$task" ] || task=$(window_to_task "$w" "$STATE")
   [ -n "$task" ] && printf 'fm-%s' "$task"
 }
 
 window_bind_context() {
   local meta
-  meta=$(fm_backend_meta_for_window "$1" "$STATE" 2>/dev/null || true)
+  meta=$(window_meta "$1" "${2:-}" 2>/dev/null || true)
   [ -n "$meta" ] || return 0
   fm_backend_bind_meta_context "$meta"
 }
 
 window_agent_alive() {
   local meta backend marker socket
-  meta=$(fm_backend_meta_for_window "$1" "$STATE" 2>/dev/null || true)
-  backend=$(window_backend "$1")
+  meta=$(window_meta "$1" "${2:-}" 2>/dev/null || true)
+  backend=$(window_backend "$1" "${2:-}")
   if [ -n "$meta" ]; then
     marker=$(fm_meta_get "$meta" tmux_window_marker)
     socket=$(fm_meta_get "$meta" tmux_socket_path)
@@ -263,16 +273,19 @@ window_agent_alive() {
 }
 
 recorded_windows() {
-  local meta w seen=
+  local meta w task ref seen=
   for meta in "$STATE"/*.meta; do
     [ -e "$meta" ] || continue
     w=$(fm_backend_target_of_meta "$meta")
     [ -n "$w" ] || continue
+    task=$(basename "$meta")
+    task=${task%.meta}
+    ref=$(fm_backend_supervision_ref_of_meta "$meta") || continue
     case "$seen" in
-      *"|$w|"*) continue ;;
+      *"|$ref|"*) continue ;;
     esac
-    seen="$seen|$w|"
-    printf '%s\n' "$w"
+    seen="$seen|$ref|"
+    printf '%s\t%s\t%s\n' "$ref" "$task" "$w"
   done
 }
 
@@ -296,8 +309,8 @@ FM_WEDGE_DEMAND_INSPECT_COUNT=${FM_WEDGE_DEMAND_INSPECT_COUNT:-3}
 # both places a hash can be absorbed this way: the plain non-terminal path,
 # and the stale_is_terminal-overridden path (a captain-relevant status-log
 # line that an active run/busy pane outranked).
-wedge_timer_check() {  # <window> <since-file> <triage-label> <escalation-count-file>
-  local win=$1 since_file=$2 label=$3 escalation_file=$4 since age n reason
+wedge_timer_check() {  # <window> <since-file> <triage-label> <escalation-count-file> [ref]
+  local win=$1 since_file=$2 label=$3 escalation_file=$4 ref=${5:-$1} since age n reason
   since=$(cat "$since_file" 2>/dev/null || true)
   case "$since" in
     ''|*[!0-9]*)
@@ -309,11 +322,11 @@ wedge_timer_check() {  # <window> <since-file> <triage-label> <escalation-count-
       if [ "$age" -ge "$STALE_ESCALATE_SECS" ]; then
         n=$(( $(cat "$escalation_file" 2>/dev/null || echo 0) + 1 ))
         echo "$n" > "$escalation_file"
-        reason="stale: $win (idle ${age}s, possible wedge, escalation $n)"
+        reason="stale: $ref (idle ${age}s, possible wedge, escalation $n)"
         if [ "$n" -ge "$FM_WEDGE_DEMAND_INSPECT_COUNT" ]; then
-          reason="stale: $win (idle ${age}s, possible wedge, escalation $n, demand-deep-inspection: same pane has wedge-escalated $n times in a row - do not re-absorb on the run-step/pane state alone)"
+          reason="stale: $ref (idle ${age}s, possible wedge, escalation $n, demand-deep-inspection: same pane has wedge-escalated $n times in a row - do not re-absorb on the run-step/pane state alone)"
         fi
-        fm_wake_append stale "$win" "$reason" || exit 1
+        fm_wake_append stale "$ref" "$reason" || exit 1
         rm -f "$since_file"
         wake "$reason"
       fi
@@ -345,9 +358,9 @@ busy_turn_over_age() {  # <task>
 # timer would. A .paused-resurfaced-<key> throttle marker records the last
 # re-surface epoch so, once past the window, it fires once per window rather than
 # every poll. Advances the stale suppressor to <hash> and flags the key paused.
-handle_paused_stale() {  # <window> <task> <hash>
-  local win=$1 task=$2 h=$3 key statusf mtime age rf rf_age reason
-  key=$(printf '%s' "$win" | tr ':/.' '___')
+handle_paused_stale() {  # <window> <task> <hash> [ref]
+  local win=$1 task=$2 h=$3 ref=${4:-$1} key statusf mtime age rf rf_age reason
+  key=$(printf '%s' "$ref" | tr ':/.' '___')
   printf '%s' "$h" > "$STATE/.stale-$key"
   : > "$STATE/.paused-$key"
   rm -f "$STATE/.stale-since-$key" "$STATE/.wedge-escalations-$key"
@@ -358,37 +371,37 @@ handle_paused_stale() {  # <window> <task> <hash>
   rf="$STATE/.paused-resurfaced-$key"
   rf_age=$(age_of "$rf")   # 999999 when no prior re-surface
   if [ "$age" -ge "$PAUSE_RESURFACE_SECS" ] && [ "$rf_age" -ge "$PAUSE_RESURFACE_SECS" ]; then
-    reason="stale: $win (paused ${age}s, awaiting external - declared pause, rechecked on a long cadence not a wedge; confirm the wait still holds)"
-    fm_wake_append stale "$win" "$reason" || exit 1
+    reason="stale: $ref (paused ${age}s, awaiting external - declared pause, rechecked on a long cadence not a wedge; confirm the wait still holds)"
+    fm_wake_append stale "$ref" "$reason" || exit 1
     date +%s > "$rf"
     wake "$reason"
   fi
   triage_log "absorbed stale (paused, awaiting external, age ${age}s): $win"
 }
 
-clear_pause_state() {  # <window>
-  local win=$1 key
-  key=${win//:/_}
+clear_pause_state() {  # <window> [ref]
+  local win=$1 ref=${2:-$1} key
+  key=${ref//:/_}
   key=${key//\//_}
   key=${key//./_}
   rm -f "$STATE/.paused-$key" "$STATE/.paused-rechecked-$key" "$STATE/.paused-resurfaced-$key"
 }
 
-clear_pause_tracking() {  # <window>
-  local win=$1 key
-  key=${win//:/_}
+clear_pause_tracking() {  # <window> [ref]
+  local win=$1 ref=${2:-$1} key
+  key=${ref//:/_}
   key=${key//\//_}
   key=${key//./_}
-  clear_pause_state "$win"
+  clear_pause_state "$win" "$ref"
   rm -f "$STATE/.stale-$key" "$STATE/.stale-since-$key" "$STATE/.wedge-escalations-$key"
 }
 
 # Reconcile a declared pause or captain-held status with authoritative crew state.
 # Only a confidently dead ordinary crew may recover paused classification after
 # fm-crew-state has fallen back to stopped or unknown.
-pause_state_class() {  # <window> <task>
-  local win=$1 task=$2 key last recheck_file class agent_alive
-  key=${win//:/_}
+pause_state_class() {  # <window> <task> [ref]
+  local win=$1 task=$2 ref=${3:-$1} key last recheck_file class agent_alive
+  key=${ref//:/_}
   key=${key//\//_}
   key=${key//./_}
   last=$(last_status_line "$STATE/$task.status")
@@ -399,8 +412,8 @@ pause_state_class() {  # <window> <task>
     return
   fi
   if [ -e "$STATE/.paused-$key" ] && [ "$(age_of "$recheck_file")" -lt "$STALE_ESCALATE_SECS" ]; then
-    if [ "$(window_kind "$win")" != secondmate ]; then
-      agent_alive=$(window_agent_alive "$win" 2>/dev/null) || agent_alive=unknown
+    if [ "$(window_kind "$win" "$task")" != secondmate ]; then
+      agent_alive=$(window_agent_alive "$win" "$task" 2>/dev/null) || agent_alive=unknown
       if [ "$agent_alive" != dead ]; then
         rm -f "$recheck_file"
         printf 'none'
@@ -416,8 +429,8 @@ pause_state_class() {  # <window> <task>
     printf 'working'
     return
   fi
-  if [ "$(window_kind "$win")" != secondmate ]; then
-    agent_alive=$(window_agent_alive "$win" 2>/dev/null) || agent_alive=unknown
+  if [ "$(window_kind "$win" "$task")" != secondmate ]; then
+    agent_alive=$(window_agent_alive "$win" "$task" 2>/dev/null) || agent_alive=unknown
     if [ "$agent_alive" != dead ]; then
       rm -f "$recheck_file"
       printf 'none'
@@ -432,13 +445,13 @@ pause_state_class() {  # <window> <task>
   printf '%s' "$class"
 }
 
-surface_nonterminal_stale() {  # <window> <hash>
-  local win=$1 h=$2 key task last
-  key=$(printf '%s' "$win" | tr ':/.' '___')
-  fm_wake_append stale "$win" "stale: $win" || exit 1
+surface_nonterminal_stale() {  # <window> <hash> [task] [ref]
+  local win=$1 h=$2 task=${3:-} ref=${4:-$1} key last
+  key=$(printf '%s' "$ref" | tr ':/.' '___')
+  fm_wake_append stale "$ref" "stale: $ref" || exit 1
   printf '%s' "$h" > "$STATE/.stale-$key"
   rm -f "$STATE/.stale-since-$key"
-  task=$(window_to_task "$win" "$STATE")
+  [ -n "$task" ] || task=$(window_to_task "$win" "$STATE")
   last=$(last_status_line "$STATE/$task.status")
   if status_is_paused_or_captain_held "$last"; then
     : > "$STATE/.paused-$key"
@@ -447,7 +460,7 @@ surface_nonterminal_stale() {  # <window> <hash>
   else
     rm -f "$STATE/.paused-$key" "$STATE/.paused-rechecked-$key" "$STATE/.paused-resurfaced-$key"
   fi
-  wake "stale: $win"
+  wake "stale: $ref"
 }
 
 # Check and heartbeat cadence must survive actionable exits and restarts: the
@@ -605,16 +618,16 @@ heartbeat_scan_finds_actionable() {
 # supervision cycle: the reader is a short-lived subprocess of THIS watcher, not
 # a second watcher, so every guard/beacon/arm/turn-end mechanism is unchanged.
 event_wait_or_sleep() {
-  local w b session first_backend="" first_session="" rec rc
+  local ref task w b session first_backend="" first_session="" rec rc
   local windows=()
-  while IFS= read -r w; do
-    b=$(window_backend "$w")
+  while IFS=$(printf '\t') read -r ref task w; do
+    b=$(window_backend "$w" "$task")
     fm_backend_has_push "$b" || continue
     # Secondmate endpoints are supervised via status writes, not pane/agent
     # state (an idle or blocked secondmate agent pane is healthy by design), so
     # they are excluded from the fast escalation exactly as the stale loop skips
     # them.
-    [ "$(window_kind "$w")" = secondmate ] && continue
+    [ "$(window_kind "$w" "$task")" = secondmate ] && continue
     session=${w%%:*}
     if [ -z "$first_backend" ]; then first_backend=$b; first_session=$session; fi
     # One socket connection covers one backend+session; a home normally has a
@@ -882,23 +895,22 @@ EOF
   # signature means the crewmate finished, is waiting, or is wedged. Each distinct
   # stale hash is surfaced, absorbed, or timed toward escalation once (.stale-*
   # remembers the hash already classified).
-  while IFS= read -r w; do
-    kind=$(window_kind "$w")
-    task=$(window_to_task "$w" "$STATE")
-    key=${w//:/_}
+  while IFS=$(printf '\t') read -r ref task w; do
+    kind=$(window_kind "$w" "$task")
+    key=${ref//:/_}
     key=${key//\//_}
     key=${key//./_}
     last=$(last_status_line "$STATE/$task.status")
     if ! status_is_paused_or_captain_held "$last" && [ -e "$STATE/.paused-$key" ]; then
-      clear_pause_tracking "$w"
+      clear_pause_tracking "$w" "$ref"
     fi
     if [ "$kind" = secondmate ] && ! status_is_paused "$last"; then
       continue
     fi
-    tail40=$( ( window_bind_context "$w" \
-      && fm_backend_capture "$(window_backend "$w")" "$w" 40 "$(window_label "$w")" ) 2>/dev/null) || continue
+    tail40=$( ( window_bind_context "$w" "$task" \
+      && fm_backend_capture "$(window_backend "$w" "$task")" "$w" 40 "$(window_label "$w" "$task")" ) 2>/dev/null) || continue
     h=$(printf '%s' "$tail40" | hash_pane)
-    key=$(printf '%s' "$w" | tr ':/.' '___')
+    key=$(printf '%s' "$ref" | tr ':/.' '___')
     hf="$STATE/.hash-$key"
     cf="$STATE/.count-$key"
     sf="$STATE/.stale-$key"
@@ -911,7 +923,7 @@ EOF
     # harness renders its busy indicator) so busy-looking strings in displayed
     # content cannot suppress stale detection. Read once per window per poll and
     # reused below so a busy verdict is consistent within one cycle.
-    if window_is_busy "$w" "$tail40"; then busy_now=0; else busy_now=1; fi
+    if window_is_busy "$w" "$tail40" "$task"; then busy_now=0; else busy_now=1; fi
     if [ "$h" = "$prev" ]; then
       n=$(( $(cat "$cf" 2>/dev/null || echo 0) + 1 ))
       echo "$n" > "$cf"
@@ -919,18 +931,18 @@ EOF
         # The pane is idle/stale at hash $h. Triage decides whether this wakes
         # firstmate. Detection itself is unchanged from above.
         if [ "$kind" = secondmate ]; then
-          case "$(pause_state_class "$w" "$task")" in
-            paused) handle_paused_stale "$w" "$task" "$h" ;;
-            *)      clear_pause_tracking "$w" ;;
+          case "$(pause_state_class "$w" "$task" "$ref")" in
+            paused) handle_paused_stale "$w" "$task" "$h" "$ref" ;;
+            *)      clear_pause_tracking "$w" "$ref" ;;
           esac
         elif afk_present; then
           # Daemon owns triage: one-shot per distinct stale hash, as before.
           if [ "$(cat "$sf" 2>/dev/null || true)" != "$h" ]; then
-            fm_wake_append stale "$w" "stale: $w" || exit 1
+            fm_wake_append stale "$ref" "stale: $ref" || exit 1
             printf '%s' "$h" > "$sf"
-            wake "stale: $w"
+            wake "stale: $ref"
           fi
-        elif stale_is_terminal "$w" "$STATE"; then
+        elif stale_is_terminal "$ref" "$STATE"; then
           # The log's last line is captain-relevant - but that alone is not
           # proof the crew is actually done: a crew's own status log gets no
           # new entry once firstmate hands it to a no-mistakes validation
@@ -946,23 +958,23 @@ EOF
           # authoritative source fm-crew-state.sh itself already prioritizes
           # over the log) a chance to override before trusting the log.
           if [ "$(cat "$sf" 2>/dev/null || true)" != "$h" ]; then
-            if crew_is_provably_working "$(window_to_task "$w" "$STATE")"; then
+            if crew_is_provably_working "$task"; then
               printf '%s' "$h" > "$sf"
               date +%s > "$ssf"
               triage_log "absorbed stale (provably working, overriding a stale captain-relevant status): $w"
             else
-              fm_wake_append stale "$w" "stale: $w" || exit 1
+              fm_wake_append stale "$ref" "stale: $ref" || exit 1
               printf '%s' "$h" > "$sf"
               rm -f "$ssf"
-              mark_surfaced "$STATE/$(window_to_task "$w" "$STATE").status"
-              wake "stale: $w"
+              mark_surfaced "$STATE/$task.status"
+              wake "stale: $ref"
             fi
           elif [ -e "$ssf" ]; then
             # This exact hash was already overridden as provably-working (a
             # wedge timer is running for it) - keep treating it that way
             # without re-reading the crew state every poll, and without
             # letting the still-captain-relevant log line re-surface it.
-            wedge_timer_check "$w" "$ssf" "stale (overridden terminal status)" "$ewf"
+            wedge_timer_check "$w" "$ssf" "stale (overridden terminal status)" "$ewf" "$ref"
           fi
           # else: already surfaced as genuinely terminal on a prior poll of
           # this same hash - nothing left to do (matches the original,
@@ -983,34 +995,32 @@ EOF
           #     waiting on a decision, or wedged) instead of leaving the finish to
           #     wait out the timer.
           if [ "$(cat "$sf" 2>/dev/null || true)" != "$h" ]; then
-            task=$(window_to_task "$w" "$STATE")
-            case "$(pause_state_class "$w" "$task")" in
+            case "$(pause_state_class "$w" "$task" "$ref")" in
               working)
-                clear_pause_tracking "$w"
+                clear_pause_tracking "$w" "$ref"
                 printf '%s' "$h" > "$sf"
                 date +%s > "$ssf"
                 triage_log "absorbed non-terminal stale (provably working): $w"
                 ;;
               paused)
-                handle_paused_stale "$w" "$task" "$h"
+                handle_paused_stale "$w" "$task" "$h" "$ref"
                 ;;
               *)
-                surface_nonterminal_stale "$w" "$h"
+                surface_nonterminal_stale "$w" "$h" "$task" "$ref"
                 ;;
             esac
           else
-            task=$(window_to_task "$w" "$STATE")
             if [ -e "$pf" ] || status_is_paused_or_captain_held "$(last_status_line "$STATE/$task.status")"; then
-              case "$(pause_state_class "$w" "$task")" in
-                paused)  handle_paused_stale "$w" "$task" "$h" ;;
-                working) clear_pause_state "$w"
+              case "$(pause_state_class "$w" "$task" "$ref")" in
+                paused)  handle_paused_stale "$w" "$task" "$h" "$ref" ;;
+                working) clear_pause_state "$w" "$ref"
                          printf '%s' "$h" > "$sf"
-                         wedge_timer_check "$w" "$ssf" "non-terminal stale (provably working after a declared pause)" "$ewf"
+                         wedge_timer_check "$w" "$ssf" "non-terminal stale (provably working after a declared pause)" "$ewf" "$ref"
                          triage_log "absorbed non-terminal stale (provably working): $w" ;;
-                *)       handle_paused_stale "$w" "$task" "$h" ;;
+                *)       handle_paused_stale "$w" "$task" "$h" "$ref" ;;
               esac
             else
-              wedge_timer_check "$w" "$ssf" "non-terminal stale" "$ewf"
+              wedge_timer_check "$w" "$ssf" "non-terminal stale" "$ewf" "$ref"
             fi
           fi
         fi
@@ -1019,30 +1029,29 @@ EOF
         # unless a genuinely busy pane has gone too long with no completed turn -
         # then route it through the same wedge timer instead of erasing it.
         if [ "$busy_now" -eq 0 ] && busy_turn_over_age "$task"; then
-          wedge_timer_check "$w" "$ssf" "busy (no completed turn)" "$ewf"
+          wedge_timer_check "$w" "$ssf" "busy (no completed turn)" "$ewf" "$ref"
         else
           rm -f "$ssf" "$ewf"
         fi
-        if [ -e "$pf" ] && { [ "$n" -ge 2 ] || ! status_is_paused_or_captain_held "$(last_status_line "$STATE/$(window_to_task "$w" "$STATE").status")"; }; then
-          clear_pause_tracking "$w"
+        if [ -e "$pf" ] && { [ "$n" -ge 2 ] || ! status_is_paused_or_captain_held "$(last_status_line "$STATE/$task.status")"; }; then
+          clear_pause_tracking "$w" "$ref"
         fi
       fi
     else
       printf '%s' "$h" > "$hf"
       echo 0 > "$cf"
       if [ "$busy_now" -eq 0 ] && busy_turn_over_age "$task"; then
-        wedge_timer_check "$w" "$ssf" "busy (no completed turn)" "$ewf"
+        wedge_timer_check "$w" "$ssf" "busy (no completed turn)" "$ewf" "$ref"
       else
         rm -f "$ssf" "$ewf"
       fi
-      task=$(window_to_task "$w" "$STATE")
       if ! afk_present && status_is_paused_or_captain_held "$(last_status_line "$STATE/$task.status")" && [ "$busy_now" -ne 0 ]; then
-        case "$(pause_state_class "$w" "$task")" in
-          paused) handle_paused_stale "$w" "$task" "$h" ;;
-          *)      clear_pause_tracking "$w" ;;
+        case "$(pause_state_class "$w" "$task" "$ref")" in
+          paused) handle_paused_stale "$w" "$task" "$h" "$ref" ;;
+          *)      clear_pause_tracking "$w" "$ref" ;;
         esac
       else
-        [ -e "$pf" ] && clear_pause_tracking "$w"
+        [ -e "$pf" ] && clear_pause_tracking "$w" "$ref"
       fi
     fi
   done < <(recorded_windows)
diff --git a/tests/fm-backend.test.sh b/tests/fm-backend.test.sh
index 0af9b2f5bd..6d3a6a5ffa 100755
--- a/tests/fm-backend.test.sh
+++ b/tests/fm-backend.test.sh
@@ -1448,6 +1448,31 @@ test_spawn_autodetect_nesting_resolves_tmux_silently() {
   pass "fm-spawn.sh: auto-detect resolves nested tmux-in-herdr to tmux and stays silent end to end"
 }
 
+test_tmux_missing_socket_is_authoritatively_absent() {
+  local out status=0
+  out=$(bash -c '
+    . "$1/bin/fm-backend.sh"
+    fm_backend_source tmux
+    fm_tmux_cli() {
+      printf "error connecting to /gone.sock (No such file or directory)\n" >&2
+      return 1
+    }
+    fm_backend_tmux_canonical_window @1 >/dev/null
+  ' _ "$ROOT" 2>&1) || status=$?
+  expect_code 2 "$status" "a vanished recorded tmux socket must prove its window absent: $out"
+  out=$(bash -c '
+    . "$1/bin/fm-backend.sh"
+    fm_backend_source tmux
+    fm_tmux_cli() {
+      printf "error connecting to /gone.sock (Connection refused)\n" >&2
+      return 1
+    }
+    fm_backend_tmux_target_state @1
+  ' _ "$ROOT")
+  [ "$out" = absent ] || fail "a refused recorded tmux socket stayed unknown: $out"
+  pass "vanished recorded tmux sockets authoritatively prove endpoint absence"
+}
+
 test_backend_name_precedence
 test_backend_detect_precedence
 test_backend_detect_cmux_fallback_bundle_id
@@ -1478,3 +1503,4 @@ test_spawn_refuses_unknown_fm_backend_env
 test_spawn_default_backend_writes_no_meta_field
 test_spawn_explicit_backend_flag_beats_autodetect_herdr_env
 test_spawn_autodetect_nesting_resolves_tmux_silently
+test_tmux_missing_socket_is_authoritatively_absent
diff --git a/tests/fm-daemon.test.sh b/tests/fm-daemon.test.sh
index a1fbd7f5fe..e50ee7c248 100755
--- a/tests/fm-daemon.test.sh
+++ b/tests/fm-daemon.test.sh
@@ -125,6 +125,40 @@ test_classify_check_and_unknown_escalate() {
   pass "check + unknown escalate; heartbeat self-handles"
 }
 
+test_daemon_host_tmux_collision_uses_task_socket() {
+  local dir state fakebin log status=0
+  dir=$(make_supercase daemon-host-tmux-collision)
+  state="$dir/state"
+  fakebin="$dir/fakebin"
+  log="$dir/tmux.log"
+  fm_write_meta "$state/one.meta" \
+    'window=@1' 'host_root=/host/one' 'tmux_socket_path=/one.sock' 'tmux_window_marker=one'
+  fm_write_meta "$state/two.meta" \
+    'window=@1' 'host_root=/host/two' 'tmux_socket_path=/two.sock' 'tmux_window_marker=two'
+  printf 'idle\n' > "$dir/pane"
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+socket=ambient
+if [ "${1:-}" = -S ]; then
+  socket=$2
+  shift 2
+fi
+printf '%s\n' "$socket" >> "$FM_SOCKET_LOG"
+case "${1:-}" in
+  capture-pane) cat "$FM_FAKE_TMUX_CAPTURE" ;;
+  *) exit 1 ;;
+esac
+SH
+  chmod +x "$fakebin/tmux"
+  PATH="$fakebin:$PATH" FM_SOCKET_LOG="$log" FM_FAKE_TMUX_CAPTURE="$dir/pane" \
+    stale_window_is_busy two "$state" || status=$?
+  expect_code 1 "$status" "idle task-scoped daemon probe returned an unexpected state"
+  assert_grep '/two.sock' "$log" "daemon did not probe the selected task's creating socket"
+  assert_no_grep '/one.sock' "$log" "daemon probed the other colliding task's socket"
+  assert_no_grep '^ambient$' "$log" "daemon probed ambient tmux for a colliding host task"
+  pass "daemon probes colliding host tmux windows through task-owned sockets"
+}
+
 test_stale_transient_self_records_marker() {
   local dir state out key
   dir=$(make_supercase stale-transient)
@@ -1823,6 +1857,7 @@ test_daemon_state_root_uses_fm_home
 test_classify_routine_signal_self
 test_classify_terminal_signal_escalates
 test_classify_check_and_unknown_escalate
+test_daemon_host_tmux_collision_uses_task_socket
 test_stale_transient_self_records_marker
 test_stale_diagnostic_wedge_survives_busy_housekeeping
 test_stale_terminal_escalates
diff --git a/tests/fm-watch-triage.test.sh b/tests/fm-watch-triage.test.sh
index a14a2923bf..22b5658d30 100755
--- a/tests/fm-watch-triage.test.sh
+++ b/tests/fm-watch-triage.test.sh
@@ -1539,6 +1539,42 @@ test_afk_paused_changed_pane_hands_off_plain_stale() {
   pass "AFK changed paused panes hand off plain stale identities for daemon-owned pause triage"
 }
 
+test_host_tmux_socket_collisions_stay_task_scoped() {
+  local dir state fakebin log out
+  dir=$(make_case host-tmux-socket-collision)
+  state="$dir/state"
+  fakebin="$dir/fakebin"
+  log="$dir/tmux.log"
+  fm_write_meta "$state/one.meta" \
+    'window=@1' 'host_root=/host/one' 'tmux_socket_path=/one.sock' 'tmux_window_marker=one'
+  fm_write_meta "$state/two.meta" \
+    'window=@1' 'host_root=/host/two' 'tmux_socket_path=/two.sock' 'tmux_window_marker=two'
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+socket=ambient
+if [ "${1:-}" = -S ]; then
+  socket=$2
+  shift 2
+fi
+printf '%s\n' "$socket" >> "$FM_SOCKET_LOG"
+[ "${1:-}" = capture-pane ] && printf '%s\n' "$socket"
+SH
+  chmod +x "$fakebin/tmux"
+  out=$(PATH="$fakebin:$PATH" FM_SOCKET_LOG="$log" FM_STATE_OVERRIDE="$state" bash -c '
+    . "$1/bin/fm-watch.sh"
+    while IFS=$(printf "\t") read -r ref task window; do
+      pane=$( ( window_bind_context "$window" "$task" \
+        && fm_backend_capture "$(window_backend "$window" "$task")" "$window" 1 ) )
+      printf "%s|%s\n" "$ref" "$pane"
+      window_is_busy "$window" "$pane" "$task" || true
+    done < <(recorded_windows)
+  ' _ "$ROOT")
+  assert_contains "$out" 'one|/one.sock' "watcher did not bind the first colliding task to its socket"
+  assert_contains "$out" 'two|/two.sock' "watcher did not bind the second colliding task to its socket"
+  assert_no_grep '^ambient$' "$log" "watcher probed ambient tmux for colliding host tasks"
+  pass "watcher keys colliding host tmux windows by task and creating socket"
+}
+
 test_signal_reason_is_actionable_classifier
 test_stale_is_terminal_classifier
 test_scan_captain_relevant_statuses_classifier
@@ -1579,3 +1615,4 @@ test_heartbeat_backstop_surfaces_unsurfaced_status
 test_beacon_stays_fresh_while_absorbing
 test_afk_present_reverts_watcher_to_one_shot
 test_afk_paused_changed_pane_hands_off_plain_stale
+test_host_tmux_socket_collisions_stay_task_scoped

From 6c046b88a7e5eaacf38fc0e104b05da11ab81745 Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Mon, 27 Jul 2026 15:11:31 +0300
Subject: [PATCH 24/39] test: bound Herdr abort fixture timing

---
 tests/fm-backend-herdr-presentation-e2e.test.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tests/fm-backend-herdr-presentation-e2e.test.sh b/tests/fm-backend-herdr-presentation-e2e.test.sh
index 158e943211..3368227dfe 100755
--- a/tests/fm-backend-herdr-presentation-e2e.test.sh
+++ b/tests/fm-backend-herdr-presentation-e2e.test.sh
@@ -742,9 +742,11 @@ pass "real Herdr lab: forced workspace.move failure leaves a successful worker i
 mkdir -p "$POST_CREATE_ABORT_CONTROL"
 ABORT_START=$(log_line_count)
 ABORT_FOCUS_START=$(focus_audit_line_count)
-spawn_task abort-a "$HOME_DIR" "$PROJECT_DIR" > "$TMP_ROOT/abort-a.out" 2> "$TMP_ROOT/abort-a.err" &
+FM_WORKTREE_CWD_ATTEMPTS=2 FM_WORKTREE_CWD_DELAY=0.1 \
+  spawn_task abort-a "$HOME_DIR" "$PROJECT_DIR" > "$TMP_ROOT/abort-a.out" 2> "$TMP_ROOT/abort-a.err" &
 ABORT_A_PID=$!
-spawn_task abort-b "$HOME_DIR" "$PROJECT_DIR" > "$TMP_ROOT/abort-b.out" 2> "$TMP_ROOT/abort-b.err" &
+FM_WORKTREE_CWD_ATTEMPTS=2 FM_WORKTREE_CWD_DELAY=0.1 \
+  spawn_task abort-b "$HOME_DIR" "$PROJECT_DIR" > "$TMP_ROOT/abort-b.out" 2> "$TMP_ROOT/abort-b.err" &
 ABORT_B_PID=$!
 if wait "$ABORT_A_PID"; then fail "post-create abort fixture A unexpectedly succeeded"; fi
 if wait "$ABORT_B_PID"; then fail "post-create abort fixture B unexpectedly succeeded"; fi

From ad2653f89d4ac68355e1046b4fc2af0834892433 Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Tue, 28 Jul 2026 11:02:45 +0300
Subject: [PATCH 25/39] no-mistakes(review): Preserve tmux rollback metadata;
 Herdr acceptance remains blocked

---
 bin/backends/tmux.sh                         |   5 +-
 bin/fm-spawn.sh                              |   5 +-
 docs/verification/runtime-backends.md        |  11 ++
 tests/fm-backend-herdr-host-root-e2e.test.sh | 141 +++++++++++++++++++
 tests/fm-backend.test.sh                     |  16 +++
 tests/fm-host-root-mode.test.sh              |  24 +++-
 6 files changed, 198 insertions(+), 4 deletions(-)
 create mode 100755 tests/fm-backend-herdr-host-root-e2e.test.sh

diff --git a/bin/backends/tmux.sh b/bin/backends/tmux.sh
index 97e7a9101f..cdf297560c 100644
--- a/bin/backends/tmux.sh
+++ b/bin/backends/tmux.sh
@@ -113,13 +113,16 @@ fm_backend_tmux_socket_path() {
 # lost, so worktree discovery cannot fall back to the active client's window.
 fm_backend_tmux_create_task() {  # <session> <window-name> <proj-abs> [task-marker] -> prints window id
   local ses=$1 wname=$2 proj_abs=$3 marker=${4:-} wid
+  FM_BACKEND_CREATE_OCCURRED=0
+  FM_BACKEND_CREATED_TARGET=
   if fm_tmux_cli list-windows -t "$ses" -F '#{window_name}' | grep -qx "$wname"; then
     echo "error: window $ses:$wname already exists" >&2
     return 1
   fi
   wid=$(fm_tmux_cli new-window -dP -F '#{window_id}' -t "$ses:" -n "$wname" -c "$proj_abs") || return 1
+  FM_BACKEND_CREATE_OCCURRED=1
+  FM_BACKEND_CREATED_TARGET=$wid
   if [ -n "$marker" ] && ! fm_tmux_cli set-window-option -t "$wid" @firstmate_task_marker "$marker" 2>/dev/null; then
-    fm_tmux_cli kill-window -t "$wid" 2>/dev/null || true
     return 1
   fi
   fm_tmux_cli set-window-option -t "$wid" automatic-rename off 2>/dev/null || true
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 70b9186c5f..1d32bdf823 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -1232,7 +1232,10 @@ case "$BACKEND" in
       }
       fm_backend_tmux_use_socket "$TMUX_SOCKET_PATH" || exit 1
     fi
-    WID=$(fm_backend_tmux_create_task "$SES" "$W" "$PROJ_ABS" "$TMUX_WINDOW_MARKER") || exit 1
+    if ! capture_backend_create WID fm_backend_tmux_create_task "$SES" "$W" "$PROJ_ABS" "$TMUX_WINDOW_MARKER"; then
+      arm_created_endpoint_rollback
+      exit 1
+    fi
     WT_TARGET="$WID"
     [ "$HOST_MODE" -eq 0 ] || T=$WID
     ;;
diff --git a/docs/verification/runtime-backends.md b/docs/verification/runtime-backends.md
index 84a18ee1bc..e0785abcd5 100644
--- a/docs/verification/runtime-backends.md
+++ b/docs/verification/runtime-backends.md
@@ -173,6 +173,17 @@ The CLI matrix was checked directly:
 All destructive verification used `bin/fm-herdr-lab.sh` with a non-default `fm-lab-` name and a byte-identical default-session tripwire.
 No ambient `herdr server stop` command is a supported test operation.
 
+### Host-root task routing
+
+Real Herdr host-root acceptance is owned by:
+
+```sh
+tests/fm-backend-herdr-host-root-e2e.test.sh
+```
+
+The acceptance drives `bin/fm-spawn.sh`, a completion lifecycle signal, `bin/fm-crew-state.sh`, and `bin/fm-teardown.sh` through an isolated named Herdr lab.
+It verifies host-authoritative cwd and instructions, target-only edits in the explicit linked worktree, clean host and primary target checkouts, completed task state, exact pane teardown, worktree return, and the default-session fleet-state tripwire.
+
 ### Prune and respawn
 
 The real label-collision reproduction is owned by:
diff --git a/tests/fm-backend-herdr-host-root-e2e.test.sh b/tests/fm-backend-herdr-host-root-e2e.test.sh
new file mode 100755
index 0000000000..61a8ee6cb8
--- /dev/null
+++ b/tests/fm-backend-herdr-host-root-e2e.test.sh
@@ -0,0 +1,141 @@
+#!/usr/bin/env bash
+# Isolated real-Herdr acceptance for host-root spawn, completion, and teardown.
+set -u
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+TMP_ROOT=$(mktemp -d "${TMPDIR:-/tmp}/fm-herdr-host-root-e2e.XXXXXX")
+SESSION="fm-lab-host-root-e2e-$$"
+ID=host-root-e2e
+WT=
+
+cleanup() {
+  [ -z "$WT" ] || treehouse return --force "$WT" >/dev/null 2>&1 || true
+  herdr_safe_stop_and_delete "$SESSION" >/dev/null 2>&1 || true
+  rm -rf "$TMP_ROOT"
+}
+fail() {
+  printf 'not ok - %s\n' "$1" >&2
+  cleanup
+  exit 1
+}
+assert_line() {
+  grep -Fx -- "$2" "$1" >/dev/null 2>&1 || fail "$3"
+}
+
+command -v herdr >/dev/null 2>&1 || { echo "skip: herdr not found"; exit 0; }
+command -v jq >/dev/null 2>&1 || { echo "skip: jq not found"; exit 0; }
+command -v treehouse >/dev/null 2>&1 || { echo "skip: treehouse not found"; exit 0; }
+
+# shellcheck source=tests/herdr-test-safety.sh
+. "$ROOT/tests/herdr-test-safety.sh"
+export HERDR_SESSION="$SESSION"
+export FM_HERDR_LAB_STATE_DIR="$TMP_ROOT/lab-state"
+trap cleanup EXIT
+fm_herdr_lab_prepare "$SESSION" || fail "could not prepare isolated Herdr lab"
+
+make_repo() {
+  local dir=$1
+  shift
+  mkdir -p "$dir"
+  git -C "$dir" init -q
+  "$@" "$dir"
+  git -C "$dir" add .
+  git -C "$dir" -c user.name='Firstmate Tests' -c user.email='tests@example.invalid' commit -qm initial
+}
+make_host() {
+  printf 'host instructions\n' > "$1/AGENTS.md"
+}
+make_target() {
+  printf 'target instructions\n' > "$1/AGENTS.md"
+  printf 'target\n' > "$1/README.md"
+}
+
+HOST="$TMP_ROOT/host"
+PROJECT="$TMP_ROOT/target"
+HOME_ROOT="$TMP_ROOT/home"
+FAKEBIN="$TMP_ROOT/fakebin"
+OBS="$TMP_ROOT/worker-observation"
+make_repo "$HOST" make_host
+make_repo "$PROJECT" make_target
+mkdir -p "$HOME_ROOT/data" "$HOME_ROOT/state" "$HOME_ROOT/config" "$FAKEBIN"
+
+cat > "$FAKEBIN/codex" <<'SH'
+#!/usr/bin/env bash
+set -u
+{
+  printf 'cwd=%s\n' "$(pwd -P)"
+  printf 'host=%s\n' "$FM_HOST_ROOT"
+  printf 'target=%s\n' "$FM_TARGET_WORKTREE"
+  printf 'target_top=%s\n' "$(git -C "$FM_TARGET_WORKTREE" rev-parse --show-toplevel)"
+  printf 'host_instructions=%s\n' "$(cat "$FM_HOST_ROOT/AGENTS.md")"
+  printf 'target_instructions=%s\n' "$(cat "$FM_TARGET_WORKTREE/AGENTS.md")"
+} > "$FM_E2E_OBS"
+printf 'worker edit\n' > "$FM_TARGET_WORKTREE/worker-edit.txt"
+mkdir -p "$FM_HOME/data/$FM_E2E_TASK_ID"
+printf '# Real Herdr host-root report\n' > "$FM_HOME/data/$FM_E2E_TASK_ID/report.md"
+printf 'done: real Herdr host-root worker completed\n' >> "$FM_HOME/state/$FM_E2E_TASK_ID.status"
+touch "$FM_HOME/state/$FM_E2E_TASK_ID.turn-ended"
+SH
+chmod +x "$FAKEBIN/codex"
+
+(cd "$HOST" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$HOME_ROOT" FM_HOST_ROOT="$HOST" \
+  "$ROOT/bin/fm-brief.sh" "$ID" "$(basename "$PROJECT")" >/dev/null) \
+  || fail "could not create host-root brief"
+
+SPAWN_OUT="$TMP_ROOT/spawn.out"
+(cd "$HOST" && PATH="$FAKEBIN:$PATH" FM_SPAWN_NO_GUARD=1 \
+  FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$HOME_ROOT" FM_HOST_ROOT="$HOST" \
+  FM_E2E_OBS="$OBS" FM_E2E_TASK_ID="$ID" \
+  "$ROOT/bin/fm-spawn.sh" "$ID" "$PROJECT" --harness codex --backend herdr --scout \
+  > "$SPAWN_OUT" 2>&1) || fail "real Herdr host-root spawn failed: $(cat "$SPAWN_OUT")"
+
+for _ in $(seq 1 100); do
+  [ -s "$OBS" ] && [ -e "$HOME_ROOT/state/$ID.turn-ended" ] && break
+  sleep 0.1
+done
+[ -s "$OBS" ] || fail "worker did not publish host-root observations"
+[ -e "$HOME_ROOT/state/$ID.turn-ended" ] || fail "worker completion lifecycle signal was absent"
+
+META="$HOME_ROOT/state/$ID.meta"
+[ -f "$META" ] || fail "spawn did not publish task metadata"
+WT=$(sed -n 's/^worktree=//p' "$META")
+PANE=$(sed -n 's/^herdr_pane_id=//p' "$META")
+[ -n "$WT" ] && [ -d "$WT" ] || fail "spawn did not retain an isolated target worktree"
+[ -n "$PANE" ] || fail "spawn did not record the Herdr pane"
+HOST_REAL=$(cd "$HOST" && pwd -P)
+WT_REAL=$(cd "$WT" && pwd -P)
+assert_line "$OBS" "cwd=$HOST_REAL" "worker cwd was not the authoritative host"
+assert_line "$OBS" "host=$HOST_REAL" "worker FM_HOST_ROOT was incorrect"
+assert_line "$OBS" "target=$WT_REAL" "worker FM_TARGET_WORKTREE was incorrect"
+assert_line "$OBS" "target_top=$WT_REAL" "worker target was not the isolated Git root"
+assert_line "$OBS" "host_instructions=host instructions" "worker could not read host instructions"
+assert_line "$OBS" "target_instructions=target instructions" "worker could not read target instructions"
+assert_line "$META" "backend=herdr" "metadata did not retain the Herdr backend"
+assert_line "$META" "host_root=$HOST_REAL" "metadata did not retain host authority"
+[ -z "$(git -C "$HOST" status --short)" ] || fail "worker changed the host repository"
+[ -z "$(git -C "$PROJECT" status --short)" ] || fail "worker changed the target primary checkout"
+[ -f "$WT/worker-edit.txt" ] || fail "worker edit did not stay in the target worktree"
+STATE_OUT=$(cd "$HOST" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$HOME_ROOT" FM_HOST_ROOT="$HOST_REAL" \
+  "$ROOT/bin/fm-crew-state.sh" "$ID")
+case "$STATE_OUT" in
+  'state: done'* ) ;;
+  *) fail "completion did not reconcile to done: $STATE_OUT" ;;
+esac
+
+TEARDOWN_OUT="$TMP_ROOT/teardown.out"
+(cd "$HOST" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$HOME_ROOT" FM_HOST_ROOT="$HOST_REAL" \
+  "$ROOT/bin/fm-teardown.sh" "$ID" > "$TEARDOWN_OUT" 2>&1) \
+  || fail "real Herdr host-root teardown failed: $(cat "$TEARDOWN_OUT")"
+[ ! -e "$META" ] || fail "teardown retained task metadata"
+[ ! -d "$WT" ] || fail "teardown retained the target worktree"
+if herdr pane get "$PANE" --session "$SESSION" >/dev/null 2>&1; then
+  fail "teardown retained the Herdr pane"
+fi
+WT=
+[ -z "$(git -C "$HOST" status --short)" ] || fail "teardown changed the host repository"
+[ -z "$(git -C "$PROJECT" status --short)" ] || fail "teardown changed the target primary checkout"
+
+herdr_safe_stop_and_delete "$SESSION" >/dev/null || fail "isolated Herdr lab teardown failed"
+trap - EXIT
+rm -rf "$TMP_ROOT"
+printf 'ok - real Herdr host-root spawn, completion, and teardown\n'
diff --git a/tests/fm-backend.test.sh b/tests/fm-backend.test.sh
index 6d3a6a5ffa..921b8ffe12 100755
--- a/tests/fm-backend.test.sh
+++ b/tests/fm-backend.test.sh
@@ -1034,6 +1034,22 @@ test_teardown_conformance_old_vs_new() {
 
 test_adapter_post_create_failure_records_ownership() {
   local out counter="$TMP_ROOT/cmux-create-counter"
+  out=$(bash -c '
+    . "$1/bin/fm-backend.sh"; fm_backend_source tmux
+    fm_tmux_cli() {
+      case "$1" in
+        list-windows) return 0 ;;
+        new-window) printf "@7\n" ;;
+        set-window-option) return 1 ;;
+        kill-window) printf killed ;;
+      esac
+    }
+    fm_backend_tmux_create_task firstmate fm-task /tmp marker >/dev/null 2>&1
+    rc=$?
+    printf "%s|%s|%s" "$rc" "$FM_BACKEND_CREATE_OCCURRED" "$FM_BACKEND_CREATED_TARGET"
+  ' _ "$ROOT")
+  [ "$out" = "1|1|@7" ] || fail "tmux did not retain partial post-create ownership: '$out'"
+
   out=$(bash -c '
     . "$1/bin/fm-backend.sh"; fm_backend_source herdr
     fm_backend_herdr_cli() {
diff --git a/tests/fm-host-root-mode.test.sh b/tests/fm-host-root-mode.test.sh
index 0dffad26cd..f8f443dd13 100644
--- a/tests/fm-host-root-mode.test.sh
+++ b/tests/fm-host-root-mode.test.sh
@@ -321,7 +321,10 @@ case "${1:-}" in
     fi
     ;;
   set-window-option)
-    [ "${*: -2:1}" != @firstmate_task_marker ] || printf '%s' "${*: -1}" > "$marker_file"
+    if [ "${*: -2:1}" = @firstmate_task_marker ]; then
+      [ "${FM_FAIL_MARKER_SET:-0}" != 1 ] || exit 94
+      printf '%s' "${*: -1}" > "$marker_file"
+    fi
     ;;
   has-session|new-session) ;;
   new-window) : > "$endpoint"; printf '@1\n' ;;
@@ -813,12 +816,29 @@ test_spawn_rollback_is_transactional() {
   git -C "$project" worktree add -q --detach "$uncertain_wt"
   git -C "$project" worktree add -q --detach "$retained_wt"
   git -C "$project" worktree add -q --detach "$unset_wt"
-  for id in rollback-clean rollback-stuck rollback-uncertain rollback-retained; do
+  for id in rollback-marker rollback-clean rollback-stuck rollback-uncertain rollback-retained; do
     (cd "$host" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
       "$ROOT/bin/fm-brief.sh" "$id" target >/dev/null 2>&1)
   done
   fb=$(make_fakebin "$TMP/fake-rollback")
   log="$TMP/rollback.log"; current="$TMP/rollback.current"; tree_log="$TMP/rollback-treehouse.log"
+
+  : > "$log"; : > "$tree_log"; printf '%s\n' "$project" > "$current"; status=0
+  out=$(cd "$host" && PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
+    FM_FAIL_MARKER_SET=1 FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 FM_TMUX_LOG="$log" \
+    FM_ENDPOINT_TARGET=test-session:fm-rollback-marker FM_LAUNCH_FILE="$TMP/rollback-marker.launch" \
+    FM_CURRENT_PATH="$current" FM_TARGET_PATH="$wt" FM_HOST_PATH="$host" FM_TREEHOUSE_LOG="$tree_log" TMUX=fake \
+    "$ROOT/bin/fm-spawn.sh" rollback-marker "$project" pi 2>&1) || status=$?
+  [ "$status" -ne 0 ] || fail "injected tmux marker failure unexpectedly succeeded"
+  assert_no_grep 'kill-window' "$log" "marker failure bypassed ownership verification during rollback"
+  assert_no_grep 'return --force' "$tree_log" "marker failure recycled a worktree before endpoint absence was confirmed"
+  assert_present "$home/state/rollback-marker.meta" "marker failure lost recovery metadata"
+  assert_grep 'window=@1' "$home/state/rollback-marker.meta" "marker failure did not record the created tmux window id"
+  assert_grep 'tmux_window_marker=' "$home/state/rollback-marker.meta" "marker failure did not retain its intended ownership marker"
+  assert_grep 'tmux_socket_path=' "$home/state/rollback-marker.meta" "marker failure did not retain its creating socket"
+  assert_present "$current.endpoint" "marker failure lost the unconfirmed live endpoint"
+  rm -f "$home/state/rollback-marker.meta" "$current.endpoint"
+
   printf '%s\n' "$project" > "$current"
   out=$(cd "$host" && PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
     FM_FAIL_LAUNCH_SEND=1 FM_BACKEND_STOP_ATTEMPTS=1 FM_BACKEND_STOP_DELAY=0 FM_TMUX_LOG="$log" \

From 19d3970e81cef72211784bb0228e87fc39ee9b6d Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Tue, 28 Jul 2026 12:10:00 +0300
Subject: [PATCH 26/39] no-mistakes(review): Captain: complete Herdr host-root
 decision-inventory acceptance

---
 bin/fm-spawn.sh                              |  2 +-
 docs/verification/runtime-backends.md        | 12 +++++++--
 tests/fm-backend-herdr-host-root-e2e.test.sh | 26 ++++++++++++--------
 3 files changed, 27 insertions(+), 13 deletions(-)

diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 1d32bdf823..1189c026d7 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -1878,7 +1878,7 @@ if [ "$KIND" = secondmate ]; then
   fi
   LAUNCH="${secondmate_root_clear}FM_ROOT_OVERRIDE= FM_STATE_OVERRIDE= FM_DATA_OVERRIDE= FM_PROJECTS_OVERRIDE= FM_CONFIG_OVERRIDE= FM_HOME=$sq_home $LAUNCH"
 elif [ "$HOST_MODE" -eq 1 ]; then
-  LAUNCH="FM_ROOT_OVERRIDE=$(shell_quote "$FM_ROOT") FM_HOME=$(shell_quote "$FM_HOME") FM_HOST_ROOT=$(shell_quote "$HOST_ROOT") FM_TARGET_WORKTREE=$(shell_quote "$WT") $LAUNCH"
+  LAUNCH="PATH=$(shell_quote "$PATH") FM_ROOT_OVERRIDE=$(shell_quote "$FM_ROOT") FM_HOME=$(shell_quote "$FM_HOME") FM_HOST_ROOT=$(shell_quote "$HOST_ROOT") FM_TARGET_WORKTREE=$(shell_quote "$WT") $LAUNCH"
 fi
 # Export GOTMPDIR into the crewmate's pane shell so the agent and every child
 # process (go build, go test, ...) inherit it. Sent before the launch command so
diff --git a/docs/verification/runtime-backends.md b/docs/verification/runtime-backends.md
index e0785abcd5..ba8f1d0e04 100644
--- a/docs/verification/runtime-backends.md
+++ b/docs/verification/runtime-backends.md
@@ -181,8 +181,16 @@ Real Herdr host-root acceptance is owned by:
 tests/fm-backend-herdr-host-root-e2e.test.sh
 ```
 
-The acceptance drives `bin/fm-spawn.sh`, a completion lifecycle signal, `bin/fm-crew-state.sh`, and `bin/fm-teardown.sh` through an isolated named Herdr lab.
-It verifies host-authoritative cwd and instructions, target-only edits in the explicit linked worktree, clean host and primary target checkouts, completed task state, exact pane teardown, worktree return, and the default-session fleet-state tripwire.
+The acceptance drives `bin/fm-spawn.sh`, a completion lifecycle signal, `bin/fm-crew-state.sh`, `bin/fm-decision-hold.sh complete`, and `bin/fm-teardown.sh` through an isolated named Herdr lab.
+It verifies host-authoritative cwd and instructions, target-only edits in the explicit linked worktree, clean host and primary target checkouts, completed task state, completed decision inventory, exact pane teardown, worktree return, and the default-session fleet-state tripwire.
+The host-root acceptance passed on 2026-07-28 against Herdr 0.7.5 and Treehouse 2.0.0 on Linux.
+The exact command and output were:
+
+```text
+tests/fm-backend-herdr-host-root-e2e.test.sh
+warn: no registry at /tmp/fm-herdr-host-root-e2e.Ymlc0f/home/data/projects.md; defaulting target to no-mistakes off
+ok - real Herdr host-root spawn, completion, decision inventory, and teardown
+```
 
 ### Prune and respawn
 
diff --git a/tests/fm-backend-herdr-host-root-e2e.test.sh b/tests/fm-backend-herdr-host-root-e2e.test.sh
index 61a8ee6cb8..9586fa5d2d 100755
--- a/tests/fm-backend-herdr-host-root-e2e.test.sh
+++ b/tests/fm-backend-herdr-host-root-e2e.test.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Isolated real-Herdr acceptance for host-root spawn, completion, and teardown.
+# Isolated real-Herdr acceptance for host-root spawn, completion, decision inventory, and teardown.
 set -u
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
@@ -54,7 +54,7 @@ HOST="$TMP_ROOT/host"
 PROJECT="$TMP_ROOT/target"
 HOME_ROOT="$TMP_ROOT/home"
 FAKEBIN="$TMP_ROOT/fakebin"
-OBS="$TMP_ROOT/worker-observation"
+OBS="$HOME_ROOT/worker-observation"
 make_repo "$HOST" make_host
 make_repo "$PROJECT" make_target
 mkdir -p "$HOME_ROOT/data" "$HOME_ROOT/state" "$HOME_ROOT/config" "$FAKEBIN"
@@ -69,12 +69,12 @@ set -u
   printf 'target_top=%s\n' "$(git -C "$FM_TARGET_WORKTREE" rev-parse --show-toplevel)"
   printf 'host_instructions=%s\n' "$(cat "$FM_HOST_ROOT/AGENTS.md")"
   printf 'target_instructions=%s\n' "$(cat "$FM_TARGET_WORKTREE/AGENTS.md")"
-} > "$FM_E2E_OBS"
+} > "$FM_HOME/worker-observation"
 printf 'worker edit\n' > "$FM_TARGET_WORKTREE/worker-edit.txt"
-mkdir -p "$FM_HOME/data/$FM_E2E_TASK_ID"
-printf '# Real Herdr host-root report\n' > "$FM_HOME/data/$FM_E2E_TASK_ID/report.md"
-printf 'done: real Herdr host-root worker completed\n' >> "$FM_HOME/state/$FM_E2E_TASK_ID.status"
-touch "$FM_HOME/state/$FM_E2E_TASK_ID.turn-ended"
+mkdir -p "$FM_HOME/data/host-root-e2e"
+printf '# Real Herdr host-root report\n' > "$FM_HOME/data/host-root-e2e/report.md"
+printf 'done: real Herdr host-root worker completed\n' >> "$FM_HOME/state/host-root-e2e.status"
+touch "$FM_HOME/state/host-root-e2e.turn-ended"
 SH
 chmod +x "$FAKEBIN/codex"
 
@@ -85,7 +85,6 @@ chmod +x "$FAKEBIN/codex"
 SPAWN_OUT="$TMP_ROOT/spawn.out"
 (cd "$HOST" && PATH="$FAKEBIN:$PATH" FM_SPAWN_NO_GUARD=1 \
   FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$HOME_ROOT" FM_HOST_ROOT="$HOST" \
-  FM_E2E_OBS="$OBS" FM_E2E_TASK_ID="$ID" \
   "$ROOT/bin/fm-spawn.sh" "$ID" "$PROJECT" --harness codex --backend herdr --scout \
   > "$SPAWN_OUT" 2>&1) || fail "real Herdr host-root spawn failed: $(cat "$SPAWN_OUT")"
 
@@ -122,12 +121,19 @@ case "$STATE_OUT" in
   *) fail "completion did not reconcile to done: $STATE_OUT" ;;
 esac
 
+(cd "$HOST" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$HOME_ROOT" FM_HOST_ROOT="$HOST_REAL" \
+  "$ROOT/bin/fm-decision-hold.sh" complete "$ID" --none >/dev/null) \
+  || fail "real Herdr host-root decision inventory failed"
+
 TEARDOWN_OUT="$TMP_ROOT/teardown.out"
 (cd "$HOST" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$HOME_ROOT" FM_HOST_ROOT="$HOST_REAL" \
   "$ROOT/bin/fm-teardown.sh" "$ID" > "$TEARDOWN_OUT" 2>&1) \
   || fail "real Herdr host-root teardown failed: $(cat "$TEARDOWN_OUT")"
 [ ! -e "$META" ] || fail "teardown retained task metadata"
-[ ! -d "$WT" ] || fail "teardown retained the target worktree"
+[ ! -f "$WT/worker-edit.txt" ] || fail "teardown retained target edits"
+TREEHOUSE_OUT=$(cd "$PROJECT" && treehouse status 2>/dev/null)
+printf '%s\n' "$TREEHOUSE_OUT" | awk '$2 == "available" { found = 1 } END { exit !found }' \
+  || fail "teardown did not return the target worktree: $TREEHOUSE_OUT"
 if herdr pane get "$PANE" --session "$SESSION" >/dev/null 2>&1; then
   fail "teardown retained the Herdr pane"
 fi
@@ -138,4 +144,4 @@ WT=
 herdr_safe_stop_and_delete "$SESSION" >/dev/null || fail "isolated Herdr lab teardown failed"
 trap - EXIT
 rm -rf "$TMP_ROOT"
-printf 'ok - real Herdr host-root spawn, completion, and teardown\n'
+printf 'ok - real Herdr host-root spawn, completion, decision inventory, and teardown\n'

From 4c4f391617892cfe585d99f30a9c25b8c5df41db Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Tue, 28 Jul 2026 12:51:22 +0300
Subject: [PATCH 27/39] no-mistakes(document): Align host-root documentation
 with runtime safeguards

---
 .agents/skills/firstmate-orca/SKILL.md        |  1 +
 .agents/skills/harness-adapters/SKILL.md      | 14 +++++-----
 .../skills/secondmate-provisioning/SKILL.md   | 11 +++-----
 .../skills/stuck-crewmate-recovery/SKILL.md   |  1 +
 bin/fm-backend.sh                             |  7 ++---
 bin/fm-spawn.sh                               | 26 +++++++++----------
 docs/configuration.md                         | 13 ++++++----
 docs/herdr-backend.md                         |  1 +
 8 files changed, 40 insertions(+), 34 deletions(-)

diff --git a/.agents/skills/firstmate-orca/SKILL.md b/.agents/skills/firstmate-orca/SKILL.md
index d8d50b07b4..9e61bd62ef 100644
--- a/.agents/skills/firstmate-orca/SKILL.md
+++ b/.agents/skills/firstmate-orca/SKILL.md
@@ -24,6 +24,7 @@ Use raw `orca` only when the helper surface cannot answer the inspection questio
 ## Preflight
 
 Work from the current firstmate home or repo root.
+In host-root mode, work instead from the physical `FM_HOST_ROOT` and invoke FirstMate helpers by their absolute `FM_ROOT/bin/` paths under the [four-root contract](../../../docs/configuration.md#host-root-mode-fm_host_root).
 If `FM_HOME` is set, remember that operational state lives under `$FM_HOME` while the helper scripts still run from this repo's `bin/`.
 
 Before switching or spawning against Orca:
diff --git a/.agents/skills/harness-adapters/SKILL.md b/.agents/skills/harness-adapters/SKILL.md
index ff80f1c23c..c2eb2293d2 100644
--- a/.agents/skills/harness-adapters/SKILL.md
+++ b/.agents/skills/harness-adapters/SKILL.md
@@ -340,7 +340,7 @@ The tmux backend's structural `fm_tmux_composer_state` read sees placeholder-fil
 The Herdr adapter (`fm_backend_herdr_composer_state`, `bin/backends/herdr.sh`) classifies the composer's own row structurally instead of diffing raw content; see `docs/herdr-backend.md` "Composer and injection safety" for the current boundary and `tests/fm-backend-herdr.test.sh` for regression coverage.
 
 Startup dialog: the "Run Grok Build in a project directory?" project picker appears ONLY when grok is launched from a non-project directory (home, Desktop, Downloads, `/tmp`).
-`fm-spawn` launches inside the treehouse worktree (a git repo root), so the picker never appears and grok treats the worktree as a trusted project automatically - no post-launch keystroke is needed.
+Default `fm-spawn` launches inside the treehouse worktree, while host-root mode launches from `FM_HOST_ROOT`; either launch root must be a recognized project directory to avoid the picker.
 Pin `[hints] project_picker_disabled = true` in `~/.grok/config.toml` if a non-project launch ever needs to skip it.
 
 **TRUECOLOR placeholder styling: covered (task afk-herdr-false-pending, 2026-07-10).**
@@ -359,11 +359,12 @@ Turn-end hook: grok fires a `Stop` hook at every turn boundary, giving firstmate
 grok loads PROJECT hooks (`<worktree>/.grok/hooks/`, `<worktree>/.claude/settings.local.json`) only after the folder is granted hook-trust in `~/.grok/trusted_folders.toml`, which is not automatic and which firstmate will not establish by editing grok's own managed trust store.
 GLOBAL hooks in `~/.grok/hooks/` are always trusted and load on first launch.
 So `fm-spawn` installs ONE firstmate-owned global hook, `~/.grok/hooks/fm-turn-end.json`, plus the companion `~/.grok/hooks/fm-turn-end.sh`, guarded as a no-op for every non-firstmate grok session.
-Its `Stop` command fires only when the current workspace holds a `.fm-grok-turnend` token pointer that matches the firstmate-owned hook registry under `~/.grok/hooks/fm-turn-end.d/`.
-`fm-spawn` writes that per-task pointer (`<worktree>/.fm-grok-turnend`, gitignored via git info/exclude like the other harnesses' worktree hook files) and a matching registry entry naming this task's `state/<id>.turn-ended`.
-The hook reads `$GROK_WORKSPACE_ROOT`, which is always set for hooks and equals the worktree.
+Its `Stop` command fires only when a launch-scoped `FM_GROK_TURNEND_TOKEN` or the current workspace's `.fm-grok-turnend` pointer matches the firstmate-owned hook registry under `~/.grok/hooks/fm-turn-end.d/`.
+`fm-spawn` always writes the matching registry entry naming this task's `state/<id>.turn-ended`.
+Default launches write the gitignored pointer under the task worktree, while host-root launches pass the token in the worker environment and write no pointer into the host.
+The default pointer path reads `$GROK_WORKSPACE_ROOT`, which Grok sets to the launch workspace.
 This keeps the hook outside the worktree, needs no trust grant, and writes only firstmate-owned files.
-`fm-teardown` removes the worktree pointer before returning a pooled worktree.
+`fm-teardown` removes any default-mode worktree pointer before returning a pooled worktree.
 Secondmate spawns skip the pointer (idle panes are healthy, no stale-pane detection for them).
 
 **Primary-session guard fact (verified 2026-07-28, Grok 0.2.112 and 0.2.73).**
@@ -411,6 +412,7 @@ The spinner match covers the full moon-phase glyph set rather than one frame, bu
 
 [`docs/turnend-guard.md`](../../../docs/turnend-guard.md) owns Kimi's verified global hook surface and captain-approved crew wake integration.
 `fm-spawn.sh` installs one marker-delimited Firstmate entry in `$HOME/.kimi-code/config.toml`, one silent always-zero hook script, and one private token registry under `$HOME/.kimi-code/fm-turn-end.d/`.
-Each Kimi crew worktree receives a gitignored `.fm-kimi-turnend` token pointer, and the global hook touches that task's `state/<id>.turn-ended` only when the Stop payload's `cwd`, pointer, and registry entry all agree.
+Default Kimi crew worktrees receive a gitignored `.fm-kimi-turnend` token pointer, while host-root launches pass `FM_KIMI_TURNEND_TOKEN` in the worker environment and write no pointer into the host.
+The global hook touches that task's `state/<id>.turn-ended` only when the Stop payload has a cwd and the selected token resolves through the private registry.
 A guarded silent hook cannot be verified from absence of effect, so prove invocation with an unguarded probe before concluding that the hook did not fire.
 The guarded turn-end signal supplements the pane busy signature, whose locale- and emoji-font-sensitive limits still apply while a turn is running.
diff --git a/.agents/skills/secondmate-provisioning/SKILL.md b/.agents/skills/secondmate-provisioning/SKILL.md
index 1f0d5c6cc9..aa182e408a 100644
--- a/.agents/skills/secondmate-provisioning/SKILL.md
+++ b/.agents/skills/secondmate-provisioning/SKILL.md
@@ -150,13 +150,10 @@ Do not hand off `local-only` items.
 
 ## Recovery
 
-For `kind=secondmate` meta with no window, treat the secondmate as a dead persistent direct report and respawn it with:
-
-```sh
-bin/fm-spawn.sh <id> --secondmate
-```
-
-Use the recorded `home=` in meta.
+Retained `kind=secondmate` metadata remains recovery authority even when its window or endpoint field is missing.
+Do not delete or rewrite that metadata, and do not invoke a direct same-id `fm-spawn`; direct spawn refuses retained metadata so an ambiguous or incomplete cleanup cannot create a duplicate secondmate.
+The locked session-start liveness sweep owns relaunch after the recorded endpoint and verified harness produce a recovery-grade `dead` or `missing` result.
+An absent endpoint field, ambiguous process, unreadable probe, or unverified harness is not relaunch authority; preserve the recorded `home=`, metadata, and endpoint evidence and report the exact blocker.
 If meta is missing but `data/secondmates.md` still registers the secondmate, respawn from the registry entry and its persistent on-disk home.
 Respawn re-resolves the secondmate harness from current config, uses the same guarded pre-launch sync, and re-propagates inherited local material, so recovered secondmates converge inherited config items and shared captain preferences whenever their home validates; tracked-file sync remains guarded separately.
 If the secondmate is already running and only inherited local material changed, prefer `bin/fm-config-push.sh` over respawning.
diff --git a/.agents/skills/stuck-crewmate-recovery/SKILL.md b/.agents/skills/stuck-crewmate-recovery/SKILL.md
index d97ebee302..c9a26e2cf2 100644
--- a/.agents/skills/stuck-crewmate-recovery/SKILL.md
+++ b/.agents/skills/stuck-crewmate-recovery/SKILL.md
@@ -31,6 +31,7 @@ Do not sweep another home's endpoints or infer ownership from a matching window
 
 Before relaunch, prove that no live agent still owns the recorded task and that the existing worktree remains available.
 Preserve its uncommitted changes and commits, keep the same task identity, and resume or relaunch the recorded harness in that existing worktree with the same brief plus a concise progress note.
+For a host-root task, keep the recorded physical `host_root=` as the harness cwd and pass the existing recorded worktree separately as `FM_TARGET_WORKTREE`; [`docs/configuration.md`](../../../docs/configuration.md#host-root-mode-fm_host_root) owns that four-root exception.
 Do not use a fresh generic spawn while the recorded worktree is unaccounted for, because allocating another worktree can split one task across two copies.
 If the worktree or ownership cannot be reconciled safely, leave all state intact and report the task failed or blocked with the conflicting evidence.
 
diff --git a/bin/fm-backend.sh b/bin/fm-backend.sh
index 238a7a9bc3..e0475b318f 100644
--- a/bin/fm-backend.sh
+++ b/bin/fm-backend.sh
@@ -841,9 +841,10 @@ fm_backend_send_text_submit() {  # <backend> <target> <text> <retries> <enter-sl
   esac
 }
 
-# fm_backend_kill: remove the task's session endpoint (best-effort; a
-# nonexistent/already-gone target is not an error - callers already swallow
-# failures here exactly as the inline `tmux kill-window ... || true` did).
+# fm_backend_kill: remove the task's session endpoint idempotently, so a
+# nonexistent or already-gone target is not an error. Real close failures
+# propagate for verified teardown, while legacy best-effort callers may
+# deliberately swallow them.
 fm_backend_kill() {  # <backend> <target>
   local backend=$1
   shift
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 1189c026d7..38a282d756 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -119,10 +119,10 @@
 #     __GROKTOKEN__ host-mode Grok per-process task hook token
 #     __KIMITOKEN__ host-mode Kimi per-process task hook token
 # Verified per-harness turn-end hooks are installed automatically where enabled; some live outside the worktree.
-# Kimi uses one surgically installed Firstmate region in $HOME/.kimi-code/config.toml,
-# a firstmate-owned global hook and registry, and a gitignored per-task pointer.
-# grok uses a firstmate-owned global hook under ${GROK_HOME:-$HOME/.grok}/hooks
-# plus a gitignored .fm-grok-turnend worktree pointer and a state token.
+# Kimi uses one surgically installed Firstmate region in $HOME/.kimi-code/config.toml
+# plus a Firstmate-owned global hook and registry. Grok uses the same global-hook
+# pattern under ${GROK_HOME:-$HOME/.grok}/hooks. Default launches add a gitignored
+# worktree pointer; host-root launches pass the registry token in the environment.
 # On success prints: spawned <id> harness=<name> kind=<ship|scout|secondmate> mode=<mode> yolo=<on|off> window=<backend-target> worktree=<path>
 # mode/yolo are resolved per-project from data/projects.md for ship/scout tasks;
 # secondmate spawns record mode=secondmate, yolo=off, home=, and projects=.
@@ -658,7 +658,8 @@ launch_template() {
     # crewmate needs; it is the targeted equivalent of claude's
     # --dangerously-skip-permissions. grok's turn-end signal does NOT ride the
     # launch command - it is a Stop-event hook installed below (global hook +
-    # per-task pointer), so the template is identical for ship/scout/secondmate.
+    # registry token). Default launches discover the token through a per-task
+    # pointer, while host-root launches pass it in the environment.
     grok)
       if [ "$HOST_MODE" -eq 1 ] && [ "$kind" != secondmate ]; then
         printf '%s' 'FM_GROK_TURNEND_TOKEN=__GROKTOKEN__ grok --always-approve __MODELFLAG____EFFORTFLAG__"$(__OPINPUT__ encode launch-brief < __BRIEF__)"'
@@ -1698,10 +1699,10 @@ EOF
       # trust store (a high-blast-radius write). GLOBAL hooks in ~/.grok/hooks/ are
       # always trusted and load on first launch with no gate. So the turn-end hook
       # lives OUTSIDE the worktree as a single firstmate-owned global hook that is a
-      # guarded no-op for every non-firstmate grok session: it fires only when the
-      # current workspace holds a .fm-grok-turnend token pointer that matches the
-      # firstmate-owned hook registry. firstmate then drops that per-task pointer
-      # (gitignored, like the other harnesses' worktree hook files).
+      # guarded no-op for every non-firstmate grok session: it fires only when a
+      # launch-scoped token or current-workspace pointer matches the firstmate-owned
+      # hook registry. Default launches add the gitignored pointer; host-root
+      # launches pass the token without writing into the host.
       # Result: the hook is outside the worktree, needs no trust grant, and never
       # touches grok's managed config - only firstmate-owned files.
       GROK_HOOKS_DIR="${GROK_HOME:-$HOME/.grok}/hooks"
@@ -1745,10 +1746,9 @@ EOF
       fi
       ;;
     kimi*)
-      # Kimi's Stop hook is global, but it is inert unless cwd contains this
-      # task's token pointer and the token resolves through Firstmate's private
-      # registry. The installer above owns the format-preserving config edit and
-      # the always-zero, silent hook script.
+      # Kimi's Stop hook is global, but it is inert unless a launch-scoped token or
+      # cwd pointer resolves through Firstmate's private registry. The installer
+      # above owns the format-preserving config edit and always-zero silent hook.
       KIMI_AUTH_DIR="$HOME/.kimi-code/fm-turn-end.d"
       old_umask=$(umask)
       umask 077
diff --git a/docs/configuration.md b/docs/configuration.md
index 60bd7c5ac3..eea5fc7718 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -68,14 +68,17 @@ A cmux spawn additionally version-gates against the installed `cmux` binary's ve
 A backend spawn refusal from a missing dependency, version gate, or unauthenticated socket is terminal for that selected backend; firstmate surfaces it as a blocker instead of silently retrying another backend.
 Task meta records `backend=` only for a non-default backend; an absent `backend=` means `tmux`, preserving existing default-path meta files.
 Every new task records `endpoint_task_id=` as the cleanup binding between the metadata filename and its opaque runtime endpoint.
+A host-root tmux task additionally records `tmux_window_marker=` and `tmux_socket_path=` so lifecycle operations stay bound to the task-owned window on its creating tmux server.
+That socket-bound identity is compatibility and cleanup-safety hardening, not host-root acceptance evidence.
 A herdr task additionally records `herdr_session=`, `herdr_workspace_id=`, `herdr_tab_id=`, and `herdr_pane_id=`.
 A zellij task additionally records `zellij_session=`, `zellij_tab_id=`, and `zellij_pane_id=`.
 An Orca task additionally records `orca_worktree_id=` and `terminal=`, with `window=fm-<id>` kept as the shared firstmate alias.
 A cmux task additionally records `cmux_workspace_id=` and `cmux_surface_id=`.
 Task selectors for `fm-peek.sh`, `fm-send.sh`, and `fm-crew-state.sh` resolve centrally through `fm_backend_resolve_selector`.
-A selector containing `:` is passed through as an explicit backend endpoint escape hatch.
-Otherwise an exact task id matching `state/<id>.meta` wins before the legacy `fm-<id>` label fallback, so task ids that themselves start with `fm-` route to their own metadata instead of being stripped.
+An exact task id matching `state/<id>.meta` wins before the legacy `fm-<id>` label fallback, so task ids that themselves start with `fm-` route to their own metadata instead of being stripped.
+Before external fallback, an exact recorded target or equivalent explicit tmux handle, including a colon-containing host-root alias, routes through its owning metadata.
 A metadata-routed selector returns the recorded backend target (`terminal=` for Orca, otherwise `window=`), and matching explicit targets can still recover the recorded backend when metadata contains the same endpoint.
+Only an unmatched selector containing `:` passes through as an explicit backend endpoint escape hatch.
 Only metadata-routed task selectors carry secondmate-marker and Codex-harness context; explicit endpoint escape hatches do not.
 These five sentences are the single owner of the task-selector vocabulary; backend guides and other documents point here instead of restating the resolution order.
 `fm-teardown.sh <id>` takes a task id directly and validates the complete metadata-only endpoint identity before any runtime dispatch or cleanup mutation.
@@ -241,9 +244,9 @@ When `config/crew-dispatch.json` exists, crewmate and scout spawns require an ex
 The inherited-local-material contract is owned by [`secondmate-provisioning`](../.agents/skills/secondmate-provisioning/SKILL.md); its harness-relevant consequence is that a secondmate's own crewmates use the primary's dispatch profiles and static harness value.
 Those inherited values are defaults and rules only; `fm-spawn` still permits a consciously chosen explicit runtime outside the config.
 `config/secondmate-harness` is not inherited because secondmates do not launch secondmates.
-For grok, `fm-spawn.sh` installs one firstmate-owned global turn-end hook under `$GROK_HOME/hooks/`, or `~/.grok/hooks/` when `GROK_HOME` is unset, and drops a per-task `.fm-grok-turnend` pointer in the worktree, with teardown removing the task token and pointer.
-For Kimi crews, `fm-spawn.sh` runs `fm-kimi-turnend-hook.sh install` and records a private registry token for teardown.
-Default launches also drop a per-task `.fm-kimi-turnend` pointer in the worktree, while host-root launches pass the same token only through `FM_KIMI_TURNEND_TOKEN` and never write a pointer into the host repository.
+For Grok, `fm-spawn.sh` installs one firstmate-owned global turn-end hook under `$GROK_HOME/hooks/`, or `~/.grok/hooks/` when `GROK_HOME` is unset, and records a private registry token for teardown.
+For Kimi crews, `fm-spawn.sh` runs `fm-kimi-turnend-hook.sh install` and records the same kind of private registry token.
+The [`harness-adapters` skill](../.agents/skills/harness-adapters/SKILL.md#host-root-task-integration) owns the default worktree-pointer and host-root launch-token delivery split for both harnesses.
 Kimi continues to use the captain's normal Kimi home, including the existing config, skills, and memory; Firstmate does not create an isolated Kimi home.
 The Kimi installer requires an existing regular non-symlink `~/.kimi-code/config.toml`, `python3` with `tomllib`, and `jq`; it validates but never serializes the captain's TOML and refuses before writing when the config is missing, malformed, or surprising or when either tool requirement is unavailable.
 Its `remove` action excises only the marker-delimited Firstmate region and removes Firstmate's hook files.
diff --git a/docs/herdr-backend.md b/docs/herdr-backend.md
index 4d29485f91..3ab8634e2b 100644
--- a/docs/herdr-backend.md
+++ b/docs/herdr-backend.md
@@ -271,6 +271,7 @@ Tests use thin compatibility wrappers in `tests/herdr-test-safety.sh` and never
 ```sh
 tests/fm-backend-herdr.test.sh
 tests/fm-backend-herdr-smoke.test.sh
+tests/fm-backend-herdr-host-root-e2e.test.sh
 tests/fm-backend-herdr-prune-safety-e2e.test.sh
 tests/fm-backend-herdr-respawn-idem-e2e.test.sh
 tests/fm-backend-herdr-workspace-per-home-e2e.test.sh

From 599ea914941a4ea22d89c3aa8ee7359fbe646a7a Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Tue, 28 Jul 2026 12:59:49 +0300
Subject: [PATCH 28/39] no-mistakes(lint): Fix host-root ShellCheck findings

---
 bin/backends/cmux.sh | 2 +-
 bin/backends/tmux.sh | 6 +++++-
 bin/fm-backend.sh    | 3 ++-
 bin/fm-spawn.sh      | 1 +
 4 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/bin/backends/cmux.sh b/bin/backends/cmux.sh
index b7689d6dcf..2ae15482bd 100644
--- a/bin/backends/cmux.sh
+++ b/bin/backends/cmux.sh
@@ -391,7 +391,7 @@ fm_backend_cmux_parse_target() {  # <target>
 
 fm_backend_cmux_workspace_across_windows() {  # <workspace_id> [expected-title] -> "<workspace_id>\t<window_id>\t<count>"
   local wsid=$1 expected_title=${2:-} wins window_ids window_id workspaces count
-  local current_id title id_match= label_match= id_count=0 label_count=0 id_conflict=0
+  local current_id title id_match='' label_match='' id_count=0 label_count=0 id_conflict=0
   wins=$(fm_backend_cmux_cli list-windows --json --id-format uuids 2>&1) || return 1
   printf '%s' "$wins" | jq -e 'type == "array" and all(.[]?; .id | type == "string")' >/dev/null 2>&1 || return 1
   window_ids=$(printf '%s' "$wins" | jq -r '.[].id' 2>/dev/null) || return 1
diff --git a/bin/backends/tmux.sh b/bin/backends/tmux.sh
index cdf297560c..68dd3668d6 100644
--- a/bin/backends/tmux.sh
+++ b/bin/backends/tmux.sh
@@ -78,6 +78,8 @@ fm_backend_tmux_task_marker() {
   printf 'fm-%s' "$token"
 }
 
+# FM_BACKEND_TMUX_SOCKET is consumed by fm_tmux_cli in the sourced tmux library.
+# shellcheck disable=SC2034
 fm_backend_tmux_use_socket() {
   case "$1" in
     /*) ;;
@@ -111,6 +113,8 @@ fm_backend_tmux_socket_path() {
 #     treehouse cd's into the worktree, which would break name-based targeting.
 # The returned window id lets callers target the window even if its name is ever
 # lost, so worktree discovery cannot fall back to the active client's window.
+# Creation-state globals are consumed by fm-spawn after direct function calls.
+# shellcheck disable=SC2034
 fm_backend_tmux_create_task() {  # <session> <window-name> <proj-abs> [task-marker] -> prints window id
   local ses=$1 wname=$2 proj_abs=$3 marker=${4:-} wid
   FM_BACKEND_CREATE_OCCURRED=0
@@ -157,7 +161,7 @@ fm_backend_tmux_send_literal() {  # <target> <text>
 # server-global window id. Inventory matching avoids display-message's dangerous
 # fallback to the active window when a named target has disappeared.
 fm_backend_tmux_canonical_window() {  # <target> [task-marker] -> @<window-id>
-  local target=$1 expected_marker=${2:-} out status pane_id window_id named named_pane indexed_window indexed_pane marker matched= named_seen=0
+  local target=$1 expected_marker=${2:-} out status pane_id window_id named named_pane indexed_window indexed_pane marker matched='' named_seen=0
   out=$(fm_tmux_cli list-panes -a -F '#{pane_id}|#{window_id}|#{session_name}:#{window_name}|#{session_name}:#{window_name}.#{pane_index}|#{session_name}:#{window_index}|#{session_name}:#{window_index}.#{pane_index}|#{@firstmate_task_marker}' 2>&1)
   status=$?
   if [ "$status" -ne 0 ]; then
diff --git a/bin/fm-backend.sh b/bin/fm-backend.sh
index e0475b318f..dd0a38015e 100644
--- a/bin/fm-backend.sh
+++ b/bin/fm-backend.sh
@@ -609,7 +609,7 @@ fm_backend_meta_for_window() {  # <target> <state-dir>
 # handles by their inventory-backed window id. Bare names remain on the legacy
 # resolver because they can be ambiguous across sessions.
 fm_backend_meta_for_target() {  # <target> <state-dir>
-  local target=$1 state=$2 meta canonical recorded recorded_canonical socket marker matched= status
+  local target=$1 state=$2 meta canonical recorded recorded_canonical socket marker matched='' status
   local FM_BACKEND_TMUX_SOCKET=
   if meta=$(fm_backend_meta_for_window "$target" "$state" 2>/dev/null); then
     printf '%s' "$meta"
@@ -1059,6 +1059,7 @@ fm_backend_stop_and_verify() {  # <backend> <target> [zellij-tab-id] [expected-l
 # Implement the recovery-grade state contract described above.
 fm_backend_agent_state() {  # <backend> <target> [tmux-marker] [tmux-socket-path]
   local backend=$1 target=$2 tmux_marker=${3:-} tmux_socket=${4:-}
+  # shellcheck disable=SC2034  # sourced tmux helpers consume this dynamic scope
   local FM_BACKEND_TMUX_SOCKET=
   fm_backend_source "$backend" || { printf 'unverified'; return 0; }
   case "$backend" in
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 38a282d756..1d21f70506 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -333,6 +333,7 @@ CMUX_WORKSPACE_ID=
 CMUX_SURFACE_ID=
 TMUX_WINDOW_MARKER=
 TMUX_SOCKET_PATH=
+# shellcheck disable=SC2034  # sourced tmux helpers consume this global
 FM_BACKEND_TMUX_SOCKET=
 
 parse_orca_worktree_result() {

From 1c3e97f150eddaeddaba01e2aa62c51c49b898d2 Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Wed, 29 Jul 2026 10:19:11 +0300
Subject: [PATCH 29/39] fix: reconcile host-root mode with endpoint hardening

---
 bin/backends/tmux.sh            | 13 ++++++----
 bin/fm-backend.sh               | 42 ++++++++++++++++++++++++++++-----
 bin/fm-brief.sh                 |  8 +++----
 tests/fm-backend-orca.test.sh   |  5 ++--
 tests/fm-host-root-mode.test.sh | 25 ++++++++++----------
 5 files changed, 64 insertions(+), 29 deletions(-)

diff --git a/bin/backends/tmux.sh b/bin/backends/tmux.sh
index 68dd3668d6..f2a2b36a71 100644
--- a/bin/backends/tmux.sh
+++ b/bin/backends/tmux.sh
@@ -233,18 +233,21 @@ fm_backend_tmux_target_state() {  # <target> [task-marker] -> present|absent|unk
 # Empty, omitted, and malformed targets return nonzero before invoking tmux so
 # tmux can never interpret an empty target as the caller's current window.
 fm_backend_tmux_kill() {  # <target>
-  local target=${1:-} session window
+  local target=${1:-} id session window
   case "$target" in
+    @*)
+      id=${target#@}
+      case "$id" in ''|*[!0-9]*) return 1 ;; esac
+      fm_tmux_cli kill-window -t "$target" 2>/dev/null || true
+      ;;
     *:*)
       session=${target%%:*}
       window=${target#*:}
+      case "$session:$window" in :*|*:|*:*:*) return 1 ;; esac
+      fm_tmux_cli kill-window -t "=$session:=$window" 2>/dev/null || true
       ;;
     *) return 1 ;;
   esac
-  case "$session:$window" in
-    :*|*:|*:*:*) return 1 ;;
-  esac
-  fm_tmux_cli kill-window -t "=$session:=$window" 2>/dev/null || true
 }
 
 # fm_backend_tmux_current_command: <target>'s live foreground process name -
diff --git a/bin/fm-backend.sh b/bin/fm-backend.sh
index dd0a38015e..4aa89fb2a1 100644
--- a/bin/fm-backend.sh
+++ b/bin/fm-backend.sh
@@ -385,7 +385,7 @@ fm_backend_endpoint_atom_valid() {  # <value>
 
 fm_backend_validate_task_endpoint() {  # <meta-file> <task-id>
   local meta=$1 id=$2 backend_count backend window worktree project binding_count binding
-  local session pane recorded_session workspace tab terminal worktree_id surface
+  local session pane recorded_session workspace tab terminal worktree_id surface host_count host_root marker socket selector
   FM_BACKEND_VALIDATED_BACKEND=
   FM_BACKEND_VALIDATED_TARGET=
   [ -f "$meta" ] && [ ! -L "$meta" ] || {
@@ -443,11 +443,41 @@ fm_backend_validate_task_endpoint() {  # <meta-file> <task-id>
 
   case "$backend" in
     tmux)
-      session=${window%%:*}
-      pane=${window#*:}
-      if [ "$pane" = "$window" ] || [ "$pane" != "fm-$id" ] \
-        || [ -z "$session" ]; then
-        echo "REFUSED: tmux endpoint '$window' is malformed or does not belong to task $id; preserving task state." >&2
+      host_count=$(grep -c '^host_root=' "$meta" 2>/dev/null || true)
+      if [ "$host_count" -eq 0 ]; then
+        session=${window%%:*}
+        pane=${window#*:}
+        if [ "$pane" = "$window" ] || [ "$pane" != "fm-$id" ] \
+          || [ -z "$session" ]; then
+          echo "REFUSED: tmux endpoint '$window' is malformed or does not belong to task $id; preserving task state." >&2
+          return 1
+        fi
+      elif [ "$host_count" -eq 1 ] && [ "$binding" = "$id" ]; then
+        host_root=$(fm_backend_meta_exact_value "$meta" host_root) || host_root=
+        marker=$(fm_backend_meta_exact_value "$meta" tmux_window_marker) || marker=
+        socket=$(fm_backend_meta_exact_value "$meta" tmux_socket_path) || socket=
+        case "$window" in
+          @*|%*) selector=${window#?}; case "$selector" in ''|*[!0-9]*) selector= ;; esac ;;
+          *:*)
+            session=${window%%:*}
+            pane=${window#*:}
+            selector=$window
+            [ "$pane" != "$window" ] && [ -n "$session" ] && [ -n "$pane" ] \
+              && [ "${pane#*:}" = "$pane" ] \
+              && fm_backend_endpoint_atom_valid "$session" \
+              && fm_backend_endpoint_atom_valid "$pane" || selector=
+            ;;
+          *) selector= ;;
+        esac
+        case "$socket" in /*) ;; *) socket= ;; esac
+        case "$socket$host_root" in *$'\n'*|*$'\r'*|*$'\t'*) socket= ;; esac
+        if [ -z "$host_root" ] || [ -z "$marker" ] || [ -z "$socket" ] || [ -z "$selector" ] \
+          || ! fm_backend_endpoint_atom_valid "$marker"; then
+          echo "REFUSED: host-root tmux endpoint metadata for task $id is malformed or inconsistent; preserving task state." >&2
+          return 1
+        fi
+      else
+        echo "REFUSED: host-root tmux endpoint metadata for task $id is missing or ambiguous; preserving task state." >&2
         return 1
       fi
       ;;
diff --git a/bin/fm-brief.sh b/bin/fm-brief.sh
index 30d0b625a7..1074f4a029 100755
--- a/bin/fm-brief.sh
+++ b/bin/fm-brief.sh
@@ -163,7 +163,7 @@ PROJECT_MEMORY_TARGET="."
 PROJECT_MEMORY_CONTEXT='in the worktree'
 if [ "$HOST_MODE" -eq 1 ]; then
   EXECUTION_MARKER='<!-- firstmate-execution-mode: host-root -->'
-  EXECUTION_SECTION=$(cat <<'EOF'
+  IFS= read -r -d '' EXECUTION_SECTION <<'EOF' || true
 # Host-root execution contract
 Your top-level process cwd is the physical host instruction root `__HOST_ROOT__`, not the target repository.
 The host root is authoritative for identity, startup, lifecycle, and cross-repository safety; keep it read-only except for effects produced by its own native lifecycle hooks.
@@ -174,7 +174,7 @@ Read the target worktree root instructions and every applicable nested instructi
 Use absolute paths, `git -C "$FM_TARGET_WORKTREE" ...`, or a scoped subshell for every target operation while keeping the top-level process cwd at the host root.
 Run tests, builds, GitHub tooling, and no-mistakes against `$FM_TARGET_WORKTREE` only; never run a bare target command from the host repository.
 EOF
-)
+  EXECUTION_SECTION=${EXECUTION_SECTION%$'\n'}
   EXECUTION_SECTION=${EXECUTION_SECTION//__HOST_ROOT__/$HOST_ROOT}
   CREW_INTRO="$CREW_INTRO"$'\n'"$EXECUTION_MARKER"$'\n'"$EXECUTION_SECTION"
   # shellcheck disable=SC2016  # These variables are literal Markdown instructions for the worker.
@@ -281,12 +281,12 @@ if [ "$HOST_MODE" -eq 1 ]; then
   # shellcheck disable=SC2016  # Literal Markdown, not shell expansion.
   ISOLATION_SECTION='**Verify isolation before anything else.** Follow the host-root execution contract above. If the host cwd or target worktree check fails, append `blocked: host-root or isolated target verification failed` and stop before branching or editing.'
 else
-  ISOLATION_SECTION=$(cat <<'EOF'
+  IFS= read -r -d '' ISOLATION_SECTION <<'EOF' || true
 **Verify isolation before anything else.** Run `pwd -P` and `git rev-parse --show-toplevel`; both must resolve to the disposable task worktree you were launched in, such as a treehouse pool path or an Orca-managed worktree, not the primary checkout firstmate operates from.
 The path check is authoritative: `git rev-parse --git-dir` and `git rev-parse --git-common-dir` can help inspect the repo, but they do not prove you are outside the primary checkout.
 If the top-level path is the primary checkout or not the worktree you were launched in, STOP - do not branch or commit here - append `blocked: launched in primary checkout, not an isolated worktree` to the status file and stop.
 EOF
-)
+  ISOLATION_SECTION=${ISOLATION_SECTION%$'\n'}
 fi
 
 if [ "$HERDR_LAB" -eq 1 ]; then
diff --git a/tests/fm-backend-orca.test.sh b/tests/fm-backend-orca.test.sh
index 361ace25b1..baf734781f 100755
--- a/tests/fm-backend-orca.test.sh
+++ b/tests/fm-backend-orca.test.sh
@@ -993,7 +993,8 @@ test_teardown_preserves_metadata_when_orca_remove_error_json() {
     "backend=orca" "orca_worktree_id=wt-remove-error" \
     "decisions_reviewed=1" "decision_keys="
   orca_case remove-error-teardown
-  printf '{"ok":false,"error":{"code":"worktree_not_removed","message":"worktree not removed"}}\n' > "$RESP/1.out"
+  printf '{"ok":true,"result":{}}\n' > "$RESP/1.out"
+  printf '{"ok":false,"error":{"code":"worktree_not_removed","message":"worktree not removed"}}\n' > "$RESP/2.out"
   neutral=$(neutral_fm_root "$CASE_DIR/neutral")
   set +e
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
@@ -1116,7 +1117,7 @@ test_host_ship_teardown_rechecks_safety_after_terminal_stop() {
   : > "$host/AGENTS.md"
   touch "$state/.last-watcher-beat"
   fm_write_meta "$state/$id.meta" \
-    "window=fm-$id" "terminal=term-ship-race" "worktree=$wt" "project=$proj" \
+    "window=fm-$id" "endpoint_task_id=$id" "terminal=term-ship-race" "worktree=$wt" "project=$proj" \
     "harness=claude" "kind=ship" "mode=no-mistakes" "yolo=off" \
     "backend=orca" "orca_worktree_id=wt-ship-race" "host_root=$host"
   orca_case ship-race
diff --git a/tests/fm-host-root-mode.test.sh b/tests/fm-host-root-mode.test.sh
index f8f443dd13..e43230b594 100644
--- a/tests/fm-host-root-mode.test.sh
+++ b/tests/fm-host-root-mode.test.sh
@@ -973,8 +973,8 @@ SH
   for action in hold complete resolve; do
     action_id="decision-post-teardown-$action"
     mkdir -p "$home/data/$action_id"
-    printf 'window=test-session:fm-%s\nworktree=/tmp/decision-target\nhost_root=%s\nproject=/tmp/project\nkind=ship\nmode=local-only\ntmux_window_marker=decision-marker\ntmux_socket_path=/tmp/fm-test.sock\n' \
-      "$action_id" "$host" > "$home/state/$action_id.meta"
+printf 'window=test-session:fm-%s\nendpoint_task_id=%s\nworktree=/tmp/decision-target\nhost_root=%s\nproject=/tmp/project\nkind=ship\nmode=local-only\ntmux_window_marker=decision-marker\ntmux_socket_path=/tmp/fm-test.sock\n' \
+"$action_id" "$action_id" "$host" > "$home/state/$action_id.meta"
     printf '%s\n' "$host" > "$current"
     : > "$current.endpoint"
     printf 'decision-marker' > "$current.endpoint.marker"
@@ -1016,8 +1016,8 @@ test_host_teardown_requires_confirmed_stop() {
   local host="$TMP/teardown-host" home="$TMP/teardown-home" project="$TMP/teardown-project" wt="$TMP/teardown-wt" fb log current tree_log out status=0 kill_line verify_line return_line
   make_host "$host"; mkdir -p "$home/data/host-teardown" "$home/state" "$home/config"; fm_git_init_commit "$project"
   git -C "$project" worktree add -q --detach "$wt"
-  printf 'window=test-session:fm-host-teardown\nworktree=%s\nhost_root=%s\nproject=%s\nkind=ship\nmode=local-only\ntmux_window_marker=teardown-marker\ntmux_socket_path=/tmp/fm-test.sock\n' \
-    "$wt" "$host" "$project" > "$home/state/host-teardown.meta"
+printf 'window=test-session:fm-host-teardown\nendpoint_task_id=host-teardown\nworktree=%s\nhost_root=%s\nproject=%s\nkind=ship\nmode=local-only\ntmux_window_marker=teardown-marker\ntmux_socket_path=/tmp/fm-test.sock\n' \
+"$wt" "$host" "$project" > "$home/state/host-teardown.meta"
   fb=$(make_fakebin "$TMP/fake-host-teardown")
   log="$TMP/host-teardown.log"; current="$TMP/host-teardown.current"; tree_log="$TMP/host-teardown-treehouse.log"
   printf '%s\n' "$host" > "$current"; : > "$current.endpoint"; printf 'teardown-marker' > "$current.endpoint.marker"; : > "$log"; : > "$tree_log"
@@ -1068,8 +1068,8 @@ test_host_teardown_refuses_recorded_overlap_before_mutation() {
   make_host "$host"
   fm_git_init_commit "$project"
   mkdir -p "$home/state" "$home/config"
-  printf 'window=test-session:fm-overlap-teardown\nworktree=%s\nhost_root=%s\nproject=%s\nkind=ship\nmode=local-only\n' \
-    "$host" "$host" "$project" > "$home/state/overlap-teardown.meta"
+printf 'window=test-session:fm-overlap-teardown\nendpoint_task_id=overlap-teardown\nworktree=%s\nhost_root=%s\nproject=%s\nkind=ship\nmode=local-only\ntmux_window_marker=overlap-marker\ntmux_socket_path=/tmp/fm-test.sock\n' \
+"$host" "$host" "$project" > "$home/state/overlap-teardown.meta"
   cp "$home/state/overlap-teardown.meta" "$TMP/overlap-teardown.meta"
   touch "$home/state/.last-watcher-beat"
   fb=$(make_fakebin "$TMP/fake-overlap-teardown")
@@ -1119,9 +1119,9 @@ test_secondmate_force_teardown_preserves_host_children_during_recursive_cleanup(
       target=child-session:w1:p2
       endpoint_named=$target
     fi
-    fm_write_meta "$subhome/state/child.meta" \
-      "window=$target" "worktree=$childwt" "project=$childproj" \
-      "backend=$backend" "host_root=$host" 'harness=echo' 'kind=ship' 'mode=no-mistakes'
+fm_write_meta "$subhome/state/child.meta" \
+"window=$target" 'endpoint_task_id=child' "worktree=$childwt" "project=$childproj" \
+"backend=$backend" "host_root=$host" 'harness=echo' 'kind=ship' 'mode=no-mistakes'
     if [ "$backend" = tmux ]; then
       printf 'tmux_window_marker=child-marker\ntmux_socket_path=/tmp/fm-test.sock\n' >> "$subhome/state/child.meta"
     fi
@@ -1194,9 +1194,10 @@ test_secondmate_force_teardown_refuses_recursive_host_overlap_before_mutation()
   fm_write_meta "$home/state/domain.meta" \
     'window=test-session:fm-domain' "worktree=$subhome" "project=$subhome" \
     'harness=echo' 'kind=secondmate' 'mode=secondmate' "home=$subhome" 'projects=alpha'
-  fm_write_meta "$subhome/state/child.meta" \
-    'window=@1' "worktree=$host" "project=$childproj" \
-    "host_root=$host" 'harness=echo' 'kind=ship' 'mode=no-mistakes'
+fm_write_meta "$subhome/state/child.meta" \
+'window=@1' 'endpoint_task_id=child' "worktree=$host" "project=$childproj" \
+"host_root=$host" 'tmux_window_marker=child-marker' 'tmux_socket_path=/tmp/fm-test.sock' \
+'harness=echo' 'kind=ship' 'mode=no-mistakes'
   fb=$(make_fakebin "$case_root/fake")
   log="$case_root/backend.log"
   current="$case_root/current"

From 5d204dc41f12b7eb7dd05631c602fb76e9ccce4b Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Wed, 29 Jul 2026 11:55:18 +0300
Subject: [PATCH 30/39] feat: activate FirstMate from an external Pi host

---
 .pi/extensions/lib/fm-host-activator.ts | 144 +++++++++++++++++
 README.md                               |   3 +-
 bin/fm-host-setup.sh                    | 198 ++++++++++++++++++++++++
 bin/fm-test-run.sh                      |  14 +-
 docs/configuration.md                   |  10 +-
 docs/verification/supervision.md        |  30 ++++
 tests/fm-backend-cmux.test.sh           |   3 +-
 tests/fm-calm-pi-extension.test.sh      |  20 ++-
 tests/fm-host-setup.test.sh             | 150 ++++++++++++++++++
 tests/fm-pi-primary-types.test.sh       |  31 ++--
 tests/fm-secondmate-harness.test.sh     |   4 +-
 11 files changed, 574 insertions(+), 33 deletions(-)
 create mode 100644 .pi/extensions/lib/fm-host-activator.ts
 create mode 100755 bin/fm-host-setup.sh
 create mode 100755 tests/fm-host-setup.test.sh

diff --git a/.pi/extensions/lib/fm-host-activator.ts b/.pi/extensions/lib/fm-host-activator.ts
new file mode 100644
index 0000000000..5592b92fed
--- /dev/null
+++ b/.pi/extensions/lib/fm-host-activator.ts
@@ -0,0 +1,144 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+
+export type FirstmateHostConfig = {
+	fmRoot: string;
+	fmHome: string;
+	hostRoot: string;
+	backend: string;
+};
+
+type ExtensionFactory = (pi: ExtensionAPI) => void | Promise<void>;
+
+const policyMarker = "<!-- firstmate-host-supervisor-policy -->";
+
+function physicalPath(path: string): string | undefined {
+	try {
+		return realpathSync(path);
+	} catch {
+		return undefined;
+	}
+}
+
+function refuse(pi: ExtensionAPI, reason: string): void {
+	const message = `FirstMate host activation refused: ${reason}`;
+	console.error(message);
+	pi.on("session_start", (_event, ctx) => {
+		ctx.ui.setStatus(
+			"firstmate-host",
+			ctx.ui.theme.fg("error", "FirstMate inactive"),
+		);
+		ctx.ui.notify(message, "error");
+	});
+}
+
+function validateConfig(config: FirstmateHostConfig): string | undefined {
+	if (physicalPath(config.fmRoot) !== config.fmRoot)
+		return `invalid FirstMate root ${config.fmRoot}`;
+	if (physicalPath(config.fmHome) !== config.fmHome)
+		return `invalid FirstMate home ${config.fmHome}`;
+	if (physicalPath(config.hostRoot) !== config.hostRoot)
+		return `invalid host root ${config.hostRoot}`;
+	if (config.fmRoot === config.hostRoot)
+		return "FirstMate root and host root must differ";
+	if (!existsSync(resolve(config.hostRoot, "AGENTS.md")))
+		return `host root has no AGENTS.md: ${config.hostRoot}`;
+	if (!existsSync(resolve(config.fmRoot, "AGENTS.md")))
+		return `FirstMate root has no AGENTS.md: ${config.fmRoot}`;
+
+	const result = spawnSync(
+		"bash",
+		[
+			"-c",
+			'. "$1/bin/fm-backend.sh" && fm_backend_validate_spawn "$2"',
+			"fm-host-activator",
+			config.fmRoot,
+			config.backend,
+		],
+		{
+			encoding: "utf8",
+			env: {
+				...process.env,
+				FM_ROOT_OVERRIDE: config.fmRoot,
+				FM_HOME: config.fmHome,
+				FM_HOST_ROOT: config.hostRoot,
+				FM_BACKEND: config.backend,
+			},
+		},
+	);
+	if (result.status !== 0)
+		return result.stderr.trim() || `invalid backend ${config.backend}`;
+	return undefined;
+}
+
+async function loadExtension(pi: ExtensionAPI, path: string): Promise<void> {
+	const module = (await import(pathToFileURL(path).href)) as {
+		default?: ExtensionFactory;
+	};
+	if (typeof module.default !== "function")
+		throw new Error(`extension has no default factory: ${path}`);
+	await module.default(pi);
+}
+
+export default async function activateFirstmateHost(
+	pi: ExtensionAPI,
+	config: FirstmateHostConfig,
+): Promise<void> {
+	if (physicalPath(process.cwd()) !== config.hostRoot) return;
+
+	const invalid = validateConfig(config);
+	if (invalid) {
+		refuse(pi, invalid);
+		return;
+	}
+
+	const expectedEnvironment: Record<string, string> = {
+		FM_ROOT_OVERRIDE: config.fmRoot,
+		FM_HOME: config.fmHome,
+		FM_HOST_ROOT: config.hostRoot,
+		FM_BACKEND: config.backend,
+	};
+	for (const [name, expected] of Object.entries(expectedEnvironment)) {
+		const ambient = process.env[name];
+		if (ambient !== undefined && ambient !== "" && ambient !== expected) {
+			refuse(pi, `${name} is already set to a conflicting value`);
+			return;
+		}
+	}
+	Object.assign(process.env, expectedEnvironment);
+
+	const supervisorPolicy = readFileSync(
+		resolve(config.fmRoot, "AGENTS.md"),
+		"utf8",
+	).trimEnd();
+	pi.on("resources_discover", () => ({
+		skillPaths: [resolve(config.fmRoot, ".agents/skills")],
+	}));
+	pi.on("before_agent_start", (event) => {
+		if (event.systemPrompt.includes(policyMarker)) return;
+		return {
+			systemPrompt: `${event.systemPrompt}\n\n${policyMarker}\n# FirstMate host supervisor policy\n\nThe host context above remains authoritative for host identity, lifecycle, and cwd.\nApply the following FirstMate supervisor policy additively.\n\n${supervisorPolicy}`,
+		};
+	});
+	pi.on("session_start", (_event, ctx) => {
+		ctx.ui.setStatus(
+			"firstmate-host",
+			ctx.ui.theme.fg("accent", "FirstMate active"),
+		);
+	});
+	pi.on("session_shutdown", (_event, ctx) => {
+		ctx.ui.setStatus("firstmate-host", undefined);
+	});
+
+	await loadExtension(
+		pi,
+		resolve(config.fmRoot, ".pi/extensions/fm-primary-turnend-guard.ts"),
+	);
+	await loadExtension(
+		pi,
+		resolve(config.fmRoot, ".pi/extensions/fm-primary-pi-watch.ts"),
+	);
+}
diff --git a/README.md b/README.md
index cf2fcff819..3f00dd8b83 100644
--- a/README.md
+++ b/README.md
@@ -84,7 +84,8 @@ cd firstmate
 ```
 
 Then launch one of the co-primary harnesses; AGENTS.md takes over from there.
-For the low-level opt-in contract used by an explicit host integration, see [Host-root mode](docs/configuration.md#host-root-mode-fm_host_root).
+To make plain Pi activate FirstMate from one existing external host root, run `bin/fm-host-setup.sh install <host-root> --backend herdr` once, then run `pi` from that host.
+The [host-root configuration](docs/configuration.md#host-root-mode-fm_host_root) covers status, uninstall, custom homes, trust, and the four-root contract.
 
 **Claude Code**
 
diff --git a/bin/fm-host-setup.sh b/bin/fm-host-setup.sh
new file mode 100755
index 0000000000..6f7dd35bad
--- /dev/null
+++ b/bin/fm-host-setup.sh
@@ -0,0 +1,198 @@
+#!/usr/bin/env bash
+# Install, inspect, or remove the single global Pi activator for one physical
+# FirstMate host root.
+# Usage: fm-host-setup.sh install <host-root> [--home <firstmate-home>] [--backend <name>]
+#        fm-host-setup.sh status
+#        fm-host-setup.sh uninstall
+#
+# The activator is installed under ${PI_CODING_AGENT_DIR:-~/.pi/agent} and is
+# dormant unless Pi's physical cwd equals the configured host root.
+# Install updates only a file carrying this script's ownership marker, refuses
+# conflicting ambient FM_ROOT_OVERRIDE/FM_HOME/FM_HOST_ROOT/FM_BACKEND values,
+# and writes nothing into the host repository.
+# Uninstall removes only that owned activator file.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+FM_ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+SOURCE="$FM_ROOT/.pi/extensions/lib/fm-host-activator.ts"
+OWNER='// firstmate-host-activator managed-v1'
+
+usage() {
+	awk '
+    NR == 1 { next }
+    /^#/ { sub(/^# ?/, ""); print; next }
+    { exit }
+  ' "$0"
+}
+
+fail() {
+	printf 'error: %s\n' "$*" >&2
+	exit 1
+}
+
+agent_dir() {
+	local dir=${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}
+	case "$dir" in
+	'~') dir=$HOME ;;
+	\~/*) dir="$HOME/${dir#\~/}" ;;
+	esac
+	case "$dir" in
+	/*) printf '%s\n' "$dir" ;;
+	*) fail "PI_CODING_AGENT_DIR must be absolute (or start with ~/): $dir" ;;
+	esac
+}
+
+owned_file() {
+	local file=$1 first=
+	[ -f "$file" ] && [ ! -L "$file" ] || return 1
+	IFS= read -r first <"$file" || return 1
+	[ "$first" = "$OWNER" ]
+}
+
+physical_dir() {
+	local label=$1 path=$2 resolved
+	[ -d "$path" ] || fail "$label is not an existing directory: $path"
+	resolved=$(cd "$path" 2>/dev/null && pwd -P) || fail "$label cannot be resolved: $path"
+	case "$resolved" in
+	*[$'\001'-$'\037'$'\177']*) fail "$label contains a control character" ;;
+	esac
+	printf '%s\n' "$resolved"
+}
+
+check_ambient() {
+	local name=$1 expected=$2 actual=${!1-}
+	[ -z "$actual" ] || [ "$actual" = "$expected" ] ||
+		fail "$name is already set to a conflicting value"
+}
+
+render_activator() {
+	local output=$1 root=$2 home=$3 host=$4 backend=$5 source_json config_json
+	source_json=$(node -e 'process.stdout.write(JSON.stringify(process.argv[1]))' "$SOURCE")
+	config_json=$(node -e '
+    const [fmRoot, fmHome, hostRoot, backend] = process.argv.slice(1);
+    process.stdout.write(JSON.stringify({ fmRoot, fmHome, hostRoot, backend }));
+  ' "$root" "$home" "$host" "$backend")
+	{
+		printf '%s\n' "$OWNER"
+		printf '// firstmate-host-config: %s\n' "$config_json"
+		printf 'import activateFirstmateHost from %s;\n' "$source_json"
+		printf 'const config = %s;\n' "$config_json"
+		printf 'export default function (pi: Parameters<typeof activateFirstmateHost>[0]) { return activateFirstmateHost(pi, config); }\n'
+	} >"$output"
+}
+
+show_status() {
+	local target=$1 config_json
+	if [ ! -e "$target" ] && [ ! -L "$target" ]; then
+		printf 'FirstMate Pi host activator: not installed\n'
+		return 0
+	fi
+	owned_file "$target" || fail "refusing unmanaged Pi extension: $target"
+	config_json=$(sed -n 's#^// firstmate-host-config: ##p' "$target" | head -1)
+	[ -n "$config_json" ] || fail "managed Pi extension has no readable configuration: $target"
+	node -e '
+    const c = JSON.parse(process.argv[1]);
+    console.log("FirstMate Pi host activator: installed");
+    console.log("host: " + c.hostRoot);
+    console.log("firstmate root: " + c.fmRoot);
+    console.log("firstmate home: " + c.fmHome);
+    console.log("worker backend: " + c.backend);
+  ' "$config_json"
+}
+
+ACTION=${1:-}
+case "$ACTION" in
+-h | --help)
+	usage
+	exit 0
+	;;
+status | uninstall)
+	[ "$#" -eq 1 ] || fail "$ACTION takes no arguments"
+	;;
+install)
+	shift
+	;;
+*)
+	usage >&2
+	exit 2
+	;;
+esac
+
+PI_DIR=$(agent_dir)
+TARGET="$PI_DIR/extensions/fm-firstmate-host.ts"
+
+case "$ACTION" in
+status)
+	show_status "$TARGET"
+	;;
+uninstall)
+	if [ ! -e "$TARGET" ] && [ ! -L "$TARGET" ]; then
+		printf 'FirstMate Pi host activator: not installed\n'
+		exit 0
+	fi
+	owned_file "$TARGET" || fail "refusing to remove unmanaged Pi extension: $TARGET"
+	rm -- "$TARGET"
+	printf 'removed %s\n' "$TARGET"
+	;;
+install)
+	command -v node >/dev/null 2>&1 || fail "node is required"
+	[ -f "$SOURCE" ] || fail "activator template is missing: $SOURCE"
+	HOST_ARG=${1:-}
+	[ -n "$HOST_ARG" ] || fail "install requires <host-root>"
+	shift
+	HOME_ARG=$FM_ROOT
+	BACKEND=herdr
+	while [ "$#" -gt 0 ]; do
+		case "$1" in
+		--home)
+			[ "$#" -ge 2 ] || fail "--home requires a value"
+			HOME_ARG=$2
+			shift 2
+			;;
+		--backend)
+			[ "$#" -ge 2 ] || fail "--backend requires a value"
+			BACKEND=$2
+			shift 2
+			;;
+		*) fail "unknown install argument: $1" ;;
+		esac
+	done
+
+	ROOT_REAL=$(physical_dir "FirstMate root" "$FM_ROOT")
+	HOME_REAL=$(physical_dir "FirstMate home" "$HOME_ARG")
+	HOST_REAL=$(physical_dir "host root" "$HOST_ARG")
+	[ "$ROOT_REAL" != "$HOST_REAL" ] || fail "host root must differ from FirstMate root"
+	[ -f "$HOST_REAL/AGENTS.md" ] || fail "host root has no AGENTS.md: $HOST_REAL"
+	(
+		export FM_ROOT_OVERRIDE=$ROOT_REAL FM_HOME=$HOME_REAL
+		# shellcheck source=bin/fm-backend.sh
+		. "$SCRIPT_DIR/fm-backend.sh"
+		fm_backend_validate_spawn "$BACKEND"
+	) || exit $?
+
+	check_ambient FM_ROOT_OVERRIDE "$ROOT_REAL"
+	check_ambient FM_HOME "$HOME_REAL"
+	check_ambient FM_HOST_ROOT "$HOST_REAL"
+	check_ambient FM_BACKEND "$BACKEND"
+
+	if [ -e "$TARGET" ] || [ -L "$TARGET" ]; then
+		owned_file "$TARGET" || fail "refusing to overwrite unmanaged Pi extension: $TARGET"
+	fi
+	mkdir -p "$PI_DIR/extensions"
+	TMP=$(mktemp "$PI_DIR/extensions/.fm-firstmate-host.XXXXXX") || fail "could not create temporary activator"
+	trap 'rm -f "${TMP:-}"' EXIT
+	render_activator "$TMP" "$ROOT_REAL" "$HOME_REAL" "$HOST_REAL" "$BACKEND"
+	chmod 0644 "$TMP"
+	if [ -f "$TARGET" ] && cmp -s "$TMP" "$TARGET"; then
+		rm -f "$TMP"
+		trap - EXIT
+		printf 'unchanged %s\n' "$TARGET"
+	else
+		mv -f -- "$TMP" "$TARGET"
+		trap - EXIT
+		printf 'installed %s\n' "$TARGET"
+	fi
+	show_status "$TARGET"
+	;;
+esac
diff --git a/bin/fm-test-run.sh b/bin/fm-test-run.sh
index 314232ae88..454157e4e2 100755
--- a/bin/fm-test-run.sh
+++ b/bin/fm-test-run.sh
@@ -122,7 +122,7 @@ family_for_basename() {
     fm-composer-ghost.test.sh|fm-composer-lib.test.sh|\
     fm-crew-state.test.sh|fm-decision-hold-lifecycle.test.sh|\
     fm-documentation-audiences.test.sh|fm-ensure-agents-md.test.sh|fm-grok-harness.test.sh|\
-    fm-kimi-harness.test.sh|fm-herdr-lab.test.sh|fm-lint.test.sh|\
+    fm-kimi-harness.test.sh|fm-herdr-lab.test.sh|fm-host-setup.test.sh|fm-lint.test.sh|\
     fm-operational-input.test.sh|fm-pi-primary-types.test.sh|\
     fm-send-popup-settle.test.sh|fm-send-settle.test.sh|\
     fm-subagent-pretool-check.test.sh|\
@@ -378,8 +378,8 @@ run_coverage_guard() {
     return 1
   fi
   cat "$tmp/s1" "$tmp/s2" | LC_ALL=C sort -u >"$tmp/shards_union"
-  missing=$(comm -23 "$tmp/proven" "$tmp/shards_union" || true)
-  extra=$(comm -13 "$tmp/proven" "$tmp/shards_union" || true)
+  missing=$(LC_ALL=C comm -23 "$tmp/proven" "$tmp/shards_union" || true)
+  extra=$(LC_ALL=C comm -13 "$tmp/proven" "$tmp/shards_union" || true)
   if [ -n "$missing" ] || [ -n "$extra" ]; then
     log "coverage guard: portable shards must equal the proven-isolated set"
     [ -z "$missing" ] || { log "missing from shards:"; printf '%s\n' "$missing" >&2; }
@@ -401,7 +401,7 @@ run_coverage_guard() {
   for pair in "shards_union:serial" "shards_union:herdr" "serial:herdr"; do
     a=${pair%%:*}
     b=${pair#*:}
-    comm -12 "$tmp/$a" "$tmp/$b" >"$tmp/overlap"
+    LC_ALL=C comm -12 "$tmp/$a" "$tmp/$b" >"$tmp/overlap"
     if [ -s "$tmp/overlap" ]; then
       log "coverage guard: overlap between $a and $b:"
       cat "$tmp/overlap" >&2
@@ -419,8 +419,8 @@ run_coverage_guard() {
     return 1
   fi
   LC_ALL=C sort -u "$tmp/union_raw" >"$tmp/union"
-  missing=$(comm -23 "$tmp/all" "$tmp/union" || true)
-  extra=$(comm -13 "$tmp/all" "$tmp/union" || true)
+  missing=$(LC_ALL=C comm -23 "$tmp/all" "$tmp/union" || true)
+  extra=$(LC_ALL=C comm -13 "$tmp/all" "$tmp/union" || true)
   if [ -n "$missing" ] || [ -n "$extra" ]; then
     log "coverage guard: union of portable shards + portable serial + Herdr must equal tests/*.test.sh"
     [ -z "$missing" ] || { log "missing from union:"; printf '%s\n' "$missing" >&2; }
@@ -433,7 +433,7 @@ run_coverage_guard() {
     "$ROOT/bin/fm-test-isolation-proof.sh" --list | LC_ALL=C sort -u >"$tmp/proof_list"
     if ! cmp -s "$tmp/proven" "$tmp/proof_list"; then
       log "coverage guard: embedded proven-isolated set diverges from bin/fm-test-isolation-proof.sh --list"
-      comm -3 "$tmp/proven" "$tmp/proof_list" >&2 || true
+      LC_ALL=C comm -3 "$tmp/proven" "$tmp/proof_list" >&2 || true
       rm -rf "$tmp"
       return 1
     fi
diff --git a/docs/configuration.md b/docs/configuration.md
index eea5fc7718..a0d9c01d71 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -183,9 +183,15 @@ The full cmux home label also includes a short hash of the resolved `FM_ROOT` pa
 ## Host-root mode (FM_HOST_ROOT)
 
 `FM_HOST_ROOT` is an optional physical instruction root and harness startup cwd for a primary FirstMate home.
-It is a low-level runtime contract for an explicit host integration, not an installer: setting the variable alone does not load FirstMate's supervisor policy or adapters into another repository.
 Unset or empty preserves the normal behavior in which FirstMate runs from its tracked code root.
-When set, the caller must already have loaded the FirstMate policy and required harness adapters additively, the value must resolve to an existing directory containing the cross-harness `AGENTS.md` instruction surface, it must differ from `FM_ROOT`, and the supervisor must be launched with its physical cwd at that directory.
+For Pi, run `bin/fm-host-setup.sh install <host-root> --backend herdr` once, then run plain `pi` from that exact physical host root.
+Use `--home <firstmate-home>` when operational state belongs outside this tracked FirstMate root, and use the script's `status` and `uninstall` actions to inspect or remove the managed activation.
+The setup writes only one owned global Pi extension under `${PI_CODING_AGENT_DIR:-~/.pi/agent}`, never edits the host, and refuses unmanaged target files or conflicting ambient FirstMate root, home, host, or backend variables.
+At the configured host, the global extension sets the four root/backend variables, loads FirstMate's existing Pi guard and watcher extensions, exposes FirstMate's internal skills, appends the supervisor policy after the host context, and displays `FirstMate active` in Pi's status line.
+Outside that exact physical host it contributes no environment, policy, skills, tools, or lifecycle behavior.
+The host's normal Pi project trust decision still controls its project-local instructions, skills, and extensions.
+Other harness integrations must provide the same additive policy and adapter loading before setting `FM_HOST_ROOT`; setting the variable alone is still only the low-level runtime contract.
+When set, the value must resolve to an existing directory containing the cross-harness `AGENTS.md` instruction surface, it must differ from `FM_ROOT`, and the supervisor must run with its physical cwd at that directory.
 `bin/fm-session-start.sh` validates that contract before lock acquisition or any bootstrap mutation.
 
 Host mode separates four roots:
diff --git a/docs/verification/supervision.md b/docs/verification/supervision.md
index fcab4f1ca5..f11620a8da 100644
--- a/docs/verification/supervision.md
+++ b/docs/verification/supervision.md
@@ -87,6 +87,36 @@ A rebased Codex 0.145.0 scout repeated the integrated path on 2026-07-26 through
 It loaded the host and target instruction surfaces, preserved the separate target worktree, completed the decision inventory, emitted its task completion, retained the report, and cleaned up while the host's native startup lifecycle remained active.
 [`runtime-backends.md`](runtime-backends.md#host-root-task-routing) owns the exact spawn command and path-routing evidence.
 
+Pi 0.82.1 verified the one-host global activator on 2026-07-28.
+The focused real-runtime entry point was:
+
+```sh
+pi --version
+bin/fm-test-run.sh tests/fm-host-setup.test.sh
+```
+
+Observed output:
+
+```text
+0.82.1
+ok - install is host-read-only, PI_CODING_AGENT_DIR-aware, and idempotent
+ok - install refuses ambient FM conflicts and unmanaged files
+ok - real Pi preserves host resources, loads FirstMate resources, and stays dormant elsewhere
+ok - uninstall removes only its owned file
+```
+
+A credentialed print-mode probe installed into the regular Pi home, ran this command from the temporary host, and uninstalled immediately afterward:
+
+```sh
+pi -p --approve --no-session --model openai-codex/gpt-5.6-sol --thinking low \
+  'Reply exactly HOST_ACTIVATION_OK.'
+```
+
+The later-loaded probe observed the original host `AGENTS.md` sentinel followed by the FirstMate supervisor-policy marker and FirstMate `AGENTS.md`, while both tracked guard/watch load markers were present.
+The model returned `HOST_ACTIVATION_OK`.
+A separate isolated tmux run invoked plain `pi` with no Pi flags from the configured host and observed `FirstMate active` plus both guard/watch load markers.
+`PI_CODING_AGENT_DIR` pointed that smoke at a temporary Pi home, and the installed activator remained dormant in a second cwd.
+
 ## Turn-end guard
 
 The direct and passive mechanisms were validated across all five harnesses on 2026-07-08 through 2026-07-12, with Claude's replacement Stop-owned path revalidated on 2026-07-24.
diff --git a/tests/fm-backend-cmux.test.sh b/tests/fm-backend-cmux.test.sh
index be1fc3c3c8..2fbd0a15c2 100755
--- a/tests/fm-backend-cmux.test.sh
+++ b/tests/fm-backend-cmux.test.sh
@@ -1035,7 +1035,7 @@ test_forced_secondmate_teardown_uses_child_cmux_config() {
   printf 'parent-secret\n' > "$config/cmux-socket-password"
   printf 'child-secret\n' > "$home/config/cmux-socket-password"
   fm_write_meta "$state/smc.meta" \
-    "window=firstmate:99" \
+    "window=firstmate:fm-smc" \
     "worktree=$home" \
     "project=$home" \
     "kind=secondmate" \
@@ -1044,6 +1044,7 @@ test_forced_secondmate_teardown_uses_child_cmux_config() {
   fm_write_meta "$home/state/childc.meta" \
     "window=ws-child:sf-child" \
     "backend=cmux" \
+    "endpoint_task_id=childc" \
     "cmux_workspace_id=ws-child" \
     "cmux_surface_id=sf-child" \
     "worktree=$dir/missing-child-worktree" \
diff --git a/tests/fm-calm-pi-extension.test.sh b/tests/fm-calm-pi-extension.test.sh
index a8e09be145..55e109dbd4 100755
--- a/tests/fm-calm-pi-extension.test.sh
+++ b/tests/fm-calm-pi-extension.test.sh
@@ -999,7 +999,7 @@ JS
 }
 
 test_operational_followup_turn_e2e() {
-  local project home config sessions version label case_name calm_state expected_notifications session_file pane i captain_line handled_line geometry_gap exact_session
+  local project home config sessions version label case_name calm_state expected_notifications session_file pane pane_file i captain_line handled_line geometry_gap exact_session
   if ! command -v pi >/dev/null 2>&1 || ! command -v tmux >/dev/null 2>&1; then
     echo "skip: pi or tmux not found for Pi operational follow-up E2E"
     return 0
@@ -1170,7 +1170,7 @@ TS
       session_arg="--session '$session_arg'"
     fi
 
-    tmux -L "$TMUX_SOCKET" new-session -d -s "$TMUX_SESSION" -x 160 -y 36 \
+    SHELL=/bin/bash tmux -L "$TMUX_SOCKET" new-session -d -s "$TMUX_SESSION" -x 160 -y 36 \
       "cd '$project' && env FM_HOME='$home' PI_CODING_AGENT_DIR='$config' FM_OPERATIONAL_INPUT_SCRIPT='$OPERATIONAL_INPUT' PI_OFFLINE=1 pi --approve --no-context-files --no-skills --no-prompt-templates --no-extensions $extensions $session_arg; rc=\$?; printf '\nPI_EXIT=%s\n' \"\$rc\"; sleep 20"
     i=0
     while [ "$i" -lt 120 ]; do
@@ -1197,7 +1197,10 @@ TS
       fail "Pi follow-up $label case did not process the monitoring notification"
     fi
 
-    pane=$(tmux -L "$TMUX_SOCKET" capture-pane -p -t "$TMUX_SESSION" -S - 2>/dev/null || true)
+    pane_file="$TMP_ROOT/followup-$label.txt"
+    wait_for_text "$pane_file" "MONITOR_HANDLED_${label}_ONE" \
+      || fail "Pi follow-up $label case persisted but did not render the monitoring result"
+    pane=$(cat "$pane_file")
     [ "$(printf '%s\n' "$pane" | grep -Fc "CAPTAIN_ANSWER_$label" || true)" -eq 1 ] \
       || fail "Pi follow-up $label case rendered a duplicate captain answer"
     assert_contains "$pane" "CAPTAIN_PROMPT_$label" "Pi follow-up $label case hid the genuine captain prompt"
@@ -1298,7 +1301,7 @@ JS
   replay_exact_case() {
     tmux -L "$TMUX_SOCKET" kill-session -t "$TMUX_SESSION" 2>/dev/null || true
     printf '%s\n' on >"$home/config/calm"
-    tmux -L "$TMUX_SOCKET" new-session -d -s "$TMUX_SESSION" -x 160 -y 36 \
+    SHELL=/bin/bash tmux -L "$TMUX_SOCKET" new-session -d -s "$TMUX_SESSION" -x 160 -y 36 \
       "cd '$project' && env FM_HOME='$home' PI_CODING_AGENT_DIR='$config' FM_OPERATIONAL_INPUT_SCRIPT='$OPERATIONAL_INPUT' PI_OFFLINE=1 pi --approve --no-context-files --no-skills --no-prompt-templates --no-extensions -e ./.pi/extensions/fm-calm.ts -e ./followup-e2e.ts --session '$exact_session'; rc=\$?; printf '\nPI_EXIT=%s\n' \"\$rc\"; sleep 20"
     i=0
     while [ "$i" -lt 120 ]; do
@@ -1455,7 +1458,7 @@ TS
   start_geometry_pi() {
     local session_arg=$1
     tmux -L "$TMUX_SOCKET" kill-session -t "$TMUX_SESSION" 2>/dev/null || true
-    tmux -L "$TMUX_SOCKET" new-session -d -s "$TMUX_SESSION" -x 100 -y 44 \
+    SHELL=/bin/bash tmux -L "$TMUX_SOCKET" new-session -d -s "$TMUX_SESSION" -x 100 -y 44 \
       "cd '$project' && env FM_HOME='$home' PI_CODING_AGENT_DIR='$config' PI_OFFLINE=1 pi --approve --no-context-files --no-prompt-templates --no-extensions -e ./.pi/extensions/fm-calm.ts -e ./geometry-provider.ts $session_arg; rc=\$?; printf '\nPI_EXIT=%s\n' \"\$rc\"; sleep 20"
   }
 
@@ -1779,7 +1782,7 @@ TS
 {"type":"message","id":"a0000016","parentId":"a0000015","timestamp":"$now","message":{"role":"assistant","content":[{"type":"text","text":"The deterministic tool example is complete."}],"api":"anthropic-messages","provider":"anthropic","model":"claude-sonnet-4-5","usage":{"input":2,"output":1,"cacheRead":0,"cacheWrite":0,"totalTokens":3,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"stop","timestamp":16}}
 JSON
 
-  tmux -L "$TMUX_SOCKET" new-session -d -s "$TMUX_SESSION" -x 180 -y 44 \
+  SHELL=/bin/bash tmux -L "$TMUX_SOCKET" new-session -d -s "$TMUX_SESSION" -x 180 -y 44 \
     "cd '$project' && env FM_HOME='$home' PI_CODING_AGENT_DIR='$config' FM_OPERATIONAL_INPUT_SCRIPT='$OPERATIONAL_INPUT' PI_OFFLINE=1 pi --approve --no-skills --no-prompt-templates --no-context-files --session '$session_file'; rc=\$?; printf '\nPI_EXIT=%s\n' \"\$rc\"; sleep 30"
   wait_for_text "$default_snapshot" "The deterministic tool example is complete." \
     || fail "Pi calm E2E did not reach the restored session transcript"
@@ -1802,7 +1805,8 @@ JSON
   while [ "$active_screen_wait" -lt 120 ]; do
     tmux -L "$TMUX_SOCKET" capture-pane -p -t "$TMUX_SESSION" >"$hidden_snapshot"
     if ! grep -Fq "CALM_E2E_OUTPUT" "$hidden_snapshot" &&
-      ! grep -Fq "/calm" "$hidden_snapshot"; then
+      ! grep -Fq "/calm" "$hidden_snapshot" &&
+      ! grep -Fq "Thinking..." "$hidden_snapshot"; then
       break
     fi
     sleep 0.05
@@ -2054,7 +2058,7 @@ JS
     || fail "Pi did not exit cleanly before the Calm persistence restart"
   tmux -L "$TMUX_SOCKET" kill-session -t "$TMUX_SESSION" 2>/dev/null || true
 
-  tmux -L "$TMUX_SOCKET" new-session -d -s "$TMUX_SESSION" -x 180 -y 44 \
+  SHELL=/bin/bash tmux -L "$TMUX_SOCKET" new-session -d -s "$TMUX_SESSION" -x 180 -y 44 \
     "cd '$project' && env FM_HOME='$home' PI_CODING_AGENT_DIR='$config' FM_OPERATIONAL_INPUT_SCRIPT='$OPERATIONAL_INPUT' PI_OFFLINE=1 pi --approve --no-skills --no-prompt-templates --no-context-files --session '$session_file'; rc=\$?; printf '\nPI_EXIT=%s\n' \"\$rc\"; sleep 30"
   wait_for_text "$restarted_snapshot" "CALM_WORKING_E2E_RESPONSE" \
     || fail "Pi did not restore the persisted session after restart"
diff --git a/tests/fm-host-setup.test.sh b/tests/fm-host-setup.test.sh
new file mode 100755
index 0000000000..b40896957b
--- /dev/null
+++ b/tests/fm-host-setup.test.sh
@@ -0,0 +1,150 @@
+#!/usr/bin/env bash
+# Focused contract and real-Pi startup checks for the single-host Pi activator.
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+SETUP="$ROOT/bin/fm-host-setup.sh"
+LAB=$(fm_test_tmproot fm-host-setup)
+PI_DIR="$LAB/pi-home"
+HOST="$LAB/host"
+FM_HOME_DIR="$LAB/firstmate-home"
+FAKE_HOME="$LAB/user-home"
+OUTSIDE="$LAB/outside"
+
+mkdir -p "$HOST" "$FM_HOME_DIR" "$FAKE_HOME" "$OUTSIDE"
+printf '# Host policy\n\nHOST_POLICY_SENTINEL\n' >"$HOST/AGENTS.md"
+
+run_setup() {
+	env -u FM_ROOT_OVERRIDE -u FM_HOME -u FM_HOST_ROOT -u FM_BACKEND \
+		PI_CODING_AGENT_DIR="$PI_DIR" HOME="$FAKE_HOME" "$SETUP" "$@"
+}
+
+assert_present "$SETUP" "bin/fm-host-setup.sh is missing"
+[ -x "$SETUP" ] || fail "fm-host-setup.sh must be executable"
+
+before=$(find "$HOST" -mindepth 1 -maxdepth 3 -print | sort)
+install_out=$(run_setup install "$HOST" --home "$FM_HOME_DIR" --backend herdr)
+after=$(find "$HOST" -mindepth 1 -maxdepth 3 -print | sort)
+[ "$before" = "$after" ] || fail "install edited the host repository"
+ACTIVATOR="$PI_DIR/extensions/fm-firstmate-host.ts"
+assert_present "$ACTIVATOR" "install did not create the Pi activator under PI_CODING_AGENT_DIR"
+assert_grep '// firstmate-host-activator managed-v1' "$ACTIVATOR" "activator ownership marker is missing"
+assert_contains "$install_out" "worker backend: herdr" "install did not report the configured backend"
+cp "$ACTIVATOR" "$LAB/activator.before"
+second_out=$(run_setup install "$HOST" --home "$FM_HOME_DIR" --backend herdr)
+cmp -s "$LAB/activator.before" "$ACTIVATOR" || fail "idempotent install changed the activator"
+assert_contains "$second_out" "unchanged" "idempotent install did not report unchanged"
+status_out=$(run_setup status)
+assert_contains "$status_out" "host: $(cd "$HOST" && pwd -P)" "status did not report the physical host"
+assert_contains "$status_out" "firstmate home: $(cd "$FM_HOME_DIR" && pwd -P)" "status did not report the FirstMate home"
+pass "install is host-read-only, PI_CODING_AGENT_DIR-aware, and idempotent"
+
+CONFLICT_PI="$LAB/conflict-pi"
+set +e
+conflict_out=$(FM_HOME="$LAB/conflict" PI_CODING_AGENT_DIR="$CONFLICT_PI" HOME="$FAKE_HOME" \
+	"$SETUP" install "$HOST" --home "$FM_HOME_DIR" --backend herdr 2>&1)
+conflict_status=$?
+set -e
+[ "$conflict_status" -ne 0 ] || fail "install accepted a conflicting ambient FM_HOME"
+assert_contains "$conflict_out" "FM_HOME is already set to a conflicting value" "ambient conflict error is unclear"
+assert_absent "$CONFLICT_PI/extensions/fm-firstmate-host.ts" "ambient conflict wrote an activator"
+
+UNMANAGED_PI="$LAB/unmanaged-pi"
+mkdir -p "$UNMANAGED_PI/extensions"
+printf 'export default function () {}\n' >"$UNMANAGED_PI/extensions/fm-firstmate-host.ts"
+set +e
+unmanaged_out=$(env -u FM_ROOT_OVERRIDE -u FM_HOME -u FM_HOST_ROOT -u FM_BACKEND \
+	PI_CODING_AGENT_DIR="$UNMANAGED_PI" HOME="$FAKE_HOME" \
+	"$SETUP" install "$HOST" --home "$FM_HOME_DIR" 2>&1)
+unmanaged_status=$?
+set -e
+[ "$unmanaged_status" -ne 0 ] || fail "install overwrote an unmanaged extension"
+assert_contains "$unmanaged_out" "refusing to overwrite unmanaged" "unmanaged install refusal is unclear"
+assert_grep 'export default function () {}' "$UNMANAGED_PI/extensions/fm-firstmate-host.ts" \
+	"unmanaged extension content changed"
+pass "install refuses ambient FM conflicts and unmanaged files"
+
+if command -v pi >/dev/null 2>&1; then
+	mkdir -p "$HOST/.pi/extensions" "$HOST/.agents/skills/host-skill" "$FM_HOME_DIR/state"
+	cat >"$HOST/.agents/skills/host-skill/SKILL.md" <<'SKILL'
+---
+name: host-skill
+description: Host fixture skill.
+---
+
+# Host skill
+SKILL
+	cat >"$HOST/.pi/extensions/host-probe.ts" <<'TS'
+import { writeFileSync } from "node:fs";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+export default function (pi: ExtensionAPI) {
+  pi.registerCommand("host-probe", {
+    description: "Write the host activation probe",
+    handler: async (_args, ctx) => {
+      const options = ctx.getSystemPromptOptions();
+      writeFileSync(process.env.HOST_PROBE_OUT!, JSON.stringify({
+        cwd: ctx.cwd,
+        contextFiles: options.contextFiles?.map((file) => file.path) ?? [],
+        skills: options.skills?.map((skill) => skill.name) ?? [],
+        env: Object.fromEntries(["FM_ROOT_OVERRIDE", "FM_HOME", "FM_HOST_ROOT", "FM_BACKEND"].map((name) => [name, process.env[name]])),
+      }));
+    },
+  });
+}
+TS
+	PROBE="$LAB/host-probe.json"
+	RPC_OUT="$LAB/pi-rpc.out"
+	RPC_ERR="$LAB/pi-rpc.err"
+	(
+		cd "$HOST" || exit 1
+		printf '%s\n' '{"type":"prompt","message":"/host-probe"}' '{"type":"get_commands"}' |
+			env -u FM_ROOT_OVERRIDE -u FM_HOME -u FM_HOST_ROOT -u FM_BACKEND \
+				PI_CODING_AGENT_DIR="$PI_DIR" HOME="$FAKE_HOME" PI_OFFLINE=1 HOST_PROBE_OUT="$PROBE" \
+				pi --approve --mode rpc --no-session >"$RPC_OUT" 2>"$RPC_ERR"
+	) || fail "real Pi RPC host activation failed: $(cat "$RPC_ERR")"
+	assert_present "$PROBE" "host lifecycle extension did not run"
+	assert_present "$FM_HOME_DIR/state/.pi-turnend-extension-loaded" "FirstMate guard extension did not load"
+	assert_present "$FM_HOME_DIR/state/.pi-watch-extension-loaded" "FirstMate watch extension did not load"
+	assert_grep 'FirstMate active' "$RPC_OUT" "FirstMate-active status indicator was not emitted"
+	assert_grep 'skill:afk' "$RPC_OUT" "FirstMate internal skills were not discovered"
+	assert_grep 'skill:host-skill' "$RPC_OUT" "host skill discovery was replaced"
+	node -e '
+    const fs = require("fs");
+    const [probePath, host, root, home] = process.argv.slice(1);
+    const p = JSON.parse(fs.readFileSync(probePath, "utf8"));
+    if (p.cwd !== host) throw new Error("cwd mismatch: " + p.cwd);
+    if (!p.contextFiles.includes(host + "/AGENTS.md")) throw new Error("host AGENTS.md missing");
+    if (!p.skills.includes("afk") || !p.skills.includes("host-skill")) throw new Error("skill sets did not compose");
+    if (p.env.FM_ROOT_OVERRIDE !== root || p.env.FM_HOME !== home || p.env.FM_HOST_ROOT !== host || p.env.FM_BACKEND !== "herdr") {
+      throw new Error("environment mismatch: " + JSON.stringify(p.env));
+    }
+  ' "$PROBE" "$(cd "$HOST" && pwd -P)" "$(cd "$ROOT" && pwd -P)" "$(cd "$FM_HOME_DIR" && pwd -P)" ||
+		fail "real Pi host activation probe failed"
+
+	rm -f "$FM_HOME_DIR/state/.pi-turnend-extension-loaded" "$FM_HOME_DIR/state/.pi-watch-extension-loaded"
+	OUTSIDE_OUT="$LAB/pi-outside.out"
+	(
+		cd "$OUTSIDE" || exit 1
+		printf '%s\n' '{"type":"get_commands"}' |
+			env -u FM_ROOT_OVERRIDE -u FM_HOME -u FM_HOST_ROOT -u FM_BACKEND \
+				PI_CODING_AGENT_DIR="$PI_DIR" HOME="$FAKE_HOME" PI_OFFLINE=1 \
+				pi --mode rpc --no-session >"$OUTSIDE_OUT" 2>/dev/null
+	) || fail "real Pi outside-host dormancy probe failed"
+	assert_no_grep 'FirstMate active' "$OUTSIDE_OUT" "activator was not dormant outside the configured host"
+	assert_no_grep 'skill:afk' "$OUTSIDE_OUT" "activator exposed FirstMate skills outside the configured host"
+	assert_absent "$FM_HOME_DIR/state/.pi-turnend-extension-loaded" "guard extension loaded outside the configured host"
+	assert_absent "$FM_HOME_DIR/state/.pi-watch-extension-loaded" "watch extension loaded outside the configured host"
+	pass "real Pi preserves host resources, loads FirstMate resources, and stays dormant elsewhere"
+else
+	printf 'skip: pi not found for real host activator startup probe\n'
+fi
+
+printf 'keep\n' >"$PI_DIR/extensions/unrelated.ts"
+uninstall_out=$(run_setup uninstall)
+assert_contains "$uninstall_out" "removed" "uninstall did not report removal"
+assert_absent "$ACTIVATOR" "uninstall left the owned activator"
+assert_present "$PI_DIR/extensions/unrelated.ts" "uninstall removed an unrelated Pi extension"
+run_setup uninstall >/dev/null || fail "repeated uninstall was not idempotent"
+pass "uninstall removes only its owned file"
diff --git a/tests/fm-pi-primary-types.test.sh b/tests/fm-pi-primary-types.test.sh
index 3ff81f63ef..1f94554349 100755
--- a/tests/fm-pi-primary-types.test.sh
+++ b/tests/fm-pi-primary-types.test.sh
@@ -4,24 +4,30 @@ set -u
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 
-command -v npm >/dev/null 2>&1 || { echo "skip: npm not found for Pi extension typecheck"; exit 0; }
-command -v tsc >/dev/null 2>&1 || { echo "skip: tsc not found for Pi extension typecheck"; exit 0; }
+command -v npm >/dev/null 2>&1 || {
+	echo "skip: npm not found for Pi extension typecheck"
+	exit 0
+}
+command -v tsc >/dev/null 2>&1 || {
+	echo "skip: tsc not found for Pi extension typecheck"
+	exit 0
+}
 
 PI_PACKAGE_DIR=${FM_PI_PACKAGE_DIR:-"$(npm root -g)/@earendil-works/pi-coding-agent"}
 if [ ! -f "$PI_PACKAGE_DIR/package.json" ]; then
-  echo "skip: installed @earendil-works/pi-coding-agent package not found"
-  exit 0
+	echo "skip: installed @earendil-works/pi-coding-agent package not found"
+	exit 0
 fi
-if [ ! -d "$PI_PACKAGE_DIR/node_modules/typebox" ] || \
-   [ ! -d "$PI_PACKAGE_DIR/node_modules/@earendil-works/pi-tui" ] || \
-   [ ! -d "$PI_PACKAGE_DIR/node_modules/@types/node" ]; then
-  echo "not ok - installed Pi package is missing pi-tui, typebox, or Node declarations" >&2
-  exit 1
+if [ ! -d "$PI_PACKAGE_DIR/node_modules/typebox" ] ||
+	[ ! -d "$PI_PACKAGE_DIR/node_modules/@earendil-works/pi-tui" ] ||
+	[ ! -d "$PI_PACKAGE_DIR/node_modules/@types/node" ]; then
+	echo "not ok - installed Pi package is missing pi-tui, typebox, or Node declarations" >&2
+	exit 1
 fi
 
 TMP_ROOT=$(mktemp -d "${TMPDIR:-/tmp}/fm-pi-primary-types.XXXXXX")
 cleanup() {
-  rm -rf "$TMP_ROOT"
+	rm -rf "$TMP_ROOT"
 }
 trap cleanup EXIT
 
@@ -29,6 +35,7 @@ mkdir -p "$TMP_ROOT/lib" "$TMP_ROOT/node_modules/@earendil-works" "$TMP_ROOT/nod
 cp "$ROOT/.pi/extensions/fm-calm.ts" "$TMP_ROOT/fm-calm.ts"
 cp "$ROOT/.pi/extensions/fm-primary-pi-watch.ts" "$TMP_ROOT/fm-primary-pi-watch.ts"
 cp "$ROOT/.pi/extensions/fm-primary-turnend-guard.ts" "$TMP_ROOT/fm-primary-turnend-guard.ts"
+cp "$ROOT/.pi/extensions/lib/fm-host-activator.ts" "$TMP_ROOT/lib/fm-host-activator.ts"
 cp "$ROOT/.pi/extensions/lib/fm-calm-assistant-layout.ts" "$TMP_ROOT/lib/fm-calm-assistant-layout.ts"
 cp "$ROOT/.pi/extensions/lib/fm-calm-operational-user-layout.ts" "$TMP_ROOT/lib/fm-calm-operational-user-layout.ts"
 cp "$ROOT/.pi/extensions/lib/fm-calm-visibility.ts" "$TMP_ROOT/lib/fm-calm-visibility.ts"
@@ -38,10 +45,10 @@ ln -s "$PI_PACKAGE_DIR/node_modules/@earendil-works/pi-tui" "$TMP_ROOT/node_modu
 ln -s "$PI_PACKAGE_DIR/node_modules/typebox" "$TMP_ROOT/node_modules/typebox"
 ln -s "$PI_PACKAGE_DIR/node_modules/@types/node" "$TMP_ROOT/node_modules/@types/node"
 
-cat > "$TMP_ROOT/package.json" <<'JSON'
+cat >"$TMP_ROOT/package.json" <<'JSON'
 {"type":"module"}
 JSON
-cat > "$TMP_ROOT/tsconfig.json" <<'JSON'
+cat >"$TMP_ROOT/tsconfig.json" <<'JSON'
 {
   "compilerOptions": {
     "allowImportingTsExtensions": true,
diff --git a/tests/fm-secondmate-harness.test.sh b/tests/fm-secondmate-harness.test.sh
index ae41c79351..54109f11c6 100755
--- a/tests/fm-secondmate-harness.test.sh
+++ b/tests/fm-secondmate-harness.test.sh
@@ -167,8 +167,8 @@ SH
   [ "$got" = pi ] || fail "selected plain Pi resolved '$got', expected pi"
   got=$(PATH="$fakebin:$BASE_PATH" PI_CODING_AGENT=true FM_PI_HARNESS=pi-signed-helper "$ROOT/bin/fm-harness.sh")
   [ "$got" = pi ] || fail "inexact signed selection marker resolved '$got', expected pi"
-  got=$(PATH="$fakebin:$BASE_PATH" FM_PI_HARNESS=pi-signed "$ROOT/bin/fm-harness.sh")
-  [ "$got" = pi ] || fail "signed selection marker without Pi's family marker resolved '$got', expected pi"
+got=$(env -u PI_CODING_AGENT PATH="$fakebin:$BASE_PATH" FM_PI_HARNESS=pi-signed "$ROOT/bin/fm-harness.sh")
+[ "$got" = pi ] || fail "signed selection marker without Pi's family marker resolved '$got', expected pi"
   got=$(PATH="$fakebin:$BASE_PATH" PI_CODING_AGENT=true FM_TEST_SIGNED_SHAPE=plain "$ROOT/bin/fm-harness.sh")
   [ "$got" = pi ] || fail "plain Pi marker resolved '$got', expected pi"
   got=$(PATH="$fakebin:$BASE_PATH" PI_CODING_AGENT=true FM_TEST_SIGNED_SHAPE=helper "$ROOT/bin/fm-harness.sh")

From a997c490225cee8967d4c6c25495bb4368213143 Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Wed, 29 Jul 2026 12:45:59 +0300
Subject: [PATCH 31/39] no-mistakes(review): Harden host-root overlap and
 metadata authority

---
 .pi/extensions/lib/fm-host-activator.ts   |  4 +-
 bin/fm-backend.sh                         | 20 +++++++-
 bin/fm-host-root-lib.sh                   | 60 +++++++++++++++++++----
 bin/fm-host-setup.sh                      |  4 +-
 tests/fm-host-root-mode.test.sh           | 29 ++++++++++-
 tests/fm-host-setup.test.sh               | 37 ++++++++++++++
 tests/fm-teardown-endpoint-safety.test.sh | 17 ++++++-
 7 files changed, 154 insertions(+), 17 deletions(-)

diff --git a/.pi/extensions/lib/fm-host-activator.ts b/.pi/extensions/lib/fm-host-activator.ts
index 5592b92fed..d8bc91c3af 100644
--- a/.pi/extensions/lib/fm-host-activator.ts
+++ b/.pi/extensions/lib/fm-host-activator.ts
@@ -53,10 +53,12 @@ function validateConfig(config: FirstmateHostConfig): string | undefined {
 		"bash",
 		[
 			"-c",
-			'. "$1/bin/fm-backend.sh" && fm_backend_validate_spawn "$2"',
+			'. "$1/bin/fm-host-root-lib.sh" && fm_host_root_assert_operational_roots "$3" "$1" "$4" && . "$1/bin/fm-backend.sh" && fm_backend_validate_spawn "$2"',
 			"fm-host-activator",
 			config.fmRoot,
 			config.backend,
+			config.hostRoot,
+			config.fmHome,
 		],
 		{
 			encoding: "utf8",
diff --git a/bin/fm-backend.sh b/bin/fm-backend.sh
index 4aa89fb2a1..aafb35756a 100644
--- a/bin/fm-backend.sh
+++ b/bin/fm-backend.sh
@@ -440,10 +440,27 @@ fm_backend_validate_task_endpoint() {  # <meta-file> <task-id>
     echo "REFUSED: endpoint metadata belongs to task $binding, not $id; preserving task state." >&2
     return 1
   fi
+  host_count=$(grep -c '^host_root=' "$meta" 2>/dev/null || true)
+  case "$host_count" in
+    0) host_root= ;;
+    1)
+      host_root=$(fm_backend_meta_exact_value "$meta" host_root) || {
+        echo "REFUSED: task $id has empty host_root ownership; preserving task state." >&2
+        return 1
+      }
+      case "$host_root" in *$'\n'*|*$'\r'*|*$'\t'*)
+        echo "REFUSED: task $id has malformed host_root ownership; preserving task state." >&2
+        return 1
+      esac
+      ;;
+    *)
+      echo "REFUSED: task $id has ambiguous host_root ownership; preserving task state." >&2
+      return 1
+      ;;
+  esac
 
   case "$backend" in
     tmux)
-      host_count=$(grep -c '^host_root=' "$meta" 2>/dev/null || true)
       if [ "$host_count" -eq 0 ]; then
         session=${window%%:*}
         pane=${window#*:}
@@ -453,7 +470,6 @@ fm_backend_validate_task_endpoint() {  # <meta-file> <task-id>
           return 1
         fi
       elif [ "$host_count" -eq 1 ] && [ "$binding" = "$id" ]; then
-        host_root=$(fm_backend_meta_exact_value "$meta" host_root) || host_root=
         marker=$(fm_backend_meta_exact_value "$meta" tmux_window_marker) || marker=
         socket=$(fm_backend_meta_exact_value "$meta" tmux_socket_path) || socket=
         case "$window" in
diff --git a/bin/fm-host-root-lib.sh b/bin/fm-host-root-lib.sh
index 3f4f2c9803..981a270bc2 100644
--- a/bin/fm-host-root-lib.sh
+++ b/bin/fm-host-root-lib.sh
@@ -12,6 +12,7 @@
 # fm_host_root_assert_task_cwd <fm-root> <task-meta>
 # fm_host_root_persist_task_owner <task-meta> <owner-file>
 # fm_host_root_paths_overlap <physical-host-root> <physical-target-root>
+# fm_host_root_assert_operational_roots <physical-host-root> <physical-fm-root> [physical-fm-home]
 # fm_host_root_command <fm-root> <repo-relative-command>
 
 fm_host_root_enabled() {
@@ -46,10 +47,7 @@ fm_host_root_resolve() {
     echo "error: FM_ROOT cannot be resolved while validating FM_HOST_ROOT: $fm_root" >&2
     return 2
   }
-  [ "$host_real" != "$root_real" ] || {
-    echo "error: FM_HOST_ROOT must differ from FM_ROOT; unset FM_HOST_ROOT for normal FirstMate-root operation" >&2
-    return 2
-  }
+  fm_host_root_assert_operational_roots "$host_real" "$root_real" || return $?
   if [ ! -f "$host_real/AGENTS.md" ]; then
     echo "error: FM_HOST_ROOT has no cross-harness instruction surface (expected AGENTS.md): $host_real" >&2
     return 2
@@ -68,10 +66,35 @@ fm_host_root_assert_session_cwd() {
   }
 }
 
+fm_host_root_recorded_owner() {
+  local meta=$1 count recorded
+  count=$(grep -c '^host_root=' "$meta" 2>/dev/null || true)
+  case "$count" in
+    0) return 1 ;;
+    1) recorded=$(sed -n 's/^host_root=//p' "$meta" 2>/dev/null) ;;
+    *)
+      echo "error: task metadata $meta has ambiguous host_root ownership" >&2
+      return 2
+      ;;
+  esac
+  [ -n "$recorded" ] || {
+    echo "error: task metadata $meta has empty host_root ownership" >&2
+    return 2
+  }
+  printf '%s\n' "$recorded"
+}
+
 fm_host_root_assert_task_cwd() {
-  local fm_root=$1 meta=$2 recorded kind host ambient cwd
-  recorded=$(sed -n 's/^host_root=//p' "$meta" 2>/dev/null | tail -1)
-  kind=$(sed -n 's/^kind=//p' "$meta" 2>/dev/null | tail -1)
+  local fm_root=$1 meta=$2 recorded kind= host ambient cwd status kind_count
+  if recorded=$(fm_host_root_recorded_owner "$meta"); then
+    :
+  else
+    status=$?
+    [ "$status" -eq 1 ] || return "$status"
+    recorded=
+  fi
+  kind_count=$(grep -c '^kind=' "$meta" 2>/dev/null || true)
+  [ "$kind_count" -ne 1 ] || kind=$(sed -n 's/^kind=//p' "$meta" 2>/dev/null)
   if [ -z "$recorded" ]; then
     if [ "$kind" = secondmate ]; then
       fm_host_root_assert_session_cwd "$fm_root"
@@ -103,9 +126,14 @@ fm_host_root_assert_task_cwd() {
 }
 
 fm_host_root_persist_task_owner() {
-  local meta=$1 owner=$2 recorded tmp
-  recorded=$(sed -n 's/^host_root=//p' "$meta" 2>/dev/null | tail -1)
-  [ -n "$recorded" ] || return 0
+  local meta=$1 owner=$2 recorded tmp status
+  if recorded=$(fm_host_root_recorded_owner "$meta"); then
+    :
+  else
+    status=$?
+    [ "$status" -eq 1 ] && return 0
+    return "$status"
+  fi
   if [ -e "$owner" ] || [ -L "$owner" ]; then
     [ -f "$owner" ] && [ ! -L "$owner" ] || {
       echo "error: host owner is not a regular file: $owner" >&2
@@ -140,6 +168,18 @@ fm_host_root_paths_overlap() {
   return 1
 }
 
+fm_host_root_assert_operational_roots() {
+  local host=$1 root=$2 home=${3:-}
+  if fm_host_root_paths_overlap "$host" "$root"; then
+    echo "error: FM_HOST_ROOT must not overlap FM_ROOT; unset FM_HOST_ROOT for normal FirstMate-root operation" >&2
+    return 2
+  fi
+  if [ -n "$home" ] && fm_host_root_paths_overlap "$host" "$home"; then
+    echo "error: FM_HOST_ROOT must not overlap FM_HOME; keep FirstMate state outside the host repository" >&2
+    return 2
+  fi
+}
+
 fm_host_root_shell_quote() {
   printf "'"
   printf '%s' "$1" | sed "s/'/'\\\\''/g"
diff --git a/bin/fm-host-setup.sh b/bin/fm-host-setup.sh
index 6f7dd35bad..dc5eedfab6 100755
--- a/bin/fm-host-setup.sh
+++ b/bin/fm-host-setup.sh
@@ -17,6 +17,8 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 SOURCE="$FM_ROOT/.pi/extensions/lib/fm-host-activator.ts"
 OWNER='// firstmate-host-activator managed-v1'
+# shellcheck source=bin/fm-host-root-lib.sh
+. "$SCRIPT_DIR/fm-host-root-lib.sh"
 
 usage() {
 	awk '
@@ -162,7 +164,7 @@ install)
 	ROOT_REAL=$(physical_dir "FirstMate root" "$FM_ROOT")
 	HOME_REAL=$(physical_dir "FirstMate home" "$HOME_ARG")
 	HOST_REAL=$(physical_dir "host root" "$HOST_ARG")
-	[ "$ROOT_REAL" != "$HOST_REAL" ] || fail "host root must differ from FirstMate root"
+	fm_host_root_assert_operational_roots "$HOST_REAL" "$ROOT_REAL" "$HOME_REAL" || exit $?
 	[ -f "$HOST_REAL/AGENTS.md" ] || fail "host root has no AGENTS.md: $HOST_REAL"
 	(
 		export FM_ROOT_OVERRIDE=$ROOT_REAL FM_HOME=$HOME_REAL
diff --git a/tests/fm-host-root-mode.test.sh b/tests/fm-host-root-mode.test.sh
index e43230b594..6fda2a9353 100644
--- a/tests/fm-host-root-mode.test.sh
+++ b/tests/fm-host-root-mode.test.sh
@@ -26,8 +26,9 @@ paths_overlap() {
 }
 
 test_resolution_and_validation() {
-  local host="$TMP/host with spaces and apostrophe's" link="$TMP/host-link" unsafe_target out status=0
+  local host="$TMP/host with spaces and apostrophe's" link="$TMP/host-link" root="$TMP/firstmate-root" unsafe_target out status=0
   make_host "$host"
+  mkdir -p "$root" "$host/private-home"
   ln -s "$host" "$link"
   out=$(resolve_host "$link") || status=$?
   expect_code 0 "$status" "symlinked host root should resolve"
@@ -64,9 +65,34 @@ test_resolution_and_validation() {
   fi
   paths_overlap / "$host" || fail "filesystem root was not classified as an ancestor"
   paths_overlap "$host" / || fail "filesystem root was not classified as an enclosing target"
+  status=0
+  out=$(bash -c '. "$1"; fm_host_root_assert_operational_roots "$2" "$3" "$4"' \
+    _ "$LIB" "$host" "$root" "$host/private-home" 2>&1) || status=$?
+  expect_code 2 "$status" "host root overlapping FirstMate home must fail"
+  assert_contains "$out" 'must not overlap FM_HOME' "operational-root overlap refusal was unclear"
   pass "host-root library resolves physical paths and rejects unsafe, harness-specific, or overlapping roots"
 }
 
+test_ambiguous_host_owner_is_rejected() {
+  local host="$TMP/ambiguous-owner-host" other="$TMP/ambiguous-owner-other" meta="$TMP/ambiguous-owner.meta" owner="$TMP/ambiguous-owner" out status=0
+  make_host "$host"
+  make_host "$other"
+  printf 'host_root=%s\nhost_root=%s\nkind=ship\n' "$host" "$other" > "$meta"
+
+  out=$(cd "$other" && FM_HOST_ROOT="$other" bash -c \
+    '. "$1"; fm_host_root_assert_task_cwd "$2" "$3"' _ "$LIB" "$ROOT" "$meta" 2>&1) || status=$?
+  expect_code 2 "$status" "duplicate host_root metadata must not grant task authority"
+  assert_contains "$out" 'ambiguous host_root ownership' "duplicate task authority refusal was unclear"
+
+  status=0
+  out=$(bash -c '. "$1"; fm_host_root_persist_task_owner "$2" "$3"' \
+    _ "$LIB" "$meta" "$owner" 2>&1) || status=$?
+  expect_code 2 "$status" "duplicate host_root metadata must not persist owner authority"
+  assert_contains "$out" 'ambiguous host_root ownership' "duplicate owner persistence refusal was unclear"
+  assert_absent "$owner" "duplicate host_root metadata created an owner record"
+  pass "host-root authority rejects duplicate metadata before use or persistence"
+}
+
 test_host_owner_publication_is_atomic() {
   local dir="$TMP/owner-publication" meta owner out status=0 mode
   mkdir -p "$dir/fakebin"
@@ -1318,6 +1344,7 @@ test_spawn_rejects_old_brief_and_secondmate_clears_roots() {
 }
 
 test_resolution_and_validation
+test_ambiguous_host_owner_is_rejected
 test_host_owner_publication_is_atomic
 test_session_cwd_mismatch_precedes_mutation
 test_host_command_rendering
diff --git a/tests/fm-host-setup.test.sh b/tests/fm-host-setup.test.sh
index b40896957b..4fa61e8c95 100755
--- a/tests/fm-host-setup.test.sh
+++ b/tests/fm-host-setup.test.sh
@@ -66,6 +66,21 @@ assert_grep 'export default function () {}' "$UNMANAGED_PI/extensions/fm-firstma
 	"unmanaged extension content changed"
 pass "install refuses ambient FM conflicts and unmanaged files"
 
+mkdir -p "$HOST/private-home"
+for overlap_home in "$HOST/private-home" "$LAB"; do
+	OVERLAP_PI="$LAB/overlap-pi-$(basename "$overlap_home")"
+	set +e
+	overlap_out=$(env -u FM_ROOT_OVERRIDE -u FM_HOME -u FM_HOST_ROOT -u FM_BACKEND \
+		PI_CODING_AGENT_DIR="$OVERLAP_PI" HOME="$FAKE_HOME" \
+		"$SETUP" install "$HOST" --home "$overlap_home" --backend herdr 2>&1)
+	overlap_status=$?
+	set -e
+	[ "$overlap_status" -ne 0 ] || fail "install accepted host and FirstMate home overlap"
+	assert_contains "$overlap_out" "must not overlap FM_HOME" "host/home overlap refusal is unclear"
+	assert_absent "$OVERLAP_PI/extensions/fm-firstmate-host.ts" "host/home overlap wrote an activator"
+done
+pass "install rejects physical ancestor and descendant host/home overlap"
+
 if command -v pi >/dev/null 2>&1; then
 	mkdir -p "$HOST/.pi/extensions" "$HOST/.agents/skills/host-skill" "$FM_HOME_DIR/state"
 	cat >"$HOST/.agents/skills/host-skill/SKILL.md" <<'SKILL'
@@ -123,6 +138,28 @@ TS
   ' "$PROBE" "$(cd "$HOST" && pwd -P)" "$(cd "$ROOT" && pwd -P)" "$(cd "$FM_HOME_DIR" && pwd -P)" ||
 		fail "real Pi host activation probe failed"
 
+	RUNTIME_OVERLAP_PI="$LAB/runtime-overlap-pi"
+	mkdir -p "$RUNTIME_OVERLAP_PI/extensions"
+	node -e '
+    const fs = require("fs");
+    const [source, target, home, host] = process.argv.slice(1);
+    fs.writeFileSync(target, fs.readFileSync(source, "utf8").replaceAll(JSON.stringify(home), JSON.stringify(host)));
+  ' "$ACTIVATOR" "$RUNTIME_OVERLAP_PI/extensions/fm-firstmate-host.ts" \
+		"$(cd "$FM_HOME_DIR" && pwd -P)" "$(cd "$HOST" && pwd -P)"
+	RUNTIME_OVERLAP_OUT="$LAB/runtime-overlap.out"
+	RUNTIME_OVERLAP_ERR="$LAB/runtime-overlap.err"
+	(
+		cd "$HOST" || exit 1
+		printf '%s\n' '{"type":"get_commands"}' |
+			env -u FM_ROOT_OVERRIDE -u FM_HOME -u FM_HOST_ROOT -u FM_BACKEND \
+				PI_CODING_AGENT_DIR="$RUNTIME_OVERLAP_PI" HOME="$FAKE_HOME" PI_OFFLINE=1 \
+				pi --mode rpc --no-session >"$RUNTIME_OVERLAP_OUT" 2>"$RUNTIME_OVERLAP_ERR"
+	) || fail "real Pi runtime-overlap refusal failed: $(cat "$RUNTIME_OVERLAP_ERR")"
+	assert_grep 'FirstMate inactive' "$RUNTIME_OVERLAP_OUT" "runtime overlap did not leave FirstMate inactive"
+	assert_grep 'must not overlap FM_HOME' "$RUNTIME_OVERLAP_ERR" "runtime overlap refusal was unclear"
+	assert_absent "$HOST/state/.pi-turnend-extension-loaded" "runtime overlap loaded the guard into the host"
+	assert_absent "$HOST/state/.pi-watch-extension-loaded" "runtime overlap loaded the watcher into the host"
+
 	rm -f "$FM_HOME_DIR/state/.pi-turnend-extension-loaded" "$FM_HOME_DIR/state/.pi-watch-extension-loaded"
 	OUTSIDE_OUT="$LAB/pi-outside.out"
 	(
diff --git a/tests/fm-teardown-endpoint-safety.test.sh b/tests/fm-teardown-endpoint-safety.test.sh
index 5786102cd3..2aec7969d9 100755
--- a/tests/fm-teardown-endpoint-safety.test.sh
+++ b/tests/fm-teardown-endpoint-safety.test.sh
@@ -94,7 +94,7 @@ test_invalid_endpoint_records_refuse_before_mutation() {
 }
 
 test_supported_backend_endpoint_records_validate() {
-  local dir id backend target
+  local dir id backend target host_id
   dir=$(make_case valid-backends)
   # shellcheck source=/dev/null
   . "$ROOT/bin/fm-backend.sh"
@@ -136,6 +136,19 @@ test_supported_backend_endpoint_records_validate() {
     "backend=cmux" "cmux_workspace_id=workspace-1" "cmux_surface_id=surface-2"
   fm_backend_validate_task_endpoint "$dir/home/state/$id.meta" "$id" || fail "valid cmux endpoint refused"
 
+  host_id=tmux-host-task
+  fm_write_meta "$dir/home/state/$host_id.meta" \
+    "window=@1" "endpoint_task_id=$host_id" "worktree=$dir/worktree" "project=$dir/project" \
+    "host_root=/host/one" "tmux_socket_path=/tmp/tmux.sock" "tmux_window_marker=marker"
+  fm_backend_validate_task_endpoint "$dir/home/state/$host_id.meta" "$host_id" || fail "valid host-root tmux endpoint refused"
+
+  for host_id in tmux-host-task herdr-task zellij-task orca-task cmux-task; do
+    printf 'host_root=/host/two\nhost_root=/host/three\n' >> "$dir/home/state/$host_id.meta"
+    if fm_backend_validate_task_endpoint "$dir/home/state/$host_id.meta" "$host_id" 2>/dev/null; then
+      fail "$host_id accepted ambiguous host_root ownership"
+    fi
+  done
+
   for backend in tmux herdr zellij orca cmux; do
     set +e
     fm_backend_kill "$backend" "" >/dev/null 2>&1
@@ -143,7 +156,7 @@ test_supported_backend_endpoint_records_validate() {
     set -e
     [ "$target" -ne 0 ] || fail "$backend generic kill accepted an empty target"
   done
-  pass "cleanup identity: valid tmux, Herdr, Zellij, Orca, and cmux records validate while every empty backend target refuses"
+  pass "cleanup identity: valid endpoints pass while ambiguous host ownership and empty backend targets refuse"
 }
 
 test_tmux_empty_target_refuses_without_invocation() {

From 801bd75a1d49d9a6abdbd9c905b077f5370da7a6 Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Wed, 29 Jul 2026 12:52:44 +0300
Subject: [PATCH 32/39] no-mistakes(review): Enforce runtime host-home root
 isolation

---
 bin/fm-host-root-lib.sh         |  9 +++++++--
 docs/configuration.md           |  2 +-
 tests/fm-host-root-mode.test.sh | 12 +++++++++++-
 3 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/bin/fm-host-root-lib.sh b/bin/fm-host-root-lib.sh
index 981a270bc2..86c84f6dec 100644
--- a/bin/fm-host-root-lib.sh
+++ b/bin/fm-host-root-lib.sh
@@ -20,7 +20,7 @@ fm_host_root_enabled() {
 }
 
 fm_host_root_resolve() {
-  local fm_root=${1:-.} host root_real host_real
+  local fm_root=${1:-.} host home root_real host_real home_real
   fm_host_root_enabled || return 1
   host=$FM_HOST_ROOT
   case "$host" in
@@ -47,7 +47,12 @@ fm_host_root_resolve() {
     echo "error: FM_ROOT cannot be resolved while validating FM_HOST_ROOT: $fm_root" >&2
     return 2
   }
-  fm_host_root_assert_operational_roots "$host_real" "$root_real" || return $?
+  home=${FM_HOME:-$fm_root}
+  home_real=$(cd "$home" 2>/dev/null && pwd -P) || {
+    echo "error: FM_HOME cannot be resolved while validating FM_HOST_ROOT: $home" >&2
+    return 2
+  }
+  fm_host_root_assert_operational_roots "$host_real" "$root_real" "$home_real" || return $?
   if [ ! -f "$host_real/AGENTS.md" ]; then
     echo "error: FM_HOST_ROOT has no cross-harness instruction surface (expected AGENTS.md): $host_real" >&2
     return 2
diff --git a/docs/configuration.md b/docs/configuration.md
index a0d9c01d71..3524788e26 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -191,7 +191,7 @@ At the configured host, the global extension sets the four root/backend variable
 Outside that exact physical host it contributes no environment, policy, skills, tools, or lifecycle behavior.
 The host's normal Pi project trust decision still controls its project-local instructions, skills, and extensions.
 Other harness integrations must provide the same additive policy and adapter loading before setting `FM_HOST_ROOT`; setting the variable alone is still only the low-level runtime contract.
-When set, the value must resolve to an existing directory containing the cross-harness `AGENTS.md` instruction surface, it must differ from `FM_ROOT`, and the supervisor must run with its physical cwd at that directory.
+When set, the value must resolve to an existing directory containing the cross-harness `AGENTS.md` instruction surface, it must not physically overlap `FM_ROOT` or `FM_HOME`, and the supervisor must run with its physical cwd at that directory.
 `bin/fm-session-start.sh` validates that contract before lock acquisition or any bootstrap mutation.
 
 Host mode separates four roots:
diff --git a/tests/fm-host-root-mode.test.sh b/tests/fm-host-root-mode.test.sh
index 6fda2a9353..ade91315b4 100644
--- a/tests/fm-host-root-mode.test.sh
+++ b/tests/fm-host-root-mode.test.sh
@@ -126,8 +126,18 @@ SH
 }
 
 test_session_cwd_mismatch_precedes_mutation() {
-  local host="$TMP/session-host" home="$TMP/session-home" other="$TMP/session-other" fake_root out status=0
+  local host="$TMP/session-host" home="$TMP/session-home" overlap_home="$TMP/session-home-link" other="$TMP/session-other" fake_root before after out status=0
   make_host "$host"; mkdir -p "$home/state" "$home/data" "$home/config" "$other"
+  ln -s "$host" "$overlap_home"
+  before=$(find "$host" -mindepth 1 -maxdepth 3 -print | sort)
+  out=$(cd "$host" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$overlap_home" FM_HOST_ROOT="$host" \
+    "$ROOT/bin/fm-session-start.sh" 2>&1) || status=$?
+  expect_code 2 "$status" "session-start must reject a physical host and home overlap"
+  assert_contains "$out" 'must not overlap FM_HOME' "session-start host/home overlap refusal was unclear"
+  after=$(find "$host" -mindepth 1 -maxdepth 3 -print | sort)
+  [ "$before" = "$after" ] || fail "session-start mutated the host before rejecting overlapping FM_HOME"
+
+  status=0
   out=$(cd "$other" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-session-start.sh" 2>&1) || status=$?
   expect_code 2 "$status" "session-start host cwd mismatch must fail"
   assert_contains "$out" 'requires the supervisor cwd' "session-start mismatch did not explain the host cwd"

From d7fb7cd52bb5607d9ed3f4ba6620204aacb1a701 Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Wed, 29 Jul 2026 13:09:59 +0300
Subject: [PATCH 33/39] no-mistakes(document): Refresh host-root verification
 evidence

---
 docs/verification/runtime-backends.md | 6 +++---
 docs/verification/supervision.md      | 3 ++-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/docs/verification/runtime-backends.md b/docs/verification/runtime-backends.md
index ba8f1d0e04..e03544e7a9 100644
--- a/docs/verification/runtime-backends.md
+++ b/docs/verification/runtime-backends.md
@@ -91,7 +91,7 @@ Expected submit matrix: proven pending plus busy is accepted as queued; proven p
 
 ### Cleanup endpoint identity
 
-The cleanup identity boundary was validated on 2026-07-28 with tmux 3.6a and metadata fixtures for every supported backend.
+The cleanup identity boundary was validated on 2026-07-29 with tmux 3.7b and metadata fixtures for every supported backend.
 
 ```sh
 tests/fm-teardown-endpoint-safety.test.sh
@@ -106,10 +106,10 @@ Bounded output from the incident regression:
 
 ```text
 ok - fm-teardown: missing, empty, malformed, ambiguous, and task-mismatched endpoints refuse before every mutation or runtime call
-ok - cleanup identity: valid tmux, Herdr, Zellij, Orca, and cmux records validate while every empty backend target refuses
+ok - cleanup identity: valid endpoints pass while ambiguous host ownership and empty backend targets refuse
 ok - tmux backend: direct empty target returns nonzero without invoking tmux
 ok - process cleanup: creation-time PID identity removes only the exact child and preserves the control child
-ok - fm-teardown: dedicated-socket invalid cleanup preserves target/control and valid cleanup removes only the exact target
+ok - fm-teardown: exact tmux cleanup preserves invalid and prefix-matched neighbors while removing only the recorded target
 ```
 
 The dedicated tmux cell removed ambient tmux variables, required a socket-bound wrapper, kept one target and one independent control window, and proved the wrapper was not called for invalid metadata or a direct empty target.
diff --git a/docs/verification/supervision.md b/docs/verification/supervision.md
index f11620a8da..3f21a955eb 100644
--- a/docs/verification/supervision.md
+++ b/docs/verification/supervision.md
@@ -87,7 +87,7 @@ A rebased Codex 0.145.0 scout repeated the integrated path on 2026-07-26 through
 It loaded the host and target instruction surfaces, preserved the separate target worktree, completed the decision inventory, emitted its task completion, retained the report, and cleaned up while the host's native startup lifecycle remained active.
 [`runtime-backends.md`](runtime-backends.md#host-root-task-routing) owns the exact spawn command and path-routing evidence.
 
-Pi 0.82.1 verified the one-host global activator on 2026-07-28.
+Pi 0.82.1 verified the one-host global activator on 2026-07-29.
 The focused real-runtime entry point was:
 
 ```sh
@@ -101,6 +101,7 @@ Observed output:
 0.82.1
 ok - install is host-read-only, PI_CODING_AGENT_DIR-aware, and idempotent
 ok - install refuses ambient FM conflicts and unmanaged files
+ok - install rejects physical ancestor and descendant host/home overlap
 ok - real Pi preserves host resources, loads FirstMate resources, and stays dormant elsewhere
 ok - uninstall removes only its owned file
 ```

From bd0812ae8a4a137988c2d4dbab9534a7a5ceac62 Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Wed, 29 Jul 2026 13:18:06 +0300
Subject: [PATCH 34/39] no-mistakes(lint): Captain: fix ShellCheck empty local
 declaration

---
 bin/fm-host-root-lib.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bin/fm-host-root-lib.sh b/bin/fm-host-root-lib.sh
index 86c84f6dec..9600cf0542 100644
--- a/bin/fm-host-root-lib.sh
+++ b/bin/fm-host-root-lib.sh
@@ -90,7 +90,7 @@ fm_host_root_recorded_owner() {
 }
 
 fm_host_root_assert_task_cwd() {
-  local fm_root=$1 meta=$2 recorded kind= host ambient cwd status kind_count
+  local fm_root=$1 meta=$2 recorded kind='' host ambient cwd status kind_count
   if recorded=$(fm_host_root_recorded_owner "$meta"); then
     :
   else

From 606e458065d976b511357e3eb2d7bb55bf1166f9 Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Thu, 30 Jul 2026 10:33:39 +0300
Subject: [PATCH 35/39] no-mistakes(review): Captain: guard host-root Pi
 workers from supervisor activation

---
 .pi/extensions/lib/fm-host-activator.ts |  6 +++++-
 tests/fm-host-setup.test.sh             | 23 +++++++++++++++++++++++
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/.pi/extensions/lib/fm-host-activator.ts b/.pi/extensions/lib/fm-host-activator.ts
index d8bc91c3af..febe46e319 100644
--- a/.pi/extensions/lib/fm-host-activator.ts
+++ b/.pi/extensions/lib/fm-host-activator.ts
@@ -89,7 +89,11 @@ export default async function activateFirstmateHost(
 	pi: ExtensionAPI,
 	config: FirstmateHostConfig,
 ): Promise<void> {
-	if (physicalPath(process.cwd()) !== config.hostRoot) return;
+	if (
+		process.env.FM_TARGET_WORKTREE ||
+		physicalPath(process.cwd()) !== config.hostRoot
+	)
+		return;
 
 	const invalid = validateConfig(config);
 	if (invalid) {
diff --git a/tests/fm-host-setup.test.sh b/tests/fm-host-setup.test.sh
index 4fa61e8c95..1c87ed77fb 100755
--- a/tests/fm-host-setup.test.sh
+++ b/tests/fm-host-setup.test.sh
@@ -41,6 +41,29 @@ assert_contains "$status_out" "host: $(cd "$HOST" && pwd -P)" "status did not re
 assert_contains "$status_out" "firstmate home: $(cd "$FM_HOME_DIR" && pwd -P)" "status did not report the FirstMate home"
 pass "install is host-read-only, PI_CODING_AGENT_DIR-aware, and idempotent"
 
+WORKER_TARGET="$LAB/worker-target"
+mkdir -p "$WORKER_TARGET" "$FM_HOME_DIR/state"
+node --experimental-strip-types --input-type=module - "$ACTIVATOR" "$HOST" "$WORKER_TARGET" \
+	"$(cd "$ROOT" && pwd -P)" "$(cd "$FM_HOME_DIR" && pwd -P)" <<'JS'
+import { pathToFileURL } from "node:url";
+const [activator, host, target, root, home] = process.argv.slice(2);
+process.chdir(host);
+Object.assign(process.env, {
+  FM_ROOT_OVERRIDE: root,
+  FM_HOME: home,
+  FM_HOST_ROOT: host,
+  FM_BACKEND: "herdr",
+  FM_TARGET_WORKTREE: target,
+});
+const events = [];
+const pi = { on: (event) => events.push(event) };
+await (await import(pathToFileURL(activator).href)).default(pi);
+if (events.length) throw new Error(`host worker registered supervisor events: ${events.join(", ")}`);
+JS
+assert_absent "$FM_HOME_DIR/state/.pi-turnend-extension-loaded" "host worker loaded the guard extension"
+assert_absent "$FM_HOME_DIR/state/.pi-watch-extension-loaded" "host worker loaded the watch extension"
+pass "host-root Pi workers do not load FirstMate supervisor policy or extensions"
+
 CONFLICT_PI="$LAB/conflict-pi"
 set +e
 conflict_out=$(FM_HOME="$LAB/conflict" PI_CODING_AGENT_DIR="$CONFLICT_PI" HOME="$FAKE_HOME" \

From 39e72446e21be015740517601336bdd538fc27f3 Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Thu, 30 Jul 2026 10:46:34 +0300
Subject: [PATCH 36/39] no-mistakes(document): Document Pi host-root worker
 activation guard

---
 bin/fm-host-setup.sh             | 3 ++-
 docs/configuration.md            | 4 ++--
 docs/verification/supervision.md | 3 ++-
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/bin/fm-host-setup.sh b/bin/fm-host-setup.sh
index dc5eedfab6..a451fb4172 100755
--- a/bin/fm-host-setup.sh
+++ b/bin/fm-host-setup.sh
@@ -6,7 +6,8 @@
 #        fm-host-setup.sh uninstall
 #
 # The activator is installed under ${PI_CODING_AGENT_DIR:-~/.pi/agent} and is
-# dormant unless Pi's physical cwd equals the configured host root.
+# dormant unless Pi's physical cwd equals the configured host root and
+# FM_TARGET_WORKTREE is unset.
 # Install updates only a file carrying this script's ownership marker, refuses
 # conflicting ambient FM_ROOT_OVERRIDE/FM_HOME/FM_HOST_ROOT/FM_BACKEND values,
 # and writes nothing into the host repository.
diff --git a/docs/configuration.md b/docs/configuration.md
index 3524788e26..c099f145c5 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -187,8 +187,8 @@ Unset or empty preserves the normal behavior in which FirstMate runs from its tr
 For Pi, run `bin/fm-host-setup.sh install <host-root> --backend herdr` once, then run plain `pi` from that exact physical host root.
 Use `--home <firstmate-home>` when operational state belongs outside this tracked FirstMate root, and use the script's `status` and `uninstall` actions to inspect or remove the managed activation.
 The setup writes only one owned global Pi extension under `${PI_CODING_AGENT_DIR:-~/.pi/agent}`, never edits the host, and refuses unmanaged target files or conflicting ambient FirstMate root, home, host, or backend variables.
-At the configured host, the global extension sets the four root/backend variables, loads FirstMate's existing Pi guard and watcher extensions, exposes FirstMate's internal skills, appends the supervisor policy after the host context, and displays `FirstMate active` in Pi's status line.
-Outside that exact physical host it contributes no environment, policy, skills, tools, or lifecycle behavior.
+For a primary Pi session at the configured host, the global extension sets the four root/backend variables, loads FirstMate's existing Pi guard and watcher extensions, exposes FirstMate's internal skills, appends the supervisor policy after the host context, and displays `FirstMate active` in Pi's status line.
+Outside that exact physical host, or in a host-root worker carrying `FM_TARGET_WORKTREE`, it contributes no environment, policy, skills, tools, or lifecycle behavior.
 The host's normal Pi project trust decision still controls its project-local instructions, skills, and extensions.
 Other harness integrations must provide the same additive policy and adapter loading before setting `FM_HOST_ROOT`; setting the variable alone is still only the low-level runtime contract.
 When set, the value must resolve to an existing directory containing the cross-harness `AGENTS.md` instruction surface, it must not physically overlap `FM_ROOT` or `FM_HOME`, and the supervisor must run with its physical cwd at that directory.
diff --git a/docs/verification/supervision.md b/docs/verification/supervision.md
index 3f21a955eb..3a6ea1dae1 100644
--- a/docs/verification/supervision.md
+++ b/docs/verification/supervision.md
@@ -87,7 +87,7 @@ A rebased Codex 0.145.0 scout repeated the integrated path on 2026-07-26 through
 It loaded the host and target instruction surfaces, preserved the separate target worktree, completed the decision inventory, emitted its task completion, retained the report, and cleaned up while the host's native startup lifecycle remained active.
 [`runtime-backends.md`](runtime-backends.md#host-root-task-routing) owns the exact spawn command and path-routing evidence.
 
-Pi 0.82.1 verified the one-host global activator on 2026-07-29.
+Pi 0.82.1 verified the one-host global activator on 2026-07-29 and the host-root worker exclusion on 2026-07-30.
 The focused real-runtime entry point was:
 
 ```sh
@@ -100,6 +100,7 @@ Observed output:
 ```text
 0.82.1
 ok - install is host-read-only, PI_CODING_AGENT_DIR-aware, and idempotent
+ok - host-root Pi workers do not load FirstMate supervisor policy or extensions
 ok - install refuses ambient FM conflicts and unmanaged files
 ok - install rejects physical ancestor and descendant host/home overlap
 ok - real Pi preserves host resources, loads FirstMate resources, and stays dormant elsewhere

From 8caebe35fed2f8b004fe25a70fc7685e33ac8b3c Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Sat, 1 Aug 2026 09:33:57 +0300
Subject: [PATCH 37/39] fix(host-root): launch workers from target worktrees

---
 .agents/skills/harness-adapters/SKILL.md      | 25 +++---
 .../skills/stuck-crewmate-recovery/SKILL.md   |  2 +-
 AGENTS.md                                     |  2 +-
 README.md                                     |  2 +-
 bin/fm-brief.sh                               | 64 ++------------
 bin/fm-spawn.sh                               | 21 ++---
 docs/architecture.md                          |  4 +-
 docs/configuration.md                         | 25 +++---
 docs/orca-backend.md                          |  2 +-
 docs/verification/runtime-backends.md         | 18 ++--
 docs/verification/supervision.md              |  5 +-
 tests/fm-backend-herdr-host-root-e2e.test.sh  | 10 +--
 tests/fm-backend-orca.test.sh                 | 86 +++++++++++++++++--
 tests/fm-host-root-mode.test.sh               | 56 +++++-------
 14 files changed, 163 insertions(+), 159 deletions(-)

diff --git a/.agents/skills/harness-adapters/SKILL.md b/.agents/skills/harness-adapters/SKILL.md
index c2eb2293d2..2faf810d45 100644
--- a/.agents/skills/harness-adapters/SKILL.md
+++ b/.agents/skills/harness-adapters/SKILL.md
@@ -105,20 +105,19 @@ When changing any primary watcher adapter, update `docs/supervision-protocols/`,
 
 ## Host-root task integration
 
-When `FM_HOST_ROOT` is set for an ordinary ship or scout, the harness starts from that physical host root and receives the isolated target separately as `FM_TARGET_WORKTREE`.
-The host's discovered instructions and lifecycle adapters remain authoritative; target instructions are read explicitly under the host-root brief before edits.
-FirstMate adds exactly one task turn-end signal without writing host configuration:
+When `FM_HOST_ROOT` is set, only the primary supervisor starts from that physical host root.
+Ordinary ship and scout harnesses start from their isolated `FM_TARGET_WORKTREE`, so the target repository's instructions and lifecycle adapters load natively while the host context stays out of focused worker sessions.
+FirstMate retains one task completion signal per harness and passes the host and target identities for supervision and recovery without changing the worker cwd:
 
-| Harness | Additive task signal in host-root mode |
+| Harness | Task completion signal in host-root mode |
 |---|---|
-| claude | An additional state-owned settings file passed with `--settings`; Claude continues loading host project settings. |
-| codex | The existing per-launch `notify` command; host `.codex/hooks.json` remains untouched. |
-| opencode | A state-owned task plugin named through `OPENCODE_CONFIG_CONTENT`; host project plugins continue to auto-load from the launch cwd. |
-| pi | The existing explicit state-owned `-e` task extension; host project extensions continue to auto-load after host trust. |
-| grok | The guarded global FirstMate Stop hook reads a per-process `FM_GROK_TURNEND_TOKEN`; host project hooks remain untouched and no pointer is written into the host repository. |
-| kimi | The guarded global FirstMate Stop hook reads a per-process `FM_KIMI_TURNEND_TOKEN`; host configuration remains otherwise untouched and no pointer is written into the host repository. |
-
-Default worktree-root launches retain their existing hook locations and command shapes.
+| claude | A state-owned settings file passed with `--settings`; target project settings still load from the worker cwd. |
+| codex | The existing per-launch `notify` command. |
+| opencode | A state-owned task plugin named through `OPENCODE_CONFIG_CONTENT`; target project plugins load from the worker cwd. |
+| pi | The existing explicit state-owned `-e` task extension; target project extensions remain subject to target trust. |
+| grok | The guarded global FirstMate Stop hook reads a per-process `FM_GROK_TURNEND_TOKEN`. |
+| kimi | The guarded global FirstMate Stop hook reads a per-process `FM_KIMI_TURNEND_TOKEN`. |
+
 Secondmate launches explicitly clear inherited `FM_HOST_ROOT` and `FM_TARGET_WORKTREE` and retain their isolated-home adapters.
 
 [`docs/verification/supervision.md`](../../../docs/verification/supervision.md#host-root-task-integration) owns the dated lifecycle evidence and current live-verification limits for these task adapters.
@@ -340,7 +339,7 @@ The tmux backend's structural `fm_tmux_composer_state` read sees placeholder-fil
 The Herdr adapter (`fm_backend_herdr_composer_state`, `bin/backends/herdr.sh`) classifies the composer's own row structurally instead of diffing raw content; see `docs/herdr-backend.md` "Composer and injection safety" for the current boundary and `tests/fm-backend-herdr.test.sh` for regression coverage.
 
 Startup dialog: the "Run Grok Build in a project directory?" project picker appears ONLY when grok is launched from a non-project directory (home, Desktop, Downloads, `/tmp`).
-Default `fm-spawn` launches inside the treehouse worktree, while host-root mode launches from `FM_HOST_ROOT`; either launch root must be a recognized project directory to avoid the picker.
+Every ordinary `fm-spawn`, including host-root mode, launches inside the isolated target worktree, which must be a recognized project directory to avoid the picker.
 Pin `[hints] project_picker_disabled = true` in `~/.grok/config.toml` if a non-project launch ever needs to skip it.
 
 **TRUECOLOR placeholder styling: covered (task afk-herdr-false-pending, 2026-07-10).**
diff --git a/.agents/skills/stuck-crewmate-recovery/SKILL.md b/.agents/skills/stuck-crewmate-recovery/SKILL.md
index c9a26e2cf2..b371d4d3d2 100644
--- a/.agents/skills/stuck-crewmate-recovery/SKILL.md
+++ b/.agents/skills/stuck-crewmate-recovery/SKILL.md
@@ -31,7 +31,7 @@ Do not sweep another home's endpoints or infer ownership from a matching window
 
 Before relaunch, prove that no live agent still owns the recorded task and that the existing worktree remains available.
 Preserve its uncommitted changes and commits, keep the same task identity, and resume or relaunch the recorded harness in that existing worktree with the same brief plus a concise progress note.
-For a host-root task, keep the recorded physical `host_root=` as the harness cwd and pass the existing recorded worktree separately as `FM_TARGET_WORKTREE`; [`docs/configuration.md`](../../../docs/configuration.md#host-root-mode-fm_host_root) owns that four-root exception.
+For a host-root task, relaunch the harness from the existing recorded worktree, pass it as `FM_TARGET_WORKTREE`, and retain the recorded physical `host_root=` only as the supervisor authority; [`docs/configuration.md`](../../../docs/configuration.md#host-root-mode-fm_host_root) owns that four-root contract.
 Do not use a fresh generic spawn while the recorded worktree is unaccounted for, because allocating another worktree can split one task across two copies.
 If the worktree or ownership cannot be reconciled safely, leave all state intact and report the task failed or blocked with the conflicting evidence.
 
diff --git a/AGENTS.md b/AGENTS.md
index 63406c9264..b4a60db9b7 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -48,7 +48,7 @@ Never add an agent name as a commit co-author.
 
 `docs/configuration.md` is the single owner of the top-level operational-home layout and configuration schemas; each producing script's header and help own exact child fields and mutation mechanics.
 `FM_HOME` selects an instance's private `data/`, `state/`, `config/`, and `projects/`, while scripts continue to come from their tracked code root.
-Optional `FM_HOST_ROOT` keeps another repository authoritative for instructions, lifecycle, and cwd while ordinary task edits stay under explicit `FM_TARGET_WORKTREE`; `docs/configuration.md` owns the four-root contract.
+Optional `FM_HOST_ROOT` keeps another repository authoritative for the primary supervisor's instructions, lifecycle, and cwd while ordinary workers launch from their isolated `FM_TARGET_WORKTREE`; `docs/configuration.md` owns the four-root contract.
 Each secondmate has a persistent isolated `FM_HOME`, including its own state, backlog, projects, and session lock, and secondmate launches clear any inherited host-root variables.
 `bin/fm-send.sh` fails closed unless `FM_HOME` is explicit, so a steer cannot silently resolve against another home.
 
diff --git a/README.md b/README.md
index 3f00dd8b83..d80b1275fb 100644
--- a/README.md
+++ b/README.md
@@ -44,7 +44,7 @@ Launching a supported harness inside it instantiates your first mate - and makes
 - **One liaison** - you talk only to the first mate; it dispatches, supervises, escalates only real decisions, and reports plain outcomes.
 - **A visible crew** - every crewmate works in its own tmux window, experimental herdr/zellij tab, cmux workspace, or Orca terminal you can watch or type into; the first mate reconciles.
 - **Disposable worktrees** - each task runs in a clean [treehouse](https://github.com/kunchenguid/treehouse) git worktree, or an Orca-managed worktree when `backend=orca`, so parallel work on one repo never collides.
-- **Optional host-root mode** - an explicitly integrated supervisor can keep an existing command-center repository authoritative for instructions, lifecycle hooks, and worker cwd while FirstMate retains its own code/home and every task edits an explicit isolated target worktree; see [configuration](docs/configuration.md#host-root-mode-fm_host_root).
+- **Optional host-root mode** - an explicitly integrated supervisor can keep an existing command-center repository authoritative for its instructions and lifecycle hooks while FirstMate retains its own code/home and every focused worker launches from its isolated target worktree; see [configuration](docs/configuration.md#host-root-mode-fm_host_root).
 - **Two task shapes** - ship tasks deliver authorized changes; scout tasks leave standalone investigation reports when the intake contract warrants separate research.
 - **Explicit project modes** - each project ships via `no-mistakes`, `direct-PR`, or `local-only`, with an optional `+yolo` autonomy flag.
 - **Optional secondmates** - opt in to persistent second mates that run from isolated firstmate homes with their own `FM_HOME`, state, projects, and session lock, supervising project clones or a project-less firstmate-repo domain, kept on the primary firstmate version by guarded local fast-forwards and checked for live agent processes at session start.
diff --git a/bin/fm-brief.sh b/bin/fm-brief.sh
index 1074f4a029..0708299750 100755
--- a/bin/fm-brief.sh
+++ b/bin/fm-brief.sh
@@ -164,30 +164,15 @@ PROJECT_MEMORY_CONTEXT='in the worktree'
 if [ "$HOST_MODE" -eq 1 ]; then
   EXECUTION_MARKER='<!-- firstmate-execution-mode: host-root -->'
   IFS= read -r -d '' EXECUTION_SECTION <<'EOF' || true
-# Host-root execution contract
-Your top-level process cwd is the physical host instruction root `__HOST_ROOT__`, not the target repository.
-The host root is authoritative for identity, startup, lifecycle, and cross-repository safety; keep it read-only except for effects produced by its own native lifecycle hooks.
-The isolated target worktree is the exact path in `$FM_TARGET_WORKTREE`.
-Before any edit, verify `[ "$(pwd -P)" = "$FM_HOST_ROOT" ]` and verify the physical result of `git -C "$FM_TARGET_WORKTREE" rev-parse --show-toplevel` equals the physical `$FM_TARGET_WORKTREE` path.
-Use `git -C "$FM_TARGET_WORKTREE" worktree list --porcelain` to identify the target primary clone and confirm its physical path differs from `$FM_TARGET_WORKTREE`.
-Read the target worktree root instructions and every applicable nested instruction file before editing; host instructions remain authoritative when the two surfaces conflict, and an unresolved conflict is a needs-decision rather than permission to guess.
-Use absolute paths, `git -C "$FM_TARGET_WORKTREE" ...`, or a scoped subshell for every target operation while keeping the top-level process cwd at the host root.
-Run tests, builds, GitHub tooling, and no-mistakes against `$FM_TARGET_WORKTREE` only; never run a bare target command from the host repository.
+# External-supervisor execution contract
+Your supervisor runs from the physical host instruction root `__HOST_ROOT__`, but your process starts inside the isolated target worktree.
+Before any edit, verify `pwd -P`, `git rev-parse --show-toplevel`, and the physical `$FM_TARGET_WORKTREE` path all identify this same isolated worktree.
+Read the target repository's root instructions and every applicable nested instruction file before editing; those target instructions are authoritative for this focused task.
+Do not read or modify `$FM_HOST_ROOT` unless the task explicitly names it as the target repository.
 EOF
   EXECUTION_SECTION=${EXECUTION_SECTION%$'\n'}
   EXECUTION_SECTION=${EXECUTION_SECTION//__HOST_ROOT__/$HOST_ROOT}
   CREW_INTRO="$CREW_INTRO"$'\n'"$EXECUTION_MARKER"$'\n'"$EXECUTION_SECTION"
-  # shellcheck disable=SC2016  # These variables are literal Markdown instructions for the worker.
-  SETUP_LOCATION='You are launched from the host instruction root; the disposable target git worktree is in `$FM_TARGET_WORKTREE` at a detached HEAD on a clean default branch.'
-  # shellcheck disable=SC2016
-  STAY_RULE='Keep the host root read-only and write target code only under `$FM_TARGET_WORKTREE`; the report and status file named below are the only other task artifacts you may write.'
-  # shellcheck disable=SC2016
-  SCOUT_STAY_RULE='Keep the host root read-only and write target code only under `$FM_TARGET_WORKTREE`; the report and status file below are the only other task artifacts you may write.'
-  # shellcheck disable=SC2016
-  BRANCH_COMMAND='`git -C "$FM_TARGET_WORKTREE" checkout -b fm/'"$ID"'`'
-  # shellcheck disable=SC2016
-  PROJECT_MEMORY_TARGET='"$FM_TARGET_WORKTREE"'
-  PROJECT_MEMORY_CONTEXT='for the target worktree'
 fi
 
 if [ "$KIND" = secondmate ]; then
@@ -277,17 +262,12 @@ fi
 
 REPO=${POS[1]}
 SETUP_LOCATION=${SETUP_LOCATION//__REPO__/$REPO}
-if [ "$HOST_MODE" -eq 1 ]; then
-  # shellcheck disable=SC2016  # Literal Markdown, not shell expansion.
-  ISOLATION_SECTION='**Verify isolation before anything else.** Follow the host-root execution contract above. If the host cwd or target worktree check fails, append `blocked: host-root or isolated target verification failed` and stop before branching or editing.'
-else
-  IFS= read -r -d '' ISOLATION_SECTION <<'EOF' || true
+IFS= read -r -d '' ISOLATION_SECTION <<'EOF' || true
 **Verify isolation before anything else.** Run `pwd -P` and `git rev-parse --show-toplevel`; both must resolve to the disposable task worktree you were launched in, such as a treehouse pool path or an Orca-managed worktree, not the primary checkout firstmate operates from.
 The path check is authoritative: `git rev-parse --git-dir` and `git rev-parse --git-common-dir` can help inspect the repo, but they do not prove you are outside the primary checkout.
 If the top-level path is the primary checkout or not the worktree you were launched in, STOP - do not branch or commit here - append `blocked: launched in primary checkout, not an isolated worktree` to the status file and stop.
 EOF
-  ISOLATION_SECTION=${ISOLATION_SECTION%$'\n'}
-fi
+ISOLATION_SECTION=${ISOLATION_SECTION%$'\n'}
 
 if [ "$HERDR_LAB" -eq 1 ]; then
 HERDR_LAB_HELPER=$(shell_quote "$FM_ROOT/bin/fm-herdr-lab.sh")
@@ -405,35 +385,10 @@ The configured merge authority approves the ready branch, then firstmate merges
 EOF
     ;;
   *)  # no-mistakes (default)
-    if [ "$HOST_MODE" -eq 1 ]; then
-      SETUP2="
-2. Run \`(cd \"\$FM_TARGET_WORKTREE\" && no-mistakes doctor)\`; if it reports the repo is not initialized there, run \`(cd \"\$FM_TARGET_WORKTREE\" && no-mistakes init)\`."
-    else
-      SETUP2="
+    SETUP2="
 2. Run \`no-mistakes doctor\`; if it reports the repo is not initialized here, run \`no-mistakes init\`."
-    fi
     RULE1='1. Never push to the default branch. Never merge a PR.'
-    if [ "$HOST_MODE" -eq 1 ]; then
-      IFS= read -r -d '' DOD <<'EOF' || true
-# Definition of done
-The task is complete only when committed on your branch.
-When you believe it is complete, append `done: {summary}` to the status file and stop.
-Firstmate will then instruct you to invoke /no-mistakes for `$FM_TARGET_WORKTREE` to validate and ship a PR.
-Before invoking it, name that target explicitly and run every no-mistakes CLI command through `(cd "$FM_TARGET_WORKTREE" && no-mistakes ...)`; never let validation default to the host cwd.
-
-You drive no-mistakes by responding to its gates, not by implementing fixes.
-Follow the guidance no-mistakes itself provides for the mechanics: it loads when you invoke /no-mistakes, and `(cd "$FM_TARGET_WORKTREE" && no-mistakes axi run --help)` plus the `help` lines in each `axi` response are authoritative and version-matched to the installed binary.
-Do not hand-edit, commit, or fix findings yourself while a run is active - the pipeline applies every fix.
-
-Two firstmate-specific rules layer on top of that guidance:
-- ask-user findings are not yours to answer: escalate to firstmate (rule 6) and stop.
-  When the decision comes back, feed it to the gate through `(cd "$FM_TARGET_WORKTREE" && no-mistakes axi respond ...)` and let the pipeline apply it - do not route the question to "the user" or implement the fix yourself.
-- Avoid `--yes`: the captain, not you, owns the ask-user decisions it would silently auto-resolve.
-
-After /no-mistakes reports CI green (the CI-ready return point - do not wait for it to keep monitoring in the background until merge), append `done: PR {url} checks green` and stop. You are finished.
-EOF
-    else
-      IFS= read -r -d '' DOD <<EOF || true
+    IFS= read -r -d '' DOD <<EOF || true
 # Definition of done
 The task is complete only when committed on your branch.
 When you believe it is complete, append \`done: {summary}\` to the status file and stop.
@@ -451,7 +406,6 @@ Two firstmate-specific rules layer on top of that guidance:
 
 After /no-mistakes reports CI green (the CI-ready return point - do not wait for it to keep monitoring in the background until merge), append \`done: PR {url} checks green\` and stop. You are finished.
 EOF
-    fi
     ;;
 esac
 
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 1d21f70506..e5d0b2a594 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -91,8 +91,8 @@
 #   Ship/scout spawns refuse to launch unless the resolved task path is a real
 #   git worktree root distinct from the primary project checkout. With optional
 #   FM_HOST_ROOT set, validation happens before the guard or endpoint mutation;
-#   the endpoint then returns to that physical host cwd and the child receives
-#   the isolated target as FM_TARGET_WORKTREE. Failed spawns before launch submission
+#   the supervisor remains rooted at the host while each ordinary worker launches
+#   from its isolated target worktree with that path in FM_TARGET_WORKTREE. Failed spawns before launch submission
 #   stop and verify the endpoint before returning the isolated copy, remove task-owned
 #   pre-record artifacts on success, and retain recovery metadata when rollback is
 #   incomplete. An ambiguous final Enter retains the endpoint, worktree, and metadata.
@@ -1593,19 +1593,10 @@ if [ "$KIND" != secondmate ] && [ "$BACKEND" != orca ]; then
   validate_spawn_worktree "treehouse get" "$T"
 fi
 
-if [ "$HOST_MODE" -eq 1 ]; then
-  HOST_CWD_ATTEMPTS=${FM_HOST_CWD_ATTEMPTS:-30}
-  HOST_CWD_DELAY=${FM_HOST_CWD_DELAY:-1}
-  case "$HOST_CWD_ATTEMPTS" in ''|*[!0-9]*|0) HOST_CWD_ATTEMPTS=30 ;; esac
-  spawn_send_text_line "$T" "cd -- $(shell_quote "$HOST_ROOT")"
-  for _ in $(seq 1 "$HOST_CWD_ATTEMPTS"); do
-    p=$(spawn_current_path "$T" || true)
-    [ "$(real_path_or_raw "$p")" = "$HOST_ROOT" ] && break
-    p=
-    sleep "$HOST_CWD_DELAY"
-  done
-  if [ -z "${p:-}" ] || [ "$(real_path_or_raw "$p")" != "$HOST_ROOT" ]; then
-    echo "error: backend endpoint did not enter FM_HOST_ROOT $HOST_ROOT; inspect target $T" >&2
+if [ "$HOST_MODE" -eq 1 ] && [ "$BACKEND" = orca ]; then
+  p=$(spawn_current_path "$T" || true)
+  if [ "$(real_path_or_raw "$p")" != "$(real_path_or_raw "$WT")" ]; then
+    echo "error: Orca endpoint did not enter FM_TARGET_WORKTREE $WT; inspect target $T" >&2
     exit 1
   fi
 fi
diff --git a/docs/architecture.md b/docs/architecture.md
index abfb0a68e3..b69c78543b 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -114,8 +114,8 @@ Codex App support is recorded in `docs/codex-app-backend.md`; it is not selectab
 
 ## Worktrees, not branches in your checkout
 
-The default launch cwd remains the isolated task worktree.
-The optional host-root exception is owned by [configuration.md's four-root runtime contract](configuration.md#host-root-mode-fm_host_root).
+Every ordinary worker launches from its isolated task worktree.
+The optional host-root mode changes the primary supervisor's instruction root without changing that worker-cwd invariant; [configuration.md's four-root runtime contract](configuration.md#host-root-mode-fm_host_root) owns the details.
 
 Crewmates never intentionally touch your project clone; [treehouse](https://github.com/kunchenguid/treehouse) pools clean worktrees for tmux, herdr, zellij, and cmux tasks, while Orca creates its own worktrees for `backend=orca`.
 For ship and scout work, `fm-spawn.sh` refuses to launch unless the resolved task path is a real git worktree root that is distinct from the project primary checkout.
diff --git a/docs/configuration.md b/docs/configuration.md
index c099f145c5..d23709835b 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -198,26 +198,25 @@ Host mode separates four roots:
 
 - `FM_ROOT` is the tracked FirstMate code, skill, documentation, and script root.
 - `FM_HOME` is the private FirstMate operational home that owns `data/`, `state/`, `config/`, and `projects/`.
-- `FM_HOST_ROOT` is the host repository whose instructions, native lifecycle, and cwd remain authoritative.
-- `FM_TARGET_WORKTREE` is the per-task isolated target repository where code changes, Git operations, tests, builds, forge operations, and no-mistakes run.
+- `FM_HOST_ROOT` is the host repository whose instructions, native lifecycle, and cwd remain authoritative for the primary supervisor.
+- `FM_TARGET_WORKTREE` is the per-task isolated target repository and ordinary worker cwd where target instructions, code changes, Git operations, tests, builds, forge operations, and no-mistakes run.
 
 The physical target worktree must differ from the target project's primary checkout and must not overlap `FM_HOST_ROOT`.
-Ordinary ship and scout endpoints still acquire and validate their isolated target worktree first, retain it as `worktree=` metadata, then return the endpoint shell to the physical host root before launching the harness.
-A failed host transition stops and verifies the new endpoint before returning the acquired worktree, removes every task-owned pre-record artifact on successful rollback, and retains recovery metadata and the isolated path when endpoint termination or resource cleanup cannot be confirmed.
+Ordinary ship and scout endpoints acquire and validate their isolated target worktree, retain it as `worktree=` metadata, and launch the harness there.
 An overlap refusal stops the endpoint but never returns or removes the overlapping path automatically.
 An unconfirmed final launch submission retains the endpoint, worktree, task safeguards, and metadata because the worker may already be running.
-The child receives exact `FM_HOST_ROOT` and `FM_TARGET_WORKTREE` values, while task actions bind to the recorded physical `host_root=` before reading or changing task data and review, merge, evidence, and teardown continue to use the recorded `worktree=` path.
+The child receives exact `FM_HOST_ROOT` and `FM_TARGET_WORKTREE` values, while the worker stays rooted in the target and supervisor task actions bind to the recorded physical `host_root=` before reading or changing task data.
+Review, merge, evidence, and teardown continue to use the recorded `worktree=` path.
 Teardown stops and verifies the recorded worker endpoint before changing or returning its isolated copy.
 Every non-forced host-root ship teardown repeats worktree safety checks after the endpoint is confirmed stopped and before branch deletion or worktree return.
-Host-root briefs carry `<!-- firstmate-execution-mode: host-root -->`, require the worker to read host instructions first and applicable target instructions before edits, keep the host read-only except for host-owned lifecycle effects, and require explicit target paths or scoped subshells.
-The same target scoping applies to the complete no-mistakes lifecycle, including doctor, initialization, run, gate responses, and follow-up help commands; no validation command may default to the host cwd.
-Spawn rejects a cwd-relative legacy brief in host mode rather than weakening that contract silently.
+Host-root briefs carry `<!-- firstmate-execution-mode: host-root -->`, require the worker to verify its target cwd and read applicable target instructions, and keep the unrelated host context out of the worker session.
+Spawn rejects a legacy brief without that marker rather than weakening the contract silently.
 Host-root ship brief generation and spawn support `no-mistakes` and `direct-PR` delivery but reject `local-only` because its guarded landing path changes the target project's primary checkout.
 Host-root scouts may inspect `local-only` targets and retain their configured mode and autonomy, but promotion rejects them while that mode remains active.
 
-Harness integration is additive.
-The [`harness-adapters` skill](../.agents/skills/harness-adapters/SKILL.md#host-root-task-integration) owns each harness's task-signal shape; none writes or replaces host hook configuration, and each signal is installed once.
-The host repository's own lifecycle hooks continue to load from the host cwd.
+Harness integration is additive for the primary supervisor and target-native for ordinary workers.
+The [`harness-adapters` skill](../.agents/skills/harness-adapters/SKILL.md#host-root-task-integration) owns each harness's task-signal shape, and each signal is installed once.
+The host repository's lifecycle hooks remain limited to the supervisor session; target project hooks load from the worker cwd.
 Host-root ordinary tasks reject raw launch commands because an unverified command cannot guarantee the required task completion safeguard.
 
 Secondmates are intentionally outside host-root mode.
@@ -420,8 +419,8 @@ Runtime tuning via environment variables (defaults shown):
 
 ```sh
 FM_HOME=                 # optional operational home for most scripts, unset means this repo root; fm-send requires it explicitly
-FM_HOST_ROOT=            # optional physical host instruction root and primary/ordinary-worker cwd; unset preserves normal behavior
-FM_TARGET_WORKTREE=      # spawn-owned exact isolated target path for a host-root worker; secondmates clear it
+FM_HOST_ROOT=            # optional physical host instruction root and primary-supervisor cwd; unset preserves normal behavior
+FM_TARGET_WORKTREE=      # spawn-owned exact isolated target path and ordinary-worker cwd; secondmates clear it
 FM_ROOT_OVERRIDE=        # override firstmate repo root, tangle-guard target, and zellij/cmux home-title hash; also legacy whole-root override when FM_HOME is unset
 FM_STATE_OVERRIDE=       # alternate state dir, mainly for tests
 FM_DATA_OVERRIDE=        # alternate data dir, mainly for tests
diff --git a/docs/orca-backend.md b/docs/orca-backend.md
index 4d88dc8497..4181d8a304 100644
--- a/docs/orca-backend.md
+++ b/docs/orca-backend.md
@@ -52,7 +52,7 @@ Exact command flags and response parsing are owned by `bin/backends/orca.sh` and
 `fm-send.sh` types and verifies composer clearance, follows `oldestCursor` when Orca returns a limited page, and retries Enter without retyping when a slash popup first fills an argument placeholder.
 A bare shell row is `unknown`, not an empty agent composer.
 The watcher has no native Orca busy signal and uses the shared terminal-tail fallback.
-In host-root mode, spawn verifies the terminal's physical cwd after moving it to `FM_HOST_ROOT`, then launches with the Orca worktree retained as `FM_TARGET_WORKTREE`.
+In host-root mode, spawn keeps the terminal in the verified Orca worktree and launches with that cwd retained as `FM_TARGET_WORKTREE`; only the primary supervisor runs from `FM_HOST_ROOT`.
 
 Cleanup keeps all shared Firstmate safety checks.
 A scout still requires its report and completed decision inventory.
diff --git a/docs/verification/runtime-backends.md b/docs/verification/runtime-backends.md
index e03544e7a9..cdab7e2bdf 100644
--- a/docs/verification/runtime-backends.md
+++ b/docs/verification/runtime-backends.md
@@ -119,8 +119,8 @@ Claude, Codex, OpenCode, Pi, pi-signed, Grok, and Kimi share that backend cleanu
 
 ### Host-root task routing
 
-The rebased host-root path was live-verified on 2026-07-26 with tmux 3.7b, Treehouse 2.0.0, and Codex CLI 0.145.0 on Linux.
-The command shape was:
+The host-root path was reverified on 2026-08-01 with Herdr 0.7.5 and Treehouse 2.0.0 through the real isolated acceptance after ordinary workers moved back to their target worktree cwd.
+The supervisor-side invocation shape remains:
 
 ```sh
 cd "$host"
@@ -133,9 +133,17 @@ FM_BACKEND=tmux \
     --harness codex --scout
 ```
 
-The worker observed its physical cwd equal to `FM_HOST_ROOT`, its target Git root equal to the physical `FM_TARGET_WORKTREE`, and the target as a detached linked worktree distinct from the clean primary checkout.
-It loaded the host and target `AGENTS.md` files, completed the decision inventory, wrote the scout report outside both repositories, and cleaned up through `bin/fm-teardown.sh`.
-The host's native startup lifecycle remained active, so host-owned lifecycle effects were allowed rather than treated as task edits.
+The worker observed its physical cwd, target Git root, and `FM_TARGET_WORKTREE` all equal to the detached isolated target worktree, distinct from the clean primary checkout and `FM_HOST_ROOT`.
+It read the target `AGENTS.md` natively from that cwd, completed the decision inventory, wrote the scout report outside both repositories, and cleaned up through `bin/fm-teardown.sh`.
+The supervisor remained rooted in the host repository, which stayed clean and did not enter the worker context.
+The earlier 2026-07-26 live evidence with workers launched from `FM_HOST_ROOT` is superseded by this target-root contract.
+
+Current entry point and observed output:
+
+```sh
+bash tests/fm-backend-herdr-host-root-e2e.test.sh
+# ok - real Herdr host-root spawn, completion, decision inventory, and teardown
+```
 
 ## Herdr
 
diff --git a/docs/verification/supervision.md b/docs/verification/supervision.md
index 3a6ea1dae1..c2dfd40b44 100644
--- a/docs/verification/supervision.md
+++ b/docs/verification/supervision.md
@@ -83,8 +83,9 @@ tests/fm-grok-harness.test.sh
 tests/fm-kimi-harness.test.sh
 ```
 
-A rebased Codex 0.145.0 scout repeated the integrated path on 2026-07-26 through tmux 3.7b.
-It loaded the host and target instruction surfaces, preserved the separate target worktree, completed the decision inventory, emitted its task completion, retained the report, and cleaned up while the host's native startup lifecycle remained active.
+The integrated path was reverified on 2026-08-01 through Herdr 0.7.5 and Treehouse 2.0.0.
+The worker launched from the isolated target worktree, read target instructions natively, completed the decision inventory, emitted its task completion, retained the report, and cleaned up while the supervisor stayed rooted in the unchanged host repository.
+The earlier 2026-07-26 host-cwd worker evidence is superseded.
 [`runtime-backends.md`](runtime-backends.md#host-root-task-routing) owns the exact spawn command and path-routing evidence.
 
 Pi 0.82.1 verified the one-host global activator on 2026-07-29 and the host-root worker exclusion on 2026-07-30.
diff --git a/tests/fm-backend-herdr-host-root-e2e.test.sh b/tests/fm-backend-herdr-host-root-e2e.test.sh
index 9586fa5d2d..5f309cb0ca 100755
--- a/tests/fm-backend-herdr-host-root-e2e.test.sh
+++ b/tests/fm-backend-herdr-host-root-e2e.test.sh
@@ -66,9 +66,8 @@ set -u
   printf 'cwd=%s\n' "$(pwd -P)"
   printf 'host=%s\n' "$FM_HOST_ROOT"
   printf 'target=%s\n' "$FM_TARGET_WORKTREE"
-  printf 'target_top=%s\n' "$(git -C "$FM_TARGET_WORKTREE" rev-parse --show-toplevel)"
-  printf 'host_instructions=%s\n' "$(cat "$FM_HOST_ROOT/AGENTS.md")"
-  printf 'target_instructions=%s\n' "$(cat "$FM_TARGET_WORKTREE/AGENTS.md")"
+  printf 'target_top=%s\n' "$(git rev-parse --show-toplevel)"
+  printf 'target_instructions=%s\n' "$(cat ./AGENTS.md)"
 } > "$FM_HOME/worker-observation"
 printf 'worker edit\n' > "$FM_TARGET_WORKTREE/worker-edit.txt"
 mkdir -p "$FM_HOME/data/host-root-e2e"
@@ -103,12 +102,11 @@ PANE=$(sed -n 's/^herdr_pane_id=//p' "$META")
 [ -n "$PANE" ] || fail "spawn did not record the Herdr pane"
 HOST_REAL=$(cd "$HOST" && pwd -P)
 WT_REAL=$(cd "$WT" && pwd -P)
-assert_line "$OBS" "cwd=$HOST_REAL" "worker cwd was not the authoritative host"
+assert_line "$OBS" "cwd=$WT_REAL" "worker cwd was not the isolated target worktree"
 assert_line "$OBS" "host=$HOST_REAL" "worker FM_HOST_ROOT was incorrect"
 assert_line "$OBS" "target=$WT_REAL" "worker FM_TARGET_WORKTREE was incorrect"
 assert_line "$OBS" "target_top=$WT_REAL" "worker target was not the isolated Git root"
-assert_line "$OBS" "host_instructions=host instructions" "worker could not read host instructions"
-assert_line "$OBS" "target_instructions=target instructions" "worker could not read target instructions"
+assert_line "$OBS" "target_instructions=target instructions" "worker did not load target instructions from its cwd"
 assert_line "$META" "backend=herdr" "metadata did not retain the Herdr backend"
 assert_line "$META" "host_root=$HOST_REAL" "metadata did not retain host authority"
 [ -z "$(git -C "$HOST" status --short)" ] || fail "worker changed the host repository"
diff --git a/tests/fm-backend-orca.test.sh b/tests/fm-backend-orca.test.sh
index baf734781f..4390e0717f 100755
--- a/tests/fm-backend-orca.test.sh
+++ b/tests/fm-backend-orca.test.sh
@@ -23,8 +23,36 @@ next=$(( $(cat "$COUNT_FILE" 2>/dev/null || echo 0) + 1 ))
   for a in "$@"; do printf '\x1f%s' "$a"; done
   printf '\n'
 } >> "$LOG"
-if [ "${1:-}" = terminal ] && [ "${2:-}" = close ] && [ -n "${FM_ORCA_CLOSE_MUTATION:-}" ]; then
-  printf 'late worker edit\n' > "$FM_ORCA_CLOSE_MUTATION"
+if [ "${1:-}" = terminal ] && [ "${2:-}" = close ]; then
+  [ -z "${FM_ORCA_CLOSE_MUTATION:-}" ] || printf 'late worker edit\n' > "$FM_ORCA_CLOSE_MUTATION"
+  [ -z "${FM_ORCA_CWD_PATH:-}" ] || : > "$RESP/.cwd-closed"
+fi
+if [ -n "${FM_ORCA_CWD_PATH:-}" ] && [ "${1:-}" = terminal ] && [ "${2:-}" = send ]; then
+  text=
+  while [ "$#" -gt 0 ]; do
+    [ "$1" != --text ] || { text=${2:-}; break; }
+    shift
+  done
+  case "$text" in
+    *'__FM_ORCA_CWD_BEGIN_'*)
+      printf '%s\n' "$text" | grep -o '__FM_ORCA_CWD_[A-Z]*_[A-Za-z0-9_]*__' > "$RESP/.cwd-markers"
+      printf '{"ok":true}\n'
+      exit 0
+      ;;
+  esac
+fi
+if [ -n "${FM_ORCA_CWD_PATH:-}" ] && [ "${1:-}" = terminal ] && [ "${2:-}" = read ] && [ -f "$RESP/.cwd-markers" ]; then
+  if [ -e "$RESP/.cwd-closed" ]; then
+    printf '{"ok":false,"error":{"code":"terminal_not_found","message":"terminal closed"}}\n'
+    exit 0
+  fi
+  begin=$(head -1 "$RESP/.cwd-markers")
+  end=$(tail -1 "$RESP/.cwd-markers")
+  python3 - "$begin" "$FM_ORCA_CWD_PATH" "$end" <<'PY'
+import json, sys
+print(json.dumps({"result": {"terminal": {"tail": sys.argv[1:]}}}))
+PY
+  exit 0
 fi
 if [ "${1:-}" = status ] && [ "${FM_ORCA_STATUS_RESPONSE:-ready}" != sequence ]; then
   printf '{"ok":true,"result":{"runtime":{"reachable":true,"state":"ready"}}}\n'
@@ -560,24 +588,27 @@ test_spawn_preserves_pathless_orca_worktree_without_terminal_proof() {
 }
 
 test_spawn_writes_orca_metadata_and_launches_harness() {
-  local proj wt data state config id out log
+  local host proj wt data state config id out log
   id="orcaspawnz1"
+  host="$TMP_ROOT/spawn-host"
   proj="$TMP_ROOT/spawn-project"
   wt="$TMP_ROOT/spawn-wt"
   data="$TMP_ROOT/spawn-data"
   state="$TMP_ROOT/spawn-state"
   config="$TMP_ROOT/spawn-config"
   fm_git_worktree "$proj" "$wt" "fm/$id"
-  mkdir -p "$data/$id" "$state" "$config"
-  printf 'brief\n' > "$data/$id/brief.md"
+  mkdir -p "$host" "$TMP_ROOT/spawn-home" "$data/$id" "$state" "$config"
+  printf 'host instructions\n' > "$host/AGENTS.md"
+  printf '<!-- firstmate-execution-mode: host-root -->\nbrief\n' > "$data/$id/brief.md"
   touch "$state/.last-watcher-beat"
   orca_case spawn
   log="$LOG"
   printf '1\n' > "$RESP/1.exit"
   printf '{"ok":true,"result":{"repo":{"id":"repo-spawn"}}}\n' > "$RESP/2.out"
   printf '{"ok":true,"result":{"worktree":{"id":"wt-spawn","path":"%s"},"terminal":{"handle":"term-spawn"}}}\n' "$wt" > "$RESP/3.out"
-  out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
-    FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
+  out=$(cd "$host" && PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" FM_ORCA_CWD_PATH="$wt" \
+    FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$TMP_ROOT/spawn-home" FM_HOST_ROOT="$host" \
+    FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" FM_SPAWN_NO_GUARD=1 \
     "$ROOT/bin/fm-spawn.sh" "$id" "$proj" claude --backend orca 2>&1 )
   expect_code 0 $? "fm-spawn.sh --backend orca should succeed with fake Orca"$'\n'"$out"
@@ -588,14 +619,50 @@ test_spawn_writes_orca_metadata_and_launches_harness() {
   assert_grep "terminal=term-spawn" "$state/$id.meta" "meta missing terminal handle"
   assert_grep "orca_worktree_id=wt-spawn" "$state/$id.meta" "meta missing Orca worktree id"
   assert_grep "worktree=$wt" "$state/$id.meta" "meta missing Orca worktree path"
+  assert_grep "host_root=$host" "$state/$id.meta" "meta missing host supervisor authority"
+  assert_contains "$(cat "$log")" 'pwd -P' "host-root Orca spawn did not verify the terminal target cwd"
   assert_not_contains "$(cat "$log")" $'orca\x1f''terminal'$'\x1f''create' \
     "spawn should reuse the implicit terminal returned by Orca worktree creation"
   assert_contains "$(cat "$log")" $'orca\x1f''terminal'$'\x1f''send'$'\x1f''--terminal'$'\x1f''term-spawn'$'\x1f''--text'$'\x1f''export GOTMPDIR=/tmp/fm-orcaspawnz1/gotmp'$'\x1f''--enter'$'\x1f''--json' \
     "spawn did not export GOTMPDIR through the Orca terminal"
-  assert_contains "$(cat "$log")" "CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false claude --dangerously-skip-permissions" \
+  assert_contains "$(cat "$log")" "CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false claude --settings" \
     "spawn did not send the selected harness launch command through Orca"
   rm -rf "/tmp/fm-$id"
-  pass "fm-spawn.sh --backend orca: reuses implicit terminal, records metadata, launches harness"
+  pass "fm-spawn.sh --backend orca: verifies target cwd, records metadata, launches harness"
+}
+
+test_host_root_spawn_refuses_wrong_orca_terminal_cwd() {
+  local host proj wt data state config id out status=0
+  id="orcacwdz2"
+  host="$TMP_ROOT/cwd-host"
+  proj="$TMP_ROOT/cwd-project"
+  wt="$TMP_ROOT/cwd-wt"
+  data="$TMP_ROOT/cwd-data"
+  state="$TMP_ROOT/cwd-state"
+  config="$TMP_ROOT/cwd-config"
+  fm_git_worktree "$proj" "$wt" "fm/$id"
+  mkdir -p "$host" "$TMP_ROOT/cwd-home" "$data/$id" "$state" "$config"
+  printf 'host instructions\n' > "$host/AGENTS.md"
+  printf '<!-- firstmate-execution-mode: host-root -->\nbrief\n' > "$data/$id/brief.md"
+  touch "$state/.last-watcher-beat"
+  orca_case cwd-refusal
+  printf '1\n' > "$RESP/1.exit"
+  printf '{"ok":true,"result":{"repo":{"id":"repo-cwd"}}}\n' > "$RESP/2.out"
+  printf '{"ok":true,"result":{"worktree":{"id":"wt-cwd","path":"%s"},"terminal":{"handle":"term-cwd"}}}\n' "$wt" > "$RESP/3.out"
+  out=$(cd "$host" && PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" FM_ORCA_CWD_PATH="$host" \
+    FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$TMP_ROOT/cwd-home" FM_HOST_ROOT="$host" \
+    FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
+    FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" FM_SPAWN_NO_GUARD=1 \
+    "$ROOT/bin/fm-spawn.sh" "$id" "$proj" claude --backend orca 2>&1) || status=$?
+  [ "$status" -ne 0 ] || fail "host-root Orca spawn accepted a terminal outside the target worktree"
+  assert_contains "$out" "did not enter FM_TARGET_WORKTREE $wt" \
+    "wrong Orca terminal cwd refusal did not explain the target requirement"
+  assert_contains "$(cat "$LOG")" $'orca\x1f''terminal'$'\x1f''close' \
+    "wrong Orca terminal cwd did not attempt to close the created endpoint"
+  assert_not_contains "$(cat "$LOG")" $'orca\x1f''worktree'$'\x1f''rm' \
+    "wrong Orca terminal cwd recycled the worktree without confirmed endpoint absence"
+  assert_present "$state/$id.meta" "unconfirmed cleanup lost recovery metadata"
+  pass "fm-spawn.sh --backend orca: refuses a wrong target cwd and preserves uncertain cleanup"
 }
 
 test_spawn_refuses_orca_secondmate_before_home_mutation() {
@@ -1440,6 +1507,7 @@ test_worktree_create_defers_pathless_cleanup_to_verified_rollback
 test_spawn_preserves_pathless_orca_worktree_when_terminal_stop_is_unknown
 test_spawn_preserves_pathless_orca_worktree_without_terminal_proof
 test_spawn_writes_orca_metadata_and_launches_harness
+test_host_root_spawn_refuses_wrong_orca_terminal_cwd
 test_spawn_refuses_orca_secondmate_before_home_mutation
 test_spawn_refuses_orca_when_runtime_not_ready
 test_spawn_refuses_orca_nonisolated_worktree
diff --git a/tests/fm-host-root-mode.test.sh b/tests/fm-host-root-mode.test.sh
index ade91315b4..c0717f4245 100644
--- a/tests/fm-host-root-mode.test.sh
+++ b/tests/fm-host-root-mode.test.sh
@@ -208,18 +208,19 @@ test_brief_variants() {
   (cd "$host" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-brief.sh" lane-host alpha >/dev/null 2>&1)
   brief="$home/data/lane-host/brief.md"
   assert_grep '<!-- firstmate-execution-mode: host-root -->' "$brief" "host brief marker missing"
-  assert_contains "$(cat "$brief")" "$host" "host brief corrupted the literal host path"
-  # shellcheck disable=SC2016  # Assertions intentionally match literal worker variables.
-  assert_contains "$(cat "$brief")" 'git -C "$FM_TARGET_WORKTREE"' "host brief does not scope Git to the target"
-  assert_grep 'Read the target worktree root instructions' "$brief" "host brief does not require target instructions"
-  assert_grep 'top-level process cwd at the host root' "$brief" "host brief does not preserve host cwd"
+  assert_contains "$(cat "$brief")" "$host" "host brief corrupted the literal supervisor path"
+  assert_grep 'process starts inside the isolated target worktree' "$brief" "host brief does not preserve the target cwd"
+  assert_grep "target repository's root instructions" "$brief" "host brief does not require target instructions"
+  # shellcheck disable=SC2016  # Assertions intentionally match literal worker variables and Markdown code spans.
+  assert_contains "$(cat "$brief")" 'Do not read or modify `$FM_HOST_ROOT`' "host brief does not keep unrelated host context out"
+  # shellcheck disable=SC2016
+  assert_grep 'Run `no-mistakes doctor`' "$brief" "host brief does not use target-native no-mistakes setup"
   # shellcheck disable=SC2016
-  assert_contains "$(cat "$brief")" '(cd "$FM_TARGET_WORKTREE" && no-mistakes doctor)' "host brief does not scope no-mistakes setup"
+  assert_contains "$(cat "$brief")" '`no-mistakes axi run --help`' "host brief does not use target-native no-mistakes help"
   # shellcheck disable=SC2016
-  assert_contains "$(cat "$brief")" '(cd "$FM_TARGET_WORKTREE" && no-mistakes axi run --help)' "host brief does not scope no-mistakes help"
+  assert_contains "$(cat "$brief")" '`no-mistakes axi respond`' "host brief does not use target-native no-mistakes responses"
   # shellcheck disable=SC2016
-  assert_contains "$(cat "$brief")" '(cd "$FM_TARGET_WORKTREE" && no-mistakes axi respond ...)' "host brief does not scope no-mistakes responses"
-  assert_no_grep '`no-mistakes axi' "$brief" "host brief leaves a bare no-mistakes CLI command"
+  assert_not_contains "$(cat "$brief")" '(cd "$FM_TARGET_WORKTREE"' "host brief still wraps target commands from the supervisor cwd"
 
   FM_HOME="$normal_home" "$ROOT/bin/fm-brief.sh" lane-normal 'alpha & beta' >/dev/null 2>&1
   assert_no_grep 'firstmate-execution-mode: host-root' "$normal_home/data/lane-normal/brief.md" "default brief changed execution mode"
@@ -432,7 +433,7 @@ test_host_scout_records_logical_project_mode() {
 }
 
 test_spawn_separates_roots() {
-  local host="$TMP/spawn & host" home="$TMP/spawn home's & #%?" project="$TMP/target & repo" wt="$TMP/target & worktree" fb log current launch obs argv turnend meta marker marker_file socket out status=0 before after tree_line cd_line launch_line
+  local host="$TMP/spawn & host" home="$TMP/spawn home's & #%?" project="$TMP/target & repo" wt="$TMP/target & worktree" fb log current launch obs argv turnend meta marker marker_file socket out status=0 before after tree_line launch_line
   make_host "$host"
   mkdir -p "$home/data/lane" "$home/state" "$home/config"
   fm_git_init_commit "$project"
@@ -460,13 +461,13 @@ test_spawn_separates_roots() {
   assert_contains "$(cat "$log")" "FM_TARGET_WORKTREE='$wt'" "child launch did not export exact target worktree"
   assert_contains "$(cat "$log")" "FM_HOST_ROOT='$host'" "child launch did not export exact host root"
   assert_contains "$(cat "$log")" 'notify=[' "Codex FirstMate turn-end safeguard was not retained"
-  [ "$(cat "$current")" = "$host" ] || fail "endpoint did not finish at physical host root"
+  [ "$(cat "$current")" = "$wt" ] || fail "endpoint did not remain at the isolated target worktree"
   tree_line=$(grep -nF 'treehouse get' "$log" | head -1 | cut -d: -f1)
-  cd_line=$(grep -nF 'cd --' "$log" | head -1 | cut -d: -f1)
   launch_line=$(grep -nF 'FM_TARGET_WORKTREE=' "$log" | head -1 | cut -d: -f1)
-  [ "$tree_line" -lt "$cd_line" ] && [ "$cd_line" -lt "$launch_line" ] || fail "spawn order was not worktree then host root then harness"
-  (cd "$host" && PATH="$fb:$PATH" FM_WORKER_OBS="$obs" FM_CODEX_ARGV="$argv" bash -c "$(cat "$launch")")
-  assert_grep "cwd=$host" "$obs" "worker harness did not start from the host root"
+  [ "$tree_line" -lt "$launch_line" ] || fail "spawn order was not worktree then harness"
+  assert_no_grep 'cd --' "$log" "spawn returned the worker endpoint to the supervisor host"
+  (cd "$wt" && PATH="$fb:$PATH" FM_WORKER_OBS="$obs" FM_CODEX_ARGV="$argv" bash -c "$(cat "$launch")")
+  assert_grep "cwd=$wt" "$obs" "worker harness did not start from the isolated target worktree"
   assert_grep "host=$host" "$obs" "worker did not receive the exact host root"
   assert_grep "target=$wt" "$obs" "worker did not receive the exact target worktree"
   turnend="$(cd "$home/state" && pwd -P)/lane.turn-ended"
@@ -585,14 +586,12 @@ SH
   pass "unset-mode Herdr retries retain their established same-identity recovery checks"
 }
 
-test_spawn_rejects_host_as_target_and_cleans_failed_transition() {
-  local host="$TMP/refusal-host" home="$TMP/refusal-home" project="$TMP/refusal-target" wt="$TMP/refusal-wt" fb log current tree_log out status=0
+test_spawn_rejects_host_as_target() {
+  local host="$TMP/refusal-host" home="$TMP/refusal-home" project="$TMP/refusal-target" fb log current tree_log out status=0
   make_host "$host"
-  mkdir -p "$home/data/host-target" "$home/data/move-fail" "$home/state" "$home/config"
+  mkdir -p "$home/data/host-target" "$home/state" "$home/config"
   fm_git_init_commit "$project"
-  git -C "$project" worktree add -q --detach "$wt"
   (cd "$host" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-brief.sh" host-target target >/dev/null 2>&1)
-  (cd "$host" && FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" "$ROOT/bin/fm-brief.sh" move-fail target >/dev/null 2>&1)
   fb=$(make_fakebin "$TMP/fake-refusals")
   log="$TMP/refusals.log"; current="$TMP/refusals.current"; tree_log="$TMP/treehouse.log"
 
@@ -607,20 +606,7 @@ test_spawn_rejects_host_as_target_and_cleans_failed_transition() {
   assert_contains "$(cat "$log")" 'kill-window' "host-as-target refusal leaked its tmux endpoint"
   assert_no_grep 'return --force' "$tree_log" "host-as-target refusal tried to recycle the authoritative host path"
   assert_present "$home/state/host-target.meta" "host-as-target refusal lost recovery metadata for the preserved path"
-
-  : > "$log"; : > "$tree_log"; printf '%s\n' "$project" > "$current"; status=0
-  out=$(cd "$host" && PATH="$fb:$PATH" FM_SPAWN_NO_GUARD=1 FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" FM_HOST_ROOT="$host" \
-    FM_HOST_CWD_ATTEMPTS=1 FM_HOST_CWD_DELAY=0 FM_REFUSE_HOST_MOVE=1 \
-    FM_TMUX_LOG="$log" FM_ENDPOINT_TARGET=test-session:fm-move-fail \
-    FM_LAUNCH_FILE="$TMP/move-fail.launch" FM_CURRENT_PATH="$current" FM_TARGET_PATH="$wt" \
-    FM_HOST_PATH="$host" FM_TREEHOUSE_LOG="$tree_log" TMUX=fake \
-    "$ROOT/bin/fm-spawn.sh" move-fail "$project" codex 2>&1) || status=$?
-  [ "$status" -ne 0 ] || fail "spawn accepted a backend that never entered FM_HOST_ROOT"
-  assert_contains "$out" 'did not enter FM_HOST_ROOT' "host transition failure was not explicit"
-  assert_contains "$(cat "$log")" 'kill-window' "failed host transition leaked its tmux endpoint"
-  assert_grep 'return --force' "$tree_log" "failed host transition did not return the acquired worktree"
-  assert_absent "$home/state/move-fail.meta" "successful transition cleanup left recovery metadata"
-  pass "host overlap preserves the path while ordinary transition failures clean their resources"
+  pass "host overlap preserves the authoritative host path"
 }
 
 test_orca_active_cwd_probe() {
@@ -1364,7 +1350,7 @@ test_host_scout_records_logical_project_mode
 test_spawn_separates_roots
 test_duplicate_spawn_preserves_existing_task
 test_unset_herdr_retry_reaches_existing_identity_checks
-test_spawn_rejects_host_as_target_and_cleans_failed_transition
+test_spawn_rejects_host_as_target
 test_orca_active_cwd_probe
 test_all_harnesses_add_one_task_safeguard
 test_mutators_require_host_cwd

From b174555be5698848cfef54ac401a0a24ca71d02e Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Sat, 1 Aug 2026 10:16:52 +0300
Subject: [PATCH 38/39] no-mistakes(review): Captain: fix host-root review
 regressions

---
 bin/fm-classify-lib.sh           |  7 ++++---
 bin/fm-spawn.sh                  |  3 ++-
 bin/fm-watch.sh                  |  2 +-
 docs/verification/supervision.md |  6 ++++--
 tests/fm-host-root-mode.test.sh  | 12 ++++++------
 tests/fm-watch-triage.test.sh    |  2 ++
 6 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/bin/fm-classify-lib.sh b/bin/fm-classify-lib.sh
index d80840f6a1..26f0fc70f2 100755
--- a/bin/fm-classify-lib.sh
+++ b/bin/fm-classify-lib.sh
@@ -390,9 +390,10 @@ signal_crew_provably_working() {  # <file> ...
 # captain-relevant; 1 otherwise, including the no-status case. A 1 only means
 # "non-terminal"; the always-on watcher then applies crew_is_provably_working,
 # while the away-mode daemon applies its persistence recheck.
-stale_is_terminal() {  # <window> <state>
-  local win=$1 state=$2 last
-  last=$(last_status_line "$state/$(window_to_task "$win" "$state").status")
+stale_is_terminal() {  # <window> <state> [task]
+  local win=$1 state=$2 task=${3:-} last
+  [ -n "$task" ] || task=$(window_to_task "$win" "$state")
+  last=$(last_status_line "$state/$task.status")
   [ -n "$last" ] && status_is_captain_relevant "$last"
 }
 
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index e5d0b2a594..78a3e1b6dd 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -1828,7 +1828,8 @@ sq_piturnend=$(shell_quote "$PROJ_ABS/.pi/extensions/fm-primary-turnend-guard.ts
 sq_piwatch=$(shell_quote "$PROJ_ABS/.pi/extensions/fm-primary-pi-watch.ts")
 sq_opinput=$(shell_quote "$FM_ROOT/bin/fm-operational-input.sh")
 sq_claude_settings=$(shell_quote "$STATE/$ID.claude-settings.json")
-sq_codex_notify=$(shell_quote "notify=[\"bash\",\"-c\",\"touch -- $sq_turnend\"]")
+codex_notify=$(node -e 'process.stdout.write("notify=" + JSON.stringify(["bash", "-c", "touch -- " + process.argv[1]]))' "$sq_turnend")
+sq_codex_notify=$(shell_quote "$codex_notify")
 sq_opencode_config=
 if [ "$HOST_MODE" -eq 1 ] && [ "$HARNESS" = opencode ]; then
   opencode_plugin_url=$(node -e 'process.stdout.write(require("node:url").pathToFileURL(process.argv[1]).href)' \
diff --git a/bin/fm-watch.sh b/bin/fm-watch.sh
index be960ef7bf..7aa98d74f9 100755
--- a/bin/fm-watch.sh
+++ b/bin/fm-watch.sh
@@ -942,7 +942,7 @@ EOF
             printf '%s' "$h" > "$sf"
             wake "stale: $ref"
           fi
-        elif stale_is_terminal "$ref" "$STATE"; then
+        elif stale_is_terminal "$ref" "$STATE" "$task"; then
           # The log's last line is captain-relevant - but that alone is not
           # proof the crew is actually done: a crew's own status log gets no
           # new entry once firstmate hands it to a no-mistakes validation
diff --git a/docs/verification/supervision.md b/docs/verification/supervision.md
index c2dfd40b44..354f9a244f 100644
--- a/docs/verification/supervision.md
+++ b/docs/verification/supervision.md
@@ -62,8 +62,10 @@ The detailed reconciliation and task chronology stay in the private audit report
 
 ## Host-root task integration
 
-The additive task lifecycle adapters were checked on Linux on 2026-07-19 with Codex 0.144.5, OpenCode 1.17.14, Pi 0.80.10, and Claude Code 2.1.214.
-Codex and OpenCode each loaded the host `AGENTS.md`, emitted one host session-start event, one host completion event, and one task completion event when launched with the state-owned adapter configuration rendered by `bin/fm-spawn.sh`.
+The 2026-07-19 additive task lifecycle evidence is superseded by target-root worker routing and is retained below only as historical evidence for the earlier host-cwd topology.
+Ordinary workers now load target-repository context only, while the primary supervisor alone loads the host instructions and lifecycle.
+Under the superseded topology, the adapters were checked on Linux with Codex 0.144.5, OpenCode 1.17.14, Pi 0.80.10, and Claude Code 2.1.214.
+Codex and OpenCode each loaded the host `AGENTS.md`, emitted one host session-start event, one host completion event, and one task completion event in that historical run.
 Pi loaded one host extension and one explicit task extension once each for a single-turn probe, and a trusted FirstMate-root run confirmed project extension discovery coexists with an explicit task extension.
 The exact Claude probe was:
 
diff --git a/tests/fm-host-root-mode.test.sh b/tests/fm-host-root-mode.test.sh
index c0717f4245..7eadbdc107 100644
--- a/tests/fm-host-root-mode.test.sh
+++ b/tests/fm-host-root-mode.test.sh
@@ -433,7 +433,7 @@ test_host_scout_records_logical_project_mode() {
 }
 
 test_spawn_separates_roots() {
-  local host="$TMP/spawn & host" home="$TMP/spawn home's & #%?" project="$TMP/target & repo" wt="$TMP/target & worktree" fb log current launch obs argv turnend meta marker marker_file socket out status=0 before after tree_line launch_line
+  local host="$TMP/spawn & host" home="$TMP/spawn home's \"quoted\" \\ & #%?" project="$TMP/target & repo" wt="$TMP/target & worktree" fb log current launch obs argv turnend meta marker marker_file socket out status=0 before after tree_line launch_line
   make_host "$host"
   mkdir -p "$home/data/lane" "$home/state" "$home/config"
   fm_git_init_commit "$project"
@@ -471,16 +471,16 @@ test_spawn_separates_roots() {
   assert_grep "host=$host" "$obs" "worker did not receive the exact host root"
   assert_grep "target=$wt" "$obs" "worker did not receive the exact target worktree"
   turnend="$(cd "$home/state" && pwd -P)/lane.turn-ended"
-  python3 - "$argv" "$turnend" <<'PY' || fail "Codex notify argv did not preserve the hostile turn-end path"
-import pathlib, subprocess, sys
+python3 - "$argv" "$turnend" <<'PY' || fail "Codex notify argv did not preserve the hostile turn-end path"
+import pathlib, subprocess, sys, tomllib
 args = pathlib.Path(sys.argv[1]).read_bytes().split(b"\0")
 args = [a.decode() for a in args if a]
 assert args.count("-c") == 1, args
 i = args.index("-c")
 config = args[i + 1]
-assert config.startswith('notify=["bash","-c","touch -- '), config
-assert config.endswith('"]'), config
-subprocess.run(["bash", "-c", config[len('notify=["bash","-c","'):-2]], check=True)
+notify = tomllib.loads(config)["notify"]
+assert notify[:2] == ["bash", "-c"], notify
+subprocess.run(notify, check=True)
 PY
   assert_present "$turnend" "Codex notify command did not touch the exact hostile path"
   assert_present "$wt/worker-edit.txt" "disposable worker probe did not edit the target worktree"
diff --git a/tests/fm-watch-triage.test.sh b/tests/fm-watch-triage.test.sh
index 22b5658d30..ebb83b9f51 100755
--- a/tests/fm-watch-triage.test.sh
+++ b/tests/fm-watch-triage.test.sh
@@ -128,6 +128,8 @@ test_stale_is_terminal_classifier() {
   fm_write_meta "$state/herdr-term.meta" "window=default:w1:p2" "backend=herdr"
   printf 'done: ready in branch fm/herdr\n' > "$state/herdr-term.status"
   stale_is_terminal "default:w1:p2" "$state" || fail "terminal herdr stale status not resolved through metadata"
+  printf 'done: ready in branch fm/prefixed\n' > "$state/fm-prefixed.status"
+  stale_is_terminal "fm-prefixed" "$state" "fm-prefixed" || fail "terminal stale status lost an explicit fm-prefixed task id"
   printf 'working: compiling\n' > "$state/nonterm.status"
   stale_is_terminal "sess:fm-nonterm" "$state" && fail "non-terminal stale classified terminal"
   stale_is_terminal "sess:fm-missing" "$state" && fail "stale with no status classified terminal"

From baa5ef04c69af8e0f137a60dac57404f8501fba9 Mon Sep 17 00:00:00 2001
From: YrFnS <yassery12345@gmail.com>
Date: Sat, 1 Aug 2026 11:24:53 +0300
Subject: [PATCH 39/39] no-mistakes(document): Consolidate host-root
 verification evidence

---
 docs/verification/runtime-backends.md | 22 +++-------------------
 docs/verification/supervision.md      | 16 ++--------------
 tests/fm-calm-pi-extension.test.sh    |  4 +++-
 3 files changed, 8 insertions(+), 34 deletions(-)

diff --git a/docs/verification/runtime-backends.md b/docs/verification/runtime-backends.md
index cdab7e2bdf..bc2885031a 100644
--- a/docs/verification/runtime-backends.md
+++ b/docs/verification/runtime-backends.md
@@ -119,7 +119,7 @@ Claude, Codex, OpenCode, Pi, pi-signed, Grok, and Kimi share that backend cleanu
 
 ### Host-root task routing
 
-The host-root path was reverified on 2026-08-01 with Herdr 0.7.5 and Treehouse 2.0.0 through the real isolated acceptance after ordinary workers moved back to their target worktree cwd.
+The host-root path was verified on 2026-08-01 with Herdr 0.7.5 and Treehouse 2.0.0 through the real isolated acceptance.
 The supervisor-side invocation shape remains:
 
 ```sh
@@ -136,7 +136,6 @@ FM_BACKEND=tmux \
 The worker observed its physical cwd, target Git root, and `FM_TARGET_WORKTREE` all equal to the detached isolated target worktree, distinct from the clean primary checkout and `FM_HOST_ROOT`.
 It read the target `AGENTS.md` natively from that cwd, completed the decision inventory, wrote the scout report outside both repositories, and cleaned up through `bin/fm-teardown.sh`.
 The supervisor remained rooted in the host repository, which stayed clean and did not enter the worker context.
-The earlier 2026-07-26 live evidence with workers launched from `FM_HOST_ROOT` is superseded by this target-root contract.
 
 Current entry point and observed output:
 
@@ -181,24 +180,9 @@ The CLI matrix was checked directly:
 All destructive verification used `bin/fm-herdr-lab.sh` with a non-default `fm-lab-` name and a byte-identical default-session tripwire.
 No ambient `herdr server stop` command is a supported test operation.
 
-### Host-root task routing
-
-Real Herdr host-root acceptance is owned by:
-
-```sh
-tests/fm-backend-herdr-host-root-e2e.test.sh
-```
-
-The acceptance drives `bin/fm-spawn.sh`, a completion lifecycle signal, `bin/fm-crew-state.sh`, `bin/fm-decision-hold.sh complete`, and `bin/fm-teardown.sh` through an isolated named Herdr lab.
-It verifies host-authoritative cwd and instructions, target-only edits in the explicit linked worktree, clean host and primary target checkouts, completed task state, completed decision inventory, exact pane teardown, worktree return, and the default-session fleet-state tripwire.
-The host-root acceptance passed on 2026-07-28 against Herdr 0.7.5 and Treehouse 2.0.0 on Linux.
-The exact command and output were:
+### Host-root acceptance
 
-```text
-tests/fm-backend-herdr-host-root-e2e.test.sh
-warn: no registry at /tmp/fm-herdr-host-root-e2e.Ymlc0f/home/data/projects.md; defaulting target to no-mistakes off
-ok - real Herdr host-root spawn, completion, decision inventory, and teardown
-```
+Current Herdr host-root commands, topology, and output are owned by the shared [host-root task-routing evidence](#host-root-task-routing).
 
 ### Prune and respawn
 
diff --git a/docs/verification/supervision.md b/docs/verification/supervision.md
index 354f9a244f..4fa457fe85 100644
--- a/docs/verification/supervision.md
+++ b/docs/verification/supervision.md
@@ -62,20 +62,9 @@ The detailed reconciliation and task chronology stay in the private audit report
 
 ## Host-root task integration
 
-The 2026-07-19 additive task lifecycle evidence is superseded by target-root worker routing and is retained below only as historical evidence for the earlier host-cwd topology.
 Ordinary workers now load target-repository context only, while the primary supervisor alone loads the host instructions and lifecycle.
-Under the superseded topology, the adapters were checked on Linux with Codex 0.144.5, OpenCode 1.17.14, Pi 0.80.10, and Claude Code 2.1.214.
-Codex and OpenCode each loaded the host `AGENTS.md`, emitted one host session-start event, one host completion event, and one task completion event in that historical run.
-Pi loaded one host extension and one explicit task extension once each for a single-turn probe, and a trusted FirstMate-root run confirmed project extension discovery coexists with an explicit task extension.
-The exact Claude probe was:
-
-```sh
-claude -p --settings "$task_settings" --dangerously-skip-permissions \
-  'Complete one turn and exit.'
-```
-
-The host project `SessionStart` hook fired once, proving `--settings` remains additive to project settings, but organization policy blocked model access before Stop and prevented live task-hook confirmation.
-Grok was unavailable, so its launch-scoped host-root token remains generated and focused-test verified rather than live verified.
+Claude's additive task settings reached the launch project's `SessionStart` hook, but organization policy blocked model access before Stop, so its task completion signal remains focused-test verified.
+Grok's launch-scoped host-root token remains generated and focused-test verified rather than live verified.
 Kimi 0.29.1 launch and global-hook mechanics were live-verified on 2026-07-25, while its launch-scoped host-root token remains focused-test verified rather than live lifecycle verified.
 The reusable deterministic entry points are:
 
@@ -87,7 +76,6 @@ tests/fm-kimi-harness.test.sh
 
 The integrated path was reverified on 2026-08-01 through Herdr 0.7.5 and Treehouse 2.0.0.
 The worker launched from the isolated target worktree, read target instructions natively, completed the decision inventory, emitted its task completion, retained the report, and cleaned up while the supervisor stayed rooted in the unchanged host repository.
-The earlier 2026-07-26 host-cwd worker evidence is superseded.
 [`runtime-backends.md`](runtime-backends.md#host-root-task-routing) owns the exact spawn command and path-routing evidence.
 
 Pi 0.82.1 verified the one-host global activator on 2026-07-29 and the host-root worker exclusion on 2026-07-30.
diff --git a/tests/fm-calm-pi-extension.test.sh b/tests/fm-calm-pi-extension.test.sh
index 55e109dbd4..4e367ecb96 100755
--- a/tests/fm-calm-pi-extension.test.sh
+++ b/tests/fm-calm-pi-extension.test.sh
@@ -1806,7 +1806,8 @@ JSON
     tmux -L "$TMUX_SOCKET" capture-pane -p -t "$TMUX_SESSION" >"$hidden_snapshot"
     if ! grep -Fq "CALM_E2E_OUTPUT" "$hidden_snapshot" &&
       ! grep -Fq "/calm" "$hidden_snapshot" &&
-      ! grep -Fq "Thinking..." "$hidden_snapshot"; then
+      ! grep -Fq "Thinking..." "$hidden_snapshot" &&
+      ! grep -Fq "fm_watch_arm_pi" "$hidden_snapshot"; then
       break
     fi
     sleep 0.05
@@ -1944,6 +1945,7 @@ JS
   tmux -L "$TMUX_SOCKET" send-keys -t "$TMUX_SESSION" -l "/export $export_file"
   tmux -L "$TMUX_SOCKET" send-keys -t "$TMUX_SESSION" M-s
   wait_for_text "$export_snapshot" "Session exported to: $export_file" \
+    || [ -s "$export_file" ] \
     || fail "/export did not complete while calm mode was on"
   node - "$export_file" <<'JS' || fail "calm-mode HTML export lost tool data or persisted synthetic provenance"
 const html = require("node:fs").readFileSync(process.argv[2], "utf8");