diff --git a/bin/fm-clean-commit-relaunch-launch-lib.sh b/bin/fm-clean-commit-relaunch-launch-lib.sh
new file mode 100755
index 00000000000..05ac2836faa
--- /dev/null
+++ b/bin/fm-clean-commit-relaunch-launch-lib.sh
@@ -0,0 +1,217 @@
+#!/usr/bin/env bash
+# Private post-allocation launch implementation for fm-clean-commit-relaunch.
+#
+# This file is source-only implementation code, not an operator command.
+# Its interface accepts only a destination identity and an already allocated
+# worktree. It never receives, reads, or validates source relaunch authority,
+# an exact commit, a handoff path, or relaunch environment state.
+
+_FM_CLEAN_RELAUNCH_LAUNCH_LIB_DIR=$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)
+# shellcheck source=bin/fm-task-inbox-lib.sh
+. "$_FM_CLEAN_RELAUNCH_LAUNCH_LIB_DIR/fm-task-inbox-lib.sh"
+
+FM_CLEAN_RELAUNCH_LAUNCH_STATE=
+FM_CLEAN_RELAUNCH_LAUNCH_WINDOW_ID=
+FM_CLEAN_RELAUNCH_LAUNCH_CREATE_INTERRUPTED=0
+FM_CLEAN_RELAUNCH_LAUNCH_METADATA_OWNED=0
+FM_CLEAN_RELAUNCH_LAUNCH_METADATA_INTERRUPTED=0
+FM_CLEAN_RELAUNCH_LAUNCH_TEMP_OWNED=0
+FM_CLEAN_RELAUNCH_LAUNCH_INBOX_OWNED=0
+FM_CLEAN_RELAUNCH_LAUNCH_STATE_CLAIM_INTERRUPTED=0
+FM_CLEAN_RELAUNCH_LAUNCH_METADATA_TMP=
+
+fm_clean_relaunch_defer_window_creation_signal() {
+  FM_CLEAN_RELAUNCH_LAUNCH_CREATE_INTERRUPTED=1
+}
+
+fm_clean_relaunch_defer_metadata_signal() {
+  FM_CLEAN_RELAUNCH_LAUNCH_METADATA_INTERRUPTED=1
+}
+
+fm_clean_relaunch_defer_state_claim_signal() {
+  FM_CLEAN_RELAUNCH_LAUNCH_STATE_CLAIM_INTERRUPTED=1
+}
+
+fm_clean_relaunch_shell_quote() {  # <value>
+  local value=$1
+  printf "'%s'" "${value//\'/\'\\\'\'}"
+}
+
+fm_clean_relaunch_destination_meta_absent() {  # <state> <id>
+  local state=$1 id=$2 artifact
+  for artifact in "$state/$id.meta" "$state/$id.inbox" "$state/$id.status" "${TMPDIR:-/tmp}/fm-$id"; do
+    [ ! -e "$artifact" ] && [ ! -L "$artifact" ] || return 1
+  done
+}
+
+fm_clean_relaunch_launch_cleanup() {  # <destination-id>
+  local id=$1 state=${FM_CLEAN_RELAUNCH_LAUNCH_STATE:-} window_id=${FM_CLEAN_RELAUNCH_LAUNCH_WINDOW_ID:-}
+  [ -n "$window_id" ] && fm_backend_kill herdr "$window_id" >/dev/null 2>&1 || true
+  [ -n "$state" ] || return 0
+  [ "$FM_CLEAN_RELAUNCH_LAUNCH_TEMP_OWNED" -eq 0 ] || rm -rf -- "${TMPDIR:-/tmp}/fm-$id"
+  [ "$FM_CLEAN_RELAUNCH_LAUNCH_INBOX_OWNED" -eq 0 ] || rm -rf -- "$state/$id.inbox"
+  [ "$FM_CLEAN_RELAUNCH_LAUNCH_METADATA_OWNED" -eq 0 ] || rm -f -- "$state/$id.meta"
+  [ -z "$FM_CLEAN_RELAUNCH_LAUNCH_METADATA_TMP" ] || rm -f -- "$FM_CLEAN_RELAUNCH_LAUNCH_METADATA_TMP"
+}
+
+fm_clean_relaunch_wait_for_ack() {  # <state> <id> <record>
+  local state=$1 id=$2 record=$3 polls=${FM_CLEAN_COMMIT_RELAUNCH_ACK_POLLS:-120}
+  local interval=${FM_CLEAN_COMMIT_RELAUNCH_ACK_INTERVAL:-0.5} handled
+  case "$polls" in ''|*[!0-9]*|0) polls=120 ;; esac
+  handled="$state/$id.inbox/handled/${record##*/}"
+  while [ "$polls" -gt 0 ]; do
+    [ -f "$handled" ] && return 0
+    sleep "$interval"
+    polls=$((polls - 1))
+  done
+  return 1
+}
+
+# fm_clean_relaunch_launch_allocated starts one fresh endpoint in an already
+# validated clean worktree. The relaunch owner alone decides whether that
+# worktree was allocated or which commit it contains.
+#
+# Interface:
+#   <destination-id> <project-root> <allocated-worktree> <brief>
+#   <harness> <backend> <mode> <yolo> <model> <effort>
+#
+# The supported profile is codex on the Herdr backend. Refusing
+# every other tuple before endpoint creation is deliberate. Their lifecycle
+# setup and acknowledgement semantics stay owned by generic fm-spawn until a
+# profile can share this helper without relaunch-specific input.
+fm_clean_relaunch_launch_allocated() {
+  local id=$1 project=$2 worktree=$3 brief=$4 harness=$5 backend=$6 mode=$7 yolo=$8 model=$9 effort=${10}
+  local state=${STATE:?STATE must be set by the relaunch owner}
+  local container session workspace seeded_tab task_ids tab_id pane_id target task_tmp meta_tmp launch record handoff late_artifact
+
+  [ "$harness:$backend" = codex:herdr ] || {
+    echo "error: allocated relaunch launch supports only codex/Herdr" >&2
+    return 1
+  }
+  [ -f "$brief" ] && [ ! -L "$brief" ] && [ -r "$brief" ] || {
+    echo "error: destination brief is unreadable" >&2
+    return 1
+  }
+  [ -d "$project" ] && [ -d "$worktree" ] && [ ! -L "$worktree" ] || {
+    echo "error: destination worktree is unreadable" >&2
+    return 1
+  }
+  [ "$(git -C "$worktree" rev-parse --show-toplevel 2>/dev/null || true)" = "$worktree" ] || {
+    echo "error: allocated destination is not a worktree root" >&2
+    return 1
+  }
+  late_artifact=$(destination_artifact_exists "$id" || true)
+  if [ -n "$late_artifact" ] && { [ "$late_artifact" != "${DATA:?DATA must be set by the relaunch owner}/$id/relaunch-handoff.json" ] || [ "${DESTINATION_HANDOFF_OWNED:-0}" -ne 1 ]; }; then
+    echo "error: destination state is already occupied" >&2
+    return 1
+  fi
+  fm_backend_source herdr || return 1
+  container=$(fm_backend_herdr_container_ensure "$project" other-home) || return 1
+  session=${container%%:*}
+  workspace=${container#*:}
+  seeded_tab=
+  case "$workspace" in *$'\t'*) seeded_tab=${workspace#*$'\t'}; workspace=${workspace%%$'\t'*} ;; esac
+  FM_CLEAN_RELAUNCH_LAUNCH_STATE=$state
+  trap fm_clean_relaunch_defer_window_creation_signal HUP INT TERM
+  if task_ids=$(fm_backend_herdr_create_task "$session:$workspace" "fm-$id" "$worktree" "$seeded_tab"); then
+    read -r tab_id pane_id <<EOF
+$task_ids
+EOF
+    [ -n "$tab_id" ] && [ -n "$pane_id" ] || return 1
+    FM_CLEAN_RELAUNCH_LAUNCH_WINDOW_ID="$session:$pane_id"
+  else
+    trap interrupted HUP INT TERM
+    return 1
+  fi
+  trap interrupted HUP INT TERM
+  [ "$FM_CLEAN_RELAUNCH_LAUNCH_CREATE_INTERRUPTED" -eq 0 ] || return 1
+  target="$FM_CLEAN_RELAUNCH_LAUNCH_WINDOW_ID"
+
+  task_tmp="${TMPDIR:-/tmp}/fm-$id"
+  trap fm_clean_relaunch_defer_state_claim_signal HUP INT TERM
+  if mkdir "$task_tmp"; then
+    FM_CLEAN_RELAUNCH_LAUNCH_TEMP_OWNED=1
+  else
+    trap interrupted HUP INT TERM
+    echo "error: destination task temp root is already occupied" >&2
+    return 1
+  fi
+  trap interrupted HUP INT TERM
+  [ "$FM_CLEAN_RELAUNCH_LAUNCH_STATE_CLAIM_INTERRUPTED" -eq 0 ] || return 1
+  mkdir "$task_tmp/gotmp" || return 1
+
+  FM_CLEAN_RELAUNCH_LAUNCH_STATE_CLAIM_INTERRUPTED=0
+  trap fm_clean_relaunch_defer_state_claim_signal HUP INT TERM
+  if mkdir "$state/$id.inbox"; then
+    FM_CLEAN_RELAUNCH_LAUNCH_INBOX_OWNED=1
+  else
+    trap interrupted HUP INT TERM
+    echo "error: destination inbox is already occupied" >&2
+    return 1
+  fi
+  trap interrupted HUP INT TERM
+  [ "$FM_CLEAN_RELAUNCH_LAUNCH_STATE_CLAIM_INTERRUPTED" -eq 0 ] || return 1
+  mkdir "$state/$id.inbox/handled" || return 1
+
+  FM_CLEAN_RELAUNCH_LAUNCH_METADATA_INTERRUPTED=0
+  trap fm_clean_relaunch_defer_metadata_signal HUP INT TERM
+  if meta_tmp=$(mktemp "$state/.${id}.meta.XXXXXX"); then
+    FM_CLEAN_RELAUNCH_LAUNCH_METADATA_TMP=$meta_tmp
+  else
+    trap interrupted HUP INT TERM
+    return 1
+  fi
+  if ! {
+    printf 'window=%s\n' "$target"
+    printf 'endpoint_task_id=%s\n' "$id"
+    printf 'backend=herdr\n'
+    printf 'herdr_session=%s\n' "$session"
+    printf 'herdr_workspace_id=%s\n' "$workspace"
+    printf 'herdr_tab_id=%s\n' "$tab_id"
+    printf 'herdr_pane_id=%s\n' "$pane_id"
+    printf 'worktree=%s\n' "$worktree"
+    printf 'project=%s\n' "$project"
+    printf 'harness=%s\n' "$harness"
+    printf 'kind=ship\n'
+    printf 'mode=%s\n' "$mode"
+    printf 'yolo=%s\n' "$yolo"
+    printf 'tasktmp=%s\n' "$task_tmp"
+    printf 'model=%s\n' "$model"
+    printf 'effort=%s\n' "$effort"
+  } > "$meta_tmp"; then
+    rm -f -- "$meta_tmp"
+    FM_CLEAN_RELAUNCH_LAUNCH_METADATA_TMP=
+    trap interrupted HUP INT TERM
+    return 1
+  fi
+  if ln "$meta_tmp" "$state/$id.meta"; then
+    FM_CLEAN_RELAUNCH_LAUNCH_METADATA_OWNED=1
+    rm -f -- "$meta_tmp"
+    FM_CLEAN_RELAUNCH_LAUNCH_METADATA_TMP=
+  else
+    rm -f -- "$meta_tmp"
+    FM_CLEAN_RELAUNCH_LAUNCH_METADATA_TMP=
+    trap interrupted HUP INT TERM
+    return 1
+  fi
+  trap interrupted HUP INT TERM
+  [ "$FM_CLEAN_RELAUNCH_LAUNCH_METADATA_INTERRUPTED" -eq 0 ] || return 1
+
+  fm_backend_herdr_send_text_line "$target" "export GOTMPDIR=$(fm_clean_relaunch_shell_quote "$task_tmp/gotmp")" || return 1
+  launch="codex"
+  [ "$model" = default ] || launch="$launch --model $(fm_clean_relaunch_shell_quote "$model")"
+  case "$effort" in
+    low|medium|high|xhigh) launch="$launch -c $(fm_clean_relaunch_shell_quote "model_reasoning_effort=\"$effort\"")" ;;
+  esac
+  launch="$launch --dangerously-bypass-approvals-and-sandbox \$( $(fm_clean_relaunch_shell_quote "$FM_ROOT/bin/fm-operational-input.sh") encode launch-brief < $(fm_clean_relaunch_shell_quote "$brief") )"
+  fm_backend_herdr_send_literal "$target" "$launch" || return 1
+  fm_backend_herdr_send_key "$target" Enter || return 1
+  handoff="${DATA:?DATA must be set by the relaunch owner}/$id/relaunch-handoff.json"
+
+  record=$(fm_task_inbox_write "$state" "$id" "Read the durable preserved-work handoff at $handoff before continuing the task.") || return 1
+  fm_task_inbox_ring herdr "$target" "$record" "fm-$id" codex || return 1
+  fm_clean_relaunch_wait_for_ack "$state" "$id" "$record" || {
+    echo "error: destination worker did not acknowledge the preserved-work handoff" >&2
+    return 1
+  }
+}
diff --git a/bin/fm-clean-commit-relaunch.sh b/bin/fm-clean-commit-relaunch.sh
new file mode 100755
index 00000000000..b134cac30d1
--- /dev/null
+++ b/bin/fm-clean-commit-relaunch.sh
@@ -0,0 +1,567 @@
+#!/usr/bin/env bash
+# Relaunch one missing committed ship task into a new clean worktree.
+#
+# Usage: fm-clean-commit-relaunch.sh <source-task-id> <destination-task-id>
+#
+# This explicit operator command is the sole owner of clean-commit relaunch.
+# It admits one missing local codex/Herdr ship task, allocates a normal clean
+# Treehouse worktree, creates a new branch at the admitted source commit,
+# publishes one evidence-only handoff, launches and acknowledges a fresh task,
+# and cleans only destination-owned state on failure.
+#
+# It never resumes, closes, alters, or cleans the source task.
+# No watcher, bootstrap, recovery, or generic-spawn path invokes this command.
+set -eu
+
+SCRIPT_DIR=$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)
+FM_ROOT=${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd -P)}
+FM_HOME=${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}
+
+resolve_dir() {  # <label> <path>
+  local label=$1 path=$2
+  [ -d "$path" ] && [ ! -L "$path" ] && [ -r "$path" ] && [ -x "$path" ] || {
+    echo "error: $label must be a readable ordinary directory: $path" >&2
+    return 1
+  }
+  (CDPATH='' cd -- "$path" && pwd -P)
+}
+
+FM_HOME=$(resolve_dir FM_HOME "$FM_HOME") || exit 1
+STATE=${FM_STATE_OVERRIDE:-$FM_HOME/state}
+DATA=${FM_DATA_OVERRIDE:-$FM_HOME/data}
+STATE=$(resolve_dir state "$STATE") || exit 1
+DATA=$(resolve_dir data "$DATA") || exit 1
+[ "$STATE" = "$FM_HOME/state" ] && [ "$DATA" = "$FM_HOME/data" ] || {
+  echo "error: clean-commit relaunch refuses cross-home state or data overrides" >&2
+  exit 1
+}
+
+# shellcheck source=bin/fm-lock-lib.sh
+. "$SCRIPT_DIR/fm-lock-lib.sh"
+# shellcheck source=bin/fm-nm-run-lib.sh
+. "$SCRIPT_DIR/fm-nm-run-lib.sh"
+# shellcheck source=bin/fm-backend.sh
+. "$SCRIPT_DIR/fm-backend.sh"
+# shellcheck source=bin/fm-pr-lib.sh
+. "$SCRIPT_DIR/fm-pr-lib.sh"
+# shellcheck source=bin/fm-pool-lib.sh
+. "$SCRIPT_DIR/fm-pool-lib.sh"
+# shellcheck source=bin/fm-clean-commit-relaunch-launch-lib.sh
+. "$SCRIPT_DIR/fm-clean-commit-relaunch-launch-lib.sh"
+
+usage() {
+  sed -n '2,${/^#/!q;p;}' "$0" | sed 's/^# \{0,1\}//'
+}
+
+valid_id() {
+  case "$1" in
+    ''|.|..|*[!A-Za-z0-9._-]*|[._-]*) return 1 ;;
+    *) return 0 ;;
+  esac
+}
+
+sha256_file() {
+  sha256sum "$1" | awk '{print $1}'
+}
+
+sha256_text() {
+  printf '%s' "$1" | sha256sum | awk '{print $1}'
+}
+
+meta_exact() {  # <meta> <key>
+  local meta=$1 key=$2 count value
+  count=$(grep -c "^$key=" "$meta" 2>/dev/null || true)
+  [ "$count" -eq 1 ] || return 1
+  value=$(sed -n "s/^$key=//p" "$meta")
+  [ -n "$value" ] || return 1
+  printf '%s' "$value"
+}
+
+meta_optional_exact() {  # <meta> <key>
+  local meta=$1 key=$2 count value
+  count=$(grep -c "^$key=" "$meta" 2>/dev/null || true)
+  case "$count" in
+    0) return 0 ;;
+    1)
+      value=$(sed -n "s/^$key=//p" "$meta")
+      [ -n "$value" ] || return 1
+      printf '%s' "$value"
+      ;;
+    *) return 1 ;;
+  esac
+}
+
+path_has_git_operation() {  # <worktree>
+  local worktree=$1 operation operation_path
+  for operation in MERGE_HEAD CHERRY_PICK_HEAD REVERT_HEAD REBASE_HEAD BISECT_START BISECT_LOG sequencer rebase-apply rebase-merge; do
+    operation_path=$(git -C "$worktree" rev-parse --git-path "$operation" 2>/dev/null || true)
+    [ -z "$operation_path" ] && continue
+    [ ! -e "$operation_path" ] && [ ! -L "$operation_path" ] || return 0
+  done
+  return 1
+}
+
+worktree_is_registered() {  # <repository> <worktree>
+  local repository=$1 worktree=$2 record candidate
+  while IFS= read -r record; do
+    case "$record" in
+      "worktree "*)
+        candidate=${record#worktree }
+        candidate=$(resolve_dir registered-worktree "$candidate" 2>/dev/null || true)
+        [ "$candidate" != "$worktree" ] || return 0
+        ;;
+    esac
+  done < <(git -C "$repository" worktree list --porcelain 2>/dev/null)
+  return 1
+}
+
+worktree_is_task_owned() {  # <worktree>
+  local worktree=$1 meta recorded
+  for meta in "$STATE"/*.meta; do
+    [ -e "$meta" ] || [ -L "$meta" ] || continue
+    [ -f "$meta" ] && [ ! -L "$meta" ] && [ -r "$meta" ] || return 2
+    recorded=$(meta_exact "$meta" worktree 2>/dev/null) || return 2
+    recorded=$(resolve_dir recorded-task-worktree "$recorded" 2>/dev/null) || return 2
+    [ "$recorded" != "$worktree" ] || return 0
+  done
+  return 1
+}
+
+task_worktrees_are_well_formed() {
+  local meta recorded
+  for meta in "$STATE"/*.meta; do
+    [ -e "$meta" ] || [ -L "$meta" ] || continue
+    [ -f "$meta" ] && [ ! -L "$meta" ] && [ -r "$meta" ] || return 1
+    recorded=$(meta_exact "$meta" worktree 2>/dev/null) || return 1
+    resolve_dir recorded-task-worktree "$recorded" >/dev/null 2>&1 || return 1
+  done
+}
+
+destination_artifact_exists() {  # <destination>
+  local destination=$1 artifact
+  for artifact in \
+    "$STATE/$destination.inbox" "$STATE/$destination.status" \
+    "$STATE/$destination.turn-ended" "$STATE/$destination.meta" \
+    "$STATE/$destination.pi-ext.ts" "$STATE/$destination.omp-ext.ts" \
+    "$STATE/$destination.omp-ready" "$STATE/$destination.omp-started" \
+    "$STATE/$destination.omp-doorbell-ready" "$STATE/$destination.omp-doorbell-ready.requests" \
+    "$STATE/$destination.grok-turnend-token" \
+    "$STATE/$destination.kimi-turnend-token" "$STATE/$destination.hermes-turnend-token" \
+    "$STATE/$destination.hermes-session" "$STATE/$destination.hermes-started" \
+    "$STATE/$destination.busy-state" "$STATE/$destination.busy-gen" \
+    "$STATE/$destination.herdr-presentation" "$STATE/.$destination.open-decisions-cursor" \
+    "$STATE/$destination.check.sh" "$STATE/$destination.pr-poll" \
+    "$STATE/$destination.pr-poll-registration" "$STATE/$destination.pr-poll-retirement" \
+    "$STATE/$destination.check-trust" "$DATA/$destination/relaunch-handoff.json" \
+    "${TMPDIR:-/tmp}/fm-$destination"; do
+    if [ -e "$artifact" ] || [ -L "$artifact" ]; then
+      printf '%s' "$artifact"
+      return 0
+    fi
+  done
+  return 1
+}
+
+no_mistakes_custody() {  # <source-worktree> <source-branch>
+  local worktree=$1 branch=$2 output status trimmed run_id run_branch run_head run_status run_outcome
+  set +e
+  output=$(fm_nm_run_bounded "$worktree" "${FM_CLEAN_COMMIT_RELAUNCH_NM_TIMEOUT:-10}" axi status 2>&1)
+  status=$?
+  set -e
+  trimmed=$(fm_nm_trim "$output")
+  case "$trimmed" in
+    '')
+      [ "$status" -eq 0 ] || { printf 'unreadable'; return 0; }
+      printf 'none'
+      return 0
+      ;;
+    'no active run')
+      printf 'none'
+      return 0
+      ;;
+  esac
+  [ "$status" -eq 0 ] || { printf 'unreadable'; return 0; }
+  run_id=$(fm_nm_strip_quotes "$(fm_nm_field "$output" id)")
+  run_branch=$(fm_nm_strip_quotes "$(fm_nm_field "$output" branch)")
+  run_head=$(fm_nm_strip_quotes "$(fm_nm_field "$output" head)")
+  run_status=$(fm_nm_strip_quotes "$(fm_nm_field "$output" status)")
+  run_outcome=$(fm_nm_strip_quotes "$(fm_nm_field "$output" outcome)")
+  [ -n "$run_id" ] && [ "$run_branch" = "$branch" ] \
+    && fm_nm_head_matches_worktree "$worktree" "$run_head" && [ -z "$run_outcome" ] || {
+    printf 'unreadable'
+    return 0
+  }
+  case "$run_status" in
+    running|fixing|ci) printf 'active' ;;
+    awaiting_approval|fix_review) printf 'parked' ;;
+    *) printf 'unreadable' ;;
+  esac
+}
+
+case "${1:-}" in
+  -h|--help) usage; exit 0 ;;
+esac
+
+[ "$#" -eq 2 ] || { usage >&2; exit 2; }
+SOURCE=$1
+DESTINATION=$2
+if ! valid_id "$SOURCE" || ! valid_id "$DESTINATION"; then
+  echo "error: source and destination task ids must be valid task ids" >&2
+  exit 2
+fi
+[ "$SOURCE" != "$DESTINATION" ] || {
+  echo "error: source and destination task ids must differ" >&2
+  exit 1
+}
+
+SOURCE_META=$STATE/$SOURCE.meta
+SOURCE_BRIEF=$DATA/$SOURCE/brief.md
+DESTINATION_BRIEF=$DATA/$DESTINATION/brief.md
+DESTINATION_HANDOFF=$DATA/$DESTINATION/relaunch-handoff.json
+SOURCE_LOCK=$STATE/.spawn-$SOURCE.lock
+DESTINATION_LOCK=$STATE/.spawn-$DESTINATION.lock
+SOURCE_LOCK_HELD=0
+DESTINATION_LOCK_HELD=0
+DESTINATION_WORKTREE=
+DESTINATION_WORKTREE_OWNED=0
+DESTINATION_LEASE_WORKTREE=
+DESTINATION_LEASE_OWNED=0
+DESTINATION_BRANCH=
+DESTINATION_BRANCH_CREATED=0
+DESTINATION_CHECKOUT_INTERRUPTED=0
+DESTINATION_HANDOFF_OWNED=0
+DESTINATION_HANDOFF_INTERRUPTED=0
+DESTINATION_HANDOFF_TMP=
+DESTINATION_ALLOCATION_INTERRUPTED=0
+
+defer_destination_checkout_signal() {
+  DESTINATION_CHECKOUT_INTERRUPTED=1
+}
+
+defer_destination_handoff_signal() {
+  DESTINATION_HANDOFF_INTERRUPTED=1
+}
+
+defer_destination_allocation_signal() {
+  DESTINATION_ALLOCATION_INTERRUPTED=1
+}
+
+cleanup_destination() {
+  if [ "$DESTINATION_WORKTREE_OWNED" -eq 1 ]; then
+    fm_clean_relaunch_launch_cleanup "$DESTINATION" || true
+  fi
+  if [ "$DESTINATION_LEASE_OWNED" -eq 1 ]; then
+    if ! (cd "$PROJECT" && "$SCRIPT_DIR/fm-treehouse-command.sh" return --if-lease-holder "fm-$DESTINATION" "$DESTINATION_LEASE_WORKTREE"); then
+      echo "error: could not return destination worktree $DESTINATION_LEASE_WORKTREE" >&2
+      return 1
+    fi
+    DESTINATION_LEASE_OWNED=0
+  fi
+  if [ "$DESTINATION_BRANCH_CREATED" -eq 1 ]; then
+    if ! git -C "$PROJECT" branch -D "$DESTINATION_BRANCH" >/dev/null; then
+      echo "error: could not delete destination branch $DESTINATION_BRANCH" >&2
+      return 1
+    fi
+  fi
+  [ "$DESTINATION_HANDOFF_OWNED" -eq 0 ] || rm -f -- "$DESTINATION_HANDOFF"
+}
+
+cleanup() {
+  status=$?
+  [ -z "$DESTINATION_HANDOFF_TMP" ] || rm -f -- "$DESTINATION_HANDOFF_TMP"
+  if [ "$status" -ne 0 ]; then
+    cleanup_destination || echo "error: destination cleanup is incomplete" >&2
+  fi
+  [ "$DESTINATION_LOCK_HELD" -eq 0 ] || fm_lock_release "$DESTINATION_LOCK" || true
+  [ "$SOURCE_LOCK_HELD" -eq 0 ] || fm_lock_release "$SOURCE_LOCK" || true
+  return "$status"
+}
+interrupted() {
+  exit 1
+}
+trap cleanup EXIT
+trap interrupted HUP INT TERM
+
+fm_lock_try_acquire "$SOURCE_LOCK" || {
+  echo "error: source task $SOURCE is already under an exclusive lifecycle operation" >&2
+  exit 1
+}
+SOURCE_LOCK_HELD=1
+fm_lock_try_acquire "$DESTINATION_LOCK" || {
+  echo "error: destination task $DESTINATION is already under an exclusive lifecycle operation" >&2
+  exit 1
+}
+DESTINATION_LOCK_HELD=1
+
+[ -f "$SOURCE_META" ] && [ ! -L "$SOURCE_META" ] && [ -r "$SOURCE_META" ] || {
+  echo "error: source task $SOURCE has no readable regular metadata" >&2
+  exit 1
+}
+[ -f "$SOURCE_BRIEF" ] && [ ! -L "$SOURCE_BRIEF" ] && [ -r "$SOURCE_BRIEF" ] || {
+  echo "error: source task $SOURCE has no readable regular brief" >&2
+  exit 1
+}
+[ -f "$DESTINATION_BRIEF" ] && [ ! -L "$DESTINATION_BRIEF" ] && [ -r "$DESTINATION_BRIEF" ] || {
+  echo "error: destination task $DESTINATION needs a pre-existing complete ship brief" >&2
+  exit 1
+}
+DESTINATION_DATA_DIR=$(resolve_dir destination-task-data "$DATA/$DESTINATION") || exit 1
+if [ "$DESTINATION_DATA_DIR" != "$DATA/$DESTINATION" ] || [ ! -w "$DESTINATION_DATA_DIR" ]; then
+  echo "error: destination task $DESTINATION data directory is not writable in this home" >&2
+  exit 1
+fi
+grep -Fq '{TASK}' "$DESTINATION_BRIEF" && {
+  echo "error: destination task $DESTINATION brief still contains a task placeholder" >&2
+  exit 1
+}
+"$SCRIPT_DIR/fm-receipt-check.sh" --parse-criteria "$DESTINATION_BRIEF" >/dev/null 2>&1 || {
+  echo "error: destination task $DESTINATION needs a complete ship brief with concrete acceptance criteria" >&2
+  exit 1
+}
+DESTINATION_ARTIFACT=$(destination_artifact_exists "$DESTINATION" || true)
+[ -z "$DESTINATION_ARTIFACT" ] || {
+  echo "error: destination task $DESTINATION already has durable state at $DESTINATION_ARTIFACT" >&2
+  exit 1
+}
+
+KIND=$(meta_exact "$SOURCE_META" kind) || { echo "error: source task $SOURCE has malformed kind metadata" >&2; exit 1; }
+[ "$KIND" = ship ] || { echo "error: clean-commit relaunch accepts only ordinary ship tasks" >&2; exit 1; }
+[ "$(grep -c '^home=' "$SOURCE_META" 2>/dev/null || true)" -eq 0 ] || {
+  echo "error: source task $SOURCE belongs to a secondmate or another home" >&2
+  exit 1
+}
+ENDPOINT_TASK=$(meta_exact "$SOURCE_META" endpoint_task_id) || { echo "error: source task $SOURCE has malformed endpoint identity" >&2; exit 1; }
+[ "$ENDPOINT_TASK" = "$SOURCE" ] || { echo "error: source task $SOURCE endpoint identity does not match its task id" >&2; exit 1; }
+SOURCE_WORKTREE=$(meta_exact "$SOURCE_META" worktree) || { echo "error: source task $SOURCE has malformed worktree metadata" >&2; exit 1; }
+PROJECT=$(meta_exact "$SOURCE_META" project) || { echo "error: source task $SOURCE has malformed project metadata" >&2; exit 1; }
+HARNESS=$(meta_exact "$SOURCE_META" harness) || { echo "error: source task $SOURCE has malformed harness metadata" >&2; exit 1; }
+BACKEND=$(meta_optional_exact "$SOURCE_META" backend) || { echo "error: source task $SOURCE has malformed backend metadata" >&2; exit 1; }
+BACKEND=${BACKEND:-tmux}
+MODE=$(meta_exact "$SOURCE_META" mode) || { echo "error: source task $SOURCE has malformed delivery metadata" >&2; exit 1; }
+YOLO=$(meta_exact "$SOURCE_META" yolo) || { echo "error: source task $SOURCE has malformed merge posture metadata" >&2; exit 1; }
+MODEL=$(meta_optional_exact "$SOURCE_META" model) || { echo "error: source task $SOURCE has malformed model metadata" >&2; exit 1; }
+EFFORT=$(meta_optional_exact "$SOURCE_META" effort) || { echo "error: source task $SOURCE has malformed effort metadata" >&2; exit 1; }
+if [ "$(grep -c '^prewalk_into=' "$SOURCE_META" 2>/dev/null || true)" -ne 0 ] \
+  || [ "$(grep -c '^allow_project_omp_extensions=' "$SOURCE_META" 2>/dev/null || true)" -ne 0 ]; then
+  echo "error: source task $SOURCE has unsupported OMP-only metadata" >&2
+  exit 1
+fi
+case "$MODE:$YOLO" in
+  no-mistakes:on|no-mistakes:off|direct-PR:on|direct-PR:off|local-only:on|local-only:off) ;;
+  *) echo "error: source task $SOURCE has invalid delivery or merge posture" >&2; exit 1 ;;
+esac
+case "$MODEL" in
+  *[!A-Za-z0-9._:/@+-]*) echo "error: source task $SOURCE has invalid model metadata" >&2; exit 1 ;;
+esac
+case "$EFFORT" in ''|default|low|medium|high|xhigh|max) ;; *) echo "error: source task $SOURCE has invalid effort metadata" >&2; exit 1 ;; esac
+[ "$HARNESS:$BACKEND" = codex:herdr ] || {
+  echo "error: clean-commit relaunch currently supports only verified codex/Herdr source tasks" >&2
+  exit 1
+}
+grep -Fxq "Delivery contract: mode=$MODE" "$DESTINATION_BRIEF" || {
+  echo "error: destination brief delivery contract does not match source mode=$MODE" >&2
+  exit 1
+}
+PR=$(meta_optional_exact "$SOURCE_META" pr) || { echo "error: source task $SOURCE has malformed PR metadata" >&2; exit 1; }
+if [ -n "$PR" ]; then
+  fm_pr_url_parse "$PR" && [ "$FM_PR_URL" = "$PR" ] || {
+    echo "error: source task $SOURCE has non-canonical PR metadata" >&2
+    exit 1
+  }
+  PR=$FM_PR_URL
+fi
+
+SOURCE_WORKTREE=$(resolve_dir source-worktree "$SOURCE_WORKTREE") || exit 1
+PROJECT=$(resolve_dir recorded-project "$PROJECT") || exit 1
+SOURCE_TOP=$(git -C "$SOURCE_WORKTREE" rev-parse --show-toplevel 2>/dev/null || true)
+SOURCE_TOP=$(resolve_dir source-repository-root "$SOURCE_TOP") || exit 1
+[ "$SOURCE_TOP" = "$SOURCE_WORKTREE" ] || {
+  echo "error: source task $SOURCE worktree is not its recorded repository root" >&2
+  exit 1
+}
+PROJECT_TOP=$(git -C "$PROJECT" rev-parse --show-toplevel 2>/dev/null || true)
+PROJECT_TOP=$(resolve_dir project-repository-root "$PROJECT_TOP") || exit 1
+[ "$PROJECT_TOP" = "$PROJECT" ] || {
+  echo "error: source task $SOURCE project is not a repository root" >&2
+  exit 1
+}
+SOURCE_COMMON=$(git -C "$SOURCE_WORKTREE" rev-parse --path-format=absolute --git-common-dir 2>/dev/null || true)
+PROJECT_COMMON=$(git -C "$PROJECT" rev-parse --path-format=absolute --git-common-dir 2>/dev/null || true)
+SOURCE_COMMON=$(resolve_dir source-physical-repository "$SOURCE_COMMON") || exit 1
+PROJECT_COMMON=$(resolve_dir project-physical-repository "$PROJECT_COMMON") || exit 1
+[ "$SOURCE_COMMON" = "$PROJECT_COMMON" ] || {
+  echo "error: source task $SOURCE is not attached to its recorded physical repository" >&2
+  exit 1
+}
+worktree_is_registered "$PROJECT" "$SOURCE_WORKTREE" || {
+  echo "error: source task $SOURCE worktree is not a registered physical worktree" >&2
+  exit 1
+}
+SOURCE_STATUS=$(git -C "$SOURCE_WORKTREE" status --porcelain --untracked-files=all --ignore-submodules=none 2>/dev/null) || {
+  echo "error: source task $SOURCE worktree status is unreadable" >&2
+  exit 1
+}
+[ -z "$SOURCE_STATUS" ] || {
+  echo "error: source task $SOURCE worktree is not completely clean" >&2
+  exit 1
+}
+path_has_git_operation "$SOURCE_WORKTREE" && {
+  echo "error: source task $SOURCE has a Git operation in progress" >&2
+  exit 1
+}
+SOURCE_COMMIT=$(git -C "$SOURCE_WORKTREE" rev-parse --verify --quiet 'HEAD^{commit}' 2>/dev/null || true)
+[ -n "$SOURCE_COMMIT" ] || { echo "error: source task $SOURCE has no readable HEAD commit" >&2; exit 1; }
+SOURCE_BRANCH=$(git -C "$SOURCE_WORKTREE" symbolic-ref --quiet --short HEAD 2>/dev/null || true)
+[ -n "$SOURCE_BRANCH" ] || { echo "error: source task $SOURCE is detached" >&2; exit 1; }
+SOURCE_BRANCH_HEAD=$(git -C "$SOURCE_WORKTREE" rev-parse --verify --quiet "refs/heads/$SOURCE_BRANCH^{commit}" 2>/dev/null || true)
+[ "$SOURCE_BRANCH_HEAD" = "$SOURCE_COMMIT" ] || {
+  echo "error: source task $SOURCE branch does not bind its exact HEAD commit" >&2
+  exit 1
+}
+git -C "$PROJECT" cat-file -e "$SOURCE_COMMIT^{commit}" 2>/dev/null || {
+  echo "error: source task $SOURCE commit is not reachable from its recorded repository" >&2
+  exit 1
+}
+
+fm_backend_validate_task_endpoint "$SOURCE_META" "$SOURCE" >/dev/null || exit 1
+fm_backend_source "$BACKEND" || exit 1
+case "$(fm_backend_agent_state "$BACKEND" "$FM_BACKEND_VALIDATED_TARGET" "$SOURCE_META" 2>/dev/null || true)" in
+  missing) ;;
+  *) echo "error: source task $SOURCE endpoint is not authoritatively missing" >&2; exit 1 ;;
+esac
+CUSTODY=$(no_mistakes_custody "$SOURCE_WORKTREE" "$SOURCE_BRANCH")
+case "$CUSTODY" in
+  none) ;;
+  active|parked) echo "error: source task $SOURCE has active or parked No-Mistakes custody" >&2; exit 1 ;;
+  *) echo "error: source task $SOURCE No-Mistakes custody is unreadable or malformed" >&2; exit 1 ;;
+esac
+task_worktrees_are_well_formed || {
+  echo "error: a local task metadata record has a malformed worktree identity" >&2
+  exit 1
+}
+
+DESTINATION_BRANCH="fm/$DESTINATION"
+[ "$SOURCE_BRANCH" != "$DESTINATION_BRANCH" ] || {
+  echo "error: source and destination branch identities would collide" >&2
+  exit 1
+}
+git -C "$PROJECT" show-ref --verify --quiet "refs/heads/$DESTINATION_BRANCH" && {
+  echo "error: destination task $DESTINATION already has branch $DESTINATION_BRANCH" >&2
+  exit 1
+}
+
+trap defer_destination_allocation_signal HUP INT TERM
+ALLOCATED_WORKTREE=$(cd "$PROJECT" && "$SCRIPT_DIR/fm-treehouse-get.sh" --lease --lease-holder "fm-$DESTINATION") || {
+  trap interrupted HUP INT TERM
+  echo "error: normal allocator did not supply a destination worktree" >&2
+  exit 1
+}
+DESTINATION_WORKTREE=$ALLOCATED_WORKTREE
+DESTINATION_LEASE_WORKTREE=$ALLOCATED_WORKTREE
+DESTINATION_LEASE_OWNED=1
+ALLOCATED_WORKTREE=$(resolve_dir destination-worktree "$ALLOCATED_WORKTREE") || exit 1
+DESTINATION_WORKTREE=$ALLOCATED_WORKTREE
+[ "$ALLOCATED_WORKTREE" != "$SOURCE_WORKTREE" ] || {
+  echo "error: normal allocator reused the source worktree" >&2
+  exit 1
+}
+DESTINATION_TOP=$(git -C "$DESTINATION_WORKTREE" rev-parse --show-toplevel 2>/dev/null || true)
+DESTINATION_TOP=$(resolve_dir destination-repository-root "$DESTINATION_TOP") || exit 1
+[ "$DESTINATION_TOP" = "$DESTINATION_WORKTREE" ] || {
+  echo "error: normal allocator returned a non-root destination worktree" >&2
+  exit 1
+}
+DESTINATION_COMMON=$(git -C "$DESTINATION_WORKTREE" rev-parse --path-format=absolute --git-common-dir 2>/dev/null || true)
+DESTINATION_COMMON=$(resolve_dir destination-physical-repository "$DESTINATION_COMMON") || exit 1
+[ "$DESTINATION_COMMON" = "$PROJECT_COMMON" ] || {
+  echo "error: normal allocator returned a destination from another physical repository" >&2
+  exit 1
+}
+[ "$DESTINATION_WORKTREE" != "$PROJECT" ] || {
+  echo "error: normal allocator returned the primary project worktree" >&2
+  exit 1
+}
+worktree_is_registered "$PROJECT" "$DESTINATION_WORKTREE" || {
+  echo "error: normal allocator returned an unregistered destination worktree" >&2
+  exit 1
+}
+if worktree_is_task_owned "$DESTINATION_WORKTREE"; then
+  echo "error: normal allocator returned an existing task worktree" >&2
+  exit 1
+else
+  case "$?" in
+    1) ;;
+    *) echo "error: could not establish local task worktree ownership" >&2; exit 1 ;;
+  esac
+fi
+if ! fm_pool_worktree_clean "$DESTINATION_WORKTREE" || path_has_git_operation "$DESTINATION_WORKTREE"; then
+  echo "error: normal allocator returned an occupied destination worktree" >&2
+  exit 1
+fi
+DESTINATION_WORKTREE_OWNED=1
+trap interrupted HUP INT TERM
+[ "$DESTINATION_ALLOCATION_INTERRUPTED" -eq 0 ] || exit 1
+trap defer_destination_checkout_signal HUP INT TERM
+if git -C "$DESTINATION_WORKTREE" checkout -b "$DESTINATION_BRANCH" "$SOURCE_COMMIT" >/dev/null; then
+  DESTINATION_BRANCH_CREATED=1
+else
+  trap interrupted HUP INT TERM
+  echo "error: could not create the destination branch at the admitted source commit" >&2
+  exit 1
+fi
+trap interrupted HUP INT TERM
+[ "$DESTINATION_CHECKOUT_INTERRUPTED" -eq 0 ] || exit 1
+DESTINATION_HEAD=$(git -C "$DESTINATION_WORKTREE" rev-parse --verify --quiet 'HEAD^{commit}' 2>/dev/null || true)
+DESTINATION_ATTACHED_BRANCH=$(git -C "$DESTINATION_WORKTREE" symbolic-ref --quiet --short HEAD 2>/dev/null || true)
+[ "$DESTINATION_HEAD" = "$SOURCE_COMMIT" ] && [ "$DESTINATION_ATTACHED_BRANCH" = "$DESTINATION_BRANCH" ] || {
+  echo "error: destination checkout did not retain the admitted branch and commit" >&2
+  exit 1
+}
+
+REPOSITORY_IDENTITY=$(sha256_text "$PROJECT_COMMON")
+SOURCE_BRIEF_IDENTITY=$(sha256_file "$SOURCE_BRIEF") || exit 1
+DESTINATION_BRIEF_IDENTITY=$(sha256_file "$DESTINATION_BRIEF") || exit 1
+trap defer_destination_handoff_signal HUP INT TERM
+if HANDOFF_TMP=$(mktemp "$DATA/$DESTINATION/.relaunch-handoff.XXXXXX"); then
+  DESTINATION_HANDOFF_TMP=$HANDOFF_TMP
+else
+  trap interrupted HUP INT TERM
+  exit 1
+fi
+jq -n \
+  --arg schema fm-clean-commit-relaunch.v1 \
+  --arg source "$SOURCE" \
+  --arg destination "$DESTINATION" \
+  --arg repository_identity "$REPOSITORY_IDENTITY" \
+  --arg source_commit "$SOURCE_COMMIT" \
+  --arg source_branch "$SOURCE_BRANCH" \
+  --arg destination_branch "$DESTINATION_BRANCH" \
+  --arg mode "$MODE" \
+  --arg yolo "$YOLO" \
+  --arg source_brief_identity "$SOURCE_BRIEF_IDENTITY" \
+  --arg destination_brief_identity "$DESTINATION_BRIEF_IDENTITY" \
+  --arg custody "$CUSTODY" \
+  --arg pr "$PR" \
+  '{schema:$schema,source:$source,destination:$destination,repository_identity:$repository_identity,source_commit:$source_commit,source_branch:$source_branch,destination_branch:$destination_branch,delivery:{mode:$mode,yolo:$yolo},source_brief_identity:$source_brief_identity,destination_brief_identity:$destination_brief_identity,no_mistakes_custody:{state:$custody,next_action:"proceed"}} + (if $pr == "" then {} else {pr:$pr} end)' \
+  > "$HANDOFF_TMP" || exit 1
+if ln "$HANDOFF_TMP" "$DESTINATION_HANDOFF"; then
+  DESTINATION_HANDOFF_OWNED=1
+  rm -f -- "$HANDOFF_TMP"
+  DESTINATION_HANDOFF_TMP=
+else
+  rm -f -- "$HANDOFF_TMP"
+  DESTINATION_HANDOFF_TMP=
+  trap interrupted HUP INT TERM
+  echo "error: destination task $DESTINATION already has a durable handoff" >&2
+  exit 1
+fi
+trap interrupted HUP INT TERM
+[ "$DESTINATION_HANDOFF_INTERRUPTED" -eq 0 ] || exit 1
+
+fm_clean_relaunch_launch_allocated \
+  "$DESTINATION" "$PROJECT" "$DESTINATION_WORKTREE" "$DESTINATION_BRIEF" \
+  "$HARNESS" "$BACKEND" "$MODE" "$YOLO" "${MODEL:-default}" "${EFFORT:-default}" || {
+  echo "error: destination launch or acknowledgement failed" >&2
+  exit 1
+}
+printf 'relaunched %s as %s at %s\n' "$SOURCE" "$DESTINATION" "$SOURCE_COMMIT"
diff --git a/docs/architecture.md b/docs/architecture.md
index 143552231d3..9afc4ee587c 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -148,6 +148,7 @@ That poll loop is still the default event source for backends with no native pus
 For capable Herdr sessions, the same watcher replaces its terminal sleep with a bounded native event wait that immediately surfaces `blocked`; [Push events and polling fallback](herdr-backend.md#push-events-and-polling-fallback) owns the current mechanism and capability gates, while [runtime backend verification](verification/runtime-backends.md#native-blocked-event) owns the active evidence.
 The deeper session-start agent-process liveness probe is separate from that busy-state poll: tmux and Herdr have verified classifiers for secondmate recovery, Zellij remains unverified, and Orca and cmux do not support secondmate spawns.
 Herdr is experimental and can be selected explicitly or by runtime auto-detection: Treehouse remains its worktree provider, [`herdr-backend.md`](herdr-backend.md) owns current setup and safety limits, and [`verification/runtime-backends.md`](verification/runtime-backends.md#herdr) owns active empirical evidence.
+The manual [clean committed worker relaunch](#clean-committed-worker-relaunch) is a narrowly scoped Herdr integration.
 Herdr uses one tab per task; [Watching and task containers](herdr-backend.md#watching-and-task-containers) owns launcher-bound workspace placement, the label-only fallback, and recovery scope.
 Its default-on presentation projection may place one clean new task in a disposable workspace without changing endpoint authority or lifecycle ownership; [Presentation spaces](herdr-backend.md#presentation-spaces) owns that conditional design and its narrow home-local restored-shell cleanup at locked session start.
 Zellij is experimental and selected only explicitly: Treehouse remains its worktree provider, [`zellij-backend.md`](zellij-backend.md) owns current setup and limits, and [`verification/runtime-backends.md`](verification/runtime-backends.md#zellij) owns active empirical evidence.
@@ -337,6 +338,16 @@ The helper reuses the durable fleet records and recovery-grade backend liveness
 Its `--check` mode delegates to `omp update --check`, reports the current and available versions, and changes neither the executable nor fleet state.
 The mechanics are owned by the `/updatefirstmate` skill and firstmate's operating manual in [`AGENTS.md`](../AGENTS.md) (self-update).
 
+## Clean committed worker relaunch
+
+`bin/fm-clean-commit-relaunch.sh` is an explicit operator command, never an automatic recovery path.
+It alone admits an ordinary local Codex/Herdr ship task whose recorded endpoint is authoritatively missing and whose committed source is outside No-Mistakes custody.
+It leases a distinct normal worktree in the same physical repository, creates the successor branch at the admitted commit, records evidence, and launches the fresh worker.
+The source branch, records, validation custody, session material, and presentation state remain read-only.
+The initial supported launch profile is Codex on the Herdr backend.
+Generic `fm-spawn.sh` remains a fresh-task interface and does not carry relaunch source, commit, handoff, or allocated-worktree authority.
+The command header owns the exact admission and cleanup mechanics.
+
 ## Restart-proof
 
 Fleet state lives in each task's session-provider backend (tmux by hard default, herdr or cmux when selected or auto-detected, zellij/orca when explicitly selected), no-mistakes run records, status event logs, local markdown under `data/` including `data/captain.md`, `data/captain-shared.md`, and `data/learnings.md`, and persistent secondmate homes.
diff --git a/tests/fm-clean-commit-relaunch.test.sh b/tests/fm-clean-commit-relaunch.test.sh
new file mode 100755
index 00000000000..3dbe5b0f5d7
--- /dev/null
+++ b/tests/fm-clean-commit-relaunch.test.sh
@@ -0,0 +1,623 @@
+#!/usr/bin/env bash
+# Deterministic behavior tests for the explicit clean-commit relaunch owner.
+#
+# The fixture uses linked Git worktrees plus fake Treehouse and Herdr adapters.
+# no-mistakes adapters. No test creates, stops, or interrogates a live Herdr
+# process. Every refusal asserts that allocation was never requested and that
+# source task records and branch identity remain unchanged.
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+REAL_GIT=$(command -v git)
+REAL_LN=$(command -v ln)
+REAL_JQ=$(command -v jq)
+
+TMP_ROOT=$(fm_test_tmproot fm-clean-commit-relaunch)
+fm_git_identity fmtest fmtest@example.invalid
+
+copy_runtime() {  # <fixture>
+  local fixture=$1 file
+  mkdir -p "$fixture/bin/backends"
+  for file in \
+    fm-clean-commit-relaunch.sh fm-clean-commit-relaunch-launch-lib.sh \
+    fm-lock-lib.sh fm-nm-run-lib.sh fm-pr-lib.sh fm-task-inbox-lib.sh \
+    fm-wake-lib.sh fm-backend.sh fm-omp-process-lib.sh fm-tmux-lib.sh \
+    fm-session-lock-lib.sh fm-pool-lib.sh fm-treehouse-root-lib.sh; do
+    cp "$ROOT/bin/$file" "$fixture/bin/$file"
+  done
+  cat > "$fixture/bin/backends/herdr.sh" <<'SH'
+fm_backend_herdr_agent_state() {
+  case "${FM_TEST_ENDPOINT:-missing}" in
+    missing) printf missing ;;
+    live) printf alive ;;
+    dead) printf dead ;;
+    *) printf unreadable ;;
+  esac
+}
+fm_backend_herdr_container_ensure() { printf 'firstmate:workspace\tseeded'; }
+fm_backend_herdr_create_task() {
+  printf 'create-task %s\n' "$*" >> "$FM_TEST_HERDR_LOG"
+  [ -z "${FM_TEST_LAUNCH_DELAY:-}" ] || sleep "$FM_TEST_LAUNCH_DELAY"
+  [ "${FM_TEST_LAUNCH_FAIL:-0}" != 1 ] || return 1
+  printf 'tab-destination pane-destination'
+}
+fm_backend_herdr_send_text_line() { printf 'send-text %s\n' "$*" >> "$FM_TEST_HERDR_LOG"; }
+fm_backend_herdr_send_literal() { printf 'send-literal %s\n' "$*" >> "$FM_TEST_HERDR_LOG"; }
+fm_backend_herdr_send_key() { printf 'send-key %s\n' "$*" >> "$FM_TEST_HERDR_LOG"; }
+fm_backend_herdr_send_text_submit() {
+  printf 'submit %s\n' "$*" >> "$FM_TEST_HERDR_LOG"
+  for message in "$FM_TEST_HOME/state/$FM_TEST_DESTINATION_ID.inbox"/*.msg; do
+    [ -e "$message" ] || continue
+    [ "${FM_TEST_ACK_MODE:-success}" = success ] && mv "$message" "$FM_TEST_HOME/state/$FM_TEST_DESTINATION_ID.inbox/handled/"
+  done
+  printf empty
+}
+fm_backend_herdr_composer_state() { printf empty; }
+fm_backend_herdr_kill() { printf 'kill %s\n' "$*" >> "$FM_TEST_HERDR_LOG"; }
+SH
+  cat > "$fixture/bin/fm-receipt-check.sh" <<'SH'
+#!/usr/bin/env bash
+exit 0
+SH
+cat > "$fixture/bin/fm-treehouse-get.sh" <<'SH'
+#!/usr/bin/env bash
+set -eu
+case "${FM_TEST_ALLOCATOR_MODE:-success}" in
+  success) ;;
+  source) printf '%s\n' "$FM_TEST_SOURCE_WORKTREE"; exit 0 ;;
+  project) printf '%s\n' "$FM_TEST_PROJECT"; exit 0 ;;
+  task) printf '%s\n' "$FM_TEST_TASK_WORKTREE"; exit 0 ;;
+  *) exit 1 ;;
+esac
+[ -z "${FM_TEST_ALLOCATOR_DELAY:-}" ] || sleep "$FM_TEST_ALLOCATOR_DELAY"
+[ -z "${FM_TEST_ALLOCATOR_DIRTY:-}" ] || : > "$FM_TEST_DESTINATION/allocator-dirty"
+[ "${FM_TEST_ALLOCATOR_TREEHOUSE_CONFIG:-0}" != 1 ] || : > "$FM_TEST_DESTINATION/treehouse.toml"
+printf '%s\n' "$FM_TEST_DESTINATION"
+SH
+  cat > "$fixture/bin/fm-treehouse-command.sh" <<'SH'
+#!/usr/bin/env bash
+set -eu
+printf '%s\n' "$*" >> "$FM_TEST_ALLOCATOR_LOG"
+if [ "${1:-}" = return ]; then
+  [ "${FM_TEST_RETURN_FAIL:-0}" != 1 ] || exit 1
+  path=${!#}
+  [ "${2:-}" = --if-lease-holder ] && [ "${3:-}" = "fm-$FM_TEST_DESTINATION_ID" ] \
+    && [ "$path" = "$FM_TEST_DESTINATION" ] || exit 1
+  git -C "$FM_TEST_PROJECT" worktree remove --force "$path" >/dev/null 2>&1 || true
+fi
+SH
+  chmod +x "$fixture/bin"/*.sh "$fixture/bin/backends/herdr.sh"
+}
+
+make_fakebin() {  # <fixture>
+  local fixture fakebin
+  fixture=$1
+  fakebin="$fixture/fakebin"
+  mkdir -p "$fakebin"
+  cat > "$fakebin/no-mistakes" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "${FM_TEST_CUSTODY:-none}" in
+  none) printf 'no active run\n'; exit 1 ;;
+  active) printf 'id: run-active\nbranch: %s\nhead: %s\nstatus: running\n' "$FM_TEST_SOURCE_BRANCH" "$FM_TEST_SOURCE_HEAD" ;;
+  parked) printf 'id: run-parked\nbranch: %s\nhead: %s\nstatus: awaiting_approval\n' "$FM_TEST_SOURCE_BRANCH" "$FM_TEST_SOURCE_HEAD" ;;
+  unreadable) printf 'status: unknown\n' ;;
+esac
+SH
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+log() { printf '%s\n' "$*" >> "$FM_TEST_TMUX_LOG"; }
+command=${1:-}
+shift || true
+case "$command" in
+  has-session) exit 0 ;;
+  new-session) exit 0 ;;
+  list-windows)
+    case "${FM_TEST_ENDPOINT:-missing}" in
+      unreadable) printf 'error connecting to fixture\n' >&2; exit 1 ;;
+    esac
+    case "${FM_TEST_ENDPOINT:-missing}" in
+      live|dead|ambiguous) printf 'fm-source\n' ;;
+    esac
+    [ ! -f "$FM_TEST_WINDOWS" ] || cat "$FM_TEST_WINDOWS"
+    ;;
+  new-window)
+    log "new-window $*"
+    if [ "${FM_TEST_FOREIGN_WINDOW_RACE:-0}" = 1 ]; then
+      printf 'fm-%s\n' "$FM_TEST_DESTINATION_ID" >> "$FM_TEST_WINDOWS"
+      exit 1
+    fi
+    [ "${FM_TEST_DUPLICATE_WINDOW_RACE:-0}" != 1 ] || printf 'fm-%s\n' "$FM_TEST_DESTINATION_ID" >> "$FM_TEST_WINDOWS"
+    [ -z "${FM_TEST_LAUNCH_DELAY:-}" ] || sleep "$FM_TEST_LAUNCH_DELAY"
+    [ "${FM_TEST_LAUNCH_FAIL:-0}" != 1 ] || exit 1
+    printf 'fm-%s\n' "$FM_TEST_DESTINATION_ID" >> "$FM_TEST_WINDOWS"
+    printf '%%42\n'
+    ;;
+  set-window-option) exit 0 ;;
+  display-message)
+    case "$*" in
+      *'#{pane_current_command}'*)
+        case "${FM_TEST_ENDPOINT:-missing}" in
+          dead) printf 'bash\n' ;;
+          ambiguous) printf 'unknown-agent\n' ;;
+          *) printf 'codex\n' ;;
+        esac
+        ;;
+      *'#{pane_id}'*) printf '%%9\n' ;;
+      *'#{pane_current_path}'*) printf '%s\n' "$FM_TEST_DESTINATION" ;;
+      *) printf 'firstmate\n' ;;
+    esac
+    ;;
+  capture-pane) printf '> \n' ;;
+  send-keys)
+    log "send-keys $*"
+    case "$*" in
+      *codex*) [ "${FM_TEST_LAUNCH_COMMAND_FAIL:-0}" != 1 ] || exit 1 ;;
+    esac
+    case "$*" in
+      *'Firstmate instruction waiting:'*)
+        [ "${FM_TEST_ACK_MODE:-success}" = success ] || exit 0
+        for message in "$FM_TEST_HOME/state/$FM_TEST_DESTINATION_ID.inbox"/*.msg; do
+          [ -e "$message" ] || continue
+          mv "$message" "$FM_TEST_HOME/state/$FM_TEST_DESTINATION_ID.inbox/handled/"
+        done
+        ;;
+    esac
+    ;;
+  kill-window) log "kill-window $*" ;;
+esac
+SH
+  cat > "$fakebin/git" <<'SH'
+#!/usr/bin/env bash
+set -u
+if [ "$1" = -C ] && [ "${3:-}" = checkout ] && [ "${4:-}" = -b ]; then
+  if [ "${FM_TEST_CHECKOUT_RACE:-0}" = 1 ]; then
+    "${FM_TEST_REAL_GIT}" -C "$2" branch "$5" "$6"
+    exit 1
+  fi
+  [ "${FM_TEST_CHECKOUT_FAIL:-0}" != 1 ] || exit 1
+fi
+exec "${FM_TEST_REAL_GIT}" "$@"
+SH
+  cat > "$fakebin/ln" <<'SH'
+#!/usr/bin/env bash
+set -u
+destination=${!#}
+case "$destination" in
+  */relaunch-handoff.json)
+    [ "${FM_TEST_HANDOFF_RACE:-0}" != 1 ] || printf 'foreign handoff\n' > "$destination"
+    ;;
+  */destination.meta)
+    [ "${FM_TEST_META_RACE:-0}" != 1 ] || printf 'foreign metadata\n' > "$destination"
+    ;;
+esac
+exec "$FM_TEST_REAL_LN" "$@"
+SH
+  cat > "$fakebin/jq" <<'SH'
+#!/usr/bin/env bash
+set -u
+[ "${FM_TEST_JQ_FAIL:-0}" != 1 ] || exit 1
+exec "$FM_TEST_REAL_JQ" "$@"
+SH
+  chmod +x "$fakebin"/*
+}
+
+write_brief() {  # <path> <mode>
+  local path=$1 mode=$2
+  mkdir -p "$(dirname "$path")"
+  cat > "$path" <<EOF
+# Task
+Exercise the relaunch fixture.
+
+# Acceptance criteria
+- AC1: The fixture exposes its destination behavior.
+
+# Definition of done
+Delivery contract: mode=$mode
+EOF
+}
+
+new_case() {  # <name>
+  local name fixture project source destination other home
+  name=$1
+  fixture="$TMP_ROOT/$name"
+  project="$fixture/project"
+  source="$fixture/source"
+  destination="$fixture/destination"
+  other="$fixture/other"
+  home="$fixture/home"
+  mkdir -p "$fixture" "$fixture/tmp" "$home/state" "$home/data" "$home/config" "$project"
+  git -C "$project" init -q
+  printf '%s\n' initial > "$project/tracked.txt"
+  git -C "$project" add tracked.txt
+  git -C "$project" commit -qm initial
+  git -C "$project" branch -M main
+  git -C "$project" worktree add -q -b fm/source "$source" main
+  printf '%s\n' committed > "$source/committed.txt"
+  git -C "$source" add committed.txt
+  git -C "$source" commit -qm committed-source
+  git -C "$project" worktree add -q -b pool/destination "$destination" main
+  git -C "$project" worktree add -q -b fm/other "$other" main
+  copy_runtime "$fixture"
+  make_fakebin "$fixture"
+  write_brief "$home/data/source/brief.md" no-mistakes
+  write_brief "$home/data/destination/brief.md" no-mistakes
+  cat > "$home/state/source.meta" <<EOF
+endpoint_task_id=source
+worktree=$source
+project=$project
+harness=codex
+backend=herdr
+herdr_session=firstmate
+herdr_workspace_id=workspace-source
+herdr_tab_id=tab-source
+herdr_pane_id=pane-source
+window=firstmate:pane-source
+kind=ship
+mode=no-mistakes
+yolo=off
+model=default
+effort=default
+tasktmp=$fixture/tmp/fm-source
+pr=https://github.com/example/repo/pull/1
+EOF
+: > "$home/state/source.status"
+mkdir -p "$home/state/source.inbox/handled" "$fixture/tmp/fm-source"
+printf '%s\n' source-session > "$home/state/source.hermes-session"
+printf '%s\n' source-presentation > "$home/state/source.herdr-presentation"
+printf '%s\n' source-validation > "$home/state/source.pr-poll"
+printf '%s\n' source-inbox > "$home/state/source.inbox/001.msg"
+printf '%s\n' source-temp > "$fixture/tmp/fm-source/session"
+printf '%s\n' source-receipt > "$home/data/source/evidence.jsonl"
+printf 'worktree=%s\n' "$other" > "$home/state/other.meta"
+  : > "$fixture/windows"
+  : > "$fixture/allocator.log"
+  : > "$fixture/tmux.log"
+  printf '%s\n' "$fixture"
+}
+
+run_owner() {  # <fixture> [source] [destination]
+  local fixture=$1 source=${2:-source} destination=${3:-destination} source_branch source_head
+  source_branch=$(git -C "$fixture/source" symbolic-ref --short HEAD)
+  source_head=$(git -C "$fixture/source" rev-parse HEAD)
+  PATH="$fixture/fakebin:$PATH" \
+    FM_TEST_REAL_GIT="$REAL_GIT" \
+    FM_TEST_REAL_LN="$REAL_LN" \
+    FM_TEST_REAL_JQ="$REAL_JQ" \
+    FM_TEST_HOME="$fixture/home" \
+    FM_TEST_PROJECT="$fixture/project" \
+    FM_TEST_SOURCE_WORKTREE="$fixture/source" \
+    FM_TEST_SOURCE_BRANCH="$source_branch" \
+    FM_TEST_SOURCE_HEAD="$source_head" \
+    FM_TEST_TASK_WORKTREE="$fixture/other" \
+    FM_TEST_DESTINATION="$fixture/destination" \
+    FM_TEST_DESTINATION_ID="$destination" \
+    FM_TEST_WINDOWS="$fixture/windows" \
+    FM_TEST_ALLOCATOR_LOG="$fixture/allocator.log" \
+    FM_TEST_HERDR_LOG="$fixture/tmux.log" \
+    TMPDIR="$fixture/tmp" FM_HOME="$fixture/home" FM_ROOT_OVERRIDE="$ROOT" \
+    "$fixture/bin/fm-clean-commit-relaunch.sh" "$source" "$destination"
+}
+
+source_snapshot() {  # <fixture>
+  local fixture source home
+  fixture=$1
+  source="$fixture/source"
+  home="$fixture/home"
+  {
+    git -C "$source" status --porcelain --untracked-files=all
+    git -C "$source" rev-parse HEAD
+    git -C "$source" rev-parse refs/heads/fm/source
+    sha256sum "$home/state/source.meta" "$home/state/source.status" \
+      "$home/state/source.hermes-session" "$home/state/source.herdr-presentation" \
+      "$home/state/source.pr-poll" "$home/state/source.inbox/001.msg" \
+      "$home/data/source/brief.md" "$home/data/source/evidence.jsonl" \
+      "$fixture/tmp/fm-source/session"
+  } | sha256sum | awk '{print $1}'
+}
+
+assert_refused_before_allocation() {  # <fixture> <output> <label>
+  local fixture=$1 output=$2 label=$3
+  [ -z "$(cat "$fixture/allocator.log")" ] || fail "$label allocated a destination before refusing"
+  assert_contains "$output" 'error:' "$label did not explain its refusal"
+}
+
+# Success accepts linked worktrees sharing a common directory, creates the exact
+# destination branch, records only stable handoff fields, and leaves every
+# source-owned record and ref unchanged.
+fixture=$(new_case success)
+before=$(source_snapshot "$fixture")
+out=$(run_owner "$fixture" 2>&1)
+expect_code 0 $? "linked-worktree relaunch should succeed"
+assert_contains "$out" 'relaunched source as destination' "success output omitted source and destination"
+source_head=$(git -C "$fixture/source" rev-parse HEAD)
+[ "$(git -C "$fixture/destination" rev-parse HEAD)" = "$source_head" ] || fail "destination did not retain the admitted source commit"
+[ "$(git -C "$fixture/destination" symbolic-ref --short HEAD)" = fm/destination ] || fail "destination did not receive its fresh branch"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "success mutated source-owned branch or records"
+assert_present "$fixture/home/state/destination.meta" "success did not publish destination metadata"
+assert_present "$fixture/home/data/destination/relaunch-handoff.json" "success did not publish handoff"
+jq -e --arg commit "$source_head" '
+  .schema == "fm-clean-commit-relaunch.v1" and .source == "source" and .destination == "destination" and
+  .source_commit == $commit and .source_branch == "fm/source" and .destination_branch == "fm/destination" and
+  .delivery == {mode:"no-mistakes",yolo:"off"} and .no_mistakes_custody == {state:"none",next_action:"proceed"} and
+  .pr == "https://github.com/example/repo/pull/1" and (.repository_identity | type == "string" and length == 64)
+' "$fixture/home/data/destination/relaunch-handoff.json" >/dev/null || fail "handoff omitted stable admitted identities"
+assert_no_grep "$fixture/source" "$fixture/home/data/destination/relaunch-handoff.json" "handoff captured mutable source path"
+assert_no_grep 'FM_CLEAN' "$fixture/home/data/destination/relaunch-handoff.json" "handoff captured caller environment"
+pass "clean relaunch: linked worktree success preserves source and binds exact destination identity"
+
+# The pool's untracked root configuration is normal allocator state, not work.
+fixture=$(new_case treehouse-config)
+before=$(source_snapshot "$fixture")
+out=$(FM_TEST_ALLOCATOR_TREEHOUSE_CONFIG=1 run_owner "$fixture" 2>&1)
+expect_code 0 $? "Treehouse-configured destination should succeed"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "Treehouse-configured destination mutated source"
+[ -f "$fixture/destination/treehouse.toml" ] || fail "Treehouse-configured destination lost its pool configuration"
+pass "clean relaunch: lone Treehouse pool configuration remains admissible"
+
+# Endpoint state is admission, never a recovery guess.
+for endpoint in live dead ambiguous unreadable; do
+  fixture=$(new_case "endpoint-$endpoint")
+  before=$(source_snapshot "$fixture")
+  out=$(FM_TEST_ENDPOINT="$endpoint" run_owner "$fixture" 2>&1)
+  expect_code 1 $? "endpoint $endpoint should refuse"
+  assert_refused_before_allocation "$fixture" "$out" "endpoint $endpoint"
+  [ "$(source_snapshot "$fixture")" = "$before" ] || fail "endpoint $endpoint mutated source"
+done
+pass "clean relaunch: only an authoritatively missing endpoint passes admission"
+
+# Metadata identity, role, home, and durable occupancy all refuse before the
+# allocator can create a destination.
+for mutation in malformed wrong-kind secondmate endpoint-mismatch destination-occupied destination-doorbell-requests duplicate-pr noncanonical-pr branch-collision; do
+  fixture=$(new_case "admission-$mutation")
+  case "$mutation" in
+    malformed) printf 'worktree=%s\n' "$fixture/source" >> "$fixture/home/state/source.meta" ;;
+    wrong-kind) sed -i 's/^kind=ship$/kind=scout/' "$fixture/home/state/source.meta" ;;
+    secondmate) printf 'home=%s\n' "$fixture/home" >> "$fixture/home/state/source.meta" ;;
+    endpoint-mismatch) sed -i 's/^endpoint_task_id=source$/endpoint_task_id=other/' "$fixture/home/state/source.meta" ;;
+    destination-occupied) : > "$fixture/home/state/destination.status" ;;
+    destination-doorbell-requests) : > "$fixture/home/state/destination.omp-doorbell-ready.requests" ;;
+    duplicate-pr) printf 'pr=https://github.com/example/repo/pull/2\n' >> "$fixture/home/state/source.meta" ;;
+    noncanonical-pr) sed -i 's#^pr=.*#pr=https://github.com/example/repo/pull/not-a-number#' "$fixture/home/state/source.meta" ;;
+    branch-collision) git -C "$fixture/project" branch fm/destination main ;;
+  esac
+  before=$(source_snapshot "$fixture")
+  out=$(run_owner "$fixture" 2>&1)
+  expect_code 1 $? "$mutation should refuse"
+  assert_refused_before_allocation "$fixture" "$out" "$mutation"
+  [ "$(source_snapshot "$fixture")" = "$before" ] || fail "$mutation mutated source"
+done
+pass "clean relaunch: malformed, foreign, occupied, and colliding admission cases refuse"
+
+# Dirty source states and every active Git operation marker are never salvaged.
+for mutation in staged untracked deleted detached missing-branch unreachable; do
+  fixture=$(new_case "git-$mutation")
+  case "$mutation" in
+    staged) printf '%s\n' staged > "$fixture/source/staged.txt"; git -C "$fixture/source" add staged.txt ;;
+    untracked) printf '%s\n' untracked > "$fixture/source/untracked.txt" ;;
+    deleted) rm "$fixture/source/tracked.txt" ;;
+    detached) git -C "$fixture/source" checkout -q --detach ;;
+    missing-branch) git -C "$fixture/source" update-ref -d refs/heads/fm/source ;;
+    unreachable) git -C "$fixture/source" commit-tree "HEAD^{tree}" -m unreachable >/dev/null; git -C "$fixture/project" update-ref -d refs/heads/fm/source ;;
+  esac
+  out=$(run_owner "$fixture" 2>&1)
+  expect_code 1 $? "git state $mutation should refuse"
+  assert_refused_before_allocation "$fixture" "$out" "git state $mutation"
+done
+for marker in MERGE_HEAD CHERRY_PICK_HEAD REVERT_HEAD REBASE_HEAD BISECT_START BISECT_LOG sequencer rebase-apply rebase-merge; do
+  fixture=$(new_case "marker-$marker")
+  path=$(git -C "$fixture/source" rev-parse --git-path "$marker")
+  if [ "$marker" = sequencer ] || [ "$marker" = rebase-apply ] || [ "$marker" = rebase-merge ]; then mkdir -p "$path"; else : > "$path"; fi
+  out=$(run_owner "$fixture" 2>&1)
+  expect_code 1 $? "Git marker $marker should refuse"
+  assert_refused_before_allocation "$fixture" "$out" "Git marker $marker"
+done
+pass "clean relaunch: dirty, detached, unreachable, and Git-operation sources refuse"
+
+# Custody is an admission boundary, including malformed data.
+for custody in active parked unreadable; do
+  fixture=$(new_case "custody-$custody")
+  before=$(source_snapshot "$fixture")
+  out=$(FM_TEST_CUSTODY="$custody" run_owner "$fixture" 2>&1)
+  expect_code 1 $? "custody $custody should refuse"
+  assert_refused_before_allocation "$fixture" "$out" "custody $custody"
+  case "$custody" in
+    active|parked) assert_contains "$out" 'active or parked No-Mistakes custody' "$custody custody was not parsed" ;;
+    unreadable) assert_contains "$out" 'custody is unreadable or malformed' "unreadable custody was not parsed" ;;
+  esac
+  [ "$(source_snapshot "$fixture")" = "$before" ] || fail "custody $custody mutated source"
+done
+pass "clean relaunch: active, parked, and unreadable No-Mistakes custody refuses"
+
+fixture=$(new_case malformed-other-worktree)
+printf 'worktree=%s\n' "$fixture/destination" >> "$fixture/home/state/other.meta"
+before=$(source_snapshot "$fixture")
+out=$(run_owner "$fixture" 2>&1)
+expect_code 1 $? "malformed foreign worktree metadata should refuse"
+assert_refused_before_allocation "$fixture" "$out" "malformed foreign worktree metadata"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "malformed foreign worktree metadata mutated source"
+pass "clean relaunch: malformed foreign worktree metadata refuses"
+
+fixture=$(new_case symlinked-other-worktree)
+rm -f -- "$fixture/home/state/other.meta"
+ln -s "$fixture/other" "$fixture/home/state/other.meta"
+before=$(source_snapshot "$fixture")
+out=$(run_owner "$fixture" 2>&1)
+expect_code 1 $? "symlinked foreign worktree metadata should refuse"
+assert_refused_before_allocation "$fixture" "$out" "symlinked foreign worktree metadata"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "symlinked foreign worktree metadata mutated source"
+pass "clean relaunch: symlinked foreign worktree metadata refuses"
+
+# Failure after allocation leaves no source change and cleans only the new
+# destination's branch, endpoint, task data, and leased worktree.
+for failure in allocator checkout launch acknowledgement; do
+  fixture=$(new_case "failure-$failure")
+  before=$(source_snapshot "$fixture")
+  case "$failure" in
+    allocator)
+      out=$(FM_TEST_ALLOCATOR_MODE=fail run_owner "$fixture" 2>&1)
+      status=$?
+      ;;
+    checkout)
+      out=$(FM_TEST_CHECKOUT_FAIL=1 run_owner "$fixture" 2>&1)
+      status=$?
+      ;;
+    launch)
+      out=$(FM_TEST_LAUNCH_FAIL=1 run_owner "$fixture" 2>&1)
+      status=$?
+      ;;
+    acknowledgement)
+      out=$(FM_TEST_ACK_MODE=timeout FM_CLEAN_COMMIT_RELAUNCH_ACK_POLLS=2 FM_CLEAN_COMMIT_RELAUNCH_ACK_INTERVAL=0.01 run_owner "$fixture" 2>&1)
+      status=$?
+      ;;
+  esac
+  expect_code 1 "$status" "$failure should fail"
+  assert_contains "$out" 'error:' "$failure did not report failure"
+  [ "$(source_snapshot "$fixture")" = "$before" ] || fail "$failure mutated source"
+  assert_absent "$fixture/home/state/destination.meta" "$failure retained destination metadata"
+  assert_absent "$fixture/home/data/destination/relaunch-handoff.json" "$failure retained destination handoff"
+  git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination && fail "$failure retained destination branch"
+done
+pass "clean relaunch: allocator, checkout, launch, and acknowledgement failure preserve source"
+
+fixture=$(new_case allocator-dirty-destination)
+before=$(source_snapshot "$fixture")
+out=$(FM_TEST_ALLOCATOR_DIRTY=1 run_owner "$fixture" 2>&1)
+expect_code 1 $? "dirty allocated destination should fail"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "dirty allocated destination mutated source"
+assert_absent "$fixture/destination" "dirty allocated destination retained its lease"
+assert_contains "$(cat "$fixture/allocator.log")" 'return --if-lease-holder fm-destination' "dirty allocated destination was not returned"
+git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination && fail "dirty allocated destination retained destination branch"
+pass "clean relaunch: rejected allocated destination returns its lease"
+
+fixture=$(new_case handoff-staging-failure)
+before=$(source_snapshot "$fixture")
+out=$(FM_TEST_JQ_FAIL=1 run_owner "$fixture" 2>&1)
+expect_code 1 $? "handoff rendering failure should fail"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "handoff rendering failure mutated source"
+[ -z "$(find "$fixture/home/data/destination" -maxdepth 1 -name '.relaunch-handoff.*' -print -quit)" ] || fail "handoff rendering failure retained staging file"
+assert_absent "$fixture/home/data/destination/relaunch-handoff.json" "handoff rendering failure published handoff"
+git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination && fail "handoff rendering failure retained destination branch"
+pass "clean relaunch: handoff rendering failure removes staging state"
+
+# A malicious or faulty allocator cannot turn source preservation into cleanup.
+fixture=$(new_case allocator-reuses-source)
+before=$(source_snapshot "$fixture")
+out=$(FM_TEST_ALLOCATOR_MODE=source run_owner "$fixture" 2>&1)
+expect_code 1 $? "source-reusing allocator should refuse"
+assert_contains "$out" 'reused the source worktree' "source-reusing allocator did not explain its refusal"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "source-reusing allocator cleaned or mutated source"
+[ -d "$fixture/source" ] || fail "source-reusing allocator removed the source worktree"
+assert_not_contains "$(cat "$fixture/allocator.log")" '--force' "source-reusing allocator used unsafe cleanup"
+pass "clean relaunch: source-reusing allocator cannot clean the source"
+
+# Only an unclaimed pool worktree may become cleanup-owned destination state.
+for allocator in project task; do
+  fixture=$(new_case "allocator-reuses-$allocator")
+  before=$(source_snapshot "$fixture")
+  out=$(FM_TEST_ALLOCATOR_MODE="$allocator" run_owner "$fixture" 2>&1)
+  expect_code 1 $? "$allocator-reusing allocator should refuse"
+  assert_contains "$out" 'error:' "$allocator-reusing allocator did not explain its refusal"
+  [ "$(source_snapshot "$fixture")" = "$before" ] || fail "$allocator-reusing allocator mutated source"
+  assert_not_contains "$(cat "$fixture/allocator.log")" '--force' "$allocator-reusing allocator used unsafe cleanup"
+  git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination && fail "$allocator-reusing allocator created a destination branch"
+done
+pass "clean relaunch: allocator must not reuse existing project worktrees"
+
+# A return failure stays visible and leaves the lease-bound destination intact.
+fixture=$(new_case return-failure)
+before=$(source_snapshot "$fixture")
+out=$(FM_TEST_LAUNCH_FAIL=1 FM_TEST_RETURN_FAIL=1 run_owner "$fixture" 2>&1)
+expect_code 1 $? "return failure should fail"
+assert_contains "$out" 'destination cleanup is incomplete' "return failure was suppressed"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "return failure mutated source"
+assert_present "$fixture/destination" "return failure removed the destination worktree"
+git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination || fail "return failure removed attached destination branch"
+pass "clean relaunch: failed destination return remains actionable"
+
+fixture=$(new_case handoff-race)
+before=$(source_snapshot "$fixture")
+out=$(FM_TEST_HANDOFF_RACE=1 run_owner "$fixture" 2>&1)
+expect_code 1 $? "concurrent handoff creation should fail"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "concurrent handoff creation mutated source"
+[ "$(cat "$fixture/home/data/destination/relaunch-handoff.json")" = 'foreign handoff' ] || fail "concurrent handoff was overwritten or removed"
+pass "clean relaunch: concurrent handoff remains foreign"
+
+fixture=$(new_case metadata-race)
+before=$(source_snapshot "$fixture")
+out=$(FM_TEST_META_RACE=1 run_owner "$fixture" 2>&1)
+expect_code 1 $? "concurrent metadata creation should fail"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "concurrent metadata creation mutated source"
+[ "$(cat "$fixture/home/state/destination.meta")" = 'foreign metadata' ] || fail "concurrent metadata was overwritten or removed"
+pass "clean relaunch: concurrent metadata remains foreign"
+
+fixture=$(new_case published-output-failure)
+before=$(source_snapshot "$fixture")
+run_owner "$fixture" >/dev/full 2>"$fixture/published-output-failure.out"
+status=$?
+expect_code 1 "$status" "published output failure should fail"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "published output failure mutated source"
+assert_absent "$fixture/home/state/destination.meta" "published output failure retained destination metadata"
+assert_absent "$fixture/home/data/destination/relaunch-handoff.json" "published output failure retained destination handoff"
+git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination && fail "published output failure retained destination branch"
+pass "clean relaunch: published output failure cleans destination"
+
+# A concurrent branch creation never becomes this relaunch's cleanup target.
+fixture=$(new_case branch-race)
+before=$(source_snapshot "$fixture")
+out=$(FM_TEST_CHECKOUT_RACE=1 run_owner "$fixture" 2>&1)
+expect_code 1 $? "concurrent branch creation should fail"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "concurrent branch creation mutated source"
+git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination || fail "concurrent branch creation was deleted"
+pass "clean relaunch: concurrent destination branch remains foreign"
+
+# An interrupt after handoff publication exits through destination-only cleanup.
+fixture=$(new_case interrupted-publication)
+before=$(source_snapshot "$fixture")
+FM_TEST_LAUNCH_DELAY=5 run_owner "$fixture" >"$fixture/interrupted.out" 2>&1 &
+pid=$!
+# Wait for both the published handoff and the delayed endpoint creation. The
+# latter is the fixture's observable barrier that the owner has entered the
+# post-publication launch window before this test interrupts it.
+for _ in $(seq 1 400); do
+  [ -f "$fixture/home/data/destination/relaunch-handoff.json" ] \
+    && grep -Fq 'create-task ' "$fixture/tmux.log" && break
+  sleep 0.01
+done
+assert_present "$fixture/home/data/destination/relaunch-handoff.json" "interrupt fixture did not reach destination publication"
+grep -Fq 'create-task ' "$fixture/tmux.log" \
+  || fail "interrupt fixture did not enter the delayed destination launch"
+kill -HUP "$pid"
+wait "$pid"
+status=$?
+expect_code 1 "$status" "interrupted publication should fail"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "interrupted publication mutated source"
+assert_absent "$fixture/home/state/destination.meta" "interrupted publication retained destination metadata"
+assert_absent "$fixture/home/data/destination/relaunch-handoff.json" "interrupted publication retained handoff"
+git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination && fail "interrupted publication retained destination branch"
+pass "clean relaunch: interrupted destination publication preserves source"
+
+# The destination lock serializes two simultaneous attempts before a second
+# endpoint or branch can be created.
+fixture=$(new_case concurrency)
+FM_TEST_ALLOCATOR_DELAY=0.2 run_owner "$fixture" >"$fixture/first.out" 2>&1 &
+pid=$!
+sleep 0.05
+out=$(run_owner "$fixture" 2>&1)
+status=$?
+wait "$pid"
+first_status=$?
+[ "$first_status" -eq 0 ] || fail "first concurrent relaunch did not succeed: $(cat "$fixture/first.out")"
+[ "$status" -ne 0 ] || fail "second concurrent relaunch unexpectedly succeeded"
+[ "$(grep -c '^create-task ' "$fixture/tmux.log")" -eq 1 ] || fail "concurrent relaunch created duplicate endpoints"
+pass "clean relaunch: destination lock serializes concurrent requests"
+
+# Generic spawn retains its public fresh-task interface; legacy relaunch flags
+help=$("$ROOT/bin/fm-spawn.sh" --help)
+assert_not_contains "$help" 'accepted-clean-commit' "generic spawn still exposes a relaunch commit flag"
+assert_not_contains "$help" 'relaunch-handoff' "generic spawn still exposes handoff authority"
+assert_not_contains "$help" 'allocated-worktree' "generic spawn still exposes an allocated-worktree mode"
+pass "clean relaunch: generic spawn exposes no relaunch carrier"