From 1d3bcdbffe51b73d7877ac23e75aa02357b03001 Mon Sep 17 00:00:00 2001
From: Pranay Pratyush <pranay.pratyush@gmail.com>
Date: Mon, 31 Aug 2026 17:49:17 +0530
Subject: [PATCH 01/16] feat: add clean commit relaunch owner

---
 bin/fm-clean-commit-relaunch-launch-lib.sh | 145 +++++++
 bin/fm-clean-commit-relaunch.sh            | 465 +++++++++++++++++++++
 docs/architecture.md                       |   9 +
 tests/fm-clean-commit-relaunch.test.sh     | 405 ++++++++++++++++++
 4 files changed, 1024 insertions(+)
 create mode 100755 bin/fm-clean-commit-relaunch-launch-lib.sh
 create mode 100755 bin/fm-clean-commit-relaunch.sh
 create mode 100755 tests/fm-clean-commit-relaunch.test.sh

diff --git a/bin/fm-clean-commit-relaunch-launch-lib.sh b/bin/fm-clean-commit-relaunch-launch-lib.sh
new file mode 100755
index 0000000000..4ec6874b0e
--- /dev/null
+++ b/bin/fm-clean-commit-relaunch-launch-lib.sh
@@ -0,0 +1,145 @@
+#!/usr/bin/env bash
+# Private post-allocation launch implementation for fm-clean-commit-relaunch.
+#
+# This file is source-only implementation code, not an operator command.
+# Its interface accepts only a destination identity and an already allocated
+# worktree. It never receives, reads, or validates source relaunch authority,
+# an exact commit, a handoff path, or relaunch environment state.
+
+_FM_CLEAN_RELAUNCH_LAUNCH_LIB_DIR=$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)
+# shellcheck source=bin/fm-task-inbox-lib.sh
+. "$_FM_CLEAN_RELAUNCH_LAUNCH_LIB_DIR/fm-task-inbox-lib.sh"
+
+FM_CLEAN_RELAUNCH_LAUNCH_TARGET=
+FM_CLEAN_RELAUNCH_LAUNCH_STATE=
+
+fm_clean_relaunch_shell_quote() {  # <value>
+  local value=$1
+  printf "'%s'" "${value//\'/\'\\\'\'}"
+}
+
+fm_clean_relaunch_destination_meta_absent() {  # <state> <id>
+  local state=$1 id=$2 artifact
+  for artifact in "$state/$id.meta" "$state/$id.inbox" "$state/$id.status" "${TMPDIR:-/tmp}/fm-$id"; do
+    [ ! -e "$artifact" ] && [ ! -L "$artifact" ] || return 1
+  done
+}
+
+fm_clean_relaunch_launch_cleanup() {  # <destination-id>
+  local id=$1 state=${FM_CLEAN_RELAUNCH_LAUNCH_STATE:-} target=${FM_CLEAN_RELAUNCH_LAUNCH_TARGET:-}
+  [ -n "$target" ] && fm_backend_kill tmux "$target" >/dev/null 2>&1 || true
+  [ -n "$state" ] || return 0
+  rm -rf -- "${TMPDIR:-/tmp}/fm-$id"
+  rm -rf -- "$state/$id.inbox"
+  rm -f -- "$state/$id.meta" "$state/$id.status" "$state/$id.turn-ended" \
+    "$state/$id.pi-ext.ts" "$state/$id.omp-ext.ts" "$state/$id.omp-ready" \
+    "$state/$id.omp-started" "$state/$id.omp-doorbell-ready" "$state/$id.busy-state" \
+    "$state/$id.busy-gen" "$state/$id.grok-turnend-token" "$state/$id.kimi-turnend-token" \
+    "$state/$id.hermes-turnend-token" "$state/$id.hermes-session" "$state/$id.hermes-started"
+}
+
+fm_clean_relaunch_wait_for_ack() {  # <state> <id> <record>
+  local state=$1 id=$2 record=$3 polls=${FM_CLEAN_COMMIT_RELAUNCH_ACK_POLLS:-120}
+  local interval=${FM_CLEAN_COMMIT_RELAUNCH_ACK_INTERVAL:-0.5} handled
+  case "$polls" in ''|*[!0-9]*|0) polls=120 ;; esac
+  handled="$state/$id.inbox/handled/${record##*/}"
+  while [ "$polls" -gt 0 ]; do
+    [ -f "$handled" ] && return 0
+    sleep "$interval"
+    polls=$((polls - 1))
+  done
+  return 1
+}
+
+# fm_clean_relaunch_launch_allocated starts one fresh endpoint in an already
+# validated clean worktree. The relaunch owner alone decides whether that
+# worktree was allocated or which commit it contains.
+#
+# Interface:
+#   <destination-id> <project-root> <allocated-worktree> <brief>
+#   <harness> <backend> <mode> <yolo> <model> <effort>
+#
+# The first supported profile is codex on the reference tmux backend. Refusing
+# every other tuple before endpoint creation is deliberate. Their lifecycle
+# setup and acknowledgement semantics stay owned by generic fm-spawn until a
+# profile can share this helper without relaunch-specific input.
+fm_clean_relaunch_launch_allocated() {
+  local id=$1 project=$2 worktree=$3 brief=$4 harness=$5 backend=$6 mode=$7 yolo=$8 model=$9 effort=${10}
+  local state=${STATE:?STATE must be set by the relaunch owner}
+  local session window target task_tmp meta_tmp launch record handoff
+
+  [ "$harness:$backend" = codex:tmux ] || {
+    echo "error: allocated relaunch launch supports only codex/tmux" >&2
+    return 1
+  }
+  [ -f "$brief" ] && [ ! -L "$brief" ] && [ -r "$brief" ] || {
+    echo "error: destination brief is unreadable" >&2
+    return 1
+  }
+  [ -d "$project" ] && [ -d "$worktree" ] && [ ! -L "$worktree" ] || {
+    echo "error: destination worktree is unreadable" >&2
+    return 1
+  }
+  [ "$(git -C "$worktree" rev-parse --show-toplevel 2>/dev/null || true)" = "$worktree" ] || {
+    echo "error: allocated destination is not a worktree root" >&2
+    return 1
+  }
+  fm_clean_relaunch_destination_meta_absent "$state" "$id" || {
+    echo "error: destination state is already occupied" >&2
+    return 1
+  }
+  fm_backend_source tmux || return 1
+  session=$(fm_backend_tmux_container_ensure) || return 1
+  window="fm-$id"
+  target="$session:$window"
+  fm_backend_tmux_create_task "$session" "$window" "$worktree" >/dev/null || return 1
+
+  FM_CLEAN_RELAUNCH_LAUNCH_TARGET=$target
+  FM_CLEAN_RELAUNCH_LAUNCH_STATE=$state
+  task_tmp="${TMPDIR:-/tmp}/fm-$id"
+  if [ -L "$task_tmp" ]; then
+    echo "error: destination task temp root must not be a symlink" >&2
+    return 1
+  fi
+  mkdir -p "$task_tmp/gotmp" || return 1
+
+  meta_tmp=$(mktemp "$state/.${id}.meta.XXXXXX") || return 1
+  if ! {
+    printf 'window=%s\n' "$target"
+    printf 'endpoint_task_id=%s\n' "$id"
+    printf 'worktree=%s\n' "$worktree"
+    printf 'project=%s\n' "$project"
+    printf 'harness=%s\n' "$harness"
+    printf 'kind=ship\n'
+    printf 'mode=%s\n' "$mode"
+    printf 'yolo=%s\n' "$yolo"
+    printf 'tasktmp=%s\n' "$task_tmp"
+    printf 'model=%s\n' "$model"
+    printf 'effort=%s\n' "$effort"
+  } > "$meta_tmp"; then
+    rm -f -- "$meta_tmp"
+    return 1
+  fi
+  if ! mv -f -- "$meta_tmp" "$state/$id.meta"; then
+    rm -f -- "$meta_tmp"
+    return 1
+  fi
+
+  fm_backend_tmux_send_text_line "$target" "export GOTMPDIR=$(fm_clean_relaunch_shell_quote "$task_tmp/gotmp")" || return 1
+  launch="codex"
+  [ "$model" = default ] || launch="$launch --model $(fm_clean_relaunch_shell_quote "$model")"
+  case "$effort" in
+    low|medium|high|xhigh) launch="$launch -c $(fm_clean_relaunch_shell_quote "model_reasoning_effort=\"$effort\"")" ;;
+  esac
+  launch="$launch --dangerously-bypass-approvals-and-sandbox \$( $(fm_clean_relaunch_shell_quote "$FM_ROOT/bin/fm-operational-input.sh") encode launch-brief < $(fm_clean_relaunch_shell_quote "$brief") )"
+  fm_backend_tmux_send_literal "$target" "$launch" || return 1
+  fm_backend_tmux_send_key "$target" Enter || return 1
+  handoff="${DATA:?DATA must be set by the relaunch owner}/$id/relaunch-handoff.json"
+
+  record=$(fm_task_inbox_write "$state" "$id" "Read the durable preserved-work handoff at $handoff before continuing the task.") || return 1
+  fm_task_inbox_ring tmux "$target" "$record" "$window" codex || return 1
+  fm_clean_relaunch_wait_for_ack "$state" "$id" "$record" || {
+    echo "error: destination worker did not acknowledge the preserved-work handoff" >&2
+    return 1
+  }
+}
diff --git a/bin/fm-clean-commit-relaunch.sh b/bin/fm-clean-commit-relaunch.sh
new file mode 100755
index 0000000000..2b26957064
--- /dev/null
+++ b/bin/fm-clean-commit-relaunch.sh
@@ -0,0 +1,465 @@
+#!/usr/bin/env bash
+# Relaunch one missing committed ship task into a new clean worktree.
+#
+# Usage: fm-clean-commit-relaunch.sh <source-task-id> <destination-task-id>
+#
+# This explicit operator command is the sole owner of clean-commit relaunch.
+# It admits one missing local codex/tmux ship task, allocates a normal clean
+# Treehouse worktree, creates a new branch at the admitted source commit,
+# publishes one evidence-only handoff, launches and acknowledges a fresh task,
+# and cleans only destination-owned state on failure.
+#
+# It never resumes, closes, alters, or cleans the source task.
+# No watcher, bootstrap, recovery, or generic-spawn path invokes this command.
+set -eu
+
+SCRIPT_DIR=$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)
+FM_ROOT=${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd -P)}
+FM_HOME=${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}
+
+resolve_dir() {  # <label> <path>
+  local label=$1 path=$2
+  [ -d "$path" ] && [ ! -L "$path" ] && [ -r "$path" ] && [ -x "$path" ] || {
+    echo "error: $label must be a readable ordinary directory: $path" >&2
+    return 1
+  }
+  (CDPATH='' cd -- "$path" && pwd -P)
+}
+
+FM_HOME=$(resolve_dir FM_HOME "$FM_HOME") || exit 1
+STATE=${FM_STATE_OVERRIDE:-$FM_HOME/state}
+DATA=${FM_DATA_OVERRIDE:-$FM_HOME/data}
+STATE=$(resolve_dir state "$STATE") || exit 1
+DATA=$(resolve_dir data "$DATA") || exit 1
+[ "$STATE" = "$FM_HOME/state" ] && [ "$DATA" = "$FM_HOME/data" ] || {
+  echo "error: clean-commit relaunch refuses cross-home state or data overrides" >&2
+  exit 1
+}
+
+# shellcheck source=bin/fm-lock-lib.sh
+. "$SCRIPT_DIR/fm-lock-lib.sh"
+# shellcheck source=bin/fm-nm-run-lib.sh
+. "$SCRIPT_DIR/fm-nm-run-lib.sh"
+# shellcheck source=bin/fm-backend.sh
+. "$SCRIPT_DIR/fm-backend.sh"
+# shellcheck source=bin/fm-pr-lib.sh
+. "$SCRIPT_DIR/fm-pr-lib.sh"
+# shellcheck source=bin/fm-clean-commit-relaunch-launch-lib.sh
+. "$SCRIPT_DIR/fm-clean-commit-relaunch-launch-lib.sh"
+
+usage() {
+  sed -n '2,${/^#/!q;p;}' "$0" | sed 's/^# \{0,1\}//'
+}
+
+valid_id() {
+  case "$1" in
+    ''|.|..|*[!A-Za-z0-9._-]*|[._-]*) return 1 ;;
+    *) return 0 ;;
+  esac
+}
+
+sha256_file() {
+  sha256sum "$1" | awk '{print $1}'
+}
+
+sha256_text() {
+  printf '%s' "$1" | sha256sum | awk '{print $1}'
+}
+
+meta_exact() {  # <meta> <key>
+  local meta=$1 key=$2 count value
+  count=$(grep -c "^$key=" "$meta" 2>/dev/null || true)
+  [ "$count" -eq 1 ] || return 1
+  value=$(sed -n "s/^$key=//p" "$meta")
+  [ -n "$value" ] || return 1
+  printf '%s' "$value"
+}
+
+meta_optional_exact() {  # <meta> <key>
+  local meta=$1 key=$2 count value
+  count=$(grep -c "^$key=" "$meta" 2>/dev/null || true)
+  case "$count" in
+    0) return 0 ;;
+    1)
+      value=$(sed -n "s/^$key=//p" "$meta")
+      [ -n "$value" ] || return 1
+      printf '%s' "$value"
+      ;;
+    *) return 1 ;;
+  esac
+}
+
+path_has_git_operation() {  # <worktree>
+  local worktree=$1 operation operation_path
+  for operation in MERGE_HEAD CHERRY_PICK_HEAD REVERT_HEAD REBASE_HEAD BISECT_START BISECT_LOG sequencer rebase-apply rebase-merge; do
+    operation_path=$(git -C "$worktree" rev-parse --git-path "$operation" 2>/dev/null || true)
+    [ -z "$operation_path" ] && continue
+    [ ! -e "$operation_path" ] && [ ! -L "$operation_path" ] || return 0
+  done
+  return 1
+}
+
+worktree_is_registered() {  # <repository> <worktree>
+  local repository=$1 worktree=$2 record candidate
+  while IFS= read -r record; do
+    case "$record" in
+      "worktree "*)
+        candidate=${record#worktree }
+        candidate=$(resolve_dir registered-worktree "$candidate" 2>/dev/null || true)
+        [ "$candidate" != "$worktree" ] || return 0
+        ;;
+    esac
+  done < <(git -C "$repository" worktree list --porcelain 2>/dev/null)
+  return 1
+}
+
+destination_artifact_exists() {  # <destination>
+  local destination=$1 artifact
+  for artifact in \
+    "$STATE/$destination.inbox" "$STATE/$destination.status" \
+    "$STATE/$destination.turn-ended" "$STATE/$destination.meta" \
+    "$STATE/$destination.pi-ext.ts" "$STATE/$destination.omp-ext.ts" \
+    "$STATE/$destination.omp-ready" "$STATE/$destination.omp-started" \
+    "$STATE/$destination.omp-doorbell-ready" "$STATE/$destination.grok-turnend-token" \
+    "$STATE/$destination.kimi-turnend-token" "$STATE/$destination.hermes-turnend-token" \
+    "$STATE/$destination.hermes-session" "$STATE/$destination.hermes-started" \
+    "$STATE/$destination.busy-state" "$STATE/$destination.busy-gen" \
+    "$STATE/$destination.herdr-presentation" "$STATE/.$destination.open-decisions-cursor" \
+    "$STATE/$destination.check.sh" "$STATE/$destination.pr-poll" \
+    "$STATE/$destination.pr-poll-registration" "$STATE/$destination.pr-poll-retirement" \
+    "$STATE/$destination.check-trust" "$DATA/$destination/relaunch-handoff.json" \
+    "${TMPDIR:-/tmp}/fm-$destination"; do
+    if [ -e "$artifact" ] || [ -L "$artifact" ]; then
+      printf '%s' "$artifact"
+      return 0
+    fi
+  done
+  return 1
+}
+
+no_mistakes_custody() {  # <source-worktree> <source-branch>
+  local worktree=$1 branch=$2 output status trimmed run_id run_branch run_head run_status run_outcome
+  set +e
+  output=$(fm_nm_run_bounded "$worktree" "${FM_CLEAN_COMMIT_RELAUNCH_NM_TIMEOUT:-10}" axi status 2>&1)
+  status=$?
+  set -e
+  trimmed=$(fm_nm_trim "$output")
+  case "$trimmed" in
+    '')
+      [ "$status" -eq 0 ] || { printf 'unreadable'; return 0; }
+      printf 'none'
+      return 0
+      ;;
+    'no active run')
+      printf 'none'
+      return 0
+      ;;
+  esac
+  [ "$status" -eq 0 ] || { printf 'unreadable'; return 0; }
+  run_id=$(fm_nm_strip_quotes "$(fm_nm_field "$output" id)")
+  run_branch=$(fm_nm_strip_quotes "$(fm_nm_field "$output" branch)")
+  run_head=$(fm_nm_strip_quotes "$(fm_nm_field "$output" head)")
+  run_status=$(fm_nm_strip_quotes "$(fm_nm_field "$output" status)")
+  run_outcome=$(fm_nm_strip_quotes "$(fm_nm_field "$output" outcome)")
+  [ -n "$run_id" ] && [ "$run_branch" = "$branch" ] \
+    && fm_nm_head_matches_worktree "$worktree" "$run_head" && [ -z "$run_outcome" ] || {
+    printf 'unreadable'
+    return 0
+  }
+  case "$run_status" in
+    running|fixing|ci) printf 'active' ;;
+    awaiting_approval|fix_review) printf 'parked' ;;
+    *) printf 'unreadable' ;;
+  esac
+}
+
+case "${1:-}" in
+  -h|--help) usage; exit 0 ;;
+esac
+
+[ "$#" -eq 2 ] || { usage >&2; exit 2; }
+SOURCE=$1
+DESTINATION=$2
+if ! valid_id "$SOURCE" || ! valid_id "$DESTINATION"; then
+  echo "error: source and destination task ids must be valid task ids" >&2
+  exit 2
+fi
+[ "$SOURCE" != "$DESTINATION" ] || {
+  echo "error: source and destination task ids must differ" >&2
+  exit 1
+}
+
+SOURCE_META=$STATE/$SOURCE.meta
+SOURCE_BRIEF=$DATA/$SOURCE/brief.md
+DESTINATION_BRIEF=$DATA/$DESTINATION/brief.md
+DESTINATION_HANDOFF=$DATA/$DESTINATION/relaunch-handoff.json
+SOURCE_LOCK=$STATE/.spawn-$SOURCE.lock
+DESTINATION_LOCK=$STATE/.spawn-$DESTINATION.lock
+SOURCE_LOCK_HELD=0
+DESTINATION_LOCK_HELD=0
+DESTINATION_WORKTREE=
+DESTINATION_BRANCH=
+DESTINATION_PUBLISHED=0
+
+cleanup_destination() {
+  [ -n "$DESTINATION_WORKTREE" ] || return 0
+  fm_clean_relaunch_launch_cleanup "$DESTINATION" || true
+  (cd "$PROJECT" && "$SCRIPT_DIR/fm-treehouse-command.sh" return --force "$DESTINATION_WORKTREE" >/dev/null 2>&1) || true
+  if [ -n "$DESTINATION_BRANCH" ]; then
+    git -C "$PROJECT" branch -D "$DESTINATION_BRANCH" >/dev/null 2>&1 || true
+  fi
+  rm -f -- "$DESTINATION_HANDOFF"
+}
+
+cleanup() {
+  status=$?
+  if [ "$status" -ne 0 ] && [ "$DESTINATION_PUBLISHED" -eq 0 ]; then
+    cleanup_destination
+  fi
+  [ "$DESTINATION_LOCK_HELD" -eq 0 ] || fm_lock_release "$DESTINATION_LOCK" || true
+  [ "$SOURCE_LOCK_HELD" -eq 0 ] || fm_lock_release "$SOURCE_LOCK" || true
+}
+interrupted() {
+  exit 1
+}
+trap cleanup EXIT
+trap interrupted HUP INT TERM
+
+fm_lock_try_acquire "$SOURCE_LOCK" || {
+  echo "error: source task $SOURCE is already under an exclusive lifecycle operation" >&2
+  exit 1
+}
+SOURCE_LOCK_HELD=1
+fm_lock_try_acquire "$DESTINATION_LOCK" || {
+  echo "error: destination task $DESTINATION is already under an exclusive lifecycle operation" >&2
+  exit 1
+}
+DESTINATION_LOCK_HELD=1
+
+[ -f "$SOURCE_META" ] && [ ! -L "$SOURCE_META" ] && [ -r "$SOURCE_META" ] || {
+  echo "error: source task $SOURCE has no readable regular metadata" >&2
+  exit 1
+}
+[ -f "$SOURCE_BRIEF" ] && [ ! -L "$SOURCE_BRIEF" ] && [ -r "$SOURCE_BRIEF" ] || {
+  echo "error: source task $SOURCE has no readable regular brief" >&2
+  exit 1
+}
+[ -f "$DESTINATION_BRIEF" ] && [ ! -L "$DESTINATION_BRIEF" ] && [ -r "$DESTINATION_BRIEF" ] || {
+  echo "error: destination task $DESTINATION needs a pre-existing complete ship brief" >&2
+  exit 1
+}
+DESTINATION_DATA_DIR=$(resolve_dir destination-task-data "$DATA/$DESTINATION") || exit 1
+if [ "$DESTINATION_DATA_DIR" != "$DATA/$DESTINATION" ] || [ ! -w "$DESTINATION_DATA_DIR" ]; then
+  echo "error: destination task $DESTINATION data directory is not writable in this home" >&2
+  exit 1
+fi
+grep -Fq '{TASK}' "$DESTINATION_BRIEF" && {
+  echo "error: destination task $DESTINATION brief still contains a task placeholder" >&2
+  exit 1
+}
+"$SCRIPT_DIR/fm-receipt-check.sh" --parse-criteria "$DESTINATION_BRIEF" >/dev/null 2>&1 || {
+  echo "error: destination task $DESTINATION needs a complete ship brief with concrete acceptance criteria" >&2
+  exit 1
+}
+DESTINATION_ARTIFACT=$(destination_artifact_exists "$DESTINATION" || true)
+[ -z "$DESTINATION_ARTIFACT" ] || {
+  echo "error: destination task $DESTINATION already has durable state at $DESTINATION_ARTIFACT" >&2
+  exit 1
+}
+
+KIND=$(meta_exact "$SOURCE_META" kind) || { echo "error: source task $SOURCE has malformed kind metadata" >&2; exit 1; }
+[ "$KIND" = ship ] || { echo "error: clean-commit relaunch accepts only ordinary ship tasks" >&2; exit 1; }
+[ "$(grep -c '^home=' "$SOURCE_META" 2>/dev/null || true)" -eq 0 ] || {
+  echo "error: source task $SOURCE belongs to a secondmate or another home" >&2
+  exit 1
+}
+ENDPOINT_TASK=$(meta_exact "$SOURCE_META" endpoint_task_id) || { echo "error: source task $SOURCE has malformed endpoint identity" >&2; exit 1; }
+[ "$ENDPOINT_TASK" = "$SOURCE" ] || { echo "error: source task $SOURCE endpoint identity does not match its task id" >&2; exit 1; }
+SOURCE_WORKTREE=$(meta_exact "$SOURCE_META" worktree) || { echo "error: source task $SOURCE has malformed worktree metadata" >&2; exit 1; }
+PROJECT=$(meta_exact "$SOURCE_META" project) || { echo "error: source task $SOURCE has malformed project metadata" >&2; exit 1; }
+HARNESS=$(meta_exact "$SOURCE_META" harness) || { echo "error: source task $SOURCE has malformed harness metadata" >&2; exit 1; }
+BACKEND=$(meta_optional_exact "$SOURCE_META" backend) || { echo "error: source task $SOURCE has malformed backend metadata" >&2; exit 1; }
+BACKEND=${BACKEND:-tmux}
+MODE=$(meta_exact "$SOURCE_META" mode) || { echo "error: source task $SOURCE has malformed delivery metadata" >&2; exit 1; }
+YOLO=$(meta_exact "$SOURCE_META" yolo) || { echo "error: source task $SOURCE has malformed merge posture metadata" >&2; exit 1; }
+MODEL=$(meta_optional_exact "$SOURCE_META" model) || { echo "error: source task $SOURCE has malformed model metadata" >&2; exit 1; }
+EFFORT=$(meta_optional_exact "$SOURCE_META" effort) || { echo "error: source task $SOURCE has malformed effort metadata" >&2; exit 1; }
+if [ "$(grep -c '^prewalk_into=' "$SOURCE_META" 2>/dev/null || true)" -ne 0 ] \
+  || [ "$(grep -c '^allow_project_omp_extensions=' "$SOURCE_META" 2>/dev/null || true)" -ne 0 ]; then
+  echo "error: source task $SOURCE has unsupported OMP-only metadata" >&2
+  exit 1
+fi
+case "$MODE:$YOLO" in
+  no-mistakes:on|no-mistakes:off|direct-PR:on|direct-PR:off|local-only:on|local-only:off) ;;
+  *) echo "error: source task $SOURCE has invalid delivery or merge posture" >&2; exit 1 ;;
+esac
+case "$MODEL" in
+  *[!A-Za-z0-9._:/@+-]*) echo "error: source task $SOURCE has invalid model metadata" >&2; exit 1 ;;
+esac
+case "$EFFORT" in ''|default|low|medium|high|xhigh|max) ;; *) echo "error: source task $SOURCE has invalid effort metadata" >&2; exit 1 ;; esac
+[ "$HARNESS:$BACKEND" = codex:tmux ] || {
+  echo "error: clean-commit relaunch currently supports only verified codex/tmux source tasks" >&2
+  exit 1
+}
+grep -Fxq "Delivery contract: mode=$MODE" "$DESTINATION_BRIEF" || {
+  echo "error: destination brief delivery contract does not match source mode=$MODE" >&2
+  exit 1
+}
+
+SOURCE_WORKTREE=$(resolve_dir source-worktree "$SOURCE_WORKTREE") || exit 1
+PROJECT=$(resolve_dir recorded-project "$PROJECT") || exit 1
+SOURCE_TOP=$(git -C "$SOURCE_WORKTREE" rev-parse --show-toplevel 2>/dev/null || true)
+SOURCE_TOP=$(resolve_dir source-repository-root "$SOURCE_TOP") || exit 1
+[ "$SOURCE_TOP" = "$SOURCE_WORKTREE" ] || {
+  echo "error: source task $SOURCE worktree is not its recorded repository root" >&2
+  exit 1
+}
+PROJECT_TOP=$(git -C "$PROJECT" rev-parse --show-toplevel 2>/dev/null || true)
+PROJECT_TOP=$(resolve_dir project-repository-root "$PROJECT_TOP") || exit 1
+[ "$PROJECT_TOP" = "$PROJECT" ] || {
+  echo "error: source task $SOURCE project is not a repository root" >&2
+  exit 1
+}
+SOURCE_COMMON=$(git -C "$SOURCE_WORKTREE" rev-parse --path-format=absolute --git-common-dir 2>/dev/null || true)
+PROJECT_COMMON=$(git -C "$PROJECT" rev-parse --path-format=absolute --git-common-dir 2>/dev/null || true)
+SOURCE_COMMON=$(resolve_dir source-physical-repository "$SOURCE_COMMON") || exit 1
+PROJECT_COMMON=$(resolve_dir project-physical-repository "$PROJECT_COMMON") || exit 1
+[ "$SOURCE_COMMON" = "$PROJECT_COMMON" ] || {
+  echo "error: source task $SOURCE is not attached to its recorded physical repository" >&2
+  exit 1
+}
+worktree_is_registered "$PROJECT" "$SOURCE_WORKTREE" || {
+  echo "error: source task $SOURCE worktree is not a registered physical worktree" >&2
+  exit 1
+}
+SOURCE_STATUS=$(git -C "$SOURCE_WORKTREE" status --porcelain --untracked-files=all --ignore-submodules=none 2>/dev/null) || {
+  echo "error: source task $SOURCE worktree status is unreadable" >&2
+  exit 1
+}
+[ -z "$SOURCE_STATUS" ] || {
+  echo "error: source task $SOURCE worktree is not completely clean" >&2
+  exit 1
+}
+path_has_git_operation "$SOURCE_WORKTREE" && {
+  echo "error: source task $SOURCE has a Git operation in progress" >&2
+  exit 1
+}
+SOURCE_COMMIT=$(git -C "$SOURCE_WORKTREE" rev-parse --verify --quiet 'HEAD^{commit}' 2>/dev/null || true)
+[ -n "$SOURCE_COMMIT" ] || { echo "error: source task $SOURCE has no readable HEAD commit" >&2; exit 1; }
+SOURCE_BRANCH=$(git -C "$SOURCE_WORKTREE" symbolic-ref --quiet --short HEAD 2>/dev/null || true)
+[ -n "$SOURCE_BRANCH" ] || { echo "error: source task $SOURCE is detached" >&2; exit 1; }
+SOURCE_BRANCH_HEAD=$(git -C "$SOURCE_WORKTREE" rev-parse --verify --quiet "refs/heads/$SOURCE_BRANCH^{commit}" 2>/dev/null || true)
+[ "$SOURCE_BRANCH_HEAD" = "$SOURCE_COMMIT" ] || {
+  echo "error: source task $SOURCE branch does not bind its exact HEAD commit" >&2
+  exit 1
+}
+git -C "$PROJECT" cat-file -e "$SOURCE_COMMIT^{commit}" 2>/dev/null || {
+  echo "error: source task $SOURCE commit is not reachable from its recorded repository" >&2
+  exit 1
+}
+
+fm_backend_validate_task_endpoint "$SOURCE_META" "$SOURCE" >/dev/null || exit 1
+fm_backend_source "$BACKEND" || exit 1
+case "$(fm_backend_agent_state "$BACKEND" "$FM_BACKEND_VALIDATED_TARGET" "$SOURCE_META" 2>/dev/null || true)" in
+  missing) ;;
+  *) echo "error: source task $SOURCE endpoint is not authoritatively missing" >&2; exit 1 ;;
+esac
+CUSTODY=$(no_mistakes_custody "$SOURCE_WORKTREE" "$SOURCE_BRANCH")
+case "$CUSTODY" in
+  none) ;;
+  active|parked) echo "error: source task $SOURCE has active or parked No-Mistakes custody" >&2; exit 1 ;;
+  *) echo "error: source task $SOURCE No-Mistakes custody is unreadable or malformed" >&2; exit 1 ;;
+esac
+
+DESTINATION_BRANCH="fm/$DESTINATION"
+[ "$SOURCE_BRANCH" != "$DESTINATION_BRANCH" ] || {
+  echo "error: source and destination branch identities would collide" >&2
+  exit 1
+}
+git -C "$PROJECT" show-ref --verify --quiet "refs/heads/$DESTINATION_BRANCH" && {
+  echo "error: destination task $DESTINATION already has branch $DESTINATION_BRANCH" >&2
+  exit 1
+}
+
+DESTINATION_WORKTREE=$(cd "$PROJECT" && "$SCRIPT_DIR/fm-treehouse-get.sh" --lease --lease-holder "fm-$DESTINATION") || {
+  echo "error: normal allocator did not supply a destination worktree" >&2
+  exit 1
+}
+DESTINATION_WORKTREE=$(resolve_dir destination-worktree "$DESTINATION_WORKTREE") || exit 1
+[ "$DESTINATION_WORKTREE" != "$SOURCE_WORKTREE" ] || {
+  echo "error: normal allocator reused the source worktree" >&2
+  exit 1
+}
+DESTINATION_TOP=$(git -C "$DESTINATION_WORKTREE" rev-parse --show-toplevel 2>/dev/null || true)
+DESTINATION_TOP=$(resolve_dir destination-repository-root "$DESTINATION_TOP") || exit 1
+[ "$DESTINATION_TOP" = "$DESTINATION_WORKTREE" ] || {
+  echo "error: normal allocator returned a non-root destination worktree" >&2
+  exit 1
+}
+DESTINATION_COMMON=$(git -C "$DESTINATION_WORKTREE" rev-parse --path-format=absolute --git-common-dir 2>/dev/null || true)
+DESTINATION_COMMON=$(resolve_dir destination-physical-repository "$DESTINATION_COMMON") || exit 1
+[ "$DESTINATION_COMMON" = "$PROJECT_COMMON" ] || {
+  echo "error: normal allocator returned a destination from another physical repository" >&2
+  exit 1
+}
+worktree_is_registered "$PROJECT" "$DESTINATION_WORKTREE" || {
+  echo "error: normal allocator returned an unregistered destination worktree" >&2
+  exit 1
+}
+DESTINATION_STATUS=$(git -C "$DESTINATION_WORKTREE" status --porcelain --untracked-files=all --ignore-submodules=none 2>/dev/null) || {
+  echo "error: normal allocator returned an unreadable destination worktree" >&2
+  exit 1
+}
+if [ -n "$DESTINATION_STATUS" ] || path_has_git_operation "$DESTINATION_WORKTREE"; then
+  echo "error: normal allocator returned an occupied destination worktree" >&2
+  exit 1
+fi
+git -C "$DESTINATION_WORKTREE" checkout -b "$DESTINATION_BRANCH" "$SOURCE_COMMIT" >/dev/null || {
+  echo "error: could not create the destination branch at the admitted source commit" >&2
+  exit 1
+}
+DESTINATION_HEAD=$(git -C "$DESTINATION_WORKTREE" rev-parse --verify --quiet 'HEAD^{commit}' 2>/dev/null || true)
+DESTINATION_ATTACHED_BRANCH=$(git -C "$DESTINATION_WORKTREE" symbolic-ref --quiet --short HEAD 2>/dev/null || true)
+[ "$DESTINATION_HEAD" = "$SOURCE_COMMIT" ] && [ "$DESTINATION_ATTACHED_BRANCH" = "$DESTINATION_BRANCH" ] || {
+  echo "error: destination checkout did not retain the admitted branch and commit" >&2
+  exit 1
+}
+
+REPOSITORY_IDENTITY=$(sha256_text "$PROJECT_COMMON")
+SOURCE_BRIEF_IDENTITY=$(sha256_file "$SOURCE_BRIEF") || exit 1
+DESTINATION_BRIEF_IDENTITY=$(sha256_file "$DESTINATION_BRIEF") || exit 1
+PR=$(meta_optional_exact "$SOURCE_META" pr) || { echo "error: source task $SOURCE has malformed PR metadata" >&2; exit 1; }
+if [ -n "$PR" ]; then
+  fm_pr_url_parse "$PR" && [ "$FM_PR_URL" = "$PR" ] || {
+    echo "error: source task $SOURCE has non-canonical PR metadata" >&2
+    exit 1
+  }
+  PR=$FM_PR_URL
+fi
+HANDOFF_TMP=$(mktemp "$DATA/$DESTINATION/.relaunch-handoff.XXXXXX") || exit 1
+jq -n \
+  --arg schema fm-clean-commit-relaunch.v1 \
+  --arg source "$SOURCE" \
+  --arg destination "$DESTINATION" \
+  --arg repository_identity "$REPOSITORY_IDENTITY" \
+  --arg source_commit "$SOURCE_COMMIT" \
+  --arg source_branch "$SOURCE_BRANCH" \
+  --arg destination_branch "$DESTINATION_BRANCH" \
+  --arg mode "$MODE" \
+  --arg yolo "$YOLO" \
+  --arg source_brief_identity "$SOURCE_BRIEF_IDENTITY" \
+  --arg destination_brief_identity "$DESTINATION_BRIEF_IDENTITY" \
+  --arg custody "$CUSTODY" \
+  --arg pr "$PR" \
+  '{schema:$schema,source:$source,destination:$destination,repository_identity:$repository_identity,source_commit:$source_commit,source_branch:$source_branch,destination_branch:$destination_branch,delivery:{mode:$mode,yolo:$yolo},source_brief_identity:$source_brief_identity,destination_brief_identity:$destination_brief_identity,no_mistakes_custody:{state:$custody,next_action:"proceed"}} + (if $pr == "" then {} else {pr:$pr} end)' \
+  > "$HANDOFF_TMP" || exit 1
+mv -f -- "$HANDOFF_TMP" "$DESTINATION_HANDOFF"
+
+fm_clean_relaunch_launch_allocated \
+  "$DESTINATION" "$PROJECT" "$DESTINATION_WORKTREE" "$DESTINATION_BRIEF" \
+  "$HARNESS" "$BACKEND" "$MODE" "$YOLO" "${MODEL:-default}" "${EFFORT:-default}" || {
+  echo "error: destination launch or acknowledgement failed" >&2
+  exit 1
+}
+DESTINATION_PUBLISHED=1
+printf 'relaunched %s as %s at %s\n' "$SOURCE" "$DESTINATION" "$SOURCE_COMMIT"
diff --git a/docs/architecture.md b/docs/architecture.md
index 143552231d..755ceee9d1 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -337,6 +337,15 @@ The helper reuses the durable fleet records and recovery-grade backend liveness
 Its `--check` mode delegates to `omp update --check`, reports the current and available versions, and changes neither the executable nor fleet state.
 The mechanics are owned by the `/updatefirstmate` skill and firstmate's operating manual in [`AGENTS.md`](../AGENTS.md) (self-update).
 
+## Clean committed worker relaunch
+
+`bin/fm-clean-commit-relaunch.sh` is an explicit operator command, never an automatic recovery path.
+It alone admits a missing committed source task, leases a distinct normal worktree, creates the successor branch at the admitted commit, records evidence, and launches the fresh worker.
+The source branch, records, validation custody, session material, and presentation state remain read-only.
+The initial supported launch profile is Codex on the reference tmux backend.
+Generic `fm-spawn.sh` remains a fresh-task interface and does not carry relaunch source, commit, handoff, or allocated-worktree authority.
+The command header owns the exact admission and cleanup mechanics.
+
 ## Restart-proof
 
 Fleet state lives in each task's session-provider backend (tmux by hard default, herdr or cmux when selected or auto-detected, zellij/orca when explicitly selected), no-mistakes run records, status event logs, local markdown under `data/` including `data/captain.md`, `data/captain-shared.md`, and `data/learnings.md`, and persistent secondmate homes.
diff --git a/tests/fm-clean-commit-relaunch.test.sh b/tests/fm-clean-commit-relaunch.test.sh
new file mode 100755
index 0000000000..dbd8793c1e
--- /dev/null
+++ b/tests/fm-clean-commit-relaunch.test.sh
@@ -0,0 +1,405 @@
+#!/usr/bin/env bash
+# Deterministic behavior tests for the explicit clean-commit relaunch owner.
+#
+# The fixture uses linked Git worktrees plus fake Treehouse, tmux, and
+# no-mistakes adapters. No test creates, stops, or interrogates a live Herdr
+# process. Every refusal asserts that allocation was never requested and that
+# source task records and branch identity remain unchanged.
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+REAL_GIT=$(command -v git)
+
+TMP_ROOT=$(fm_test_tmproot fm-clean-commit-relaunch)
+fm_git_identity fmtest fmtest@example.invalid
+
+copy_runtime() {  # <fixture>
+  local fixture=$1 file
+  mkdir -p "$fixture/bin/backends"
+  for file in \
+    fm-clean-commit-relaunch.sh fm-clean-commit-relaunch-launch-lib.sh \
+    fm-lock-lib.sh fm-nm-run-lib.sh fm-pr-lib.sh fm-task-inbox-lib.sh \
+    fm-wake-lib.sh fm-backend.sh fm-omp-process-lib.sh fm-tmux-lib.sh \
+    fm-session-lock-lib.sh; do
+    cp "$ROOT/bin/$file" "$fixture/bin/$file"
+  done
+  cp "$ROOT/bin/backends/tmux.sh" "$fixture/bin/backends/tmux.sh"
+  cat > "$fixture/bin/fm-receipt-check.sh" <<'SH'
+#!/usr/bin/env bash
+exit 0
+SH
+  cat > "$fixture/bin/fm-treehouse-get.sh" <<'SH'
+#!/usr/bin/env bash
+set -eu
+[ "${FM_TEST_ALLOCATOR_MODE:-success}" = success ] || exit 1
+[ -z "${FM_TEST_ALLOCATOR_DELAY:-}" ] || sleep "$FM_TEST_ALLOCATOR_DELAY"
+[ -z "${FM_TEST_ALLOCATOR_DIRTY:-}" ] || : > "$FM_TEST_DESTINATION/allocator-dirty"
+printf '%s\n' "$FM_TEST_DESTINATION"
+SH
+  cat > "$fixture/bin/fm-treehouse-command.sh" <<'SH'
+#!/usr/bin/env bash
+set -eu
+printf '%s\n' "$*" >> "$FM_TEST_ALLOCATOR_LOG"
+if [ "${1:-}" = return ]; then
+  path=${!#}
+  git -C "$FM_TEST_PROJECT" worktree remove --force "$path" >/dev/null 2>&1 || true
+fi
+SH
+  chmod +x "$fixture/bin"/*.sh "$fixture/bin/backends/tmux.sh"
+}
+
+make_fakebin() {  # <fixture>
+  local fixture fakebin
+  fixture=$1
+  fakebin="$fixture/fakebin"
+  mkdir -p "$fakebin"
+  cat > "$fakebin/no-mistakes" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "${FM_TEST_CUSTODY:-none}" in
+  none) printf 'no active run\n'; exit 1 ;;
+  active) printf 'id: run-active\nbranch: %s\nhead: %s\nstatus: running\n' "$FM_TEST_SOURCE_BRANCH" "$FM_TEST_SOURCE_HEAD" ;;
+  parked) printf 'id: run-parked\nbranch: %s\nhead: %s\nstatus: awaiting_approval\n' "$FM_TEST_SOURCE_BRANCH" "$FM_TEST_SOURCE_HEAD" ;;
+  unreadable) printf 'status: unknown\n' ;;
+esac
+SH
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+log() { printf '%s\n' "$*" >> "$FM_TEST_TMUX_LOG"; }
+command=${1:-}
+shift || true
+case "$command" in
+  has-session) exit 0 ;;
+  new-session) exit 0 ;;
+  list-windows)
+    case "${FM_TEST_ENDPOINT:-missing}" in
+      unreadable) printf 'error connecting to fixture\n' >&2; exit 1 ;;
+    esac
+    case "${FM_TEST_ENDPOINT:-missing}" in
+      live|dead|ambiguous) printf 'fm-source\n' ;;
+    esac
+    [ ! -f "$FM_TEST_WINDOWS" ] || cat "$FM_TEST_WINDOWS"
+    ;;
+  new-window)
+    log "new-window $*"
+    [ -z "${FM_TEST_LAUNCH_DELAY:-}" ] || sleep "$FM_TEST_LAUNCH_DELAY"
+    [ "${FM_TEST_LAUNCH_FAIL:-0}" != 1 ] || exit 1
+    printf 'fm-%s\n' "$FM_TEST_DESTINATION_ID" >> "$FM_TEST_WINDOWS"
+    printf '%%42\n'
+    ;;
+  set-window-option) exit 0 ;;
+  display-message)
+    case "$*" in
+      *'#{pane_current_command}'*)
+        case "${FM_TEST_ENDPOINT:-missing}" in
+          dead) printf 'bash\n' ;;
+          ambiguous) printf 'unknown-agent\n' ;;
+          *) printf 'codex\n' ;;
+        esac
+        ;;
+      *'#{pane_id}'*) printf '%%9\n' ;;
+      *'#{pane_current_path}'*) printf '%s\n' "$FM_TEST_DESTINATION" ;;
+      *) printf 'firstmate\n' ;;
+    esac
+    ;;
+  capture-pane) printf '> \n' ;;
+  send-keys)
+    log "send-keys $*"
+    case "$*" in
+      *codex*) [ "${FM_TEST_LAUNCH_COMMAND_FAIL:-0}" != 1 ] || exit 1 ;;
+    esac
+    case "$*" in
+      *'Firstmate instruction waiting:'*)
+        [ "${FM_TEST_ACK_MODE:-success}" = success ] || exit 0
+        for message in "$FM_TEST_HOME/state/$FM_TEST_DESTINATION_ID.inbox"/*.msg; do
+          [ -e "$message" ] || continue
+          mv "$message" "$FM_TEST_HOME/state/$FM_TEST_DESTINATION_ID.inbox/handled/"
+        done
+        ;;
+    esac
+    ;;
+  kill-window) log "kill-window $*" ;;
+esac
+SH
+  cat > "$fakebin/git" <<'SH'
+#!/usr/bin/env bash
+set -u
+if [ "${FM_TEST_CHECKOUT_FAIL:-0}" = 1 ] && [ "$1" = -C ] && [ "${3:-}" = checkout ] && [ "${4:-}" = -b ]; then
+  exit 1
+fi
+exec "${FM_TEST_REAL_GIT}" "$@"
+SH
+  chmod +x "$fakebin"/*
+}
+
+write_brief() {  # <path> <mode>
+  local path=$1 mode=$2
+  mkdir -p "$(dirname "$path")"
+  cat > "$path" <<EOF
+# Task
+Exercise the relaunch fixture.
+
+# Acceptance criteria
+- AC1: The fixture exposes its destination behavior.
+
+# Definition of done
+Delivery contract: mode=$mode
+EOF
+}
+
+new_case() {  # <name>
+  local name fixture project source destination home
+  name=$1
+  fixture="$TMP_ROOT/$name"
+  project="$fixture/project"
+  source="$fixture/source"
+  destination="$fixture/destination"
+  home="$fixture/home"
+  mkdir -p "$fixture" "$fixture/tmp" "$home/state" "$home/data" "$home/config" "$project"
+  git -C "$project" init -q
+  printf '%s\n' initial > "$project/tracked.txt"
+  git -C "$project" add tracked.txt
+  git -C "$project" commit -qm initial
+  git -C "$project" branch -M main
+  git -C "$project" worktree add -q -b fm/source "$source" main
+  printf '%s\n' committed > "$source/committed.txt"
+  git -C "$source" add committed.txt
+  git -C "$source" commit -qm committed-source
+  git -C "$project" worktree add -q -b pool/destination "$destination" main
+  copy_runtime "$fixture"
+  make_fakebin "$fixture"
+  write_brief "$home/data/source/brief.md" no-mistakes
+  write_brief "$home/data/destination/brief.md" no-mistakes
+  cat > "$home/state/source.meta" <<EOF
+window=firstmate:fm-source
+endpoint_task_id=source
+worktree=$source
+project=$project
+harness=codex
+kind=ship
+mode=no-mistakes
+yolo=off
+model=default
+effort=default
+tasktmp=$fixture/tmp/fm-source
+pr=https://github.com/example/repo/pull/1
+EOF
+: > "$home/state/source.status"
+mkdir -p "$home/state/source.inbox/handled" "$fixture/tmp/fm-source"
+printf '%s\n' source-session > "$home/state/source.hermes-session"
+printf '%s\n' source-presentation > "$home/state/source.herdr-presentation"
+printf '%s\n' source-validation > "$home/state/source.pr-poll"
+printf '%s\n' source-inbox > "$home/state/source.inbox/001.msg"
+printf '%s\n' source-temp > "$fixture/tmp/fm-source/session"
+printf '%s\n' source-receipt > "$home/data/source/evidence.jsonl"
+  : > "$fixture/windows"
+  : > "$fixture/allocator.log"
+  : > "$fixture/tmux.log"
+  printf '%s\n' "$fixture"
+}
+
+run_owner() {  # <fixture> [source] [destination]
+  local fixture=$1 source=${2:-source} destination=${3:-destination}
+  PATH="$fixture/fakebin:$PATH" \
+    FM_TEST_REAL_GIT="$REAL_GIT" \
+    FM_TEST_HOME="$fixture/home" \
+    FM_TEST_PROJECT="$fixture/project" \
+    FM_TEST_DESTINATION="$fixture/destination" \
+    FM_TEST_DESTINATION_ID="$destination" \
+    FM_TEST_WINDOWS="$fixture/windows" \
+    FM_TEST_ALLOCATOR_LOG="$fixture/allocator.log" \
+    FM_TEST_TMUX_LOG="$fixture/tmux.log" \
+    TMPDIR="$fixture/tmp" FM_HOME="$fixture/home" FM_ROOT_OVERRIDE="$ROOT" \
+    "$fixture/bin/fm-clean-commit-relaunch.sh" "$source" "$destination"
+}
+
+source_snapshot() {  # <fixture>
+  local fixture source home
+  fixture=$1
+  source="$fixture/source"
+  home="$fixture/home"
+  {
+    git -C "$source" status --porcelain --untracked-files=all
+    git -C "$source" rev-parse HEAD
+    git -C "$source" rev-parse refs/heads/fm/source
+    sha256sum "$home/state/source.meta" "$home/state/source.status" \
+      "$home/state/source.hermes-session" "$home/state/source.herdr-presentation" \
+      "$home/state/source.pr-poll" "$home/state/source.inbox/001.msg" \
+      "$home/data/source/brief.md" "$home/data/source/evidence.jsonl" \
+      "$fixture/tmp/fm-source/session"
+  } | sha256sum | awk '{print $1}'
+}
+
+assert_refused_before_allocation() {  # <fixture> <output> <label>
+  local fixture=$1 output=$2 label=$3
+  [ -z "$(cat "$fixture/allocator.log")" ] || fail "$label allocated a destination before refusing"
+  assert_contains "$output" 'error:' "$label did not explain its refusal"
+}
+
+# Success accepts linked worktrees sharing a common directory, creates the exact
+# destination branch, records only stable handoff fields, and leaves every
+# source-owned record and ref unchanged.
+fixture=$(new_case success)
+before=$(source_snapshot "$fixture")
+out=$(run_owner "$fixture" 2>&1)
+expect_code 0 $? "linked-worktree relaunch should succeed"
+assert_contains "$out" 'relaunched source as destination' "success output omitted source and destination"
+source_head=$(git -C "$fixture/source" rev-parse HEAD)
+[ "$(git -C "$fixture/destination" rev-parse HEAD)" = "$source_head" ] || fail "destination did not retain the admitted source commit"
+[ "$(git -C "$fixture/destination" symbolic-ref --short HEAD)" = fm/destination ] || fail "destination did not receive its fresh branch"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "success mutated source-owned branch or records"
+assert_present "$fixture/home/state/destination.meta" "success did not publish destination metadata"
+assert_present "$fixture/home/data/destination/relaunch-handoff.json" "success did not publish handoff"
+jq -e --arg commit "$source_head" '
+  .schema == "fm-clean-commit-relaunch.v1" and .source == "source" and .destination == "destination" and
+  .source_commit == $commit and .source_branch == "fm/source" and .destination_branch == "fm/destination" and
+  .delivery == {mode:"no-mistakes",yolo:"off"} and .no_mistakes_custody == {state:"none",next_action:"proceed"} and
+  .pr == "https://github.com/example/repo/pull/1" and (.repository_identity | type == "string" and length == 64)
+' "$fixture/home/data/destination/relaunch-handoff.json" >/dev/null || fail "handoff omitted stable admitted identities"
+assert_no_grep "$fixture/source" "$fixture/home/data/destination/relaunch-handoff.json" "handoff captured mutable source path"
+assert_no_grep 'FM_CLEAN' "$fixture/home/data/destination/relaunch-handoff.json" "handoff captured caller environment"
+pass "clean relaunch: linked worktree success preserves source and binds exact destination identity"
+
+# Endpoint state is admission, never a recovery guess.
+for endpoint in live dead ambiguous unreadable; do
+  fixture=$(new_case "endpoint-$endpoint")
+  before=$(source_snapshot "$fixture")
+  out=$(FM_TEST_ENDPOINT="$endpoint" run_owner "$fixture" 2>&1)
+  expect_code 1 $? "endpoint $endpoint should refuse"
+  assert_refused_before_allocation "$fixture" "$out" "endpoint $endpoint"
+  [ "$(source_snapshot "$fixture")" = "$before" ] || fail "endpoint $endpoint mutated source"
+done
+pass "clean relaunch: only an authoritatively missing endpoint passes admission"
+
+# Metadata identity, role, home, and durable occupancy all refuse before the
+# allocator can create a destination.
+for mutation in malformed wrong-kind secondmate endpoint-mismatch destination-occupied branch-collision; do
+  fixture=$(new_case "admission-$mutation")
+  case "$mutation" in
+    malformed) printf 'worktree=%s\n' "$fixture/source" >> "$fixture/home/state/source.meta" ;;
+    wrong-kind) sed -i 's/^kind=ship$/kind=scout/' "$fixture/home/state/source.meta" ;;
+    secondmate) printf 'home=%s\n' "$fixture/home" >> "$fixture/home/state/source.meta" ;;
+    endpoint-mismatch) sed -i 's/^endpoint_task_id=source$/endpoint_task_id=other/' "$fixture/home/state/source.meta" ;;
+    destination-occupied) : > "$fixture/home/state/destination.status" ;;
+    branch-collision) git -C "$fixture/project" branch fm/destination main ;;
+  esac
+  before=$(source_snapshot "$fixture")
+  out=$(run_owner "$fixture" 2>&1)
+  expect_code 1 $? "$mutation should refuse"
+  assert_refused_before_allocation "$fixture" "$out" "$mutation"
+  [ "$(source_snapshot "$fixture")" = "$before" ] || fail "$mutation mutated source"
+done
+pass "clean relaunch: malformed, foreign, occupied, and colliding admission cases refuse"
+
+# Dirty source states and every active Git operation marker are never salvaged.
+for mutation in staged untracked deleted detached missing-branch unreachable; do
+  fixture=$(new_case "git-$mutation")
+  case "$mutation" in
+    staged) printf '%s\n' staged > "$fixture/source/staged.txt"; git -C "$fixture/source" add staged.txt ;;
+    untracked) printf '%s\n' untracked > "$fixture/source/untracked.txt" ;;
+    deleted) rm "$fixture/source/tracked.txt" ;;
+    detached) git -C "$fixture/source" checkout -q --detach ;;
+    missing-branch) git -C "$fixture/source" update-ref -d refs/heads/fm/source ;;
+    unreachable) git -C "$fixture/source" commit-tree "HEAD^{tree}" -m unreachable >/dev/null; git -C "$fixture/project" update-ref -d refs/heads/fm/source ;;
+  esac
+  out=$(run_owner "$fixture" 2>&1)
+  expect_code 1 $? "git state $mutation should refuse"
+  assert_refused_before_allocation "$fixture" "$out" "git state $mutation"
+done
+for marker in MERGE_HEAD CHERRY_PICK_HEAD REVERT_HEAD REBASE_HEAD BISECT_START BISECT_LOG sequencer rebase-apply rebase-merge; do
+  fixture=$(new_case "marker-$marker")
+  path=$(git -C "$fixture/source" rev-parse --git-path "$marker")
+  if [ "$marker" = sequencer ] || [ "$marker" = rebase-apply ] || [ "$marker" = rebase-merge ]; then mkdir -p "$path"; else : > "$path"; fi
+  out=$(run_owner "$fixture" 2>&1)
+  expect_code 1 $? "Git marker $marker should refuse"
+  assert_refused_before_allocation "$fixture" "$out" "Git marker $marker"
+done
+pass "clean relaunch: dirty, detached, unreachable, and Git-operation sources refuse"
+
+# Custody is an admission boundary, including malformed data.
+for custody in active parked unreadable; do
+  fixture=$(new_case "custody-$custody")
+  before=$(source_snapshot "$fixture")
+  out=$(FM_TEST_CUSTODY="$custody" run_owner "$fixture" 2>&1)
+  expect_code 1 $? "custody $custody should refuse"
+  assert_refused_before_allocation "$fixture" "$out" "custody $custody"
+  [ "$(source_snapshot "$fixture")" = "$before" ] || fail "custody $custody mutated source"
+done
+pass "clean relaunch: active, parked, and unreadable No-Mistakes custody refuses"
+
+# Failure after allocation leaves no source change and cleans only the new
+# destination's branch, endpoint, task data, and leased worktree.
+for failure in allocator checkout launch acknowledgement; do
+  fixture=$(new_case "failure-$failure")
+  before=$(source_snapshot "$fixture")
+  case "$failure" in
+    allocator)
+      out=$(FM_TEST_ALLOCATOR_MODE=fail run_owner "$fixture" 2>&1)
+      status=$?
+      ;;
+    checkout)
+      out=$(FM_TEST_CHECKOUT_FAIL=1 run_owner "$fixture" 2>&1)
+      status=$?
+      ;;
+    launch)
+      out=$(FM_TEST_LAUNCH_FAIL=1 run_owner "$fixture" 2>&1)
+      status=$?
+      ;;
+    acknowledgement)
+      out=$(FM_TEST_ACK_MODE=timeout FM_CLEAN_COMMIT_RELAUNCH_ACK_POLLS=2 FM_CLEAN_COMMIT_RELAUNCH_ACK_INTERVAL=0.01 run_owner "$fixture" 2>&1)
+      status=$?
+      ;;
+  esac
+  expect_code 1 "$status" "$failure should fail"
+  assert_contains "$out" 'error:' "$failure did not report failure"
+  [ "$(source_snapshot "$fixture")" = "$before" ] || fail "$failure mutated source"
+  assert_absent "$fixture/home/state/destination.meta" "$failure retained destination metadata"
+  assert_absent "$fixture/home/data/destination/relaunch-handoff.json" "$failure retained destination handoff"
+  git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination && fail "$failure retained destination branch"
+done
+pass "clean relaunch: allocator, checkout, launch, and acknowledgement failure preserve source"
+
+# An interrupt after handoff publication exits through destination-only cleanup.
+fixture=$(new_case interrupted-publication)
+before=$(source_snapshot "$fixture")
+FM_TEST_LAUNCH_DELAY=5 run_owner "$fixture" >"$fixture/interrupted.out" 2>&1 &
+pid=$!
+for _ in $(seq 1 100); do
+  [ -f "$fixture/home/data/destination/relaunch-handoff.json" ] && break
+  sleep 0.01
+done
+assert_present "$fixture/home/data/destination/relaunch-handoff.json" "interrupt fixture did not reach destination publication"
+kill -HUP "$pid"
+wait "$pid"
+status=$?
+expect_code 1 "$status" "interrupted publication should fail"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "interrupted publication mutated source"
+assert_absent "$fixture/home/state/destination.meta" "interrupted publication retained destination metadata"
+assert_absent "$fixture/home/data/destination/relaunch-handoff.json" "interrupted publication retained handoff"
+git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination && fail "interrupted publication retained destination branch"
+pass "clean relaunch: interrupted destination publication preserves source"
+
+# The destination lock serializes two simultaneous attempts before a second
+# endpoint or branch can be created.
+fixture=$(new_case concurrency)
+FM_TEST_ALLOCATOR_DELAY=0.2 run_owner "$fixture" >"$fixture/first.out" 2>&1 &
+pid=$!
+sleep 0.05
+out=$(run_owner "$fixture" 2>&1)
+status=$?
+wait "$pid"
+first_status=$?
+[ "$first_status" -eq 0 ] || fail "first concurrent relaunch did not succeed: $(cat "$fixture/first.out")"
+[ "$status" -ne 0 ] || fail "second concurrent relaunch unexpectedly succeeded"
+[ "$(grep -c '^new-window ' "$fixture/tmux.log")" -eq 1 ] || fail "concurrent relaunch created duplicate endpoints"
+pass "clean relaunch: destination lock serializes concurrent requests"
+
+# Generic spawn retains its public fresh-task interface; legacy relaunch flags
+help=$("$ROOT/bin/fm-spawn.sh" --help)
+assert_not_contains "$help" 'accepted-clean-commit' "generic spawn still exposes a relaunch commit flag"
+assert_not_contains "$help" 'relaunch-handoff' "generic spawn still exposes handoff authority"
+assert_not_contains "$help" 'allocated-worktree' "generic spawn still exposes an allocated-worktree mode"
+pass "clean relaunch: generic spawn exposes no relaunch carrier"

From 54d835d558cf55643469ff64bd1fe26216ae4daa Mon Sep 17 00:00:00 2001
From: Pranay Pratyush <pranay.pratyush@gmail.com>
Date: Mon, 31 Aug 2026 18:35:20 +0530
Subject: [PATCH 02/16] no-mistakes(review): Harden relaunch allocation cleanup

---
 bin/fm-clean-commit-relaunch.sh        | 19 +++++++--------
 tests/fm-clean-commit-relaunch.test.sh | 32 +++++++++++++++++++++++---
 2 files changed, 39 insertions(+), 12 deletions(-)

diff --git a/bin/fm-clean-commit-relaunch.sh b/bin/fm-clean-commit-relaunch.sh
index 2b26957064..9eeb4f3dc7 100755
--- a/bin/fm-clean-commit-relaunch.sh
+++ b/bin/fm-clean-commit-relaunch.sh
@@ -44,6 +44,8 @@ DATA=$(resolve_dir data "$DATA") || exit 1
 . "$SCRIPT_DIR/fm-backend.sh"
 # shellcheck source=bin/fm-pr-lib.sh
 . "$SCRIPT_DIR/fm-pr-lib.sh"
+# shellcheck source=bin/fm-pool-lib.sh
+. "$SCRIPT_DIR/fm-pool-lib.sh"
 # shellcheck source=bin/fm-clean-commit-relaunch-launch-lib.sh
 . "$SCRIPT_DIR/fm-clean-commit-relaunch-launch-lib.sh"
 
@@ -198,11 +200,12 @@ DESTINATION_LOCK=$STATE/.spawn-$DESTINATION.lock
 SOURCE_LOCK_HELD=0
 DESTINATION_LOCK_HELD=0
 DESTINATION_WORKTREE=
+DESTINATION_WORKTREE_OWNED=0
 DESTINATION_BRANCH=
 DESTINATION_PUBLISHED=0
 
 cleanup_destination() {
-  [ -n "$DESTINATION_WORKTREE" ] || return 0
+  [ "$DESTINATION_WORKTREE_OWNED" -eq 1 ] || return 0
   fm_clean_relaunch_launch_cleanup "$DESTINATION" || true
   (cd "$PROJECT" && "$SCRIPT_DIR/fm-treehouse-command.sh" return --force "$DESTINATION_WORKTREE" >/dev/null 2>&1) || true
   if [ -n "$DESTINATION_BRANCH" ]; then
@@ -381,15 +384,17 @@ git -C "$PROJECT" show-ref --verify --quiet "refs/heads/$DESTINATION_BRANCH" &&
   exit 1
 }
 
-DESTINATION_WORKTREE=$(cd "$PROJECT" && "$SCRIPT_DIR/fm-treehouse-get.sh" --lease --lease-holder "fm-$DESTINATION") || {
+ALLOCATED_WORKTREE=$(cd "$PROJECT" && "$SCRIPT_DIR/fm-treehouse-get.sh" --lease --lease-holder "fm-$DESTINATION") || {
   echo "error: normal allocator did not supply a destination worktree" >&2
   exit 1
 }
-DESTINATION_WORKTREE=$(resolve_dir destination-worktree "$DESTINATION_WORKTREE") || exit 1
-[ "$DESTINATION_WORKTREE" != "$SOURCE_WORKTREE" ] || {
+ALLOCATED_WORKTREE=$(resolve_dir destination-worktree "$ALLOCATED_WORKTREE") || exit 1
+[ "$ALLOCATED_WORKTREE" != "$SOURCE_WORKTREE" ] || {
   echo "error: normal allocator reused the source worktree" >&2
   exit 1
 }
+DESTINATION_WORKTREE=$ALLOCATED_WORKTREE
+DESTINATION_WORKTREE_OWNED=1
 DESTINATION_TOP=$(git -C "$DESTINATION_WORKTREE" rev-parse --show-toplevel 2>/dev/null || true)
 DESTINATION_TOP=$(resolve_dir destination-repository-root "$DESTINATION_TOP") || exit 1
 [ "$DESTINATION_TOP" = "$DESTINATION_WORKTREE" ] || {
@@ -406,11 +411,7 @@ worktree_is_registered "$PROJECT" "$DESTINATION_WORKTREE" || {
   echo "error: normal allocator returned an unregistered destination worktree" >&2
   exit 1
 }
-DESTINATION_STATUS=$(git -C "$DESTINATION_WORKTREE" status --porcelain --untracked-files=all --ignore-submodules=none 2>/dev/null) || {
-  echo "error: normal allocator returned an unreadable destination worktree" >&2
-  exit 1
-}
-if [ -n "$DESTINATION_STATUS" ] || path_has_git_operation "$DESTINATION_WORKTREE"; then
+if ! fm_pool_worktree_clean "$DESTINATION_WORKTREE" || path_has_git_operation "$DESTINATION_WORKTREE"; then
   echo "error: normal allocator returned an occupied destination worktree" >&2
   exit 1
 fi
diff --git a/tests/fm-clean-commit-relaunch.test.sh b/tests/fm-clean-commit-relaunch.test.sh
index dbd8793c1e..ff5876ba05 100755
--- a/tests/fm-clean-commit-relaunch.test.sh
+++ b/tests/fm-clean-commit-relaunch.test.sh
@@ -22,7 +22,7 @@ copy_runtime() {  # <fixture>
     fm-clean-commit-relaunch.sh fm-clean-commit-relaunch-launch-lib.sh \
     fm-lock-lib.sh fm-nm-run-lib.sh fm-pr-lib.sh fm-task-inbox-lib.sh \
     fm-wake-lib.sh fm-backend.sh fm-omp-process-lib.sh fm-tmux-lib.sh \
-    fm-session-lock-lib.sh; do
+    fm-session-lock-lib.sh fm-pool-lib.sh fm-treehouse-root-lib.sh; do
     cp "$ROOT/bin/$file" "$fixture/bin/$file"
   done
   cp "$ROOT/bin/backends/tmux.sh" "$fixture/bin/backends/tmux.sh"
@@ -30,12 +30,17 @@ copy_runtime() {  # <fixture>
 #!/usr/bin/env bash
 exit 0
 SH
-  cat > "$fixture/bin/fm-treehouse-get.sh" <<'SH'
+cat > "$fixture/bin/fm-treehouse-get.sh" <<'SH'
 #!/usr/bin/env bash
 set -eu
-[ "${FM_TEST_ALLOCATOR_MODE:-success}" = success ] || exit 1
+case "${FM_TEST_ALLOCATOR_MODE:-success}" in
+  success) ;;
+  source) printf '%s\n' "$FM_TEST_SOURCE_WORKTREE"; exit 0 ;;
+  *) exit 1 ;;
+esac
 [ -z "${FM_TEST_ALLOCATOR_DELAY:-}" ] || sleep "$FM_TEST_ALLOCATOR_DELAY"
 [ -z "${FM_TEST_ALLOCATOR_DIRTY:-}" ] || : > "$FM_TEST_DESTINATION/allocator-dirty"
+[ "${FM_TEST_ALLOCATOR_TREEHOUSE_CONFIG:-0}" != 1 ] || : > "$FM_TEST_DESTINATION/treehouse.toml"
 printf '%s\n' "$FM_TEST_DESTINATION"
 SH
   cat > "$fixture/bin/fm-treehouse-command.sh" <<'SH'
@@ -207,6 +212,7 @@ run_owner() {  # <fixture> [source] [destination]
     FM_TEST_REAL_GIT="$REAL_GIT" \
     FM_TEST_HOME="$fixture/home" \
     FM_TEST_PROJECT="$fixture/project" \
+    FM_TEST_SOURCE_WORKTREE="$fixture/source" \
     FM_TEST_DESTINATION="$fixture/destination" \
     FM_TEST_DESTINATION_ID="$destination" \
     FM_TEST_WINDOWS="$fixture/windows" \
@@ -263,6 +269,15 @@ assert_no_grep "$fixture/source" "$fixture/home/data/destination/relaunch-handof
 assert_no_grep 'FM_CLEAN' "$fixture/home/data/destination/relaunch-handoff.json" "handoff captured caller environment"
 pass "clean relaunch: linked worktree success preserves source and binds exact destination identity"
 
+# The pool's untracked root configuration is normal allocator state, not work.
+fixture=$(new_case treehouse-config)
+before=$(source_snapshot "$fixture")
+out=$(FM_TEST_ALLOCATOR_TREEHOUSE_CONFIG=1 run_owner "$fixture" 2>&1)
+expect_code 0 $? "Treehouse-configured destination should succeed"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "Treehouse-configured destination mutated source"
+[ -f "$fixture/destination/treehouse.toml" ] || fail "Treehouse-configured destination lost its pool configuration"
+pass "clean relaunch: lone Treehouse pool configuration remains admissible"
+
 # Endpoint state is admission, never a recovery guess.
 for endpoint in live dead ambiguous unreadable; do
   fixture=$(new_case "endpoint-$endpoint")
@@ -362,6 +377,17 @@ for failure in allocator checkout launch acknowledgement; do
 done
 pass "clean relaunch: allocator, checkout, launch, and acknowledgement failure preserve source"
 
+# A malicious or faulty allocator cannot turn source preservation into cleanup.
+fixture=$(new_case allocator-reuses-source)
+before=$(source_snapshot "$fixture")
+out=$(FM_TEST_ALLOCATOR_MODE=source run_owner "$fixture" 2>&1)
+expect_code 1 $? "source-reusing allocator should refuse"
+assert_contains "$out" 'reused the source worktree' "source-reusing allocator did not explain its refusal"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "source-reusing allocator cleaned or mutated source"
+[ -d "$fixture/source" ] || fail "source-reusing allocator removed the source worktree"
+[ -z "$(cat "$fixture/allocator.log")" ] || fail "source-reusing allocator tried to return the source worktree"
+pass "clean relaunch: source-reusing allocator cannot clean the source"
+
 # An interrupt after handoff publication exits through destination-only cleanup.
 fixture=$(new_case interrupted-publication)
 before=$(source_snapshot "$fixture")

From 4a81a7dc502faf89f0133881bb4382073a90b0c2 Mon Sep 17 00:00:00 2001
From: Pranay Pratyush <pranay.pratyush@gmail.com>
Date: Mon, 31 Aug 2026 18:45:31 +0530
Subject: [PATCH 03/16] no-mistakes(review): Harden relaunch admission and
 cleanup

---
 bin/fm-clean-commit-relaunch-launch-lib.sh |  7 ++--
 bin/fm-clean-commit-relaunch.sh            | 41 ++++++++++++++-----
 tests/fm-clean-commit-relaunch.test.sh     | 46 +++++++++++++++++++++-
 3 files changed, 79 insertions(+), 15 deletions(-)

diff --git a/bin/fm-clean-commit-relaunch-launch-lib.sh b/bin/fm-clean-commit-relaunch-launch-lib.sh
index 4ec6874b0e..2af426cf1b 100755
--- a/bin/fm-clean-commit-relaunch-launch-lib.sh
+++ b/bin/fm-clean-commit-relaunch-launch-lib.sh
@@ -34,7 +34,8 @@ fm_clean_relaunch_launch_cleanup() {  # <destination-id>
   rm -f -- "$state/$id.meta" "$state/$id.status" "$state/$id.turn-ended" \
     "$state/$id.pi-ext.ts" "$state/$id.omp-ext.ts" "$state/$id.omp-ready" \
     "$state/$id.omp-started" "$state/$id.omp-doorbell-ready" "$state/$id.busy-state" \
-    "$state/$id.busy-gen" "$state/$id.grok-turnend-token" "$state/$id.kimi-turnend-token" \
+    "$state/$id.omp-doorbell-ready.requests" "$state/$id.busy-gen" \
+    "$state/$id.grok-turnend-token" "$state/$id.kimi-turnend-token" \
     "$state/$id.hermes-turnend-token" "$state/$id.hermes-session" "$state/$id.hermes-started"
 }
 
@@ -92,10 +93,10 @@ fm_clean_relaunch_launch_allocated() {
   session=$(fm_backend_tmux_container_ensure) || return 1
   window="fm-$id"
   target="$session:$window"
-  fm_backend_tmux_create_task "$session" "$window" "$worktree" >/dev/null || return 1
-
   FM_CLEAN_RELAUNCH_LAUNCH_TARGET=$target
   FM_CLEAN_RELAUNCH_LAUNCH_STATE=$state
+  fm_backend_tmux_create_task "$session" "$window" "$worktree" >/dev/null || return 1
+
   task_tmp="${TMPDIR:-/tmp}/fm-$id"
   if [ -L "$task_tmp" ]; then
     echo "error: destination task temp root must not be a symlink" >&2
diff --git a/bin/fm-clean-commit-relaunch.sh b/bin/fm-clean-commit-relaunch.sh
index 9eeb4f3dc7..b379bff787 100755
--- a/bin/fm-clean-commit-relaunch.sh
+++ b/bin/fm-clean-commit-relaunch.sh
@@ -115,6 +115,18 @@ worktree_is_registered() {  # <repository> <worktree>
   return 1
 }
 
+worktree_is_task_owned() {  # <worktree>
+  local worktree=$1 meta recorded
+  for meta in "$STATE"/*.meta; do
+    [ -f "$meta" ] && [ ! -L "$meta" ] && [ -r "$meta" ] || continue
+    recorded=$(meta_exact "$meta" worktree 2>/dev/null || true)
+    [ -n "$recorded" ] || continue
+    recorded=$(resolve_dir recorded-task-worktree "$recorded" 2>/dev/null || true)
+    [ "$recorded" != "$worktree" ] || return 0
+  done
+  return 1
+}
+
 destination_artifact_exists() {  # <destination>
   local destination=$1 artifact
   for artifact in \
@@ -122,7 +134,8 @@ destination_artifact_exists() {  # <destination>
     "$STATE/$destination.turn-ended" "$STATE/$destination.meta" \
     "$STATE/$destination.pi-ext.ts" "$STATE/$destination.omp-ext.ts" \
     "$STATE/$destination.omp-ready" "$STATE/$destination.omp-started" \
-    "$STATE/$destination.omp-doorbell-ready" "$STATE/$destination.grok-turnend-token" \
+    "$STATE/$destination.omp-doorbell-ready" "$STATE/$destination.omp-doorbell-ready.requests" \
+    "$STATE/$destination.grok-turnend-token" \
     "$STATE/$destination.kimi-turnend-token" "$STATE/$destination.hermes-turnend-token" \
     "$STATE/$destination.hermes-session" "$STATE/$destination.hermes-started" \
     "$STATE/$destination.busy-state" "$STATE/$destination.busy-gen" \
@@ -308,6 +321,14 @@ grep -Fxq "Delivery contract: mode=$MODE" "$DESTINATION_BRIEF" || {
   echo "error: destination brief delivery contract does not match source mode=$MODE" >&2
   exit 1
 }
+PR=$(meta_optional_exact "$SOURCE_META" pr) || { echo "error: source task $SOURCE has malformed PR metadata" >&2; exit 1; }
+if [ -n "$PR" ]; then
+  fm_pr_url_parse "$PR" && [ "$FM_PR_URL" = "$PR" ] || {
+    echo "error: source task $SOURCE has non-canonical PR metadata" >&2
+    exit 1
+  }
+  PR=$FM_PR_URL
+fi
 
 SOURCE_WORKTREE=$(resolve_dir source-worktree "$SOURCE_WORKTREE") || exit 1
 PROJECT=$(resolve_dir recorded-project "$PROJECT") || exit 1
@@ -394,7 +415,6 @@ ALLOCATED_WORKTREE=$(resolve_dir destination-worktree "$ALLOCATED_WORKTREE") ||
   exit 1
 }
 DESTINATION_WORKTREE=$ALLOCATED_WORKTREE
-DESTINATION_WORKTREE_OWNED=1
 DESTINATION_TOP=$(git -C "$DESTINATION_WORKTREE" rev-parse --show-toplevel 2>/dev/null || true)
 DESTINATION_TOP=$(resolve_dir destination-repository-root "$DESTINATION_TOP") || exit 1
 [ "$DESTINATION_TOP" = "$DESTINATION_WORKTREE" ] || {
@@ -407,14 +427,23 @@ DESTINATION_COMMON=$(resolve_dir destination-physical-repository "$DESTINATION_C
   echo "error: normal allocator returned a destination from another physical repository" >&2
   exit 1
 }
+[ "$DESTINATION_WORKTREE" != "$PROJECT" ] || {
+  echo "error: normal allocator returned the primary project worktree" >&2
+  exit 1
+}
 worktree_is_registered "$PROJECT" "$DESTINATION_WORKTREE" || {
   echo "error: normal allocator returned an unregistered destination worktree" >&2
   exit 1
 }
+worktree_is_task_owned "$DESTINATION_WORKTREE" && {
+  echo "error: normal allocator returned an existing task worktree" >&2
+  exit 1
+}
 if ! fm_pool_worktree_clean "$DESTINATION_WORKTREE" || path_has_git_operation "$DESTINATION_WORKTREE"; then
   echo "error: normal allocator returned an occupied destination worktree" >&2
   exit 1
 fi
+DESTINATION_WORKTREE_OWNED=1
 git -C "$DESTINATION_WORKTREE" checkout -b "$DESTINATION_BRANCH" "$SOURCE_COMMIT" >/dev/null || {
   echo "error: could not create the destination branch at the admitted source commit" >&2
   exit 1
@@ -429,14 +458,6 @@ DESTINATION_ATTACHED_BRANCH=$(git -C "$DESTINATION_WORKTREE" symbolic-ref --quie
 REPOSITORY_IDENTITY=$(sha256_text "$PROJECT_COMMON")
 SOURCE_BRIEF_IDENTITY=$(sha256_file "$SOURCE_BRIEF") || exit 1
 DESTINATION_BRIEF_IDENTITY=$(sha256_file "$DESTINATION_BRIEF") || exit 1
-PR=$(meta_optional_exact "$SOURCE_META" pr) || { echo "error: source task $SOURCE has malformed PR metadata" >&2; exit 1; }
-if [ -n "$PR" ]; then
-  fm_pr_url_parse "$PR" && [ "$FM_PR_URL" = "$PR" ] || {
-    echo "error: source task $SOURCE has non-canonical PR metadata" >&2
-    exit 1
-  }
-  PR=$FM_PR_URL
-fi
 HANDOFF_TMP=$(mktemp "$DATA/$DESTINATION/.relaunch-handoff.XXXXXX") || exit 1
 jq -n \
   --arg schema fm-clean-commit-relaunch.v1 \
diff --git a/tests/fm-clean-commit-relaunch.test.sh b/tests/fm-clean-commit-relaunch.test.sh
index ff5876ba05..022ac4b41d 100755
--- a/tests/fm-clean-commit-relaunch.test.sh
+++ b/tests/fm-clean-commit-relaunch.test.sh
@@ -36,6 +36,8 @@ set -eu
 case "${FM_TEST_ALLOCATOR_MODE:-success}" in
   success) ;;
   source) printf '%s\n' "$FM_TEST_SOURCE_WORKTREE"; exit 0 ;;
+  project) printf '%s\n' "$FM_TEST_PROJECT"; exit 0 ;;
+  task) printf '%s\n' "$FM_TEST_TASK_WORKTREE"; exit 0 ;;
   *) exit 1 ;;
 esac
 [ -z "${FM_TEST_ALLOCATOR_DELAY:-}" ] || sleep "$FM_TEST_ALLOCATOR_DELAY"
@@ -156,12 +158,13 @@ EOF
 }
 
 new_case() {  # <name>
-  local name fixture project source destination home
+  local name fixture project source destination other home
   name=$1
   fixture="$TMP_ROOT/$name"
   project="$fixture/project"
   source="$fixture/source"
   destination="$fixture/destination"
+  other="$fixture/other"
   home="$fixture/home"
   mkdir -p "$fixture" "$fixture/tmp" "$home/state" "$home/data" "$home/config" "$project"
   git -C "$project" init -q
@@ -174,6 +177,7 @@ new_case() {  # <name>
   git -C "$source" add committed.txt
   git -C "$source" commit -qm committed-source
   git -C "$project" worktree add -q -b pool/destination "$destination" main
+  git -C "$project" worktree add -q -b fm/other "$other" main
   copy_runtime "$fixture"
   make_fakebin "$fixture"
   write_brief "$home/data/source/brief.md" no-mistakes
@@ -200,6 +204,7 @@ printf '%s\n' source-validation > "$home/state/source.pr-poll"
 printf '%s\n' source-inbox > "$home/state/source.inbox/001.msg"
 printf '%s\n' source-temp > "$fixture/tmp/fm-source/session"
 printf '%s\n' source-receipt > "$home/data/source/evidence.jsonl"
+printf 'worktree=%s\n' "$other" > "$home/state/other.meta"
   : > "$fixture/windows"
   : > "$fixture/allocator.log"
   : > "$fixture/tmux.log"
@@ -213,6 +218,7 @@ run_owner() {  # <fixture> [source] [destination]
     FM_TEST_HOME="$fixture/home" \
     FM_TEST_PROJECT="$fixture/project" \
     FM_TEST_SOURCE_WORKTREE="$fixture/source" \
+    FM_TEST_TASK_WORKTREE="$fixture/other" \
     FM_TEST_DESTINATION="$fixture/destination" \
     FM_TEST_DESTINATION_ID="$destination" \
     FM_TEST_WINDOWS="$fixture/windows" \
@@ -291,7 +297,7 @@ pass "clean relaunch: only an authoritatively missing endpoint passes admission"
 
 # Metadata identity, role, home, and durable occupancy all refuse before the
 # allocator can create a destination.
-for mutation in malformed wrong-kind secondmate endpoint-mismatch destination-occupied branch-collision; do
+for mutation in malformed wrong-kind secondmate endpoint-mismatch destination-occupied destination-doorbell-requests duplicate-pr noncanonical-pr branch-collision; do
   fixture=$(new_case "admission-$mutation")
   case "$mutation" in
     malformed) printf 'worktree=%s\n' "$fixture/source" >> "$fixture/home/state/source.meta" ;;
@@ -299,6 +305,9 @@ for mutation in malformed wrong-kind secondmate endpoint-mismatch destination-oc
     secondmate) printf 'home=%s\n' "$fixture/home" >> "$fixture/home/state/source.meta" ;;
     endpoint-mismatch) sed -i 's/^endpoint_task_id=source$/endpoint_task_id=other/' "$fixture/home/state/source.meta" ;;
     destination-occupied) : > "$fixture/home/state/destination.status" ;;
+    destination-doorbell-requests) : > "$fixture/home/state/destination.omp-doorbell-ready.requests" ;;
+    duplicate-pr) printf 'pr=https://github.com/example/repo/pull/2\n' >> "$fixture/home/state/source.meta" ;;
+    noncanonical-pr) sed -i 's#^pr=.*#pr=https://github.com/example/repo/pull/not-a-number#' "$fixture/home/state/source.meta" ;;
     branch-collision) git -C "$fixture/project" branch fm/destination main ;;
   esac
   before=$(source_snapshot "$fixture")
@@ -388,6 +397,19 @@ assert_contains "$out" 'reused the source worktree' "source-reusing allocator di
 [ -z "$(cat "$fixture/allocator.log")" ] || fail "source-reusing allocator tried to return the source worktree"
 pass "clean relaunch: source-reusing allocator cannot clean the source"
 
+# Only an unclaimed pool worktree may become cleanup-owned destination state.
+for allocator in project task; do
+  fixture=$(new_case "allocator-reuses-$allocator")
+  before=$(source_snapshot "$fixture")
+  out=$(FM_TEST_ALLOCATOR_MODE="$allocator" run_owner "$fixture" 2>&1)
+  expect_code 1 $? "$allocator-reusing allocator should refuse"
+  assert_contains "$out" 'error:' "$allocator-reusing allocator did not explain its refusal"
+  [ "$(source_snapshot "$fixture")" = "$before" ] || fail "$allocator-reusing allocator mutated source"
+  [ -z "$(cat "$fixture/allocator.log")" ] || fail "$allocator-reusing allocator tried to return an existing worktree"
+  git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination && fail "$allocator-reusing allocator created a destination branch"
+done
+pass "clean relaunch: allocator must not reuse existing project worktrees"
+
 # An interrupt after handoff publication exits through destination-only cleanup.
 fixture=$(new_case interrupted-publication)
 before=$(source_snapshot "$fixture")
@@ -408,6 +430,26 @@ assert_absent "$fixture/home/data/destination/relaunch-handoff.json" "interrupte
 git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination && fail "interrupted publication retained destination branch"
 pass "clean relaunch: interrupted destination publication preserves source"
 
+# An interrupt while tmux creates the destination also cleans that new window.
+fixture=$(new_case interrupted-window-creation)
+before=$(source_snapshot "$fixture")
+FM_TEST_LAUNCH_DELAY=5 run_owner "$fixture" >"$fixture/interrupted.out" 2>&1 &
+pid=$!
+for _ in $(seq 1 100); do
+  [ -s "$fixture/tmux.log" ] && break
+  sleep 0.01
+done
+assert_present "$fixture/tmux.log" "window-creation interrupt fixture did not start tmux creation"
+kill -HUP "$pid"
+wait "$pid"
+status=$?
+expect_code 1 "$status" "interrupted window creation should fail"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "interrupted window creation mutated source"
+assert_contains "$(cat "$fixture/tmux.log")" 'kill-window' "interrupted window creation did not clean the destination endpoint"
+assert_absent "$fixture/home/state/destination.meta" "interrupted window creation retained destination metadata"
+git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination && fail "interrupted window creation retained destination branch"
+pass "clean relaunch: interrupted window creation cleans destination endpoint"
+
 # The destination lock serializes two simultaneous attempts before a second
 # endpoint or branch can be created.
 fixture=$(new_case concurrency)

From 0f642bb2b351b426e1274f83783cf445adbfe415 Mon Sep 17 00:00:00 2001
From: Pranay Pratyush <pranay.pratyush@gmail.com>
Date: Mon, 31 Aug 2026 18:56:42 +0530
Subject: [PATCH 04/16] no-mistakes(review): Safeguard relaunch cleanup
 ownership

---
 bin/fm-clean-commit-relaunch.sh        | 33 ++++++++++++++++++++++----
 tests/fm-clean-commit-relaunch.test.sh | 29 ++++++++++++++++++++--
 2 files changed, 56 insertions(+), 6 deletions(-)

diff --git a/bin/fm-clean-commit-relaunch.sh b/bin/fm-clean-commit-relaunch.sh
index b379bff787..f9b20fbfc0 100755
--- a/bin/fm-clean-commit-relaunch.sh
+++ b/bin/fm-clean-commit-relaunch.sh
@@ -127,6 +127,19 @@ worktree_is_task_owned() {  # <worktree>
   return 1
 }
 
+destination_tmux_window_absent() {  # <destination>
+  local destination=$1 session windows
+  if [ -n "${TMUX:-}" ]; then
+    session=$(tmux display-message -p '#S' 2>/dev/null) || return 1
+  elif tmux has-session -t firstmate 2>/dev/null; then
+    session=firstmate
+  else
+    return 0
+  fi
+  windows=$(tmux list-windows -t "$session" -F '#{window_name}' 2>/dev/null) || return 1
+  ! grep -Fxq "fm-$destination" <<< "$windows"
+}
+
 destination_artifact_exists() {  # <destination>
   local destination=$1 artifact
   for artifact in \
@@ -220,9 +233,15 @@ DESTINATION_PUBLISHED=0
 cleanup_destination() {
   [ "$DESTINATION_WORKTREE_OWNED" -eq 1 ] || return 0
   fm_clean_relaunch_launch_cleanup "$DESTINATION" || true
-  (cd "$PROJECT" && "$SCRIPT_DIR/fm-treehouse-command.sh" return --force "$DESTINATION_WORKTREE" >/dev/null 2>&1) || true
+  if ! (cd "$PROJECT" && "$SCRIPT_DIR/fm-treehouse-command.sh" return --if-lease-holder "fm-$DESTINATION" "$DESTINATION_WORKTREE"); then
+    echo "error: could not return destination worktree $DESTINATION_WORKTREE" >&2
+    return 1
+  fi
   if [ -n "$DESTINATION_BRANCH" ]; then
-    git -C "$PROJECT" branch -D "$DESTINATION_BRANCH" >/dev/null 2>&1 || true
+    if ! git -C "$PROJECT" branch -D "$DESTINATION_BRANCH" >/dev/null; then
+      echo "error: could not delete destination branch $DESTINATION_BRANCH" >&2
+      return 1
+    fi
   fi
   rm -f -- "$DESTINATION_HANDOFF"
 }
@@ -230,10 +249,11 @@ cleanup_destination() {
 cleanup() {
   status=$?
   if [ "$status" -ne 0 ] && [ "$DESTINATION_PUBLISHED" -eq 0 ]; then
-    cleanup_destination
+    cleanup_destination || echo "error: destination cleanup is incomplete" >&2
   fi
   [ "$DESTINATION_LOCK_HELD" -eq 0 ] || fm_lock_release "$DESTINATION_LOCK" || true
   [ "$SOURCE_LOCK_HELD" -eq 0 ] || fm_lock_release "$SOURCE_LOCK" || true
+  return "$status"
 }
 interrupted() {
   exit 1
@@ -388,6 +408,10 @@ case "$(fm_backend_agent_state "$BACKEND" "$FM_BACKEND_VALIDATED_TARGET" "$SOURC
   missing) ;;
   *) echo "error: source task $SOURCE endpoint is not authoritatively missing" >&2; exit 1 ;;
 esac
+destination_tmux_window_absent "$DESTINATION" || {
+  echo "error: destination task $DESTINATION already has a tmux endpoint or tmux is unreadable" >&2
+  exit 1
+}
 CUSTODY=$(no_mistakes_custody "$SOURCE_WORKTREE" "$SOURCE_BRANCH")
 case "$CUSTODY" in
   none) ;;
@@ -410,11 +434,12 @@ ALLOCATED_WORKTREE=$(cd "$PROJECT" && "$SCRIPT_DIR/fm-treehouse-get.sh" --lease
   exit 1
 }
 ALLOCATED_WORKTREE=$(resolve_dir destination-worktree "$ALLOCATED_WORKTREE") || exit 1
+DESTINATION_WORKTREE=$ALLOCATED_WORKTREE
+DESTINATION_WORKTREE_OWNED=1
 [ "$ALLOCATED_WORKTREE" != "$SOURCE_WORKTREE" ] || {
   echo "error: normal allocator reused the source worktree" >&2
   exit 1
 }
-DESTINATION_WORKTREE=$ALLOCATED_WORKTREE
 DESTINATION_TOP=$(git -C "$DESTINATION_WORKTREE" rev-parse --show-toplevel 2>/dev/null || true)
 DESTINATION_TOP=$(resolve_dir destination-repository-root "$DESTINATION_TOP") || exit 1
 [ "$DESTINATION_TOP" = "$DESTINATION_WORKTREE" ] || {
diff --git a/tests/fm-clean-commit-relaunch.test.sh b/tests/fm-clean-commit-relaunch.test.sh
index 022ac4b41d..5cf5f1c057 100755
--- a/tests/fm-clean-commit-relaunch.test.sh
+++ b/tests/fm-clean-commit-relaunch.test.sh
@@ -50,7 +50,10 @@ SH
 set -eu
 printf '%s\n' "$*" >> "$FM_TEST_ALLOCATOR_LOG"
 if [ "${1:-}" = return ]; then
+  [ "${FM_TEST_RETURN_FAIL:-0}" != 1 ] || exit 1
   path=${!#}
+  [ "${2:-}" = --if-lease-holder ] && [ "${3:-}" = "fm-$FM_TEST_DESTINATION_ID" ] \
+    && [ "$path" = "$FM_TEST_DESTINATION" ] || exit 1
   git -C "$FM_TEST_PROJECT" worktree remove --force "$path" >/dev/null 2>&1 || true
 fi
 SH
@@ -295,6 +298,17 @@ for endpoint in live dead ambiguous unreadable; do
 done
 pass "clean relaunch: only an authoritatively missing endpoint passes admission"
 
+# A destination endpoint is occupied even without durable task metadata.
+fixture=$(new_case destination-window-occupied)
+before=$(source_snapshot "$fixture")
+printf 'fm-destination\n' > "$fixture/windows"
+out=$(run_owner "$fixture" 2>&1)
+expect_code 1 $? "existing destination window should refuse"
+assert_refused_before_allocation "$fixture" "$out" "existing destination window"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "existing destination window mutated source"
+[ "$(cat "$fixture/windows")" = fm-destination ] || fail "existing destination window was removed"
+pass "clean relaunch: existing destination endpoint refuses before allocation"
+
 # Metadata identity, role, home, and durable occupancy all refuse before the
 # allocator can create a destination.
 for mutation in malformed wrong-kind secondmate endpoint-mismatch destination-occupied destination-doorbell-requests duplicate-pr noncanonical-pr branch-collision; do
@@ -394,7 +408,7 @@ expect_code 1 $? "source-reusing allocator should refuse"
 assert_contains "$out" 'reused the source worktree' "source-reusing allocator did not explain its refusal"
 [ "$(source_snapshot "$fixture")" = "$before" ] || fail "source-reusing allocator cleaned or mutated source"
 [ -d "$fixture/source" ] || fail "source-reusing allocator removed the source worktree"
-[ -z "$(cat "$fixture/allocator.log")" ] || fail "source-reusing allocator tried to return the source worktree"
+assert_not_contains '--force' "$(cat "$fixture/allocator.log")" "source-reusing allocator used unsafe cleanup"
 pass "clean relaunch: source-reusing allocator cannot clean the source"
 
 # Only an unclaimed pool worktree may become cleanup-owned destination state.
@@ -405,11 +419,22 @@ for allocator in project task; do
   expect_code 1 $? "$allocator-reusing allocator should refuse"
   assert_contains "$out" 'error:' "$allocator-reusing allocator did not explain its refusal"
   [ "$(source_snapshot "$fixture")" = "$before" ] || fail "$allocator-reusing allocator mutated source"
-  [ -z "$(cat "$fixture/allocator.log")" ] || fail "$allocator-reusing allocator tried to return an existing worktree"
+  assert_not_contains '--force' "$(cat "$fixture/allocator.log")" "$allocator-reusing allocator used unsafe cleanup"
   git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination && fail "$allocator-reusing allocator created a destination branch"
 done
 pass "clean relaunch: allocator must not reuse existing project worktrees"
 
+# A return failure stays visible and leaves the lease-bound destination intact.
+fixture=$(new_case return-failure)
+before=$(source_snapshot "$fixture")
+out=$(FM_TEST_LAUNCH_FAIL=1 FM_TEST_RETURN_FAIL=1 run_owner "$fixture" 2>&1)
+expect_code 1 $? "return failure should fail"
+assert_contains "$out" 'destination cleanup is incomplete' "return failure was suppressed"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "return failure mutated source"
+assert_present "$fixture/destination" "return failure removed the destination worktree"
+git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination || fail "return failure removed attached destination branch"
+pass "clean relaunch: failed destination return remains actionable"
+
 # An interrupt after handoff publication exits through destination-only cleanup.
 fixture=$(new_case interrupted-publication)
 before=$(source_snapshot "$fixture")

From e8858c97a9bb8cd7b74f257a10e43b23c6b224f1 Mon Sep 17 00:00:00 2001
From: Pranay Pratyush <pranay.pratyush@gmail.com>
Date: Mon, 31 Aug 2026 19:03:55 +0530
Subject: [PATCH 05/16] no-mistakes(review): Eliminate relaunch cleanup
 ownership races

---
 bin/fm-clean-commit-relaunch-launch-lib.sh | 23 ++++++++++++----
 bin/fm-clean-commit-relaunch.sh            | 22 +++++++++++----
 tests/fm-clean-commit-relaunch.test.sh     | 31 ++++++++++++++++++++--
 3 files changed, 64 insertions(+), 12 deletions(-)

diff --git a/bin/fm-clean-commit-relaunch-launch-lib.sh b/bin/fm-clean-commit-relaunch-launch-lib.sh
index 2af426cf1b..d601f365bb 100755
--- a/bin/fm-clean-commit-relaunch-launch-lib.sh
+++ b/bin/fm-clean-commit-relaunch-launch-lib.sh
@@ -12,6 +12,12 @@ _FM_CLEAN_RELAUNCH_LAUNCH_LIB_DIR=$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE
 
 FM_CLEAN_RELAUNCH_LAUNCH_TARGET=
 FM_CLEAN_RELAUNCH_LAUNCH_STATE=
+FM_CLEAN_RELAUNCH_LAUNCH_WINDOW_ID=
+FM_CLEAN_RELAUNCH_LAUNCH_CREATE_INTERRUPTED=0
+
+fm_clean_relaunch_defer_window_creation_signal() {
+  FM_CLEAN_RELAUNCH_LAUNCH_CREATE_INTERRUPTED=1
+}
 
 fm_clean_relaunch_shell_quote() {  # <value>
   local value=$1
@@ -26,8 +32,8 @@ fm_clean_relaunch_destination_meta_absent() {  # <state> <id>
 }
 
 fm_clean_relaunch_launch_cleanup() {  # <destination-id>
-  local id=$1 state=${FM_CLEAN_RELAUNCH_LAUNCH_STATE:-} target=${FM_CLEAN_RELAUNCH_LAUNCH_TARGET:-}
-  [ -n "$target" ] && fm_backend_kill tmux "$target" >/dev/null 2>&1 || true
+  local id=$1 state=${FM_CLEAN_RELAUNCH_LAUNCH_STATE:-} window_id=${FM_CLEAN_RELAUNCH_LAUNCH_WINDOW_ID:-}
+  [ -n "$window_id" ] && fm_backend_kill tmux "$window_id" >/dev/null 2>&1 || true
   [ -n "$state" ] || return 0
   rm -rf -- "${TMPDIR:-/tmp}/fm-$id"
   rm -rf -- "$state/$id.inbox"
@@ -67,7 +73,7 @@ fm_clean_relaunch_wait_for_ack() {  # <state> <id> <record>
 fm_clean_relaunch_launch_allocated() {
   local id=$1 project=$2 worktree=$3 brief=$4 harness=$5 backend=$6 mode=$7 yolo=$8 model=$9 effort=${10}
   local state=${STATE:?STATE must be set by the relaunch owner}
-  local session window target task_tmp meta_tmp launch record handoff
+  local session window target window_id task_tmp meta_tmp launch record handoff
 
   [ "$harness:$backend" = codex:tmux ] || {
     echo "error: allocated relaunch launch supports only codex/tmux" >&2
@@ -93,9 +99,16 @@ fm_clean_relaunch_launch_allocated() {
   session=$(fm_backend_tmux_container_ensure) || return 1
   window="fm-$id"
   target="$session:$window"
-  FM_CLEAN_RELAUNCH_LAUNCH_TARGET=$target
   FM_CLEAN_RELAUNCH_LAUNCH_STATE=$state
-  fm_backend_tmux_create_task "$session" "$window" "$worktree" >/dev/null || return 1
+  trap fm_clean_relaunch_defer_window_creation_signal HUP INT TERM
+  if window_id=$(fm_backend_tmux_create_task "$session" "$window" "$worktree"); then
+    FM_CLEAN_RELAUNCH_LAUNCH_WINDOW_ID="$session:$window_id"
+  else
+    trap interrupted HUP INT TERM
+    return 1
+  fi
+  trap interrupted HUP INT TERM
+  [ "$FM_CLEAN_RELAUNCH_LAUNCH_CREATE_INTERRUPTED" -eq 0 ] || return 1
 
   task_tmp="${TMPDIR:-/tmp}/fm-$id"
   if [ -L "$task_tmp" ]; then
diff --git a/bin/fm-clean-commit-relaunch.sh b/bin/fm-clean-commit-relaunch.sh
index f9b20fbfc0..c6a09bd283 100755
--- a/bin/fm-clean-commit-relaunch.sh
+++ b/bin/fm-clean-commit-relaunch.sh
@@ -228,7 +228,13 @@ DESTINATION_LOCK_HELD=0
 DESTINATION_WORKTREE=
 DESTINATION_WORKTREE_OWNED=0
 DESTINATION_BRANCH=
+DESTINATION_BRANCH_CREATED=0
 DESTINATION_PUBLISHED=0
+DESTINATION_CHECKOUT_INTERRUPTED=0
+
+defer_destination_checkout_signal() {
+  DESTINATION_CHECKOUT_INTERRUPTED=1
+}
 
 cleanup_destination() {
   [ "$DESTINATION_WORKTREE_OWNED" -eq 1 ] || return 0
@@ -237,7 +243,7 @@ cleanup_destination() {
     echo "error: could not return destination worktree $DESTINATION_WORKTREE" >&2
     return 1
   fi
-  if [ -n "$DESTINATION_BRANCH" ]; then
+  if [ "$DESTINATION_BRANCH_CREATED" -eq 1 ]; then
     if ! git -C "$PROJECT" branch -D "$DESTINATION_BRANCH" >/dev/null; then
       echo "error: could not delete destination branch $DESTINATION_BRANCH" >&2
       return 1
@@ -433,9 +439,10 @@ ALLOCATED_WORKTREE=$(cd "$PROJECT" && "$SCRIPT_DIR/fm-treehouse-get.sh" --lease
   echo "error: normal allocator did not supply a destination worktree" >&2
   exit 1
 }
-ALLOCATED_WORKTREE=$(resolve_dir destination-worktree "$ALLOCATED_WORKTREE") || exit 1
 DESTINATION_WORKTREE=$ALLOCATED_WORKTREE
 DESTINATION_WORKTREE_OWNED=1
+ALLOCATED_WORKTREE=$(resolve_dir destination-worktree "$ALLOCATED_WORKTREE") || exit 1
+DESTINATION_WORKTREE=$ALLOCATED_WORKTREE
 [ "$ALLOCATED_WORKTREE" != "$SOURCE_WORKTREE" ] || {
   echo "error: normal allocator reused the source worktree" >&2
   exit 1
@@ -468,11 +475,16 @@ if ! fm_pool_worktree_clean "$DESTINATION_WORKTREE" || path_has_git_operation "$
   echo "error: normal allocator returned an occupied destination worktree" >&2
   exit 1
 fi
-DESTINATION_WORKTREE_OWNED=1
-git -C "$DESTINATION_WORKTREE" checkout -b "$DESTINATION_BRANCH" "$SOURCE_COMMIT" >/dev/null || {
+trap defer_destination_checkout_signal HUP INT TERM
+if git -C "$DESTINATION_WORKTREE" checkout -b "$DESTINATION_BRANCH" "$SOURCE_COMMIT" >/dev/null; then
+  DESTINATION_BRANCH_CREATED=1
+else
+  trap interrupted HUP INT TERM
   echo "error: could not create the destination branch at the admitted source commit" >&2
   exit 1
-}
+fi
+trap interrupted HUP INT TERM
+[ "$DESTINATION_CHECKOUT_INTERRUPTED" -eq 0 ] || exit 1
 DESTINATION_HEAD=$(git -C "$DESTINATION_WORKTREE" rev-parse --verify --quiet 'HEAD^{commit}' 2>/dev/null || true)
 DESTINATION_ATTACHED_BRANCH=$(git -C "$DESTINATION_WORKTREE" symbolic-ref --quiet --short HEAD 2>/dev/null || true)
 [ "$DESTINATION_HEAD" = "$SOURCE_COMMIT" ] && [ "$DESTINATION_ATTACHED_BRANCH" = "$DESTINATION_BRANCH" ] || {
diff --git a/tests/fm-clean-commit-relaunch.test.sh b/tests/fm-clean-commit-relaunch.test.sh
index 5cf5f1c057..18ef915669 100755
--- a/tests/fm-clean-commit-relaunch.test.sh
+++ b/tests/fm-clean-commit-relaunch.test.sh
@@ -95,6 +95,10 @@ case "$command" in
     ;;
   new-window)
     log "new-window $*"
+    if [ "${FM_TEST_FOREIGN_WINDOW_RACE:-0}" = 1 ]; then
+      printf 'fm-%s\n' "$FM_TEST_DESTINATION_ID" >> "$FM_TEST_WINDOWS"
+      exit 1
+    fi
     [ -z "${FM_TEST_LAUNCH_DELAY:-}" ] || sleep "$FM_TEST_LAUNCH_DELAY"
     [ "${FM_TEST_LAUNCH_FAIL:-0}" != 1 ] || exit 1
     printf 'fm-%s\n' "$FM_TEST_DESTINATION_ID" >> "$FM_TEST_WINDOWS"
@@ -137,8 +141,12 @@ SH
   cat > "$fakebin/git" <<'SH'
 #!/usr/bin/env bash
 set -u
-if [ "${FM_TEST_CHECKOUT_FAIL:-0}" = 1 ] && [ "$1" = -C ] && [ "${3:-}" = checkout ] && [ "${4:-}" = -b ]; then
-  exit 1
+if [ "$1" = -C ] && [ "${3:-}" = checkout ] && [ "${4:-}" = -b ]; then
+  if [ "${FM_TEST_CHECKOUT_RACE:-0}" = 1 ]; then
+    "${FM_TEST_REAL_GIT}" -C "$2" branch "$5" "$6"
+    exit 1
+  fi
+  [ "${FM_TEST_CHECKOUT_FAIL:-0}" != 1 ] || exit 1
 fi
 exec "${FM_TEST_REAL_GIT}" "$@"
 SH
@@ -435,6 +443,25 @@ assert_present "$fixture/destination" "return failure removed the destination wo
 git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination || fail "return failure removed attached destination branch"
 pass "clean relaunch: failed destination return remains actionable"
 
+# A concurrent branch creation never becomes this relaunch's cleanup target.
+fixture=$(new_case branch-race)
+before=$(source_snapshot "$fixture")
+out=$(FM_TEST_CHECKOUT_RACE=1 run_owner "$fixture" 2>&1)
+expect_code 1 $? "concurrent branch creation should fail"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "concurrent branch creation mutated source"
+git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination || fail "concurrent branch creation was deleted"
+pass "clean relaunch: concurrent destination branch remains foreign"
+
+# A concurrent tmux window creation never becomes this relaunch's cleanup target.
+fixture=$(new_case window-race)
+before=$(source_snapshot "$fixture")
+out=$(FM_TEST_FOREIGN_WINDOW_RACE=1 run_owner "$fixture" 2>&1)
+expect_code 1 $? "concurrent window creation should fail"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "concurrent window creation mutated source"
+[ "$(cat "$fixture/windows")" = fm-destination ] || fail "concurrent window creation was removed"
+assert_not_contains 'kill-window' "$(cat "$fixture/tmux.log")" "concurrent window creation was cleaned"
+pass "clean relaunch: concurrent destination endpoint remains foreign"
+
 # An interrupt after handoff publication exits through destination-only cleanup.
 fixture=$(new_case interrupted-publication)
 before=$(source_snapshot "$fixture")

From f1dcf974e552b57167cc54dfb8f96e0cb2f4d20f Mon Sep 17 00:00:00 2001
From: Pranay Pratyush <pranay.pratyush@gmail.com>
Date: Mon, 31 Aug 2026 19:10:29 +0530
Subject: [PATCH 06/16] no-mistakes(review): Harden relaunch cleanup and
 custody admission

---
 bin/fm-clean-commit-relaunch.sh        | 29 +++++++++++++++++++------
 tests/fm-clean-commit-relaunch.test.sh | 30 +++++++++++++++++++++++++-
 2 files changed, 52 insertions(+), 7 deletions(-)

diff --git a/bin/fm-clean-commit-relaunch.sh b/bin/fm-clean-commit-relaunch.sh
index c6a09bd283..fdc7c29a6b 100755
--- a/bin/fm-clean-commit-relaunch.sh
+++ b/bin/fm-clean-commit-relaunch.sh
@@ -119,14 +119,22 @@ worktree_is_task_owned() {  # <worktree>
   local worktree=$1 meta recorded
   for meta in "$STATE"/*.meta; do
     [ -f "$meta" ] && [ ! -L "$meta" ] && [ -r "$meta" ] || continue
-    recorded=$(meta_exact "$meta" worktree 2>/dev/null || true)
-    [ -n "$recorded" ] || continue
-    recorded=$(resolve_dir recorded-task-worktree "$recorded" 2>/dev/null || true)
+    recorded=$(meta_exact "$meta" worktree 2>/dev/null) || return 2
+    recorded=$(resolve_dir recorded-task-worktree "$recorded" 2>/dev/null) || return 2
     [ "$recorded" != "$worktree" ] || return 0
   done
   return 1
 }
 
+task_worktrees_are_well_formed() {
+  local meta recorded
+  for meta in "$STATE"/*.meta; do
+    [ -f "$meta" ] && [ ! -L "$meta" ] && [ -r "$meta" ] || continue
+    recorded=$(meta_exact "$meta" worktree 2>/dev/null) || return 1
+    resolve_dir recorded-task-worktree "$recorded" >/dev/null 2>&1 || return 1
+  done
+}
+
 destination_tmux_window_absent() {  # <destination>
   local destination=$1 session windows
   if [ -n "${TMUX:-}" ]; then
@@ -254,7 +262,7 @@ cleanup_destination() {
 
 cleanup() {
   status=$?
-  if [ "$status" -ne 0 ] && [ "$DESTINATION_PUBLISHED" -eq 0 ]; then
+  if [ "$status" -ne 0 ]; then
     cleanup_destination || echo "error: destination cleanup is incomplete" >&2
   fi
   [ "$DESTINATION_LOCK_HELD" -eq 0 ] || fm_lock_release "$DESTINATION_LOCK" || true
@@ -424,6 +432,10 @@ case "$CUSTODY" in
   active|parked) echo "error: source task $SOURCE has active or parked No-Mistakes custody" >&2; exit 1 ;;
   *) echo "error: source task $SOURCE No-Mistakes custody is unreadable or malformed" >&2; exit 1 ;;
 esac
+task_worktrees_are_well_formed || {
+  echo "error: a local task metadata record has a malformed worktree identity" >&2
+  exit 1
+}
 
 DESTINATION_BRANCH="fm/$DESTINATION"
 [ "$SOURCE_BRANCH" != "$DESTINATION_BRANCH" ] || {
@@ -467,10 +479,15 @@ worktree_is_registered "$PROJECT" "$DESTINATION_WORKTREE" || {
   echo "error: normal allocator returned an unregistered destination worktree" >&2
   exit 1
 }
-worktree_is_task_owned "$DESTINATION_WORKTREE" && {
+if worktree_is_task_owned "$DESTINATION_WORKTREE"; then
   echo "error: normal allocator returned an existing task worktree" >&2
   exit 1
-}
+else
+  case "$?" in
+    1) ;;
+    *) echo "error: could not establish local task worktree ownership" >&2; exit 1 ;;
+  esac
+fi
 if ! fm_pool_worktree_clean "$DESTINATION_WORKTREE" || path_has_git_operation "$DESTINATION_WORKTREE"; then
   echo "error: normal allocator returned an occupied destination worktree" >&2
   exit 1
diff --git a/tests/fm-clean-commit-relaunch.test.sh b/tests/fm-clean-commit-relaunch.test.sh
index 18ef915669..cefba00949 100755
--- a/tests/fm-clean-commit-relaunch.test.sh
+++ b/tests/fm-clean-commit-relaunch.test.sh
@@ -223,12 +223,16 @@ printf 'worktree=%s\n' "$other" > "$home/state/other.meta"
 }
 
 run_owner() {  # <fixture> [source] [destination]
-  local fixture=$1 source=${2:-source} destination=${3:-destination}
+  local fixture=$1 source=${2:-source} destination=${3:-destination} source_branch source_head
+  source_branch=$(git -C "$fixture/source" symbolic-ref --short HEAD)
+  source_head=$(git -C "$fixture/source" rev-parse HEAD)
   PATH="$fixture/fakebin:$PATH" \
     FM_TEST_REAL_GIT="$REAL_GIT" \
     FM_TEST_HOME="$fixture/home" \
     FM_TEST_PROJECT="$fixture/project" \
     FM_TEST_SOURCE_WORKTREE="$fixture/source" \
+    FM_TEST_SOURCE_BRANCH="$source_branch" \
+    FM_TEST_SOURCE_HEAD="$source_head" \
     FM_TEST_TASK_WORKTREE="$fixture/other" \
     FM_TEST_DESTINATION="$fixture/destination" \
     FM_TEST_DESTINATION_ID="$destination" \
@@ -372,10 +376,23 @@ for custody in active parked unreadable; do
   out=$(FM_TEST_CUSTODY="$custody" run_owner "$fixture" 2>&1)
   expect_code 1 $? "custody $custody should refuse"
   assert_refused_before_allocation "$fixture" "$out" "custody $custody"
+  case "$custody" in
+    active|parked) assert_contains "$out" 'active or parked No-Mistakes custody' "$custody custody was not parsed" ;;
+    unreadable) assert_contains "$out" 'custody is unreadable or malformed' "unreadable custody was not parsed" ;;
+  esac
   [ "$(source_snapshot "$fixture")" = "$before" ] || fail "custody $custody mutated source"
 done
 pass "clean relaunch: active, parked, and unreadable No-Mistakes custody refuses"
 
+fixture=$(new_case malformed-other-worktree)
+printf 'worktree=%s\n' "$fixture/destination" >> "$fixture/home/state/other.meta"
+before=$(source_snapshot "$fixture")
+out=$(run_owner "$fixture" 2>&1)
+expect_code 1 $? "malformed foreign worktree metadata should refuse"
+assert_refused_before_allocation "$fixture" "$out" "malformed foreign worktree metadata"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "malformed foreign worktree metadata mutated source"
+pass "clean relaunch: malformed foreign worktree metadata refuses"
+
 # Failure after allocation leaves no source change and cleans only the new
 # destination's branch, endpoint, task data, and leased worktree.
 for failure in allocator checkout launch acknowledgement; do
@@ -443,6 +460,17 @@ assert_present "$fixture/destination" "return failure removed the destination wo
 git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination || fail "return failure removed attached destination branch"
 pass "clean relaunch: failed destination return remains actionable"
 
+fixture=$(new_case published-output-failure)
+before=$(source_snapshot "$fixture")
+run_owner "$fixture" >/dev/full 2>"$fixture/published-output-failure.out"
+status=$?
+expect_code 1 "$status" "published output failure should fail"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "published output failure mutated source"
+assert_absent "$fixture/home/state/destination.meta" "published output failure retained destination metadata"
+assert_absent "$fixture/home/data/destination/relaunch-handoff.json" "published output failure retained destination handoff"
+git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination && fail "published output failure retained destination branch"
+pass "clean relaunch: published output failure cleans destination"
+
 # A concurrent branch creation never becomes this relaunch's cleanup target.
 fixture=$(new_case branch-race)
 before=$(source_snapshot "$fixture")

From 1162237094d635d6ca222c84298f6b555b6036b2 Mon Sep 17 00:00:00 2001
From: Pranay Pratyush <pranay.pratyush@gmail.com>
Date: Mon, 31 Aug 2026 20:38:35 +0530
Subject: [PATCH 07/16] no-mistakes(review): Protect relaunch destination
 publication races

---
 bin/fm-clean-commit-relaunch-launch-lib.sh | 26 +++++++++--
 bin/fm-clean-commit-relaunch.sh            | 27 ++++++++++--
 tests/fm-clean-commit-relaunch.test.sh     | 51 ++++++++++++++++++++++
 3 files changed, 97 insertions(+), 7 deletions(-)

diff --git a/bin/fm-clean-commit-relaunch-launch-lib.sh b/bin/fm-clean-commit-relaunch-launch-lib.sh
index d601f365bb..91eea7b8cd 100755
--- a/bin/fm-clean-commit-relaunch-launch-lib.sh
+++ b/bin/fm-clean-commit-relaunch-launch-lib.sh
@@ -14,11 +14,17 @@ FM_CLEAN_RELAUNCH_LAUNCH_TARGET=
 FM_CLEAN_RELAUNCH_LAUNCH_STATE=
 FM_CLEAN_RELAUNCH_LAUNCH_WINDOW_ID=
 FM_CLEAN_RELAUNCH_LAUNCH_CREATE_INTERRUPTED=0
+FM_CLEAN_RELAUNCH_LAUNCH_METADATA_OWNED=0
+FM_CLEAN_RELAUNCH_LAUNCH_METADATA_INTERRUPTED=0
 
 fm_clean_relaunch_defer_window_creation_signal() {
   FM_CLEAN_RELAUNCH_LAUNCH_CREATE_INTERRUPTED=1
 }
 
+fm_clean_relaunch_defer_metadata_signal() {
+  FM_CLEAN_RELAUNCH_LAUNCH_METADATA_INTERRUPTED=1
+}
+
 fm_clean_relaunch_shell_quote() {  # <value>
   local value=$1
   printf "'%s'" "${value//\'/\'\\\'\'}"
@@ -37,7 +43,8 @@ fm_clean_relaunch_launch_cleanup() {  # <destination-id>
   [ -n "$state" ] || return 0
   rm -rf -- "${TMPDIR:-/tmp}/fm-$id"
   rm -rf -- "$state/$id.inbox"
-  rm -f -- "$state/$id.meta" "$state/$id.status" "$state/$id.turn-ended" \
+  [ "$FM_CLEAN_RELAUNCH_LAUNCH_METADATA_OWNED" -eq 0 ] || rm -f -- "$state/$id.meta"
+  rm -f -- "$state/$id.status" "$state/$id.turn-ended" \
     "$state/$id.pi-ext.ts" "$state/$id.omp-ext.ts" "$state/$id.omp-ready" \
     "$state/$id.omp-started" "$state/$id.omp-doorbell-ready" "$state/$id.busy-state" \
     "$state/$id.omp-doorbell-ready.requests" "$state/$id.busy-gen" \
@@ -73,7 +80,7 @@ fm_clean_relaunch_wait_for_ack() {  # <state> <id> <record>
 fm_clean_relaunch_launch_allocated() {
   local id=$1 project=$2 worktree=$3 brief=$4 harness=$5 backend=$6 mode=$7 yolo=$8 model=$9 effort=${10}
   local state=${STATE:?STATE must be set by the relaunch owner}
-  local session window target window_id task_tmp meta_tmp launch record handoff
+  local session window target window_id window_count task_tmp meta_tmp launch record handoff
 
   [ "$harness:$backend" = codex:tmux ] || {
     echo "error: allocated relaunch launch supports only codex/tmux" >&2
@@ -109,6 +116,12 @@ fm_clean_relaunch_launch_allocated() {
   fi
   trap interrupted HUP INT TERM
   [ "$FM_CLEAN_RELAUNCH_LAUNCH_CREATE_INTERRUPTED" -eq 0 ] || return 1
+  window_count=$(tmux list-windows -t "$session" -F '#{window_name}' 2>/dev/null | grep -Fxc "$window" || true)
+  [ "$window_count" -eq 1 ] || {
+    echo "error: destination tmux endpoint is ambiguous after creation" >&2
+    return 1
+  }
+  target="$FM_CLEAN_RELAUNCH_LAUNCH_WINDOW_ID"
 
   task_tmp="${TMPDIR:-/tmp}/fm-$id"
   if [ -L "$task_tmp" ]; then
@@ -134,10 +147,17 @@ fm_clean_relaunch_launch_allocated() {
     rm -f -- "$meta_tmp"
     return 1
   fi
-  if ! mv -f -- "$meta_tmp" "$state/$id.meta"; then
+  trap fm_clean_relaunch_defer_metadata_signal HUP INT TERM
+  if ln "$meta_tmp" "$state/$id.meta"; then
+    FM_CLEAN_RELAUNCH_LAUNCH_METADATA_OWNED=1
     rm -f -- "$meta_tmp"
+  else
+    rm -f -- "$meta_tmp"
+    trap interrupted HUP INT TERM
     return 1
   fi
+  trap interrupted HUP INT TERM
+  [ "$FM_CLEAN_RELAUNCH_LAUNCH_METADATA_INTERRUPTED" -eq 0 ] || return 1
 
   fm_backend_tmux_send_text_line "$target" "export GOTMPDIR=$(fm_clean_relaunch_shell_quote "$task_tmp/gotmp")" || return 1
   launch="codex"
diff --git a/bin/fm-clean-commit-relaunch.sh b/bin/fm-clean-commit-relaunch.sh
index fdc7c29a6b..752268373e 100755
--- a/bin/fm-clean-commit-relaunch.sh
+++ b/bin/fm-clean-commit-relaunch.sh
@@ -118,7 +118,8 @@ worktree_is_registered() {  # <repository> <worktree>
 worktree_is_task_owned() {  # <worktree>
   local worktree=$1 meta recorded
   for meta in "$STATE"/*.meta; do
-    [ -f "$meta" ] && [ ! -L "$meta" ] && [ -r "$meta" ] || continue
+    [ -e "$meta" ] || [ -L "$meta" ] || continue
+    [ -f "$meta" ] && [ ! -L "$meta" ] && [ -r "$meta" ] || return 2
     recorded=$(meta_exact "$meta" worktree 2>/dev/null) || return 2
     recorded=$(resolve_dir recorded-task-worktree "$recorded" 2>/dev/null) || return 2
     [ "$recorded" != "$worktree" ] || return 0
@@ -129,7 +130,8 @@ worktree_is_task_owned() {  # <worktree>
 task_worktrees_are_well_formed() {
   local meta recorded
   for meta in "$STATE"/*.meta; do
-    [ -f "$meta" ] && [ ! -L "$meta" ] && [ -r "$meta" ] || continue
+    [ -e "$meta" ] || [ -L "$meta" ] || continue
+    [ -f "$meta" ] && [ ! -L "$meta" ] && [ -r "$meta" ] || return 1
     recorded=$(meta_exact "$meta" worktree 2>/dev/null) || return 1
     resolve_dir recorded-task-worktree "$recorded" >/dev/null 2>&1 || return 1
   done
@@ -239,11 +241,17 @@ DESTINATION_BRANCH=
 DESTINATION_BRANCH_CREATED=0
 DESTINATION_PUBLISHED=0
 DESTINATION_CHECKOUT_INTERRUPTED=0
+DESTINATION_HANDOFF_OWNED=0
+DESTINATION_HANDOFF_INTERRUPTED=0
 
 defer_destination_checkout_signal() {
   DESTINATION_CHECKOUT_INTERRUPTED=1
 }
 
+defer_destination_handoff_signal() {
+  DESTINATION_HANDOFF_INTERRUPTED=1
+}
+
 cleanup_destination() {
   [ "$DESTINATION_WORKTREE_OWNED" -eq 1 ] || return 0
   fm_clean_relaunch_launch_cleanup "$DESTINATION" || true
@@ -257,7 +265,7 @@ cleanup_destination() {
       return 1
     fi
   fi
-  rm -f -- "$DESTINATION_HANDOFF"
+  [ "$DESTINATION_HANDOFF_OWNED" -eq 0 ] || rm -f -- "$DESTINATION_HANDOFF"
 }
 
 cleanup() {
@@ -529,7 +537,18 @@ jq -n \
   --arg pr "$PR" \
   '{schema:$schema,source:$source,destination:$destination,repository_identity:$repository_identity,source_commit:$source_commit,source_branch:$source_branch,destination_branch:$destination_branch,delivery:{mode:$mode,yolo:$yolo},source_brief_identity:$source_brief_identity,destination_brief_identity:$destination_brief_identity,no_mistakes_custody:{state:$custody,next_action:"proceed"}} + (if $pr == "" then {} else {pr:$pr} end)' \
   > "$HANDOFF_TMP" || exit 1
-mv -f -- "$HANDOFF_TMP" "$DESTINATION_HANDOFF"
+trap defer_destination_handoff_signal HUP INT TERM
+if ln "$HANDOFF_TMP" "$DESTINATION_HANDOFF"; then
+  DESTINATION_HANDOFF_OWNED=1
+  rm -f -- "$HANDOFF_TMP"
+else
+  rm -f -- "$HANDOFF_TMP"
+  trap interrupted HUP INT TERM
+  echo "error: destination task $DESTINATION already has a durable handoff" >&2
+  exit 1
+fi
+trap interrupted HUP INT TERM
+[ "$DESTINATION_HANDOFF_INTERRUPTED" -eq 0 ] || exit 1
 
 fm_clean_relaunch_launch_allocated \
   "$DESTINATION" "$PROJECT" "$DESTINATION_WORKTREE" "$DESTINATION_BRIEF" \
diff --git a/tests/fm-clean-commit-relaunch.test.sh b/tests/fm-clean-commit-relaunch.test.sh
index cefba00949..ac6fb1667d 100755
--- a/tests/fm-clean-commit-relaunch.test.sh
+++ b/tests/fm-clean-commit-relaunch.test.sh
@@ -11,6 +11,7 @@ set -u
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 REAL_GIT=$(command -v git)
+REAL_LN=$(command -v ln)
 
 TMP_ROOT=$(fm_test_tmproot fm-clean-commit-relaunch)
 fm_git_identity fmtest fmtest@example.invalid
@@ -99,6 +100,7 @@ case "$command" in
       printf 'fm-%s\n' "$FM_TEST_DESTINATION_ID" >> "$FM_TEST_WINDOWS"
       exit 1
     fi
+    [ "${FM_TEST_DUPLICATE_WINDOW_RACE:-0}" != 1 ] || printf 'fm-%s\n' "$FM_TEST_DESTINATION_ID" >> "$FM_TEST_WINDOWS"
     [ -z "${FM_TEST_LAUNCH_DELAY:-}" ] || sleep "$FM_TEST_LAUNCH_DELAY"
     [ "${FM_TEST_LAUNCH_FAIL:-0}" != 1 ] || exit 1
     printf 'fm-%s\n' "$FM_TEST_DESTINATION_ID" >> "$FM_TEST_WINDOWS"
@@ -149,6 +151,20 @@ if [ "$1" = -C ] && [ "${3:-}" = checkout ] && [ "${4:-}" = -b ]; then
   [ "${FM_TEST_CHECKOUT_FAIL:-0}" != 1 ] || exit 1
 fi
 exec "${FM_TEST_REAL_GIT}" "$@"
+SH
+  cat > "$fakebin/ln" <<'SH'
+#!/usr/bin/env bash
+set -u
+destination=${!#}
+case "$destination" in
+  */relaunch-handoff.json)
+    [ "${FM_TEST_HANDOFF_RACE:-0}" != 1 ] || printf 'foreign handoff\n' > "$destination"
+    ;;
+  */destination.meta)
+    [ "${FM_TEST_META_RACE:-0}" != 1 ] || printf 'foreign metadata\n' > "$destination"
+    ;;
+esac
+exec "$FM_TEST_REAL_LN" "$@"
 SH
   chmod +x "$fakebin"/*
 }
@@ -228,6 +244,7 @@ run_owner() {  # <fixture> [source] [destination]
   source_head=$(git -C "$fixture/source" rev-parse HEAD)
   PATH="$fixture/fakebin:$PATH" \
     FM_TEST_REAL_GIT="$REAL_GIT" \
+    FM_TEST_REAL_LN="$REAL_LN" \
     FM_TEST_HOME="$fixture/home" \
     FM_TEST_PROJECT="$fixture/project" \
     FM_TEST_SOURCE_WORKTREE="$fixture/source" \
@@ -393,6 +410,16 @@ assert_refused_before_allocation "$fixture" "$out" "malformed foreign worktree m
 [ "$(source_snapshot "$fixture")" = "$before" ] || fail "malformed foreign worktree metadata mutated source"
 pass "clean relaunch: malformed foreign worktree metadata refuses"
 
+fixture=$(new_case symlinked-other-worktree)
+rm -f -- "$fixture/home/state/other.meta"
+ln -s "$fixture/other" "$fixture/home/state/other.meta"
+before=$(source_snapshot "$fixture")
+out=$(run_owner "$fixture" 2>&1)
+expect_code 1 $? "symlinked foreign worktree metadata should refuse"
+assert_refused_before_allocation "$fixture" "$out" "symlinked foreign worktree metadata"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "symlinked foreign worktree metadata mutated source"
+pass "clean relaunch: symlinked foreign worktree metadata refuses"
+
 # Failure after allocation leaves no source change and cleans only the new
 # destination's branch, endpoint, task data, and leased worktree.
 for failure in allocator checkout launch acknowledgement; do
@@ -460,6 +487,22 @@ assert_present "$fixture/destination" "return failure removed the destination wo
 git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination || fail "return failure removed attached destination branch"
 pass "clean relaunch: failed destination return remains actionable"
 
+fixture=$(new_case handoff-race)
+before=$(source_snapshot "$fixture")
+out=$(FM_TEST_HANDOFF_RACE=1 run_owner "$fixture" 2>&1)
+expect_code 1 $? "concurrent handoff creation should fail"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "concurrent handoff creation mutated source"
+[ "$(cat "$fixture/home/data/destination/relaunch-handoff.json")" = 'foreign handoff' ] || fail "concurrent handoff was overwritten or removed"
+pass "clean relaunch: concurrent handoff remains foreign"
+
+fixture=$(new_case metadata-race)
+before=$(source_snapshot "$fixture")
+out=$(FM_TEST_META_RACE=1 run_owner "$fixture" 2>&1)
+expect_code 1 $? "concurrent metadata creation should fail"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "concurrent metadata creation mutated source"
+[ "$(cat "$fixture/home/state/destination.meta")" = 'foreign metadata' ] || fail "concurrent metadata was overwritten or removed"
+pass "clean relaunch: concurrent metadata remains foreign"
+
 fixture=$(new_case published-output-failure)
 before=$(source_snapshot "$fixture")
 run_owner "$fixture" >/dev/full 2>"$fixture/published-output-failure.out"
@@ -490,6 +533,14 @@ expect_code 1 $? "concurrent window creation should fail"
 assert_not_contains 'kill-window' "$(cat "$fixture/tmux.log")" "concurrent window creation was cleaned"
 pass "clean relaunch: concurrent destination endpoint remains foreign"
 
+fixture=$(new_case duplicate-window-race)
+before=$(source_snapshot "$fixture")
+out=$(FM_TEST_DUPLICATE_WINDOW_RACE=1 run_owner "$fixture" 2>&1)
+expect_code 1 $? "duplicate destination window should fail"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "duplicate destination window mutated source"
+assert_not_contains 'send-keys' "$(cat "$fixture/tmux.log")" "duplicate destination window received a launch or inbox command"
+pass "clean relaunch: duplicate destination endpoint refuses after creation"
+
 # An interrupt after handoff publication exits through destination-only cleanup.
 fixture=$(new_case interrupted-publication)
 before=$(source_snapshot "$fixture")

From 60e60af745c566ae855780975adf16bf7a718877 Mon Sep 17 00:00:00 2001
From: Pranay Pratyush <pranay.pratyush@gmail.com>
Date: Mon, 31 Aug 2026 20:46:40 +0530
Subject: [PATCH 08/16] no-mistakes(review): Harden relaunch allocation and
 state ownership

---
 bin/fm-clean-commit-relaunch-launch-lib.sh | 26 +++++++++++++---------
 bin/fm-clean-commit-relaunch.sh            | 11 ++++++++-
 tests/fm-clean-commit-relaunch.test.sh     |  8 +++----
 3 files changed, 29 insertions(+), 16 deletions(-)

diff --git a/bin/fm-clean-commit-relaunch-launch-lib.sh b/bin/fm-clean-commit-relaunch-launch-lib.sh
index 91eea7b8cd..f9e55fc004 100755
--- a/bin/fm-clean-commit-relaunch-launch-lib.sh
+++ b/bin/fm-clean-commit-relaunch-launch-lib.sh
@@ -16,6 +16,8 @@ FM_CLEAN_RELAUNCH_LAUNCH_WINDOW_ID=
 FM_CLEAN_RELAUNCH_LAUNCH_CREATE_INTERRUPTED=0
 FM_CLEAN_RELAUNCH_LAUNCH_METADATA_OWNED=0
 FM_CLEAN_RELAUNCH_LAUNCH_METADATA_INTERRUPTED=0
+FM_CLEAN_RELAUNCH_LAUNCH_TEMP_OWNED=0
+FM_CLEAN_RELAUNCH_LAUNCH_INBOX_OWNED=0
 
 fm_clean_relaunch_defer_window_creation_signal() {
   FM_CLEAN_RELAUNCH_LAUNCH_CREATE_INTERRUPTED=1
@@ -41,15 +43,9 @@ fm_clean_relaunch_launch_cleanup() {  # <destination-id>
   local id=$1 state=${FM_CLEAN_RELAUNCH_LAUNCH_STATE:-} window_id=${FM_CLEAN_RELAUNCH_LAUNCH_WINDOW_ID:-}
   [ -n "$window_id" ] && fm_backend_kill tmux "$window_id" >/dev/null 2>&1 || true
   [ -n "$state" ] || return 0
-  rm -rf -- "${TMPDIR:-/tmp}/fm-$id"
-  rm -rf -- "$state/$id.inbox"
+  [ "$FM_CLEAN_RELAUNCH_LAUNCH_TEMP_OWNED" -eq 0 ] || rm -rf -- "${TMPDIR:-/tmp}/fm-$id"
+  [ "$FM_CLEAN_RELAUNCH_LAUNCH_INBOX_OWNED" -eq 0 ] || rm -rf -- "$state/$id.inbox"
   [ "$FM_CLEAN_RELAUNCH_LAUNCH_METADATA_OWNED" -eq 0 ] || rm -f -- "$state/$id.meta"
-  rm -f -- "$state/$id.status" "$state/$id.turn-ended" \
-    "$state/$id.pi-ext.ts" "$state/$id.omp-ext.ts" "$state/$id.omp-ready" \
-    "$state/$id.omp-started" "$state/$id.omp-doorbell-ready" "$state/$id.busy-state" \
-    "$state/$id.omp-doorbell-ready.requests" "$state/$id.busy-gen" \
-    "$state/$id.grok-turnend-token" "$state/$id.kimi-turnend-token" \
-    "$state/$id.hermes-turnend-token" "$state/$id.hermes-session" "$state/$id.hermes-started"
 }
 
 fm_clean_relaunch_wait_for_ack() {  # <state> <id> <record>
@@ -124,11 +120,19 @@ fm_clean_relaunch_launch_allocated() {
   target="$FM_CLEAN_RELAUNCH_LAUNCH_WINDOW_ID"
 
   task_tmp="${TMPDIR:-/tmp}/fm-$id"
-  if [ -L "$task_tmp" ]; then
-    echo "error: destination task temp root must not be a symlink" >&2
+  if ! mkdir "$task_tmp"; then
+    echo "error: destination task temp root is already occupied" >&2
     return 1
   fi
-  mkdir -p "$task_tmp/gotmp" || return 1
+  FM_CLEAN_RELAUNCH_LAUNCH_TEMP_OWNED=1
+  mkdir "$task_tmp/gotmp" || return 1
+
+  if ! mkdir "$state/$id.inbox"; then
+    echo "error: destination inbox is already occupied" >&2
+    return 1
+  fi
+  FM_CLEAN_RELAUNCH_LAUNCH_INBOX_OWNED=1
+  mkdir "$state/$id.inbox/handled" || return 1
 
   meta_tmp=$(mktemp "$state/.${id}.meta.XXXXXX") || return 1
   if ! {
diff --git a/bin/fm-clean-commit-relaunch.sh b/bin/fm-clean-commit-relaunch.sh
index 752268373e..817996eb3f 100755
--- a/bin/fm-clean-commit-relaunch.sh
+++ b/bin/fm-clean-commit-relaunch.sh
@@ -243,6 +243,7 @@ DESTINATION_PUBLISHED=0
 DESTINATION_CHECKOUT_INTERRUPTED=0
 DESTINATION_HANDOFF_OWNED=0
 DESTINATION_HANDOFF_INTERRUPTED=0
+DESTINATION_ALLOCATION_INTERRUPTED=0
 
 defer_destination_checkout_signal() {
   DESTINATION_CHECKOUT_INTERRUPTED=1
@@ -252,6 +253,10 @@ defer_destination_handoff_signal() {
   DESTINATION_HANDOFF_INTERRUPTED=1
 }
 
+defer_destination_allocation_signal() {
+  DESTINATION_ALLOCATION_INTERRUPTED=1
+}
+
 cleanup_destination() {
   [ "$DESTINATION_WORKTREE_OWNED" -eq 1 ] || return 0
   fm_clean_relaunch_launch_cleanup "$DESTINATION" || true
@@ -455,12 +460,13 @@ git -C "$PROJECT" show-ref --verify --quiet "refs/heads/$DESTINATION_BRANCH" &&
   exit 1
 }
 
+trap defer_destination_allocation_signal HUP INT TERM
 ALLOCATED_WORKTREE=$(cd "$PROJECT" && "$SCRIPT_DIR/fm-treehouse-get.sh" --lease --lease-holder "fm-$DESTINATION") || {
+  trap interrupted HUP INT TERM
   echo "error: normal allocator did not supply a destination worktree" >&2
   exit 1
 }
 DESTINATION_WORKTREE=$ALLOCATED_WORKTREE
-DESTINATION_WORKTREE_OWNED=1
 ALLOCATED_WORKTREE=$(resolve_dir destination-worktree "$ALLOCATED_WORKTREE") || exit 1
 DESTINATION_WORKTREE=$ALLOCATED_WORKTREE
 [ "$ALLOCATED_WORKTREE" != "$SOURCE_WORKTREE" ] || {
@@ -500,6 +506,9 @@ if ! fm_pool_worktree_clean "$DESTINATION_WORKTREE" || path_has_git_operation "$
   echo "error: normal allocator returned an occupied destination worktree" >&2
   exit 1
 fi
+DESTINATION_WORKTREE_OWNED=1
+trap interrupted HUP INT TERM
+[ "$DESTINATION_ALLOCATION_INTERRUPTED" -eq 0 ] || exit 1
 trap defer_destination_checkout_signal HUP INT TERM
 if git -C "$DESTINATION_WORKTREE" checkout -b "$DESTINATION_BRANCH" "$SOURCE_COMMIT" >/dev/null; then
   DESTINATION_BRANCH_CREATED=1
diff --git a/tests/fm-clean-commit-relaunch.test.sh b/tests/fm-clean-commit-relaunch.test.sh
index ac6fb1667d..1e88c86f36 100755
--- a/tests/fm-clean-commit-relaunch.test.sh
+++ b/tests/fm-clean-commit-relaunch.test.sh
@@ -460,7 +460,7 @@ expect_code 1 $? "source-reusing allocator should refuse"
 assert_contains "$out" 'reused the source worktree' "source-reusing allocator did not explain its refusal"
 [ "$(source_snapshot "$fixture")" = "$before" ] || fail "source-reusing allocator cleaned or mutated source"
 [ -d "$fixture/source" ] || fail "source-reusing allocator removed the source worktree"
-assert_not_contains '--force' "$(cat "$fixture/allocator.log")" "source-reusing allocator used unsafe cleanup"
+assert_not_contains "$(cat "$fixture/allocator.log")" '--force' "source-reusing allocator used unsafe cleanup"
 pass "clean relaunch: source-reusing allocator cannot clean the source"
 
 # Only an unclaimed pool worktree may become cleanup-owned destination state.
@@ -471,7 +471,7 @@ for allocator in project task; do
   expect_code 1 $? "$allocator-reusing allocator should refuse"
   assert_contains "$out" 'error:' "$allocator-reusing allocator did not explain its refusal"
   [ "$(source_snapshot "$fixture")" = "$before" ] || fail "$allocator-reusing allocator mutated source"
-  assert_not_contains '--force' "$(cat "$fixture/allocator.log")" "$allocator-reusing allocator used unsafe cleanup"
+  assert_not_contains "$(cat "$fixture/allocator.log")" '--force' "$allocator-reusing allocator used unsafe cleanup"
   git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination && fail "$allocator-reusing allocator created a destination branch"
 done
 pass "clean relaunch: allocator must not reuse existing project worktrees"
@@ -530,7 +530,7 @@ out=$(FM_TEST_FOREIGN_WINDOW_RACE=1 run_owner "$fixture" 2>&1)
 expect_code 1 $? "concurrent window creation should fail"
 [ "$(source_snapshot "$fixture")" = "$before" ] || fail "concurrent window creation mutated source"
 [ "$(cat "$fixture/windows")" = fm-destination ] || fail "concurrent window creation was removed"
-assert_not_contains 'kill-window' "$(cat "$fixture/tmux.log")" "concurrent window creation was cleaned"
+assert_not_contains "$(cat "$fixture/tmux.log")" 'kill-window' "concurrent window creation was cleaned"
 pass "clean relaunch: concurrent destination endpoint remains foreign"
 
 fixture=$(new_case duplicate-window-race)
@@ -538,7 +538,7 @@ before=$(source_snapshot "$fixture")
 out=$(FM_TEST_DUPLICATE_WINDOW_RACE=1 run_owner "$fixture" 2>&1)
 expect_code 1 $? "duplicate destination window should fail"
 [ "$(source_snapshot "$fixture")" = "$before" ] || fail "duplicate destination window mutated source"
-assert_not_contains 'send-keys' "$(cat "$fixture/tmux.log")" "duplicate destination window received a launch or inbox command"
+assert_not_contains "$(cat "$fixture/tmux.log")" 'send-keys' "duplicate destination window received a launch or inbox command"
 pass "clean relaunch: duplicate destination endpoint refuses after creation"
 
 # An interrupt after handoff publication exits through destination-only cleanup.

From 87abbf7dc08c14f053dc4aee8ab0726fa50e4cde Mon Sep 17 00:00:00 2001
From: Pranay Pratyush <pranay.pratyush@gmail.com>
Date: Mon, 31 Aug 2026 20:53:08 +0530
Subject: [PATCH 09/16] no-mistakes(review): Harden relaunch endpoint and state
 claims

---
 bin/fm-clean-commit-relaunch-launch-lib.sh | 40 +++++++++++++++++-----
 1 file changed, 31 insertions(+), 9 deletions(-)

diff --git a/bin/fm-clean-commit-relaunch-launch-lib.sh b/bin/fm-clean-commit-relaunch-launch-lib.sh
index f9e55fc004..de8da4ebe2 100755
--- a/bin/fm-clean-commit-relaunch-launch-lib.sh
+++ b/bin/fm-clean-commit-relaunch-launch-lib.sh
@@ -18,6 +18,8 @@ FM_CLEAN_RELAUNCH_LAUNCH_METADATA_OWNED=0
 FM_CLEAN_RELAUNCH_LAUNCH_METADATA_INTERRUPTED=0
 FM_CLEAN_RELAUNCH_LAUNCH_TEMP_OWNED=0
 FM_CLEAN_RELAUNCH_LAUNCH_INBOX_OWNED=0
+FM_CLEAN_RELAUNCH_LAUNCH_STATE_CLAIM_INTERRUPTED=0
+FM_CLEAN_RELAUNCH_LAUNCH_METADATA_TMP=
 
 fm_clean_relaunch_defer_window_creation_signal() {
   FM_CLEAN_RELAUNCH_LAUNCH_CREATE_INTERRUPTED=1
@@ -27,6 +29,10 @@ fm_clean_relaunch_defer_metadata_signal() {
   FM_CLEAN_RELAUNCH_LAUNCH_METADATA_INTERRUPTED=1
 }
 
+fm_clean_relaunch_defer_state_claim_signal() {
+  FM_CLEAN_RELAUNCH_LAUNCH_STATE_CLAIM_INTERRUPTED=1
+}
+
 fm_clean_relaunch_shell_quote() {  # <value>
   local value=$1
   printf "'%s'" "${value//\'/\'\\\'\'}"
@@ -46,6 +52,7 @@ fm_clean_relaunch_launch_cleanup() {  # <destination-id>
   [ "$FM_CLEAN_RELAUNCH_LAUNCH_TEMP_OWNED" -eq 0 ] || rm -rf -- "${TMPDIR:-/tmp}/fm-$id"
   [ "$FM_CLEAN_RELAUNCH_LAUNCH_INBOX_OWNED" -eq 0 ] || rm -rf -- "$state/$id.inbox"
   [ "$FM_CLEAN_RELAUNCH_LAUNCH_METADATA_OWNED" -eq 0 ] || rm -f -- "$state/$id.meta"
+  [ -z "$FM_CLEAN_RELAUNCH_LAUNCH_METADATA_TMP" ] || rm -f -- "$FM_CLEAN_RELAUNCH_LAUNCH_METADATA_TMP"
 }
 
 fm_clean_relaunch_wait_for_ack() {  # <state> <id> <record>
@@ -76,7 +83,7 @@ fm_clean_relaunch_wait_for_ack() {  # <state> <id> <record>
 fm_clean_relaunch_launch_allocated() {
   local id=$1 project=$2 worktree=$3 brief=$4 harness=$5 backend=$6 mode=$7 yolo=$8 model=$9 effort=${10}
   local state=${STATE:?STATE must be set by the relaunch owner}
-  local session window target window_id window_count task_tmp meta_tmp launch record handoff
+  local session window canonical_target target window_id window_count task_tmp meta_tmp launch record handoff late_artifact
 
   [ "$harness:$backend" = codex:tmux ] || {
     echo "error: allocated relaunch launch supports only codex/tmux" >&2
@@ -94,14 +101,15 @@ fm_clean_relaunch_launch_allocated() {
     echo "error: allocated destination is not a worktree root" >&2
     return 1
   }
-  fm_clean_relaunch_destination_meta_absent "$state" "$id" || {
+  late_artifact=$(destination_artifact_exists "$id" || true)
+  if [ -n "$late_artifact" ] && { [ "$late_artifact" != "${DATA:?DATA must be set by the relaunch owner}/$id/relaunch-handoff.json" ] || [ "${DESTINATION_HANDOFF_OWNED:-0}" -ne 1 ]; }; then
     echo "error: destination state is already occupied" >&2
     return 1
-  }
+  fi
   fm_backend_source tmux || return 1
   session=$(fm_backend_tmux_container_ensure) || return 1
   window="fm-$id"
-  target="$session:$window"
+  canonical_target="$session:$window"
   FM_CLEAN_RELAUNCH_LAUNCH_STATE=$state
   trap fm_clean_relaunch_defer_window_creation_signal HUP INT TERM
   if window_id=$(fm_backend_tmux_create_task "$session" "$window" "$worktree"); then
@@ -120,23 +128,35 @@ fm_clean_relaunch_launch_allocated() {
   target="$FM_CLEAN_RELAUNCH_LAUNCH_WINDOW_ID"
 
   task_tmp="${TMPDIR:-/tmp}/fm-$id"
-  if ! mkdir "$task_tmp"; then
+  trap fm_clean_relaunch_defer_state_claim_signal HUP INT TERM
+  if mkdir "$task_tmp"; then
+    FM_CLEAN_RELAUNCH_LAUNCH_TEMP_OWNED=1
+  else
+    trap interrupted HUP INT TERM
     echo "error: destination task temp root is already occupied" >&2
     return 1
   fi
-  FM_CLEAN_RELAUNCH_LAUNCH_TEMP_OWNED=1
+  trap interrupted HUP INT TERM
+  [ "$FM_CLEAN_RELAUNCH_LAUNCH_STATE_CLAIM_INTERRUPTED" -eq 0 ] || return 1
   mkdir "$task_tmp/gotmp" || return 1
 
-  if ! mkdir "$state/$id.inbox"; then
+  FM_CLEAN_RELAUNCH_LAUNCH_STATE_CLAIM_INTERRUPTED=0
+  trap fm_clean_relaunch_defer_state_claim_signal HUP INT TERM
+  if mkdir "$state/$id.inbox"; then
+    FM_CLEAN_RELAUNCH_LAUNCH_INBOX_OWNED=1
+  else
+    trap interrupted HUP INT TERM
     echo "error: destination inbox is already occupied" >&2
     return 1
   fi
-  FM_CLEAN_RELAUNCH_LAUNCH_INBOX_OWNED=1
+  trap interrupted HUP INT TERM
+  [ "$FM_CLEAN_RELAUNCH_LAUNCH_STATE_CLAIM_INTERRUPTED" -eq 0 ] || return 1
   mkdir "$state/$id.inbox/handled" || return 1
 
   meta_tmp=$(mktemp "$state/.${id}.meta.XXXXXX") || return 1
+  FM_CLEAN_RELAUNCH_LAUNCH_METADATA_TMP=$meta_tmp
   if ! {
-    printf 'window=%s\n' "$target"
+    printf 'window=%s\n' "$canonical_target"
     printf 'endpoint_task_id=%s\n' "$id"
     printf 'worktree=%s\n' "$worktree"
     printf 'project=%s\n' "$project"
@@ -155,8 +175,10 @@ fm_clean_relaunch_launch_allocated() {
   if ln "$meta_tmp" "$state/$id.meta"; then
     FM_CLEAN_RELAUNCH_LAUNCH_METADATA_OWNED=1
     rm -f -- "$meta_tmp"
+    FM_CLEAN_RELAUNCH_LAUNCH_METADATA_TMP=
   else
     rm -f -- "$meta_tmp"
+    FM_CLEAN_RELAUNCH_LAUNCH_METADATA_TMP=
     trap interrupted HUP INT TERM
     return 1
   fi

From 238be56b22c38d301b6400d9e04ffc45a9a8d19d Mon Sep 17 00:00:00 2001
From: Pranay Pratyush <pranay.pratyush@gmail.com>
Date: Mon, 31 Aug 2026 20:58:15 +0530
Subject: [PATCH 10/16] no-mistakes(review): Track relaunch staging cleanup

---
 bin/fm-clean-commit-relaunch-launch-lib.sh | 13 ++++++++++---
 bin/fm-clean-commit-relaunch.sh            | 13 +++++++++++--
 tests/fm-clean-commit-relaunch.test.sh     | 18 ++++++++++++++++++
 3 files changed, 39 insertions(+), 5 deletions(-)

diff --git a/bin/fm-clean-commit-relaunch-launch-lib.sh b/bin/fm-clean-commit-relaunch-launch-lib.sh
index de8da4ebe2..1cd2d2a73b 100755
--- a/bin/fm-clean-commit-relaunch-launch-lib.sh
+++ b/bin/fm-clean-commit-relaunch-launch-lib.sh
@@ -153,8 +153,14 @@ fm_clean_relaunch_launch_allocated() {
   [ "$FM_CLEAN_RELAUNCH_LAUNCH_STATE_CLAIM_INTERRUPTED" -eq 0 ] || return 1
   mkdir "$state/$id.inbox/handled" || return 1
 
-  meta_tmp=$(mktemp "$state/.${id}.meta.XXXXXX") || return 1
-  FM_CLEAN_RELAUNCH_LAUNCH_METADATA_TMP=$meta_tmp
+  FM_CLEAN_RELAUNCH_LAUNCH_METADATA_INTERRUPTED=0
+  trap fm_clean_relaunch_defer_metadata_signal HUP INT TERM
+  if meta_tmp=$(mktemp "$state/.${id}.meta.XXXXXX"); then
+    FM_CLEAN_RELAUNCH_LAUNCH_METADATA_TMP=$meta_tmp
+  else
+    trap interrupted HUP INT TERM
+    return 1
+  fi
   if ! {
     printf 'window=%s\n' "$canonical_target"
     printf 'endpoint_task_id=%s\n' "$id"
@@ -169,9 +175,10 @@ fm_clean_relaunch_launch_allocated() {
     printf 'effort=%s\n' "$effort"
   } > "$meta_tmp"; then
     rm -f -- "$meta_tmp"
+    FM_CLEAN_RELAUNCH_LAUNCH_METADATA_TMP=
+    trap interrupted HUP INT TERM
     return 1
   fi
-  trap fm_clean_relaunch_defer_metadata_signal HUP INT TERM
   if ln "$meta_tmp" "$state/$id.meta"; then
     FM_CLEAN_RELAUNCH_LAUNCH_METADATA_OWNED=1
     rm -f -- "$meta_tmp"
diff --git a/bin/fm-clean-commit-relaunch.sh b/bin/fm-clean-commit-relaunch.sh
index 817996eb3f..e5068604b7 100755
--- a/bin/fm-clean-commit-relaunch.sh
+++ b/bin/fm-clean-commit-relaunch.sh
@@ -243,6 +243,7 @@ DESTINATION_PUBLISHED=0
 DESTINATION_CHECKOUT_INTERRUPTED=0
 DESTINATION_HANDOFF_OWNED=0
 DESTINATION_HANDOFF_INTERRUPTED=0
+DESTINATION_HANDOFF_TMP=
 DESTINATION_ALLOCATION_INTERRUPTED=0
 
 defer_destination_checkout_signal() {
@@ -275,6 +276,7 @@ cleanup_destination() {
 
 cleanup() {
   status=$?
+  [ -z "$DESTINATION_HANDOFF_TMP" ] || rm -f -- "$DESTINATION_HANDOFF_TMP"
   if [ "$status" -ne 0 ]; then
     cleanup_destination || echo "error: destination cleanup is incomplete" >&2
   fi
@@ -529,7 +531,13 @@ DESTINATION_ATTACHED_BRANCH=$(git -C "$DESTINATION_WORKTREE" symbolic-ref --quie
 REPOSITORY_IDENTITY=$(sha256_text "$PROJECT_COMMON")
 SOURCE_BRIEF_IDENTITY=$(sha256_file "$SOURCE_BRIEF") || exit 1
 DESTINATION_BRIEF_IDENTITY=$(sha256_file "$DESTINATION_BRIEF") || exit 1
-HANDOFF_TMP=$(mktemp "$DATA/$DESTINATION/.relaunch-handoff.XXXXXX") || exit 1
+trap defer_destination_handoff_signal HUP INT TERM
+if HANDOFF_TMP=$(mktemp "$DATA/$DESTINATION/.relaunch-handoff.XXXXXX"); then
+  DESTINATION_HANDOFF_TMP=$HANDOFF_TMP
+else
+  trap interrupted HUP INT TERM
+  exit 1
+fi
 jq -n \
   --arg schema fm-clean-commit-relaunch.v1 \
   --arg source "$SOURCE" \
@@ -546,12 +554,13 @@ jq -n \
   --arg pr "$PR" \
   '{schema:$schema,source:$source,destination:$destination,repository_identity:$repository_identity,source_commit:$source_commit,source_branch:$source_branch,destination_branch:$destination_branch,delivery:{mode:$mode,yolo:$yolo},source_brief_identity:$source_brief_identity,destination_brief_identity:$destination_brief_identity,no_mistakes_custody:{state:$custody,next_action:"proceed"}} + (if $pr == "" then {} else {pr:$pr} end)' \
   > "$HANDOFF_TMP" || exit 1
-trap defer_destination_handoff_signal HUP INT TERM
 if ln "$HANDOFF_TMP" "$DESTINATION_HANDOFF"; then
   DESTINATION_HANDOFF_OWNED=1
   rm -f -- "$HANDOFF_TMP"
+  DESTINATION_HANDOFF_TMP=
 else
   rm -f -- "$HANDOFF_TMP"
+  DESTINATION_HANDOFF_TMP=
   trap interrupted HUP INT TERM
   echo "error: destination task $DESTINATION already has a durable handoff" >&2
   exit 1
diff --git a/tests/fm-clean-commit-relaunch.test.sh b/tests/fm-clean-commit-relaunch.test.sh
index 1e88c86f36..8b6950b95f 100755
--- a/tests/fm-clean-commit-relaunch.test.sh
+++ b/tests/fm-clean-commit-relaunch.test.sh
@@ -12,6 +12,7 @@ set -u
 
 REAL_GIT=$(command -v git)
 REAL_LN=$(command -v ln)
+REAL_JQ=$(command -v jq)
 
 TMP_ROOT=$(fm_test_tmproot fm-clean-commit-relaunch)
 fm_git_identity fmtest fmtest@example.invalid
@@ -165,6 +166,12 @@ case "$destination" in
     ;;
 esac
 exec "$FM_TEST_REAL_LN" "$@"
+SH
+  cat > "$fakebin/jq" <<'SH'
+#!/usr/bin/env bash
+set -u
+[ "${FM_TEST_JQ_FAIL:-0}" != 1 ] || exit 1
+exec "$FM_TEST_REAL_JQ" "$@"
 SH
   chmod +x "$fakebin"/*
 }
@@ -245,6 +252,7 @@ run_owner() {  # <fixture> [source] [destination]
   PATH="$fixture/fakebin:$PATH" \
     FM_TEST_REAL_GIT="$REAL_GIT" \
     FM_TEST_REAL_LN="$REAL_LN" \
+    FM_TEST_REAL_JQ="$REAL_JQ" \
     FM_TEST_HOME="$fixture/home" \
     FM_TEST_PROJECT="$fixture/project" \
     FM_TEST_SOURCE_WORKTREE="$fixture/source" \
@@ -452,6 +460,16 @@ for failure in allocator checkout launch acknowledgement; do
 done
 pass "clean relaunch: allocator, checkout, launch, and acknowledgement failure preserve source"
 
+fixture=$(new_case handoff-staging-failure)
+before=$(source_snapshot "$fixture")
+out=$(FM_TEST_JQ_FAIL=1 run_owner "$fixture" 2>&1)
+expect_code 1 $? "handoff rendering failure should fail"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "handoff rendering failure mutated source"
+[ -z "$(find "$fixture/home/data/destination" -maxdepth 1 -name '.relaunch-handoff.*' -print -quit)" ] || fail "handoff rendering failure retained staging file"
+assert_absent "$fixture/home/data/destination/relaunch-handoff.json" "handoff rendering failure published handoff"
+git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination && fail "handoff rendering failure retained destination branch"
+pass "clean relaunch: handoff rendering failure removes staging state"
+
 # A malicious or faulty allocator cannot turn source preservation into cleanup.
 fixture=$(new_case allocator-reuses-source)
 before=$(source_snapshot "$fixture")

From e519acaee881c951f9c01bf7f9cd8f8cd0cb0941 Mon Sep 17 00:00:00 2001
From: Pranay Pratyush <pranay.pratyush@gmail.com>
Date: Mon, 31 Aug 2026 21:05:31 +0530
Subject: [PATCH 11/16] no-mistakes(review): Return rejected destination leases

---
 bin/fm-clean-commit-relaunch.sh        | 18 +++++++++++++-----
 tests/fm-clean-commit-relaunch.test.sh | 10 ++++++++++
 2 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/bin/fm-clean-commit-relaunch.sh b/bin/fm-clean-commit-relaunch.sh
index e5068604b7..9bbd20bbf8 100755
--- a/bin/fm-clean-commit-relaunch.sh
+++ b/bin/fm-clean-commit-relaunch.sh
@@ -237,6 +237,8 @@ SOURCE_LOCK_HELD=0
 DESTINATION_LOCK_HELD=0
 DESTINATION_WORKTREE=
 DESTINATION_WORKTREE_OWNED=0
+DESTINATION_LEASE_WORKTREE=
+DESTINATION_LEASE_OWNED=0
 DESTINATION_BRANCH=
 DESTINATION_BRANCH_CREATED=0
 DESTINATION_PUBLISHED=0
@@ -259,11 +261,15 @@ defer_destination_allocation_signal() {
 }
 
 cleanup_destination() {
-  [ "$DESTINATION_WORKTREE_OWNED" -eq 1 ] || return 0
-  fm_clean_relaunch_launch_cleanup "$DESTINATION" || true
-  if ! (cd "$PROJECT" && "$SCRIPT_DIR/fm-treehouse-command.sh" return --if-lease-holder "fm-$DESTINATION" "$DESTINATION_WORKTREE"); then
-    echo "error: could not return destination worktree $DESTINATION_WORKTREE" >&2
-    return 1
+  if [ "$DESTINATION_WORKTREE_OWNED" -eq 1 ]; then
+    fm_clean_relaunch_launch_cleanup "$DESTINATION" || true
+  fi
+  if [ "$DESTINATION_LEASE_OWNED" -eq 1 ]; then
+    if ! (cd "$PROJECT" && "$SCRIPT_DIR/fm-treehouse-command.sh" return --if-lease-holder "fm-$DESTINATION" "$DESTINATION_LEASE_WORKTREE"); then
+      echo "error: could not return destination worktree $DESTINATION_LEASE_WORKTREE" >&2
+      return 1
+    fi
+    DESTINATION_LEASE_OWNED=0
   fi
   if [ "$DESTINATION_BRANCH_CREATED" -eq 1 ]; then
     if ! git -C "$PROJECT" branch -D "$DESTINATION_BRANCH" >/dev/null; then
@@ -469,6 +475,8 @@ ALLOCATED_WORKTREE=$(cd "$PROJECT" && "$SCRIPT_DIR/fm-treehouse-get.sh" --lease
   exit 1
 }
 DESTINATION_WORKTREE=$ALLOCATED_WORKTREE
+DESTINATION_LEASE_WORKTREE=$ALLOCATED_WORKTREE
+DESTINATION_LEASE_OWNED=1
 ALLOCATED_WORKTREE=$(resolve_dir destination-worktree "$ALLOCATED_WORKTREE") || exit 1
 DESTINATION_WORKTREE=$ALLOCATED_WORKTREE
 [ "$ALLOCATED_WORKTREE" != "$SOURCE_WORKTREE" ] || {
diff --git a/tests/fm-clean-commit-relaunch.test.sh b/tests/fm-clean-commit-relaunch.test.sh
index 8b6950b95f..e81d3b5a9c 100755
--- a/tests/fm-clean-commit-relaunch.test.sh
+++ b/tests/fm-clean-commit-relaunch.test.sh
@@ -460,6 +460,16 @@ for failure in allocator checkout launch acknowledgement; do
 done
 pass "clean relaunch: allocator, checkout, launch, and acknowledgement failure preserve source"
 
+fixture=$(new_case allocator-dirty-destination)
+before=$(source_snapshot "$fixture")
+out=$(FM_TEST_ALLOCATOR_DIRTY=1 run_owner "$fixture" 2>&1)
+expect_code 1 $? "dirty allocated destination should fail"
+[ "$(source_snapshot "$fixture")" = "$before" ] || fail "dirty allocated destination mutated source"
+assert_absent "$fixture/destination" "dirty allocated destination retained its lease"
+assert_contains "$(cat "$fixture/allocator.log")" 'return --if-lease-holder fm-destination' "dirty allocated destination was not returned"
+git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination && fail "dirty allocated destination retained destination branch"
+pass "clean relaunch: rejected allocated destination returns its lease"
+
 fixture=$(new_case handoff-staging-failure)
 before=$(source_snapshot "$fixture")
 out=$(FM_TEST_JQ_FAIL=1 run_owner "$fixture" 2>&1)

From f7120470722dd9c376978ca056c7cf71389b7760 Mon Sep 17 00:00:00 2001
From: Pranay Pratyush <pranay.pratyush@gmail.com>
Date: Mon, 31 Aug 2026 22:24:59 +0530
Subject: [PATCH 12/16] no-mistakes(review): Restrict clean relaunch to Herdr

---
 bin/fm-clean-commit-relaunch-launch-lib.sh | 48 ++++++-----
 bin/fm-clean-commit-relaunch.sh            | 23 +-----
 docs/architecture.md                       |  1 +
 tests/fm-clean-commit-relaunch.test.sh     | 95 +++++++++-------------
 4 files changed, 71 insertions(+), 96 deletions(-)

diff --git a/bin/fm-clean-commit-relaunch-launch-lib.sh b/bin/fm-clean-commit-relaunch-launch-lib.sh
index 1cd2d2a73b..26c343c51e 100755
--- a/bin/fm-clean-commit-relaunch-launch-lib.sh
+++ b/bin/fm-clean-commit-relaunch-launch-lib.sh
@@ -47,7 +47,7 @@ fm_clean_relaunch_destination_meta_absent() {  # <state> <id>
 
 fm_clean_relaunch_launch_cleanup() {  # <destination-id>
   local id=$1 state=${FM_CLEAN_RELAUNCH_LAUNCH_STATE:-} window_id=${FM_CLEAN_RELAUNCH_LAUNCH_WINDOW_ID:-}
-  [ -n "$window_id" ] && fm_backend_kill tmux "$window_id" >/dev/null 2>&1 || true
+  [ -n "$window_id" ] && fm_backend_kill herdr "$window_id" >/dev/null 2>&1 || true
   [ -n "$state" ] || return 0
   [ "$FM_CLEAN_RELAUNCH_LAUNCH_TEMP_OWNED" -eq 0 ] || rm -rf -- "${TMPDIR:-/tmp}/fm-$id"
   [ "$FM_CLEAN_RELAUNCH_LAUNCH_INBOX_OWNED" -eq 0 ] || rm -rf -- "$state/$id.inbox"
@@ -76,17 +76,17 @@ fm_clean_relaunch_wait_for_ack() {  # <state> <id> <record>
 #   <destination-id> <project-root> <allocated-worktree> <brief>
 #   <harness> <backend> <mode> <yolo> <model> <effort>
 #
-# The first supported profile is codex on the reference tmux backend. Refusing
+# The supported profile is codex on the Herdr backend. Refusing
 # every other tuple before endpoint creation is deliberate. Their lifecycle
 # setup and acknowledgement semantics stay owned by generic fm-spawn until a
 # profile can share this helper without relaunch-specific input.
 fm_clean_relaunch_launch_allocated() {
   local id=$1 project=$2 worktree=$3 brief=$4 harness=$5 backend=$6 mode=$7 yolo=$8 model=$9 effort=${10}
   local state=${STATE:?STATE must be set by the relaunch owner}
-  local session window canonical_target target window_id window_count task_tmp meta_tmp launch record handoff late_artifact
+  local container session workspace seeded_tab task_ids tab_id pane_id target task_tmp meta_tmp launch record handoff late_artifact
 
-  [ "$harness:$backend" = codex:tmux ] || {
-    echo "error: allocated relaunch launch supports only codex/tmux" >&2
+  [ "$harness:$backend" = codex:herdr ] || {
+    echo "error: allocated relaunch launch supports only codex/Herdr" >&2
     return 1
   }
   [ -f "$brief" ] && [ ! -L "$brief" ] && [ -r "$brief" ] || {
@@ -106,25 +106,26 @@ fm_clean_relaunch_launch_allocated() {
     echo "error: destination state is already occupied" >&2
     return 1
   fi
-  fm_backend_source tmux || return 1
-  session=$(fm_backend_tmux_container_ensure) || return 1
-  window="fm-$id"
-  canonical_target="$session:$window"
+  fm_backend_source herdr || return 1
+  container=$(fm_backend_herdr_container_ensure "$project" other-home) || return 1
+  session=${container%%:*}
+  workspace=${container#*:}
+  seeded_tab=
+  case "$workspace" in *$'\t'*) seeded_tab=${workspace#*$'\t'}; workspace=${workspace%%$'\t'*} ;; esac
   FM_CLEAN_RELAUNCH_LAUNCH_STATE=$state
   trap fm_clean_relaunch_defer_window_creation_signal HUP INT TERM
-  if window_id=$(fm_backend_tmux_create_task "$session" "$window" "$worktree"); then
-    FM_CLEAN_RELAUNCH_LAUNCH_WINDOW_ID="$session:$window_id"
+  if task_ids=$(fm_backend_herdr_create_task "$session:$workspace" "fm-$id" "$worktree" "$seeded_tab"); then
+    read -r tab_id pane_id <<EOF
+$task_ids
+EOF
+    [ -n "$tab_id" ] && [ -n "$pane_id" ] || return 1
+    FM_CLEAN_RELAUNCH_LAUNCH_WINDOW_ID="$session:$pane_id"
   else
     trap interrupted HUP INT TERM
     return 1
   fi
   trap interrupted HUP INT TERM
   [ "$FM_CLEAN_RELAUNCH_LAUNCH_CREATE_INTERRUPTED" -eq 0 ] || return 1
-  window_count=$(tmux list-windows -t "$session" -F '#{window_name}' 2>/dev/null | grep -Fxc "$window" || true)
-  [ "$window_count" -eq 1 ] || {
-    echo "error: destination tmux endpoint is ambiguous after creation" >&2
-    return 1
-  }
   target="$FM_CLEAN_RELAUNCH_LAUNCH_WINDOW_ID"
 
   task_tmp="${TMPDIR:-/tmp}/fm-$id"
@@ -162,8 +163,13 @@ fm_clean_relaunch_launch_allocated() {
     return 1
   fi
   if ! {
-    printf 'window=%s\n' "$canonical_target"
+    printf 'window=%s\n' "$target"
     printf 'endpoint_task_id=%s\n' "$id"
+    printf 'backend=herdr\n'
+    printf 'herdr_session=%s\n' "$session"
+    printf 'herdr_workspace_id=%s\n' "$workspace"
+    printf 'herdr_tab_id=%s\n' "$tab_id"
+    printf 'herdr_pane_id=%s\n' "$pane_id"
     printf 'worktree=%s\n' "$worktree"
     printf 'project=%s\n' "$project"
     printf 'harness=%s\n' "$harness"
@@ -192,19 +198,19 @@ fm_clean_relaunch_launch_allocated() {
   trap interrupted HUP INT TERM
   [ "$FM_CLEAN_RELAUNCH_LAUNCH_METADATA_INTERRUPTED" -eq 0 ] || return 1
 
-  fm_backend_tmux_send_text_line "$target" "export GOTMPDIR=$(fm_clean_relaunch_shell_quote "$task_tmp/gotmp")" || return 1
+  fm_backend_herdr_send_text_line "$target" "export GOTMPDIR=$(fm_clean_relaunch_shell_quote "$task_tmp/gotmp")" || return 1
   launch="codex"
   [ "$model" = default ] || launch="$launch --model $(fm_clean_relaunch_shell_quote "$model")"
   case "$effort" in
     low|medium|high|xhigh) launch="$launch -c $(fm_clean_relaunch_shell_quote "model_reasoning_effort=\"$effort\"")" ;;
   esac
   launch="$launch --dangerously-bypass-approvals-and-sandbox \$( $(fm_clean_relaunch_shell_quote "$FM_ROOT/bin/fm-operational-input.sh") encode launch-brief < $(fm_clean_relaunch_shell_quote "$brief") )"
-  fm_backend_tmux_send_literal "$target" "$launch" || return 1
-  fm_backend_tmux_send_key "$target" Enter || return 1
+  fm_backend_herdr_send_literal "$target" "$launch" || return 1
+  fm_backend_herdr_send_key "$target" Enter || return 1
   handoff="${DATA:?DATA must be set by the relaunch owner}/$id/relaunch-handoff.json"
 
   record=$(fm_task_inbox_write "$state" "$id" "Read the durable preserved-work handoff at $handoff before continuing the task.") || return 1
-  fm_task_inbox_ring tmux "$target" "$record" "$window" codex || return 1
+  fm_task_inbox_ring herdr "$target" "$record" "fm-$id" codex || return 1
   fm_clean_relaunch_wait_for_ack "$state" "$id" "$record" || {
     echo "error: destination worker did not acknowledge the preserved-work handoff" >&2
     return 1
diff --git a/bin/fm-clean-commit-relaunch.sh b/bin/fm-clean-commit-relaunch.sh
index 9bbd20bbf8..b3ec654c89 100755
--- a/bin/fm-clean-commit-relaunch.sh
+++ b/bin/fm-clean-commit-relaunch.sh
@@ -4,7 +4,7 @@
 # Usage: fm-clean-commit-relaunch.sh <source-task-id> <destination-task-id>
 #
 # This explicit operator command is the sole owner of clean-commit relaunch.
-# It admits one missing local codex/tmux ship task, allocates a normal clean
+# It admits one missing local codex/Herdr ship task, allocates a normal clean
 # Treehouse worktree, creates a new branch at the admitted source commit,
 # publishes one evidence-only handoff, launches and acknowledges a fresh task,
 # and cleans only destination-owned state on failure.
@@ -137,19 +137,6 @@ task_worktrees_are_well_formed() {
   done
 }
 
-destination_tmux_window_absent() {  # <destination>
-  local destination=$1 session windows
-  if [ -n "${TMUX:-}" ]; then
-    session=$(tmux display-message -p '#S' 2>/dev/null) || return 1
-  elif tmux has-session -t firstmate 2>/dev/null; then
-    session=firstmate
-  else
-    return 0
-  fi
-  windows=$(tmux list-windows -t "$session" -F '#{window_name}' 2>/dev/null) || return 1
-  ! grep -Fxq "fm-$destination" <<< "$windows"
-}
-
 destination_artifact_exists() {  # <destination>
   local destination=$1 artifact
   for artifact in \
@@ -368,8 +355,8 @@ case "$MODEL" in
   *[!A-Za-z0-9._:/@+-]*) echo "error: source task $SOURCE has invalid model metadata" >&2; exit 1 ;;
 esac
 case "$EFFORT" in ''|default|low|medium|high|xhigh|max) ;; *) echo "error: source task $SOURCE has invalid effort metadata" >&2; exit 1 ;; esac
-[ "$HARNESS:$BACKEND" = codex:tmux ] || {
-  echo "error: clean-commit relaunch currently supports only verified codex/tmux source tasks" >&2
+[ "$HARNESS:$BACKEND" = codex:herdr ] || {
+  echo "error: clean-commit relaunch currently supports only verified codex/Herdr source tasks" >&2
   exit 1
 }
 grep -Fxq "Delivery contract: mode=$MODE" "$DESTINATION_BRIEF" || {
@@ -443,10 +430,6 @@ case "$(fm_backend_agent_state "$BACKEND" "$FM_BACKEND_VALIDATED_TARGET" "$SOURC
   missing) ;;
   *) echo "error: source task $SOURCE endpoint is not authoritatively missing" >&2; exit 1 ;;
 esac
-destination_tmux_window_absent "$DESTINATION" || {
-  echo "error: destination task $DESTINATION already has a tmux endpoint or tmux is unreadable" >&2
-  exit 1
-}
 CUSTODY=$(no_mistakes_custody "$SOURCE_WORKTREE" "$SOURCE_BRANCH")
 case "$CUSTODY" in
   none) ;;
diff --git a/docs/architecture.md b/docs/architecture.md
index 755ceee9d1..b50f447173 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -148,6 +148,7 @@ That poll loop is still the default event source for backends with no native pus
 For capable Herdr sessions, the same watcher replaces its terminal sleep with a bounded native event wait that immediately surfaces `blocked`; [Push events and polling fallback](herdr-backend.md#push-events-and-polling-fallback) owns the current mechanism and capability gates, while [runtime backend verification](verification/runtime-backends.md#native-blocked-event) owns the active evidence.
 The deeper session-start agent-process liveness probe is separate from that busy-state poll: tmux and Herdr have verified classifiers for secondmate recovery, Zellij remains unverified, and Orca and cmux do not support secondmate spawns.
 Herdr is experimental and can be selected explicitly or by runtime auto-detection: Treehouse remains its worktree provider, [`herdr-backend.md`](herdr-backend.md) owns current setup and safety limits, and [`verification/runtime-backends.md`](verification/runtime-backends.md#herdr) owns active empirical evidence.
+`fm-clean-commit-relaunch.sh` is manual-only and currently accepts only a missing Codex/Herdr ship endpoint, with its source-only launch helper owning the resulting private relaunch lifecycle.
 Herdr uses one tab per task; [Watching and task containers](herdr-backend.md#watching-and-task-containers) owns launcher-bound workspace placement, the label-only fallback, and recovery scope.
 Its default-on presentation projection may place one clean new task in a disposable workspace without changing endpoint authority or lifecycle ownership; [Presentation spaces](herdr-backend.md#presentation-spaces) owns that conditional design and its narrow home-local restored-shell cleanup at locked session start.
 Zellij is experimental and selected only explicitly: Treehouse remains its worktree provider, [`zellij-backend.md`](zellij-backend.md) owns current setup and limits, and [`verification/runtime-backends.md`](verification/runtime-backends.md#zellij) owns active empirical evidence.
diff --git a/tests/fm-clean-commit-relaunch.test.sh b/tests/fm-clean-commit-relaunch.test.sh
index e81d3b5a9c..85fc77a512 100755
--- a/tests/fm-clean-commit-relaunch.test.sh
+++ b/tests/fm-clean-commit-relaunch.test.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # Deterministic behavior tests for the explicit clean-commit relaunch owner.
 #
-# The fixture uses linked Git worktrees plus fake Treehouse, tmux, and
+# The fixture uses linked Git worktrees plus fake Treehouse and Herdr adapters.
 # no-mistakes adapters. No test creates, stops, or interrogates a live Herdr
 # process. Every refusal asserts that allocation was never requested and that
 # source task records and branch identity remain unchanged.
@@ -27,7 +27,36 @@ copy_runtime() {  # <fixture>
     fm-session-lock-lib.sh fm-pool-lib.sh fm-treehouse-root-lib.sh; do
     cp "$ROOT/bin/$file" "$fixture/bin/$file"
   done
-  cp "$ROOT/bin/backends/tmux.sh" "$fixture/bin/backends/tmux.sh"
+  cat > "$fixture/bin/backends/herdr.sh" <<'SH'
+fm_backend_herdr_agent_state() {
+  case "${FM_TEST_ENDPOINT:-missing}" in
+    missing) printf missing ;;
+    live) printf alive ;;
+    dead) printf dead ;;
+    *) printf unreadable ;;
+  esac
+}
+fm_backend_herdr_container_ensure() { printf 'firstmate:workspace\tseeded'; }
+fm_backend_herdr_create_task() {
+  printf 'create-task %s\n' "$*" >> "$FM_TEST_HERDR_LOG"
+  [ -z "${FM_TEST_LAUNCH_DELAY:-}" ] || sleep "$FM_TEST_LAUNCH_DELAY"
+  [ "${FM_TEST_LAUNCH_FAIL:-0}" != 1 ] || return 1
+  printf 'tab-destination pane-destination'
+}
+fm_backend_herdr_send_text_line() { printf 'send-text %s\n' "$*" >> "$FM_TEST_HERDR_LOG"; }
+fm_backend_herdr_send_literal() { printf 'send-literal %s\n' "$*" >> "$FM_TEST_HERDR_LOG"; }
+fm_backend_herdr_send_key() { printf 'send-key %s\n' "$*" >> "$FM_TEST_HERDR_LOG"; }
+fm_backend_herdr_send_text_submit() {
+  printf 'submit %s\n' "$*" >> "$FM_TEST_HERDR_LOG"
+  for message in "$FM_TEST_HOME/state/$FM_TEST_DESTINATION_ID.inbox"/*.msg; do
+    [ -e "$message" ] || continue
+    [ "${FM_TEST_ACK_MODE:-success}" = success ] && mv "$message" "$FM_TEST_HOME/state/$FM_TEST_DESTINATION_ID.inbox/handled/"
+  done
+  printf empty
+}
+fm_backend_herdr_composer_state() { printf empty; }
+fm_backend_herdr_kill() { printf 'kill %s\n' "$*" >> "$FM_TEST_HERDR_LOG"; }
+SH
   cat > "$fixture/bin/fm-receipt-check.sh" <<'SH'
 #!/usr/bin/env bash
 exit 0
@@ -59,7 +88,7 @@ if [ "${1:-}" = return ]; then
   git -C "$FM_TEST_PROJECT" worktree remove --force "$path" >/dev/null 2>&1 || true
 fi
 SH
-  chmod +x "$fixture/bin"/*.sh "$fixture/bin/backends/tmux.sh"
+  chmod +x "$fixture/bin"/*.sh "$fixture/bin/backends/herdr.sh"
 }
 
 make_fakebin() {  # <fixture>
@@ -217,11 +246,16 @@ new_case() {  # <name>
   write_brief "$home/data/source/brief.md" no-mistakes
   write_brief "$home/data/destination/brief.md" no-mistakes
   cat > "$home/state/source.meta" <<EOF
-window=firstmate:fm-source
 endpoint_task_id=source
 worktree=$source
 project=$project
 harness=codex
+backend=herdr
+herdr_session=firstmate
+herdr_workspace_id=workspace-source
+herdr_tab_id=tab-source
+herdr_pane_id=pane-source
+window=firstmate:pane-source
 kind=ship
 mode=no-mistakes
 yolo=off
@@ -263,7 +297,7 @@ run_owner() {  # <fixture> [source] [destination]
     FM_TEST_DESTINATION_ID="$destination" \
     FM_TEST_WINDOWS="$fixture/windows" \
     FM_TEST_ALLOCATOR_LOG="$fixture/allocator.log" \
-    FM_TEST_TMUX_LOG="$fixture/tmux.log" \
+    FM_TEST_HERDR_LOG="$fixture/tmux.log" \
     TMPDIR="$fixture/tmp" FM_HOME="$fixture/home" FM_ROOT_OVERRIDE="$ROOT" \
     "$fixture/bin/fm-clean-commit-relaunch.sh" "$source" "$destination"
 }
@@ -335,17 +369,6 @@ for endpoint in live dead ambiguous unreadable; do
 done
 pass "clean relaunch: only an authoritatively missing endpoint passes admission"
 
-# A destination endpoint is occupied even without durable task metadata.
-fixture=$(new_case destination-window-occupied)
-before=$(source_snapshot "$fixture")
-printf 'fm-destination\n' > "$fixture/windows"
-out=$(run_owner "$fixture" 2>&1)
-expect_code 1 $? "existing destination window should refuse"
-assert_refused_before_allocation "$fixture" "$out" "existing destination window"
-[ "$(source_snapshot "$fixture")" = "$before" ] || fail "existing destination window mutated source"
-[ "$(cat "$fixture/windows")" = fm-destination ] || fail "existing destination window was removed"
-pass "clean relaunch: existing destination endpoint refuses before allocation"
-
 # Metadata identity, role, home, and durable occupancy all refuse before the
 # allocator can create a destination.
 for mutation in malformed wrong-kind secondmate endpoint-mismatch destination-occupied destination-doorbell-requests duplicate-pr noncanonical-pr branch-collision; do
@@ -551,24 +574,6 @@ expect_code 1 $? "concurrent branch creation should fail"
 git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination || fail "concurrent branch creation was deleted"
 pass "clean relaunch: concurrent destination branch remains foreign"
 
-# A concurrent tmux window creation never becomes this relaunch's cleanup target.
-fixture=$(new_case window-race)
-before=$(source_snapshot "$fixture")
-out=$(FM_TEST_FOREIGN_WINDOW_RACE=1 run_owner "$fixture" 2>&1)
-expect_code 1 $? "concurrent window creation should fail"
-[ "$(source_snapshot "$fixture")" = "$before" ] || fail "concurrent window creation mutated source"
-[ "$(cat "$fixture/windows")" = fm-destination ] || fail "concurrent window creation was removed"
-assert_not_contains "$(cat "$fixture/tmux.log")" 'kill-window' "concurrent window creation was cleaned"
-pass "clean relaunch: concurrent destination endpoint remains foreign"
-
-fixture=$(new_case duplicate-window-race)
-before=$(source_snapshot "$fixture")
-out=$(FM_TEST_DUPLICATE_WINDOW_RACE=1 run_owner "$fixture" 2>&1)
-expect_code 1 $? "duplicate destination window should fail"
-[ "$(source_snapshot "$fixture")" = "$before" ] || fail "duplicate destination window mutated source"
-assert_not_contains "$(cat "$fixture/tmux.log")" 'send-keys' "duplicate destination window received a launch or inbox command"
-pass "clean relaunch: duplicate destination endpoint refuses after creation"
-
 # An interrupt after handoff publication exits through destination-only cleanup.
 fixture=$(new_case interrupted-publication)
 before=$(source_snapshot "$fixture")
@@ -589,26 +594,6 @@ assert_absent "$fixture/home/data/destination/relaunch-handoff.json" "interrupte
 git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination && fail "interrupted publication retained destination branch"
 pass "clean relaunch: interrupted destination publication preserves source"
 
-# An interrupt while tmux creates the destination also cleans that new window.
-fixture=$(new_case interrupted-window-creation)
-before=$(source_snapshot "$fixture")
-FM_TEST_LAUNCH_DELAY=5 run_owner "$fixture" >"$fixture/interrupted.out" 2>&1 &
-pid=$!
-for _ in $(seq 1 100); do
-  [ -s "$fixture/tmux.log" ] && break
-  sleep 0.01
-done
-assert_present "$fixture/tmux.log" "window-creation interrupt fixture did not start tmux creation"
-kill -HUP "$pid"
-wait "$pid"
-status=$?
-expect_code 1 "$status" "interrupted window creation should fail"
-[ "$(source_snapshot "$fixture")" = "$before" ] || fail "interrupted window creation mutated source"
-assert_contains "$(cat "$fixture/tmux.log")" 'kill-window' "interrupted window creation did not clean the destination endpoint"
-assert_absent "$fixture/home/state/destination.meta" "interrupted window creation retained destination metadata"
-git -C "$fixture/project" show-ref --verify --quiet refs/heads/fm/destination && fail "interrupted window creation retained destination branch"
-pass "clean relaunch: interrupted window creation cleans destination endpoint"
-
 # The destination lock serializes two simultaneous attempts before a second
 # endpoint or branch can be created.
 fixture=$(new_case concurrency)
@@ -621,7 +606,7 @@ wait "$pid"
 first_status=$?
 [ "$first_status" -eq 0 ] || fail "first concurrent relaunch did not succeed: $(cat "$fixture/first.out")"
 [ "$status" -ne 0 ] || fail "second concurrent relaunch unexpectedly succeeded"
-[ "$(grep -c '^new-window ' "$fixture/tmux.log")" -eq 1 ] || fail "concurrent relaunch created duplicate endpoints"
+[ "$(grep -c '^create-task ' "$fixture/tmux.log")" -eq 1 ] || fail "concurrent relaunch created duplicate endpoints"
 pass "clean relaunch: destination lock serializes concurrent requests"
 
 # Generic spawn retains its public fresh-task interface; legacy relaunch flags

From d3d873a166b931ed30d4c2341d8115899cd51c10 Mon Sep 17 00:00:00 2001
From: Pranay Pratyush <pranay.pratyush@gmail.com>
Date: Mon, 31 Aug 2026 22:31:07 +0530
Subject: [PATCH 13/16] no-mistakes(document): Align relaunch backend
 documentation

---
 docs/architecture.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/architecture.md b/docs/architecture.md
index b50f447173..1bce16f37e 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -343,7 +343,7 @@ The mechanics are owned by the `/updatefirstmate` skill and firstmate's operatin
 `bin/fm-clean-commit-relaunch.sh` is an explicit operator command, never an automatic recovery path.
 It alone admits a missing committed source task, leases a distinct normal worktree, creates the successor branch at the admitted commit, records evidence, and launches the fresh worker.
 The source branch, records, validation custody, session material, and presentation state remain read-only.
-The initial supported launch profile is Codex on the reference tmux backend.
+The initial supported launch profile is Codex on the Herdr backend.
 Generic `fm-spawn.sh` remains a fresh-task interface and does not carry relaunch source, commit, handoff, or allocated-worktree authority.
 The command header owns the exact admission and cleanup mechanics.
 

From 5c7b6c6515e82b82c8303a2c94a5c9384f42c074 Mon Sep 17 00:00:00 2001
From: Pranay Pratyush <pranay.pratyush@gmail.com>
Date: Mon, 31 Aug 2026 22:36:02 +0530
Subject: [PATCH 14/16] no-mistakes(lint): Remove unused relaunch lint
 variables

---
 bin/fm-clean-commit-relaunch-launch-lib.sh | 1 -
 bin/fm-clean-commit-relaunch.sh            | 2 --
 2 files changed, 3 deletions(-)

diff --git a/bin/fm-clean-commit-relaunch-launch-lib.sh b/bin/fm-clean-commit-relaunch-launch-lib.sh
index 26c343c51e..05ac2836fa 100755
--- a/bin/fm-clean-commit-relaunch-launch-lib.sh
+++ b/bin/fm-clean-commit-relaunch-launch-lib.sh
@@ -10,7 +10,6 @@ _FM_CLEAN_RELAUNCH_LAUNCH_LIB_DIR=$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE
 # shellcheck source=bin/fm-task-inbox-lib.sh
 . "$_FM_CLEAN_RELAUNCH_LAUNCH_LIB_DIR/fm-task-inbox-lib.sh"
 
-FM_CLEAN_RELAUNCH_LAUNCH_TARGET=
 FM_CLEAN_RELAUNCH_LAUNCH_STATE=
 FM_CLEAN_RELAUNCH_LAUNCH_WINDOW_ID=
 FM_CLEAN_RELAUNCH_LAUNCH_CREATE_INTERRUPTED=0
diff --git a/bin/fm-clean-commit-relaunch.sh b/bin/fm-clean-commit-relaunch.sh
index b3ec654c89..b134cac30d 100755
--- a/bin/fm-clean-commit-relaunch.sh
+++ b/bin/fm-clean-commit-relaunch.sh
@@ -228,7 +228,6 @@ DESTINATION_LEASE_WORKTREE=
 DESTINATION_LEASE_OWNED=0
 DESTINATION_BRANCH=
 DESTINATION_BRANCH_CREATED=0
-DESTINATION_PUBLISHED=0
 DESTINATION_CHECKOUT_INTERRUPTED=0
 DESTINATION_HANDOFF_OWNED=0
 DESTINATION_HANDOFF_INTERRUPTED=0
@@ -565,5 +564,4 @@ fm_clean_relaunch_launch_allocated \
   echo "error: destination launch or acknowledgement failed" >&2
   exit 1
 }
-DESTINATION_PUBLISHED=1
 printf 'relaunched %s as %s at %s\n' "$SOURCE" "$DESTINATION" "$SOURCE_COMMIT"

From 0b4995dd926d28df008b11a295072b5e982f2447 Mon Sep 17 00:00:00 2001
From: Pranay Pratyush <pranay.pratyush@gmail.com>
Date: Mon, 31 Aug 2026 22:57:41 +0530
Subject: [PATCH 15/16] no-mistakes: apply CI fixes

---
 tests/fm-clean-commit-relaunch.test.sh | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/tests/fm-clean-commit-relaunch.test.sh b/tests/fm-clean-commit-relaunch.test.sh
index 85fc77a512..3dbe5b0f5d 100755
--- a/tests/fm-clean-commit-relaunch.test.sh
+++ b/tests/fm-clean-commit-relaunch.test.sh
@@ -579,11 +579,17 @@ fixture=$(new_case interrupted-publication)
 before=$(source_snapshot "$fixture")
 FM_TEST_LAUNCH_DELAY=5 run_owner "$fixture" >"$fixture/interrupted.out" 2>&1 &
 pid=$!
-for _ in $(seq 1 100); do
-  [ -f "$fixture/home/data/destination/relaunch-handoff.json" ] && break
+# Wait for both the published handoff and the delayed endpoint creation. The
+# latter is the fixture's observable barrier that the owner has entered the
+# post-publication launch window before this test interrupts it.
+for _ in $(seq 1 400); do
+  [ -f "$fixture/home/data/destination/relaunch-handoff.json" ] \
+    && grep -Fq 'create-task ' "$fixture/tmux.log" && break
   sleep 0.01
 done
 assert_present "$fixture/home/data/destination/relaunch-handoff.json" "interrupt fixture did not reach destination publication"
+grep -Fq 'create-task ' "$fixture/tmux.log" \
+  || fail "interrupt fixture did not enter the delayed destination launch"
 kill -HUP "$pid"
 wait "$pid"
 status=$?

From 25da67106ad67d4f1e6cef5a2f4a844d1952df84 Mon Sep 17 00:00:00 2001
From: Pranay Pratyush <pranay.pratyush@gmail.com>
Date: Mon, 31 Aug 2026 23:20:32 +0530
Subject: [PATCH 16/16] no-mistakes(document): Document Herdr-only clean-commit
 relaunch constraints

---
 docs/architecture.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/docs/architecture.md b/docs/architecture.md
index 1bce16f37e..9afc4ee587 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -148,7 +148,7 @@ That poll loop is still the default event source for backends with no native pus
 For capable Herdr sessions, the same watcher replaces its terminal sleep with a bounded native event wait that immediately surfaces `blocked`; [Push events and polling fallback](herdr-backend.md#push-events-and-polling-fallback) owns the current mechanism and capability gates, while [runtime backend verification](verification/runtime-backends.md#native-blocked-event) owns the active evidence.
 The deeper session-start agent-process liveness probe is separate from that busy-state poll: tmux and Herdr have verified classifiers for secondmate recovery, Zellij remains unverified, and Orca and cmux do not support secondmate spawns.
 Herdr is experimental and can be selected explicitly or by runtime auto-detection: Treehouse remains its worktree provider, [`herdr-backend.md`](herdr-backend.md) owns current setup and safety limits, and [`verification/runtime-backends.md`](verification/runtime-backends.md#herdr) owns active empirical evidence.
-`fm-clean-commit-relaunch.sh` is manual-only and currently accepts only a missing Codex/Herdr ship endpoint, with its source-only launch helper owning the resulting private relaunch lifecycle.
+The manual [clean committed worker relaunch](#clean-committed-worker-relaunch) is a narrowly scoped Herdr integration.
 Herdr uses one tab per task; [Watching and task containers](herdr-backend.md#watching-and-task-containers) owns launcher-bound workspace placement, the label-only fallback, and recovery scope.
 Its default-on presentation projection may place one clean new task in a disposable workspace without changing endpoint authority or lifecycle ownership; [Presentation spaces](herdr-backend.md#presentation-spaces) owns that conditional design and its narrow home-local restored-shell cleanup at locked session start.
 Zellij is experimental and selected only explicitly: Treehouse remains its worktree provider, [`zellij-backend.md`](zellij-backend.md) owns current setup and limits, and [`verification/runtime-backends.md`](verification/runtime-backends.md#zellij) owns active empirical evidence.
@@ -341,7 +341,8 @@ The mechanics are owned by the `/updatefirstmate` skill and firstmate's operatin
 ## Clean committed worker relaunch
 
 `bin/fm-clean-commit-relaunch.sh` is an explicit operator command, never an automatic recovery path.
-It alone admits a missing committed source task, leases a distinct normal worktree, creates the successor branch at the admitted commit, records evidence, and launches the fresh worker.
+It alone admits an ordinary local Codex/Herdr ship task whose recorded endpoint is authoritatively missing and whose committed source is outside No-Mistakes custody.
+It leases a distinct normal worktree in the same physical repository, creates the successor branch at the admitted commit, records evidence, and launches the fresh worker.
 The source branch, records, validation custody, session material, and presentation state remain read-only.
 The initial supported launch profile is Codex on the Herdr backend.
 Generic `fm-spawn.sh` remains a fresh-task interface and does not carry relaunch source, commit, handoff, or allocated-worktree authority.