diff --git a/.agents/skills/bootstrap-diagnostics/SKILL.md b/.agents/skills/bootstrap-diagnostics/SKILL.md
index 1d49f4b8312..fb2c6c88c7b 100644
--- a/.agents/skills/bootstrap-diagnostics/SKILL.md
+++ b/.agents/skills/bootstrap-diagnostics/SKILL.md
@@ -17,7 +17,7 @@ The inline rules in `AGENTS.md` section 3 still bind: detect, then consent, then
 When any diagnostic needs captain attention, report the plain consequence and requested action using `AGENTS.md` section 9's captain-facing translation contract; do not name the diagnostic label unless the captain needs to paste it into a command or issue.
 
 - `MISSING: <tool> (install: <command>)` - list the missing tools to the captain with a one-line purpose each plus the printed install commands, wait for consent (one approval may cover the list), then run `bin/fm-bootstrap.sh install <approved tools...>`.
-  For `treehouse`, this also covers an installed version whose `treehouse get` lacks `--lease`; treat it as an upgrade request.
+  For `treehouse`, an installed version that fails the capability check owned by [`bin/fm-bootstrap.sh`](../../../bin/fm-bootstrap.sh) also requires an upgrade; use the printed install command after consent.
   For `no-mistakes`, this also covers an installed version older than 1.46.0, because this repo's PR gate requires structured pipeline attestation that older builds do not write.
   For essential axi-family tools - `gh-axi`, `tasks-axi`, `quota-axi` - an installed version below its floor is a plain upgrade request; [`bin/fm-bootstrap.sh`](../../../bin/fm-bootstrap.sh) owns the floor policy, and never argue the floor down to whatever the home happens to have installed.
   For `tasks-axi`, this additionally covers an installed build that fails the separate feature probe (`bin/fm-tasks-axi-lib.sh` owns the definition); `config/backlog-backend=manual` only suppresses the verbose `BOOTSTRAP_INFO: tasks-axi available` fact, not this missing-tool report.
diff --git a/.agents/skills/stuck-crewmate-recovery/SKILL.md b/.agents/skills/stuck-crewmate-recovery/SKILL.md
index c5209051a44..010bb2cc456 100644
--- a/.agents/skills/stuck-crewmate-recovery/SKILL.md
+++ b/.agents/skills/stuck-crewmate-recovery/SKILL.md
@@ -32,7 +32,9 @@ Read the targeted current state with `bin/fm-crew-state.sh <id>` before deciding
 A no-mistakes run matched to the crew's branch and current code remains authoritative when the endpoint is dead: handle a terminal or parked run through the normal lifecycle, and keep supervising an active run instead of creating a duplicate worker.
 
 When no authoritative run accounts for the task, inspect only its recorded backend and worktree inventory.
-Use `treehouse status` for treehouse-backed tmux, herdr, zellij, or cmux tasks, and use the recorded `orca_worktree_id=` and `terminal=` for Orca tasks.
+Use `treehouse status --root <root>` for treehouse-backed tmux, herdr, zellij, or cmux tasks, where `<root>` is `FM_TREEHOUSE_TASK_ROOT` from `bin/fm-wake-lib.sh`'s `fm_treehouse_task_root` using the recorded `treehouse_root=` (empty for legacy records) and `worktree=`.
+Stop if reconciliation fails; a bare `treehouse status` does not reliably select the task's recorded pool.
+Use the recorded `orca_worktree_id=` and `terminal=` for Orca tasks.
 Do not sweep another home's endpoints or infer ownership from a matching window label.
 
 Before relaunch, prove that no live agent still owns the recorded task and that the existing worktree remains available.
diff --git a/bin/fm-bootstrap.sh b/bin/fm-bootstrap.sh
index 1c550c71f10..597efbe86b3 100755
--- a/bin/fm-bootstrap.sh
+++ b/bin/fm-bootstrap.sh
@@ -54,7 +54,7 @@
 #          on a feature branch instead of its default branch - a crewmate's work
 #          landed in the primary instead of its own worktree; restore it per the line.
 #          treehouse is also MISSING when its installed version lacks
-#          "treehouse get --lease" support.
+#          "treehouse get --lease" or "--root" support.
 #          no-mistakes is also MISSING when its installed version is older than
 #          1.46.0 (structured pipeline attestation floor; see CONTRIBUTING.md).
 #          The AXI-family floor policy is owned beside GH_AXI_MIN and
@@ -917,8 +917,11 @@ NO_MISTAKES_MIN=1.46.0
 GH_AXI_MIN=0.1.29
 LAVISH_AXI_MIN=0.1.46
 
-treehouse_supports_lease() {
-  treehouse get --help 2>&1 | grep -Eq '(^|[^[:alnum:]_-])--lease([^[:alnum:]_-]|$)'
+treehouse_supports_required_flags() {
+  local help
+  help=$(treehouse get --help 2>&1) || return 1
+  printf '%s\n' "$help" | grep -Eq '(^|[^[:alnum:]_-])--lease([^[:alnum:]_-]|$)' &&
+    printf '%s\n' "$help" | grep -Eq '(^|[^[:alnum:]_-])--root([^[:alnum:]_-]|$)'
 }
 
 # Shared semantic-version floor for the tool gates below. A version string that
@@ -1428,11 +1431,11 @@ detect_local_tools() {
   for t in $COMMON_TOOLS; do
     command -v "$t" >/dev/null || missing_tool_diagnostic "$t"
   done
-  # The treehouse lease-support upgrade check is only relevant when the resolved
+  # The treehouse capability upgrade check is only relevant when the resolved
   # backend actually requires treehouse (every backend except orca, which owns its
   # own worktrees); an orca home must not be told to upgrade a provider it never uses.
   if fm_backend_list_contains "$TOOLS" treehouse \
-    && command -v treehouse >/dev/null 2>&1 && ! treehouse_supports_lease; then
+    && command -v treehouse >/dev/null 2>&1 && ! treehouse_supports_required_flags; then
     echo "MISSING: treehouse (install: $(install_cmd treehouse))"
   fi
   if command -v no-mistakes >/dev/null 2>&1 && ! tool_version_at_least no-mistakes "$NO_MISTAKES_MIN"; then
diff --git a/bin/fm-home-seed.sh b/bin/fm-home-seed.sh
index 6693ab1df74..7a2897f9c33 100755
--- a/bin/fm-home-seed.sh
+++ b/bin/fm-home-seed.sh
@@ -7,7 +7,11 @@
 #       a fresh firstmate worktree via "treehouse get --lease", which durably
 #       leases the worktree under the secondmate <id> so the home survives with
 #       no live process and is never recycled until the lease is released with
-#       "treehouse return". Projects are cloned
+#       "treehouse return". That lease is the PRIMARY's own, taken from the
+#       firstmate repository's pool using Treehouse's own root resolution, and is
+#       deliberately not one of the per-home child project pools that
+#       bin/fm-wake-lib.sh's fm_treehouse_home_root gives ship and scout
+#       slots, so registered homes keep resolving. Projects are cloned
 #       from the active home into the secondmate home's projects/ directory.
 #       That project list is non-exclusive provisioning data. Pass --no-projects
 #       instead of a project list to seed a project-less home for a domain whose
diff --git a/bin/fm-install-treehouse.sh b/bin/fm-install-treehouse.sh
index 9d181439c87..2ca0ea49797 100755
--- a/bin/fm-install-treehouse.sh
+++ b/bin/fm-install-treehouse.sh
@@ -9,12 +9,12 @@
 # Usage:
 #   fm-install-treehouse.sh <destination-directory>
 #
-# Pins Treehouse v2.0.1, the version exercised by the local real-Herdr suite.
+# Pins Treehouse v2.3.0 with durable leases and explicit root selection.
 set -eu
 
-FM_TREEHOUSE_CI_VERSION=2.0.1
+FM_TREEHOUSE_CI_VERSION=2.3.0
 FM_TREEHOUSE_CI_TAG="v${FM_TREEHOUSE_CI_VERSION}"
-# Bounded download ceiling (bytes). Official 2.0.1 archives are under 8 MiB.
+# Bounded download ceiling (bytes).
 FM_TREEHOUSE_CI_MAX_BYTES=15000000
 FM_TREEHOUSE_CI_REPO=kunchenguid/treehouse
 
@@ -30,19 +30,19 @@ arch=$(uname -m)
 case "${os}-${arch}" in
   Linux-x86_64)
     ARCHIVE=treehouse-v${FM_TREEHOUSE_CI_VERSION}-linux-amd64.tar.gz
-    SHA256=1d5a32751ab921670103fd201ddb2b91b47338cb13976f45642b827cf8976af2
+    SHA256=94fd2b2c20c35aac1ddc2941317890ad82c9916f5ccecbac4a50cda783eed10f
     ;;
   Linux-aarch64|Linux-arm64)
     ARCHIVE=treehouse-v${FM_TREEHOUSE_CI_VERSION}-linux-arm64.tar.gz
-    SHA256=eaccc9c5b98125df8bd77425598eeecee66cb0371db4eb1cf75f0d813c18fab9
+    SHA256=408589ba72b58d5e942071ed863a83fd96566cfd1e514945daa59defde528bbb
     ;;
   Darwin-arm64)
     ARCHIVE=treehouse-v${FM_TREEHOUSE_CI_VERSION}-darwin-arm64.tar.gz
-    SHA256=7ee5078f3d1f33c01196548797fce65408e459d53530b77d4ba56e074fa1c1a2
+    SHA256=1cb09bcfa830b4eec5e54beeaa71589adb9c5d828573dda0f5150e2d80cf13d5
     ;;
   Darwin-x86_64)
     ARCHIVE=treehouse-v${FM_TREEHOUSE_CI_VERSION}-darwin-amd64.tar.gz
-    SHA256=1cf44580a5837f995e1d3bb74f4fbd3112b642acd20406087d9735a8106112fd
+    SHA256=349afcc13c2beb20d846eb560a11b30e1a5cab8e2dfb22988a36aa7f213b5881
     ;;
   *)
     die "unsupported platform ${os}-${arch}; official Treehouse assets are linux/darwin amd64 and arm64"
@@ -68,7 +68,7 @@ fi
 [ "$ACTUAL_SHA256" = "$SHA256" ] || die "checksum mismatch for $ARCHIVE (expected $SHA256, got $ACTUAL_SHA256)"
 
 tar -xzf "$TMP/$ARCHIVE" -C "$TMP"
-# Archive layout: a single `treehouse` binary at the archive root (verified for v2.0.1).
+# Archive layout: a single `treehouse` binary at the archive root (verified for v2.3.0).
 if [ -f "$TMP/treehouse" ]; then
   BIN="$TMP/treehouse"
 elif [ -f "$TMP/treehouse-v${FM_TREEHOUSE_CI_VERSION}/treehouse" ]; then
@@ -82,7 +82,7 @@ mkdir -p "$DESTINATION"
 install -m 0755 "$BIN" "$DESTINATION/treehouse"
 
 installed_version=$("$DESTINATION/treehouse" --version 2>/dev/null | tr -d '[:space:]')
-# treehouse prints "v2.0.1" (leading v) on --version.
+# treehouse prints "v2.3.0" (leading v) on --version.
 case "$installed_version" in
   "v${FM_TREEHOUSE_CI_VERSION}"|"${FM_TREEHOUSE_CI_VERSION}") ;;
   *)
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 88fa2fcfabe..0f20fd29bbd 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -347,6 +347,17 @@
 # A ship task records the explicit mode/yolo it was passed; a secondmate spawn records
 # mode=secondmate, yolo=off, home=, and projects=; a scout records neither, and both the
 # success line and state/<id>.meta omit them.
+# A ship or scout spawn on a Treehouse-backed backend (every backend except orca)
+# acquires its slot with `treehouse get --root <root>`, where <root> is this
+# home's own CLI root (bin/fm-wake-lib.sh's fm_treehouse_home_root), and records
+# that absolute root as treehouse_root= in state/<id>.meta. A slot outside its pool
+# refuses the launch. A relaunch keeps the recorded treehouse_root= line; a record without
+# one predates the field and resolves its root from the slot path itself.
+# Fresh allocation and relaunch refuse a slot whose owner claim names another
+# canonical home with an extant task record, independently of runtime liveness.
+# A prior record in the same canonical home does not reserve a reusable slot;
+# this check leaves Treehouse's allocation eligibility and teardown's ownership
+# proof intact. Missing-home or unreadable claims refuse rather than guess.
 # Every fresh spawn or relaunch records a new spawn_gen= incarnation token so durable
 # consumers can distinguish a replacement worker that reuses the same task id.
 # When the home session's frozen trace-context decision is enabled (see
@@ -1046,6 +1057,7 @@ SPAWN_TASK_SET_LOCK_HELD=0
 SPAWN_TREEHOUSE_PROJECT_LOCK=
 SPAWN_TREEHOUSE_PROJECT_LOCK_HELD=0
 SPAWN_SLOT_CLAIMED=0
+SPAWN_TREEHOUSE_ROOT=
 RELAUNCH_REPLACEMENT_PENDING=0
 RELAUNCH_REPLACEMENT_BUSY_GEN=
 RELAUNCH_REPLACEMENT_HARNESS=
@@ -2703,6 +2715,33 @@ spawn_worktree_isolated() { # <path>
   return 0
 }
 
+spawn_refuse_live_foreign_claim() {
+  local worktree=$1 inspect_target=$2 owner_id owner_home owner_meta
+  fm_treehouse_slot_owner_state "$worktree" "$ID"
+  case "$FM_TREEHOUSE_SLOT_OWNER" in
+    absent) return 0 ;;
+    mine|other)
+      owner_id=$FM_TREEHOUSE_SLOT_OWNER_ID
+      owner_home=$FM_TREEHOUSE_SLOT_OWNER_HOME
+      if [ -z "$owner_home" ]; then
+        echo "error: Treehouse slot $worktree is claimed by task $owner_id without a home; refusing to launch without knowing which home owns it; inspect window $inspect_target" >&2
+        return 1
+      fi
+      if [ "$(real_path_or_raw "$owner_home")" = "$(real_path_or_raw "$FM_HOME")" ]; then
+        return 0
+      fi
+      owner_meta="$owner_home/state/$owner_id.meta"
+      if [ -e "$owner_meta" ] || [ -L "$owner_meta" ]; then
+        echo "error: Treehouse slot $worktree is still held by task $owner_id of foreign home $owner_home (record $owner_meta exists); refusing to launch; inspect window $inspect_target" >&2
+        return 1
+      fi
+      return 0
+      ;;
+  esac
+  echo "error: Treehouse slot $worktree has an unreadable owner claim; refusing to launch without knowing which home owns it; inspect window $inspect_target" >&2
+  return 1
+}
+
 validate_spawn_worktree() { # <source> <inspect-target>
   local source=$1 inspect_target=$2
   if ! spawn_worktree_isolated "$WT"; then
@@ -2946,6 +2985,9 @@ if [ "$RELAUNCH" -eq 1 ]; then
   # A secondmate's home already resolved WT above through the same validation a
   # fresh secondmate spawn uses; every other kind takes the recorded worktree.
   [ "$KIND" = secondmate ] || WT=$RELAUNCH_WT
+  if [ "$KIND" != secondmate ] && [ "$BACKEND" != orca ]; then
+    spawn_refuse_live_foreign_claim "$WT" "$T" || exit 1
+  fi
   WT_TARGET=$T
   SES=${T%%:*}
 else
@@ -3464,7 +3506,23 @@ if [ "$RELAUNCH" -eq 1 ]; then
   fi
   [ "$KIND" = secondmate ] || validate_spawn_worktree "relaunch" "$T"
 elif [ "$KIND" != secondmate ] && [ "$BACKEND" != orca ]; then
-  spawn_send_text_line "$WT_TARGET" 'treehouse get'
+  # Acquire the slot from THIS home's Treehouse root (bin/fm-wake-lib.sh's
+  # fm_treehouse_home_root owns the contract). Treehouse names a pool after the
+  # repository, so without an explicit root two homes holding clones of one
+  # remote share a single pool and can be handed each other's slots. The root
+  # is passed as --root, which overrides TREEHOUSE_ROOT and any treehouse.toml
+  # in the pane's own environment, and is recorded below as treehouse_root= so
+  # every later call on the slot uses the root it was actually taken from.
+  SPAWN_TREEHOUSE_ROOT=$(fm_treehouse_home_root "$FM_HOME" "$PROJ_ABS") || {
+    echo "error: could not resolve this home's Treehouse root for $FM_HOME; refusing to allocate from a pool another home may share" >&2
+    exit 1
+  }
+  mkdir -p -- "$SPAWN_TREEHOUSE_ROOT" 2>/dev/null || {
+    echo "error: could not create this home's Treehouse root $SPAWN_TREEHOUSE_ROOT" >&2
+    exit 1
+  }
+  SPAWN_TREEHOUSE_ROOT=$(CDPATH='' cd -- "$SPAWN_TREEHOUSE_ROOT" && pwd -P) || exit 1
+  spawn_send_text_line "$WT_TARGET" "treehouse get --root $(shell_quote "$SPAWN_TREEHOUSE_ROOT")"
 
   # Wait for the treehouse subshell: the pane's cwd moves from the project to the worktree.
   # Target the stable window id, not the name: if the name is ever lost (e.g. an
@@ -3537,7 +3595,12 @@ elif [ "$KIND" != secondmate ] && [ "$BACKEND" != orca ]; then
   # under its successor.
   # Written under the Treehouse project lock held from before slot allocation
   # through metadata publication, so no other spawn or return sees a half-claim.
+  spawn_refuse_live_foreign_claim "$WT" "$T" || exit 1
   if fm_treehouse_pool_slot "$PROJ_ABS" "$WT"; then
+    fm_treehouse_task_root "$SPAWN_TREEHOUSE_ROOT" "$WT" || {
+      echo "error: treehouse get entered $WT outside this home's Treehouse root ($FM_TREEHOUSE_ROOT_REASON); refusing to launch into a slot another home may own; inspect window $T" >&2
+      exit 1
+    }
     if ! fm_treehouse_slot_owner_claim "$WT" "$ID" "$FM_HOME"; then
       echo "error: could not claim Treehouse pool slot $WT for task $ID; refusing to launch a worker whose slot cannot later be proved to be its own; inspect window $T" >&2
       exit 1
@@ -4074,6 +4137,11 @@ preserve_relaunch_meta() {
   echo "endpoint_task_id=$ID"
   echo "worktree=$WT"
   echo "project=$PROJ_ABS"
+  # The Treehouse root the slot was taken from (fm_treehouse_home_root). Written
+  # only by the fresh spawn that ran `treehouse get`; a relaunch passes the
+  # recorded line through untouched, and a record without it predates the field
+  # and resolves its root from the slot's own path (fm_treehouse_task_root).
+  [ "$RELAUNCH" -eq 1 ] || [ -z "$SPAWN_TREEHOUSE_ROOT" ] || echo "treehouse_root=$SPAWN_TREEHOUSE_ROOT"
   echo "harness=$HARNESS"
   echo "kind=$KIND"
   [ -z "$MODE" ] || echo "mode=$MODE"
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index dcdac9ef2db..b7465b112df 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -161,6 +161,16 @@
 # leased home releases its durable treehouse lease so the pool slot is freed,
 # never left leased forever. If the treehouse return fails, teardown leaves the
 # leased home and state in place instead of hiding a still-held lease.
+# Treehouse root (per-home pools): every `treehouse return` on a task's slot
+# passes `--root <root>`, where <root> is reconciled by bin/fm-wake-lib.sh's
+# fm_treehouse_task_root between the record's treehouse_root= line and the root
+# the slot actually sits under. A record that predates the field (no
+# treehouse_root=) resolves to the slot's own root, so legacy slots drain through
+# the pool that allocated them with no migration; a record whose treehouse_root=
+# does not contain its worktree REFUSES before any mutation, because returning
+# through the wrong root would act on another home's slot. A secondmate home is
+# the primary's own durable lease from the firstmate repository's pool and is
+# returned without --root, exactly as it was leased.
 # Usage: fm-teardown.sh <task-id> [--force] [--legacy-record]
 #   --force skips ordinary-task dirty and landed-work checks, skips scout report
 #   checks, and discards secondmate child work for kind=secondmate. Only use it
@@ -1008,6 +1018,17 @@ elif [ "$TREEHOUSE_SLOT_LOCK_REQUIRED" = 1 ]; then
   echo "REFUSED: task $ID stopped naming a live Treehouse slot while teardown acquired its locks; nothing was changed" >&2
   exit 1
 fi
+# The root every Treehouse call on this task's slot uses (script header,
+# "Treehouse root"): the recorded treehouse_root= when it contains the slot, the
+# slot's own root for a record that predates the field, and a refusal otherwise.
+TEARDOWN_TREEHOUSE_ROOT=
+if [ -n "$EXPECTED_TREEHOUSE_PROJECT_LOCK" ]; then
+  fm_treehouse_task_root "$(fm_meta_get "$META" treehouse_root)" "$WT" || {
+    echo "REFUSED: task $ID's worktree $WT is not under its recorded Treehouse root ($FM_TREEHOUSE_ROOT_REASON); returning it through that root would act on another home's slot, so nothing was changed - not even with --force." >&2
+    exit 1
+  }
+  TEARDOWN_TREEHOUSE_ROOT=$FM_TREEHOUSE_TASK_ROOT
+fi
 MODE=$(grep '^mode=' "$META" | cut -d= -f2- || true)
 [ -n "$MODE" ] || MODE=no-mistakes
 
@@ -1635,13 +1656,18 @@ cleanup_stale_lock_for_safety_check() {
 
 # Return a worktree/home via `treehouse return --force`, tolerating a transient or
 # stale git index.lock left by a killed crew process. See the script header.
-teardown_treehouse_return() {
-  local dir=$1 cd_dir=$2 label=$3 post_cleanup_check=${4:-}
+# A nonempty <root> is passed as `--root <root>`, so the return acts on the pool
+# the slot was taken from (script header, "Treehouse root"); an empty <root>
+# leaves the pool to Treehouse's own resolution, as a secondmate home lease needs.
+teardown_treehouse_return() {  # <dir> <cd-dir> <label> [post-cleanup-check] [root]
+  local dir=$1 cd_dir=$2 label=$3 post_cleanup_check=${4:-} root=${5:-}
   local out lock attempt=0 max_retries lock_desc
+  local -a root_args=()
+  [ -z "$root" ] || root_args=(--root "$root")
 
   # Capture stdout+stderr so non-lock failures stay visible and lock failures can
   # be matched by signature even when the lock file is already gone mid-check.
-  if out=$( ( cd "$cd_dir" && treehouse return --force "$dir" ) 2>&1 ); then
+  if out=$( ( cd "$cd_dir" && treehouse return "${root_args[@]+"${root_args[@]}"}" --force "$dir" ) 2>&1 ); then
     [ -n "$out" ] && printf '%s\n' "$out"
     return 0
   fi
@@ -1666,7 +1692,7 @@ teardown_treehouse_return() {
     echo "teardown: $label return failed with transient git lock ($lock_desc); waiting ${TREEHOUSE_RETURN_LOCK_RETRY_WAIT_SECS}s and retrying ($attempt/${max_retries})" >&2
     sleep "$TREEHOUSE_RETURN_LOCK_RETRY_WAIT_SECS"
 
-    if out=$( ( cd "$cd_dir" && treehouse return --force "$dir" ) 2>&1 ); then
+    if out=$( ( cd "$cd_dir" && treehouse return "${root_args[@]+"${root_args[@]}"}" --force "$dir" ) 2>&1 ); then
       [ -n "$out" ] && printf '%s\n' "$out"
       echo "teardown: $label return succeeded on retry; lock cleared on its own" >&2
       return 0
@@ -1693,7 +1719,7 @@ teardown_treehouse_return() {
           return 1
         fi
       fi
-      if out=$( ( cd "$cd_dir" && treehouse return --force "$dir" ) 2>&1 ); then
+      if out=$( ( cd "$cd_dir" && treehouse return "${root_args[@]+"${root_args[@]}"}" --force "$dir" ) 2>&1 ); then
         [ -n "$out" ] && printf '%s\n' "$out"
         echo "teardown: $label return succeeded after stale-lock cleanup" >&2
         return 0
@@ -2816,6 +2842,10 @@ preflight_descendant_treehouse_slots() {
       continue
     fi
     fm_backend_validate_task_endpoint "$meta" "$task_id" || return 1
+    fm_treehouse_task_root "$(meta_value "$meta" treehouse_root)" "$worktree" || {
+      echo "REFUSED: child $task_id's worktree $worktree is not under its recorded Treehouse root ($FM_TREEHOUSE_ROOT_REASON); forced teardown changed nothing" >&2
+      return 1
+    }
     require_exclusive_worktree_slot_record "$meta" "$task_id" "$state" "$worktree" || return 1
     owner_rc=0
     require_owned_worktree_slot_record "$task_id" "$worktree" || owner_rc=$?
@@ -3038,7 +3068,7 @@ endpoint_close_refusal() {  # <subject> <backend> <target> <honors-force>
 }
 
 cleanup_firstmate_home_children() {
-  local home=$1 sub_state child_meta child_id child_t child_wt child_proj child_kind child_home child_backend child_orca_worktree_id child_return_rc child_busy_gen child_owner_rc
+  local home=$1 sub_state child_meta child_id child_t child_wt child_proj child_kind child_home child_backend child_orca_worktree_id child_return_rc child_busy_gen child_owner_rc child_root
   sub_state="$home/state"
   [ -d "$sub_state" ] || return 0
   for child_meta in "$sub_state"/*.meta; do
@@ -3115,7 +3145,18 @@ cleanup_firstmate_home_children() {
           "$child_wt/.opencode/plugins/fm-busy-state.js" \
           "$child_wt/.fm-grok-turnend" "$child_wt/.fm-kimi-turnend"
         if [ -n "$child_proj" ] && [ -d "$child_proj" ] && command -v treehouse >/dev/null 2>&1; then
-          if teardown_treehouse_return "$child_wt" "$child_proj" "child worktree"; then
+          # Only a recognized pool slot is returned through a root; the
+          # preflight above already refused a slot its recorded root does not
+          # contain, and the same reconciliation here picks the root to pass.
+          child_root=
+          if fm_treehouse_pool_slot "$child_proj" "$child_wt"; then
+            fm_treehouse_task_root "$(meta_value "$child_meta" treehouse_root)" "$child_wt" || {
+              echo "REFUSED: child $child_id's worktree $child_wt is not under its recorded Treehouse root ($FM_TREEHOUSE_ROOT_REASON); its slot was left untouched" >&2
+              return 1
+            }
+            child_root=$FM_TREEHOUSE_TASK_ROOT
+          fi
+          if teardown_treehouse_return "$child_wt" "$child_proj" "child worktree" "" "$child_root"; then
             fm_treehouse_slot_owner_release "$child_wt" "$child_id"
           else
             child_return_rc=$?
@@ -3442,7 +3483,7 @@ elif [ -d "$WT" ] && [ "$KIND" != secondmate ]; then
   if [ "$FORCE" != "--force" ] && [ "$KIND" != scout ] && [ "$KIND" != secondmate ]; then
     post_lock_cleanup_check=validate_worktree_teardown_safety
   fi
-  teardown_treehouse_return "$WT" "$PROJ" "worktree" "$post_lock_cleanup_check" || {
+  teardown_treehouse_return "$WT" "$PROJ" "worktree" "$post_lock_cleanup_check" "$TEARDOWN_TREEHOUSE_ROOT" || {
     echo "error: treehouse return failed for worktree $WT; teardown aborted" >&2
     exit 1
   }
diff --git a/bin/fm-test-run.sh b/bin/fm-test-run.sh
index 1f1bda6b8b9..0f580fc1aa4 100755
--- a/bin/fm-test-run.sh
+++ b/bin/fm-test-run.sh
@@ -369,7 +369,7 @@ family_for_basename() {
     fm-send-inbox.test.sh|fm-spawn-batch.test.sh|\
     fm-spawn-dispatch-profile.test.sh|fm-claude-trust.test.sh|\
     fm-trace-context-spawn.test.sh|fm-spawn-worktree-settle.test.sh|\
-    fm-teardown-endpoint-safety.test.sh)
+    fm-teardown-endpoint-safety.test.sh|fm-treehouse-pool-isolation.test.sh)
       printf '%s\n' backend-dispatch
       ;;
     fm-check-unregister.test.sh|fm-pr-check-security.test.sh|fm-pr-merge.test.sh|\
@@ -794,6 +794,7 @@ tests/fm-tmux-agent-liveness.test.sh 1516
 tests/fm-tool-update-check.test.sh 14176
 tests/fm-trace-context-lib.test.sh 209
 tests/fm-trace-context-spawn.test.sh 44702
+tests/fm-treehouse-pool-isolation.test.sh 15000
 tests/fm-turnend-guard.test.sh 42565
 tests/fm-update.test.sh 5212
 tests/fm-vendor-auth-probe.test.sh 43316
diff --git a/bin/fm-wake-lib.sh b/bin/fm-wake-lib.sh
index e3582cbc4da..f8323558881 100755
--- a/bin/fm-wake-lib.sh
+++ b/bin/fm-wake-lib.sh
@@ -1249,6 +1249,102 @@ fm_treehouse_pool_slot() {  # <project-dir> <worktree>
   [ "$project_common" = "$slot_common" ]
 }
 
+# Home-scoped Treehouse root: where THIS home's ship and scout slots live.
+#
+# Treehouse names a pool after the repository it serves, so two clones of one
+# remote - a project under the primary home and the same project under a
+# persistent secondmate home - resolve to ONE pool under Treehouse's default
+# root, and a launch from either home can be handed a slot the other home's task
+# is still working in. Firstmate therefore gives every home its own root:
+#
+#   <base>/fm-home-<hash>
+#
+# <base> is nonempty $TREEHOUSE_ROOT, else $HOME/.treehouse. Relative bases resolve
+# from the canonical spawning project directory, which must then be supplied.
+# <hash> is the first 12 hex digits of the Git blob hash
+# of the home's canonical path (symlinks resolved), so the root is deterministic
+# per home, distinct across homes even when their repositories share a remote or
+# a name, and free of every character the home path might carry. The root is
+# passed to Treehouse explicitly as `--root` (pools live in <root>/.treehouse), overriding TREEHOUSE_ROOT and
+# any repository treehouse.toml, and is recorded in the task's meta as
+# treehouse_root= so return, ownership checks, and crash recovery use the root
+# the slot was taken from rather than whatever the environment says later.
+#
+# Only ship and scout slots move to this root; bin/fm-home-seed.sh owns the
+# separate root-resolution contract for persistent secondmate home leases.
+#
+# A task whose meta predates treehouse_root= has its slot wherever Treehouse put
+# it at the time (the legacy shared pool). fm_treehouse_task_root resolves that
+# root from the slot path itself, so legacy slots drain through their original
+# pool with no migration, move, or reinterpretation.
+fm_treehouse_home_root() {  # [<fm-home>] [<project-dir>]
+  local home=${1:-$FM_HOME} project=${2:-} base hash
+  home=$(CDPATH='' cd -- "$home" 2>/dev/null && pwd -P) || return 1
+  base=${TREEHOUSE_ROOT:-${HOME:-}/.treehouse}
+  [ -n "${HOME:-}" ] || [ -n "${TREEHOUSE_ROOT:-}" ] || return 1
+  case "$base" in
+    /*) ;;
+    *)
+      [ -n "$project" ] || return 1
+      project=$(CDPATH='' cd -- "$project" 2>/dev/null && pwd -P) || return 1
+      base="$project/$base"
+      ;;
+  esac
+  case "$base" in *[$'\n\r']*) return 1 ;; esac
+  hash=$(printf '%s' "$home" | git hash-object --stdin 2>/dev/null) || return 1
+  [ -n "$hash" ] || return 1
+  printf '%s/fm-home-%s\n' "${base%/}" "${hash:0:12}"
+}
+
+# The resolved pool directory, not the CLI root: for
+# <cli-root>/.treehouse/<pool>/<slot>/<repo>, returns <cli-root>/.treehouse.
+fm_treehouse_slot_root() {  # <worktree>
+  local worktree=$1 slot
+  slot=$(CDPATH='' cd -- "$worktree" 2>/dev/null && pwd -P) || return 1
+  printf '%s\n' "$(dirname "$(dirname "$(dirname "$slot")")")"
+}
+
+# The root every Treehouse call on a task's slot must use, reconciled between
+# the task's recorded treehouse_root= and the slot's actual location.
+#
+# Sets FM_TREEHOUSE_TASK_ROOT to the CLI root and returns 0 when its .treehouse
+# directory matches the slot's resolved pool directory. An empty recorded root
+# (a legacy task) is inferred as the parent of that pool directory and checked
+# the same way. Returns 1 with
+# FM_TREEHOUSE_TASK_ROOT empty when the record names a root that does not
+# contain the slot - including a recorded root that no longer exists - because
+# a call issued against a root the slot is not under would be returning or
+# claiming another home's slot. FM_TREEHOUSE_ROOT_REASON names the
+# contradiction for the caller's refusal. Both are output globals, so call this
+# directly rather than in a command substitution.
+# shellcheck disable=SC2034 # Output globals, read by the sourcing caller.
+FM_TREEHOUSE_TASK_ROOT=
+# shellcheck disable=SC2034 # Output globals, read by the sourcing caller.
+FM_TREEHOUSE_ROOT_REASON=
+fm_treehouse_task_root() {  # <recorded-root> <worktree>
+  local recorded=$1 worktree=$2 actual expected
+  FM_TREEHOUSE_ROOT_REASON=
+  FM_TREEHOUSE_TASK_ROOT=
+  actual=$(fm_treehouse_slot_root "$worktree") || {
+    # shellcheck disable=SC2034 # Output global, read by the sourcing caller.
+    FM_TREEHOUSE_ROOT_REASON="worktree $worktree is not a readable directory"
+    return 1
+  }
+  [ -n "$recorded" ] || recorded=$(dirname "$actual")
+  expected=$(CDPATH='' cd -- "$recorded/.treehouse" 2>/dev/null && pwd -P) || {
+    # shellcheck disable=SC2034 # Output global, read by the sourcing caller.
+    FM_TREEHOUSE_ROOT_REASON="Treehouse pool directory $recorded/.treehouse does not exist, yet the worktree sits under $actual"
+    return 1
+  }
+  if [ "$expected" != "$actual" ]; then
+    # shellcheck disable=SC2034 # Output global, read by the sourcing caller.
+    FM_TREEHOUSE_ROOT_REASON="Treehouse root $recorded resolves to $expected, but the worktree sits under $actual"
+    return 1
+  fi
+  # shellcheck disable=SC2034 # Output global, read by the sourcing caller.
+  FM_TREEHOUSE_TASK_ROOT=$recorded
+}
+
 # Slot-owner claim: which task a Treehouse pool slot currently belongs to.
 #
 # Treehouse can record ownership durably: `treehouse get --lease --lease-holder`
diff --git a/docs/architecture.md b/docs/architecture.md
index 8079e672c21..20e7cc98f6b 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -355,6 +355,7 @@ A later merged poll consumes only that matching persisted value; with no match i
 Teardown is fail-closed for ship worktrees: dirty worktrees refuse, and committed work must be landed before the worktree is returned.
 A pool worktree is only returned after teardown passes the slot-ownership proof: a contradictory task record or a supported live endpoint refuses without touching either task, and no discard authority relaxes that.
 A slot's own owner claim, written by the spawn that takes it under the allocation lock and owned by [`bin/fm-wake-lib.sh`](../bin/fm-wake-lib.sh), covers a slot reassigned to a task that left no record the scan could reach: a claim naming a different task releases nothing - teardown warns, names the claimant, and finishes only the task's own cleanup - because Treehouse's own live process lease cannot answer ownership once the worker's exit releases it.
+[`configuration.md`](configuration.md#runtime-backend-configbackend--fm_backend) owns home-scoped Treehouse pool configuration, while [`bin/fm-spawn.sh`](../bin/fm-spawn.sh)'s header owns the foreign-home claim refusal and same-home reuse boundary.
 Allocation and return serialize on one project lock per machine-local Firstmate tree: every home reachable through local parent links shares that lock, and a home seeded from another machine anchors its own, because a lock taken on this filesystem is neither held nor observable across that boundary.
 Before the worktree is returned, teardown concludes the task's own no-mistakes run when it is parked at a gate, including a run whose head the task copy cannot resolve - the shared runs-ledger continuation proof is the only recognition for that case, so cleanup never orphans a parked run the pipeline advanced past the submitted head.
 [`bin/fm-teardown.sh`](../bin/fm-teardown.sh)'s header owns the landed-work proofs, slot-ownership proof, endpoint-close refusal, PR-discovery fallback, pre-teardown run conclusion, and stale-lock recovery procedure; [`tests/fm-teardown-endpoint-safety.test.sh`](../tests/fm-teardown-endpoint-safety.test.sh) and [`tests/fm-secondmate-safety.test.sh`](../tests/fm-secondmate-safety.test.sh) pin the slot-collision boundary.
diff --git a/docs/configuration.md b/docs/configuration.md
index cb6ead4c3c1..e96cda99756 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -129,6 +129,11 @@ Every routine firstmate backlog command therefore runs through [`bin/fm-tasks-ax
 For spawn-capable adapters, the runtime session-provider backend controls where task windows/endpoints are created, captured, sent to, watched, and killed.
 `tmux` is the verified reference backend (see [`docs/tmux-backend.md`](tmux-backend.md)); `herdr` has its own required CI lane (see [`docs/herdr-backend.md`](herdr-backend.md)); `zellij`, `orca`, and `cmux` remain experimental spawn backends with no dedicated real-backend CI lane (see [`docs/zellij-backend.md`](zellij-backend.md), [`docs/orca-backend.md`](orca-backend.md), and [`docs/cmux-backend.md`](cmux-backend.md)).
 Treehouse remains the worktree provider for tmux, herdr, zellij, and cmux, since herdr, zellij, and cmux are session providers only; Orca provides both the task worktree and terminal endpoint.
+Fresh ship and scout allocations use separate Treehouse pools for each canonical Firstmate home, including when homes hold clones of the same remote.
+`TREEHOUSE_ROOT` selects the base for these pools; relative values resolve from the spawning repository, and unset or empty values use `~/.treehouse`.
+The task records its absolute CLI root for later return and recovery, and a mismatch with the slot's actual pool refuses the operation.
+Legacy tasks keep their original pools, and secondmate home leases retain the provisioning behavior owned by [`bin/fm-home-seed.sh`](../bin/fm-home-seed.sh).
+[`bin/fm-wake-lib.sh`](../bin/fm-wake-lib.sh)'s `fm_treehouse_home_root` and `fm_treehouse_task_root` own root derivation and reconciliation; [`tests/fm-treehouse-pool-isolation.test.sh`](../tests/fm-treehouse-pool-isolation.test.sh) covers allocation, recovery, and return.
 New spawns choose the backend in this order: an explicit `--backend` flag that current authority for that exact task alone has authorized (a present captain instruction or the task's own accepted brief; never later-task precedent by analogy), then `FM_BACKEND`, then the first non-empty line of local gitignored `config/backend`, then runtime auto-detection from `$TMUX`, `HERDR_ENV=1`, or cmux runtime signals, then default `tmux`.
 If more than one runtime marker is present, detection resolves innermost-first: `$TMUX` is checked before `HERDR_ENV=1`, which is checked before cmux's primary `CMUX_WORKSPACE_ID` marker and its documented fallback signals - tmux or herdr started from inside a cmux terminal is the innermost, currently-executing layer, while cmux itself (a terminal application, not a nestable multiplexer) is always checked last.
 See [`docs/cmux-backend.md`](cmux-backend.md#runtime-detection) for why cmux can be selected when `CMUX_WORKSPACE_ID` is absent.
@@ -471,7 +476,8 @@ That delta is owned in code by `fm_backend_required_tools` in `bin/fm-backend.sh
 Backend tool availability uses the adapter's own executable resolver, so bootstrap and spawn agree on supported non-`PATH` locations such as cmux's bundled CLI.
 An unknown resolved backend emits `BACKEND_INVALID` and blocks dispatch instead of silently dropping its dependency delta or falling back to tmux.
 Orca provides both the task worktree and terminal endpoint (see "Runtime backend" above), so `backend=orca` requires only `orca` on top of the universal toolchain and skips both `treehouse` and every other backend's session CLI.
-A herdr, zellij, or cmux home is therefore never told `tmux` is missing, and the `treehouse` durable-lease upgrade check runs only for the backends that actually use treehouse.
+A herdr, zellij, or cmux home is therefore never told `tmux` is missing.
+For backends that use Treehouse, bootstrap requires a successful `treehouse get --help` probe advertising both `--lease` and `--root`; an incompatible installation produces an upgrade diagnostic with the install command.
 When `config/crew-dispatch.json` exists, bootstrap also requires `jq` for dispatch profile validation.
 When Relay is opted in, bootstrap also requires `curl` and `jq` before arming the relay poll shim.
 `tasks-axi` and `quota-axi` are essential bootstrap tools in every profile.
@@ -1078,6 +1084,7 @@ FM_WATCH_TRIAGE_LOG_MAX_BYTES=262144   # size cap for the watcher's absorbed-wak
 FM_FLEET_SYNC_BOOTSTRAP_TIMEOUT=     # optional seconds allowed for bootstrap's best-effort clone refresh; unset/blank defaults to max(20, 5 + 3 * origin-backed-project-count)
 FM_FLEET_PRUNE=1        # set to 0 to skip pruning local branches whose upstream is gone
 FM_STALE_WORKTREE_LOCK_AGE_SECS=30       # min mtime age before fm-teardown.sh treats a leftover worktree git index.lock as provably stale
+TREEHOUSE_ROOT=          # optional worker-pool base; see "Runtime backend" for root selection
 FM_TREEHOUSE_RETURN_LOCK_RETRIES=3        # retries after a treehouse return fails on the transient git index.lock signature
 FM_TREEHOUSE_RETURN_LOCK_RETRY_WAIT_SECS=1 # seconds fm-teardown.sh waits before each retry after that signature
 FM_STALE_WORKTREE_LOCK_RETRY_WAIT_SECS=   # legacy alias for FM_TREEHOUSE_RETURN_LOCK_RETRY_WAIT_SECS when the new variable is unset
diff --git a/tests/fm-bootstrap.test.sh b/tests/fm-bootstrap.test.sh
index 561f8100aa1..61f8c60e85b 100755
--- a/tests/fm-bootstrap.test.sh
+++ b/tests/fm-bootstrap.test.sh
@@ -71,7 +71,8 @@ if [ "${1:-}" = get ] && [ "${2:-}" = --help ]; then
   else
     printf '%s\n' 'Usage: treehouse get'
   fi
-  exit 0
+  [ "${FM_FAKE_TREEHOUSE_ROOT_HELP:-1}" = 0 ] || printf '%s\n' '  --root string'
+  exit "${FM_FAKE_TREEHOUSE_HELP_EXIT:-0}"
 fi
 exit 0
 SH
@@ -687,6 +688,33 @@ ROWS
   pass "bootstrap: JSON-emitting backends require jq (their genuine dep), never tmux"
 }
 
+test_treehouse_root_check_follows_resolved_backend() {
+  local backend scenario case_dir fakebin out root_help help_exit
+  for backend in tmux herdr zellij cmux orca; do
+    for scenario in supported missing-root failed-help; do
+      case_dir="$TMP_ROOT/treehouse-root-$backend-$scenario"
+      mkdir -p "$case_dir/home/config"
+      printf '%s\n' "$backend" > "$case_dir/home/config/backend"
+      fakebin=$(make_fake_toolchain "$case_dir")
+      fm_fake_exit0 "$fakebin" "$backend" jq
+      root_help=1
+      help_exit=0
+      [ "$scenario" != missing-root ] || root_help=0
+      [ "$scenario" != failed-help ] || help_exit=1
+      out=$(PATH="$fakebin:$BASE_PATH" FM_HOME="$case_dir/home" FM_ROOT_OVERRIDE="$case_dir/home" \
+        FM_FAKE_TREEHOUSE_LEASE_HELP=1 FM_FAKE_TREEHOUSE_ROOT_HELP="$root_help" \
+        FM_FAKE_TREEHOUSE_HELP_EXIT="$help_exit" "$ROOT/bin/fm-bootstrap.sh")
+      if [ "$backend" = orca ] || [ "$scenario" = supported ]; then
+        [ -z "$out" ] || fail "$backend/$scenario: unexpected diagnostic: $out"
+      else
+        [ "$out" = 'MISSING: treehouse (install: curl -fsSL https://kunchenguid.github.io/treehouse/install.sh | sh)' ] \
+          || fail "$backend/$scenario: missing actionable Treehouse upgrade: $out"
+      fi
+    done
+  done
+  pass "bootstrap requires Treehouse root support only for Treehouse-backed runtimes"
+}
+
 test_treehouse_lease_check_follows_resolved_backend() {
   local case_dir fakebin out
   # A treehouse that lacks durable --lease support is only a problem for a backend
@@ -1178,6 +1206,7 @@ test_cmux_bundled_cli_satisfies_dependency
 test_unknown_backend_reports_invalid_configuration
 test_json_backends_require_jq_not_tmux
 test_treehouse_lease_check_follows_resolved_backend
+test_treehouse_root_check_follows_resolved_backend
 test_fleet_sync_timeout_scales_with_origin_backed_project_count
 test_fleet_sync_timeout_floor_preserves_small_fleets
 test_fleet_sync_timeout_explicit_override_wins
diff --git a/tests/fm-secondmate-safety.test.sh b/tests/fm-secondmate-safety.test.sh
index 7a69e15fe86..865595ef062 100755
--- a/tests/fm-secondmate-safety.test.sh
+++ b/tests/fm-secondmate-safety.test.sh
@@ -1941,12 +1941,12 @@ test_secondmate_force_teardown_refuses_duplicated_child_slot() {
   home="$TMP_ROOT/force-duplicate-slot-home"
   subhome="$TMP_ROOT/force-duplicate-slot-subhome"
   childproj="$subhome/projects/alpha"
-  childwt="$TMP_ROOT/force-duplicate-slot-pool/1/alpha"
+  childwt="$TMP_ROOT/.treehouse/force-duplicate-slot-pool/1/alpha"
   err="$TMP_ROOT/force-duplicate-slot.err"
   mkdir -p "$home/state" "$home/data" "$subhome/state" "$(dirname "$childwt")"
   fm_git_worktree "$childproj" "$childwt" duplicate-child
   printf '{"worktrees":[{"name":"1","path":"%s"}]}\n' "$childwt" \
-    > "$TMP_ROOT/force-duplicate-slot-pool/treehouse-state.json"
+    > "$TMP_ROOT/.treehouse/force-duplicate-slot-pool/treehouse-state.json"
   printf 'domain\n' > "$subhome/.fm-secondmate-home"
   cat > "$home/state/domain.meta" <<EOF
 window=firstmate:fm-domain
@@ -1995,12 +1995,12 @@ test_secondmate_force_teardown_preserves_child_on_unproven_lock() {
   home="$TMP_ROOT/force-lock-home"
   subhome="$TMP_ROOT/force-lock-subhome"
   childproj="$subhome/projects/alpha"
-  childwt="$TMP_ROOT/force-lock-child-pool/1/alpha"
+  childwt="$TMP_ROOT/.treehouse/force-lock-child-pool/1/alpha"
   err="$TMP_ROOT/force-lock-child.err"
   mkdir -p "$home/state" "$home/data" "$subhome/state" "$(dirname "$childwt")"
   fm_git_worktree "$childproj" "$childwt" force-child-lock
   printf '{"worktrees":[{"name":"1","path":"%s"}]}\n' "$childwt" \
-    > "$TMP_ROOT/force-lock-child-pool/treehouse-state.json"
+    > "$TMP_ROOT/.treehouse/force-lock-child-pool/treehouse-state.json"
   printf 'domain\n' > "$subhome/.fm-secondmate-home"
   cat > "$home/state/domain.meta" <<EOF
 window=firstmate:fm-domain
diff --git a/tests/fm-secondmate-sync.test.sh b/tests/fm-secondmate-sync.test.sh
index 1e5d2290f32..bb4dfcb0c6c 100755
--- a/tests/fm-secondmate-sync.test.sh
+++ b/tests/fm-secondmate-sync.test.sh
@@ -362,7 +362,7 @@ SH
   cat > "$fakebin/treehouse" <<'SH'
 #!/usr/bin/env bash
 if [ "${1:-}" = get ] && [ "${2:-}" = --help ]; then
-  printf '%s\n' 'Usage: treehouse get [--lease]'
+  printf '%s\n' 'Usage: treehouse get [--lease] [--root string]'
 fi
 exit 0
 SH
diff --git a/tests/fm-session-start.test.sh b/tests/fm-session-start.test.sh
index b3d6aba1458..220322605c6 100755
--- a/tests/fm-session-start.test.sh
+++ b/tests/fm-session-start.test.sh
@@ -90,7 +90,7 @@ SH
   cat > "$fakebin/treehouse" <<'SH'
 #!/usr/bin/env bash
 if [ "${1:-}" = get ] && [ "${2:-}" = --help ]; then
-  printf '%s\n' 'Usage: treehouse get [--lease]'
+  printf '%s\n' 'Usage: treehouse get [--lease] [--root string]'
   exit 0
 fi
 exit 0
diff --git a/tests/fm-spawn-pool-base-freshen.test.sh b/tests/fm-spawn-pool-base-freshen.test.sh
index 2d39f3607ca..8d229674994 100755
--- a/tests/fm-spawn-pool-base-freshen.test.sh
+++ b/tests/fm-spawn-pool-base-freshen.test.sh
@@ -676,11 +676,18 @@ test_stale_pin_beside_other_dirt_reports_one_verdict() {
   pass "a stale pin beside other dirt yields the conservative refusal alone, with no stale-pin line"
 }
 
-# Re-lay a case's pooled worktree as a managed Treehouse slot: <pool>/<slot>/<repo>
+# Re-lay a case's pooled worktree as a managed Treehouse slot: <root>/<pool>/<slot>/<repo>
 # with the pool's state file beside the slot, which is the shape fm-spawn claims
-# for its task. Rewrites POOL_DIR to the relocated checkout.
+# for its task. The pool sits under the home-scoped Treehouse root fm-spawn asks
+# Treehouse for (bin/fm-wake-lib.sh fm_treehouse_home_root, resolved against the
+# same throwaway HOME fm_test_run_spawn launches with), because a slot anywhere
+# else is refused as another home's. Rewrites POOL_DIR to the relocated checkout.
 lay_out_as_pool_slot() {
-  local slot_root="$CASE_DIR/slots"
+  local home_root slot_root
+  mkdir -p "$HOME_DIR/user-home"
+  home_root=$(HOME="$HOME_DIR/user-home" FM_HOME="$HOME_DIR" bash -c '. "$1"; fm_treehouse_home_root "$2"' _ \
+    "$ROOT/bin/fm-wake-lib.sh" "$HOME_DIR") || fail "could not resolve the case home's Treehouse root"
+  slot_root="$home_root/.treehouse/project-pool"
   mkdir -p "$slot_root/1"
   git -C "$PROJECT_DIR" worktree move "$POOL_DIR" "$slot_root/1/project"
   printf '{"worktrees":[{"name":"1","path":"%s"}]}\n' "$slot_root/1/project" \
@@ -720,7 +727,7 @@ test_pool_slot_claim_follows_the_spawn_outcome() {
   out=$(run_spawn "$id" --scout)
   status=$?
   [ "$status" -ne 0 ] || fail "spawn launched a worker on a slot it could not claim"
-  assert_contains "$out" "could not claim Treehouse pool slot" \
+  assert_contains "$out" "has an unreadable owner claim" \
     "spawn did not name the unclaimable slot as the reason"
   [ -d "$SLOT_CLAIM" ] || fail "spawn replaced the directory blocking its slot claim"
   [ ! -e "$HOME_DIR/state/$id.meta" ] || fail "spawn published a record for an unclaimable slot"
diff --git a/tests/fm-startup-memory-budget.test.sh b/tests/fm-startup-memory-budget.test.sh
index fe5a5439f62..21c8566dadc 100755
--- a/tests/fm-startup-memory-budget.test.sh
+++ b/tests/fm-startup-memory-budget.test.sh
@@ -38,7 +38,7 @@ SH
   cat > "$fakebin/treehouse" <<'SH'
 #!/usr/bin/env bash
 if [ "${1:-}" = get ] && [ "${2:-}" = --help ]; then
-  printf '%s\n' 'Usage: treehouse get [--lease]'
+  printf '%s\n' 'Usage: treehouse get [--lease] [--root string]'
 fi
 SH
   cat > "$fakebin/no-mistakes" <<'SH'
diff --git a/tests/fm-tangle-guard.test.sh b/tests/fm-tangle-guard.test.sh
index d59864e0dae..aac7cee73c9 100755
--- a/tests/fm-tangle-guard.test.sh
+++ b/tests/fm-tangle-guard.test.sh
@@ -278,7 +278,7 @@ test_spawn_tmux_window_construction() {
     "must disable allow-rename on the spawned window"
 
   # Bug 2 fix (b): treehouse-get and the worktree wait loop target the stable id.
-  assert_grep "send-keys -t @spawnwid treehouse get Enter" "$rec" \
+  assert_grep "send-keys -t @spawnwid treehouse get --root " "$rec" \
     "treehouse get must be sent to the stable window id"
   assert_grep "display-message -p -t @spawnwid #{pane_current_path}" "$rec" \
     "the worktree wait loop must query the stable window id, not the name"
diff --git a/tests/fm-teardown-endpoint-safety.test.sh b/tests/fm-teardown-endpoint-safety.test.sh
index 4002cf4df3e..86a51f59b2d 100755
--- a/tests/fm-teardown-endpoint-safety.test.sh
+++ b/tests/fm-teardown-endpoint-safety.test.sh
@@ -38,19 +38,19 @@ SH
 mark_case_as_treehouse_pool() {  # <case>
   local dir=$1
   rm -rf "$dir/worktree"
-  mkdir -p "$dir/pool/1"
+  mkdir -p "$dir/.treehouse/pool/1"
   git -C "$dir/project" -c user.name=test -c user.email=test@example.invalid \
     commit --allow-empty -qm pool-fixture
-  git -C "$dir/project" worktree add -q --detach "$dir/pool/1/project"
-  ln -s "pool/1/project" "$dir/worktree"
+  git -C "$dir/project" worktree add -q --detach "$dir/.treehouse/pool/1/project"
+  ln -s ".treehouse/pool/1/project" "$dir/worktree"
   printf '{"worktrees":[{"name":"1","path":"%s"}]}\n' \
-    "$dir/pool/1/project" > "$dir/pool/treehouse-state.json"
+    "$dir/.treehouse/pool/1/project" > "$dir/.treehouse/pool/treehouse-state.json"
   : > "$dir/worktree/sentinel"
 }
 
 claim_pool_slot() {  # <case> <task-id> [home]
   local dir=$1 id=$2 home=${3:-$1/home}
-  printf 'task=%s\nhome=%s\n' "$id" "$home" > "$dir/pool/1/.fm-slot-owner"
+  printf 'task=%s\nhome=%s\n' "$id" "$home" > "$dir/.treehouse/pool/1/.fm-slot-owner"
 }
 
 run_case() {  # <case> <id>
@@ -868,10 +868,10 @@ test_remote_layout_homes_serialize_on_one_project_lock() {
 assert_reassigned_slot_left_alone() {  # <case> <id> <other> <description>
   local dir=$1 id=$2 other=$3 description=$4
   assert_absent "$dir/home/state/$id.meta" "$description: the stale task's own record was not removed"
-  assert_present "$dir/pool/1/.fm-slot-owner" "$description: another task's slot claim was removed"
-  assert_contains "$(cat "$dir/pool/1/.fm-slot-owner")" "task=$other" \
+  assert_present "$dir/.treehouse/pool/1/.fm-slot-owner" "$description: another task's slot claim was removed"
+  assert_contains "$(cat "$dir/.treehouse/pool/1/.fm-slot-owner")" "task=$other" \
     "$description: another task's slot claim was rewritten"
-  assert_present "$dir/pool/1/project/.git" "$description: the reassigned slot's checkout was removed"
+  assert_present "$dir/.treehouse/pool/1/project/.git" "$description: the reassigned slot's checkout was removed"
   ! grep -Fq "treehouse <return>" "$dir/runtime.log" \
     || fail "$description: the reassigned slot was returned to the pool: $(cat "$dir/runtime.log")"
   assert_contains "$(cat "$dir/stderr")" "$other" \
@@ -948,7 +948,7 @@ test_reassigned_pool_slot_finishes_own_cleanup_without_touching_the_slot() {
   fm_write_meta "$dir/home/state/$id.meta" \
     "window=firstmate:fm-$id" "endpoint_task_id=$id" \
     "worktree=$dir/worktree" "project=$dir/project" "kind=scout"
-  printf 'not-a-claim\n' > "$dir/pool/1/.fm-slot-owner"
+  printf 'not-a-claim\n' > "$dir/.treehouse/pool/1/.fm-slot-owner"
 
   set +e
   run_case "$dir" "$id" > "$dir/stdout" 2> "$dir/stderr"
@@ -956,11 +956,11 @@ test_reassigned_pool_slot_finishes_own_cleanup_without_touching_the_slot() {
   set -e
   [ "$rc" -ne 0 ] || fail "teardown returned a pool slot whose claim could not be read"
   assert_present "$dir/worktree/sentinel" "teardown reset a pool slot whose claim could not be read"
-  assert_present "$dir/pool/1/.fm-slot-owner" "teardown removed an unreadable slot claim"
+  assert_present "$dir/.treehouse/pool/1/.fm-slot-owner" "teardown removed an unreadable slot claim"
   assert_present "$dir/home/state/$id.meta" "teardown removed the task record on an unreadable claim"
   [ ! -s "$dir/runtime.log" ] \
     || fail "teardown reached the runtime on an unreadable slot claim: $(cat "$dir/runtime.log")"
-  assert_contains "$(cat "$dir/stderr")" "$dir/pool/1/.fm-slot-owner" \
+  assert_contains "$(cat "$dir/stderr")" "$dir/.treehouse/pool/1/.fm-slot-owner" \
     "unreadable-claim refusal should name the claim file to inspect"
 
   pass "fm-teardown: a pool slot claimed by another task is left alone while the task's own cleanup finishes"
@@ -981,7 +981,7 @@ test_own_and_absent_slot_claims_still_tear_down() {
   run_case "$dir" "$id" > "$dir/stdout" 2> "$dir/stderr" \
     || fail "teardown of a task holding its own slot claim failed: $(cat "$dir/stderr")"
   assert_absent "$dir/home/state/$id.meta" "own-claim teardown left the task record"
-  assert_absent "$dir/pool/1/.fm-slot-owner" "own-claim teardown left its spent slot claim behind"
+  assert_absent "$dir/.treehouse/pool/1/.fm-slot-owner" "own-claim teardown left its spent slot claim behind"
   grep -Fq "treehouse <return>" "$dir/runtime.log" \
     || fail "own-claim teardown did not return its own pool slot: $(cat "$dir/runtime.log")"
 
diff --git a/tests/fm-treehouse-pool-isolation.test.sh b/tests/fm-treehouse-pool-isolation.test.sh
new file mode 100755
index 00000000000..27d5753303e
--- /dev/null
+++ b/tests/fm-treehouse-pool-isolation.test.sh
@@ -0,0 +1,469 @@
+#!/usr/bin/env bash
+# Regression tests for the home-scoped Treehouse root contract
+# (bin/fm-wake-lib.sh fm_treehouse_home_root / fm_treehouse_task_root, carried by
+# bin/fm-spawn.sh and bin/fm-teardown.sh).
+#
+# Treehouse names a pool after the repository it serves, so two Firstmate homes
+# holding clones of one remote - the primary and a persistent secondmate -
+# resolved to ONE shared pool and could be handed each other's live slots. Every
+# home now allocates from its own deterministic root, records that root in the
+# task's meta, and returns through it; a record that predates the field keeps
+# resolving its original pool, and a root that does not contain the slot refuses.
+set -u
+
+# shellcheck source=tests/fixtures.sh
+. "$(dirname "${BASH_SOURCE[0]}")/fixtures.sh"
+
+SPAWN="$ROOT/bin/fm-spawn.sh"
+TEARDOWN="$ROOT/bin/fm-teardown.sh"
+WAKE_LIB="$ROOT/bin/fm-wake-lib.sh"
+TMP_ROOT=$(fm_test_tmproot fm-treehouse-pool-isolation)
+# Every Treehouse root the code under test derives lands under this base, never
+# under the operator's live ~/.treehouse.
+export TREEHOUSE_ROOT="$TMP_ROOT/treehouse-base"
+mkdir -p "$TREEHOUSE_ROOT"
+
+home_root() {  # <fm-home>
+  FM_HOME="$1" bash -c '. "$1"; fm_treehouse_home_root "$2" "$3"' _ "$WAKE_LIB" "$1" "${2:-}"
+}
+
+# --- fake runtime -----------------------------------------------------------
+# The fake tmux answers the pane-path poll with FM_FAKE_PANE_PATH and appends
+# every send-keys line to FM_FAKE_TMUX_LOG, so the test reads the exact
+# `treehouse get` line the worker's pane received.
+make_fakebin() {  # <dir>
+  local dir=$1 fakebin
+  fakebin=$(fm_fakebin "$dir")
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "$*" in
+  *"#{pane_current_command}"*) printf 'bash\n'; exit 0 ;;
+  *"#{pane_current_path}"*) printf '%s\n' "${FM_FAKE_PANE_PATH:-}"; exit 0 ;;
+esac
+case "${1:-}" in
+  list-windows) [ -z "${FM_FAKE_RELAUNCH_ID:-}" ] || printf 'fm-%s\n' "$FM_FAKE_RELAUNCH_ID"; exit 0 ;;
+  display-message) printf 'firstmate\n'; exit 0 ;;
+  send-keys) printf '%s\n' "$*" >> "${FM_FAKE_TMUX_LOG:-/dev/null}"; exit 0 ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/tmux"
+  # `treehouse return ...` is logged so a teardown test can read the root it used.
+  cat > "$fakebin/treehouse" <<'SH'
+#!/usr/bin/env bash
+printf 'treehouse' >> "${FM_FAKE_TREEHOUSE_LOG:-/dev/null}"
+printf ' <%s>' "$@" >> "${FM_FAKE_TREEHOUSE_LOG:-/dev/null}"
+printf '\n' >> "${FM_FAKE_TREEHOUSE_LOG:-/dev/null}"
+exit 0
+SH
+  chmod +x "$fakebin/treehouse"
+  printf '%s\n' "$fakebin"
+}
+
+# make_home <dir> <task-id>: a Firstmate home with a brief for the task.
+make_home() {
+  local home=$1 id=$2
+  mkdir -p "$home/data/$id" "$home/projects" "$home/state" "$home/config"
+  printf 'codex\n' > "$home/config/crew-harness"
+  cat > "$home/data/$id/brief.md" <<EOF
+# Task
+## Captain's intent
+Exercise per-home Treehouse allocation for $id.
+
+## Firstmate spec
+Record the slot and its root.
+EOF
+  touch "$home/state/.last-watcher-beat"
+}
+
+# make_pool_slot <project> <root> <pool-name> <slot>: a Treehouse-shaped slot
+# <root>/.treehouse/<pool-name>/<slot>/project, a linked worktree of <project>, with the
+# pool's state file, exactly as fm_treehouse_pool_slot recognizes it.
+make_pool_slot() {
+  local project=$1 root=$2/.treehouse pool=$3 slot=$4 wt
+  wt="$root/$pool/$slot/project"
+  mkdir -p "$root/$pool/$slot"
+  git -C "$project" worktree add -q --detach "$wt"
+  printf '{"worktrees":[{"name":"%s","path":"%s"}]}\n' "$slot" "$wt" > "$root/$pool/treehouse-state.json"
+  printf '%s\n' "$wt"
+}
+
+run_spawn() {  # <home> <project> <id> <pane-path> <fakebin> <tmux-log>
+  local home=$1 project=$2 id=$3 pane=$4 fakebin=$5 log=$6
+  local -a args=("$id" "$project" --mode no-mistakes --yolo off)
+  [ "${7:-}" != relaunch ] || args=("$id" --relaunch)
+  FM_ROOT_OVERRIDE='' FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
+    FM_PROJECTS_OVERRIDE="$home/projects" FM_CONFIG_OVERRIDE="$home/config" \
+    FM_SPAWN_NO_GUARD=1 TMUX="fake,1,0" \
+    FM_FAKE_PANE_PATH="$pane" FM_FAKE_TMUX_LOG="$log" \
+    PATH="$fakebin:$PATH" \
+    "$SPAWN" "${args[@]}" 2>&1
+}
+
+run_teardown() {  # <home> <id> <fakebin> <treehouse-log>
+  local home=$1 id=$2 fakebin=$3 log=$4
+  FM_HOME="$home" FM_ROOT_OVERRIDE="$ROOT" FM_FAKE_TREEHOUSE_LOG="$log" \
+    PATH="$fakebin:$PATH" "$TEARDOWN" "$id" --force
+}
+
+# --- root contract ----------------------------------------------------------
+
+test_home_root_is_deterministic_distinct_and_canonical() {
+  local dir=$TMP_ROOT/root-contract a b again via_link
+  mkdir -p "$dir/home-a" "$dir/home-b"
+  ln -s "$dir/home-a" "$dir/home-a-link"
+  a=$(home_root "$dir/home-a") || fail "home root for home-a did not resolve"
+  b=$(home_root "$dir/home-b") || fail "home root for home-b did not resolve"
+  again=$(home_root "$dir/home-a") || fail "second home root for home-a did not resolve"
+  via_link=$(home_root "$dir/home-a-link") || fail "home root through a symlink did not resolve"
+  [ "$a" = "$again" ] || fail "home root is not deterministic: $a vs $again"
+  [ "$a" = "$via_link" ] || fail "home root differs through a symlink to the same home: $a vs $via_link"
+  [ "$a" != "$b" ] || fail "two homes resolved to the same Treehouse root: $a"
+  case "$a" in
+    "$TREEHOUSE_ROOT"/fm-home-[0-9a-f]*) ;;
+    *) fail "home root is not <base>/fm-home-<hash> under TREEHOUSE_ROOT: $a" ;;
+  esac
+  case "$a" in *[!A-Za-z0-9/._-]*) fail "home root carries characters unsafe for a path: $a" ;; esac
+  pass "fm_treehouse_home_root: deterministic per canonical home, distinct across homes, path-safe under the Treehouse base"
+}
+
+# --- two homes, one remote --------------------------------------------------
+
+# The live incident: the primary and a secondmate each hold a clone of the same
+# remote. Each spawn must ask Treehouse for a slot under its own home's root and
+# record that root; the two roots must differ although the repositories share a
+# remote and a name.
+test_two_homes_with_clones_of_one_repo_allocate_to_different_roots() {
+  local dir=$TMP_ROOT/two-homes upstream fakebin
+  local home_a=$dir/home-a home_b=$dir/home-b proj_a proj_b root_a root_b wt_a wt_b out
+  mkdir -p "$dir"
+  fakebin=$(make_fakebin "$dir")
+  fm_git_init_commit "$dir/upstream"
+  upstream="$dir/upstream"
+  make_home "$home_a" task-a
+  make_home "$home_b" task-b
+  git clone -q "$upstream" "$home_a/projects/shared-repo"
+  git clone -q "$upstream" "$home_b/projects/shared-repo"
+  proj_a="$home_a/projects/shared-repo"
+  proj_b="$home_b/projects/shared-repo"
+  root_a=$(home_root "$home_a") || fail "root for home-a did not resolve"
+  root_b=$(home_root "$home_b") || fail "root for home-b did not resolve"
+  [ "$root_a" != "$root_b" ] || fail "clones of one repo in two homes resolved to one root: $root_a"
+  # Treehouse would name both pools identically; place each under its home's root.
+  wt_a=$(make_pool_slot "$proj_a" "$root_a" shared-repo-e814d1 1)
+  wt_b=$(make_pool_slot "$proj_b" "$root_b" shared-repo-e814d1 1)
+
+  out=$(run_spawn "$home_a" "$proj_a" task-a "$wt_a" "$fakebin" "$dir/tmux-a.log") \
+    || fail "spawn from home-a failed: $out"
+  out=$(run_spawn "$home_b" "$proj_b" task-b "$wt_b" "$fakebin" "$dir/tmux-b.log") \
+    || fail "spawn from home-b failed: $out"
+
+  grep -Fq "treehouse get --root '$root_a'" "$dir/tmux-a.log" \
+    || fail "home-a's pane did not receive treehouse get --root '$root_a': $(cat "$dir/tmux-a.log")"
+  grep -Fq "treehouse get --root '$root_b'" "$dir/tmux-b.log" \
+    || fail "home-b's pane did not receive treehouse get --root '$root_b': $(cat "$dir/tmux-b.log")"
+  ! grep -Fq "$root_b" "$dir/tmux-a.log" || fail "home-a's pane was pointed at home-b's root"
+  assert_grep "treehouse_root=$root_a" "$home_a/state/task-a.meta" "home-a's record did not carry its Treehouse root"
+  assert_grep "treehouse_root=$root_b" "$home_b/state/task-b.meta" "home-b's record did not carry its Treehouse root"
+  assert_grep "worktree=$wt_a" "$home_a/state/task-a.meta" "home-a's record did not carry its slot"
+  assert_grep "task=task-a" "$root_a/.treehouse/shared-repo-e814d1/1/.fm-slot-owner" "home-a's slot was not claimed for task-a"
+  assert_grep "task=task-b" "$root_b/.treehouse/shared-repo-e814d1/1/.fm-slot-owner" "home-b's slot was not claimed for task-b"
+  pass "fm-spawn: two homes with clones of one repo allocate under two distinct home-scoped Treehouse roots and record them"
+}
+
+# --- teardown through the recorded root -------------------------------------
+
+test_teardown_returns_through_recorded_root() {
+  local dir=$TMP_ROOT/teardown-recorded home=$TMP_ROOT/teardown-recorded/home fakebin root wt
+  mkdir -p "$dir"
+  fakebin=$(make_fakebin "$dir")
+  make_home "$home" task-r
+  fm_git_init_commit "$home/projects/repo"
+  root=$(home_root "$home") || fail "root did not resolve"
+  wt=$(make_pool_slot "$home/projects/repo" "$root" repo-abc123 1)
+  printf 'task=task-r\nhome=%s\n' "$home" > "$root/.treehouse/repo-abc123/1/.fm-slot-owner"
+  fm_write_meta "$home/state/task-r.meta" \
+    "window=firstmate:fm-task-r" "endpoint_task_id=task-r" \
+    "worktree=$wt" "project=$home/projects/repo" "treehouse_root=$root" "kind=scout"
+  run_teardown "$home" task-r "$fakebin" "$dir/treehouse.log" > "$dir/stdout" 2> "$dir/stderr" \
+    || fail "teardown through the recorded root failed: $(cat "$dir/stderr")"
+  grep -Fq "treehouse <return> <--root> <$root> <--force> <$wt>" "$dir/treehouse.log" \
+    || fail "teardown did not return the slot through its recorded root: $(cat "$dir/treehouse.log")"
+  assert_absent "$home/state/task-r.meta" "teardown left the task record"
+  assert_absent "$root/.treehouse/repo-abc123/1/.fm-slot-owner" "teardown left the spent slot claim"
+  pass "fm-teardown: a task returns its slot through the Treehouse root its record carries"
+}
+
+# --- legacy record ----------------------------------------------------------
+
+# A record written before treehouse_root= existed names a slot in the pool
+# Treehouse allocated at the time. It must return through THAT pool's root -
+# read from the slot itself - never through the home-scoped root the home would
+# use today, and never be moved or reinterpreted.
+test_legacy_record_returns_through_its_original_root() {
+  local dir=$TMP_ROOT/legacy home=$TMP_ROOT/legacy/home fakebin legacy_root wt home_scoped
+  mkdir -p "$dir"
+  fakebin=$(make_fakebin "$dir")
+  make_home "$home" task-l
+  fm_git_init_commit "$home/projects/repo"
+  legacy_root="$TREEHOUSE_ROOT"
+  wt=$(make_pool_slot "$home/projects/repo" "$legacy_root" repo-legacy 2)
+  home_scoped=$(home_root "$home") || fail "root did not resolve"
+  fm_write_meta "$home/state/task-l.meta" \
+    "window=firstmate:fm-task-l" "endpoint_task_id=task-l" \
+    "worktree=$wt" "project=$home/projects/repo" "kind=scout"
+  run_teardown "$home" task-l "$fakebin" "$dir/treehouse.log" > "$dir/stdout" 2> "$dir/stderr" \
+    || fail "teardown of a legacy record failed: $(cat "$dir/stderr")"
+  grep -Fq "treehouse <return> <--root> <$legacy_root> <--force> <$wt>" "$dir/treehouse.log" \
+    || fail "legacy record did not return through its original pool root: $(cat "$dir/treehouse.log")"
+  ! grep -Fq "$home_scoped" "$dir/treehouse.log" \
+    || fail "legacy record was returned through the home-scoped root it never used"
+  assert_absent "$home/state/task-l.meta" "legacy teardown left the task record"
+  pass "fm-teardown: a record without treehouse_root= still returns through the pool root that allocated it"
+}
+
+# --- mismatched root refuses ------------------------------------------------
+
+test_mismatched_root_refuses_teardown_without_mutation() {
+  local dir=$TMP_ROOT/mismatch home=$TMP_ROOT/mismatch/home fakebin wt other_root rc
+  mkdir -p "$dir"
+  fakebin=$(make_fakebin "$dir")
+  make_home "$home" task-m
+  fm_git_init_commit "$home/projects/repo"
+  wt=$(make_pool_slot "$home/projects/repo" "$TREEHOUSE_ROOT" repo-mm 1)
+  other_root=$(home_root "$home") || fail "root did not resolve"
+  mkdir -p "$other_root"
+  : > "$wt/sentinel"
+  printf 'task=task-m\nhome=%s\n' "$home" > "$TREEHOUSE_ROOT/.treehouse/repo-mm/1/.fm-slot-owner"
+  fm_write_meta "$home/state/task-m.meta" \
+    "window=firstmate:fm-task-m" "endpoint_task_id=task-m" \
+    "worktree=$wt" "project=$home/projects/repo" "treehouse_root=$other_root" "kind=scout"
+  set +e
+  run_teardown "$home" task-m "$fakebin" "$dir/treehouse.log" > "$dir/stdout" 2> "$dir/stderr"
+  rc=$?
+  set -e
+  [ "$rc" -ne 0 ] || fail "teardown with a root that does not contain the slot succeeded"
+  assert_contains "$(cat "$dir/stderr")" "REFUSED" "mismatched root did not refuse explicitly: $(cat "$dir/stderr")"
+  assert_contains "$(cat "$dir/stderr")" "$other_root" "refusal did not name the recorded root"
+  assert_present "$home/state/task-m.meta" "mismatched root changed the task record before refusing"
+  assert_present "$wt/sentinel" "mismatched root touched the slot before refusing"
+  assert_present "$TREEHOUSE_ROOT/.treehouse/repo-mm/1/.fm-slot-owner" "mismatched root removed the slot claim"
+  [ ! -s "$dir/treehouse.log" ] || fail "mismatched root still called treehouse: $(cat "$dir/treehouse.log")"
+  pass "fm-teardown: a recorded root that does not contain the slot refuses and changes nothing, even with --force"
+}
+
+test_spawn_refuses_slot_outside_home_root() {
+  local dir=$TMP_ROOT/spawn-foreign-root home=$TMP_ROOT/spawn-foreign-root/home fakebin wt out rc
+  mkdir -p "$dir"
+  fakebin=$(make_fakebin "$dir")
+  make_home "$home" task-f
+  fm_git_init_commit "$home/projects/repo"
+  # Treehouse hands back a slot from the shared legacy pool, not this home's root.
+  wt=$(make_pool_slot "$home/projects/repo" "$TREEHOUSE_ROOT" repo-shared 1)
+  set +e
+  out=$(run_spawn "$home" "$home/projects/repo" task-f "$wt" "$fakebin" "$dir/tmux.log")
+  rc=$?
+  set -e
+  [ "$rc" -ne 0 ] || fail "spawn accepted a slot outside its home's Treehouse root: $out"
+  assert_contains "$out" "outside this home's Treehouse root" "spawn did not name the root mismatch: $out"
+  assert_absent "$home/state/task-f.meta" "spawn published a record for a refused slot"
+  assert_absent "$TREEHOUSE_ROOT/.treehouse/repo-shared/1/.fm-slot-owner" "spawn claimed a slot it refused"
+  pass "fm-spawn: a slot Treehouse enters outside this home's root refuses rather than claiming it"
+}
+
+test_spawn_reuses_slot_with_previous_task_record() {
+  local mode dir home fakebin root wt out owner_home
+  for mode in canonical alias; do
+    dir="$TMP_ROOT/reuse-claim-$mode"
+    home="$dir/home"
+    mkdir -p "$dir"
+    fakebin=$(make_fakebin "$dir")
+    make_home "$home" task-n
+    fm_git_init_commit "$home/projects/repo"
+    root=$(home_root "$home") || fail "root did not resolve"
+    wt=$(make_pool_slot "$home/projects/repo" "$root" repo-reuse 1)
+    owner_home="$home"
+    if [ "$mode" = alias ]; then
+      ln -s "$home" "$dir/home-alias"
+      owner_home="$dir/home-alias"
+    fi
+    printf 'task=holder\nhome=%s\n' "$owner_home" > "$root/.treehouse/repo-reuse/1/.fm-slot-owner"
+    fm_write_meta "$home/state/holder.meta" \
+      "window=firstmate:fm-holder" "worktree=$wt" "project=$home/projects/repo" "kind=ship"
+    cp "$home/state/holder.meta" "$dir/holder-before.meta"
+
+    out=$(run_spawn "$home" "$home/projects/repo" task-n "$wt" "$fakebin" "$dir/tmux.log") \
+      || fail "spawn refused a reusable $mode slot while its previous task record remained: $out"
+    assert_grep "task=task-n" "$root/.treehouse/repo-reuse/1/.fm-slot-owner" "spawn did not claim the reused slot"
+    assert_grep "worktree=$wt" "$home/state/task-n.meta" "spawn did not record the reused slot"
+    assert_grep "treehouse_root=$root" "$home/state/task-n.meta" "spawn did not retain the home's isolated root"
+    cmp -s "$dir/holder-before.meta" "$home/state/holder.meta" \
+      || fail "reusing the slot changed its previous task record"
+  done
+  pass "fm-spawn: same canonical home reuses a slot while its previous task record remains"
+}
+
+test_spawn_refuses_live_foreign_home_claims() {
+  local mode owner_id dir home other_home fakebin root wt out marker relaunch_id slot_project
+  for mode in fresh shared-clone relaunch; do
+    for owner_id in holder task-n; do
+      dir="$TMP_ROOT/foreign-$mode-$owner_id"
+      home="$dir/home"
+      other_home="$dir/other-home"
+      mkdir -p "$other_home/state"
+      fakebin=$(make_fakebin "$dir")
+      make_home "$home" task-n
+      fm_git_init_commit "$home/projects/repo"
+      root=$(home_root "$home") || fail "root did not resolve"
+      [ "$mode" != relaunch ] || root="$dir/legacy-shared"
+      slot_project="$home/projects/repo"
+      if [ "$mode" = shared-clone ]; then
+        git clone -q "$slot_project" "$other_home/project"
+        slot_project="$other_home/project"
+      fi
+      wt=$(make_pool_slot "$slot_project" "$root" repo-foreign 1)
+      marker="$root/.treehouse/repo-foreign/1/.fm-slot-owner"
+      printf 'task=%s\nhome=%s\n' "$owner_id" "$other_home" > "$marker"
+      cp "$marker" "$dir/claim-before"
+      fm_write_meta "$other_home/state/$owner_id.meta" "worktree=$wt" "kind=ship"
+      if [ "$mode" = relaunch ]; then
+        fm_write_meta "$home/state/task-n.meta" \
+          "window=firstmate:fm-task-n" "endpoint_task_id=task-n" "harness=codex" \
+          "worktree=$wt" "project=$home/projects/repo" "kind=ship" "mode=no-mistakes" "yolo=off"
+        cp "$home/state/task-n.meta" "$dir/task-before.meta"
+      fi
+      relaunch_id=
+      [ "$mode" != relaunch ] || relaunch_id=task-n
+      if out=$(FM_FAKE_RELAUNCH_ID="$relaunch_id" run_spawn "$home" "$home/projects/repo" task-n "$wt" "$fakebin" "$dir/tmux.log" "$mode"); then
+        fail "$mode accepted a slot held by foreign task $owner_id: $out"
+      fi
+      assert_contains "$out" "foreign home $other_home" "$mode did not identify the foreign owner: $out"
+      cmp -s "$marker" "$dir/claim-before" || fail "$mode changed the foreign claim"
+      if [ "$mode" = relaunch ]; then
+        cmp -s "$home/state/task-n.meta" "$dir/task-before.meta" || fail "refused relaunch changed task metadata"
+      else
+        assert_absent "$home/state/task-n.meta" "refused spawn published task metadata"
+      fi
+      assert_present "$wt/.git" "$mode removed the foreign worktree"
+      if [ -f "$dir/tmux.log" ]; then
+        ! grep -Fq 'encode launch-brief' "$dir/tmux.log" || fail "$mode launched into a foreign slot"
+      fi
+      if [ "$mode" = fresh ]; then
+        rm -f "$other_home/state/$owner_id.meta"
+        out=$(run_spawn "$home" "$home/projects/repo" task-n "$wt" "$fakebin" "$dir/stale.log") \
+          || fail "spawn refused a stale foreign-home claim: $out"
+        assert_grep "home=$home" "$marker" "spawn did not replace the stale foreign-home claim"
+      fi
+    done
+  done
+  pass "fm-spawn: fresh allocation and legacy relaunch refuse foreign live claims, even with the same task id"
+}
+
+test_relative_treehouse_roots_resolve_from_project() {
+  local relative dir home project fakebin root wt out n=0
+  for relative in . ./new/pools ../shared-pools 'pool space'; do
+    n=$((n + 1))
+    dir="$TMP_ROOT/relative-$n"
+    home="$dir/home"
+    make_home "$home" task-r
+    project="$home/projects/repo"
+    fm_git_init_commit "$project"
+    mkdir -p "$dir/unrelated"
+    ln -s "$project" "$dir/project-link"
+    fakebin=$(make_fakebin "$dir")
+    root=$(TREEHOUSE_ROOT="$relative" home_root "$home" "$dir/project-link") || fail "relative root $relative did not resolve"
+    case "$root" in "$project"/*/fm-home-*) ;; *) fail "$relative did not resolve against $project: $root" ;; esac
+    wt=$(make_pool_slot "$project" "$root" repo-relative 1)
+    root=$(cd "$root" && pwd -P)
+    out=$(cd "$dir/unrelated" && TREEHOUSE_ROOT="$relative" run_spawn "$home" "$dir/project-link" task-r "$wt" "$fakebin" "$dir/tmux.log") \
+      || fail "spawn failed for relative root $relative: $out"
+    assert_grep "treehouse_root=$root" "$home/state/task-r.meta" "relative CLI root was not recorded as an absolute path"
+    assert_contains "$(cat "$dir/tmux.log")" "treehouse get --root '$root'" "allocation used the wrong relative root"
+    TREEHOUSE_ROOT=elsewhere run_teardown "$home" task-r "$fakebin" "$dir/return.log" > "$dir/out" 2> "$dir/err" \
+      || fail "return failed for relative root $relative: $(cat "$dir/err")"
+    assert_contains "$(cat "$dir/return.log")" "<--root> <$root>" "return ignored the recorded absolute root"
+  done
+  pass "fm-spawn: relative roots resolve from the spawning repository and record absolute CLI roots"
+}
+
+test_real_treehouse_root_round_trip() (
+  fm_live_gate default-on FM_LIVE_TREEHOUSE_POOLS treehouse jq
+  local dir="$TMP_ROOT/real-treehouse" mode cli_root recorded wt resolved expected
+  local treehouse_env_root=
+  mkdir -p "$dir/user" "$dir/home"
+  fm_git_init_commit "$dir/repo"
+  real_treehouse() (
+    cd "$dir/repo" || exit 1
+    env HOME="$dir/user" TREEHOUSE_ROOT="$treehouse_env_root" TREEHOUSE_NO_UPDATE_CHECK=1 treehouse "$@"
+  )
+  for mode in explicit symlink relative-dot relative-nested relative-parent legacy-default legacy-config legacy-env; do
+    rm -f "$dir/repo/treehouse.toml"
+    treehouse_env_root=
+    cli_root=
+    recorded=
+    case "$mode" in
+      explicit|symlink|relative-*)
+        case "$mode" in
+          relative-dot) treehouse_env_root=. ;;
+          relative-nested) treehouse_env_root=./new/pools ;;
+          relative-parent) treehouse_env_root=../shared-pools ;;
+          *) treehouse_env_root="$TREEHOUSE_ROOT" ;;
+        esac
+        cli_root=$(TREEHOUSE_ROOT="$treehouse_env_root" home_root "$dir/home" "$dir/repo") || fail "real home root did not resolve"
+        mkdir -p "$cli_root"
+        cli_root=$(cd "$cli_root" && pwd -P)
+        if [ "$mode" = symlink ]; then
+          ln -s "$cli_root" "$dir/root-link"
+          cli_root="$dir/root-link"
+        fi
+        recorded="$cli_root"
+        expected="$cli_root"
+        wt=$(real_treehouse get --root "$cli_root" --lease --lease-holder "$mode" --no-fetch) \
+          || fail "real Treehouse allocation failed for $mode"
+        ;;
+      *)
+        case "$mode" in
+          legacy-default) expected="$dir/user" ;;
+          legacy-config)
+            printf 'root = "configured"\n' > "$dir/repo/treehouse.toml"
+            expected="$dir/repo/configured"
+            ;;
+          legacy-env)
+            treehouse_env_root="$dir/env-root"
+            expected="$treehouse_env_root"
+            ;;
+        esac
+        wt=$(real_treehouse get --lease --lease-holder "$mode" --no-fetch) \
+          || fail "real legacy Treehouse allocation failed for $mode"
+        ;;
+    esac
+    resolved=$(FM_HOME="$dir/home" bash -c '
+      . "$1"
+      fm_treehouse_task_root "$2" "$3" || exit 1
+      printf "%s\n" "$FM_TREEHOUSE_TASK_ROOT"
+    ' _ "$WAKE_LIB" "$recorded" "$wt") || fail "real Treehouse slot reconciliation failed for $mode: $wt"
+    [ "$resolved" = "$expected" ] || fail "$mode resolved $resolved instead of CLI root $expected"
+    real_treehouse status --root "$resolved" --json | \
+      jq -e --arg wt "$wt" --arg holder "$mode" 'any(.[]; .path == $wt and .lease_holder == $holder and .status == "leased")' >/dev/null \
+      || fail "recovery status missed the real $mode slot"
+    real_treehouse return --root "$resolved" --force "$wt" \
+      || fail "return through reconciled CLI root failed for $mode"
+    real_treehouse status --root "$resolved" --json | \
+      jq -e --arg wt "$wt" 'any(.[]; .path == $wt and .lease_holder == "" and .status == "available")' >/dev/null \
+      || fail "return did not release the real $mode slot"
+  done
+  pass "real Treehouse allocation, recovery, and return preserve explicit and legacy roots"
+)
+
+test_home_root_is_deterministic_distinct_and_canonical
+test_two_homes_with_clones_of_one_repo_allocate_to_different_roots
+test_teardown_returns_through_recorded_root
+test_legacy_record_returns_through_its_original_root
+test_mismatched_root_refuses_teardown_without_mutation
+test_spawn_refuses_slot_outside_home_root
+test_spawn_reuses_slot_with_previous_task_record
+test_spawn_refuses_live_foreign_home_claims
+test_relative_treehouse_roots_resolve_from_project
+test_real_treehouse_root_round_trip