From 5780f8db3252166d2c24c5ae35907bf64ac336c5 Mon Sep 17 00:00:00 2001
From: Tejas Shah <talktejas@gmail.com>
Date: Sun, 20 Sep 2026 14:31:57 +0700
Subject: [PATCH 01/10] fix(spawn): claim a task's pool worktree so it is never
 reassigned under a live task

Supersedes #4, which cannot be revalidated: its branch was rewritten (the
pipeline rebased it onto a moved main, and custody was then returned at that
rebased head), and no-mistakes refuses to reconcile its private mirror record
afterwards. Same content, clean branch from main.

On 2026-08-19 a spawn was handed a pooled working copy that another task's own
record still named as its live copy. The pool reset it to a detached HEAD,
evicting a paused task from the copy holding its work; nothing was lost only
because that task had already pushed. Treehouse counts a slot as in use only
while a process runs inside it, so a task whose agent has exited - paused,
crashed, or between turns - leaves its copy looking free.

bin/fm-spawn.sh now takes the pool's own durable claim itself
(treehouse get --lease) instead of relying on the pane's subshell to hold the
slot, then moves the pane into the leased copy in a subshell so the pane's own
shell does not sit inside the worktree. Release paths: ordinary teardown returns
the worktree and the lease with it; an aborted spawn returns it holder-matched
in cleanup; otherwise the holder label names the owning record and the task
records worktree_lease= so a stale claim is self-identifying and releasable with
one command.

A named refusal stays as a second line of defence for the one copy a claim
cannot protect - a task spawned before claims existed, holding its slot with
nothing but its processes. The claim is deliberately kept on that refusal, so
the slot is quarantined rather than offered to the next spawn in a refuse-loop.

Upstream's slot-owner claim marker is kept as-is and this claim sits above it:
the lease stops the pool reassigning a live copy, the marker answers at teardown
whether the slot beside a record is still that record's own.
---
 bin/backends/cmux.sh                          |   3 +-
 bin/backends/herdr.sh                         |  16 +-
 bin/backends/tmux.sh                          |   8 +-
 bin/backends/zellij.sh                        |  10 +-
 bin/fm-spawn.sh                               | 200 +++++++++++-------
 bin/fm-teardown.sh                            |   3 +
 docs/architecture.md                          |   3 +-
 docs/cmux-backend.md                          |   2 +-
 docs/verification/runtime-backends.md         |  22 ++
 docs/zellij-backend.md                        |   2 +-
 tests/fixtures.sh                             |   7 +-
 .../fm-backend-herdr-presentation-e2e.test.sh |  49 +++--
 tests/fm-backend.test.sh                      |  20 +-
 tests/fm-backlog-atomicity.test.sh            |   3 +-
 tests/fm-bootstrap-network-parallel.test.sh   |   3 +-
 tests/fm-captain-hold-lifecycle.test.sh       |  18 +-
 tests/fm-kimi-harness.test.sh                 |   3 +-
 tests/fm-muse-harness.test.sh                 |   3 +-
 tests/fm-public-followup.test.sh              |  27 ++-
 tests/fm-rovo-harness.test.sh                 |   3 +-
 tests/fm-secondmate-harness.test.sh           |  10 +-
 tests/fm-secondmate-sync.test.sh              |   9 +-
 tests/fm-shared-captain-inheritance.test.sh   |   3 +-
 tests/fm-spawn-base-branch.test.sh            |   2 +-
 tests/fm-spawn-pool-base-freshen.test.sh      |  15 +-
 tests/fm-spawn-worktree-lease.test.sh         | 166 +++++++++++++++
 tests/fm-spawn-worktree-settle.test.sh        |  68 +++---
 tests/fm-tangle-guard.test.sh                 |  13 +-
 tests/fm-trace-context-spawn.test.sh          |   2 +-
 tests/lib.sh                                  |  32 +++
 30 files changed, 531 insertions(+), 194 deletions(-)
 create mode 100644 tests/fm-spawn-worktree-lease.test.sh

diff --git a/bin/backends/cmux.sh b/bin/backends/cmux.sh
index 747d3fc2ccd..348186ee709 100644
--- a/bin/backends/cmux.sh
+++ b/bin/backends/cmux.sh
@@ -36,7 +36,8 @@
 #      (herdr-shape): `workspace list`'s `current_directory` field reflects a
 #      `cd` run directly in the surface's own top-level shell, but stays
 #      frozen at wherever that shell was when it launched a foreground
-#      subshell (exactly what `treehouse get` does) - verified live: a nested
+#      subshell (exactly what the spawn-time `(cd -- '<wt>' && exec $SHELL)`
+#      does) - verified live: a nested
 #      `bash -c 'cd /Users && exec bash'` left `current_directory` reporting
 #      the PARENT shell's last cwd, never following into the subshell. Fixed
 #      with zellij's own pwd-marker-probe workaround, reused verbatim in
diff --git a/bin/backends/herdr.sh b/bin/backends/herdr.sh
index 88a8cb61492..33b0301f626 100644
--- a/bin/backends/herdr.sh
+++ b/bin/backends/herdr.sh
@@ -2081,8 +2081,10 @@ fm_backend_herdr_explicit_close_pane_confirmed() {  # <session> <pane_id>
 #   shell      - every foreground process is a recognized shell AND no
 #                descendant of the pane shell is a verified harness: positive
 #                proof the pane is shell-only. The descendant walk is what makes
-#                this safe for the crew shape, where a nested `treehouse get`
-#                shell sits under the pane's top shell.
+#                this safe for the crew shape, where the nested worktree
+#                shell fm-spawn.sh starts with
+#                `(cd -- '<wt>' && exec $SHELL)` sits under the pane's top
+#                shell.
 #   other      - the foreground group holds something that is neither: a tool
 #                the agent is running in its own process group, a pager, a
 #                stranger's process. Not a shell-only pane. An idle shell
@@ -2933,15 +2935,16 @@ fm_backend_herdr_target_ready() {  # <target>
 
 # fm_backend_herdr_current_path: the live FOREGROUND process's cwd, or empty on
 # any error. Mirrors tmux's pane_current_path poll used for worktree-path
-# discovery after `treehouse get`.
+# discovery after the pane enters its worktree.
 #
 # Verified pitfall: `pane get`'s `.result.pane.cwd` is the pane's cwd AT
 # CREATION TIME - the top-level shell's cwd - and does NOT update when that
-# shell `cd`s or enters a subshell (as `treehouse get` does). Reading it here
+# shell `cd`s or enters a subshell (as fm-spawn.sh's
+# `(cd -- '<wt>' && exec $SHELL)` does). Reading it here
 # would make fm-spawn.sh's worktree-discovery poll never see the pane "leave"
 # the project directory, since `cwd` stays frozen at the original path forever.
 # `.result.pane.foreground_cwd` tracks the ACTUALLY RUNNING foreground
-# process's cwd instead, which is what changes when `treehouse get` enters its
+# process's cwd instead, which is what changes when that command enters its
 # worktree subshell - confirmed live against a real treehouse acquisition.
 fm_backend_herdr_current_path() {  # <target>
   fm_backend_herdr_target_ready "$1" || return 0
@@ -2951,7 +2954,8 @@ fm_backend_herdr_current_path() {  # <target>
 
 # fm_backend_herdr_send_text_line: send one line of TEXT then submit,
 # ATOMICALLY - mirrors tmux's `send-keys -t T text Enter`. Used for the fixed
-# spawn-time commands (treehouse get, the GOTMPDIR export). `pane run` types
+# spawn-time commands (the worktree-entry subshell, the GOTMPDIR export).
+# `pane run` types
 # the command and submits it in one call (verified).
 fm_backend_herdr_send_text_line() {  # <target> <text>
   fm_backend_herdr_target_ready "$1" || return 1
diff --git a/bin/backends/tmux.sh b/bin/backends/tmux.sh
index 2bc1c8aa0d7..e9c70aeeba8 100644
--- a/bin/backends/tmux.sh
+++ b/bin/backends/tmux.sh
@@ -8,8 +8,9 @@
 # default (tmux, `backend=` absent) path stays byte-identical. Sourced only
 # through bin/fm-backend.sh's fm_backend_source, never directly.
 #
-# Worktree acquisition (running `treehouse get` inside the pane, and polling
-# its cwd) is unchanged by this extraction: P1 scopes only the session
+# Worktree acquisition (fm-spawn.sh takes the pool's lease itself, sends
+# `(cd -- '<wt>' && exec $SHELL)` into the pane, and polls its cwd) is
+# unchanged by this extraction: P1 scopes only the session
 # provider, not the worktree provider, so fm-spawn.sh still drives that part
 # inline with these same send/current-path primitives.
 #
@@ -115,7 +116,8 @@ fm_backend_tmux_current_path() {  # <target>
 
 # fm_backend_tmux_send_text_line: send one line of TEXT then Enter, with no
 # composer verification - used for the fixed spawn-time commands
-# (`treehouse get`, the GOTMPDIR export) that already ran this exact sequence
+# (the `(cd -- '<wt>' && exec $SHELL)` worktree entry, the GOTMPDIR export)
+# that already ran this exact sequence
 # inline in fm-spawn.sh. Mirrors `tmux send-keys -t "$T" "<text>" Enter`.
 fm_backend_tmux_send_text_line() {  # <target> <text>
   tmux send-keys -t "$1" "$2" Enter
diff --git a/bin/backends/zellij.sh b/bin/backends/zellij.sh
index a90247899f1..bfac5a2ad83 100644
--- a/bin/backends/zellij.sh
+++ b/bin/backends/zellij.sh
@@ -53,8 +53,8 @@
 #   4. `list-panes --json`'s `pane_cwd` reflects a `cd` run DIRECTLY in the
 #      pane's own top-level shell within one poll (<0.3s) - but does NOT
 #      reflect a `cd` performed by a NESTED SUBSHELL the pane's shell
-#      launched as a foreground command (verified: `treehouse get` opens
-#      exactly such a subshell). `pane_cwd` stays frozen at wherever the
+#      launched as a foreground command (verified: the spawn-time
+#      `(cd -- '<wt>' && exec $SHELL)` opens exactly such a subshell). `pane_cwd` stays frozen at wherever the
 #      pane's shell was when it invoked that foreground command - worse than
 #      herdr's frozen-cwd trap (herdr at least exposes a `foreground_cwd`
 #      that tracks this; zellij's CLI exposes no live-process cwd field and
@@ -388,13 +388,13 @@ fm_backend_zellij_target_ready() {  # <target> [expected-label]
 
 # fm_backend_zellij_current_path: the live pane's cwd, or empty on any error.
 # Mirrors tmux's pane_current_path poll used for worktree-path discovery after
-# `treehouse get`.
+# the pane enters its worktree.
 #
 # Verified pitfall (docs/zellij-backend.md "Worktree-path discovery: pane_cwd
 # does not track a subshell"): `list-panes --json`'s `pane_cwd` DOES reflect a
 # `cd` run directly in the pane's own top-level shell, but stays FROZEN at
-# whatever directory the pane's shell was in when it launched `treehouse get`
-# as a foreground command - it never follows that command's own internal `cd`
+# whatever directory the pane's shell was in when it launched the
+# worktree-entry command as a foreground command - it never follows that command's own internal `cd`
 # into the acquired worktree, even after the subshell is fully interactive and
 # a `pwd` typed into it prints the correct live path on screen. Zellij's CLI
 # exposes no per-pane pid and no live-process cwd field to read instead
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 9c35c7b014b..7721825547d 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -63,7 +63,7 @@
 #   then tmux.
 #   Spawn-capable backends are the reference tmux adapter and experimental
 #   herdr, zellij, orca, and cmux. Orca owns both the task worktree and
-#   terminal, so ship/scout Orca spawns do not run treehouse get; cmux is a
+#   terminal, so ship/scout Orca spawns take no pool worktree; cmux is a
 #   session provider only, exactly like herdr/zellij, so it does. An
 #   auto-detected herdr or cmux spawn prints a loud stderr notice;
 #   auto-detected tmux stays silent; zellij and orca are never auto-detected.
@@ -202,13 +202,17 @@
 #   Ship/scout spawns refuse to launch unless the resolved task path is a real
 #   git worktree root distinct from both the spawning project and its repository's
 #   primary checkout, including when the spawning project is a linked worktree.
-#   On the backends that discover that path by reading the task pane's own cwd,
-#   the same isolation test screens every read: a pane still showing the project
-#   or the repository primary while `treehouse get` prepares the slot is waited
-#   out as a transient rather than adopted and then refused, so a home that is
-#   itself a linked worktree of the project repository still launches. A pane
-#   that never reaches an isolated worktree refuses at the end of that wait,
-#   naming the last path seen and why it was rejected.
+#   The task worktree is a durable treehouse LEASE fm-spawn takes itself, held
+#   under a label naming the task record that owns it, so a copy whose agent is
+#   not currently running is never handed to another spawn and reset under it.
+#   The isolation test screens the leased path before the pane is touched at all.
+#   The pane is then moved into that copy and must be observed there: a pane
+#   still showing the project or the repository primary in its first reads is
+#   waited out as a transient, so a home that is itself a linked worktree of the
+#   project repository still launches, and a pane that never arrives refuses at
+#   the end of that wait, naming the leased copy and the last path seen.
+#   An aborted spawn returns the lease before any record can name it; otherwise
+#   the published record owns it and bin/fm-teardown.sh's return releases it.
 #   That placement is proven only at launch. Every ship or scout pane therefore
 #   also receives `export FM_TASK_ID=<task-id>` before the launch command, on
 #   the same channel as GOTMPDIR, and bin/fm-test-run.sh refuses to execute the
@@ -1094,6 +1098,9 @@ SPAWN_TASK_SET_LOCK_HELD=0
 SPAWN_TREEHOUSE_PROJECT_LOCK=
 SPAWN_TREEHOUSE_PROJECT_LOCK_HELD=0
 SPAWN_SLOT_CLAIMED=0
+SPAWN_TREEHOUSE_LEASE_HOLDER=
+SPAWN_TREEHOUSE_LEASE_PATH=
+SPAWN_TREEHOUSE_LEASE_PENDING=0
 RELAUNCH_REPLACEMENT_PENDING=0
 RELAUNCH_REPLACEMENT_BUSY_GEN=
 RELAUNCH_REPLACEMENT_HARNESS=
@@ -1242,6 +1249,17 @@ spawn_abort_cleanup() {
       echo "warning: leaving task $ID's slot claim on $WT in place; the Treehouse project lock is no longer held, so the next spawn's claim replaces it" >&2
     fi
   fi
+  if [ "$SPAWN_TREEHOUSE_LEASE_PENDING" = 1 ]; then
+    # The spawn is aborting before any task record can name this lease, so the
+    # slot would otherwise stay claimed by a task that never existed. Return it
+    # while the project lock is still held, and match on the holder label so a
+    # slot some later allocation has already taken over is never returned here.
+    SPAWN_TREEHOUSE_LEASE_PENDING=0
+    ( cd "$PROJ_ABS" && treehouse return --force \
+        --if-lease-holder "$SPAWN_TREEHOUSE_LEASE_HOLDER" \
+        "$SPAWN_TREEHOUSE_LEASE_PATH" >/dev/null 2>&1 ) \
+      || echo "warning: could not release the treehouse lease on $SPAWN_TREEHOUSE_LEASE_PATH held as $SPAWN_TREEHOUSE_LEASE_HOLDER; release it with: treehouse return --force --if-lease-holder '$SPAWN_TREEHOUSE_LEASE_HOLDER' '$SPAWN_TREEHOUSE_LEASE_PATH'" >&2
+  fi
   if [ "$SPAWN_TREEHOUSE_PROJECT_LOCK_HELD" = 1 ]; then
     SPAWN_TREEHOUSE_PROJECT_LOCK_HELD=0
     fm_lock_release "$SPAWN_TREEHOUSE_PROJECT_LOCK" || true
@@ -2784,7 +2802,7 @@ spawn_worktree_isolated() { # <path>
 validate_spawn_worktree() { # <source> <inspect-target>
   local source=$1 inspect_target=$2
   if ! spawn_worktree_isolated "$WT"; then
-    echo "error: $source did not yield an isolated worktree (resolved '$WT'; worktree root '${SPAWN_WT_TOP:-none}'; spawning project '$PROJ_ABS'); refusing to launch to avoid tangling the primary checkout. Inspect target $inspect_target" >&2
+    echo "error: $source did not yield an isolated worktree (resolved '$WT': ${SPAWN_WT_REASON:-no reason recorded}; worktree root '${SPAWN_WT_TOP:-none}'; spawning project '$PROJ_ABS'); refusing to launch to avoid tangling the primary checkout. Inspect target $inspect_target" >&2
     exit 1
   fi
 }
@@ -3687,77 +3705,107 @@ if [ "$RELAUNCH" -eq 1 ]; then
   fi
   [ "$KIND" = secondmate ] || validate_spawn_worktree "relaunch" "$T"
 elif [ "$KIND" != secondmate ] && [ "$BACKEND" != orca ]; then
-  spawn_send_text_line "$WT_TARGET" 'treehouse get'
+  # Claim the pool slot from HERE, durably, instead of letting the pane's
+  # `treehouse get` subshell hold it. Treehouse counts a slot as in use only
+  # while a process is running inside it, so a task whose agent has exited -
+  # paused, crashed, or between turns - leaves its own working copy looking
+  # free. The next `treehouse get` then hands that copy to a new spawn and
+  # resets it (observed 2026-08-19: a live task's copy was reassigned and reset
+  # to a detached HEAD, silently, with no refusal). A lease is the pool's own
+  # durable claim: treehouse never hands a leased slot to a later get and never
+  # prunes it, with or without a process inside, so the claim is enforced by
+  # the layer that does the allocating rather than re-derived from task records
+  # after the copy has already been reset.
+  #
+  # How the claim is released, since a claim nothing can release is the trap
+  # this fix could otherwise create:
+  #   - Normally bin/fm-teardown.sh returns the worktree, and `treehouse return`
+  #     releases the lease with it. That is the whole ordinary lifecycle.
+  #   - An aborted spawn releases it below in spawn_abort_cleanup, before any
+  #     task record exists to point at it.
+  #   - Otherwise the holder label names the exact record that owns the lease,
+  #     so a lease outliving its task is self-identifying and releasable with
+  #     `treehouse return --force --if-lease-holder <label> <path>`. A stale
+  #     lease costs one pool slot until then; it can never wedge a spawn,
+  #     because treehouse creates another slot rather than refusing.
+  SPAWN_TREEHOUSE_LEASE_HOLDER="fm:$ID@$STATE"
+  WT=$(cd "$PROJ_ABS" && treehouse get --lease --lease-holder "$SPAWN_TREEHOUSE_LEASE_HOLDER") || {
+    echo "error: treehouse get --lease could not lease a worktree for project '$PROJ_ABS'; nothing was launched" >&2
+    exit 1
+  }
+  if [ -z "$WT" ]; then
+    echo "error: treehouse get --lease reported no worktree for project '$PROJ_ABS'; nothing was launched" >&2
+    exit 1
+  fi
+  SPAWN_TREEHOUSE_LEASE_PATH=$WT
+  SPAWN_TREEHOUSE_LEASE_PENDING=1
+  validate_spawn_worktree "treehouse get --lease" "$T"
+
+  # Second line of defence, for a copy the pool offered that a live task record
+  # in this home still names WITHOUT a claim of its own: a task spawned before
+  # leases existed holds its slot with nothing but its processes, and that is
+  # exactly the copy the pool cannot see a claim on. Refuse rather than launch
+  # into it, and name the task that holds it so the operator knows who to ask
+  # instead of going hunting. A record that does carry its own worktree_lease=
+  # is not that case - the pool would not have offered its copy - so it is left
+  # to the ordinary slot-ownership reconciliation rather than blocking a spawn.
+  # The lease is deliberately NOT returned here: releasing it would hand the
+  # same copy to the next spawn, which would refuse again, and the pool would
+  # deadlock on it forever. Holding it quarantines that one slot instead - the
+  # next spawn is given a different copy and proceeds - and the label below is
+  # what releases it once the records are reconciled.
+  spawn_wt_claim=$(real_path_or_raw "$WT")
+  for spawn_other_meta in "$STATE"/*.meta; do
+    [ -f "$spawn_other_meta" ] && [ ! -L "$spawn_other_meta" ] || continue
+    spawn_other_id=$(basename "$spawn_other_meta" .meta)
+    [ "$spawn_other_id" != "$ID" ] || continue
+    spawn_other_wt=$(fm_meta_get "$spawn_other_meta" worktree)
+    [ -n "$spawn_other_wt" ] || continue
+    [ -z "$(fm_meta_get "$spawn_other_meta" worktree_lease)" ] || continue
+    [ "$(real_path_or_raw "$spawn_other_wt")" = "$spawn_wt_claim" ] || continue
+    SPAWN_TREEHOUSE_LEASE_PENDING=0
+    echo "error: the pool offered '$WT', which task $spawn_other_id's own record still names as its working copy; refusing to launch task $ID into it and reset another worker's work" >&2
+    echo "That copy is now held under '$SPAWN_TREEHOUSE_LEASE_HOLDER' so it is not offered again; reconcile whichever record is wrong (bin/fm-crew-state.sh $spawn_other_id), then release it with: treehouse return --force --if-lease-holder '$SPAWN_TREEHOUSE_LEASE_HOLDER' '$WT'" >&2
+    echo "Re-running this spawn is safe: it is given a different copy." >&2
+    exit 1
+  done
 
-  # Wait for the treehouse subshell: the pane's cwd moves from the project to the worktree.
+  # Move the pane into the leased copy and prove it arrived, the same way the
+  # relaunch path above does: the lease already fixes WHICH copy this task owns,
+  # so nothing here has to discover it from the pane, and a pane that reports a
+  # transient or stale path just keeps the wait going instead of being adopted.
   # Target the stable window id, not the name: if the name is ever lost (e.g. an
-  # automatic-rename slips through), display-message -t <bad-name> falls back to the
-  # active client's window, which would misread firstmate's OWN pane path as the
-  # worktree and tangle a hook into the primary checkout. The window id never lies.
-  # The project comparison is physical: spawn_worktree_isolated screens each
-  # read against PROJ_ABS_REAL, not PROJ_ABS, because a symlinked project prefix
-  # would otherwise make the pane's OS-level cwd read differ from PROJ_ABS on
-  # the very first poll, before the pane has actually moved.
-  #
-  # A single read that already looks isolated is not proof the pane settled
-  # there: on some tmux/WSL setups a brand-new window's pane_current_path
-  # transiently reports an unrelated stale path (seen live as another real git
-  # checkout entirely) before the shell catches up with treehouse get's cd. That
-  # stale path passes spawn_worktree_isolated too (it resolves to a real,
-  # distinct worktree top-level), so accepting it on one read alone silently
-  # records the wrong worktree= in state/<id>.meta. Require two consecutive
-  # reads to agree on the same isolated path before accepting it; a mismatch
-  # just becomes the new candidate rather than resetting the wait, so a pane
-  # that is already settled by the first real read only costs the one existing
-  # inter-poll sleep as confirmation, not a whole extra cycle on top.
-  #
-  # Every candidate is screened with the isolation guard's own predicate, so a
-  # read of the project itself or of the repository primary checkout is treated
-  # as the transient it is and the wait continues, instead of being adopted and
-  # then refused by the guard.
-  # A candidate the screen rejects is never adopted, so a host where the pane
-  # never reaches an isolated worktree spends the whole window before refusing.
-  # That wait is deliberate - telling a transient apart from a terminal
-  # misconfiguration would need machinery this path does not want - so the
-  # refusal has to be self-explaining instead: carry the last path seen and the
-  # reason it was rejected, and report both at the deadline.
-  candidate=""
-  last_seen=""
-  last_reason="the pane reported no path"
+  # automatic-rename slips through), display-message -t <bad-name> falls back to
+  # the active client's window, which would misread firstmate's OWN pane path as
+  # the worktree and tangle a hook into the primary checkout. The window id never
+  # lies.
+  # Enter the copy in a SUBSHELL, the same process shape `treehouse get` left
+  # behind: the pane's own top-level shell stays in the project, and only the
+  # foreground shell sits in the worktree. A plain top-level `cd` would put the
+  # pane's shell itself inside the worktree, where bin/fm-teardown.sh's
+  # leaked-process reaper would end it as a stray worktree process instead of
+  # letting the backend close its pane - which on Herdr skips the projection's
+  # own confirmed close and leaves its presentation journal quarantined.
+  spawn_cd_path=${WT//\'/\'\\\'\'}
+  spawn_send_text_line "$WT_TARGET" "(cd -- '$spawn_cd_path' && exec \"\${SHELL:-/bin/sh}\")" || {
+    echo "error: could not tell window $T to enter its leased worktree '$WT'; nothing was launched" >&2
+    exit 1
+  }
+  spawn_wt_real=$(real_path_or_raw "$WT")
+  spawn_seen=
   for _ in $(seq 1 60); do
-    p=$(spawn_current_path "$WT_TARGET" || true)
-    [ -z "$p" ] || last_seen="$p"
-    if [ -n "$p" ] && spawn_worktree_isolated "$p"; then
-      p_real=$(real_path_or_raw "$p")
-      last_reason="it is an isolated worktree, but no second read agreed with it"
-      if [ -n "$candidate" ] && [ "$p_real" = "$candidate" ]; then
-        WT="$p"
-        break
-      fi
-      candidate="$p_real"
-    else
-      candidate=""
-      [ -z "$p" ] || last_reason=$SPAWN_WT_REASON
-    fi
+    spawn_seen=$(spawn_current_path "$WT_TARGET" || true)
+    [ -z "$spawn_seen" ] || [ "$(real_path_or_raw "$spawn_seen")" != "$spawn_wt_real" ] || break
     sleep 1
   done
-  if [ -z "$WT" ]; then
-    echo "error: treehouse get did not enter an isolated worktree within 60s (last seen '${last_seen:-none}': $last_reason; spawning project '$PROJ_ABS'); inspect window $T" >&2
+  if [ -z "$spawn_seen" ] || [ "$(real_path_or_raw "$spawn_seen")" != "$spawn_wt_real" ]; then
+    echo "error: window $T did not enter its leased worktree '$WT' within 60s (last seen '${spawn_seen:-none}'; spawning project '$PROJ_ABS'); inspect window $T" >&2
     exit 1
   fi
 
-  validate_spawn_worktree "treehouse get" "$T"
-
-  # Claim the pool slot for this task. The interactive `treehouse get` sent to
-  # the pane above records only a process lease (Treehouse's durable
-  # `get --lease --lease-holder`, which bin/fm-home-seed.sh uses for secondmate
-  # homes, is not this path), so Treehouse cannot say which task a slot belongs
-  # to once that task's worker exits - and that is exactly when the slot is
-  # handed on and this task's worktree= line goes stale. The claim is what lets
-  # bin/fm-teardown.sh leave a slot that has since been reassigned untouched, so
-  # a slot that cannot be claimed is refused here, at the cheapest point, rather
-  # than launching a worker whose slot teardown could later release out from
-  # under its successor.
+  # Record WHICH task owns this pool slot. The lease above stops the pool from
+  # handing the copy to a later spawn; the claim answers the other question, at
+  # teardown: whether the slot beside a task's record is still that task's own.
   # Written under the Treehouse project lock held from before slot allocation
   # through metadata publication, so no other spawn or return sees a half-claim.
   if fm_treehouse_pool_slot "$PROJ_ABS" "$WT"; then
@@ -4296,6 +4344,11 @@ preserve_relaunch_meta() {
   echo "window=$META_WINDOW"
   echo "endpoint_task_id=$ID"
   echo "worktree=$WT"
+  # The pool claim this task holds on that copy, so the record itself says how
+  # to release it: treehouse return --force --if-lease-holder <this> <worktree>.
+  # Deliberately absent from the relaunch-owned key list above, so a relaunch
+  # carries the original claim forward rather than dropping it.
+  [ -z "$SPAWN_TREEHOUSE_LEASE_HOLDER" ] || echo "worktree_lease=$SPAWN_TREEHOUSE_LEASE_HOLDER"
   echo "project=$PROJ_ABS"
   echo "harness=$HARNESS"
   echo "kind=$KIND"
@@ -4420,6 +4473,9 @@ fi
 # still being delivered, cannot observe or complete a fresh provisional record
 # between its state check and `tasks-axi start`, and a delivery failure cannot
 # follow a committed In-flight transition.
+# The task record is published, so it - not this aborting-spawn flag - now owns
+# the worktree lease; teardown releases it with the worktree.
+SPAWN_TREEHOUSE_LEASE_PENDING=0
 if [ "$SPAWN_TREEHOUSE_PROJECT_LOCK_HELD" = 1 ]; then
   SPAWN_TREEHOUSE_PROJECT_LOCK_HELD=0
   fm_lock_release "$SPAWN_TREEHOUSE_PROJECT_LOCK"
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index c0d4f0213c6..07b6c5a8a77 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -128,6 +128,9 @@
 # through metadata publication, closing the publication
 # gap; forced secondmate teardown takes it and runs the same checks for every
 # descendant Treehouse slot before touching any child.
+# A task worktree is also claimed with a durable Treehouse lease at spawn
+# (bin/fm-spawn.sh owns the claim), and the return below releases that lease with
+# the slot, so an ordinary teardown is what frees the claim.
 # These refusals are not relaxed by --force: --force authorizes discarding THIS
 # task's unlanded work, never another task's live work. Nothing of this task's
 # own is removed by a refusal; reconcile whichever record is wrong and re-run.
diff --git a/docs/architecture.md b/docs/architecture.md
index e0109db1ae9..8622f5704ee 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -243,7 +243,8 @@ Codex App support is recorded in `docs/codex-app-backend.md`; it is not selectab
 ## Worktrees, not branches in your checkout
 
 Crewmates never intentionally touch your project clone; [treehouse](https://github.com/kunchenguid/treehouse) pools clean worktrees for tmux, herdr, zellij, and cmux tasks, while Orca creates its own worktrees for `backend=orca`.
-The [`fm-spawn.sh` header](../bin/fm-spawn.sh) owns ship/scout worktree isolation and fresh-base refusal rules, including spawns from linked homes.
+A task's pool worktree is claimed with a durable treehouse lease labelled by the task record that owns it, so a copy whose agent is not running is never handed to the next spawn and reset under it, and teardown's return releases the claim.
+The [`fm-spawn.sh` header](../bin/fm-spawn.sh) owns ship/scout worktree isolation, the lease claim, and fresh-base refusal rules, including spawns from linked homes.
 Portable regressions live in [`tests/fm-spawn-pool-base-freshen.test.sh`](../tests/fm-spawn-pool-base-freshen.test.sh) for spawn isolation and base freshness, and [`tests/fm-control-relaunch.test.sh`](../tests/fm-control-relaunch.test.sh) for preserving the recorded copy on relaunch.
 
 The firstmate repo has one extra exposure because it can dispatch crewmates to work on itself.
diff --git a/docs/cmux-backend.md b/docs/cmux-backend.md
index 51618de5b5f..4ec911c7b10 100644
--- a/docs/cmux-backend.md
+++ b/docs/cmux-backend.md
@@ -87,7 +87,7 @@ A genuinely fresh surface returns an internal error from `read-screen` until som
 Target readiness therefore uses the structural `list-panes` response instead of a content read.
 Capture remains bounded and locally trimmed after `read-screen` becomes available.
 
-`current_directory` follows a top-level shell `cd` but not the foreground subshell opened by `treehouse get`.
+`current_directory` follows a top-level shell `cd` but not a foreground subshell.
 Spawn-time worktree discovery sends begin and end markers around `pwd`, captures the marked block, and joins wrapped path lines.
 
 An ordinary metadata-routed `fm-send.sh` text steer becomes a durable steering-inbox record, and only its best-effort constant doorbell passes through cmux's submit machinery.
diff --git a/docs/verification/runtime-backends.md b/docs/verification/runtime-backends.md
index f870d561b89..11bec98b4fe 100644
--- a/docs/verification/runtime-backends.md
+++ b/docs/verification/runtime-backends.md
@@ -1521,6 +1521,28 @@ The current catch-up reporting boundary is pinned by `tests/fm-afk-return.test.s
 The fixture captures submitted input through Pi's `input` extension hook, so the lab agent directory needs no provider credentials.
 The daemon injection transport into a live composer keeps its coverage in `tests/fm-afk-inject-herdr-e2e.test.sh` for the harnesses that still run the daemon, and the dedicated Herdr daemon workspace topology is covered by `tests/fm-afk-launch.test.sh` and preserves the captain tab's pane count.
 
+## Treehouse worktree pool
+
+The pool claim `bin/fm-spawn.sh` takes on a task worktree was verified on 2026-09-17 with treehouse v2.1.0 on Linux (WSL2).
+A task whose agent is not currently running leaves no process inside its copy, and a lease is what keeps that idle-looking copy from being handed to the next spawn and reset.
+
+```sh
+treehouse get --lease --lease-holder 'fm:demo-task@/home/fm/state'
+treehouse status --json
+printf 'pwd -P\nexit\n' | treehouse get
+```
+
+Observed output, with the pool root shortened:
+
+```text
+.treehouse/repo-b871d3/1/repo
+[{"name":"1","path":".../1/repo","status":"leased","lease_id":"84cf5022d6c3160e356d7a09de20d763","lease_holder":"fm:demo-task@/home/fm/state","leased_at":"2026-09-17T18:37:42.418019618+07:00","processes":[]}]
+.treehouse/repo-b871d3/2/repo
+```
+
+The leased slot carries no process and is still not handed to the later plain `get`, which allocates a different slot, and the holder label is readable back from the pool's own status.
+[`tests/fm-spawn-worktree-lease.test.sh`](../../tests/fm-spawn-worktree-lease.test.sh) is the command that refreshes this record; it skips when treehouse is not installed.
+
 ## Zellij
 
 The current compatibility floor and latest verification are Zellij 0.44.0 with `jq` on macOS aarch64.
diff --git a/docs/zellij-backend.md b/docs/zellij-backend.md
index fb58e52a621..a12ba2dd9ed 100644
--- a/docs/zellij-backend.md
+++ b/docs/zellij-backend.md
@@ -66,7 +66,7 @@ A pane can still disappear between verification and the operation; downstream su
 
 Every pane operation passes an explicit `--pane-id` because a new session can focus its release-notes plugin pane, whose numeric plugin id is in a separate namespace from terminal pane ids.
 
-`pane_cwd` follows a top-level shell `cd` but not the foreground subshell opened by `treehouse get`.
+`pane_cwd` follows a top-level shell `cd` but not a foreground subshell.
 Worktree discovery therefore sends begin and end markers around `pwd`, captures the marked block, and joins wrapped path lines.
 This active probe is scoped to spawn-time worktree discovery and is not advertised as a general live-cwd API.
 
diff --git a/tests/fixtures.sh b/tests/fixtures.sh
index 043d350012e..f95c8192f5a 100755
--- a/tests/fixtures.sh
+++ b/tests/fixtures.sh
@@ -251,14 +251,15 @@ EOF
 }
 
 # fm_test_make_spawn_fakebin <dir> [extra-exit0-tool...]
-# Creates <dir>/fakebin with the spawn tmux stub, a no-op treehouse, and any
-# extra exit-0 tools. Echoes the fakebin path.
+# Creates <dir>/fakebin with the spawn tmux stub, a lease-answering treehouse,
+# and any extra exit-0 tools. Echoes the fakebin path.
 fm_test_make_spawn_fakebin() {
   local dir=$1 fakebin
   shift
   fakebin=$(fm_fakebin "$dir")
   fm_test_fake_tmux_spawn "$fakebin"
-  fm_fake_exit0 "$fakebin" treehouse "$@"
+  fm_fake_exit0 "$fakebin" "$@"
+  fm_test_fake_treehouse_lease "$fakebin"
   printf '%s\n' "$fakebin"
 }
 
diff --git a/tests/fm-backend-herdr-presentation-e2e.test.sh b/tests/fm-backend-herdr-presentation-e2e.test.sh
index 4aef0afc349..3faad50e0d1 100755
--- a/tests/fm-backend-herdr-presentation-e2e.test.sh
+++ b/tests/fm-backend-herdr-presentation-e2e.test.sh
@@ -208,8 +208,12 @@ set -u
   done
   printf '\n'
 } >> "$TREEHOUSE_CALL_LOG"
+# Arm the post-create abort: the worktree claim is taken after the task pane
+# exists, so refusing it aborts the spawn exactly where this fixture needs it,
+# without involving the real pool or the arrival wait.
 if [ -d "$POST_CREATE_ABORT_CONTROL" ] && [ "${1:-}" = get ]; then
-  exit 0
+  echo "treehouse: no worktree available (post-create abort fixture)" >&2
+  exit 1
 fi
 # Treehouse's pool allocator is outside the Herdr concurrency contract under
 # test. Serialize its calls so simultaneous recovery spawns cannot race for
@@ -412,10 +416,18 @@ spawn_task() {  # <id> <home> <project>
     "$ROOT/bin/fm-spawn.sh" "$id" "$project" "sh -c 'while :; do sleep 60; done'" --mode no-mistakes --yolo off --backend herdr
 }
 
+# A concurrent spawn can lose either serialization race before it does any
+# projected work: the home's task-set lock, or the project's pool-slot lock that
+# the worktree claim is taken under. Both mean "not my turn yet", so both retry.
+concurrent_spawn_lost_a_lock() {  # <stderr>
+  grep -F "task set is locked" "$1" >/dev/null 2>&1 \
+    || grep -F "Treehouse slot allocation or return is in progress" "$1" >/dev/null 2>&1
+}
+
 finish_concurrent_spawn() {  # <id> <status> <stdout> <stderr>
   local id=$1 status=$2 out=$3 err=$4
   [ "$status" -ne 0 ] || return 0
-  grep -F "task set is locked" "$err" >/dev/null 2>&1 \
+  concurrent_spawn_lost_a_lock "$err" \
     || fail "concurrent projected spawn $id failed unexpectedly: $(cat "$err")"
   spawn_task "$id" "$HOME_DIR" "$PROJECT_DIR" > "$out" 2> "$err" \
     || fail "projected spawn $id retry failed after task-set publication completed: $(cat "$err")"
@@ -424,7 +436,7 @@ finish_concurrent_spawn() {  # <id> <status> <stdout> <stderr>
 finish_concurrent_expected_abort() {  # <id> <status> <stdout> <stderr>
   local id=$1 status=$2 out=$3 err=$4
   [ "$status" -ne 0 ] || fail "post-create abort fixture $id unexpectedly succeeded"
-  if grep -F "task set is locked" "$err" >/dev/null 2>&1; then
+  if concurrent_spawn_lost_a_lock "$err"; then
     if spawn_task "$id" "$HOME_DIR" "$PROJECT_DIR" > "$out" 2> "$err"; then
       fail "post-create abort fixture $id unexpectedly succeeded after task-set publication completed"
     fi
@@ -851,20 +863,31 @@ if wait "$ABORT_A_PID"; then ABORT_A_STATUS=0; else ABORT_A_STATUS=$?; fi
 if wait "$ABORT_B_PID"; then ABORT_B_STATUS=0; else ABORT_B_STATUS=$?; fi
 finish_concurrent_expected_abort abort-a "$ABORT_A_STATUS" "$TMP_ROOT/abort-a.out" "$TMP_ROOT/abort-a.err"
 finish_concurrent_expected_abort abort-b "$ABORT_B_STATUS" "$TMP_ROOT/abort-b.out" "$TMP_ROOT/abort-b.err"
-# The forced foreground_cwd is a plain non-git directory, which the discovery
-# poll now screens out on every read rather than adopting, so the armed failure
-# arrives as the poll's own deadline refusal naming that path.
-grep -F "did not enter an isolated worktree" "$TMP_ROOT/abort-a.err" >/dev/null 2>&1 \
+# The armed failure is the refused worktree claim, which the spawn takes after
+# the task pane exists - so both spawns abort post-create, as this fixture needs.
+grep -F "could not lease a worktree" "$TMP_ROOT/abort-a.err" >/dev/null 2>&1 \
   || fail "post-create abort fixture A did not reach the armed validation failure"
-grep -F "did not enter an isolated worktree" "$TMP_ROOT/abort-b.err" >/dev/null 2>&1 \
+grep -F "could not lease a worktree" "$TMP_ROOT/abort-b.err" >/dev/null 2>&1 \
   || fail "post-create abort fixture B did not reach the armed validation failure"
 ABORT_A_PANE=$(cat "$POST_CREATE_ABORT_CONTROL/abort-a/task-pane")
 ABORT_B_PANE=$(cat "$POST_CREATE_ABORT_CONTROL/abort-b/task-pane")
-ABORT_SEQUENCE=$(sed -n "$((ABORT_FOCUS_START + 1)),\$p" "$FOCUS_AUDIT_LOG" | awk -F '\t' -v a="$ABORT_A_PANE" -v b="$ABORT_B_PANE" '
-  $1 == "workspace-create" && $4 ~ /^└ abort-a · p:/ { print "create-a" }
-  $1 == "workspace-create" && $4 ~ /^└ abort-b · p:/ { print "create-b" }
-  $1 == "pane-close" && $4 == a { print "close-a" }
-  $1 == "pane-close" && $4 == b { print "close-b" }
+# Read the interleaving from the ordered CLI call log rather than the focus
+# audit: an aborted spawn's projected pane is a bare idle shell, so the
+# focus-preserving close ends that shell instead of calling `pane close`, and
+# only the call log records both mechanisms in one order. Either one is that
+# task's cleanup; what must hold is that one task's create-then-cleanup does not
+# interleave with the other's.
+ABORT_SEQUENCE=$(sed -n "$((ABORT_START + 1)),\$p" "$HERDR_CALL_LOG" | awk -F '\t' -v a="$ABORT_A_PANE" -v b="$ABORT_B_PANE" '
+  $1 == "workspace" && $2 == "create" { for (i = 3; i <= NF; i++) {
+    if ($i ~ /^└ abort-a · p:/) { print "create-a" }
+    if ($i ~ /^└ abort-b · p:/) { print "create-b" }
+  } }
+  $1 == "pane" && ($2 == "close" || $2 == "process-info") {
+    for (i = 3; i <= NF; i++) {
+      if ($i == a && !seen_a) { print "close-a"; seen_a = 1 }
+      if ($i == b && !seen_b) { print "close-b"; seen_b = 1 }
+    }
+  }
 ')
 case "$ABORT_SEQUENCE" in
   $'create-a\nclose-a\ncreate-b\nclose-b'|$'create-b\nclose-b\ncreate-a\nclose-a') ;;
diff --git a/tests/fm-backend.test.sh b/tests/fm-backend.test.sh
index f7021ac39e6..6d349600b2c 100755
--- a/tests/fm-backend.test.sh
+++ b/tests/fm-backend.test.sh
@@ -807,7 +807,15 @@ esac
 exit 0
 SH
   chmod +x "$fb/tmux"
-  fm_fake_exit0 "$fb" treehouse
+  # Stand in for the pool: the spawn leases its worktree, so the stub hands back
+  # the same fake worktree this fixture's tmux stub reports.
+  cat > "$fb/treehouse" <<SH
+#!/usr/bin/env bash
+set -u
+case " \$* " in *" --lease "*) printf '%s\\n' "$wt"; exit 0 ;; esac
+exit 0
+SH
+  chmod +x "$fb/treehouse"
   printf '%s\n' "$fb"
 }
 
@@ -877,7 +885,15 @@ esac
 exit 0
 SH
   chmod +x "$fb/tmux"
-  fm_fake_exit0 "$fb" treehouse
+  # Stand in for the pool: the spawn leases its worktree, so the stub hands back
+  # the same fake worktree this fixture's tmux stub reports.
+  cat > "$fb/treehouse" <<SH
+#!/usr/bin/env bash
+set -u
+case " \$* " in *" --lease "*) printf '%s\\n' "$wt"; exit 0 ;; esac
+exit 0
+SH
+  chmod +x "$fb/treehouse"
   printf '%s\n' "$fb"
 }
 
diff --git a/tests/fm-backlog-atomicity.test.sh b/tests/fm-backlog-atomicity.test.sh
index 2290c5848bf..e5448fbe13c 100755
--- a/tests/fm-backlog-atomicity.test.sh
+++ b/tests/fm-backlog-atomicity.test.sh
@@ -95,7 +95,8 @@ case "${1:-}" in display-message) printf 'firstmate\n'; exit 0 ;; esac
 exit 0
 SH
   chmod +x "$fakebin/tmux"
-  fm_fake_exit0 "$fakebin" treehouse gh gh-axi no-mistakes
+  fm_fake_exit0 "$fakebin" gh gh-axi no-mistakes
+  fm_test_fake_treehouse_lease "$fakebin"
 
   fm_git_init_commit "$case_dir/project"
   fm_git_add_origin "$case_dir/project" "$case_dir/project.origin.git"
diff --git a/tests/fm-bootstrap-network-parallel.test.sh b/tests/fm-bootstrap-network-parallel.test.sh
index f28d46cebe0..a27b5a9d4a0 100755
--- a/tests/fm-bootstrap-network-parallel.test.sh
+++ b/tests/fm-bootstrap-network-parallel.test.sh
@@ -184,7 +184,8 @@ test_remote_probe_scheduling_keeps_per_mate_lines() { # <parallel|fallback>
   git -C "$primary" add AGENTS.md bin
   git -C "$primary" commit -qm 'seed primary default branch'
   fakebin=$(fm_fakebin "$dir")
-  fm_fake_exit0 "$fakebin" gh treehouse tmux node
+  fm_fake_exit0 "$fakebin" gh tmux node
+  fm_test_fake_treehouse_lease "$fakebin"
   log="$dir/probe.log"
   : > "$log"
   install_fake_ssh "$fakebin"
diff --git a/tests/fm-captain-hold-lifecycle.test.sh b/tests/fm-captain-hold-lifecycle.test.sh
index cfe7f443562..a537aa0509c 100755
--- a/tests/fm-captain-hold-lifecycle.test.sh
+++ b/tests/fm-captain-hold-lifecycle.test.sh
@@ -31,7 +31,8 @@ make_home() {  # <name>
 ## Done
 EOF
   fakebin=$(fm_fakebin "$home")
-  fm_fake_exit0 "$fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_fake_exit0 "$fakebin" tmux no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$fakebin"
   printf '%s\n' "$home"
 }
 
@@ -240,7 +241,8 @@ archive = "data/done-archive.md"
 done_keep = 10
 EOF
   fb=$(fm_fakebin "$home")
-  fm_fake_exit0 "$fb" tmux treehouse no-mistakes gh gh-axi
+  fm_fake_exit0 "$fb" tmux no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$fb"
   printf '%s\n' "$home|$graph/.beads"
 }
 
@@ -1299,7 +1301,8 @@ test_secondmate_hold_stays_in_authoritative_home() {
 ## Done
 EOF
   fakebin=$(fm_fakebin "$mate")
-  fm_fake_exit0 "$fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_fake_exit0 "$fakebin" tmux no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$fakebin"
   origin=sample-mate-review
   mkdir -p "$mate/data/$origin"
   tasks_in "$mate" add "$origin" "Investigate secondmate sample" --kind scout --repo sample --start >/dev/null
@@ -1356,7 +1359,8 @@ test_secondmate_home_publishes_holds_and_answers() {
 ## Done
 EOF
   fakebin=$(fm_fakebin "$mate")
-  fm_fake_exit0 "$fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_fake_exit0 "$fakebin" tmux no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$fakebin"
   channel="$parent/state/channel-mate.status"
   decision="$mate/decision.txt"
 
@@ -2901,7 +2905,7 @@ SH
   assert_not_contains "$show" "Deliverable of the finished work" \
     "the deliverable was recorded before destructive cleanup succeeded"
 
-  fm_fake_exit0 "$home/fakebin" treehouse
+  fm_test_fake_treehouse_lease "$home/fakebin"
   bootstrap=$(PATH="$home/fakebin:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
     FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
     FM_CONFIG_OVERRIDE="$home/config" FM_BOOTSTRAP_NETWORK=skip \
@@ -2957,7 +2961,7 @@ SH
   printf 'Proceed with the reported result.\n' > "$home/answer.txt"
   run_captain "$home" answer "$id" --decision-file "$home/answer.txt" >/dev/null \
     || fail "the captain could not answer before cleanup replay"
-  fm_fake_exit0 "$home/fakebin" treehouse
+  fm_test_fake_treehouse_lease "$home/fakebin"
   bootstrap=$(PATH="$home/fakebin:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
     FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
     FM_CONFIG_OVERRIDE="$home/config" FM_BOOTSTRAP_NETWORK=skip \
@@ -3082,7 +3086,7 @@ SH
   assert_contains "$show" "state: done" "the relocated report kept the answered call open"
   assert_contains "$show" "held: no" "the relocated report kept the answered call held"
 
-  fm_fake_exit0 "$home/fakebin" treehouse
+  fm_test_fake_treehouse_lease "$home/fakebin"
   bootstrap=$(PATH="$home/fakebin:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
     FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$data" \
     FM_CONFIG_OVERRIDE="$home/config" FM_BOOTSTRAP_NETWORK=skip \
diff --git a/tests/fm-kimi-harness.test.sh b/tests/fm-kimi-harness.test.sh
index e08674d3fe8..59d562ffd2c 100755
--- a/tests/fm-kimi-harness.test.sh
+++ b/tests/fm-kimi-harness.test.sh
@@ -202,7 +202,8 @@ esac
 exit 0
 SH
   chmod +x "$fakebin/tmux"
-  fm_fake_exit0 "$fakebin" treehouse gh-axi gh
+  fm_fake_exit0 "$fakebin" gh-axi gh
+  fm_test_fake_treehouse_lease "$fakebin"
   fm_fake_exit0 "$fakebin" kimi
   ln -s "$JQ_BIN" "$fakebin/jq"
   printf '%s\n' "$fakebin"
diff --git a/tests/fm-muse-harness.test.sh b/tests/fm-muse-harness.test.sh
index a655b4d7ec7..75c8563c7f5 100755
--- a/tests/fm-muse-harness.test.sh
+++ b/tests/fm-muse-harness.test.sh
@@ -112,7 +112,8 @@ set -u
 exec "$FM_FAKE_MUSE_VERSIONED" -c 'result=$($FM_FAKE_HARNESS_PROBE); printf "%s" "$result" > "$FM_FAKE_HARNESS_RESULT"'
 SH
   chmod +x "$fakebin/muse"
-  fm_fake_exit0 "$fakebin" treehouse gh-axi gh
+  fm_fake_exit0 "$fakebin" gh-axi gh
+  fm_test_fake_treehouse_lease "$fakebin"
   printf '%s\n' "$fakebin"
 }
 
diff --git a/tests/fm-public-followup.test.sh b/tests/fm-public-followup.test.sh
index c5551d99a0b..5859fbb8233 100755
--- a/tests/fm-public-followup.test.sh
+++ b/tests/fm-public-followup.test.sh
@@ -125,7 +125,8 @@ make_home() {  # <name> [relay-on|relay-off]
 EOF
   [ "$relay" = relay-off ] || printf 'FMX_PAIRING_TOKEN=test-token\n' > "$home/.env"
   make_fake_curl "$home" >/dev/null
-  fm_fake_exit0 "$home/fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_fake_exit0 "$home/fakebin" tmux no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$home/fakebin"
   printf '%s\n' "$home"
 }
 
@@ -846,7 +847,8 @@ test_secondmate_teardown_resolves_parent_from_durable_record_when_env_lost() {
   child=$(cd "$child" && pwd -P)
   parent_resolved=$(cd "$parent" && pwd -P)
   make_fake_curl "$child" >/dev/null
-  fm_fake_exit0 "$child/fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_fake_exit0 "$child/fakebin" tmux no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$child/fakebin"
 
   assert_local_secondmate_parent_record "$child" "$parent_resolved"
 
@@ -883,7 +885,8 @@ test_secondmate_teardown_durable_record_missing_parent_registration_still_refuse
   child=$(cd "$child" && pwd -P)
   parent_resolved=$(cd "$parent" && pwd -P)
   make_fake_curl "$child" >/dev/null
-  fm_fake_exit0 "$child/fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_fake_exit0 "$child/fakebin" tmux no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$child/fakebin"
   assert_local_secondmate_parent_record "$child" "$parent_resolved"
   fm_write_meta "$child/state/work-child.meta" \
     "window=firstmate:fm-work-child" "endpoint_task_id=work-child" \
@@ -914,7 +917,8 @@ test_secondmate_teardown_durable_record_with_unknown_field_succeeds() {
   child=$(cd "$child" && pwd -P)
   parent_resolved=$(cd "$parent" && pwd -P)
   make_fake_curl "$child" >/dev/null
-  fm_fake_exit0 "$child/fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_fake_exit0 "$child/fakebin" tmux no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$child/fakebin"
   assert_local_secondmate_parent_record "$child" "$parent_resolved"
   printf 'some_future_field=value\n' >> "$child/.fm-secondmate-parent"
   parent_alias="$TMP_ROOT/teardown-durable-clean-parent-alias"
@@ -949,7 +953,8 @@ test_secondmate_teardown_rejects_conflicting_live_and_durable_parent_bindings()
   child=$(cd "$child" && pwd -P)
   parent_resolved=$(cd "$durable_parent" && pwd -P)
   make_fake_curl "$child" >/dev/null
-  fm_fake_exit0 "$child/fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_fake_exit0 "$child/fakebin" tmux no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$child/fakebin"
   assert_local_secondmate_parent_record "$child" "$parent_resolved"
   fm_write_meta "$durable_parent/state/mate.meta" "kind=secondmate" "home=$child"
   fm_git_init_commit "$child/projects/worktree"
@@ -981,7 +986,8 @@ test_secondmate_teardown_rejects_unsafe_durable_parent_records() {
       || fail "real secondmate seeding failed for $case_name"
     child=$(cd "$child" && pwd -P)
     make_fake_curl "$child" >/dev/null
-    fm_fake_exit0 "$child/fakebin" tmux treehouse no-mistakes gh gh-axi
+    fm_fake_exit0 "$child/fakebin" tmux no-mistakes gh gh-axi
+    fm_test_fake_treehouse_lease "$child/fakebin"
     fm_write_meta "$child/state/work-child.meta" \
       "window=firstmate:fm-work-child" "endpoint_task_id=work-child" \
       "worktree=$child" "project=$child" "kind=ship" "mode=local-only" "spawn_gen=public-followup-fixture"
@@ -1043,7 +1049,8 @@ test_secondmate_teardown_rejects_nul_bearing_durable_parent_record() {
   child=$(cd "$child" && pwd -P)
   parent_resolved=$(cd "$parent" && pwd -P)
   make_fake_curl "$child" >/dev/null
-  fm_fake_exit0 "$child/fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_fake_exit0 "$child/fakebin" tmux no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$child/fakebin"
   assert_local_secondmate_parent_record "$child" "$parent_resolved"
   fm_write_meta "$parent/state/mate.meta" "kind=secondmate" "home=$child"
   fm_git_init_commit "$child/projects/worktree"
@@ -1474,7 +1481,8 @@ test_dropped_baton_now_surfaces_open_loop() {
     "$ROOT/bin/fm-home-seed.sh" mate "$child" --no-projects >/dev/null || fail "seed failed"
   child=$(cd "$child" && pwd -P)
   make_fake_curl "$child" >/dev/null
-  fm_fake_exit0 "$child/fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_fake_exit0 "$child/fakebin" tmux no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$child/fakebin"
   log="$TMP_ROOT/curl.log"; : > "$log"
 
   seed_repro_commitment "$parent" public-final-pi-rearm-repro req-pirearm \
@@ -1524,7 +1532,8 @@ test_control_registered_followon_is_guarded() {
     "$ROOT/bin/fm-home-seed.sh" mate "$child" --no-projects >/dev/null || fail "seed failed"
   child=$(cd "$child" && pwd -P)
   make_fake_curl "$child" >/dev/null
-  fm_fake_exit0 "$child/fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_fake_exit0 "$child/fakebin" tmux no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$child/fakebin"
   seed_repro_commitment "$parent" public-final-pi-rearm-ship req-pirearm2 \
     secondmate:mate pi-rearm-loop-fix-r1
   fm_write_meta "$parent/state/mate.meta" "kind=secondmate" "home=$child"
diff --git a/tests/fm-rovo-harness.test.sh b/tests/fm-rovo-harness.test.sh
index 021d6ff0c59..a5f368e9b14 100644
--- a/tests/fm-rovo-harness.test.sh
+++ b/tests/fm-rovo-harness.test.sh
@@ -123,7 +123,8 @@ esac
 exit 0
 SH
   chmod +x "$fakebin/tmux"
-  fm_fake_exit0 "$fakebin" treehouse gh-axi gh
+  fm_fake_exit0 "$fakebin" gh-axi gh
+  fm_test_fake_treehouse_lease "$fakebin"
   fm_fake_exit0 "$fakebin" rovo
   printf '%s\n' "$fakebin"
 }
diff --git a/tests/fm-secondmate-harness.test.sh b/tests/fm-secondmate-harness.test.sh
index f4d9546e0b4..a3f8c3c4648 100755
--- a/tests/fm-secondmate-harness.test.sh
+++ b/tests/fm-secondmate-harness.test.sh
@@ -682,6 +682,7 @@ SH
   # registration below needs, so link the real one in rather than presenting a
   # node-less spawn host no real fleet member looks like.
   ln -sf "$(command -v node)" "$fakebin/node"
+  fm_test_fake_treehouse_lease "$fakebin"
   printf '%s\n' "$fakebin"
 }
 
@@ -1112,14 +1113,7 @@ SH
 exit 0
 SH
   chmod +x "$fakebin/gh"
-  cat > "$fakebin/treehouse" <<'SH'
-#!/usr/bin/env bash
-if [ "${1:-}" = get ] && [ "${2:-}" = --help ]; then
-  printf '%s\n' 'Usage: treehouse get [--lease]'
-fi
-exit 0
-SH
-  chmod +x "$fakebin/treehouse"
+  fm_test_fake_treehouse_lease "$fakebin"
   cat > "$fakebin/no-mistakes" <<'SH'
 #!/usr/bin/env bash
 if [ "${1:-}" = --version ]; then
diff --git a/tests/fm-secondmate-sync.test.sh b/tests/fm-secondmate-sync.test.sh
index 234c39c30b2..201812ba56c 100755
--- a/tests/fm-secondmate-sync.test.sh
+++ b/tests/fm-secondmate-sync.test.sh
@@ -1273,7 +1273,8 @@ test_bootstrap_syncs_remote_home_to_primary_commit() {
     'herdr_workspace_id=w1' 'herdr_tab_id=t1' 'herdr_pane_id=p1'
 
   fakebin=$(make_remote_leg_ssh_stub "$w")
-  fm_fake_exit0 "$fakebin" gh treehouse tmux node
+  fm_fake_exit0 "$fakebin" gh tmux node
+  fm_test_fake_treehouse_lease "$fakebin"
   out=$(PATH="$fakebin:$BASE_PATH" \
     FM_HOME="$home" FM_ROOT_OVERRIDE="$w/main" \
     FM_BOOTSTRAP_NETWORK=only \
@@ -1311,7 +1312,8 @@ test_bootstrap_reports_outdated_host_actionably() {
   printf 'remote_host=host-sm\n' >> "$home/state/sm.meta"
 
   fakebin=$(make_remote_leg_ssh_stub "$w")
-  fm_fake_exit0 "$fakebin" gh treehouse tmux node
+  fm_fake_exit0 "$fakebin" gh tmux node
+  fm_test_fake_treehouse_lease "$fakebin"
   out=$(PATH="$fakebin:$BASE_PATH" \
     FM_HOME="$home" FM_ROOT_OVERRIDE="$w/main" \
     FM_BOOTSTRAP_NETWORK=only \
@@ -1352,7 +1354,8 @@ test_remote_launch_does_not_retarget_host_copy() {
   install_remote_herdr_fixture "$herdrbin" "$w/herdr.state" "$w/herdr.log" \
     "$w/herdr.sendfail" "$w/herdr.sock"
   cp "$herdrbin/bin/herdr" "$fakebin/herdr"
-  fm_fake_exit0 "$fakebin" gh treehouse tmux node
+  fm_fake_exit0 "$fakebin" gh tmux node
+  fm_test_fake_treehouse_lease "$fakebin"
 
   # The real launch leg, exactly as the parent invokes it after its own sync.
   launch_out=$(PATH="$fakebin:$BASE_PATH" \
diff --git a/tests/fm-shared-captain-inheritance.test.sh b/tests/fm-shared-captain-inheritance.test.sh
index efd61dd804f..b094f200d59 100755
--- a/tests/fm-shared-captain-inheritance.test.sh
+++ b/tests/fm-shared-captain-inheritance.test.sh
@@ -219,7 +219,8 @@ SH
 # Version-aware stubs so bootstrap's tool floors stay quiet in fixture PATH.
 add_bootstrap_compatible_tools() {
   local fakebin=$1
-  fm_fake_exit0 "$fakebin" node chrome-devtools-axi gh treehouse
+  fm_fake_exit0 "$fakebin" node chrome-devtools-axi gh
+  fm_test_fake_treehouse_lease "$fakebin"
   fm_fake_version_tool "$fakebin" lavish-axi FM_FAKE_LAVISH_AXI_VERSION 0.1.46
   cat > "$fakebin/gh-axi" <<'SH'
 #!/usr/bin/env bash
diff --git a/tests/fm-spawn-base-branch.test.sh b/tests/fm-spawn-base-branch.test.sh
index 08a76399be1..dbcbe5fcd51 100755
--- a/tests/fm-spawn-base-branch.test.sh
+++ b/tests/fm-spawn-base-branch.test.sh
@@ -47,7 +47,7 @@ esac
 exit 0
 SH
   chmod +x "$fakebin/tmux"
-  fm_fake_exit0 "$fakebin" treehouse
+  fm_test_fake_treehouse_lease "$fakebin"
   printf '%s\n' "$fakebin"
 }
 
diff --git a/tests/fm-spawn-pool-base-freshen.test.sh b/tests/fm-spawn-pool-base-freshen.test.sh
index 2d39f3607ca..298c463efff 100755
--- a/tests/fm-spawn-pool-base-freshen.test.sh
+++ b/tests/fm-spawn-pool-base-freshen.test.sh
@@ -144,14 +144,15 @@ test_linked_spawning_home_rejects_primary_before_refresh() {
         || fail "spawn did not refresh the genuine scout copy"
     else
       [ "$status" -ne 0 ] || fail "linked spawning home accepted $returned as a disposable copy"
-      # None of these is an isolated copy, so the worktree poll never adopts one
-      # and the wait runs out instead: the spawning directory fails the poll's
-      # own project comparison, and the repository primary (named directly or
-      # through a symlink) fails the isolation screen the poll shares with the
-      # guard. The refusal names the last path the pane reported.
-      assert_contains "$out" "did not enter an isolated worktree" \
+      # None of these is an isolated copy, so the isolation screen refuses the
+      # leased path before the pane is ever moved into it: the spawning
+      # directory fails the project comparison, and the repository primary
+      # (named directly or through a symlink) fails the common-git-dir test.
+      # The refusal names the copy it rejected and why.
+      assert_contains "$out" "did not yield an isolated worktree" \
         "spawn did not explain its isolation refusal"
-      assert_contains "$out" "last seen" "refusal did not name the path the pane reported"
+      assert_contains "$out" "resolved '$POOL_DIR'" \
+        "refusal did not name the copy it rejected"
       [ ! -e "$HOME_DIR/state/$id.meta" ] || fail "refused spawn published task metadata"
       [ ! -e "$primary/.git/FETCH_HEAD" ] || fail "refused spawn fetched before proving isolation"
     fi
diff --git a/tests/fm-spawn-worktree-lease.test.sh b/tests/fm-spawn-worktree-lease.test.sh
new file mode 100644
index 00000000000..647a278bc92
--- /dev/null
+++ b/tests/fm-spawn-worktree-lease.test.sh
@@ -0,0 +1,166 @@
+#!/usr/bin/env bash
+# Regression test for the worktree claim fm-spawn.sh takes on a pool slot
+# (bin/fm-spawn.sh, the `treehouse get --lease` branch).
+#
+# Treehouse counts a slot as in use only while a process runs inside it, so a
+# task whose agent has exited - paused, crashed, or between turns - leaves its
+# own working copy looking free, and the next spawn was handed that copy and
+# reset it (observed 2026-08-19, silently, with no refusal). fm-spawn therefore
+# takes the pool's own durable claim on the slot instead of relying on the
+# pane's subshell to hold it, and labels the lease with the task record that
+# owns it so a lease outliving its task can be identified and released.
+#
+# The three things that must hold: the claim is taken and labelled, an aborted
+# spawn gives it straight back, and a live claim really does keep the pool from
+# handing the same copy to the next get.
+set -u
+
+# shellcheck source=tests/fixtures.sh
+. "$(dirname "${BASH_SOURCE[0]}")/fixtures.sh"
+
+TMP_ROOT=$(fm_test_tmproot fm-spawn-worktree-lease)
+SEP=$'\x1f'
+
+# make_lease_case <name> <id> -> case record; leaves LEASE_* globals set.
+make_lease_case() {
+  local name=$1 id=$2 case_dir
+  case_dir="$TMP_ROOT/$name"
+  LEASE_HOME="$case_dir/home"
+  LEASE_PROJ="$case_dir/project"
+  LEASE_WT="$case_dir/slot"
+  LEASE_LOG="$case_dir/treehouse.log"
+  mkdir -p "$case_dir"
+  LEASE_FAKEBIN=$(make_spawn_fakebin "$case_dir/fake")
+  fm_test_fake_sleep_noop "$LEASE_FAKEBIN"
+  fm_test_spawn_home "$LEASE_HOME" codex
+  fm_git_worktree "$LEASE_PROJ" "$LEASE_WT" "slot-$name"
+  fm_test_spawn_brief "$LEASE_HOME" "$id" "Exercise the pool claim for $id."
+  : > "$LEASE_LOG"
+}
+
+run_lease_spawn() {  # <id> <pane-path>
+  local id=$1 pane=$2
+  FM_TREEHOUSE_LOG="$LEASE_LOG" FM_FAKE_LEASE_PATH="$LEASE_WT" \
+    fm_test_run_spawn "$LEASE_HOME" "$pane" "$LEASE_FAKEBIN" \
+    "$id" "$LEASE_PROJ" --mode no-mistakes --yolo off
+}
+
+# The claim itself: a durable lease, labelled with the task record that owns it
+# so the label alone says which record to look for when a lease outlives its
+# task.
+test_spawn_claims_the_slot_with_a_labelled_lease() {
+  local id out status
+  id=lease-claim-w1
+  make_lease_case lease-claim "$id"
+
+  out=$(run_lease_spawn "$id" "$LEASE_WT")
+  status=$?
+  expect_code 0 "$status" "spawn should succeed"$'\n'"$out"
+  assert_grep "worktree=$LEASE_WT" "$LEASE_HOME/state/$id.meta" \
+    "meta did not record the leased worktree"
+  assert_contains "$(cat "$LEASE_LOG")" \
+    "treehouse${SEP}get${SEP}--lease${SEP}--lease-holder${SEP}fm:$id@$LEASE_HOME/state" \
+    "spawn did not take a durable lease labelled with the owning task record"
+  assert_not_contains "$(cat "$LEASE_LOG")" "return" \
+    "a successful spawn returned the slot it had just claimed"
+  pass "a spawn claims its pool slot with a lease labelled by the owning task record"
+}
+
+# The claim must not outlive a spawn that never published a record to point at
+# it, and the return must be holder-matched so it can never take back a slot
+# some later allocation already owns.
+test_aborted_spawn_returns_its_claim() {
+  local id out status log
+  id=lease-abort-w2
+  make_lease_case lease-abort "$id"
+
+  # The pane never arrives in the leased copy, so the spawn refuses at the
+  # deadline - after the lease was taken and before any record names it.
+  out=$(run_lease_spawn "$id" "$LEASE_PROJ")
+  status=$?
+  [ "$status" -ne 0 ] || fail "spawn accepted a pane that never entered the leased worktree"$'\n'"$out"
+  [ ! -e "$LEASE_HOME/state/$id.meta" ] || fail "refused spawn published task metadata"
+  log=$(cat "$LEASE_LOG")
+  assert_contains "$log" \
+    "treehouse${SEP}return${SEP}--force${SEP}--if-lease-holder${SEP}fm:$id@$LEASE_HOME/state${SEP}$LEASE_WT" \
+    "an aborted spawn left its pool claim behind"
+  pass "an aborted spawn returns its claim, matched on the holder that took it"
+}
+
+# A copy the pool still offers although a live task record names it - the shape
+# a task spawned before leases existed leaves behind - must be refused, and the
+# refusal must name the holder. The claim is kept so the same copy is not
+# offered to the next spawn, which would refuse again and deadlock the pool.
+test_copy_another_task_record_claims_is_refused_by_name() {
+  local id out status log
+  id=lease-conflict-w3
+  make_lease_case lease-conflict "$id"
+  fm_write_meta "$LEASE_HOME/state/other-task-w3.meta" \
+    "worktree=$LEASE_WT" "project=$LEASE_PROJ" "kind=ship" "backend=tmux"
+
+  out=$(run_lease_spawn "$id" "$LEASE_WT")
+  status=$?
+  [ "$status" -ne 0 ] || fail "spawn launched into a copy another task record claims"$'\n'"$out"
+  assert_contains "$out" "task other-task-w3's own record still names as its working copy" \
+    "the refusal did not name the task holding the copy"
+  assert_contains "$out" "--if-lease-holder 'fm:$id@$LEASE_HOME/state'" \
+    "the refusal did not say how to release the copy it is holding"
+  [ ! -e "$LEASE_HOME/state/$id.meta" ] || fail "refused spawn published task metadata"
+  log=$(cat "$LEASE_LOG")
+  assert_not_contains "$log" "return" \
+    "the refusal returned the claim, so the next spawn would be offered the same copy again"
+  pass "a copy another task record claims is refused by name, and stays claimed"
+}
+
+# The record's own claim is also what says it does not need this defence: a task
+# holding a lease cannot have had its copy offered, so its record must not block
+# a spawn the pool did allocate.
+test_a_record_holding_its_own_claim_does_not_block_a_spawn() {
+  local id out status
+  id=lease-claimed-neighbour-w4
+  make_lease_case lease-claimed-neighbour "$id"
+  fm_write_meta "$LEASE_HOME/state/other-task-w4.meta" \
+    "worktree=$LEASE_WT" "worktree_lease=fm:other-task-w4@$LEASE_HOME/state" \
+    "project=$LEASE_PROJ" "kind=ship" "backend=tmux"
+
+  out=$(run_lease_spawn "$id" "$LEASE_WT")
+  status=$?
+  expect_code 0 "$status" "spawn was blocked by a record that holds its own claim"$'\n'"$out"
+  assert_grep "worktree_lease=fm:$id@$LEASE_HOME/state" "$LEASE_HOME/state/$id.meta" \
+    "meta did not record the claim this task holds on its copy"
+  pass "a record holding its own claim does not block a spawn the pool allocated"
+}
+
+# The guarantee the whole fix rests on, checked against the real pool rather
+# than assumed: a leased slot is not handed to a later `treehouse get`, with no
+# process running inside it.
+test_real_pool_does_not_hand_out_a_leased_slot() {
+  local repo leased handed
+  if ! command -v treehouse >/dev/null 2>&1; then
+    echo "skip: treehouse not installed - cannot check the real pool's lease guarantee"
+    return 0
+  fi
+  repo="$TMP_ROOT/real-pool/repo"
+  fm_git_init_commit "$repo"
+  printf 'max_trees = 16\nroot = "./"\n' > "$repo/treehouse.toml"
+  git -C "$repo" add treehouse.toml
+  git -C "$repo" -c user.email=fm@test -c user.name=fm commit -qm 'pool config'
+  leased=$(cd "$repo" && treehouse get --lease --lease-holder 'fm:pool-guarantee@state' 2>/dev/null) \
+    || fail "real treehouse could not lease a worktree"
+  [ -n "$leased" ] || fail "real treehouse leased no worktree"
+  # Nothing is running inside the leased slot, which is exactly the state that
+  # made a live task's copy look free before it was claimed. The pool lives
+  # under the fixture repo, so it is removed with the temp root.
+  handed=$(cd "$repo" && printf 'pwd -P\nexit\n' | treehouse get 2>/dev/null | grep '^/' | tail -1)
+  [ -n "$handed" ] || fail "real treehouse handed out no worktree at all"
+  [ "$handed" != "$leased" ] || fail "real treehouse handed out the leased, idle slot"
+  pass "the real pool does not hand out a leased slot that has no process inside it"
+}
+
+test_spawn_claims_the_slot_with_a_labelled_lease
+test_aborted_spawn_returns_its_claim
+test_copy_another_task_record_claims_is_refused_by_name
+test_a_record_holding_its_own_claim_does_not_block_a_spawn
+test_real_pool_does_not_hand_out_a_leased_slot
+
+echo "# all fm-spawn-worktree-lease tests passed"
diff --git a/tests/fm-spawn-worktree-settle.test.sh b/tests/fm-spawn-worktree-settle.test.sh
index 418d0d70246..36e15a53f3e 100755
--- a/tests/fm-spawn-worktree-settle.test.sh
+++ b/tests/fm-spawn-worktree-settle.test.sh
@@ -1,24 +1,16 @@
 #!/usr/bin/env bash
-# Regression test for the fm-spawn.sh treehouse-get worktree-detection settle
-# loop (bin/fm-spawn.sh, the `for _ in $(seq 1 60)` loop after `treehouse get`).
+# Regression test for the fm-spawn.sh pane-settle loop (bin/fm-spawn.sh, the
+# `for _ in $(seq 1 60)` loop after the worktree lease).
 #
-# On some tmux/WSL setups a brand-new window's pane_current_path transiently
-# reports a stale, unrelated-but-real path on the very first poll, before the
-# pane actually settles into the worktree treehouse get moved it to. That stale
-# path still passes the loop's "differs from the project" check and
-# validate_spawn_worktree's "is a real, distinct worktree" check (it IS a real
-# git checkout, just the wrong one), so a naive single-read loop silently
-# records the wrong worktree= in state/<id>.meta. This test simulates that
-# transient-then-settled pane_current_path sequence with a fake tmux and
-# asserts the recorded worktree resolves to the real, settled worktree, never
-# the stale first read.
-#
-# The same loop has a second transient to survive: `treehouse get` reports the
-# REPOSITORY's primary checkout as its own cwd while it is still preparing a
-# slot. From a linked spawning home that path is not the project, so a poll
-# comparing only against the project adopted it and the isolation guard then
-# refused the launch. The cases below cover both the transient and the pane
-# that never leaves the primary at all.
+# fm-spawn leases the task's worktree itself and then moves the pane into it, so
+# the leased path - not whatever the pane happens to report - is what gets
+# recorded. The loop exists to prove the pane actually arrived, and it has two
+# transients to survive. On some tmux/WSL setups a brand-new window's
+# pane_current_path reports a stale, unrelated-but-real path on the first polls
+# before the shell catches up with the cd; from a linked spawning home that
+# stale path can even be the repository's own primary checkout. Neither may be
+# mistaken for arrival, and a pane that never arrives must fail loudly at the
+# deadline rather than launching a worker outside the copy it was given.
 set -u
 
 # shellcheck source=tests/fixtures.sh
@@ -61,7 +53,7 @@ esac
 exit 0
 SH
   chmod +x "$fakebin/tmux"
-  fm_fake_exit0 "$fakebin" treehouse
+  fm_test_fake_treehouse_lease "$fakebin"
   printf '%s\n' "$fakebin"
 }
 
@@ -134,8 +126,9 @@ test_single_stale_first_read_is_not_accepted() {
   pass "a single transient stale pane_current_path read is not accepted as the worktree"
 }
 
-# A pane that reports the real worktree from the very first read costs exactly
-# one confirming read - not a whole extra polling cycle on top of it. Counting
+# A pane that reports the leased worktree from the very first read costs exactly
+# that one read - the loop must not spend a polling cycle on a settled pane.
+# Counting
 # the pane reads measures the loop itself; wall-clock time would fold in every
 # other cost of a spawn (fetch, trust registration) and drift with the machine.
 test_already_settled_pane_costs_one_confirm_read() {
@@ -150,19 +143,18 @@ test_already_settled_pane_costs_one_confirm_read() {
   assert_grep "worktree=$WT_DIR" "$HOME_DIR/state/$id.meta" \
     "meta did not record the already-settled worktree"
   reads=$(cat "$COUNTFILE")
-  [ "$reads" -eq 2 ] || fail "already-settled pane took $reads reads to confirm - expected the first read plus one confirmation"
-  pass "an already-settled pane confirms on the next read, not a whole extra cycle"
+  [ "$reads" -eq 1 ] || fail "already-settled pane took $reads reads to confirm - expected a single read"
+  pass "an already-settled pane confirms on its first read, not a whole extra cycle"
 }
 
 # make_primary_case <name> <id> <stale_reads> builds the linked-home shape: the
 # spawning project is itself a LINKED worktree of the repository, and the path
-# the pane transiently reports is that repository's PRIMARY checkout. `treehouse
-# get` reports the repository it is preparing a slot from as its own cwd while
-# it is still fetching and checking out, so the pane reads the primary for the
-# first seconds. The primary is not the spawning project, so a poll that only
-# compares against the project accepts it as the worktree, and the isolation
-# guard then refuses the launch even though treehouse went on to enter a real
-# slot. The settled path is a second linked worktree of the same repository.
+# the pane transiently reports is that repository's PRIMARY checkout - the path
+# a pane in a linked home reads for the first seconds after it is created,
+# before the cd into the leased slot takes effect. The primary is not the
+# spawning project, so a loop that only compared against the project would
+# accept it as arrival and launch the worker in the primary checkout. The
+# settled path is a second linked worktree of the same repository.
 make_primary_case() {
   local name=$1 id=$2 stale_reads=$3 case_dir home primary proj wt fakebin countfile
   case_dir="$TMP_ROOT/$name"
@@ -179,9 +171,9 @@ make_primary_case() {
   printf '%s\n' "$case_dir|$home|$proj|$wt|$primary|$fakebin|$countfile|$stale_reads"
 }
 
-# The exact incident: the pane reports the repository primary for the first
-# reads, then settles into the slot treehouse actually created. The primary must
-# never be adopted as the worktree, so the spawn lands on the settled slot.
+# The pane reports the repository primary for the first reads, then settles into
+# the leased slot. The primary must never count as arrival, so the spawn lands
+# on the leased slot.
 test_transient_primary_checkout_is_not_accepted() {
   local rec id out status
   id=settle-primary-transient-z3
@@ -211,12 +203,12 @@ test_primary_checkout_that_never_settles_fails_at_the_deadline() {
   out=$(run_settle_spawn "$id")
   status=$?
   [ "$status" -ne 0 ] || fail "spawn accepted a pane that never left the primary checkout"$'\n'"$out"
-  assert_contains "$out" "did not enter an isolated worktree" \
-    "spawn did not explain that the pane never reached an isolated worktree"
+  assert_contains "$out" "did not enter its leased worktree" \
+    "spawn did not explain that the pane never reached the leased worktree"
   assert_contains "$out" "$STALE_DIR" \
     "the refusal did not name the path the pane kept reporting"
-  assert_contains "$out" "repository's primary checkout" \
-    "the refusal did not say why that path was rejected"
+  assert_contains "$out" "$WT_DIR" \
+    "the refusal did not name the leased worktree the pane never reached"
   [ ! -e "$HOME_DIR/state/$id.meta" ] || fail "refused spawn published task metadata"
   pass "a pane stuck on the primary checkout fails loudly at the deadline"
 }
diff --git a/tests/fm-tangle-guard.test.sh b/tests/fm-tangle-guard.test.sh
index d59864e0dae..527c90f2a99 100755
--- a/tests/fm-tangle-guard.test.sh
+++ b/tests/fm-tangle-guard.test.sh
@@ -185,14 +185,14 @@ test_spawn_isolation_abort() {
   out=$(GIT_CEILING_DIRECTORIES="$TMP_ROOT/spawn-notgit-root" \
     run_spawn "$home" abort-notgit-dd4 "$proj" "$TMP_ROOT/spawn-notgit-root/plain" "$fakebin"); status=$?
   expect_code 1 "$status" "spawn into a non-worktree dir should abort"
-  assert_contains "$out" "did not enter an isolated worktree" "non-worktree spawn lacked the isolation error"
+  assert_contains "$out" "did not yield an isolated worktree" "non-worktree spawn lacked the isolation error"
   assert_contains "$out" "not inside a git worktree" "non-worktree spawn did not say why the path was rejected"
   assert_absent "$home/state/abort-notgit-dd4.meta" "aborted spawn must not record meta"
 
   # Abort: the pane resolves INTO the primary checkout (a subdir of PROJ_ABS).
   out=$(run_spawn "$home" abort-primary-ee5 "$proj" "$proj/sub" "$fakebin"); status=$?
   expect_code 1 "$status" "spawn landing inside the primary checkout should abort"
-  assert_contains "$out" "did not enter an isolated worktree" "primary-checkout spawn lacked the isolation error"
+  assert_contains "$out" "did not yield an isolated worktree" "primary-checkout spawn lacked the isolation error"
   assert_contains "$out" "not a worktree root" "primary-checkout spawn did not say why the path was rejected"
   assert_absent "$home/state/abort-primary-ee5.meta" "aborted spawn must not record meta"
 
@@ -238,7 +238,7 @@ esac
 exit 0
 SH
   chmod +x "$fakebin/tmux"
-  fm_fake_exit0 "$fakebin" treehouse
+  fm_test_fake_treehouse_lease "$fakebin"
   printf '%s\n' "$fakebin"
 }
 
@@ -277,9 +277,10 @@ test_spawn_tmux_window_construction() {
   assert_grep "set-window-option -t @spawnwid allow-rename off" "$rec" \
     "must disable allow-rename on the spawned window"
 
-  # Bug 2 fix (b): treehouse-get and the worktree wait loop target the stable id.
-  assert_grep "send-keys -t @spawnwid treehouse get Enter" "$rec" \
-    "treehouse get must be sent to the stable window id"
+  # Bug 2 fix (b): the move into the leased worktree and the arrival wait loop
+  # both target the stable id.
+  assert_grep "send-keys -t @spawnwid (cd -- " "$rec" \
+    "the move into the leased worktree must be sent to the stable window id"
   assert_grep "display-message -p -t @spawnwid #{pane_current_path}" "$rec" \
     "the worktree wait loop must query the stable window id, not the name"
 
diff --git a/tests/fm-trace-context-spawn.test.sh b/tests/fm-trace-context-spawn.test.sh
index b9a61736246..a810e100999 100755
--- a/tests/fm-trace-context-spawn.test.sh
+++ b/tests/fm-trace-context-spawn.test.sh
@@ -89,7 +89,7 @@ esac
 exit 0
 SH
   chmod +x "$fakebin/tmux"
-  fm_fake_exit0 "$fakebin" treehouse
+  fm_test_fake_treehouse_lease "$fakebin"
   printf '%s\n' "$fakebin"
 }
 
diff --git a/tests/lib.sh b/tests/lib.sh
index 4429362ae55..e01b3389bf8 100644
--- a/tests/lib.sh
+++ b/tests/lib.sh
@@ -351,6 +351,7 @@ fm_fakebin() {
 fm_fake_exit0() {
   local fakebin=$1 tool
   shift
+  [ "$#" -gt 0 ] || return 0
   for tool in "$@"; do
     cat > "$fakebin/$tool" <<'SH'
 #!/usr/bin/env bash
@@ -360,6 +361,37 @@ SH
   done
 }
 
+# fm_test_fake_treehouse_lease <fakebin>
+# Stands in for the pool: `treehouse get --lease` prints the leased worktree
+# (FM_FAKE_LEASE_PATH, defaulting to the path the fake pane will report), every
+# call is appended to FM_TREEHOUSE_LOG when set, and everything else exits 0.
+fm_test_fake_treehouse_lease() {
+  local fakebin=$1
+  cat > "$fakebin/treehouse" <<'SH'
+#!/usr/bin/env bash
+set -u
+if [ -n "${FM_TREEHOUSE_LOG:-}" ]; then
+  { printf 'treehouse'; for a in "$@"; do printf '\x1f%s' "$a"; done; printf '\n'; } >> "$FM_TREEHOUSE_LOG"
+fi
+case "${1:-}" in
+  get)
+    case " $* " in
+      *" --help "*|*" -h "*)
+        printf '%s\n' 'Usage: treehouse get [--lease] [--lease-holder string]'
+        exit 0
+        ;;
+      *" --lease "*)
+        printf '%s\n' "${FM_FAKE_LEASE_PATH:-${FM_FAKE_PANE_PATH:-}}"
+        exit 0
+        ;;
+    esac
+    ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/treehouse"
+}
+
 # fm_fake_crash_injector <fakebin>
 # Drops an `fm-crash-inject <pid>` shim that a PATH fake calls to simulate a
 # hard crash of the process under test. It SIGKILLs <pid> and then returns only

From 8a56cdeccdfd67ad429eb3dfaf7bcd9a55143e1c Mon Sep 17 00:00:00 2001
From: Tejas Shah <talktejas@gmail.com>
Date: Sun, 20 Sep 2026 14:39:10 +0700
Subject: [PATCH 02/10] no-mistakes(review): guard abort lease release on
 record; refresh claim rationale

---
 bin/fm-spawn.sh                       |  6 +++++-
 bin/fm-wake-lib.sh                    | 24 ++++++++++++------------
 docs/herdr-backend.md                 |  2 +-
 docs/verification/runtime-backends.md |  2 +-
 4 files changed, 19 insertions(+), 15 deletions(-)

diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 7721825547d..d941f6c9cba 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -1249,11 +1249,15 @@ spawn_abort_cleanup() {
       echo "warning: leaving task $ID's slot claim on $WT in place; the Treehouse project lock is no longer held, so the next spawn's claim replaces it" >&2
     fi
   fi
-  if [ "$SPAWN_TREEHOUSE_LEASE_PENDING" = 1 ]; then
+  if [ "$SPAWN_TREEHOUSE_LEASE_PENDING" = 1 ] &&
+    [ ! -e "$STATE/$ID.meta" ] && [ ! -L "$STATE/$ID.meta" ]; then
     # The spawn is aborting before any task record can name this lease, so the
     # slot would otherwise stay claimed by a task that never existed. Return it
     # while the project lock is still held, and match on the holder label so a
     # slot some later allocation has already taken over is never returned here.
+    # A record that survived the abort (its rollback failed) names this lease
+    # itself, so the release is skipped: handing that copy back to the pool is
+    # the reassignment this claim exists to prevent.
     SPAWN_TREEHOUSE_LEASE_PENDING=0
     ( cd "$PROJ_ABS" && treehouse return --force \
         --if-lease-holder "$SPAWN_TREEHOUSE_LEASE_HOLDER" \
diff --git a/bin/fm-wake-lib.sh b/bin/fm-wake-lib.sh
index e3582cbc4da..25e0df33d42 100755
--- a/bin/fm-wake-lib.sh
+++ b/bin/fm-wake-lib.sh
@@ -1254,18 +1254,18 @@ fm_treehouse_pool_slot() {  # <project-dir> <worktree>
 # Treehouse can record ownership durably: `treehouse get --lease --lease-holder`
 # reserves a slot under a label until `treehouse return --if-lease-holder`
 # releases it, and Firstmate uses exactly that for secondmate homes
-# (bin/fm-home-seed.sh). Crewmate spawns do not take that path: they acquire
-# their slot through the interactive pane-driven `treehouse get`, whose state
-# entry is a live process lease (owner_pid plus owner_started_at, and `treehouse
-# status` reports in-use from the processes actually running under the path).
-# That answers "is anything running here", never "which task owns this", and it
-# is released by the very event that makes a task record stale - the worker
-# exiting - so a slot whose lease has lapsed reads identical whether it is still
-# this task's or has since been handed to another one. Firstmate therefore keeps
-# its own claim on top: one file naming the task that took the slot, written by
-# bin/fm-spawn.sh under the same project lock that allocates the slot and
-# released by bin/fm-teardown.sh when the slot goes back to the pool. Moving
-# crewmate spawns onto the durable lease is separate follow-up work.
+# (bin/fm-home-seed.sh) and for crewmate spawns (bin/fm-spawn.sh), which take
+# the lease themselves rather than letting the pane's subshell hold the slot.
+# The lease stops the pool from handing a task's copy to a later spawn, which
+# is the question the pool itself answers; it does not answer the other one,
+# at teardown: whether the slot beside a task's record is still that task's
+# own. A slot Treehouse reports as free - the process lease it also keeps
+# (owner_pid plus owner_started_at) lapses the moment the worker exits - reads
+# identical whether it is still this task's or has since been handed to
+# another one. Firstmate therefore keeps its own claim on top: one file naming
+# the task that took the slot, written by bin/fm-spawn.sh under the same
+# project lock that allocates the slot and released by bin/fm-teardown.sh when
+# the slot goes back to the pool.
 #
 # The claim lives at <pool>/<slot>/.fm-slot-owner - a sibling of the repo
 # checkout rather than a file inside it - so claiming a slot can never dirty the
diff --git a/docs/herdr-backend.md b/docs/herdr-backend.md
index 97523457071..a6549403060 100644
--- a/docs/herdr-backend.md
+++ b/docs/herdr-backend.md
@@ -284,7 +284,7 @@ Create replaces only a confidently dead or no-agent husk, creates the replacemen
 This prevents closing the workspace's last tab before a replacement exists.
 
 A registration alone never proves an agent.
-Herdr keeps a Pi registration (`agent get` still reports `agent=pi` with its last status) after the Pi process has exited to a plain shell whenever a nested interactive shell sits under the pane's top shell, which is the crew shape `treehouse get` leaves behind (measured on Herdr 0.9.0 - [verification](verification/runtime-backends.md) "Stale agent registration"; upstream issue #4115).
+Herdr keeps a Pi registration (`agent get` still reports `agent=pi` with its last status) after the Pi process has exited to a plain shell whenever a nested interactive shell sits under the pane's top shell, which is the crew shape the spawn-time `(cd -- '<worktree>' && exec $SHELL)` subshell leaves behind (measured on Herdr 0.9.0 - [verification](verification/runtime-backends.md) "Stale agent registration"; upstream issue #4115).
 So before a registered agent counts as live, the pane classifier reads `pane process-info` and the real process table through the shared harness-process classifier in `bin/fm-agent-process-lib.sh`, the same rule the tmux adapter proves liveness with: a harness in the foreground process group, or still a descendant of the pane shell, keeps the registration live; a foreground that is nothing but shells with no harness descendant is a `stale-agent` pane, agent-free with that explicit reason; a foreground holding anything else keeps the registration live, but only after the same bounded settle window the idle-shell proof uses, because an idle shell transiently hosts prompt helpers such as starship in its foreground group and the first agent or shell sample in that window decides; an unreadable process view makes the pane `unknown`, trusting neither the registration nor its absence.
 No registered status outranks the process view, because an agent killed mid-turn leaves `working` behind just as a quit one leaves `idle`, and the native busy verdict is verified the same way so a shell-only pane never reads busy.
 The `pane process-info` subcommand that this process-level proof depends on is present in every supported release client from the 0.7.1 floor upward (measured 2026-09-10 on the pinned 0.7.1, 0.7.3, 0.7.4, and 0.7.5 release clients - [verification](verification/runtime-backends.md) "Stale agent registration").
diff --git a/docs/verification/runtime-backends.md b/docs/verification/runtime-backends.md
index 11bec98b4fe..5fe5e6a945a 100644
--- a/docs/verification/runtime-backends.md
+++ b/docs/verification/runtime-backends.md
@@ -1434,7 +1434,7 @@ The Herdr refusal when a shell accepts the command but does not move is not exer
 
 Measured 2026-09-10 on macOS aarch64 against Herdr 0.9.0 (protocol 22) and Pi 0.85.1 in an isolated `fm-lab-` session (upstream issue #4115, duplicates #3639, #3487, #2908, #3545).
 
-Herdr keeps a Pi registration after the Pi process has exited to a shell when a nested interactive shell sits under the pane's top shell, which is the crew shape `treehouse get` leaves behind; a plain `/quit` directly under the top shell, and a `kill -9` of Pi, both released it on this version.
+Herdr keeps a Pi registration after the Pi process has exited to a shell when a nested interactive shell sits under the pane's top shell, which is the crew shape the spawn-time `(cd -- '<worktree>' && exec $SHELL)` subshell leaves behind; a plain `/quit` directly under the top shell, and a `kill -9` of Pi, both released it on this version.
 Reproduced in the lab with a nested `zsh` under the pane shell, then `pi` with no prompt, then `/quit`:
 
 ```sh

From 386a6783fe1079d630d56eb3e26a7a939dd36864 Mon Sep 17 00:00:00 2001
From: Tejas Shah <talktejas@gmail.com>
Date: Sun, 20 Sep 2026 14:51:59 +0700
Subject: [PATCH 03/10] no-mistakes(review): gate and verify holder-matched
 lease release

---
 bin/fm-bootstrap.sh                   | 13 ++++++-
 bin/fm-spawn.sh                       | 27 ++++++++------
 docs/verification/runtime-backends.md | 18 +++++++++
 tests/fm-bootstrap.test.sh            | 23 ++++++++----
 tests/fm-spawn-worktree-lease.test.sh | 16 ++++++++
 tests/lib.sh                          | 54 +++++++++++++++++++++------
 6 files changed, 120 insertions(+), 31 deletions(-)

diff --git a/bin/fm-bootstrap.sh b/bin/fm-bootstrap.sh
index 11cd240d5a5..c6562404dd2 100755
--- a/bin/fm-bootstrap.sh
+++ b/bin/fm-bootstrap.sh
@@ -938,8 +938,19 @@ NO_MISTAKES_MIN=1.46.0
 GH_AXI_MIN=0.1.29
 LAVISH_AXI_MIN=0.1.46
 
+treehouse_advertises_flag() {  # <subcommand> <flag>
+  treehouse "$1" --help 2>&1 |
+    grep -Eq "(^|[^[:alnum:]_-])$2([^[:alnum:]_-]|$)"
+}
+
+# Both halves of a task's pool claim, not just the half that takes it: the spawn
+# leases the slot with `get --lease --lease-holder` and every release path -
+# aborted spawn, operator recovery - matches on `return --if-lease-holder`, so a
+# build carrying only the first leaves claims nothing can release.
 treehouse_supports_lease() {
-  treehouse get --help 2>&1 | grep -Eq '(^|[^[:alnum:]_-])--lease([^[:alnum:]_-]|$)'
+  treehouse_advertises_flag get --lease &&
+    treehouse_advertises_flag get --lease-holder &&
+    treehouse_advertises_flag return --if-lease-holder
 }
 
 # Shared semantic-version floor for the tool gates below. A version string that
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index d941f6c9cba..94dc6b435ba 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -1259,10 +1259,10 @@ spawn_abort_cleanup() {
     # itself, so the release is skipped: handing that copy back to the pool is
     # the reassignment this claim exists to prevent.
     SPAWN_TREEHOUSE_LEASE_PENDING=0
-    ( cd "$PROJ_ABS" && treehouse return --force \
+    SPAWN_LEASE_RELEASE_OUT=$( cd "$PROJ_ABS" && treehouse return --force \
         --if-lease-holder "$SPAWN_TREEHOUSE_LEASE_HOLDER" \
-        "$SPAWN_TREEHOUSE_LEASE_PATH" >/dev/null 2>&1 ) \
-      || echo "warning: could not release the treehouse lease on $SPAWN_TREEHOUSE_LEASE_PATH held as $SPAWN_TREEHOUSE_LEASE_HOLDER; release it with: treehouse return --force --if-lease-holder '$SPAWN_TREEHOUSE_LEASE_HOLDER' '$SPAWN_TREEHOUSE_LEASE_PATH'" >&2
+        "$SPAWN_TREEHOUSE_LEASE_PATH" 2>&1 ) \
+      || echo "warning: could not release the treehouse lease on $SPAWN_TREEHOUSE_LEASE_PATH held as $SPAWN_TREEHOUSE_LEASE_HOLDER (treehouse said: ${SPAWN_LEASE_RELEASE_OUT:-nothing}); release it with: treehouse return --force --if-lease-holder '$SPAWN_TREEHOUSE_LEASE_HOLDER' '$SPAWN_TREEHOUSE_LEASE_PATH'" >&2
   fi
   if [ "$SPAWN_TREEHOUSE_PROJECT_LOCK_HELD" = 1 ]; then
     SPAWN_TREEHOUSE_PROJECT_LOCK_HELD=0
@@ -2742,14 +2742,13 @@ real_path_or_raw() { # <path>
 # left holding the worktree root the check read, and SPAWN_WT_REASON a short
 # phrase naming why a rejected path failed, both for the refusal messages.
 #
-# The worktree-discovery poll below reads this same predicate, so it can never
-# adopt a path the guard would then refuse. That matters because a pane's cwd
-# read is a snapshot of whatever process is in the foreground: while `treehouse
-# get` is still fetching and checking a slot out, it reports the REPOSITORY's
-# primary checkout as its own cwd. That path differs from a linked spawning
-# project, so a poll comparing only against the project accepted it, and the
-# guard then refused a launch whose slot treehouse went on to create normally.
-# A read like that is a transient, not a destination: the poll keeps waiting.
+# Its callers are the two validate_spawn_worktree sites: the fresh path screens
+# the copy the pool leased BEFORE the pane is told to enter it, so a path that
+# is not this project's own isolated worktree is refused while nothing but the
+# lease has happened yet, and a relaunch screens the copy its record already
+# names. Nothing reads a pane's cwd to decide which
+# copy a task owns any more - the lease does that - so this predicate no longer
+# has to tell a worktree apart from a transient foreground cwd.
 SPAWN_WT_TOP=
 SPAWN_WT_REASON=
 spawn_worktree_isolated() { # <path>
@@ -4761,7 +4760,11 @@ fi
 if [ "$SPAWN_BACKLOG_COMMIT_STATUS" -ne 0 ]; then
   if [ "$RELAUNCH" -eq 0 ]; then
     if spawn_fresh_commit_rollback; then
-      echo "error: task $ID's backlog item could not be moved to In flight ($FM_BACKLOG_TRANSITION_ERROR); its record was removed so no worker is left that the backlog does not own - close out endpoint $T and local copy $WT by hand, then re-run the spawn" >&2
+      SPAWN_LEASE_RECOVERY=
+      if [ -n "$SPAWN_TREEHOUSE_LEASE_HOLDER" ]; then
+        SPAWN_LEASE_RECOVERY="; the removed record was what named this task's pool claim, so release it with: treehouse return --force --if-lease-holder '$SPAWN_TREEHOUSE_LEASE_HOLDER' '$WT'"
+      fi
+      echo "error: task $ID's backlog item could not be moved to In flight ($FM_BACKLOG_TRANSITION_ERROR); its record was removed so no worker is left that the backlog does not own - close out endpoint $T and local copy $WT by hand, then re-run the spawn$SPAWN_LEASE_RECOVERY" >&2
     else
       echo "error: task $ID's backlog item could not be moved to In flight ($FM_BACKLOG_TRANSITION_ERROR), and failed-dispatch cleanup is incomplete; the provisional record may remain at $STATE/$ID.meta - close out endpoint $T and local copy $WT by hand, then remove the record and busy state before retrying" >&2
     fi
diff --git a/docs/verification/runtime-backends.md b/docs/verification/runtime-backends.md
index 5fe5e6a945a..132e61fb11d 100644
--- a/docs/verification/runtime-backends.md
+++ b/docs/verification/runtime-backends.md
@@ -1541,6 +1541,24 @@ Observed output, with the pool root shortened:
 ```
 
 The leased slot carries no process and is still not handed to the later plain `get`, which allocates a different slot, and the holder label is readable back from the pool's own status.
+
+The release every claim depends on is holder-matched, verified on 2026-09-20 with the same build against the slot leased above.
+
+```sh
+treehouse return --force --if-lease-holder 'fm:other@/home/fm/state' .../1/repo
+treehouse return --force --if-lease-holder 'fm:demo-task@/home/fm/state' .../1/repo
+treehouse status --json
+```
+
+Observed output, with the pool root shortened:
+
+```text
+failed to return worktree: lease precondition failed: lease holder does not match worktree .../1/repo
+🌳 Worktree returned to pool.
+[{"name":"1","path":".../1/repo","status":"available","lease_id":"","lease_holder":"","leased_at":null,"processes":[]}]
+```
+
+A holder that does not match leaves the lease in place and exits 1, so a release can never take back a slot some later allocation already owns; the matching holder returns the slot and clears the label. `bin/fm-bootstrap.sh` gates on this flag alongside `get --lease`, so a build without it is reported as a treehouse upgrade rather than leaving claims nothing can release.
 [`tests/fm-spawn-worktree-lease.test.sh`](../../tests/fm-spawn-worktree-lease.test.sh) is the command that refreshes this record; it skips when treehouse is not installed.
 
 ## Zellij
diff --git a/tests/fm-bootstrap.test.sh b/tests/fm-bootstrap.test.sh
index d8cc824f0dd..b07c6db7791 100755
--- a/tests/fm-bootstrap.test.sh
+++ b/tests/fm-bootstrap.test.sh
@@ -40,7 +40,10 @@ unset TMUX TMUX_PANE HERDR_ENV HERDR_PANE_ID HERDR_SESSION HERDR_SOCKET_PATH \
   CMUX_WORKSPACE_ID CMUX_SURFACE_ID CMUX_SOCKET_PATH CMUX_TAB_ID CMUX_PANEL_ID 2>/dev/null || true
 
 # A fake toolchain where every required tool is present and gh is authenticated.
-# treehouse's `get --help` advertises --lease only when FM_FAKE_TREEHOUSE_LEASE_HELP=1.
+# treehouse advertises the pool-claim flags only when FM_FAKE_TREEHOUSE_LEASE_HELP=1:
+# `get --lease`/`--lease-holder` that takes a claim and `return --if-lease-holder`
+# that releases exactly it. FM_FAKE_TREEHOUSE_LEASE_HELP=getonly is the build that
+# can take a claim it can never release.
 make_fake_toolchain() {
   local dir=$1 fakebin
   fakebin=$(fm_fakebin "$dir")
@@ -65,12 +68,17 @@ SH
   chmod +x "$fakebin/gh"
   cat > "$fakebin/treehouse" <<'SH'
 #!/usr/bin/env bash
-if [ "${1:-}" = get ] && [ "${2:-}" = --help ]; then
-  if [ "${FM_FAKE_TREEHOUSE_LEASE_HELP:-}" = 1 ]; then
-    printf '%s\n' 'Usage: treehouse get [--lease] [--lease-holder <holder>]'
-  else
-    printf '%s\n' 'Usage: treehouse get'
-  fi
+if [ "${2:-}" = --help ]; then
+  case "${1:-}:${FM_FAKE_TREEHOUSE_LEASE_HELP:-}" in
+    get:1|get:getonly)
+      printf '%s\n' 'Usage: treehouse get [--lease] [--lease-holder <holder>]' ;;
+    get:*)
+      printf '%s\n' 'Usage: treehouse get' ;;
+    return:1)
+      printf '%s\n' 'Usage: treehouse return [--force] [--if-lease-holder <holder>]' ;;
+    return:*)
+      printf '%s\n' 'Usage: treehouse return [--force]' ;;
+  esac
   exit 0
 fi
 exit 0
@@ -305,6 +313,7 @@ test_bootstrap_reporting() {
     esac
   done <<'ROWS'
 treehouse --lease support is accepted silently^1^0.2.4^1^manual^empty^^
+treehouse that leases but cannot release reports an upgrade^getonly^0.2.4^1^-^grep^MISSING: treehouse (install: curl -fsSL https://kunchenguid.github.io/treehouse/install.sh | sh)^NEEDS_GH_AUTH
 treehouse without --lease reports an upgrade, gh auth is fine^0^0.2.4^1^-^grep^MISSING: treehouse (install: curl -fsSL https://kunchenguid.github.io/treehouse/install.sh | sh)^NEEDS_GH_AUTH
 compatible tasks-axi is silent by default^1^0.2.4^1^-^empty^^
 missing tasks-axi is required by default^1^-^1^-^exact^MISSING: tasks-axi (install: npm install -g tasks-axi)^
diff --git a/tests/fm-spawn-worktree-lease.test.sh b/tests/fm-spawn-worktree-lease.test.sh
index 647a278bc92..5fe2c84d570 100644
--- a/tests/fm-spawn-worktree-lease.test.sh
+++ b/tests/fm-spawn-worktree-lease.test.sh
@@ -84,6 +84,9 @@ test_aborted_spawn_returns_its_claim() {
   assert_contains "$log" \
     "treehouse${SEP}return${SEP}--force${SEP}--if-lease-holder${SEP}fm:$id@$LEASE_HOME/state${SEP}$LEASE_WT" \
     "an aborted spawn left its pool claim behind"
+  [ ! -e "$LEASE_LOG.holder" ] || fail "the pool still holds the claim, so the release the spawn ran was refused"
+  assert_not_contains "$out" "could not release the treehouse lease" \
+    "the release failed and the spawn reported it"
   pass "an aborted spawn returns its claim, matched on the holder that took it"
 }
 
@@ -155,6 +158,19 @@ test_real_pool_does_not_hand_out_a_leased_slot() {
   [ -n "$handed" ] || fail "real treehouse handed out no worktree at all"
   [ "$handed" != "$leased" ] || fail "real treehouse handed out the leased, idle slot"
   pass "the real pool does not hand out a leased slot that has no process inside it"
+
+  # The release side of the same contract: every claim this fix takes is given
+  # back with a holder-matched return, so it must exist on the real build, must
+  # refuse a holder that is not the one holding the claim, and must free the
+  # slot for the holder that is.
+  ( cd "$repo" && treehouse return --force --if-lease-holder 'fm:someone-else@state' "$leased" >/dev/null 2>&1 ) \
+    && fail "real treehouse returned a leased slot to a holder that does not hold it"
+  ( cd "$repo" && treehouse return --force --if-lease-holder 'fm:pool-guarantee@state' "$leased" >/dev/null 2>&1 ) \
+    || fail "real treehouse could not release the claim its own holder label took"
+  assert_not_contains "$(cd "$repo" && treehouse status --json 2>/dev/null)" \
+    'fm:pool-guarantee@state' \
+    "the pool still records the released claim, so the slot is not back in the pool"
+  pass "a claim is released only by the holder that took it, and the slot returns to the pool"
 }
 
 test_spawn_claims_the_slot_with_a_labelled_lease
diff --git a/tests/lib.sh b/tests/lib.sh
index e01b3389bf8..38aa6cbea57 100644
--- a/tests/lib.sh
+++ b/tests/lib.sh
@@ -365,6 +365,14 @@ SH
 # Stands in for the pool: `treehouse get --lease` prints the leased worktree
 # (FM_FAKE_LEASE_PATH, defaulting to the path the fake pane will report), every
 # call is appended to FM_TREEHOUSE_LOG when set, and everything else exits 0.
+#
+# `get` and `return` model the real flag surface (treehouse v2.1.0, recorded in
+# docs/verification/runtime-backends.md): a flag neither subcommand accepts is
+# rejected the way treehouse rejects it, so a caller spelling a flag this build
+# does not have fails here instead of passing on argv text alone. When
+# FM_TREEHOUSE_LOG is set the holder label `get --lease-holder` recorded is kept
+# beside it, and `return --if-lease-holder` releases the slot only when the
+# label matches - the lease precondition the real pool enforces.
 fm_test_fake_treehouse_lease() {
   local fakebin=$1
   cat > "$fakebin/treehouse" <<'SH'
@@ -373,18 +381,42 @@ set -u
 if [ -n "${FM_TREEHOUSE_LOG:-}" ]; then
   { printf 'treehouse'; for a in "$@"; do printf '\x1f%s' "$a"; done; printf '\n'; } >> "$FM_TREEHOUSE_LOG"
 fi
-case "${1:-}" in
+holder_state=${FM_TREEHOUSE_LOG:+$FM_TREEHOUSE_LOG.holder}
+sub=${1:-}
+shift || true
+lease=0 holder= want_holder= have_want_holder=0
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --help|-h)
+      case "$sub" in
+        get) printf '%s\n' '      --lease' '      --lease-holder string' ;;
+        return) printf '%s\n' '      --force' '      --if-lease-holder string' ;;
+      esac
+      exit 0
+      ;;
+    --lease) [ "$sub" = get ] || { echo "unknown flag: $1" >&2; exit 1; }; lease=1 ;;
+    --lease-holder) [ "$sub" = get ] || { echo "unknown flag: $1" >&2; exit 1; }; holder=${2:-}; shift ;;
+    --if-lease-holder) [ "$sub" = return ] || { echo "unknown flag: $1" >&2; exit 1; }; want_holder=${2:-}; have_want_holder=1; shift ;;
+    --force) [ "$sub" = return ] || { echo "unknown flag: $1" >&2; exit 1; } ;;
+    --*) echo "unknown flag: $1" >&2; exit 1 ;;
+  esac
+  shift
+done
+case "$sub" in
   get)
-    case " $* " in
-      *" --help "*|*" -h "*)
-        printf '%s\n' 'Usage: treehouse get [--lease] [--lease-holder string]'
-        exit 0
-        ;;
-      *" --lease "*)
-        printf '%s\n' "${FM_FAKE_LEASE_PATH:-${FM_FAKE_PANE_PATH:-}}"
-        exit 0
-        ;;
-    esac
+    if [ "$lease" = 1 ]; then
+      [ -z "$holder_state" ] || printf '%s\n' "$holder" > "$holder_state"
+      printf '%s\n' "${FM_FAKE_LEASE_PATH:-${FM_FAKE_PANE_PATH:-}}"
+    fi
+    ;;
+  return)
+    if [ "$have_want_holder" = 1 ] && [ -n "$holder_state" ]; then
+      if [ "$want_holder" != "$(cat "$holder_state" 2>/dev/null)" ]; then
+        echo "failed to return worktree: lease precondition failed: lease holder does not match" >&2
+        exit 1
+      fi
+    fi
+    [ -z "$holder_state" ] || rm -f "$holder_state"
     ;;
 esac
 exit 0

From 03dda0b13e14bb1a3a90658d292fdf724797f730 Mon Sep 17 00:00:00 2001
From: Tejas Shah <talktejas@gmail.com>
Date: Sun, 20 Sep 2026 15:14:27 +0700
Subject: [PATCH 04/10] no-mistakes(review): bound pool allocation and name
 orphaned claims

---
 bin/fm-backlog-transition-lib.sh      | 38 ++++++++++++++++-----------
 bin/fm-spawn.sh                       | 29 +++++++++++++++++---
 tests/fm-spawn-worktree-lease.test.sh | 36 +++++++++++++++++++++++++
 3 files changed, 84 insertions(+), 19 deletions(-)

diff --git a/bin/fm-backlog-transition-lib.sh b/bin/fm-backlog-transition-lib.sh
index 1d14f4ef80b..485852daafc 100644
--- a/bin/fm-backlog-transition-lib.sh
+++ b/bin/fm-backlog-transition-lib.sh
@@ -316,10 +316,12 @@ fm_backlog_transition_applies() {  # <config-dir> <data-dir> <kind>
   return 0
 }
 
-# Run `tasks-axi` with an optional FM_TASKS_AXI_TIMEOUT bound. A caller that
-# holds a lock across the call - the spawn commit and its preservation
-# read-back run under the per-task meta lock - sets the bound, so an
-# unresponsive tasks-axi cannot hold that lock open indefinitely; a timed-out
+# Run a command with an optional timeout bound. Every caller that holds a lock
+# across an external call uses this one runner: the spawn commit and its
+# preservation read-back under the per-task meta lock (FM_TASKS_AXI_TIMEOUT),
+# and the pool allocation under the shared Treehouse project lock
+# (FM_TREEHOUSE_GET_TIMEOUT), so an unresponsive tool cannot hold a lock open
+# indefinitely; a timed-out
 # call exits 124, or 137 when the kill-after had to fire (GNU timeout's own
 # status for a KILL-forced expiry), and the callers treat either as the bound
 # expiring and report the timeout as the reason through their existing error
@@ -328,7 +330,7 @@ fm_backlog_transition_applies() {  # <config-dir> <data-dir> <kind>
 # elsewhere (a stock macOS host has perl but no timeout variant; perl is
 # already a hard dependency of this library's byte validators, so the
 # fallback adds no new tool). Every bounded path forces termination: a
-# tasks-axi that ignores SIGTERM must not outlive the bound, since an
+# command that ignores SIGTERM must not outlive the bound, since an
 # unbounded call under the lock is exactly the hang the bound exists to
 # prevent - so the GNU variants carry a kill-after of one further bound
 # (TERM at the bound, KILL after that grace) and the watchdog kills the
@@ -336,22 +338,24 @@ fm_backlog_transition_applies() {  # <config-dir> <data-dir> <kind>
 # all, the call fails closed instead of running unbounded. Must be the last
 # command of a subshell: the exec keeps the tasks-axi process exactly where
 # the plain call sat, and the bound kills the child, not the caller.
-fm_tasks_axi_timeout_expired() {  # <status>
+# fm_tasks_axi is the tasks-axi-shaped wrapper the backlog paths call.
+fm_run_bounded_timed_out() {  # <status>
   case $1 in
     124 | 137) return 0 ;;
   esac
   return 1
 }
 
-fm_tasks_axi() {
-  local bound=${FM_TASKS_AXI_TIMEOUT:-}
+fm_run_bounded() {  # <bound-seconds-or-empty> <command> [arg...]
+  local bound=$1
+  shift
   if [ -z "$bound" ]; then
-    exec tasks-axi "$@"
+    exec "$@"
   fi
   if command -v timeout >/dev/null 2>&1; then
-    exec timeout -k "$bound" "$bound" tasks-axi "$@"
+    exec timeout -k "$bound" "$bound" "$@"
   elif command -v gtimeout >/dev/null 2>&1; then
-    exec gtimeout -k "$bound" "$bound" tasks-axi "$@"
+    exec gtimeout -k "$bound" "$bound" "$@"
   elif command -v perl >/dev/null 2>&1; then
     # Fork, run tasks-axi in the child, and poll waitpid(WNOHANG) until the
     # child exits or the bound expires: the same contract as
@@ -387,12 +391,16 @@ fm_tasks_axi() {
         select undef, undef, undef, $step;
         $elapsed += $step;
       }
-    ' -- "$bound" tasks-axi "$@"
+    ' -- "$bound" "$@"
   fi
-  printf 'fm_tasks_axi: cannot bound tasks-axi within %ss: none of timeout, gtimeout, or perl is available\n' "$bound" >&2
+  printf 'fm_run_bounded: cannot bound %s within %ss: none of timeout, gtimeout, or perl is available\n' "$1" "$bound" >&2
   exit 127
 }
 
+fm_tasks_axi() {
+  fm_run_bounded "${FM_TASKS_AXI_TIMEOUT:-}" tasks-axi "$@"
+}
+
 # Print one row's `tasks-axi show` output (plus stderr) from the addressing
 # fm_backlog_tasks_axi_addressing resolved, with `--file` only for the markdown
 # backend. Addressing or backend-resolution errors return before tasks-axi runs;
@@ -496,7 +504,7 @@ fm_backlog_row_probe() {  # <data-dir> <id>
     else
       FM_BACKLOG_ROW_ERROR=$(printf '%s\n' "$out" | sed -n '1p')
       if [ -z "$FM_BACKLOG_ROW_ERROR" ]; then
-        if fm_tasks_axi_timeout_expired "$command_status" && [ -n "${FM_TASKS_AXI_TIMEOUT:-}" ]; then
+        if fm_run_bounded_timed_out "$command_status" && [ -n "${FM_TASKS_AXI_TIMEOUT:-}" ]; then
           FM_BACKLOG_ROW_ERROR="tasks-axi show $id did not finish within ${FM_TASKS_AXI_TIMEOUT}s"
         else
           FM_BACKLOG_ROW_ERROR="tasks-axi show $id failed with no output"
@@ -549,7 +557,7 @@ fm_backlog_mutate() {  # <data-dir> <verb> <id> [flag...]
   [ "$command_status" -ne 0 ] || return 0
   FM_BACKLOG_TRANSITION_ERROR=$(printf '%s\n' "$out" | sed -n '1p')
   if [ -z "$FM_BACKLOG_TRANSITION_ERROR" ]; then
-    if fm_tasks_axi_timeout_expired "$command_status" && [ -n "${FM_TASKS_AXI_TIMEOUT:-}" ]; then
+    if fm_run_bounded_timed_out "$command_status" && [ -n "${FM_TASKS_AXI_TIMEOUT:-}" ]; then
       FM_BACKLOG_TRANSITION_ERROR="tasks-axi $verb $id did not finish within ${FM_TASKS_AXI_TIMEOUT}s"
     else
       FM_BACKLOG_TRANSITION_ERROR="tasks-axi $verb $id failed with no output"
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 94dc6b435ba..247e6b3eeaf 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -1224,7 +1224,11 @@ spawn_abort_cleanup() {
     fm_lock_release "$SPAWN_TASK_LOCK" || true
   fi
   if [ "$SPAWN_FRESH_COMMIT_PENDING" = 1 ]; then
-    if ! spawn_fresh_commit_rollback; then
+    if spawn_fresh_commit_rollback; then
+      if [ "$SPAWN_TREEHOUSE_LEASE_PENDING" != 1 ] && [ -n "$SPAWN_TREEHOUSE_LEASE_HOLDER" ]; then
+        echo "warning: the record removed by failed-dispatch cleanup was what named task $ID's pool claim on $SPAWN_TREEHOUSE_LEASE_PATH; a worker may already be live in that copy, so inspect it first, then release the claim with: treehouse return --force --if-lease-holder '$SPAWN_TREEHOUSE_LEASE_HOLDER' '$SPAWN_TREEHOUSE_LEASE_PATH'" >&2
+      fi
+    else
       status=1
     fi
   fi
@@ -3732,10 +3736,27 @@ elif [ "$KIND" != secondmate ] && [ "$BACKEND" != orca ]; then
   #     lease costs one pool slot until then; it can never wedge a spawn,
   #     because treehouse creates another slot rather than refusing.
   SPAWN_TREEHOUSE_LEASE_HOLDER="fm:$ID@$STATE"
-  WT=$(cd "$PROJ_ABS" && treehouse get --lease --lease-holder "$SPAWN_TREEHOUSE_LEASE_HOLDER") || {
-    echo "error: treehouse get --lease could not lease a worktree for project '$PROJ_ABS'; nothing was launched" >&2
+  # Allocation runs under the shared Treehouse project lock, and it creates a
+  # slot by fetching and adding a git worktree, so a stalled fetch would hold
+  # that lock - and every other spawn for this project - open ended. Bound it
+  # the way the backlog commit is bounded (fm_run_bounded), with the deadline
+  # the pane's discovery poll used to give this step. A timed-out allocation
+  # refuses: the EXIT trap releases the project lock, and the refusal names the
+  # holder label a half-created slot would carry, because a slot that may hold
+  # work is the operator's to inspect rather than this script's to tidy away.
+  SPAWN_TREEHOUSE_GET_STATUS=0
+  WT=$(cd "$PROJ_ABS" && fm_run_bounded "${FM_TREEHOUSE_GET_TIMEOUT:-60}" \
+    treehouse get --lease --lease-holder "$SPAWN_TREEHOUSE_LEASE_HOLDER") ||
+    SPAWN_TREEHOUSE_GET_STATUS=$?
+  if [ "$SPAWN_TREEHOUSE_GET_STATUS" -ne 0 ]; then
+    if fm_run_bounded_timed_out "$SPAWN_TREEHOUSE_GET_STATUS"; then
+      echo "error: treehouse get --lease did not allocate a worktree for project '$PROJ_ABS' within ${FM_TREEHOUSE_GET_TIMEOUT:-60}s; nothing was launched" >&2
+      echo "A slot may have been half created under holder '$SPAWN_TREEHOUSE_LEASE_HOLDER'; inspect it with: (cd '$PROJ_ABS' && treehouse status --json), and release it once you are satisfied it holds no work with: (cd '$PROJ_ABS' && treehouse return --force --if-lease-holder '$SPAWN_TREEHOUSE_LEASE_HOLDER' <path>)" >&2
+    else
+      echo "error: treehouse get --lease could not lease a worktree for project '$PROJ_ABS'; nothing was launched" >&2
+    fi
     exit 1
-  }
+  fi
   if [ -z "$WT" ]; then
     echo "error: treehouse get --lease reported no worktree for project '$PROJ_ABS'; nothing was launched" >&2
     exit 1
diff --git a/tests/fm-spawn-worktree-lease.test.sh b/tests/fm-spawn-worktree-lease.test.sh
index 5fe2c84d570..b648033e9e8 100644
--- a/tests/fm-spawn-worktree-lease.test.sh
+++ b/tests/fm-spawn-worktree-lease.test.sh
@@ -45,6 +45,41 @@ run_lease_spawn() {  # <id> <pane-path>
     "$id" "$LEASE_PROJ" --mode no-mistakes --yolo off
 }
 
+# Allocation happens under the shared Treehouse project lock, so a `treehouse
+# get` that never returns - a stalled fetch, a hung credential helper - would
+# wedge every other spawn for the project behind a lock nothing releases. The
+# bound must refuse, name what the stall may have left behind, and give the lock
+# back: a second spawn hits the same bound rather than "another Treehouse slot
+# allocation or return is in progress".
+test_stalled_allocation_refuses_and_frees_the_project_lock() {
+  local id out status again
+  id=lease-stall-w5
+  make_lease_case lease-stall "$id"
+  cat > "$LEASE_FAKEBIN/treehouse" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "${1:-}:${2:-}" in
+  get:--lease) exec /bin/sleep 60 ;;
+esac
+exit 0
+SH
+  chmod +x "$LEASE_FAKEBIN/treehouse"
+
+  out=$(FM_TREEHOUSE_GET_TIMEOUT=1 run_lease_spawn "$id" "$LEASE_WT")
+  status=$?
+  [ "$status" -ne 0 ] || fail "spawn accepted an allocation that never returned"$'\n'"$out"
+  assert_contains "$out" "did not allocate a worktree for project '$LEASE_PROJ' within 1s" \
+    "the refusal did not say the allocation bound expired"
+  assert_contains "$out" "--if-lease-holder 'fm:$id@$LEASE_HOME/state'" \
+    "the refusal did not name the holder a half-created slot would carry"
+  [ ! -e "$LEASE_HOME/state/$id.meta" ] || fail "a refused allocation published task metadata"
+
+  again=$(FM_TREEHOUSE_GET_TIMEOUT=1 run_lease_spawn "$id" "$LEASE_WT" 2>&1)
+  assert_not_contains "$again" "another Treehouse slot allocation or return is in progress" \
+    "the timed-out spawn kept the shared project lock, so the next spawn cannot allocate at all"
+  pass "a stalled allocation refuses within its bound and gives the project lock back"
+}
+
 # The claim itself: a durable lease, labelled with the task record that owns it
 # so the label alone says which record to look for when a lease outlives its
 # task.
@@ -174,6 +209,7 @@ test_real_pool_does_not_hand_out_a_leased_slot() {
 }
 
 test_spawn_claims_the_slot_with_a_labelled_lease
+test_stalled_allocation_refuses_and_frees_the_project_lock
 test_aborted_spawn_returns_its_claim
 test_copy_another_task_record_claims_is_refused_by_name
 test_a_record_holding_its_own_claim_does_not_block_a_spawn

From 426a90abd3348fc8c5aeb3ad541b2ee51214a350 Mon Sep 17 00:00:00 2001
From: Tejas Shah <talktejas@gmail.com>
Date: Sun, 20 Sep 2026 15:24:06 +0700
Subject: [PATCH 05/10] no-mistakes(review): assert lockdir release; scope
 recovery commands to project

---
 bin/fm-backlog-transition-lib.sh      |  8 ++++----
 bin/fm-spawn.sh                       |  8 ++++----
 tests/fm-spawn-worktree-lease.test.sh | 16 +++++++++-------
 3 files changed, 17 insertions(+), 15 deletions(-)

diff --git a/bin/fm-backlog-transition-lib.sh b/bin/fm-backlog-transition-lib.sh
index 485852daafc..163357d5ceb 100644
--- a/bin/fm-backlog-transition-lib.sh
+++ b/bin/fm-backlog-transition-lib.sh
@@ -336,9 +336,8 @@ fm_backlog_transition_applies() {  # <config-dir> <data-dir> <kind>
 # (TERM at the bound, KILL after that grace) and the watchdog kills the
 # same way. When a bound was requested but no bounding mechanism exists at
 # all, the call fails closed instead of running unbounded. Must be the last
-# command of a subshell: the exec keeps the tasks-axi process exactly where
+# command of a subshell: the exec keeps the bounded process exactly where
 # the plain call sat, and the bound kills the child, not the caller.
-# fm_tasks_axi is the tasks-axi-shaped wrapper the backlog paths call.
 fm_run_bounded_timed_out() {  # <status>
   case $1 in
     124 | 137) return 0 ;;
@@ -357,9 +356,9 @@ fm_run_bounded() {  # <bound-seconds-or-empty> <command> [arg...]
   elif command -v gtimeout >/dev/null 2>&1; then
     exec gtimeout -k "$bound" "$bound" "$@"
   elif command -v perl >/dev/null 2>&1; then
-    # Fork, run tasks-axi in the child, and poll waitpid(WNOHANG) until the
+    # Fork, run the command in the child, and poll waitpid(WNOHANG) until the
     # child exits or the bound expires: the same contract as
-    # `timeout $bound tasks-axi ...`. Expiry kills the child with TERM, waits
+    # `timeout $bound <command> ...`. Expiry kills the child with TERM, waits
     # one further bound of grace, then KILL, and exits 124 so the callers'
     # timeout plumbing reports it. Polling rather than alarm+die keeps the
     # bound off perl's platform-dependent syscall-restart signal semantics.
@@ -397,6 +396,7 @@ fm_run_bounded() {  # <bound-seconds-or-empty> <command> [arg...]
   exit 127
 }
 
+# The tasks-axi-shaped wrapper the backlog paths call.
 fm_tasks_axi() {
   fm_run_bounded "${FM_TASKS_AXI_TIMEOUT:-}" tasks-axi "$@"
 }
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 247e6b3eeaf..2140212d537 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -1226,7 +1226,7 @@ spawn_abort_cleanup() {
   if [ "$SPAWN_FRESH_COMMIT_PENDING" = 1 ]; then
     if spawn_fresh_commit_rollback; then
       if [ "$SPAWN_TREEHOUSE_LEASE_PENDING" != 1 ] && [ -n "$SPAWN_TREEHOUSE_LEASE_HOLDER" ]; then
-        echo "warning: the record removed by failed-dispatch cleanup was what named task $ID's pool claim on $SPAWN_TREEHOUSE_LEASE_PATH; a worker may already be live in that copy, so inspect it first, then release the claim with: treehouse return --force --if-lease-holder '$SPAWN_TREEHOUSE_LEASE_HOLDER' '$SPAWN_TREEHOUSE_LEASE_PATH'" >&2
+        echo "warning: the record removed by failed-dispatch cleanup was what named task $ID's pool claim on $SPAWN_TREEHOUSE_LEASE_PATH; a worker may already be live in that copy, so inspect it first, then release the claim with: (cd '$PROJ_ABS' && treehouse return --force --if-lease-holder '$SPAWN_TREEHOUSE_LEASE_HOLDER' '$SPAWN_TREEHOUSE_LEASE_PATH')" >&2
       fi
     else
       status=1
@@ -1266,7 +1266,7 @@ spawn_abort_cleanup() {
     SPAWN_LEASE_RELEASE_OUT=$( cd "$PROJ_ABS" && treehouse return --force \
         --if-lease-holder "$SPAWN_TREEHOUSE_LEASE_HOLDER" \
         "$SPAWN_TREEHOUSE_LEASE_PATH" 2>&1 ) \
-      || echo "warning: could not release the treehouse lease on $SPAWN_TREEHOUSE_LEASE_PATH held as $SPAWN_TREEHOUSE_LEASE_HOLDER (treehouse said: ${SPAWN_LEASE_RELEASE_OUT:-nothing}); release it with: treehouse return --force --if-lease-holder '$SPAWN_TREEHOUSE_LEASE_HOLDER' '$SPAWN_TREEHOUSE_LEASE_PATH'" >&2
+      || echo "warning: could not release the treehouse lease on $SPAWN_TREEHOUSE_LEASE_PATH held as $SPAWN_TREEHOUSE_LEASE_HOLDER (treehouse said: ${SPAWN_LEASE_RELEASE_OUT:-nothing}); release it with: (cd '$PROJ_ABS' && treehouse return --force --if-lease-holder '$SPAWN_TREEHOUSE_LEASE_HOLDER' '$SPAWN_TREEHOUSE_LEASE_PATH')" >&2
   fi
   if [ "$SPAWN_TREEHOUSE_PROJECT_LOCK_HELD" = 1 ]; then
     SPAWN_TREEHOUSE_PROJECT_LOCK_HELD=0
@@ -3789,7 +3789,7 @@ elif [ "$KIND" != secondmate ] && [ "$BACKEND" != orca ]; then
     [ "$(real_path_or_raw "$spawn_other_wt")" = "$spawn_wt_claim" ] || continue
     SPAWN_TREEHOUSE_LEASE_PENDING=0
     echo "error: the pool offered '$WT', which task $spawn_other_id's own record still names as its working copy; refusing to launch task $ID into it and reset another worker's work" >&2
-    echo "That copy is now held under '$SPAWN_TREEHOUSE_LEASE_HOLDER' so it is not offered again; reconcile whichever record is wrong (bin/fm-crew-state.sh $spawn_other_id), then release it with: treehouse return --force --if-lease-holder '$SPAWN_TREEHOUSE_LEASE_HOLDER' '$WT'" >&2
+    echo "That copy is now held under '$SPAWN_TREEHOUSE_LEASE_HOLDER' so it is not offered again; reconcile whichever record is wrong (bin/fm-crew-state.sh $spawn_other_id), then release it with: (cd '$PROJ_ABS' && treehouse return --force --if-lease-holder '$SPAWN_TREEHOUSE_LEASE_HOLDER' '$WT')" >&2
     echo "Re-running this spawn is safe: it is given a different copy." >&2
     exit 1
   done
@@ -4783,7 +4783,7 @@ if [ "$SPAWN_BACKLOG_COMMIT_STATUS" -ne 0 ]; then
     if spawn_fresh_commit_rollback; then
       SPAWN_LEASE_RECOVERY=
       if [ -n "$SPAWN_TREEHOUSE_LEASE_HOLDER" ]; then
-        SPAWN_LEASE_RECOVERY="; the removed record was what named this task's pool claim, so release it with: treehouse return --force --if-lease-holder '$SPAWN_TREEHOUSE_LEASE_HOLDER' '$WT'"
+        SPAWN_LEASE_RECOVERY="; the removed record was what named this task's pool claim, so release it with: (cd '$PROJ_ABS' && treehouse return --force --if-lease-holder '$SPAWN_TREEHOUSE_LEASE_HOLDER' '$WT')"
       fi
       echo "error: task $ID's backlog item could not be moved to In flight ($FM_BACKLOG_TRANSITION_ERROR); its record was removed so no worker is left that the backlog does not own - close out endpoint $T and local copy $WT by hand, then re-run the spawn$SPAWN_LEASE_RECOVERY" >&2
     else
diff --git a/tests/fm-spawn-worktree-lease.test.sh b/tests/fm-spawn-worktree-lease.test.sh
index b648033e9e8..a71d0cd96ae 100644
--- a/tests/fm-spawn-worktree-lease.test.sh
+++ b/tests/fm-spawn-worktree-lease.test.sh
@@ -48,11 +48,10 @@ run_lease_spawn() {  # <id> <pane-path>
 # Allocation happens under the shared Treehouse project lock, so a `treehouse
 # get` that never returns - a stalled fetch, a hung credential helper - would
 # wedge every other spawn for the project behind a lock nothing releases. The
-# bound must refuse, name what the stall may have left behind, and give the lock
-# back: a second spawn hits the same bound rather than "another Treehouse slot
-# allocation or return is in progress".
+# bound must refuse, name what the stall may have left behind, and leave no
+# project lockdir behind.
 test_stalled_allocation_refuses_and_frees_the_project_lock() {
-  local id out status again
+  local id out status held
   id=lease-stall-w5
   make_lease_case lease-stall "$id"
   cat > "$LEASE_FAKEBIN/treehouse" <<'SH'
@@ -74,9 +73,12 @@ SH
     "the refusal did not name the holder a half-created slot would carry"
   [ ! -e "$LEASE_HOME/state/$id.meta" ] || fail "a refused allocation published task metadata"
 
-  again=$(FM_TREEHOUSE_GET_TIMEOUT=1 run_lease_spawn "$id" "$LEASE_WT" 2>&1)
-  assert_not_contains "$again" "another Treehouse slot allocation or return is in progress" \
-    "the timed-out spawn kept the shared project lock, so the next spawn cannot allocate at all"
+  # The lock itself, not a later spawn's ability to take one: fm_lock_try_acquire
+  # steals a lockdir whose recorded process is gone, so a second spawn allocates
+  # either way and proves nothing. The lockdir under this home's state directory
+  # (fm_treehouse_project_lock_path) is the observable the release owns.
+  held=$(find "$LEASE_HOME/state" -maxdepth 1 -name '.treehouse-project-*.lock' 2>/dev/null)
+  [ -z "$held" ] || fail "the timed-out spawn kept the shared Treehouse project lock: $held"
   pass "a stalled allocation refuses within its bound and gives the project lock back"
 }
 

From 1f5b669498ce943c5f20ce56f0c65a888e0942d6 Mon Sep 17 00:00:00 2001
From: Tejas Shah <talktejas@gmail.com>
Date: Sun, 20 Sep 2026 15:50:02 +0700
Subject: [PATCH 06/10] no-mistakes(document): document pool-allocation bound
 and widened treehouse lease gate

---
 .agents/skills/bootstrap-diagnostics/SKILL.md | 2 +-
 docs/configuration.md                         | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.agents/skills/bootstrap-diagnostics/SKILL.md b/.agents/skills/bootstrap-diagnostics/SKILL.md
index 96560e62a18..cf3291ee4da 100644
--- a/.agents/skills/bootstrap-diagnostics/SKILL.md
+++ b/.agents/skills/bootstrap-diagnostics/SKILL.md
@@ -17,7 +17,7 @@ The inline rules in `AGENTS.md` section 3 still bind: detect, then consent, then
 When any diagnostic needs captain attention, report the plain consequence and requested action using `AGENTS.md` section 9's captain-facing translation contract; do not name the diagnostic label unless the captain needs to paste it into a command or issue.
 
 - `MISSING: <tool> (install: <command>)` - list the missing tools to the captain with a one-line purpose each plus the printed install commands, wait for consent (one approval may cover the list), then run `bin/fm-bootstrap.sh install <approved tools...>`.
-  For `treehouse`, this also covers an installed version whose `treehouse get` lacks `--lease`; treat it as an upgrade request.
+  For `treehouse`, this also covers an installed version missing any of the pool-claim lease flags (`get --lease`, `get --lease-holder`, `return --if-lease-holder`); treat it as an upgrade request.
   For `no-mistakes`, this also covers an installed version older than 1.46.0, because this repo's PR gate requires structured pipeline attestation that older builds do not write.
   For essential axi-family tools - `gh-axi`, `tasks-axi`, `quota-axi` - an installed version below its floor is a plain upgrade request; [`bin/fm-bootstrap.sh`](../../../bin/fm-bootstrap.sh) owns the floor policy, and never argue the floor down to whatever the home happens to have installed.
   For `tasks-axi`, this additionally covers an installed build that fails the separate feature probe (`bin/fm-tasks-axi-lib.sh` owns the definition); `config/backlog-backend=manual` only suppresses the verbose `BOOTSTRAP_INFO: tasks-axi available` fact, not this missing-tool report.
diff --git a/docs/configuration.md b/docs/configuration.md
index 68899691629..a9fd4a52ba6 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -1130,6 +1130,7 @@ FM_WATCH_TRIAGE_LOG_MAX_BYTES=262144   # size cap for the watcher's absorbed-wak
 FM_FLEET_SYNC_BOOTSTRAP_TIMEOUT=     # optional seconds allowed for bootstrap's best-effort clone refresh; unset/blank defaults to max(20, 5 + 3 * origin-backed-project-count)
 FM_FLEET_PRUNE=1        # set to 0 to skip pruning local branches whose upstream is gone
 FM_STALE_WORKTREE_LOCK_AGE_SECS=30       # min mtime age before fm-teardown.sh treats a leftover worktree git index.lock as provably stale
+FM_TREEHOUSE_GET_TIMEOUT=60               # seconds bounding the leased pool-worktree allocation bin/fm-spawn.sh runs under the shared treehouse project lock; hitting the bound refuses the spawn, releases that lock, and names the holder label a half-created slot would carry so it can be inspected before release
 FM_TREEHOUSE_RETURN_LOCK_RETRIES=3        # retries after a treehouse return fails on the transient git index.lock signature
 FM_TREEHOUSE_RETURN_LOCK_RETRY_WAIT_SECS=1 # seconds fm-teardown.sh waits before each retry after that signature
 FM_STALE_WORKTREE_LOCK_RETRY_WAIT_SECS=   # legacy alias for FM_TREEHOUSE_RETURN_LOCK_RETRY_WAIT_SECS when the new variable is unset

From fa19c478456c8b184b2cc762734ea363c613ba69 Mon Sep 17 00:00:00 2001
From: Tejas Shah <talktejas@gmail.com>
Date: Sun, 20 Sep 2026 17:05:01 +0700
Subject: [PATCH 07/10] no-mistakes(review): install flag-modelling treehouse
 lease stub in stale suites

---
 tests/fm-agy-harness.test.sh           |  3 ++-
 tests/fm-secondmate-liveness.test.sh   |  9 +--------
 tests/fm-secondmate-sync.test.sh       |  9 +--------
 tests/fm-session-start.test.sh         | 10 +---------
 tests/fm-startup-memory-budget.test.sh |  7 +------
 tests/fm-x-mode.test.sh                | 10 +---------
 6 files changed, 7 insertions(+), 41 deletions(-)

diff --git a/tests/fm-agy-harness.test.sh b/tests/fm-agy-harness.test.sh
index d13f23c625d..be442235140 100755
--- a/tests/fm-agy-harness.test.sh
+++ b/tests/fm-agy-harness.test.sh
@@ -544,7 +544,8 @@ echo "fake agy must never execute" >&2
 exit 9
 SH
   chmod +x "$fakebin/agy"
-  fm_fake_exit0 "$fakebin" treehouse gh-axi gh
+  fm_fake_exit0 "$fakebin" gh-axi gh
+  fm_test_fake_treehouse_lease "$fakebin"
   printf '%s\n' "$fakebin"
 }
 
diff --git a/tests/fm-secondmate-liveness.test.sh b/tests/fm-secondmate-liveness.test.sh
index 72aa0697fd8..8fc49b84d35 100755
--- a/tests/fm-secondmate-liveness.test.sh
+++ b/tests/fm-secondmate-liveness.test.sh
@@ -222,14 +222,7 @@ SH
 exit 0
 SH
   chmod +x "$fakebin/gh"
-  cat > "$fakebin/treehouse" <<'SH'
-#!/usr/bin/env bash
-if [ "${1:-}" = get ] && [ "${2:-}" = --help ]; then
-  printf '%s\n' 'Usage: treehouse get [--lease]'
-fi
-exit 0
-SH
-  chmod +x "$fakebin/treehouse"
+  fm_test_fake_treehouse_lease "$fakebin"
   cat > "$fakebin/no-mistakes" <<'SH'
 #!/usr/bin/env bash
 if [ "${1:-}" = --version ]; then
diff --git a/tests/fm-secondmate-sync.test.sh b/tests/fm-secondmate-sync.test.sh
index 201812ba56c..7c4423e2cbb 100755
--- a/tests/fm-secondmate-sync.test.sh
+++ b/tests/fm-secondmate-sync.test.sh
@@ -359,14 +359,7 @@ SH
 exit 0
 SH
   chmod +x "$fakebin/gh"
-  cat > "$fakebin/treehouse" <<'SH'
-#!/usr/bin/env bash
-if [ "${1:-}" = get ] && [ "${2:-}" = --help ]; then
-  printf '%s\n' 'Usage: treehouse get [--lease]'
-fi
-exit 0
-SH
-  chmod +x "$fakebin/treehouse"
+  fm_test_fake_treehouse_lease "$fakebin"
   cat > "$fakebin/no-mistakes" <<'SH'
 #!/usr/bin/env bash
 if [ "${1:-}" = --version ]; then
diff --git a/tests/fm-session-start.test.sh b/tests/fm-session-start.test.sh
index b3d6aba1458..88fdf0e3ab8 100755
--- a/tests/fm-session-start.test.sh
+++ b/tests/fm-session-start.test.sh
@@ -87,15 +87,7 @@ SH
 exit 0
 SH
   chmod +x "$fakebin/gh"
-  cat > "$fakebin/treehouse" <<'SH'
-#!/usr/bin/env bash
-if [ "${1:-}" = get ] && [ "${2:-}" = --help ]; then
-  printf '%s\n' 'Usage: treehouse get [--lease]'
-  exit 0
-fi
-exit 0
-SH
-  chmod +x "$fakebin/treehouse"
+  fm_test_fake_treehouse_lease "$fakebin"
   cat > "$fakebin/no-mistakes" <<'SH'
 #!/usr/bin/env bash
 if [ "${1:-}" = --version ]; then
diff --git a/tests/fm-startup-memory-budget.test.sh b/tests/fm-startup-memory-budget.test.sh
index fe5a5439f62..8e7d4eaeaf8 100755
--- a/tests/fm-startup-memory-budget.test.sh
+++ b/tests/fm-startup-memory-budget.test.sh
@@ -35,12 +35,7 @@ SH
 #!/usr/bin/env bash
 exit 0
 SH
-  cat > "$fakebin/treehouse" <<'SH'
-#!/usr/bin/env bash
-if [ "${1:-}" = get ] && [ "${2:-}" = --help ]; then
-  printf '%s\n' 'Usage: treehouse get [--lease]'
-fi
-SH
+  fm_test_fake_treehouse_lease "$fakebin"
   cat > "$fakebin/no-mistakes" <<'SH'
 #!/usr/bin/env bash
 if [ "${1:-}" = --version ]; then
diff --git a/tests/fm-x-mode.test.sh b/tests/fm-x-mode.test.sh
index 9f45252bc70..4d90298ff06 100755
--- a/tests/fm-x-mode.test.sh
+++ b/tests/fm-x-mode.test.sh
@@ -806,15 +806,7 @@ fi
 exit 0
 SH
   chmod +x "$fakebin/gh"
-  cat > "$fakebin/treehouse" <<'SH'
-#!/usr/bin/env bash
-if [ "${1:-}" = get ] && [ "${2:-}" = --help ]; then
-  printf '%s\n' 'Usage: treehouse get [--lease] [--lease-holder <holder>]'
-  exit 0
-fi
-exit 0
-SH
-  chmod +x "$fakebin/treehouse"
+  fm_test_fake_treehouse_lease "$fakebin"
   printf 'FMX_PAIRING_TOKEN=tok-missing\n' > "$home/.env"
   out=$(PATH="$fakebin" FM_HOME="$home" FM_ROOT_OVERRIDE="$home" \
     "$BASH" "$ROOT/bin/fm-bootstrap.sh" 2>/dev/null)

From 6a4dc55516612a6b553f6e75a63d8882a9084756 Mon Sep 17 00:00:00 2001
From: Tejas Shah <talktejas@gmail.com>
Date: Sun, 20 Sep 2026 17:15:02 +0700
Subject: [PATCH 08/10] no-mistakes(review): pin CI treehouse to v2.1.0 for
 holder-matched release

---
 bin/fm-install-treehouse.sh           | 20 +++++++++++---------
 docs/verification/runtime-backends.md |  1 +
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/bin/fm-install-treehouse.sh b/bin/fm-install-treehouse.sh
index b0ec7816679..a4b01e2a38a 100755
--- a/bin/fm-install-treehouse.sh
+++ b/bin/fm-install-treehouse.sh
@@ -9,12 +9,14 @@
 # Usage:
 #   fm-install-treehouse.sh <destination-directory>
 #
-# Pins Treehouse v2.0.1, the version exercised by the local real-Herdr suite.
+# Pins Treehouse v2.1.0, the version exercised by the local real-Herdr suite and
+# the floor for the pool claim: `get --lease --lease-holder` and the
+# holder-matched `return --if-lease-holder` release bin/fm-bootstrap.sh gates on.
 set -eu
 
-FM_TREEHOUSE_CI_VERSION=2.0.1
+FM_TREEHOUSE_CI_VERSION=2.1.0
 FM_TREEHOUSE_CI_TAG="v${FM_TREEHOUSE_CI_VERSION}"
-# Bounded download ceiling (bytes). Official 2.0.1 archives are under 8 MiB.
+# Bounded download ceiling (bytes). Official 2.1.0 archives are under 8 MiB.
 FM_TREEHOUSE_CI_MAX_BYTES=15000000
 FM_TREEHOUSE_CI_REPO=kunchenguid/treehouse
 
@@ -30,19 +32,19 @@ arch=$(uname -m)
 case "${os}-${arch}" in
   Linux-x86_64)
     ARCHIVE=treehouse-v${FM_TREEHOUSE_CI_VERSION}-linux-amd64.tar.gz
-    SHA256=1d5a32751ab921670103fd201ddb2b91b47338cb13976f45642b827cf8976af2
+    SHA256=ff030255663bb5d384309cdf1b3a0bd62006e0ac978340d292039697cb70c225
     ;;
   Linux-aarch64|Linux-arm64)
     ARCHIVE=treehouse-v${FM_TREEHOUSE_CI_VERSION}-linux-arm64.tar.gz
-    SHA256=eaccc9c5b98125df8bd77425598eeecee66cb0371db4eb1cf75f0d813c18fab9
+    SHA256=d4e37ad11d50fb6381c060d34e7372e944e01af78b0c6707c6d0ff966c7c2c44
     ;;
   Darwin-arm64)
     ARCHIVE=treehouse-v${FM_TREEHOUSE_CI_VERSION}-darwin-arm64.tar.gz
-    SHA256=7ee5078f3d1f33c01196548797fce65408e459d53530b77d4ba56e074fa1c1a2
+    SHA256=a2e9bcba88d643a828062f3425dcf601886372fc2aca87b542b36fc8bbf2c992
     ;;
   Darwin-x86_64)
     ARCHIVE=treehouse-v${FM_TREEHOUSE_CI_VERSION}-darwin-amd64.tar.gz
-    SHA256=1cf44580a5837f995e1d3bb74f4fbd3112b642acd20406087d9735a8106112fd
+    SHA256=8eb2eb3b63f409a316bd9c19af5d3035e5b72f6feffc98f0fac658e1ed33a397
     ;;
   *)
     die "unsupported platform ${os}-${arch}; official Treehouse assets are linux/darwin amd64 and arm64"
@@ -69,7 +71,7 @@ fi
 [ "$ACTUAL_SHA256" = "$SHA256" ] || die "checksum mismatch for $ARCHIVE (expected $SHA256, got $ACTUAL_SHA256)"
 
 tar -xzf "$TMP/$ARCHIVE" -C "$TMP"
-# Archive layout: a single `treehouse` binary at the archive root (verified for v2.0.1).
+# Archive layout: a single `treehouse` binary at the archive root (verified for v2.1.0).
 if [ -f "$TMP/treehouse" ]; then
   BIN="$TMP/treehouse"
 elif [ -f "$TMP/treehouse-v${FM_TREEHOUSE_CI_VERSION}/treehouse" ]; then
@@ -83,7 +85,7 @@ mkdir -p "$DESTINATION"
 install -m 0755 "$BIN" "$DESTINATION/treehouse"
 
 installed_version=$("$DESTINATION/treehouse" --version 2>/dev/null | tr -d '[:space:]')
-# treehouse prints "v2.0.1" (leading v) on --version.
+# treehouse prints "v2.1.0" (leading v) on --version.
 case "$installed_version" in
   "v${FM_TREEHOUSE_CI_VERSION}"|"${FM_TREEHOUSE_CI_VERSION}") ;;
   *)
diff --git a/docs/verification/runtime-backends.md b/docs/verification/runtime-backends.md
index 132e61fb11d..10e315027bb 100644
--- a/docs/verification/runtime-backends.md
+++ b/docs/verification/runtime-backends.md
@@ -1524,6 +1524,7 @@ The daemon injection transport into a live composer keeps its coverage in `tests
 ## Treehouse worktree pool
 
 The pool claim `bin/fm-spawn.sh` takes on a task worktree was verified on 2026-09-17 with treehouse v2.1.0 on Linux (WSL2).
+`bin/fm-install-treehouse.sh` pins that same v2.1.0 for CI, so the real-Herdr lane runs against the flag surface recorded here; 2.0.1 ships `get --lease --lease-holder` but no `return --if-lease-holder`, which is below the floor `bin/fm-bootstrap.sh` gates on.
 A task whose agent is not currently running leaves no process inside its copy, and a lease is what keeps that idle-looking copy from being handed to the next spawn and reset.
 
 ```sh

From 3761d2c7e4fb7c0a28e8eae7d4115147c7697ddb Mon Sep 17 00:00:00 2001
From: Tejas Shah <talktejas@gmail.com>
Date: Sun, 20 Sep 2026 17:56:02 +0700
Subject: [PATCH 09/10] no-mistakes(test): teach dispatch-profile timeout stub
 the GNU -k shape

---
 tests/fm-spawn-dispatch-profile.test.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tests/fm-spawn-dispatch-profile.test.sh b/tests/fm-spawn-dispatch-profile.test.sh
index f7274693ae7..28e6b557108 100755
--- a/tests/fm-spawn-dispatch-profile.test.sh
+++ b/tests/fm-spawn-dispatch-profile.test.sh
@@ -34,8 +34,14 @@ SH
 make_spawn_fakebin() {
   local dir=$1 fakebin
   fakebin=$(fm_test_make_spawn_fakebin "$dir")
+  # Pass-through stand-in for the bound fm_run_bounded puts around external
+  # calls, in the GNU shape it invokes: `timeout -k <bound> <bound> <cmd>...`.
+  # Nothing here is meant to expire, so both durations are dropped and the
+  # command runs unbounded; a stub that dropped only one argument would try to
+  # exec the bound itself.
   cat > "$fakebin/timeout" <<'SH'
 #!/usr/bin/env bash
+while [ "${1:-}" = -k ]; do shift 2; done
 shift
 exec "$@"
 SH

From f1b760f9926bde1d0d9995ff268bfacde1a22b83 Mon Sep 17 00:00:00 2001
From: Tejas Shah <talktejas@gmail.com>
Date: Sun, 20 Sep 2026 18:28:09 +0700
Subject: [PATCH 10/10] no-mistakes(document): document worktree_lease meta
 field and its release command

---
 docs/configuration.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/configuration.md b/docs/configuration.md
index a9fd4a52ba6..1421aa19acc 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -146,6 +146,7 @@ A cmux spawn additionally version-gates against the installed `cmux` binary's ve
 A backend spawn refusal from a missing dependency, version gate, or unauthenticated socket is terminal for that selected backend; firstmate surfaces it as a blocker instead of silently retrying another backend.
 Task meta records `backend=` only for a non-default backend; an absent `backend=` means `tmux`, preserving existing default-path meta files.
 Every new task records `endpoint_task_id=` as the cleanup binding between the metadata filename and its opaque runtime endpoint.
+A ship or scout task in a Treehouse pool worktree also records `worktree_lease=fm:<task-id>@<state-dir>`, the holder label of the durable pool claim `fm-spawn.sh` takes on that copy so it is never handed to another spawn; ordinary teardown's return releases it, and a claim that outlives its task is released with `(cd '<project>' && treehouse return --force --if-lease-holder '<worktree_lease>' '<worktree>')`.
 A herdr task additionally records `herdr_session=`, `herdr_workspace_id=`, `herdr_tab_id=`, and `herdr_pane_id=`.
 A zellij task additionally records `zellij_session=`, `zellij_tab_id=`, and `zellij_pane_id=`.
 An Orca task additionally records `orca_worktree_id=` and `terminal=`, with `window=fm-<id>` kept as the shared firstmate alias.