From d23499da39b352eeabdb38eadf66d2f4a5914472 Mon Sep 17 00:00:00 2001
From: Tejas Shah <talktejas@gmail.com>
Date: Thu, 17 Sep 2026 18:41:44 +0700
Subject: [PATCH 1/5] fix(spawn): claim a task's pool worktree with a durable
 lease

Treehouse counts a pool slot as in use only while a process runs inside
it, so a task whose agent has exited - paused, crashed, or simply between
turns - leaves its own working copy looking free. The next spawn was then
handed that copy and reset it to a detached HEAD, silently, with no
refusal (observed 2026-08-19; nothing was lost only because that task had
already pushed its branch).

fm-spawn now takes the pool's own durable claim itself - `treehouse get
--lease` - instead of relying on the pane's `treehouse get` subshell to
hold the slot, and moves the pane into the leased copy. Treehouse never
hands a leased slot to a later get and never prunes it, with or without a
process inside, so the claim is enforced by the layer that does the
allocating rather than re-derived from task records after the copy has
already been reset.

The lease holder label names the task record that owns it
("fm:<id>@<state-dir>"), which is what keeps a claim from outliving its
task unnoticed: teardown's `treehouse return` releases it in the ordinary
case, an aborted spawn returns it holder-matched before any record can
name it, and anything left over is self-identifying and releasable with
one command. A stale lease costs a pool slot until then; it can never
wedge a spawn, because treehouse allocates another slot rather than
refusing.

The leased path is now screened for isolation before the pane is touched
at all, so a non-isolated copy is refused earlier and the refusal carries
the reason it was rejected.
---
 bin/fm-spawn.sh                               | 159 ++++++++++--------
 docs/architecture.md                          |   3 +-
 docs/cmux-backend.md                          |   2 +-
 docs/verification/runtime-backends.md         |  22 +++
 docs/zellij-backend.md                        |   2 +-
 tests/fixtures.sh                             |   7 +-
 .../fm-backend-herdr-presentation-e2e.test.sh |   4 +-
 tests/fm-backend.test.sh                      |   2 +
 tests/fm-backlog-atomicity.test.sh            |   1 +
 tests/fm-bootstrap-network-parallel.test.sh   |   1 +
 tests/fm-captain-hold-lifecycle.test.sh       |   7 +
 tests/fm-kimi-harness.test.sh                 |   1 +
 tests/fm-muse-harness.test.sh                 |   1 +
 tests/fm-public-followup.test.sh              |   9 +
 tests/fm-rovo-harness.test.sh                 |   1 +
 tests/fm-secondmate-sync.test.sh              |   3 +
 tests/fm-shared-captain-inheritance.test.sh   |   1 +
 tests/fm-spawn-base-branch.test.sh            |   1 +
 tests/fm-spawn-pool-base-freshen.test.sh      |  15 +-
 tests/fm-spawn-worktree-lease.test.sh         | 120 +++++++++++++
 tests/fm-spawn-worktree-settle.test.sh        |  67 ++++----
 tests/fm-tangle-guard.test.sh                 |  12 +-
 tests/fm-trace-context-spawn.test.sh          |   1 +
 tests/lib.sh                                  |  36 ++++
 24 files changed, 349 insertions(+), 129 deletions(-)
 create mode 100644 tests/fm-spawn-worktree-lease.test.sh

diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 36422519902..03d46c0cbe1 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -63,7 +63,7 @@
 #   then tmux.
 #   Spawn-capable backends are the reference tmux adapter and experimental
 #   herdr, zellij, orca, and cmux. Orca owns both the task worktree and
-#   terminal, so ship/scout Orca spawns do not run treehouse get; cmux is a
+#   terminal, so ship/scout Orca spawns take no pool worktree; cmux is a
 #   session provider only, exactly like herdr/zellij, so it does. An
 #   auto-detected herdr or cmux spawn prints a loud stderr notice;
 #   auto-detected tmux stays silent; zellij and orca are never auto-detected.
@@ -188,13 +188,17 @@
 #   Ship/scout spawns refuse to launch unless the resolved task path is a real
 #   git worktree root distinct from both the spawning project and its repository's
 #   primary checkout, including when the spawning project is a linked worktree.
-#   On the backends that discover that path by reading the task pane's own cwd,
-#   the same isolation test screens every read: a pane still showing the project
-#   or the repository primary while `treehouse get` prepares the slot is waited
-#   out as a transient rather than adopted and then refused, so a home that is
-#   itself a linked worktree of the project repository still launches. A pane
-#   that never reaches an isolated worktree refuses at the end of that wait,
-#   naming the last path seen and why it was rejected.
+#   The task worktree is a durable treehouse LEASE fm-spawn takes itself, held
+#   under a label naming the task record that owns it, so a copy whose agent is
+#   not currently running is never handed to another spawn and reset under it.
+#   The isolation test screens the leased path before the pane is touched at all.
+#   The pane is then moved into that copy and must be observed there: a pane
+#   still showing the project or the repository primary in its first reads is
+#   waited out as a transient, so a home that is itself a linked worktree of the
+#   project repository still launches, and a pane that never arrives refuses at
+#   the end of that wait, naming the leased copy and the last path seen.
+#   An aborted spawn returns the lease before any record can name it; otherwise
+#   the published record owns it and bin/fm-teardown.sh's return releases it.
 #   That placement is proven only at launch. Every ship or scout pane therefore
 #   also receives `export FM_TASK_ID=<task-id>` before the launch command, on
 #   the same channel as GOTMPDIR, and bin/fm-test-run.sh refuses to execute the
@@ -1055,6 +1059,9 @@ SPAWN_TASK_SET_LOCK_HELD=0
 SPAWN_TREEHOUSE_PROJECT_LOCK=
 SPAWN_TREEHOUSE_PROJECT_LOCK_HELD=0
 SPAWN_SLOT_CLAIMED=0
+SPAWN_TREEHOUSE_LEASE_HOLDER=
+SPAWN_TREEHOUSE_LEASE_PATH=
+SPAWN_TREEHOUSE_LEASE_PENDING=0
 RELAUNCH_REPLACEMENT_PENDING=0
 RELAUNCH_REPLACEMENT_BUSY_GEN=
 RELAUNCH_REPLACEMENT_HARNESS=
@@ -1203,6 +1210,17 @@ spawn_abort_cleanup() {
       echo "warning: leaving task $ID's slot claim on $WT in place; the Treehouse project lock is no longer held, so the next spawn's claim replaces it" >&2
     fi
   fi
+  if [ "$SPAWN_TREEHOUSE_LEASE_PENDING" = 1 ]; then
+    # The spawn is aborting before any task record can name this lease, so the
+    # slot would otherwise stay claimed by a task that never existed. Return it
+    # while the project lock is still held, and match on the holder label so a
+    # slot some later allocation has already taken over is never returned here.
+    SPAWN_TREEHOUSE_LEASE_PENDING=0
+    ( cd "$PROJ_ABS" && treehouse return --force \
+        --if-lease-holder "$SPAWN_TREEHOUSE_LEASE_HOLDER" \
+        "$SPAWN_TREEHOUSE_LEASE_PATH" >/dev/null 2>&1 ) \
+      || echo "warning: could not release the treehouse lease on $SPAWN_TREEHOUSE_LEASE_PATH held as $SPAWN_TREEHOUSE_LEASE_HOLDER; release it with: treehouse return --force --if-lease-holder '$SPAWN_TREEHOUSE_LEASE_HOLDER' '$SPAWN_TREEHOUSE_LEASE_PATH'" >&2
+  fi
   if [ "$SPAWN_TREEHOUSE_PROJECT_LOCK_HELD" = 1 ]; then
     SPAWN_TREEHOUSE_PROJECT_LOCK_HELD=0
     fm_lock_release "$SPAWN_TREEHOUSE_PROJECT_LOCK" || true
@@ -2744,7 +2762,7 @@ spawn_worktree_isolated() { # <path>
 validate_spawn_worktree() { # <source> <inspect-target>
   local source=$1 inspect_target=$2
   if ! spawn_worktree_isolated "$WT"; then
-    echo "error: $source did not yield an isolated worktree (resolved '$WT'; worktree root '${SPAWN_WT_TOP:-none}'; spawning project '$PROJ_ABS'); refusing to launch to avoid tangling the primary checkout. Inspect target $inspect_target" >&2
+    echo "error: $source did not yield an isolated worktree (resolved '$WT': ${SPAWN_WT_REASON:-no reason recorded}; worktree root '${SPAWN_WT_TOP:-none}'; spawning project '$PROJ_ABS'); refusing to launch to avoid tangling the primary checkout. Inspect target $inspect_target" >&2
     exit 1
   fi
 }
@@ -3613,77 +3631,71 @@ if [ "$RELAUNCH" -eq 1 ]; then
   fi
   [ "$KIND" = secondmate ] || validate_spawn_worktree "relaunch" "$T"
 elif [ "$KIND" != secondmate ] && [ "$BACKEND" != orca ]; then
-  spawn_send_text_line "$WT_TARGET" 'treehouse get'
+  # Claim the pool slot from HERE, durably, instead of letting the pane's
+  # `treehouse get` subshell hold it. Treehouse counts a slot as in use only
+  # while a process is running inside it, so a task whose agent has exited -
+  # paused, crashed, or between turns - leaves its own working copy looking
+  # free. The next `treehouse get` then hands that copy to a new spawn and
+  # resets it (observed 2026-08-19: a live task's copy was reassigned and reset
+  # to a detached HEAD, silently, with no refusal). A lease is the pool's own
+  # durable claim: treehouse never hands a leased slot to a later get and never
+  # prunes it, with or without a process inside, so the claim is enforced by
+  # the layer that does the allocating rather than re-derived from task records
+  # after the copy has already been reset.
+  #
+  # How the claim is released, since a claim nothing can release is the trap
+  # this fix could otherwise create:
+  #   - Normally bin/fm-teardown.sh returns the worktree, and `treehouse return`
+  #     releases the lease with it. That is the whole ordinary lifecycle.
+  #   - An aborted spawn releases it below in spawn_abort_cleanup, before any
+  #     task record exists to point at it.
+  #   - Otherwise the holder label names the exact record that owns the lease,
+  #     so a lease outliving its task is self-identifying and releasable with
+  #     `treehouse return --force --if-lease-holder <label> <path>`. A stale
+  #     lease costs one pool slot until then; it can never wedge a spawn,
+  #     because treehouse creates another slot rather than refusing.
+  SPAWN_TREEHOUSE_LEASE_HOLDER="fm:$ID@$STATE"
+  WT=$(cd "$PROJ_ABS" && treehouse get --lease --lease-holder "$SPAWN_TREEHOUSE_LEASE_HOLDER") || {
+    echo "error: treehouse get --lease could not lease a worktree for project '$PROJ_ABS'; nothing was launched" >&2
+    exit 1
+  }
+  if [ -z "$WT" ]; then
+    echo "error: treehouse get --lease reported no worktree for project '$PROJ_ABS'; nothing was launched" >&2
+    exit 1
+  fi
+  SPAWN_TREEHOUSE_LEASE_PATH=$WT
+  SPAWN_TREEHOUSE_LEASE_PENDING=1
+  validate_spawn_worktree "treehouse get --lease" "$T"
 
-  # Wait for the treehouse subshell: the pane's cwd moves from the project to the worktree.
+  # Move the pane into the leased copy and prove it arrived, the same way the
+  # relaunch path above does: the lease already fixes WHICH copy this task owns,
+  # so nothing here has to discover it from the pane, and a pane that reports a
+  # transient or stale path just keeps the wait going instead of being adopted.
   # Target the stable window id, not the name: if the name is ever lost (e.g. an
-  # automatic-rename slips through), display-message -t <bad-name> falls back to the
-  # active client's window, which would misread firstmate's OWN pane path as the
-  # worktree and tangle a hook into the primary checkout. The window id never lies.
-  # The project comparison is physical: spawn_worktree_isolated screens each
-  # read against PROJ_ABS_REAL, not PROJ_ABS, because a symlinked project prefix
-  # would otherwise make the pane's OS-level cwd read differ from PROJ_ABS on
-  # the very first poll, before the pane has actually moved.
-  #
-  # A single read that already looks isolated is not proof the pane settled
-  # there: on some tmux/WSL setups a brand-new window's pane_current_path
-  # transiently reports an unrelated stale path (seen live as another real git
-  # checkout entirely) before the shell catches up with treehouse get's cd. That
-  # stale path passes spawn_worktree_isolated too (it resolves to a real,
-  # distinct worktree top-level), so accepting it on one read alone silently
-  # records the wrong worktree= in state/<id>.meta. Require two consecutive
-  # reads to agree on the same isolated path before accepting it; a mismatch
-  # just becomes the new candidate rather than resetting the wait, so a pane
-  # that is already settled by the first real read only costs the one existing
-  # inter-poll sleep as confirmation, not a whole extra cycle on top.
-  #
-  # Every candidate is screened with the isolation guard's own predicate, so a
-  # read of the project itself or of the repository primary checkout is treated
-  # as the transient it is and the wait continues, instead of being adopted and
-  # then refused by the guard.
-  # A candidate the screen rejects is never adopted, so a host where the pane
-  # never reaches an isolated worktree spends the whole window before refusing.
-  # That wait is deliberate - telling a transient apart from a terminal
-  # misconfiguration would need machinery this path does not want - so the
-  # refusal has to be self-explaining instead: carry the last path seen and the
-  # reason it was rejected, and report both at the deadline.
-  candidate=""
-  last_seen=""
-  last_reason="the pane reported no path"
+  # automatic-rename slips through), display-message -t <bad-name> falls back to
+  # the active client's window, which would misread firstmate's OWN pane path as
+  # the worktree and tangle a hook into the primary checkout. The window id never
+  # lies.
+  spawn_cd_path=${WT//\'/\'\\\'\'}
+  spawn_send_text_line "$WT_TARGET" "cd -- '$spawn_cd_path'" || {
+    echo "error: could not tell window $T to enter its leased worktree '$WT'; nothing was launched" >&2
+    exit 1
+  }
+  spawn_wt_real=$(real_path_or_raw "$WT")
+  spawn_seen=
   for _ in $(seq 1 60); do
-    p=$(spawn_current_path "$WT_TARGET" || true)
-    [ -z "$p" ] || last_seen="$p"
-    if [ -n "$p" ] && spawn_worktree_isolated "$p"; then
-      p_real=$(real_path_or_raw "$p")
-      last_reason="it is an isolated worktree, but no second read agreed with it"
-      if [ -n "$candidate" ] && [ "$p_real" = "$candidate" ]; then
-        WT="$p"
-        break
-      fi
-      candidate="$p_real"
-    else
-      candidate=""
-      [ -z "$p" ] || last_reason=$SPAWN_WT_REASON
-    fi
+    spawn_seen=$(spawn_current_path "$WT_TARGET" || true)
+    [ -z "$spawn_seen" ] || [ "$(real_path_or_raw "$spawn_seen")" != "$spawn_wt_real" ] || break
     sleep 1
   done
-  if [ -z "$WT" ]; then
-    echo "error: treehouse get did not enter an isolated worktree within 60s (last seen '${last_seen:-none}': $last_reason; spawning project '$PROJ_ABS'); inspect window $T" >&2
+  if [ -z "$spawn_seen" ] || [ "$(real_path_or_raw "$spawn_seen")" != "$spawn_wt_real" ]; then
+    echo "error: window $T did not enter its leased worktree '$WT' within 60s (last seen '${spawn_seen:-none}'; spawning project '$PROJ_ABS'); inspect window $T" >&2
     exit 1
   fi
 
-  validate_spawn_worktree "treehouse get" "$T"
-
-  # Claim the pool slot for this task. The interactive `treehouse get` sent to
-  # the pane above records only a process lease (Treehouse's durable
-  # `get --lease --lease-holder`, which bin/fm-home-seed.sh uses for secondmate
-  # homes, is not this path), so Treehouse cannot say which task a slot belongs
-  # to once that task's worker exits - and that is exactly when the slot is
-  # handed on and this task's worktree= line goes stale. The claim is what lets
-  # bin/fm-teardown.sh leave a slot that has since been reassigned untouched, so
-  # a slot that cannot be claimed is refused here, at the cheapest point, rather
-  # than launching a worker whose slot teardown could later release out from
-  # under its successor.
+  # Record WHICH task owns this pool slot. The lease above stops the pool from
+  # handing the copy to a later spawn; the claim answers the other question, at
+  # teardown: whether the slot beside a task's record is still that task's own.
   # Written under the Treehouse project lock held from before slot allocation
   # through metadata publication, so no other spawn or return sees a half-claim.
   if fm_treehouse_pool_slot "$PROJ_ABS" "$WT"; then
@@ -4342,6 +4354,9 @@ fi
 # still being delivered, cannot observe or complete a fresh provisional record
 # between its state check and `tasks-axi start`, and a delivery failure cannot
 # follow a committed In-flight transition.
+# The task record is published, so it - not this aborting-spawn flag - now owns
+# the worktree lease; teardown releases it with the worktree.
+SPAWN_TREEHOUSE_LEASE_PENDING=0
 if [ "$SPAWN_TREEHOUSE_PROJECT_LOCK_HELD" = 1 ]; then
   SPAWN_TREEHOUSE_PROJECT_LOCK_HELD=0
   fm_lock_release "$SPAWN_TREEHOUSE_PROJECT_LOCK"
diff --git a/docs/architecture.md b/docs/architecture.md
index c8e8a9e58ef..16919aacf8c 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -243,7 +243,8 @@ Codex App support is recorded in `docs/codex-app-backend.md`; it is not selectab
 ## Worktrees, not branches in your checkout
 
 Crewmates never intentionally touch your project clone; [treehouse](https://github.com/kunchenguid/treehouse) pools clean worktrees for tmux, herdr, zellij, and cmux tasks, while Orca creates its own worktrees for `backend=orca`.
-The [`fm-spawn.sh` header](../bin/fm-spawn.sh) owns ship/scout worktree isolation and fresh-base refusal rules, including spawns from linked homes.
+A task's pool worktree is claimed with a durable treehouse lease labelled by the task record that owns it, so a copy whose agent is not running is never handed to the next spawn and reset under it, and teardown's return releases the claim.
+The [`fm-spawn.sh` header](../bin/fm-spawn.sh) owns ship/scout worktree isolation, the lease claim, and fresh-base refusal rules, including spawns from linked homes.
 Portable regressions live in [`tests/fm-spawn-pool-base-freshen.test.sh`](../tests/fm-spawn-pool-base-freshen.test.sh) for spawn isolation and base freshness, and [`tests/fm-control-relaunch.test.sh`](../tests/fm-control-relaunch.test.sh) for preserving the recorded copy on relaunch.
 
 The firstmate repo has one extra exposure because it can dispatch crewmates to work on itself.
diff --git a/docs/cmux-backend.md b/docs/cmux-backend.md
index 51618de5b5f..4ec911c7b10 100644
--- a/docs/cmux-backend.md
+++ b/docs/cmux-backend.md
@@ -87,7 +87,7 @@ A genuinely fresh surface returns an internal error from `read-screen` until som
 Target readiness therefore uses the structural `list-panes` response instead of a content read.
 Capture remains bounded and locally trimmed after `read-screen` becomes available.
 
-`current_directory` follows a top-level shell `cd` but not the foreground subshell opened by `treehouse get`.
+`current_directory` follows a top-level shell `cd` but not a foreground subshell.
 Spawn-time worktree discovery sends begin and end markers around `pwd`, captures the marked block, and joins wrapped path lines.
 
 An ordinary metadata-routed `fm-send.sh` text steer becomes a durable steering-inbox record, and only its best-effort constant doorbell passes through cmux's submit machinery.
diff --git a/docs/verification/runtime-backends.md b/docs/verification/runtime-backends.md
index f870d561b89..11bec98b4fe 100644
--- a/docs/verification/runtime-backends.md
+++ b/docs/verification/runtime-backends.md
@@ -1521,6 +1521,28 @@ The current catch-up reporting boundary is pinned by `tests/fm-afk-return.test.s
 The fixture captures submitted input through Pi's `input` extension hook, so the lab agent directory needs no provider credentials.
 The daemon injection transport into a live composer keeps its coverage in `tests/fm-afk-inject-herdr-e2e.test.sh` for the harnesses that still run the daemon, and the dedicated Herdr daemon workspace topology is covered by `tests/fm-afk-launch.test.sh` and preserves the captain tab's pane count.
 
+## Treehouse worktree pool
+
+The pool claim `bin/fm-spawn.sh` takes on a task worktree was verified on 2026-09-17 with treehouse v2.1.0 on Linux (WSL2).
+A task whose agent is not currently running leaves no process inside its copy, and a lease is what keeps that idle-looking copy from being handed to the next spawn and reset.
+
+```sh
+treehouse get --lease --lease-holder 'fm:demo-task@/home/fm/state'
+treehouse status --json
+printf 'pwd -P\nexit\n' | treehouse get
+```
+
+Observed output, with the pool root shortened:
+
+```text
+.treehouse/repo-b871d3/1/repo
+[{"name":"1","path":".../1/repo","status":"leased","lease_id":"84cf5022d6c3160e356d7a09de20d763","lease_holder":"fm:demo-task@/home/fm/state","leased_at":"2026-09-17T18:37:42.418019618+07:00","processes":[]}]
+.treehouse/repo-b871d3/2/repo
+```
+
+The leased slot carries no process and is still not handed to the later plain `get`, which allocates a different slot, and the holder label is readable back from the pool's own status.
+[`tests/fm-spawn-worktree-lease.test.sh`](../../tests/fm-spawn-worktree-lease.test.sh) is the command that refreshes this record; it skips when treehouse is not installed.
+
 ## Zellij
 
 The current compatibility floor and latest verification are Zellij 0.44.0 with `jq` on macOS aarch64.
diff --git a/docs/zellij-backend.md b/docs/zellij-backend.md
index fb58e52a621..a12ba2dd9ed 100644
--- a/docs/zellij-backend.md
+++ b/docs/zellij-backend.md
@@ -66,7 +66,7 @@ A pane can still disappear between verification and the operation; downstream su
 
 Every pane operation passes an explicit `--pane-id` because a new session can focus its release-notes plugin pane, whose numeric plugin id is in a separate namespace from terminal pane ids.
 
-`pane_cwd` follows a top-level shell `cd` but not the foreground subshell opened by `treehouse get`.
+`pane_cwd` follows a top-level shell `cd` but not a foreground subshell.
 Worktree discovery therefore sends begin and end markers around `pwd`, captures the marked block, and joins wrapped path lines.
 This active probe is scoped to spawn-time worktree discovery and is not advertised as a general live-cwd API.
 
diff --git a/tests/fixtures.sh b/tests/fixtures.sh
index 043d350012e..f95c8192f5a 100755
--- a/tests/fixtures.sh
+++ b/tests/fixtures.sh
@@ -251,14 +251,15 @@ EOF
 }
 
 # fm_test_make_spawn_fakebin <dir> [extra-exit0-tool...]
-# Creates <dir>/fakebin with the spawn tmux stub, a no-op treehouse, and any
-# extra exit-0 tools. Echoes the fakebin path.
+# Creates <dir>/fakebin with the spawn tmux stub, a lease-answering treehouse,
+# and any extra exit-0 tools. Echoes the fakebin path.
 fm_test_make_spawn_fakebin() {
   local dir=$1 fakebin
   shift
   fakebin=$(fm_fakebin "$dir")
   fm_test_fake_tmux_spawn "$fakebin"
-  fm_fake_exit0 "$fakebin" treehouse "$@"
+  fm_fake_exit0 "$fakebin" "$@"
+  fm_test_fake_treehouse_lease "$fakebin"
   printf '%s\n' "$fakebin"
 }
 
diff --git a/tests/fm-backend-herdr-presentation-e2e.test.sh b/tests/fm-backend-herdr-presentation-e2e.test.sh
index 4aef0afc349..2ebb6995bcb 100755
--- a/tests/fm-backend-herdr-presentation-e2e.test.sh
+++ b/tests/fm-backend-herdr-presentation-e2e.test.sh
@@ -854,9 +854,9 @@ finish_concurrent_expected_abort abort-b "$ABORT_B_STATUS" "$TMP_ROOT/abort-b.ou
 # The forced foreground_cwd is a plain non-git directory, which the discovery
 # poll now screens out on every read rather than adopting, so the armed failure
 # arrives as the poll's own deadline refusal naming that path.
-grep -F "did not enter an isolated worktree" "$TMP_ROOT/abort-a.err" >/dev/null 2>&1 \
+grep -F "did not yield an isolated worktree" "$TMP_ROOT/abort-a.err" >/dev/null 2>&1 \
   || fail "post-create abort fixture A did not reach the armed validation failure"
-grep -F "did not enter an isolated worktree" "$TMP_ROOT/abort-b.err" >/dev/null 2>&1 \
+grep -F "did not yield an isolated worktree" "$TMP_ROOT/abort-b.err" >/dev/null 2>&1 \
   || fail "post-create abort fixture B did not reach the armed validation failure"
 ABORT_A_PANE=$(cat "$POST_CREATE_ABORT_CONTROL/abort-a/task-pane")
 ABORT_B_PANE=$(cat "$POST_CREATE_ABORT_CONTROL/abort-b/task-pane")
diff --git a/tests/fm-backend.test.sh b/tests/fm-backend.test.sh
index f7021ac39e6..36902a26d86 100755
--- a/tests/fm-backend.test.sh
+++ b/tests/fm-backend.test.sh
@@ -808,6 +808,7 @@ exit 0
 SH
   chmod +x "$fb/tmux"
   fm_fake_exit0 "$fb" treehouse
+  fm_test_fake_treehouse_lease "$fb"
   printf '%s\n' "$fb"
 }
 
@@ -878,6 +879,7 @@ exit 0
 SH
   chmod +x "$fb/tmux"
   fm_fake_exit0 "$fb" treehouse
+  fm_test_fake_treehouse_lease "$fb"
   printf '%s\n' "$fb"
 }
 
diff --git a/tests/fm-backlog-atomicity.test.sh b/tests/fm-backlog-atomicity.test.sh
index 2290c5848bf..360aed1baba 100755
--- a/tests/fm-backlog-atomicity.test.sh
+++ b/tests/fm-backlog-atomicity.test.sh
@@ -96,6 +96,7 @@ exit 0
 SH
   chmod +x "$fakebin/tmux"
   fm_fake_exit0 "$fakebin" treehouse gh gh-axi no-mistakes
+  fm_test_fake_treehouse_lease "$fakebin"
 
   fm_git_init_commit "$case_dir/project"
   fm_git_add_origin "$case_dir/project" "$case_dir/project.origin.git"
diff --git a/tests/fm-bootstrap-network-parallel.test.sh b/tests/fm-bootstrap-network-parallel.test.sh
index f28d46cebe0..673d5de9d00 100755
--- a/tests/fm-bootstrap-network-parallel.test.sh
+++ b/tests/fm-bootstrap-network-parallel.test.sh
@@ -185,6 +185,7 @@ test_remote_probe_scheduling_keeps_per_mate_lines() { # <parallel|fallback>
   git -C "$primary" commit -qm 'seed primary default branch'
   fakebin=$(fm_fakebin "$dir")
   fm_fake_exit0 "$fakebin" gh treehouse tmux node
+  fm_test_fake_treehouse_lease "$fakebin"
   log="$dir/probe.log"
   : > "$log"
   install_fake_ssh "$fakebin"
diff --git a/tests/fm-captain-hold-lifecycle.test.sh b/tests/fm-captain-hold-lifecycle.test.sh
index cfe7f443562..d0e641e05f1 100755
--- a/tests/fm-captain-hold-lifecycle.test.sh
+++ b/tests/fm-captain-hold-lifecycle.test.sh
@@ -32,6 +32,7 @@ make_home() {  # <name>
 EOF
   fakebin=$(fm_fakebin "$home")
   fm_fake_exit0 "$fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$fakebin"
   printf '%s\n' "$home"
 }
 
@@ -241,6 +242,7 @@ done_keep = 10
 EOF
   fb=$(fm_fakebin "$home")
   fm_fake_exit0 "$fb" tmux treehouse no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$fb"
   printf '%s\n' "$home|$graph/.beads"
 }
 
@@ -1300,6 +1302,7 @@ test_secondmate_hold_stays_in_authoritative_home() {
 EOF
   fakebin=$(fm_fakebin "$mate")
   fm_fake_exit0 "$fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$fakebin"
   origin=sample-mate-review
   mkdir -p "$mate/data/$origin"
   tasks_in "$mate" add "$origin" "Investigate secondmate sample" --kind scout --repo sample --start >/dev/null
@@ -1357,6 +1360,7 @@ test_secondmate_home_publishes_holds_and_answers() {
 EOF
   fakebin=$(fm_fakebin "$mate")
   fm_fake_exit0 "$fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$fakebin"
   channel="$parent/state/channel-mate.status"
   decision="$mate/decision.txt"
 
@@ -2902,6 +2906,7 @@ SH
     "the deliverable was recorded before destructive cleanup succeeded"
 
   fm_fake_exit0 "$home/fakebin" treehouse
+  fm_test_fake_treehouse_lease "$home/fakebin"
   bootstrap=$(PATH="$home/fakebin:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
     FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
     FM_CONFIG_OVERRIDE="$home/config" FM_BOOTSTRAP_NETWORK=skip \
@@ -2958,6 +2963,7 @@ SH
   run_captain "$home" answer "$id" --decision-file "$home/answer.txt" >/dev/null \
     || fail "the captain could not answer before cleanup replay"
   fm_fake_exit0 "$home/fakebin" treehouse
+  fm_test_fake_treehouse_lease "$home/fakebin"
   bootstrap=$(PATH="$home/fakebin:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
     FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
     FM_CONFIG_OVERRIDE="$home/config" FM_BOOTSTRAP_NETWORK=skip \
@@ -3083,6 +3089,7 @@ SH
   assert_contains "$show" "held: no" "the relocated report kept the answered call held"
 
   fm_fake_exit0 "$home/fakebin" treehouse
+  fm_test_fake_treehouse_lease "$home/fakebin"
   bootstrap=$(PATH="$home/fakebin:$PATH" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$home" \
     FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$data" \
     FM_CONFIG_OVERRIDE="$home/config" FM_BOOTSTRAP_NETWORK=skip \
diff --git a/tests/fm-kimi-harness.test.sh b/tests/fm-kimi-harness.test.sh
index e08674d3fe8..1310f00441c 100755
--- a/tests/fm-kimi-harness.test.sh
+++ b/tests/fm-kimi-harness.test.sh
@@ -203,6 +203,7 @@ exit 0
 SH
   chmod +x "$fakebin/tmux"
   fm_fake_exit0 "$fakebin" treehouse gh-axi gh
+  fm_test_fake_treehouse_lease "$fakebin"
   fm_fake_exit0 "$fakebin" kimi
   ln -s "$JQ_BIN" "$fakebin/jq"
   printf '%s\n' "$fakebin"
diff --git a/tests/fm-muse-harness.test.sh b/tests/fm-muse-harness.test.sh
index a655b4d7ec7..4c6fcdb62a5 100755
--- a/tests/fm-muse-harness.test.sh
+++ b/tests/fm-muse-harness.test.sh
@@ -113,6 +113,7 @@ exec "$FM_FAKE_MUSE_VERSIONED" -c 'result=$($FM_FAKE_HARNESS_PROBE); printf "%s"
 SH
   chmod +x "$fakebin/muse"
   fm_fake_exit0 "$fakebin" treehouse gh-axi gh
+  fm_test_fake_treehouse_lease "$fakebin"
   printf '%s\n' "$fakebin"
 }
 
diff --git a/tests/fm-public-followup.test.sh b/tests/fm-public-followup.test.sh
index c5551d99a0b..944bae1499c 100755
--- a/tests/fm-public-followup.test.sh
+++ b/tests/fm-public-followup.test.sh
@@ -126,6 +126,7 @@ EOF
   [ "$relay" = relay-off ] || printf 'FMX_PAIRING_TOKEN=test-token\n' > "$home/.env"
   make_fake_curl "$home" >/dev/null
   fm_fake_exit0 "$home/fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$home/fakebin"
   printf '%s\n' "$home"
 }
 
@@ -847,6 +848,7 @@ test_secondmate_teardown_resolves_parent_from_durable_record_when_env_lost() {
   parent_resolved=$(cd "$parent" && pwd -P)
   make_fake_curl "$child" >/dev/null
   fm_fake_exit0 "$child/fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$child/fakebin"
 
   assert_local_secondmate_parent_record "$child" "$parent_resolved"
 
@@ -884,6 +886,7 @@ test_secondmate_teardown_durable_record_missing_parent_registration_still_refuse
   parent_resolved=$(cd "$parent" && pwd -P)
   make_fake_curl "$child" >/dev/null
   fm_fake_exit0 "$child/fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$child/fakebin"
   assert_local_secondmate_parent_record "$child" "$parent_resolved"
   fm_write_meta "$child/state/work-child.meta" \
     "window=firstmate:fm-work-child" "endpoint_task_id=work-child" \
@@ -915,6 +918,7 @@ test_secondmate_teardown_durable_record_with_unknown_field_succeeds() {
   parent_resolved=$(cd "$parent" && pwd -P)
   make_fake_curl "$child" >/dev/null
   fm_fake_exit0 "$child/fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$child/fakebin"
   assert_local_secondmate_parent_record "$child" "$parent_resolved"
   printf 'some_future_field=value\n' >> "$child/.fm-secondmate-parent"
   parent_alias="$TMP_ROOT/teardown-durable-clean-parent-alias"
@@ -950,6 +954,7 @@ test_secondmate_teardown_rejects_conflicting_live_and_durable_parent_bindings()
   parent_resolved=$(cd "$durable_parent" && pwd -P)
   make_fake_curl "$child" >/dev/null
   fm_fake_exit0 "$child/fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$child/fakebin"
   assert_local_secondmate_parent_record "$child" "$parent_resolved"
   fm_write_meta "$durable_parent/state/mate.meta" "kind=secondmate" "home=$child"
   fm_git_init_commit "$child/projects/worktree"
@@ -982,6 +987,7 @@ test_secondmate_teardown_rejects_unsafe_durable_parent_records() {
     child=$(cd "$child" && pwd -P)
     make_fake_curl "$child" >/dev/null
     fm_fake_exit0 "$child/fakebin" tmux treehouse no-mistakes gh gh-axi
+    fm_test_fake_treehouse_lease "$child/fakebin"
     fm_write_meta "$child/state/work-child.meta" \
       "window=firstmate:fm-work-child" "endpoint_task_id=work-child" \
       "worktree=$child" "project=$child" "kind=ship" "mode=local-only" "spawn_gen=public-followup-fixture"
@@ -1044,6 +1050,7 @@ test_secondmate_teardown_rejects_nul_bearing_durable_parent_record() {
   parent_resolved=$(cd "$parent" && pwd -P)
   make_fake_curl "$child" >/dev/null
   fm_fake_exit0 "$child/fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$child/fakebin"
   assert_local_secondmate_parent_record "$child" "$parent_resolved"
   fm_write_meta "$parent/state/mate.meta" "kind=secondmate" "home=$child"
   fm_git_init_commit "$child/projects/worktree"
@@ -1475,6 +1482,7 @@ test_dropped_baton_now_surfaces_open_loop() {
   child=$(cd "$child" && pwd -P)
   make_fake_curl "$child" >/dev/null
   fm_fake_exit0 "$child/fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$child/fakebin"
   log="$TMP_ROOT/curl.log"; : > "$log"
 
   seed_repro_commitment "$parent" public-final-pi-rearm-repro req-pirearm \
@@ -1525,6 +1533,7 @@ test_control_registered_followon_is_guarded() {
   child=$(cd "$child" && pwd -P)
   make_fake_curl "$child" >/dev/null
   fm_fake_exit0 "$child/fakebin" tmux treehouse no-mistakes gh gh-axi
+  fm_test_fake_treehouse_lease "$child/fakebin"
   seed_repro_commitment "$parent" public-final-pi-rearm-ship req-pirearm2 \
     secondmate:mate pi-rearm-loop-fix-r1
   fm_write_meta "$parent/state/mate.meta" "kind=secondmate" "home=$child"
diff --git a/tests/fm-rovo-harness.test.sh b/tests/fm-rovo-harness.test.sh
index 021d6ff0c59..0e1bf868dd5 100644
--- a/tests/fm-rovo-harness.test.sh
+++ b/tests/fm-rovo-harness.test.sh
@@ -124,6 +124,7 @@ exit 0
 SH
   chmod +x "$fakebin/tmux"
   fm_fake_exit0 "$fakebin" treehouse gh-axi gh
+  fm_test_fake_treehouse_lease "$fakebin"
   fm_fake_exit0 "$fakebin" rovo
   printf '%s\n' "$fakebin"
 }
diff --git a/tests/fm-secondmate-sync.test.sh b/tests/fm-secondmate-sync.test.sh
index 234c39c30b2..92a5835aa95 100755
--- a/tests/fm-secondmate-sync.test.sh
+++ b/tests/fm-secondmate-sync.test.sh
@@ -1274,6 +1274,7 @@ test_bootstrap_syncs_remote_home_to_primary_commit() {
 
   fakebin=$(make_remote_leg_ssh_stub "$w")
   fm_fake_exit0 "$fakebin" gh treehouse tmux node
+  fm_test_fake_treehouse_lease "$fakebin"
   out=$(PATH="$fakebin:$BASE_PATH" \
     FM_HOME="$home" FM_ROOT_OVERRIDE="$w/main" \
     FM_BOOTSTRAP_NETWORK=only \
@@ -1312,6 +1313,7 @@ test_bootstrap_reports_outdated_host_actionably() {
 
   fakebin=$(make_remote_leg_ssh_stub "$w")
   fm_fake_exit0 "$fakebin" gh treehouse tmux node
+  fm_test_fake_treehouse_lease "$fakebin"
   out=$(PATH="$fakebin:$BASE_PATH" \
     FM_HOME="$home" FM_ROOT_OVERRIDE="$w/main" \
     FM_BOOTSTRAP_NETWORK=only \
@@ -1353,6 +1355,7 @@ test_remote_launch_does_not_retarget_host_copy() {
     "$w/herdr.sendfail" "$w/herdr.sock"
   cp "$herdrbin/bin/herdr" "$fakebin/herdr"
   fm_fake_exit0 "$fakebin" gh treehouse tmux node
+  fm_test_fake_treehouse_lease "$fakebin"
 
   # The real launch leg, exactly as the parent invokes it after its own sync.
   launch_out=$(PATH="$fakebin:$BASE_PATH" \
diff --git a/tests/fm-shared-captain-inheritance.test.sh b/tests/fm-shared-captain-inheritance.test.sh
index efd61dd804f..1504ec71539 100755
--- a/tests/fm-shared-captain-inheritance.test.sh
+++ b/tests/fm-shared-captain-inheritance.test.sh
@@ -220,6 +220,7 @@ SH
 add_bootstrap_compatible_tools() {
   local fakebin=$1
   fm_fake_exit0 "$fakebin" node chrome-devtools-axi gh treehouse
+  fm_test_fake_treehouse_lease "$fakebin"
   fm_fake_version_tool "$fakebin" lavish-axi FM_FAKE_LAVISH_AXI_VERSION 0.1.46
   cat > "$fakebin/gh-axi" <<'SH'
 #!/usr/bin/env bash
diff --git a/tests/fm-spawn-base-branch.test.sh b/tests/fm-spawn-base-branch.test.sh
index d7967b682af..f094436288e 100755
--- a/tests/fm-spawn-base-branch.test.sh
+++ b/tests/fm-spawn-base-branch.test.sh
@@ -41,6 +41,7 @@ exit 0
 SH
   chmod +x "$fakebin/tmux"
   fm_fake_exit0 "$fakebin" treehouse
+  fm_test_fake_treehouse_lease "$fakebin"
   printf '%s\n' "$fakebin"
 }
 
diff --git a/tests/fm-spawn-pool-base-freshen.test.sh b/tests/fm-spawn-pool-base-freshen.test.sh
index 2d39f3607ca..298c463efff 100755
--- a/tests/fm-spawn-pool-base-freshen.test.sh
+++ b/tests/fm-spawn-pool-base-freshen.test.sh
@@ -144,14 +144,15 @@ test_linked_spawning_home_rejects_primary_before_refresh() {
         || fail "spawn did not refresh the genuine scout copy"
     else
       [ "$status" -ne 0 ] || fail "linked spawning home accepted $returned as a disposable copy"
-      # None of these is an isolated copy, so the worktree poll never adopts one
-      # and the wait runs out instead: the spawning directory fails the poll's
-      # own project comparison, and the repository primary (named directly or
-      # through a symlink) fails the isolation screen the poll shares with the
-      # guard. The refusal names the last path the pane reported.
-      assert_contains "$out" "did not enter an isolated worktree" \
+      # None of these is an isolated copy, so the isolation screen refuses the
+      # leased path before the pane is ever moved into it: the spawning
+      # directory fails the project comparison, and the repository primary
+      # (named directly or through a symlink) fails the common-git-dir test.
+      # The refusal names the copy it rejected and why.
+      assert_contains "$out" "did not yield an isolated worktree" \
         "spawn did not explain its isolation refusal"
-      assert_contains "$out" "last seen" "refusal did not name the path the pane reported"
+      assert_contains "$out" "resolved '$POOL_DIR'" \
+        "refusal did not name the copy it rejected"
       [ ! -e "$HOME_DIR/state/$id.meta" ] || fail "refused spawn published task metadata"
       [ ! -e "$primary/.git/FETCH_HEAD" ] || fail "refused spawn fetched before proving isolation"
     fi
diff --git a/tests/fm-spawn-worktree-lease.test.sh b/tests/fm-spawn-worktree-lease.test.sh
new file mode 100644
index 00000000000..1fc1db908fe
--- /dev/null
+++ b/tests/fm-spawn-worktree-lease.test.sh
@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# Regression test for the worktree claim fm-spawn.sh takes on a pool slot
+# (bin/fm-spawn.sh, the `treehouse get --lease` branch).
+#
+# Treehouse counts a slot as in use only while a process runs inside it, so a
+# task whose agent has exited - paused, crashed, or between turns - leaves its
+# own working copy looking free, and the next spawn was handed that copy and
+# reset it (observed 2026-08-19, silently, with no refusal). fm-spawn therefore
+# takes the pool's own durable claim on the slot instead of relying on the
+# pane's subshell to hold it, and labels the lease with the task record that
+# owns it so a lease outliving its task can be identified and released.
+#
+# The three things that must hold: the claim is taken and labelled, an aborted
+# spawn gives it straight back, and a live claim really does keep the pool from
+# handing the same copy to the next get.
+set -u
+
+# shellcheck source=tests/fixtures.sh
+. "$(dirname "${BASH_SOURCE[0]}")/fixtures.sh"
+
+TMP_ROOT=$(fm_test_tmproot fm-spawn-worktree-lease)
+SEP=$'\x1f'
+
+# make_lease_case <name> <id> -> case record; leaves LEASE_* globals set.
+make_lease_case() {
+  local name=$1 id=$2 case_dir
+  case_dir="$TMP_ROOT/$name"
+  LEASE_HOME="$case_dir/home"
+  LEASE_PROJ="$case_dir/project"
+  LEASE_WT="$case_dir/slot"
+  LEASE_LOG="$case_dir/treehouse.log"
+  mkdir -p "$case_dir"
+  LEASE_FAKEBIN=$(make_spawn_fakebin "$case_dir/fake")
+  fm_test_fake_sleep_noop "$LEASE_FAKEBIN"
+  fm_test_spawn_home "$LEASE_HOME" codex
+  fm_git_worktree "$LEASE_PROJ" "$LEASE_WT" "slot-$name"
+  fm_test_spawn_brief "$LEASE_HOME" "$id" "Exercise the pool claim for $id."
+  : > "$LEASE_LOG"
+}
+
+run_lease_spawn() {  # <id> <pane-path>
+  local id=$1 pane=$2
+  FM_TREEHOUSE_LOG="$LEASE_LOG" FM_FAKE_LEASE_PATH="$LEASE_WT" \
+    fm_test_run_spawn "$LEASE_HOME" "$pane" "$LEASE_FAKEBIN" \
+    "$id" "$LEASE_PROJ" --mode no-mistakes --yolo off
+}
+
+# The claim itself: a durable lease, labelled with the task record that owns it
+# so the label alone says which record to look for when a lease outlives its
+# task.
+test_spawn_claims_the_slot_with_a_labelled_lease() {
+  local id out status
+  id=lease-claim-w1
+  make_lease_case lease-claim "$id"
+
+  out=$(run_lease_spawn "$id" "$LEASE_WT")
+  status=$?
+  expect_code 0 "$status" "spawn should succeed"$'\n'"$out"
+  assert_grep "worktree=$LEASE_WT" "$LEASE_HOME/state/$id.meta" \
+    "meta did not record the leased worktree"
+  assert_contains "$(cat "$LEASE_LOG")" \
+    "treehouse${SEP}get${SEP}--lease${SEP}--lease-holder${SEP}fm:$id@$LEASE_HOME/state" \
+    "spawn did not take a durable lease labelled with the owning task record"
+  assert_not_contains "$(cat "$LEASE_LOG")" "return" \
+    "a successful spawn returned the slot it had just claimed"
+  pass "a spawn claims its pool slot with a lease labelled by the owning task record"
+}
+
+# The claim must not outlive a spawn that never published a record to point at
+# it, and the return must be holder-matched so it can never take back a slot
+# some later allocation already owns.
+test_aborted_spawn_returns_its_claim() {
+  local id out status log
+  id=lease-abort-w2
+  make_lease_case lease-abort "$id"
+
+  # The pane never arrives in the leased copy, so the spawn refuses at the
+  # deadline - after the lease was taken and before any record names it.
+  out=$(run_lease_spawn "$id" "$LEASE_PROJ")
+  status=$?
+  [ "$status" -ne 0 ] || fail "spawn accepted a pane that never entered the leased worktree"$'\n'"$out"
+  [ ! -e "$LEASE_HOME/state/$id.meta" ] || fail "refused spawn published task metadata"
+  log=$(cat "$LEASE_LOG")
+  assert_contains "$log" \
+    "treehouse${SEP}return${SEP}--force${SEP}--if-lease-holder${SEP}fm:$id@$LEASE_HOME/state${SEP}$LEASE_WT" \
+    "an aborted spawn left its pool claim behind"
+  pass "an aborted spawn returns its claim, matched on the holder that took it"
+}
+
+# The guarantee the whole fix rests on, checked against the real pool rather
+# than assumed: a leased slot is not handed to a later `treehouse get`, with no
+# process running inside it.
+test_real_pool_does_not_hand_out_a_leased_slot() {
+  local repo leased handed
+  if ! command -v treehouse >/dev/null 2>&1; then
+    echo "skip: treehouse not installed - cannot check the real pool's lease guarantee"
+    return 0
+  fi
+  repo="$TMP_ROOT/real-pool/repo"
+  fm_git_init_commit "$repo"
+  printf 'max_trees = 16\nroot = "./"\n' > "$repo/treehouse.toml"
+  git -C "$repo" add treehouse.toml
+  git -C "$repo" -c user.email=fm@test -c user.name=fm commit -qm 'pool config'
+  leased=$(cd "$repo" && treehouse get --lease --lease-holder 'fm:pool-guarantee@state' 2>/dev/null) \
+    || fail "real treehouse could not lease a worktree"
+  [ -n "$leased" ] || fail "real treehouse leased no worktree"
+  # Nothing is running inside the leased slot, which is exactly the state that
+  # made a live task's copy look free before it was claimed. The pool lives
+  # under the fixture repo, so it is removed with the temp root.
+  handed=$(cd "$repo" && printf 'pwd -P\nexit\n' | treehouse get 2>/dev/null | grep '^/' | tail -1)
+  [ -n "$handed" ] || fail "real treehouse handed out no worktree at all"
+  [ "$handed" != "$leased" ] || fail "real treehouse handed out the leased, idle slot"
+  pass "the real pool does not hand out a leased slot that has no process inside it"
+}
+
+test_spawn_claims_the_slot_with_a_labelled_lease
+test_aborted_spawn_returns_its_claim
+test_real_pool_does_not_hand_out_a_leased_slot
+
+echo "# all fm-spawn-worktree-lease tests passed"
diff --git a/tests/fm-spawn-worktree-settle.test.sh b/tests/fm-spawn-worktree-settle.test.sh
index 418d0d70246..e4398b39687 100755
--- a/tests/fm-spawn-worktree-settle.test.sh
+++ b/tests/fm-spawn-worktree-settle.test.sh
@@ -1,24 +1,16 @@
 #!/usr/bin/env bash
-# Regression test for the fm-spawn.sh treehouse-get worktree-detection settle
-# loop (bin/fm-spawn.sh, the `for _ in $(seq 1 60)` loop after `treehouse get`).
+# Regression test for the fm-spawn.sh pane-settle loop (bin/fm-spawn.sh, the
+# `for _ in $(seq 1 60)` loop after the worktree lease).
 #
-# On some tmux/WSL setups a brand-new window's pane_current_path transiently
-# reports a stale, unrelated-but-real path on the very first poll, before the
-# pane actually settles into the worktree treehouse get moved it to. That stale
-# path still passes the loop's "differs from the project" check and
-# validate_spawn_worktree's "is a real, distinct worktree" check (it IS a real
-# git checkout, just the wrong one), so a naive single-read loop silently
-# records the wrong worktree= in state/<id>.meta. This test simulates that
-# transient-then-settled pane_current_path sequence with a fake tmux and
-# asserts the recorded worktree resolves to the real, settled worktree, never
-# the stale first read.
-#
-# The same loop has a second transient to survive: `treehouse get` reports the
-# REPOSITORY's primary checkout as its own cwd while it is still preparing a
-# slot. From a linked spawning home that path is not the project, so a poll
-# comparing only against the project adopted it and the isolation guard then
-# refused the launch. The cases below cover both the transient and the pane
-# that never leaves the primary at all.
+# fm-spawn leases the task's worktree itself and then moves the pane into it, so
+# the leased path - not whatever the pane happens to report - is what gets
+# recorded. The loop exists to prove the pane actually arrived, and it has two
+# transients to survive. On some tmux/WSL setups a brand-new window's
+# pane_current_path reports a stale, unrelated-but-real path on the first polls
+# before the shell catches up with the cd; from a linked spawning home that
+# stale path can even be the repository's own primary checkout. Neither may be
+# mistaken for arrival, and a pane that never arrives must fail loudly at the
+# deadline rather than launching a worker outside the copy it was given.
 set -u
 
 # shellcheck source=tests/fixtures.sh
@@ -62,6 +54,7 @@ exit 0
 SH
   chmod +x "$fakebin/tmux"
   fm_fake_exit0 "$fakebin" treehouse
+  fm_test_fake_treehouse_lease "$fakebin"
   printf '%s\n' "$fakebin"
 }
 
@@ -134,8 +127,9 @@ test_single_stale_first_read_is_not_accepted() {
   pass "a single transient stale pane_current_path read is not accepted as the worktree"
 }
 
-# A pane that reports the real worktree from the very first read costs exactly
-# one confirming read - not a whole extra polling cycle on top of it. Counting
+# A pane that reports the leased worktree from the very first read costs exactly
+# that one read - the loop must not spend a polling cycle on a settled pane.
+# Counting
 # the pane reads measures the loop itself; wall-clock time would fold in every
 # other cost of a spawn (fetch, trust registration) and drift with the machine.
 test_already_settled_pane_costs_one_confirm_read() {
@@ -150,19 +144,18 @@ test_already_settled_pane_costs_one_confirm_read() {
   assert_grep "worktree=$WT_DIR" "$HOME_DIR/state/$id.meta" \
     "meta did not record the already-settled worktree"
   reads=$(cat "$COUNTFILE")
-  [ "$reads" -eq 2 ] || fail "already-settled pane took $reads reads to confirm - expected the first read plus one confirmation"
-  pass "an already-settled pane confirms on the next read, not a whole extra cycle"
+  [ "$reads" -eq 1 ] || fail "already-settled pane took $reads reads to confirm - expected a single read"
+  pass "an already-settled pane confirms on its first read, not a whole extra cycle"
 }
 
 # make_primary_case <name> <id> <stale_reads> builds the linked-home shape: the
 # spawning project is itself a LINKED worktree of the repository, and the path
-# the pane transiently reports is that repository's PRIMARY checkout. `treehouse
-# get` reports the repository it is preparing a slot from as its own cwd while
-# it is still fetching and checking out, so the pane reads the primary for the
-# first seconds. The primary is not the spawning project, so a poll that only
-# compares against the project accepts it as the worktree, and the isolation
-# guard then refuses the launch even though treehouse went on to enter a real
-# slot. The settled path is a second linked worktree of the same repository.
+# the pane transiently reports is that repository's PRIMARY checkout - the path
+# a pane in a linked home reads for the first seconds after it is created,
+# before the cd into the leased slot takes effect. The primary is not the
+# spawning project, so a loop that only compared against the project would
+# accept it as arrival and launch the worker in the primary checkout. The
+# settled path is a second linked worktree of the same repository.
 make_primary_case() {
   local name=$1 id=$2 stale_reads=$3 case_dir home primary proj wt fakebin countfile
   case_dir="$TMP_ROOT/$name"
@@ -179,9 +172,9 @@ make_primary_case() {
   printf '%s\n' "$case_dir|$home|$proj|$wt|$primary|$fakebin|$countfile|$stale_reads"
 }
 
-# The exact incident: the pane reports the repository primary for the first
-# reads, then settles into the slot treehouse actually created. The primary must
-# never be adopted as the worktree, so the spawn lands on the settled slot.
+# The pane reports the repository primary for the first reads, then settles into
+# the leased slot. The primary must never count as arrival, so the spawn lands
+# on the leased slot.
 test_transient_primary_checkout_is_not_accepted() {
   local rec id out status
   id=settle-primary-transient-z3
@@ -211,12 +204,12 @@ test_primary_checkout_that_never_settles_fails_at_the_deadline() {
   out=$(run_settle_spawn "$id")
   status=$?
   [ "$status" -ne 0 ] || fail "spawn accepted a pane that never left the primary checkout"$'\n'"$out"
-  assert_contains "$out" "did not enter an isolated worktree" \
-    "spawn did not explain that the pane never reached an isolated worktree"
+  assert_contains "$out" "did not enter its leased worktree" \
+    "spawn did not explain that the pane never reached the leased worktree"
   assert_contains "$out" "$STALE_DIR" \
     "the refusal did not name the path the pane kept reporting"
-  assert_contains "$out" "repository's primary checkout" \
-    "the refusal did not say why that path was rejected"
+  assert_contains "$out" "$WT_DIR" \
+    "the refusal did not name the leased worktree the pane never reached"
   [ ! -e "$HOME_DIR/state/$id.meta" ] || fail "refused spawn published task metadata"
   pass "a pane stuck on the primary checkout fails loudly at the deadline"
 }
diff --git a/tests/fm-tangle-guard.test.sh b/tests/fm-tangle-guard.test.sh
index d59864e0dae..4348bac596a 100755
--- a/tests/fm-tangle-guard.test.sh
+++ b/tests/fm-tangle-guard.test.sh
@@ -185,14 +185,14 @@ test_spawn_isolation_abort() {
   out=$(GIT_CEILING_DIRECTORIES="$TMP_ROOT/spawn-notgit-root" \
     run_spawn "$home" abort-notgit-dd4 "$proj" "$TMP_ROOT/spawn-notgit-root/plain" "$fakebin"); status=$?
   expect_code 1 "$status" "spawn into a non-worktree dir should abort"
-  assert_contains "$out" "did not enter an isolated worktree" "non-worktree spawn lacked the isolation error"
+  assert_contains "$out" "did not yield an isolated worktree" "non-worktree spawn lacked the isolation error"
   assert_contains "$out" "not inside a git worktree" "non-worktree spawn did not say why the path was rejected"
   assert_absent "$home/state/abort-notgit-dd4.meta" "aborted spawn must not record meta"
 
   # Abort: the pane resolves INTO the primary checkout (a subdir of PROJ_ABS).
   out=$(run_spawn "$home" abort-primary-ee5 "$proj" "$proj/sub" "$fakebin"); status=$?
   expect_code 1 "$status" "spawn landing inside the primary checkout should abort"
-  assert_contains "$out" "did not enter an isolated worktree" "primary-checkout spawn lacked the isolation error"
+  assert_contains "$out" "did not yield an isolated worktree" "primary-checkout spawn lacked the isolation error"
   assert_contains "$out" "not a worktree root" "primary-checkout spawn did not say why the path was rejected"
   assert_absent "$home/state/abort-primary-ee5.meta" "aborted spawn must not record meta"
 
@@ -239,6 +239,7 @@ exit 0
 SH
   chmod +x "$fakebin/tmux"
   fm_fake_exit0 "$fakebin" treehouse
+  fm_test_fake_treehouse_lease "$fakebin"
   printf '%s\n' "$fakebin"
 }
 
@@ -277,9 +278,10 @@ test_spawn_tmux_window_construction() {
   assert_grep "set-window-option -t @spawnwid allow-rename off" "$rec" \
     "must disable allow-rename on the spawned window"
 
-  # Bug 2 fix (b): treehouse-get and the worktree wait loop target the stable id.
-  assert_grep "send-keys -t @spawnwid treehouse get Enter" "$rec" \
-    "treehouse get must be sent to the stable window id"
+  # Bug 2 fix (b): the move into the leased worktree and the arrival wait loop
+  # both target the stable id.
+  assert_grep "send-keys -t @spawnwid cd -- " "$rec" \
+    "the move into the leased worktree must be sent to the stable window id"
   assert_grep "display-message -p -t @spawnwid #{pane_current_path}" "$rec" \
     "the worktree wait loop must query the stable window id, not the name"
 
diff --git a/tests/fm-trace-context-spawn.test.sh b/tests/fm-trace-context-spawn.test.sh
index b9a61736246..6e1c8564999 100755
--- a/tests/fm-trace-context-spawn.test.sh
+++ b/tests/fm-trace-context-spawn.test.sh
@@ -90,6 +90,7 @@ exit 0
 SH
   chmod +x "$fakebin/tmux"
   fm_fake_exit0 "$fakebin" treehouse
+  fm_test_fake_treehouse_lease "$fakebin"
   printf '%s\n' "$fakebin"
 }
 
diff --git a/tests/lib.sh b/tests/lib.sh
index 4429362ae55..2830ab07b1b 100644
--- a/tests/lib.sh
+++ b/tests/lib.sh
@@ -360,6 +360,42 @@ SH
   done
 }
 
+# fm_test_fake_treehouse_lease <fakebin>
+# Stands in for the pool: `treehouse get --lease` prints the leased worktree
+# (FM_FAKE_LEASE_PATH, defaulting to the path the fake pane will report), every
+# call is appended to FM_TREEHOUSE_LOG when set, and everything else exits 0.
+# FM_FAKE_LEASE_FAIL=1 makes the acquire fail the way an exhausted pool does.
+fm_test_fake_treehouse_lease() {
+  local fakebin=$1
+  cat > "$fakebin/treehouse" <<'SH'
+#!/usr/bin/env bash
+set -u
+if [ -n "${FM_TREEHOUSE_LOG:-}" ]; then
+  { printf 'treehouse'; for a in "$@"; do printf '\x1f%s' "$a"; done; printf '\n'; } >> "$FM_TREEHOUSE_LOG"
+fi
+case "${1:-}" in
+  get)
+    case " $* " in
+      *" --help "*|*" -h "*)
+        printf '%s\n' 'Usage: treehouse get [--lease] [--lease-holder string]'
+        exit 0
+        ;;
+      *" --lease "*)
+        if [ "${FM_FAKE_LEASE_FAIL:-0}" = 1 ]; then
+          echo "treehouse: no worktree available" >&2
+          exit 1
+        fi
+        printf '%s\n' "${FM_FAKE_LEASE_PATH:-${FM_FAKE_PANE_PATH:-}}"
+        exit 0
+        ;;
+    esac
+    ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/treehouse"
+}
+
 # fm_fake_crash_injector <fakebin>
 # Drops an `fm-crash-inject <pid>` shim that a PATH fake calls to simulate a
 # hard crash of the process under test. It SIGKILLs <pid> and then returns only

From 072772b96c246ecb366cbc25beb9eaf02d6ed48d Mon Sep 17 00:00:00 2001
From: Tejas Shah <talktejas@gmail.com>
Date: Thu, 17 Sep 2026 18:45:05 +0700
Subject: [PATCH 2/5] fix(spawn): refuse a pooled copy a live task record still
 names

The pool cannot see a claim on a copy whose only claim was the processes
inside it - the shape every task spawned before leases existed leaves
behind - so fm-spawn checks this home's own records too and refuses by
name rather than launching into another worker's copy.

The claim is deliberately kept on that refusal. Releasing it would offer
the same copy to the next spawn, which would refuse again and deadlock
the pool on it; holding it quarantines that one slot instead, and the
refusal prints the exact command that releases it once the contradictory
records are reconciled.
---
 bin/fm-spawn.sh                       | 25 +++++++++++++++++++++++++
 bin/fm-teardown.sh                    |  3 +++
 tests/fm-spawn-worktree-lease.test.sh | 26 ++++++++++++++++++++++++++
 3 files changed, 54 insertions(+)

diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 03d46c0cbe1..9c3b3c51517 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -3667,6 +3667,31 @@ elif [ "$KIND" != secondmate ] && [ "$BACKEND" != orca ]; then
   SPAWN_TREEHOUSE_LEASE_PENDING=1
   validate_spawn_worktree "treehouse get --lease" "$T"
 
+  # Second line of defence, for a copy the pool offered that a live task record
+  # in this home still names: a task spawned before leases existed holds its
+  # slot with nothing but its processes, and that is exactly the copy the pool
+  # cannot see a claim on. Refuse rather than launch into it, and name the task
+  # that holds it so the operator knows who to ask instead of going hunting.
+  # The lease is deliberately NOT returned here: releasing it would hand the
+  # same copy to the next spawn, which would refuse again, and the pool would
+  # deadlock on it forever. Holding it quarantines that one slot instead - the
+  # next spawn is given a different copy and proceeds - and the label below is
+  # what releases it once the records are reconciled.
+  spawn_wt_claim=$(real_path_or_raw "$WT")
+  for spawn_other_meta in "$STATE"/*.meta; do
+    [ -f "$spawn_other_meta" ] && [ ! -L "$spawn_other_meta" ] || continue
+    spawn_other_id=$(basename "$spawn_other_meta" .meta)
+    [ "$spawn_other_id" != "$ID" ] || continue
+    spawn_other_wt=$(fm_meta_get "$spawn_other_meta" worktree)
+    [ -n "$spawn_other_wt" ] || continue
+    [ "$(real_path_or_raw "$spawn_other_wt")" = "$spawn_wt_claim" ] || continue
+    SPAWN_TREEHOUSE_LEASE_PENDING=0
+    echo "error: the pool offered '$WT', which task $spawn_other_id's own record still names as its working copy; refusing to launch task $ID into it and reset another worker's work" >&2
+    echo "That copy is now held under '$SPAWN_TREEHOUSE_LEASE_HOLDER' so it is not offered again; reconcile whichever record is wrong (bin/fm-crew-state.sh $spawn_other_id), then release it with: treehouse return --force --if-lease-holder '$SPAWN_TREEHOUSE_LEASE_HOLDER' '$WT'" >&2
+    echo "Re-running this spawn is safe: it is given a different copy." >&2
+    exit 1
+  done
+
   # Move the pane into the leased copy and prove it arrived, the same way the
   # relaunch path above does: the lease already fixes WHICH copy this task owns,
   # so nothing here has to discover it from the pane, and a pane that reports a
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index e0b9c339be0..2802f9bcb94 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -128,6 +128,9 @@
 # through metadata publication, closing the publication
 # gap; forced secondmate teardown takes it and runs the same checks for every
 # descendant Treehouse slot before touching any child.
+# A task worktree is also claimed with a durable Treehouse lease at spawn
+# (bin/fm-spawn.sh owns the claim), and the return below releases that lease with
+# the slot, so an ordinary teardown is what frees the claim.
 # These refusals are not relaxed by --force: --force authorizes discarding THIS
 # task's unlanded work, never another task's live work. Nothing of this task's
 # own is removed by a refusal; reconcile whichever record is wrong and re-run.
diff --git a/tests/fm-spawn-worktree-lease.test.sh b/tests/fm-spawn-worktree-lease.test.sh
index 1fc1db908fe..2e3fdb556e7 100644
--- a/tests/fm-spawn-worktree-lease.test.sh
+++ b/tests/fm-spawn-worktree-lease.test.sh
@@ -87,6 +87,31 @@ test_aborted_spawn_returns_its_claim() {
   pass "an aborted spawn returns its claim, matched on the holder that took it"
 }
 
+# A copy the pool still offers although a live task record names it - the shape
+# a task spawned before leases existed leaves behind - must be refused, and the
+# refusal must name the holder. The claim is kept so the same copy is not
+# offered to the next spawn, which would refuse again and deadlock the pool.
+test_copy_another_task_record_claims_is_refused_by_name() {
+  local id out status log
+  id=lease-conflict-w3
+  make_lease_case lease-conflict "$id"
+  fm_write_meta "$LEASE_HOME/state/other-task-w3.meta" \
+    "worktree=$LEASE_WT" "project=$LEASE_PROJ" "kind=ship" "backend=tmux"
+
+  out=$(run_lease_spawn "$id" "$LEASE_WT")
+  status=$?
+  [ "$status" -ne 0 ] || fail "spawn launched into a copy another task record claims"$'\n'"$out"
+  assert_contains "$out" "task other-task-w3's own record still names as its working copy" \
+    "the refusal did not name the task holding the copy"
+  assert_contains "$out" "--if-lease-holder 'fm:$id@$LEASE_HOME/state'" \
+    "the refusal did not say how to release the copy it is holding"
+  [ ! -e "$LEASE_HOME/state/$id.meta" ] || fail "refused spawn published task metadata"
+  log=$(cat "$LEASE_LOG")
+  assert_not_contains "$log" "return" \
+    "the refusal returned the claim, so the next spawn would be offered the same copy again"
+  pass "a copy another task record claims is refused by name, and stays claimed"
+}
+
 # The guarantee the whole fix rests on, checked against the real pool rather
 # than assumed: a leased slot is not handed to a later `treehouse get`, with no
 # process running inside it.
@@ -115,6 +140,7 @@ test_real_pool_does_not_hand_out_a_leased_slot() {
 
 test_spawn_claims_the_slot_with_a_labelled_lease
 test_aborted_spawn_returns_its_claim
+test_copy_another_task_record_claims_is_refused_by_name
 test_real_pool_does_not_hand_out_a_leased_slot
 
 echo "# all fm-spawn-worktree-lease tests passed"

From ae48127375fb8a3bd0be5ad0f3b954044eb22781 Mon Sep 17 00:00:00 2001
From: Tejas Shah <talktejas@gmail.com>
Date: Thu, 17 Sep 2026 19:06:28 +0700
Subject: [PATCH 3/5] test: stand in for the pool with a lease-answering
 treehouse fake

The spawn now runs treehouse itself instead of typing `treehouse get`
into the pane, so every fixture that drives a crew or scout spawn has to
answer the acquire. tests/lib.sh owns that stub; each suite's own no-op
treehouse is replaced by it.
---
 tests/fm-secondmate-harness.test.sh | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/tests/fm-secondmate-harness.test.sh b/tests/fm-secondmate-harness.test.sh
index f4d9546e0b4..a3f8c3c4648 100755
--- a/tests/fm-secondmate-harness.test.sh
+++ b/tests/fm-secondmate-harness.test.sh
@@ -682,6 +682,7 @@ SH
   # registration below needs, so link the real one in rather than presenting a
   # node-less spawn host no real fleet member looks like.
   ln -sf "$(command -v node)" "$fakebin/node"
+  fm_test_fake_treehouse_lease "$fakebin"
   printf '%s\n' "$fakebin"
 }
 
@@ -1112,14 +1113,7 @@ SH
 exit 0
 SH
   chmod +x "$fakebin/gh"
-  cat > "$fakebin/treehouse" <<'SH'
-#!/usr/bin/env bash
-if [ "${1:-}" = get ] && [ "${2:-}" = --help ]; then
-  printf '%s\n' 'Usage: treehouse get [--lease]'
-fi
-exit 0
-SH
-  chmod +x "$fakebin/treehouse"
+  fm_test_fake_treehouse_lease "$fakebin"
   cat > "$fakebin/no-mistakes" <<'SH'
 #!/usr/bin/env bash
 if [ "${1:-}" = --version ]; then

From 0b9152fdc5638cdad9c5bc5b01248a4e31ff4cd2 Mon Sep 17 00:00:00 2001
From: Tejas Shah <talktejas@gmail.com>
Date: Thu, 17 Sep 2026 19:38:32 +0700
Subject: [PATCH 4/5] fix(spawn): record the pool claim with the task that
 holds it

worktree_lease= in the task record says which claim releases that copy,
and it is what tells the claim-conflict refusal apart from its target: a
record carrying its own claim cannot have had its copy offered by the
pool, so only an unclaimed record - the shape a task spawned before
leases existed leaves - blocks a spawn. A relaunch carries the original
claim forward.
---
 bin/fm-spawn.sh                       | 17 +++++++++++++----
 tests/fm-backend.test.sh              | 22 ++++++++++++++++++----
 tests/fm-spawn-worktree-lease.test.sh | 20 ++++++++++++++++++++
 3 files changed, 51 insertions(+), 8 deletions(-)

diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 9c3b3c51517..f2391bb6357 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -3668,10 +3668,13 @@ elif [ "$KIND" != secondmate ] && [ "$BACKEND" != orca ]; then
   validate_spawn_worktree "treehouse get --lease" "$T"
 
   # Second line of defence, for a copy the pool offered that a live task record
-  # in this home still names: a task spawned before leases existed holds its
-  # slot with nothing but its processes, and that is exactly the copy the pool
-  # cannot see a claim on. Refuse rather than launch into it, and name the task
-  # that holds it so the operator knows who to ask instead of going hunting.
+  # in this home still names WITHOUT a claim of its own: a task spawned before
+  # leases existed holds its slot with nothing but its processes, and that is
+  # exactly the copy the pool cannot see a claim on. Refuse rather than launch
+  # into it, and name the task that holds it so the operator knows who to ask
+  # instead of going hunting. A record that does carry its own worktree_lease=
+  # is not that case - the pool would not have offered its copy - so it is left
+  # to the ordinary slot-ownership reconciliation rather than blocking a spawn.
   # The lease is deliberately NOT returned here: releasing it would hand the
   # same copy to the next spawn, which would refuse again, and the pool would
   # deadlock on it forever. Holding it quarantines that one slot instead - the
@@ -3684,6 +3687,7 @@ elif [ "$KIND" != secondmate ] && [ "$BACKEND" != orca ]; then
     [ "$spawn_other_id" != "$ID" ] || continue
     spawn_other_wt=$(fm_meta_get "$spawn_other_meta" worktree)
     [ -n "$spawn_other_wt" ] || continue
+    [ -z "$(fm_meta_get "$spawn_other_meta" worktree_lease)" ] || continue
     [ "$(real_path_or_raw "$spawn_other_wt")" = "$spawn_wt_claim" ] || continue
     SPAWN_TREEHOUSE_LEASE_PENDING=0
     echo "error: the pool offered '$WT', which task $spawn_other_id's own record still names as its working copy; refusing to launch task $ID into it and reset another worker's work" >&2
@@ -4259,6 +4263,11 @@ preserve_relaunch_meta() {
   echo "window=$META_WINDOW"
   echo "endpoint_task_id=$ID"
   echo "worktree=$WT"
+  # The pool claim this task holds on that copy, so the record itself says how
+  # to release it: treehouse return --force --if-lease-holder <this> <worktree>.
+  # Deliberately absent from the relaunch-owned key list above, so a relaunch
+  # carries the original claim forward rather than dropping it.
+  [ -z "$SPAWN_TREEHOUSE_LEASE_HOLDER" ] || echo "worktree_lease=$SPAWN_TREEHOUSE_LEASE_HOLDER"
   echo "project=$PROJ_ABS"
   echo "harness=$HARNESS"
   echo "kind=$KIND"
diff --git a/tests/fm-backend.test.sh b/tests/fm-backend.test.sh
index 36902a26d86..6d349600b2c 100755
--- a/tests/fm-backend.test.sh
+++ b/tests/fm-backend.test.sh
@@ -807,8 +807,15 @@ esac
 exit 0
 SH
   chmod +x "$fb/tmux"
-  fm_fake_exit0 "$fb" treehouse
-  fm_test_fake_treehouse_lease "$fb"
+  # Stand in for the pool: the spawn leases its worktree, so the stub hands back
+  # the same fake worktree this fixture's tmux stub reports.
+  cat > "$fb/treehouse" <<SH
+#!/usr/bin/env bash
+set -u
+case " \$* " in *" --lease "*) printf '%s\\n' "$wt"; exit 0 ;; esac
+exit 0
+SH
+  chmod +x "$fb/treehouse"
   printf '%s\n' "$fb"
 }
 
@@ -878,8 +885,15 @@ esac
 exit 0
 SH
   chmod +x "$fb/tmux"
-  fm_fake_exit0 "$fb" treehouse
-  fm_test_fake_treehouse_lease "$fb"
+  # Stand in for the pool: the spawn leases its worktree, so the stub hands back
+  # the same fake worktree this fixture's tmux stub reports.
+  cat > "$fb/treehouse" <<SH
+#!/usr/bin/env bash
+set -u
+case " \$* " in *" --lease "*) printf '%s\\n' "$wt"; exit 0 ;; esac
+exit 0
+SH
+  chmod +x "$fb/treehouse"
   printf '%s\n' "$fb"
 }
 
diff --git a/tests/fm-spawn-worktree-lease.test.sh b/tests/fm-spawn-worktree-lease.test.sh
index 2e3fdb556e7..647a278bc92 100644
--- a/tests/fm-spawn-worktree-lease.test.sh
+++ b/tests/fm-spawn-worktree-lease.test.sh
@@ -112,6 +112,25 @@ test_copy_another_task_record_claims_is_refused_by_name() {
   pass "a copy another task record claims is refused by name, and stays claimed"
 }
 
+# The record's own claim is also what says it does not need this defence: a task
+# holding a lease cannot have had its copy offered, so its record must not block
+# a spawn the pool did allocate.
+test_a_record_holding_its_own_claim_does_not_block_a_spawn() {
+  local id out status
+  id=lease-claimed-neighbour-w4
+  make_lease_case lease-claimed-neighbour "$id"
+  fm_write_meta "$LEASE_HOME/state/other-task-w4.meta" \
+    "worktree=$LEASE_WT" "worktree_lease=fm:other-task-w4@$LEASE_HOME/state" \
+    "project=$LEASE_PROJ" "kind=ship" "backend=tmux"
+
+  out=$(run_lease_spawn "$id" "$LEASE_WT")
+  status=$?
+  expect_code 0 "$status" "spawn was blocked by a record that holds its own claim"$'\n'"$out"
+  assert_grep "worktree_lease=fm:$id@$LEASE_HOME/state" "$LEASE_HOME/state/$id.meta" \
+    "meta did not record the claim this task holds on its copy"
+  pass "a record holding its own claim does not block a spawn the pool allocated"
+}
+
 # The guarantee the whole fix rests on, checked against the real pool rather
 # than assumed: a leased slot is not handed to a later `treehouse get`, with no
 # process running inside it.
@@ -141,6 +160,7 @@ test_real_pool_does_not_hand_out_a_leased_slot() {
 test_spawn_claims_the_slot_with_a_labelled_lease
 test_aborted_spawn_returns_its_claim
 test_copy_another_task_record_claims_is_refused_by_name
+test_a_record_holding_its_own_claim_does_not_block_a_spawn
 test_real_pool_does_not_hand_out_a_leased_slot
 
 echo "# all fm-spawn-worktree-lease tests passed"

From 72c61659fb0badd025f62f069f068e4887697585 Mon Sep 17 00:00:00 2001
From: Tejas Shah <talktejas@gmail.com>
Date: Thu, 17 Sep 2026 20:40:11 +0700
Subject: [PATCH 5/5] fix(spawn): enter the leased copy in a subshell, as the
 pool's own get did

A plain top-level cd would leave the task pane's own shell inside the
worktree, where teardown's leaked-process reaper ends it as a stray
process instead of letting the backend close its pane. On Herdr that
skipped the projection's confirmed close and left its presentation
journal quarantined. Entering in a subshell keeps the process shape the
pool's interactive get produced: the pane's shell stays in the project,
only the foreground shell sits in the copy.

The presentation fixture arms its post-create abort through a refused
claim (still after the pane exists) and reads the abort interleaving from
the ordered CLI call log, which records both close mechanisms.
---
 bin/fm-spawn.sh                               |  9 +++-
 .../fm-backend-herdr-presentation-e2e.test.sh | 49 ++++++++++++++-----
 tests/fm-tangle-guard.test.sh                 |  2 +-
 3 files changed, 45 insertions(+), 15 deletions(-)

diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index f2391bb6357..494ff2a9533 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -3705,8 +3705,15 @@ elif [ "$KIND" != secondmate ] && [ "$BACKEND" != orca ]; then
   # the active client's window, which would misread firstmate's OWN pane path as
   # the worktree and tangle a hook into the primary checkout. The window id never
   # lies.
+  # Enter the copy in a SUBSHELL, the same process shape `treehouse get` left
+  # behind: the pane's own top-level shell stays in the project, and only the
+  # foreground shell sits in the worktree. A plain top-level `cd` would put the
+  # pane's shell itself inside the worktree, where bin/fm-teardown.sh's
+  # leaked-process reaper would end it as a stray worktree process instead of
+  # letting the backend close its pane - which on Herdr skips the projection's
+  # own confirmed close and leaves its presentation journal quarantined.
   spawn_cd_path=${WT//\'/\'\\\'\'}
-  spawn_send_text_line "$WT_TARGET" "cd -- '$spawn_cd_path'" || {
+  spawn_send_text_line "$WT_TARGET" "(cd -- '$spawn_cd_path' && exec \"\${SHELL:-/bin/sh}\")" || {
     echo "error: could not tell window $T to enter its leased worktree '$WT'; nothing was launched" >&2
     exit 1
   }
diff --git a/tests/fm-backend-herdr-presentation-e2e.test.sh b/tests/fm-backend-herdr-presentation-e2e.test.sh
index 2ebb6995bcb..3faad50e0d1 100755
--- a/tests/fm-backend-herdr-presentation-e2e.test.sh
+++ b/tests/fm-backend-herdr-presentation-e2e.test.sh
@@ -208,8 +208,12 @@ set -u
   done
   printf '\n'
 } >> "$TREEHOUSE_CALL_LOG"
+# Arm the post-create abort: the worktree claim is taken after the task pane
+# exists, so refusing it aborts the spawn exactly where this fixture needs it,
+# without involving the real pool or the arrival wait.
 if [ -d "$POST_CREATE_ABORT_CONTROL" ] && [ "${1:-}" = get ]; then
-  exit 0
+  echo "treehouse: no worktree available (post-create abort fixture)" >&2
+  exit 1
 fi
 # Treehouse's pool allocator is outside the Herdr concurrency contract under
 # test. Serialize its calls so simultaneous recovery spawns cannot race for
@@ -412,10 +416,18 @@ spawn_task() {  # <id> <home> <project>
     "$ROOT/bin/fm-spawn.sh" "$id" "$project" "sh -c 'while :; do sleep 60; done'" --mode no-mistakes --yolo off --backend herdr
 }
 
+# A concurrent spawn can lose either serialization race before it does any
+# projected work: the home's task-set lock, or the project's pool-slot lock that
+# the worktree claim is taken under. Both mean "not my turn yet", so both retry.
+concurrent_spawn_lost_a_lock() {  # <stderr>
+  grep -F "task set is locked" "$1" >/dev/null 2>&1 \
+    || grep -F "Treehouse slot allocation or return is in progress" "$1" >/dev/null 2>&1
+}
+
 finish_concurrent_spawn() {  # <id> <status> <stdout> <stderr>
   local id=$1 status=$2 out=$3 err=$4
   [ "$status" -ne 0 ] || return 0
-  grep -F "task set is locked" "$err" >/dev/null 2>&1 \
+  concurrent_spawn_lost_a_lock "$err" \
     || fail "concurrent projected spawn $id failed unexpectedly: $(cat "$err")"
   spawn_task "$id" "$HOME_DIR" "$PROJECT_DIR" > "$out" 2> "$err" \
     || fail "projected spawn $id retry failed after task-set publication completed: $(cat "$err")"
@@ -424,7 +436,7 @@ finish_concurrent_spawn() {  # <id> <status> <stdout> <stderr>
 finish_concurrent_expected_abort() {  # <id> <status> <stdout> <stderr>
   local id=$1 status=$2 out=$3 err=$4
   [ "$status" -ne 0 ] || fail "post-create abort fixture $id unexpectedly succeeded"
-  if grep -F "task set is locked" "$err" >/dev/null 2>&1; then
+  if concurrent_spawn_lost_a_lock "$err"; then
     if spawn_task "$id" "$HOME_DIR" "$PROJECT_DIR" > "$out" 2> "$err"; then
       fail "post-create abort fixture $id unexpectedly succeeded after task-set publication completed"
     fi
@@ -851,20 +863,31 @@ if wait "$ABORT_A_PID"; then ABORT_A_STATUS=0; else ABORT_A_STATUS=$?; fi
 if wait "$ABORT_B_PID"; then ABORT_B_STATUS=0; else ABORT_B_STATUS=$?; fi
 finish_concurrent_expected_abort abort-a "$ABORT_A_STATUS" "$TMP_ROOT/abort-a.out" "$TMP_ROOT/abort-a.err"
 finish_concurrent_expected_abort abort-b "$ABORT_B_STATUS" "$TMP_ROOT/abort-b.out" "$TMP_ROOT/abort-b.err"
-# The forced foreground_cwd is a plain non-git directory, which the discovery
-# poll now screens out on every read rather than adopting, so the armed failure
-# arrives as the poll's own deadline refusal naming that path.
-grep -F "did not yield an isolated worktree" "$TMP_ROOT/abort-a.err" >/dev/null 2>&1 \
+# The armed failure is the refused worktree claim, which the spawn takes after
+# the task pane exists - so both spawns abort post-create, as this fixture needs.
+grep -F "could not lease a worktree" "$TMP_ROOT/abort-a.err" >/dev/null 2>&1 \
   || fail "post-create abort fixture A did not reach the armed validation failure"
-grep -F "did not yield an isolated worktree" "$TMP_ROOT/abort-b.err" >/dev/null 2>&1 \
+grep -F "could not lease a worktree" "$TMP_ROOT/abort-b.err" >/dev/null 2>&1 \
   || fail "post-create abort fixture B did not reach the armed validation failure"
 ABORT_A_PANE=$(cat "$POST_CREATE_ABORT_CONTROL/abort-a/task-pane")
 ABORT_B_PANE=$(cat "$POST_CREATE_ABORT_CONTROL/abort-b/task-pane")
-ABORT_SEQUENCE=$(sed -n "$((ABORT_FOCUS_START + 1)),\$p" "$FOCUS_AUDIT_LOG" | awk -F '\t' -v a="$ABORT_A_PANE" -v b="$ABORT_B_PANE" '
-  $1 == "workspace-create" && $4 ~ /^└ abort-a · p:/ { print "create-a" }
-  $1 == "workspace-create" && $4 ~ /^└ abort-b · p:/ { print "create-b" }
-  $1 == "pane-close" && $4 == a { print "close-a" }
-  $1 == "pane-close" && $4 == b { print "close-b" }
+# Read the interleaving from the ordered CLI call log rather than the focus
+# audit: an aborted spawn's projected pane is a bare idle shell, so the
+# focus-preserving close ends that shell instead of calling `pane close`, and
+# only the call log records both mechanisms in one order. Either one is that
+# task's cleanup; what must hold is that one task's create-then-cleanup does not
+# interleave with the other's.
+ABORT_SEQUENCE=$(sed -n "$((ABORT_START + 1)),\$p" "$HERDR_CALL_LOG" | awk -F '\t' -v a="$ABORT_A_PANE" -v b="$ABORT_B_PANE" '
+  $1 == "workspace" && $2 == "create" { for (i = 3; i <= NF; i++) {
+    if ($i ~ /^└ abort-a · p:/) { print "create-a" }
+    if ($i ~ /^└ abort-b · p:/) { print "create-b" }
+  } }
+  $1 == "pane" && ($2 == "close" || $2 == "process-info") {
+    for (i = 3; i <= NF; i++) {
+      if ($i == a && !seen_a) { print "close-a"; seen_a = 1 }
+      if ($i == b && !seen_b) { print "close-b"; seen_b = 1 }
+    }
+  }
 ')
 case "$ABORT_SEQUENCE" in
   $'create-a\nclose-a\ncreate-b\nclose-b'|$'create-b\nclose-b\ncreate-a\nclose-a') ;;
diff --git a/tests/fm-tangle-guard.test.sh b/tests/fm-tangle-guard.test.sh
index 4348bac596a..19a6cddfdb8 100755
--- a/tests/fm-tangle-guard.test.sh
+++ b/tests/fm-tangle-guard.test.sh
@@ -280,7 +280,7 @@ test_spawn_tmux_window_construction() {
 
   # Bug 2 fix (b): the move into the leased worktree and the arrival wait loop
   # both target the stable id.
-  assert_grep "send-keys -t @spawnwid cd -- " "$rec" \
+  assert_grep "send-keys -t @spawnwid (cd -- " "$rec" \
     "the move into the leased worktree must be sent to the stable window id"
   assert_grep "display-message -p -t @spawnwid #{pane_current_path}" "$rec" \
     "the worktree wait loop must query the stable window id, not the name"