From 7d9d131cd96ccedf8ba2a45b63cc16c23975498c Mon Sep 17 00:00:00 2001
From: Shane Bracewell <sbracewell64@gmail.com>
Date: Sun, 26 Jul 2026 10:37:34 -0400
Subject: [PATCH 1/6] feat(identity): make a crewmate pane unmistakable for
 firstmate

On 2026-07-26 the captain opened a crewmate pane believing it was
firstmate and issued cross-lane instructions there. Nothing was lost only
because that crewmate volunteered its identity and asked first, and
firstmate's own records still went stale for a day, because a crewmate
cannot write another lane's state.

Four mechanical contributors, all fixed here.

The primary home's herdr crew workspace was labeled "firstmate" - the one
workspace firstmate is guaranteed NOT to be in, since firstmate is
launched by the captain and never by fm-spawn.sh. It is now
"firstmate-crew". The secondmate form stays "2ndmate-<id>" on purpose: a
secondmate IS spawned into its own home workspace alongside its children,
so that label already names what the workspace contains, and a "-crew"
suffix there would introduce the very mislabel this removes.

The rename is safe for a home that already has tasks under the old label.
No task metadata ever recorded the label - fm-spawn.sh records
herdr_workspace_id/herdr_tab_id and a window=<session>:<pane-id> target -
so the only label-keyed consumer is fm_backend_herdr_workspace_find, which
also feeds fm_backend_herdr_list_live recovery. That function still adopts
a legacy-labeled workspace while it holds at least one fm-<id> tab, and
the spawn path renames that exact workspace in place, so its id, tabs, and
panes never move. A legacy-labeled workspace with no task tab is neither
adopted nor renamed, which additionally protects a personal workspace that
merely shares the old name.

Firstmate's own tab carried no label at all. bin/fm-label-self.sh, run
once from the session-start digest, labels it "firstmate" under tmux and
herdr. It refuses in a secondmate home, whose fm-<secondmate-id> endpoint
label is the parent's identity handle, and refuses any fm- label, since
that prefix is the task-endpoint namespace. fm-<task-id> labels are
untouched, so endpoint identity verification is unchanged.

The label sticks in both runtimes. Herdr tracks a pane's terminal_title
separately from its tab label (verified read-only against a live Claude
pane: terminal_title rewritten by the harness, tab label still the
spawn-time fm-<id>). Real tmux 3.6a keeps a renamed window name across an
application OSC 2 title change, under default and hostile options alike.

Finally, every crewmate scaffold now carries the pane-identity pair: state
plainly that you are a worker on this task and not firstmate before acting
on anything a human asks outside the brief, then confirm; and record an
override actually carried out with a nonterminal "working:" line, so
firstmate's records self-heal. That verb is deliberate - a blocked: or
needs-decision: line would open a keyed decision that only an explicit
resolution closes.
---
 bin/backends/herdr.sh                         | 238 +++++++++++--
 bin/backends/tmux.sh                          |  30 ++
 bin/fm-backend.sh                             |  19 +
 bin/fm-brief.sh                               |  28 ++
 bin/fm-label-self.sh                          |  90 +++++
 bin/fm-session-start.sh                       |  14 +
 bin/fm-spawn.sh                               |   2 +-
 docs/herdr-backend.md                         |  17 +-
 docs/tmux-backend.md                          |   3 +
 .../fm-backend-herdr-prune-safety-e2e.test.sh |  16 +-
 tests/fm-backend-herdr-smoke.test.sh          |   6 +-
 ...ckend-herdr-workspace-per-home-e2e.test.sh |   8 +-
 tests/fm-backend-herdr.test.sh                | 328 ++++++++++++++++--
 tests/fm-backend-tmux-smoke.test.sh           |  37 ++
 tests/fm-backend.test.sh                      |  18 +
 tests/fm-brief.test.sh                        |  54 +++
 tests/fm-session-start.test.sh                |  91 +++++
 tests/lib.sh                                  |  10 +
 18 files changed, 940 insertions(+), 69 deletions(-)
 create mode 100755 bin/fm-label-self.sh

diff --git a/bin/backends/herdr.sh b/bin/backends/herdr.sh
index 3a28daaa33..9f10a63dda 100644
--- a/bin/backends/herdr.sh
+++ b/bin/backends/herdr.sh
@@ -56,8 +56,8 @@
 # never overrides a real invocation. It exists only so this file's own unit
 # tests, which source it directly without that preamble, resolve to a sane
 # default (the firstmate repo root - never a secondmate home, so
-# fm_backend_herdr_workspace_label falls through to "firstmate" exactly like
-# pre-P3 behavior when a test does not care about home-specific labeling).
+# fm_backend_herdr_workspace_label falls through to the primary crew-workspace
+# label when a test does not care about home-specific labeling).
 FM_BACKEND_HERDR_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-${FM_ROOT:-$FM_BACKEND_HERDR_ROOT}}"
 FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
@@ -110,13 +110,42 @@ FM_BACKEND_HERDR_SECONDMATE_MARKER=".fm-secondmate-home"
 # No send, capture, Treehouse, or general task-ownership path reads it.
 FM_BACKEND_HERDR_PRESENTATION_JOURNAL_SUFFIX=".herdr-presentation"
 
+# The PRIMARY home's crew-workspace label. It names a CONTAINER OF WORKERS,
+# never the supervisor: firstmate itself is launched by the captain, never by
+# fm-spawn.sh, so this workspace only ever holds crewmate, scout, and
+# secondmate tabs - firstmate's own pane is guaranteed NOT to be in it. The
+# pre-existing constant was the bare word "firstmate", which read as
+# "firstmate is here" on exactly the one workspace firstmate is never in; on
+# 2026-07-26 the captain opened a crewmate pane there believing it was
+# firstmate and issued cross-lane instructions to a worker. The `-crew` suffix
+# also removes the plain-directory-name label collision that
+# fm_backend_herdr_workspace_prune_seeded_default_tab documents below, since a
+# workspace whose label is derived from a cwd basename can trivially read
+# "firstmate" but essentially never reads "firstmate-crew".
+FM_BACKEND_HERDR_PRIMARY_LABEL='firstmate-crew'
+# The primary's PRE-MIGRATION crew-workspace label. A home that already has
+# tasks recorded under it keeps working unchanged: the label is never stored
+# in task metadata (fm-spawn.sh records herdr_workspace_id/herdr_tab_id ids and
+# a `window=<session>:<pane-id>` target, never a label), so the only
+# label-keyed consumer is fm_backend_herdr_workspace_find - which still adopts
+# a legacy-labeled workspace that actually holds task tabs, keeping both spawn
+# and fm_backend_herdr_list_live recovery intact, and
+# fm_backend_herdr_workspace_migrate_legacy_label renames it in place on the
+# next spawn so the id, its tabs, and their panes never move.
+FM_BACKEND_HERDR_PRIMARY_LEGACY_LABEL='firstmate'
+
 # fm_backend_herdr_workspace_label: the per-firstmate-HOME herdr workspace
 # label (docs/herdr-backend.md "Default task container shape"). The PRIMARY home (no
-# secondmate marker) resolves to the constant "firstmate", byte-identical to
-# every pre-existing task's recorded label - no forced migration. A SECONDMATE
+# secondmate marker) resolves to FM_BACKEND_HERDR_PRIMARY_LABEL. A SECONDMATE
 # home resolves to "2ndmate-<secondmate-id>", so its tasks land in their own
 # workspace, obviously distinguishable from the primary's (and from every
-# other secondmate's) in herdr's spaces sidebar. Read fresh from FM_HOME on
+# other secondmate's) in herdr's spaces sidebar. The secondmate form
+# deliberately carries no `-crew` suffix: unlike the primary, a secondmate IS
+# spawned by fm-spawn.sh into its own home's workspace (fm-spawn.sh's herdr
+# case arm shadows FM_HOME for exactly that call), so that workspace really
+# does contain the supervisor it names, and suffixing it would introduce the
+# very mislabel this rename removes. The shared rule is that a workspace label
+# names what the workspace actually contains. Read fresh from FM_HOME on
 # every call rather than cached at source time: FM_HOME is the home's own
 # durable identity, not env plumbing threaded through a call chain, so the
 # label is automatically stable across every respawn/recovery for the life of
@@ -124,15 +153,36 @@ FM_BACKEND_HERDR_PRESENTATION_JOURNAL_SUFFIX=".herdr-presentation"
 # when the PRIMARY spawns that secondmate (its own process's FM_HOME still
 # names the primary at that point) - see fm-spawn.sh's herdr case arm.
 fm_backend_herdr_workspace_label() {
+  local id
+  id=$(fm_backend_herdr_secondmate_id) || id=""
+  if [ -n "$id" ]; then
+    printf '2ndmate-%s' "$id"
+    return 0
+  fi
+  printf '%s' "$FM_BACKEND_HERDR_PRIMARY_LABEL"
+}
+
+# fm_backend_herdr_secondmate_id: this home's validated secondmate id, or empty
+# for the primary home (and for an empty/unreadable marker, which falls back to
+# primary behavior exactly as before).
+fm_backend_herdr_secondmate_id() {
   local marker="$FM_HOME/$FM_BACKEND_HERDR_SECONDMATE_MARKER" id
-  if [ -f "$marker" ]; then
-    id=$(tr -d '[:space:]' < "$marker" 2>/dev/null)
-    if [ -n "$id" ]; then
-      printf '2ndmate-%s' "$id"
-      return 0
-    fi
+  [ -f "$marker" ] || return 0
+  id=$(tr -d '[:space:]' < "$marker" 2>/dev/null)
+  printf '%s' "$id"
+}
+
+# fm_backend_herdr_workspace_legacy_label: the pre-migration label this home
+# must still ADOPT, or empty when there is nothing to migrate. Only the primary
+# home has one; a secondmate home's "2ndmate-<id>" label is unchanged, so it
+# prints nothing and every legacy path below becomes a no-op for it.
+fm_backend_herdr_workspace_legacy_label() {
+  local id
+  id=$(fm_backend_herdr_secondmate_id) || id=""
+  if [ -n "$id" ]; then
+    return 0
   fi
-  printf 'firstmate'
+  printf '%s' "$FM_BACKEND_HERDR_PRIMARY_LEGACY_LABEL"
 }
 
 # fm_backend_herdr_cli: run `herdr <args...>` scoped to <session>, setting
@@ -195,6 +245,41 @@ fm_backend_herdr_session() {
   printf '%s' "${HERDR_SESSION:-default}"
 }
 
+# fm_backend_herdr_label_self: label the tab the CALLER ITSELF is running in,
+# so firstmate's own pane has a standing front door in herdr's sidebar instead
+# of the bare positional label ("1") a captain-launched tab carries. Called
+# only through bin/fm-label-self.sh, which owns the refusals that make this
+# safe (never in a secondmate home, never an fm-<id> label).
+#
+# The tab is resolved from herdr's own injected HERDR_TAB_ID, falling back to
+# a `pane get` on HERDR_PANE_ID for a herdr build that injects only the pane.
+# Neither is a lookup by label, so this never touches another tab.
+#
+# Verified (herdr 0.7.5, real default session, read-only `pane get` on a live
+# Claude crewmate pane): herdr tracks a pane's `terminal_title` - the OSC title
+# the harness rewrites continuously - as a field SEPARATE from its tab `label`.
+# The pane reported terminal_title "⠂ Add crew pane identity guardrails" while
+# its tab label was still the spawn-time "fm-crew-pane-identity-guardrails", so
+# an explicitly set tab label is not overwritten by the harness. That is the
+# same property firstmate's whole label-based recovery
+# (fm_backend_herdr_list_live) already depends on.
+fm_backend_herdr_label_self() {  # <label>
+  local label=$1 session tab
+  [ -n "$label" ] || { echo "error: fm_backend_herdr_label_self needs a label" >&2; return 1; }
+  fm_backend_herdr_tool_check || return 1
+  session=$(fm_backend_herdr_session)
+  tab=${HERDR_TAB_ID:-}
+  if [ -z "$tab" ]; then
+    [ -n "${HERDR_PANE_ID:-}" ] || { echo "error: not running inside a herdr pane (neither HERDR_TAB_ID nor HERDR_PANE_ID is set)" >&2; return 1; }
+    tab=$(fm_backend_herdr_cli "$session" pane get "$HERDR_PANE_ID" 2>/dev/null \
+      | jq -r '.result.pane.tab_id // empty' 2>/dev/null)
+  fi
+  [ -n "$tab" ] || { echo "error: could not resolve this herdr pane's own tab id" >&2; return 1; }
+  fm_backend_herdr_cli "$session" tab rename "$tab" "$label" >/dev/null 2>&1 \
+    || { echo "error: herdr tab rename failed for $tab" >&2; return 1; }
+  return 0
+}
+
 # fm_backend_herdr_projection_id: generate a compact 128-bit base64url token.
 # The token is a non-adversarial visual correlator, never destructive
 # authority.
@@ -644,6 +729,15 @@ fm_backend_herdr_projection_close_pane_focus_preserving() {  # <session> <pane-i
 # current workspace-create response.
 # After a successful move, every pre-existing workspace id sequence excluding
 # the new id must be byte-identical to the pre-move sequence.
+#
+# `is_legacy_child` deliberately keeps the HISTORIC owner prefixes ("firstmate/",
+# "2ndmate-<id>/") because that projection-child label format predates both the
+# current "└ " format and the primary's crew-workspace rename, so no legacy child
+# can ever carry the current primary label. The consequence of not aliasing them
+# is that a leftover legacy child of a RENAMED primary is no longer recognized as
+# that primary's child: ordering is then skipped (this function is best-effort)
+# and a restart binding falls back to the flat layout, both of which are the
+# existing safe outcomes for any unrecognized shape.
 fm_backend_herdr_projection_order_best_effort() {  # <session> <created-workspace-id> <parent-label>
   local session=$1 created=$2 parent=$3 list analysis current desired protocol schema socket mover response move_status focus_before
   local before_existing after_existing
@@ -655,12 +749,13 @@ fm_backend_herdr_projection_order_best_effort() {  # <session> <created-workspac
     echo "warning: herdr presentation ordering could not list workspaces; leaving worker in Herdr's current order" >&2
     return 0
   }
-  analysis=$(printf '%s' "$list" | jq -c --arg created "$created" --arg parent "$parent" '
+  analysis=$(printf '%s' "$list" | jq -c --arg created "$created" --arg parent "$parent" \
+    --arg primary "$FM_BACKEND_HERDR_PRIMARY_LABEL" --arg primary_legacy "$FM_BACKEND_HERDR_PRIMARY_LEGACY_LABEL" '
     def is_parent:
       (.label | type) == "string" and .label == $parent;
     def is_top_level_parent:
       (.label | type) == "string"
-      and ((.label == "firstmate") or (.label | test("^2ndmate-[^/]+$")));
+      and ((.label == $primary) or (.label == $primary_legacy) or (.label | test("^2ndmate-[^/]+$")));
     def is_new_child:
       (.label | type) == "string"
       and (.label | test("^└ .+ · p:[A-Za-z0-9_-]{22}$"));
@@ -821,26 +916,110 @@ fm_backend_herdr_server_ensure() {  # <session>
   return 1
 }
 
-# fm_backend_herdr_workspace_find: this HOME's own workspace id inside
-# <session> (fm_backend_herdr_workspace_label), or empty (never creates).
-# Read-only, safe for recovery/list paths. Label-collision semantics
-# (docs/herdr-backend.md "Label collisions"): herdr enforces no label
-# uniqueness at all, so this adopts the FIRST matching workspace `jq` returns
-# (list order, normally creation order/oldest) rather than disambiguating -
-# identical in spirit to the pre-existing tab duplicate-label check below.
-fm_backend_herdr_workspace_find() {  # <session>
-  local session=$1 label list
-  label=$(fm_backend_herdr_workspace_label)
-  list=$(fm_backend_herdr_cli "$session" workspace list 2>/dev/null) || return 0
+# fm_backend_herdr_workspace_id_in_list: the first workspace id in an already
+# fetched `workspace list` body whose label is EXACTLY <label>, or empty.
+# Read-only, never creates.
+# Label-collision semantics (docs/herdr-backend.md "Label collisions"): herdr
+# enforces no label uniqueness at all, so this adopts the FIRST matching
+# workspace `jq` returns (list order, normally creation order/oldest) rather
+# than disambiguating - identical in spirit to the pre-existing tab
+# duplicate-label check below.
+# Takes an already-fetched `workspace list` body so a caller that needs to look
+# up two labels (canonical and legacy) pays for ONE list call, not two.
+fm_backend_herdr_workspace_id_in_list() {  # <workspace-list-json> <label>
+  local list=$1 label=$2
+  [ -n "$label" ] || return 0
   # NOTE: the jq variable is $want, NOT $label - `label` is a jq reserved
   # keyword (label/break), so declaring a jq variable named "label" is a
   # compile error that `2>/dev/null` would silently swallow, making this find
-  # ALWAYS return empty and every spawn mint a fresh "firstmate" workspace
-  # (the workspace leak).
+  # ALWAYS return empty and every spawn mint a fresh crew workspace (the
+  # workspace leak).
   printf '%s' "$list" | jq -r --arg want "$label" \
     '.result.workspaces[]? | select(.label == $want) | .workspace_id' 2>/dev/null | head -1
 }
 
+# fm_backend_herdr_workspace_task_tab_count: how many tabs in <workspace-id>
+# carry a firstmate task label (fm-<id>). Prints an integer, 0 on any read
+# failure, so callers can treat "cannot tell" as "no evidence". Only firstmate
+# ever creates an fm-<id> tab, which is what makes a non-zero count positive
+# proof that a workspace is this home's own crew container rather than a
+# human-owned workspace whose label merely collides.
+fm_backend_herdr_workspace_task_tab_count() {  # <session> <workspace-id>
+  local session=$1 wsid=$2 tabs n
+  tabs=$(fm_backend_herdr_cli "$session" tab list --workspace "$wsid" 2>/dev/null) || { printf '0'; return 0; }
+  n=$(printf '%s' "$tabs" | jq -r \
+    '[.result.tabs[]? | select((.label | type) == "string" and (.label | startswith("fm-")))] | length' 2>/dev/null)
+  case "$n" in ''|*[!0-9]*) n=0 ;; esac
+  printf '%s' "$n"
+}
+
+# fm_backend_herdr_workspace_find: this HOME's own workspace id inside
+# <session> (fm_backend_herdr_workspace_label), or empty (never creates).
+# Read-only, safe for recovery/list paths.
+#
+# Legacy fallback (the primary's pre-migration "firstmate" label): when no
+# canonically labeled workspace exists, a legacy-labeled one is adopted ONLY
+# when it actually holds at least one fm-<id> task tab. That keeps every task
+# already recorded under the old label reachable - both for spawn adoption and
+# for fm_backend_herdr_list_live recovery, which scopes to this function's
+# result - while a tab-less legacy match is deliberately NOT adopted: it holds
+# no recoverable task by definition, and refusing it removes the residual
+# adopt-a-human's-lookalike-workspace hazard that the seeded-default-tab prune
+# incident below is about.
+fm_backend_herdr_workspace_find() {  # <session>
+  local session=$1 list wsid legacy
+  list=$(fm_backend_herdr_cli "$session" workspace list 2>/dev/null) || return 0
+  wsid=$(fm_backend_herdr_workspace_id_in_list "$list" "$(fm_backend_herdr_workspace_label)")
+  if [ -n "$wsid" ]; then
+    printf '%s' "$wsid"
+    return 0
+  fi
+  legacy=$(fm_backend_herdr_workspace_legacy_label)
+  [ -n "$legacy" ] || return 0
+  wsid=$(fm_backend_herdr_workspace_id_in_list "$list" "$legacy")
+  [ -n "$wsid" ] || return 0
+  [ "$(fm_backend_herdr_workspace_task_tab_count "$session" "$wsid")" -gt 0 ] || return 0
+  printf '%s' "$wsid"
+}
+
+# fm_backend_herdr_workspace_migrate_legacy_label: rename this home's
+# legacy-labeled crew workspace to the canonical label, IN PLACE. Best-effort
+# and idempotent - it prints nothing and always returns 0, because
+# fm_backend_herdr_workspace_find already adopts the legacy label, so a failed
+# or skipped rename costs a stale label and nothing else. Called from
+# fm_backend_herdr_container_ensure, i.e. on the spawn path only, so read-only
+# recovery/list paths keep their no-mutation contract.
+#
+# A rename moves no workspace, tab, or pane id, so every recorded task target
+# (`window=<session>:<pane-id>`) and every recorded herdr_workspace_id survives
+# it untouched.
+#
+# Three preconditions, all required:
+#   - this home HAS a legacy label (primary only);
+#   - NO canonically labeled workspace exists yet, so a home that already
+#     migrated - or that legitimately has both - never has two containers
+#     silently merged into one label;
+#   - the legacy-labeled workspace holds at least one fm-<id> task tab, which
+#     is the same positive proof of ownership fm_backend_herdr_workspace_find
+#     requires before adopting it. A human's coincidentally-labeled workspace
+#     is therefore never renamed.
+fm_backend_herdr_workspace_migrate_legacy_label() {  # <session>
+  local session=$1 canonical legacy list wsid
+  legacy=$(fm_backend_herdr_workspace_legacy_label)
+  [ -n "$legacy" ] || return 0
+  canonical=$(fm_backend_herdr_workspace_label)
+  if [ "$canonical" = "$legacy" ]; then
+    return 0
+  fi
+  list=$(fm_backend_herdr_cli "$session" workspace list 2>/dev/null) || return 0
+  [ -z "$(fm_backend_herdr_workspace_id_in_list "$list" "$canonical")" ] || return 0
+  wsid=$(fm_backend_herdr_workspace_id_in_list "$list" "$legacy")
+  [ -n "$wsid" ] || return 0
+  [ "$(fm_backend_herdr_workspace_task_tab_count "$session" "$wsid")" -gt 0 ] || return 0
+  fm_backend_herdr_cli "$session" workspace rename "$wsid" "$canonical" >/dev/null 2>&1 || true
+  return 0
+}
+
 # fm_backend_herdr_workspace_prune_seeded_default_tab: close EXACTLY
 # <seeded_tab_id>, the auto-created default tab id that THIS SAME
 # fm_backend_herdr_workspace_ensure call captured straight from its own
@@ -979,6 +1158,11 @@ fm_backend_herdr_container_ensure() {  # <cwd-for-a-fresh-workspace>
   fm_backend_herdr_version_check || return 1
   session=$(fm_backend_herdr_session)
   fm_backend_herdr_server_ensure "$session" || return 1
+  # Converge a pre-migration crew-workspace label before the ensure below, so a
+  # home carrying tasks under the old label keeps ONE container instead of
+  # gaining a second one. Best-effort and never fatal: workspace_find adopts
+  # the legacy label either way.
+  fm_backend_herdr_workspace_migrate_legacy_label "$session"
   fm_backend_herdr_workspace_ensure "$session" "$cwd" >/dev/null || { label=$(fm_backend_herdr_workspace_label); echo "error: failed to ensure herdr workspace '$label' in session '$session'" >&2; return 1; }
   if [ -z "$FM_BACKEND_HERDR_WS_ID" ]; then
     label=$(fm_backend_herdr_workspace_label)
diff --git a/bin/backends/tmux.sh b/bin/backends/tmux.sh
index b618e055bc..d71a693d65 100644
--- a/bin/backends/tmux.sh
+++ b/bin/backends/tmux.sh
@@ -94,6 +94,36 @@ fm_backend_tmux_create_task() {  # <session> <window-name> <proj-abs> -> prints
   printf '%s\n' "$wid"
 }
 
+# fm_backend_tmux_label_self: rename the window the CALLER ITSELF runs in, so
+# firstmate's own pane has a standing front door instead of tmux's positional
+# default name. Called only through bin/fm-label-self.sh, which owns the
+# refusals that make this safe (never in a secondmate home, never an fm-<id>
+# label). The window is resolved from tmux's own $TMUX_PANE, falling back to
+# the client's current window, so this never targets a task window by name.
+#
+# The name is pinned exactly like fm_backend_tmux_create_task pins a task
+# window: verified with real tmux 3.6a on a private socket that `rename-window`
+# alone already turns automatic-rename off for that window and the name then
+# survives an application OSC 2 title change, both under default options and
+# under a hostile `allow-rename on` + global `automatic-rename on` config; the
+# two explicit set-window-option calls are the same defense in depth the task
+# path uses.
+fm_backend_tmux_label_self() {  # <label>
+  local label=$1 wid
+  [ -n "$label" ] || { echo "error: fm_backend_tmux_label_self needs a label" >&2; return 1; }
+  [ -n "${TMUX:-}" ] || { echo "error: not running inside tmux (\$TMUX is unset)" >&2; return 1; }
+  if [ -n "${TMUX_PANE:-}" ]; then
+    wid=$(tmux display-message -p -t "$TMUX_PANE" '#{window_id}' 2>/dev/null)
+  else
+    wid=$(tmux display-message -p '#{window_id}' 2>/dev/null)
+  fi
+  [ -n "$wid" ] || { echo "error: could not resolve this tmux pane's own window id" >&2; return 1; }
+  tmux rename-window -t "$wid" "$label" 2>/dev/null || { echo "error: tmux rename-window failed for $wid" >&2; return 1; }
+  tmux set-window-option -t "$wid" automatic-rename off 2>/dev/null || true
+  tmux set-window-option -t "$wid" allow-rename off 2>/dev/null || true
+  return 0
+}
+
 # fm_backend_tmux_current_path: the live pane's current working directory, or
 # empty on any tmux error. Mirrors fm-spawn.sh's worktree-discovery poll:
 # `tmux display-message -p -t "$T" '#{pane_current_path}'`.
diff --git a/bin/fm-backend.sh b/bin/fm-backend.sh
index 2112a53279..d6235e7e7d 100644
--- a/bin/fm-backend.sh
+++ b/bin/fm-backend.sh
@@ -584,6 +584,25 @@ fm_backend_kill() {  # <backend> <target>
   esac
 }
 
+# fm_backend_label_self: label the terminal endpoint FIRSTMATE ITSELF occupies,
+# so the supervisor is identifiable at a glance next to the fm-<task-id> worker
+# endpoints it spawns. This is the only backend operation whose target is the
+# caller's own pane rather than a recorded task target, so each arm resolves it
+# from the backend's own ambient markers and never from a label lookup.
+# bin/fm-label-self.sh is the sole caller and owns the safety refusals.
+# Only the two runtime-auto-detected backends implement it; the rest report the
+# limitation rather than pretending to have labeled anything.
+fm_backend_label_self() {  # <backend> <label>
+  local backend=$1
+  shift
+  fm_backend_source "$backend" || return 1
+  case "$backend" in
+    tmux) fm_backend_tmux_label_self "$@" ;;
+    herdr) fm_backend_herdr_label_self "$@" ;;
+    *) echo "error: backend '$backend' has no verified way to label firstmate's own endpoint" >&2; return 1 ;;
+  esac
+}
+
 fm_backend_remove_worktree() {  # <backend> <worktree-id>
   local backend=$1
   shift
diff --git a/bin/fm-brief.sh b/bin/fm-brief.sh
index 00ea34ddab..b49c5bad63 100755
--- a/bin/fm-brief.sh
+++ b/bin/fm-brief.sh
@@ -39,6 +39,14 @@
 # declared-external-wait verb (FM_CLASSIFY_PAUSED_VERB, default "paused") from
 # "blocked:": pause for a known external wait expected to clear on its own,
 # blocked when firstmate must act.
+# Every crewmate scaffold (ship and scout) also carries the pane-identity pair:
+# state plainly that you are a worker on this task and not firstmate before
+# acting on anything a human asks outside the brief, and record any override
+# actually carried out with a nonterminal "working:" line, so firstmate's own
+# records self-heal instead of silently going stale. That verb is deliberate -
+# bin/fm-classify-lib.sh's keyed fold makes "blocked:"/"needs-decision:" OPEN a
+# decision that only an explicit resolution closes, which is the wrong shape for
+# a completed action.
 # Ship tasks include a project-memory section so durable project-intrinsic
 # learnings can be committed to AGENTS.md through the project's delivery path;
 # it carries the AGENTS.md authoring bar (widely useful knowledge only, pointers
@@ -262,6 +270,16 @@ The report is the only thing that survives, so anything worth keeping must be in
 7. Never stop, restart, or update the shared \`no-mistakes\` daemon - it is one instance serving
    every lane/home, so restarting it kills other lanes' in-flight pipeline runs. On ANY no-mistakes
    daemon error, append \`blocked: {the daemon error}\` and stop; only firstmate manages the daemon.
+8. You are not firstmate, and a human typing into your pane may believe you are. If a human asks you
+   for anything outside this task, say so plainly BEFORE you act: you are a worker on task \`$ID\`,
+   not firstmate, and merges, cross-lane work, other lanes' state, and fleet supervision belong to
+   firstmate. Then ask whether they still want you to proceed, and wait for their answer.
+9. If you do act outside this brief on the captain's explicit instruction, leave a durable record:
+   append \`working: acted outside this brief on captain instruction - {what you did, and where}\`.
+   You cannot write another lane's records, so that line is the only way firstmate learns of it and
+   keeps its own records accurate. \`working:\` is the deliberate choice here - \`blocked:\` and
+   \`needs-decision:\` would open a decision that stays open until it is explicitly closed, and a
+   completed action is neither.
 
 # Definition of done
 Write your findings to \`$DATA/$ID/report.md\`.
@@ -374,6 +392,16 @@ $RULE1
 7. Never stop, restart, or update the shared \`no-mistakes\` daemon - it is one instance serving
    every lane/home, so restarting it kills other lanes' in-flight pipeline runs. On ANY no-mistakes
    daemon error, append \`blocked: {the daemon error}\` and stop; only firstmate manages the daemon.
+8. You are not firstmate, and a human typing into your pane may believe you are. If a human asks you
+   for anything outside this task, say so plainly BEFORE you act: you are a worker on task \`$ID\`,
+   not firstmate, and merges, cross-lane work, other lanes' state, and fleet supervision belong to
+   firstmate. Then ask whether they still want you to proceed, and wait for their answer.
+9. If you do act outside this brief on the captain's explicit instruction, leave a durable record:
+   append \`working: acted outside this brief on captain instruction - {what you did, and where}\`.
+   You cannot write another lane's records, so that line is the only way firstmate learns of it and
+   keeps its own records accurate. \`working:\` is the deliberate choice here - \`blocked:\` and
+   \`needs-decision:\` would open a decision that stays open until it is explicitly closed, and a
+   completed action is neither.
 
 # Project memory
 If \`AGENTS.md\` or \`CLAUDE.md\` already exists, or if this task produced durable project-intrinsic knowledge, run \`$FM_ROOT/bin/fm-ensure-agents-md.sh .\` in the worktree.
diff --git a/bin/fm-label-self.sh b/bin/fm-label-self.sh
new file mode 100755
index 0000000000..8da96e792b
--- /dev/null
+++ b/bin/fm-label-self.sh
@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# fm-label-self.sh - give firstmate's OWN terminal endpoint a standing label.
+#
+# Why: every worker endpoint firstmate spawns is labeled fm-<task-id>, but
+# firstmate's own pane is launched by the captain and so carries whatever the
+# runtime defaults to (a bare "1" under herdr, a positional name under tmux).
+# The supervisor was therefore the one endpoint with no visible front door,
+# which is how a captain came to issue cross-lane instructions into a crewmate
+# pane on 2026-07-26. This labels the caller's own endpoint so the supervisor
+# is identifiable at a glance.
+#
+# Usage: fm-label-self.sh [--label <label>]
+#   --label <label>  override the resolved label (default: FM_SELF_LABEL, else
+#                    "firstmate"). An EXPLICITLY EMPTY label - FM_SELF_LABEL= or
+#                    --label "" - is the documented no-op, used by the test
+#                    suite so a run from inside a real terminal never relabels
+#                    the developer's own window or tab.
+#   -h, --help       print this header.
+#
+# Contract: ALWAYS exits 0 - this is a cosmetic convenience run from
+# bin/fm-session-start.sh, never a gate. It prints NOTHING when the endpoint
+# was labeled, and exactly one plain-English `note:` line explaining why not
+# otherwise. That keeps a routine session start silent and keeps a failure from
+# looking like an actionable bootstrap diagnostic.
+#
+# Refusals, all of which protect endpoint IDENTITY rather than cosmetics:
+#   - A SECONDMATE home is refused outright. A secondmate's own endpoint was
+#     created by the parent's fm-spawn.sh and is labeled fm-<secondmate-id>;
+#     that label is the parent's identity handle for it
+#     (fm_backend_expected_label_of_selector, and herdr's label-matched
+#     recovery in fm_backend_herdr_list_live), so renaming it would break the
+#     parent's send/peek/recovery path.
+#   - Any label starting with `fm-` is refused, because that prefix is the
+#     reserved task-endpoint namespace: herdr's recovery scan treats every
+#     fm-* tab in a home's workspace as a live task.
+#   - A runtime with no verified self-label operation is reported, not faked.
+#
+# The runtime is resolved with fm_backend_detect (the runtime this process is
+# CURRENTLY executing inside), never fm_backend_name: config/backend names the
+# backend NEW TASKS spawn into, which can legitimately differ from the terminal
+# the captain launched firstmate in.
+set -u
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
+FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+
+usage() {
+  awk '
+    NR == 1 { next }
+    /^#/ { sub(/^# ?/, ""); print; next }
+    { exit }
+  ' "$0"
+}
+
+# The secondmate-home marker written by bin/fm-home-seed.sh. Read directly
+# rather than through the herdr adapter, because this refusal must hold for
+# every runtime, including ones with no herdr adapter loaded.
+SECONDMATE_MARKER=".fm-secondmate-home"
+
+LABEL=${FM_SELF_LABEL-firstmate}
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    -h|--help) usage; exit 0 ;;
+    --label) LABEL=${2:-}; shift 2 || exit 0 ;;
+    *) printf 'note: fm-label-self.sh ignored unknown argument %s\n' "$1"; exit 0 ;;
+  esac
+done
+
+note() { printf 'note: %s\n' "$1"; exit 0; }
+
+[ -n "$LABEL" ] || note "self-labeling is switched off (empty label), so this firstmate's own terminal tab is unchanged."
+case "$LABEL" in
+  fm-*) note "refused to label this firstmate's own terminal tab '$LABEL': the fm- prefix is reserved for worker endpoints." ;;
+esac
+
+if [ -f "$FM_HOME/$SECONDMATE_MARKER" ]; then
+  note "this is a secondmate home, so its own endpoint keeps the fm- label the main firstmate reaches it by."
+fi
+
+# shellcheck source=bin/fm-backend.sh
+. "$SCRIPT_DIR/fm-backend.sh"
+
+RUNTIME=$(fm_backend_detect 2>/dev/null) || RUNTIME=""
+[ -n "$RUNTIME" ] || note "this firstmate is not running inside a terminal runtime that can label its own tab."
+
+OUT=$(fm_backend_label_self "$RUNTIME" "$LABEL" 2>&1) || \
+  note "could not label this firstmate's own terminal tab in $RUNTIME; it keeps its previous name. ${OUT:-no detail reported}"
+
+exit 0
diff --git a/bin/fm-session-start.sh b/bin/fm-session-start.sh
index c7dbb13555..a32596e53d 100755
--- a/bin/fm-session-start.sh
+++ b/bin/fm-session-start.sh
@@ -27,6 +27,13 @@
 #
 #   1. lock          - acquire the per-home session lock FIRST, before any
 #                       mutating step runs.
+#   1b. self label    - bin/fm-label-self.sh gives firstmate's OWN terminal
+#                       endpoint a standing label, so the supervisor is
+#                       identifiable next to the fm-<task-id> worker endpoints.
+#                       It touches only the pane this process runs in, never
+#                       shared fleet state, so it runs in read-only mode too;
+#                       it always exits 0 and prints only when it could not
+#                       label the endpoint.
 #   2. bootstrap      - home-local stale Herdr projection cleanup runs only
 #                       when this session actually holds the lock. Detect-only
 #                       diagnostics always run. Bootstrap's five MUTATING sweeps
@@ -265,6 +272,13 @@ if [ "$LOCK_RC" -ne 0 ]; then
   }
 fi
 
+# --- 1b. self label ------------------------------------------------------
+# Labels only the pane this process runs in, so it is safe in read-only mode
+# and needs no lock. Silent on success by contract; its one failure line is
+# plain prose, not a bootstrap diagnostic token.
+SELF_LABEL_OUT=$("$SCRIPT_DIR/fm-label-self.sh" 2>&1 || true)
+[ -n "$SELF_LABEL_OUT" ] && printf '%s\n' "$SELF_LABEL_OUT"
+
 # --- 2. bootstrap --------------------------------------------------------
 subsection "BOOTSTRAP"
 if [ "$READ_ONLY" -eq 1 ]; then
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 00a2262ef4..e15eae6380 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -951,7 +951,7 @@ case "$BACKEND" in
     # secondmate's home), so FM_HOME here still names the primary. Shadow it
     # to PROJ_ABS for just these two calls (bash restores it automatically
     # after each prefixed simple-command call) so the secondmate's tab lands
-    # in the secondmate's own workspace, not the primary's "firstmate" one.
+    # in the secondmate's own workspace, not the primary's crew workspace.
     HERDR_LABEL_HOME=$FM_HOME
     if [ "$KIND" = secondmate ]; then
       HERDR_LABEL_HOME=$PROJ_ABS
diff --git a/docs/herdr-backend.md b/docs/herdr-backend.md
index 91047bcc6f..a9bf11e4a4 100644
--- a/docs/herdr-backend.md
+++ b/docs/herdr-backend.md
@@ -34,10 +34,16 @@ Real harness credential tests remain opt-in rather than part of default CI.
 ## Watching and task containers
 
 Each Firstmate home gets one durable workspace with one task tab per endpoint.
-The primary workspace is `firstmate`.
-A secondmate home uses `2ndmate-<secondmate-id>`, derived from its validated `.fm-secondmate-home` marker.
+The primary workspace is `firstmate-crew`.
+It contains only spawned workers: the primary Firstmate is launched by the captain, never by `bin/fm-spawn.sh`, so its own pane is never inside it.
+A secondmate home uses `2ndmate-<secondmate-id>`, derived from its validated `.fm-secondmate-home` marker, and carries no `-crew` suffix because a secondmate IS spawned into its own home workspace alongside its children.
+The rule is that a workspace label names what that workspace actually contains.
 The secondmate process and every child it launches resolve the same home label; a secondmate launched by the primary receives a narrowly scoped home override during container creation.
 
+Firstmate labels its own tab `firstmate` at session start through `bin/fm-label-self.sh`, so the supervisor is identifiable beside the `fm-<task-id>` worker tabs.
+An explicitly set tab label is independent of the pane's `terminal_title`, which the harness rewrites continuously, so the label persists.
+A secondmate home is refused: its own tab is labeled `fm-<secondmate-id>` and the main Firstmate reaches it by that label.
+
 Attach to the selected named Herdr session and switch to the relevant home workspace to watch its task tabs.
 Routine supervision uses `bin/fm-peek.sh <id>` and `FM_HOME=<home> bin/fm-send.sh <id> '<text>'` without attaching.
 
@@ -46,9 +52,14 @@ The first workspace in a completely empty Herdr session must become focused beca
 
 Herdr does not enforce workspace or tab label uniqueness.
 Firstmate adopts the first workspace matching its derived home label and refuses duplicate task tabs inside it.
-Avoid naming a personal workspace `firstmate` or `2ndmate-<id>` because the adapter cannot distinguish that label collision from its own container.
+Avoid naming a personal workspace `firstmate-crew` or `2ndmate-<id>` because the adapter cannot distinguish that label collision from its own container.
 An older secondmate workspace using `firstmate-<id>` is not migrated automatically; rename it manually before expecting new tasks or recovery to use it.
 
+A home whose primary workspace still carries the earlier `firstmate` label keeps working without any manual step.
+No task metadata ever recorded the label, so a workspace still labeled `firstmate` is adopted for both spawning and recovery while it holds at least one `fm-<id>` tab, and the next spawn renames that same workspace in place, preserving its id, tabs, and panes.
+A workspace labeled `firstmate` that holds no task tab is neither adopted nor renamed, so a personal workspace that merely shares the old name is left alone.
+With optional presentation spaces enabled, a task projected under the earlier label falls back to the ordinary flat layout once, which is the same safe fallback any unmatched projection binding takes.
+
 Existing task operations use recorded endpoint ids and do not move a live task when labels change.
 The per-home workspace is reused while it has task tabs.
 Closing its last tab can remove the workspace, and the next spawn recreates it.
diff --git a/docs/tmux-backend.md b/docs/tmux-backend.md
index ae24507c58..07fbb4c41a 100644
--- a/docs/tmux-backend.md
+++ b/docs/tmux-backend.md
@@ -31,6 +31,9 @@ tmux attach -t firstmate
 ```
 
 Each task window is named `fm-<id>`.
+Firstmate names its own window `firstmate` at session start through `bin/fm-label-self.sh`, so the supervisor is identifiable beside those worker windows.
+The name is pinned with `automatic-rename` and `allow-rename` off, exactly like a task window, so an agent's terminal-title rewrite cannot replace it.
+A secondmate home is refused: its own window is named `fm-<secondmate-id>` and the main Firstmate reaches it by that name.
 
 ```sh
 tmux list-windows -t <session-name>
diff --git a/tests/fm-backend-herdr-prune-safety-e2e.test.sh b/tests/fm-backend-herdr-prune-safety-e2e.test.sh
index eca742fc4b..46b032c62a 100755
--- a/tests/fm-backend-herdr-prune-safety-e2e.test.sh
+++ b/tests/fm-backend-herdr-prune-safety-e2e.test.sh
@@ -6,8 +6,9 @@
 #
 # Reproduces the exact collision shape against a private, throwaway
 # HERDR_SESSION (never the captain's default): a startup-workspace-shaped
-# layout - one tab labeled "1" in a pre-existing workspace labeled
-# "firstmate" - with a live long-running process in that pane, exactly as
+# layout - one tab labeled "1" in a pre-existing workspace whose label
+# collides with the primary home's own crew-workspace label - with a live
+# long-running process in that pane, exactly as
 # the captain's own live crewmate session looked at incident time. Then
 # drives the real spawn-time container_ensure +
 # create_task path and asserts the live pane (and its live process) survive
@@ -50,17 +51,18 @@ fm_backend_source herdr || fail "fm_backend_source herdr failed"
 fm_backend_herdr_version_check || fail "version_check failed against the real installed herdr"
 
 # --- 1. reproduce the label-collision startup-workspace shape ---------------
-# Explicitly label the startup workspace "firstmate" to create the collision
+# Explicitly label the startup workspace with the primary home's own crew label
+# to create the collision
 # deterministically. Herdr's unlabeled workspace-label derivation is not a
 # stable test contract, while the adopted-workspace state is the behavior
 # this regression must exercise. The seeded tab remains labeled "1".
 
-LIVE_CWD="$SCRATCH/firstmate"
+LIVE_CWD="$SCRATCH/firstmate-crew"
 mkdir -p "$LIVE_CWD"
 
 fm_backend_herdr_server_ensure "$SESSION" || fail "could not start the isolated session's server"
 
-CREATE_OUT=$(fm_backend_herdr_cli "$SESSION" workspace create --cwd "$LIVE_CWD" --label firstmate --no-focus) \
+CREATE_OUT=$(fm_backend_herdr_cli "$SESSION" workspace create --cwd "$LIVE_CWD" --label firstmate-crew --no-focus) \
   || fail "could not create the label-collision startup workspace"
 LIVE_WSID=$(printf '%s' "$CREATE_OUT" | jq -r '.result.workspace.workspace_id // empty')
 LIVE_TAB_ID=$(printf '%s' "$CREATE_OUT" | jq -r '.result.tab.tab_id // empty')
@@ -70,8 +72,8 @@ if [ -z "$LIVE_WSID" ] || [ -z "$LIVE_TAB_ID" ] || [ -z "$LIVE_PANE_ID" ]; then
 fi
 
 LIVE_LABEL=$(herdr workspace list --session "$SESSION" 2>&1 | jq -r --arg id "$LIVE_WSID" '.result.workspaces[]? | select(.workspace_id == $id) | .label')
-[ "$LIVE_LABEL" = firstmate ] || fail "the startup workspace label should be 'firstmate', got '$LIVE_LABEL' - repro setup is wrong"
-pass "repro setup: a pre-existing workspace labeled 'firstmate' collides with the primary home's own label"
+[ "$LIVE_LABEL" = firstmate-crew ] || fail "the startup workspace label should be 'firstmate-crew', got '$LIVE_LABEL' - repro setup is wrong"
+pass "repro setup: a pre-existing workspace labeled 'firstmate-crew' collides with the primary home's own label"
 
 # Simulate a live long-running agent in that pane: a heartbeat loop that
 # appends to a marker file, so liveness is independently verifiable (not just
diff --git a/tests/fm-backend-herdr-smoke.test.sh b/tests/fm-backend-herdr-smoke.test.sh
index 9eef7a9024..55a3016f0a 100755
--- a/tests/fm-backend-herdr-smoke.test.sh
+++ b/tests/fm-backend-herdr-smoke.test.sh
@@ -60,7 +60,7 @@ case "$CONTAINER" in
   *) fail "container_ensure returned an unexpected shape: $CONTAINER" ;;
 esac
 [ -n "$SEEDED_TAB_ID" ] || fail "the first container_ensure in a brand-new isolated session must CREATE the workspace and report its seeded default tab id"
-pass "real herdr: container_ensure starts the isolated session's server, creates the firstmate workspace ($CONTAINER), and reports its seeded default tab id ($SEEDED_TAB_ID)"
+pass "real herdr: container_ensure starts the isolated session's server, creates the crew workspace ($CONTAINER), and reports its seeded default tab id ($SEEDED_TAB_ID)"
 
 # A second container_ensure must reuse (ADOPT) the same workspace (idempotent)
 # and report an EMPTY seeded tab id - the created-vs-adopted gate that fixes
@@ -72,7 +72,7 @@ CONTAINER2=${CONTAINER2_RAW%%$'\t'*}
 SEEDED_TAB_ID2=${CONTAINER2_RAW#*$'\t'}
 [ "$CONTAINER2" = "$CONTAINER" ] || fail "container_ensure is not idempotent: '$CONTAINER' vs '$CONTAINER2'"
 [ -z "$SEEDED_TAB_ID2" ] || fail "an ADOPTED (reused) workspace must report an EMPTY seeded default tab id, got '$SEEDED_TAB_ID2'"
-pass "real herdr: container_ensure is idempotent (reuses/adopts the existing firstmate workspace, reports no seeded default tab on adoption)"
+pass "real herdr: container_ensure is idempotent (reuses/adopts the existing crew workspace, reports no seeded default tab on adoption)"
 
 # --- create_task + duplicate refusal + default-tab prune ---------------------
 
@@ -230,7 +230,7 @@ sleep 0.5
 fm_backend_herdr_server_ensure "$SESSION" || fail "the isolated session's server did not come back up after the stop"
 
 POST_LIST=$(herdr workspace list --session "$SESSION" 2>&1)
-POST_PRIMARY_ID=$(printf '%s' "$POST_LIST" | jq -r '.result.workspaces[]? | select(.label == "firstmate") | .workspace_id')
+POST_PRIMARY_ID=$(printf '%s' "$POST_LIST" | jq -r '.result.workspaces[]? | select(.label == "firstmate-crew") | .workspace_id')
 POST_SM_ID=$(printf '%s' "$POST_LIST" | jq -r --arg l "2ndmate-smoketest-sm1" '.result.workspaces[]? | select(.label == $l) | .workspace_id')
 [ "$POST_PRIMARY_ID" = "${CONTAINER#*:}" ] || fail "the primary workspace id did not survive the restart: before=${CONTAINER#*:} after=$POST_PRIMARY_ID"
 [ "$POST_SM_ID" = "$SM_WSID" ] || fail "the secondmate workspace id did not survive the restart: before=$SM_WSID after=$POST_SM_ID"
diff --git a/tests/fm-backend-herdr-workspace-per-home-e2e.test.sh b/tests/fm-backend-herdr-workspace-per-home-e2e.test.sh
index ac09c01607..02c45ccfa1 100755
--- a/tests/fm-backend-herdr-workspace-per-home-e2e.test.sh
+++ b/tests/fm-backend-herdr-workspace-per-home-e2e.test.sh
@@ -19,7 +19,7 @@
 #
 # Covers, at minimum (per the task brief):
 #   - a primary-shaped home (no .fm-secondmate-home marker) spawning a
-#     crewmate into the "firstmate" workspace
+#     crewmate into the "firstmate-crew" workspace
 #   - a secondmate-shaped home (with .fm-secondmate-home) getting its own
 #     labeled workspace when the PRIMARY spawns it (fm-spawn.sh's FM_HOME
 #     shadow for --secondmate)
@@ -102,7 +102,7 @@ make_scratch_project() {  # <dir>
 PROJ1="$TMP_ROOT/scratch-project-1"; make_scratch_project "$PROJ1"
 PROJ2="$TMP_ROOT/scratch-project-2"; make_scratch_project "$PROJ2"
 
-# --- 1. primary-shaped home: a crewmate spawns into the "firstmate" space ---
+# --- 1. primary-shaped home: a crewmate spawns into the "firstmate-crew" space ---
 
 CM1_OUT="$TMP_ROOT/cm1.out"; CM1_ERR="$TMP_ROOT/cm1.err"
 FM_SPAWN_NO_GUARD=1 FM_HOME="$PRIMARY_HOME" FM_ROOT_OVERRIDE="$ROOT" \
@@ -126,8 +126,8 @@ assert_contains_local "$CM1_CAPTURE" "primary-crew-ok" "cm1's raw launch command
 CM1_WSID=$(herdr pane get "$CM1_PANE" --session "$SESSION" 2>/dev/null | jq -r '.result.pane.workspace_id // empty')
 [ -n "$CM1_WSID" ] || fail "could not read cm1's pane workspace_id"
 CM1_WS_LABEL=$(herdr workspace list --session "$SESSION" 2>&1 | jq -r --arg id "$CM1_WSID" '.result.workspaces[]? | select(.workspace_id == $id) | .label')
-[ "$CM1_WS_LABEL" = "firstmate" ] || fail "a primary-shaped home's crewmate should land in the 'firstmate' workspace, got '$CM1_WS_LABEL'"
-pass "real herdr E2E: the primary-shaped home's crewmate landed in the 'firstmate' workspace"
+[ "$CM1_WS_LABEL" = "firstmate-crew" ] || fail "a primary-shaped home's crewmate should land in the 'firstmate-crew' workspace, got '$CM1_WS_LABEL'"
+pass "real herdr E2E: the primary-shaped home's crewmate landed in the 'firstmate-crew' workspace"
 
 # --- 2. the PRIMARY spawns a secondmate: its tab lands in the SECONDMATE's own space ---
 # (fm-spawn.sh's herdr case arm shadows FM_HOME to the secondmate's home for
diff --git a/tests/fm-backend-herdr.test.sh b/tests/fm-backend-herdr.test.sh
index b2e980d964..22432e4723 100755
--- a/tests/fm-backend-herdr.test.sh
+++ b/tests/fm-backend-herdr.test.sh
@@ -223,8 +223,31 @@ test_workspace_label_primary_home_no_marker() {
   local home
   home="$TMP_ROOT/primary-home-no-marker"; mkdir -p "$home"
   out=$( FM_HOME="$home" bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_workspace_label' "$ROOT" )
-  [ "$out" = "firstmate" ] || fail "a primary home (no .fm-secondmate-home marker) should resolve to label 'firstmate', got '$out'"
-  pass "fm_backend_herdr_workspace_label: a primary home (no marker) resolves to 'firstmate'"
+  [ "$out" = "firstmate-crew" ] || fail "a primary home (no .fm-secondmate-home marker) should resolve to label 'firstmate-crew', got '$out'"
+  pass "fm_backend_herdr_workspace_label: a primary home (no marker) resolves to 'firstmate-crew'"
+}
+
+# The primary crew workspace holds ONLY spawned workers, never firstmate itself
+# (firstmate is launched by the captain, not by fm-spawn.sh), so its label must
+# not read as "firstmate is here" - the 2026-07-26 mistaken-pane incident.
+test_workspace_label_primary_is_not_the_bare_supervisor_name() {
+  local home
+  home="$TMP_ROOT/primary-home-not-bare"; mkdir -p "$home"
+  out=$( FM_HOME="$home" bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_workspace_label' "$ROOT" )
+  [ "$out" != "firstmate" ] || fail "the primary crew workspace label must not be the bare supervisor name"
+  pass "fm_backend_herdr_workspace_label: the primary crew workspace is not labeled with the bare supervisor name"
+}
+
+test_workspace_legacy_label_primary_and_secondmate() {
+  local home
+  home="$TMP_ROOT/legacy-label-primary"; mkdir -p "$home"
+  out=$( FM_HOME="$home" bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_workspace_legacy_label' "$ROOT" )
+  [ "$out" = "firstmate" ] || fail "the primary home's legacy label should be 'firstmate', got '$out'"
+  home="$TMP_ROOT/legacy-label-secondmate"; mkdir -p "$home"
+  printf 'legacy-s1\n' > "$home/.fm-secondmate-home"
+  out=$( FM_HOME="$home" bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_workspace_legacy_label' "$ROOT" )
+  [ -z "$out" ] || fail "a secondmate home has no legacy label to migrate, got '$out'"
+  pass "fm_backend_herdr_workspace_legacy_label: only the primary home carries a pre-migration label"
 }
 
 test_workspace_label_secondmate_home_uses_marker_id() {
@@ -250,8 +273,8 @@ test_workspace_label_empty_marker_falls_back_to_primary() {
   home="$TMP_ROOT/secondmate-home-empty"; mkdir -p "$home"
   : > "$home/.fm-secondmate-home"
   out=$( FM_HOME="$home" bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_workspace_label' "$ROOT" )
-  [ "$out" = "firstmate" ] || fail "an empty/unreadable marker should fall back to 'firstmate', got '$out'"
-  pass "fm_backend_herdr_workspace_label: an empty marker file falls back to the primary label 'firstmate'"
+  [ "$out" = "firstmate-crew" ] || fail "an empty/unreadable marker should fall back to 'firstmate-crew', got '$out'"
+  pass "fm_backend_herdr_workspace_label: an empty marker file falls back to the primary label 'firstmate-crew'"
 }
 
 test_workspace_label_different_secondmates_get_different_labels() {
@@ -266,6 +289,213 @@ test_workspace_label_different_secondmates_get_different_labels() {
   pass "fm_backend_herdr_workspace_label: two different secondmate homes get two different, non-colliding labels"
 }
 
+# --- legacy crew-workspace label migration (crew-pane-identity-guardrails) ---
+#
+# The primary's crew workspace was relabeled from "firstmate" to
+# "firstmate-crew". No task metadata ever recorded the LABEL (fm-spawn.sh
+# records herdr_workspace_id/herdr_tab_id and a window=<session>:<pane-id>
+# target), so these tests pin the only two label-keyed behaviors that can strand
+# a pre-existing task: adoption by fm_backend_herdr_workspace_find (which
+# fm_backend_herdr_list_live recovery scopes to) and the in-place rename.
+
+herdr_find_fixture() {  # <dir-name> -> echoes "<fakebin>|<log>|<resp>"
+  local dir="$TMP_ROOT/$1"
+  mkdir -p "$dir/responses"
+  : > "$dir/log"
+  printf '%s|%s|%s' "$(make_herdr_fakebin "$dir")" "$dir/log" "$dir/responses"
+}
+
+test_workspace_find_prefers_canonical_over_legacy() {
+  local fb log resp out home
+  IFS='|' read -r fb log resp <<EOF
+$(herdr_find_fixture find-canonical-wins)
+EOF
+  home="$TMP_ROOT/find-canonical-wins-home"; mkdir -p "$home"
+  printf '{"result":{"workspaces":[{"workspace_id":"wLegacy","label":"firstmate"},{"workspace_id":"wNew","label":"firstmate-crew"}]}}\n' > "$resp/1.out"
+  out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_HOME="$home" \
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_workspace_find fmtest' "$ROOT" )
+  [ "$out" = "wNew" ] || fail "workspace_find must prefer the canonical label, got '$out'"
+  assert_not_contains "$(cat "$log")" $'\x1f''tab'$'\x1f''list' "a canonical match must not need a task-tab probe at all"
+  pass "fm_backend_herdr_workspace_find: the canonical crew-workspace label wins over the legacy one"
+}
+
+test_workspace_find_adopts_legacy_label_holding_task_tabs() {
+  local fb log resp out home
+  IFS='|' read -r fb log resp <<EOF
+$(herdr_find_fixture find-legacy-adopt)
+EOF
+  home="$TMP_ROOT/find-legacy-adopt-home"; mkdir -p "$home"
+  printf '{"result":{"workspaces":[{"workspace_id":"wLegacy","label":"firstmate"}]}}\n' > "$resp/1.out"
+  printf '{"result":{"tabs":[{"tab_id":"wLegacy:t1","label":"1"},{"tab_id":"wLegacy:t2","label":"fm-old-task"}]}}\n' > "$resp/2.out"
+  out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_HOME="$home" \
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_workspace_find fmtest' "$ROOT" )
+  [ "$out" = "wLegacy" ] || fail "a legacy-labeled workspace holding an fm-<id> tab must still be adopted so pre-existing tasks stay reachable, got '$out'"
+  pass "fm_backend_herdr_workspace_find: adopts the pre-migration label while it still holds task tabs (recovery unharmed)"
+}
+
+test_workspace_find_ignores_legacy_label_without_task_tabs() {
+  local fb log resp out home
+  IFS='|' read -r fb log resp <<EOF
+$(herdr_find_fixture find-legacy-empty)
+EOF
+  home="$TMP_ROOT/find-legacy-empty-home"; mkdir -p "$home"
+  printf '{"result":{"workspaces":[{"workspace_id":"wHuman","label":"firstmate"}]}}\n' > "$resp/1.out"
+  printf '{"result":{"tabs":[{"tab_id":"wHuman:t1","label":"1"}]}}\n' > "$resp/2.out"
+  out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_HOME="$home" \
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_workspace_find fmtest' "$ROOT" )
+  [ -z "$out" ] || fail "a legacy-labeled workspace with no fm-<id> tab holds no recoverable task and must not be adopted, got '$out'"
+  pass "fm_backend_herdr_workspace_find: never adopts a task-tab-less lookalike of the pre-migration label"
+}
+
+test_workspace_find_secondmate_never_falls_back_to_the_primary_label() {
+  local fb log resp out home
+  IFS='|' read -r fb log resp <<EOF
+$(herdr_find_fixture find-secondmate-no-legacy)
+EOF
+  home="$TMP_ROOT/find-secondmate-home"; mkdir -p "$home"
+  printf 'sm-legacy-1\n' > "$home/.fm-secondmate-home"
+  printf '{"result":{"workspaces":[{"workspace_id":"wLegacy","label":"firstmate"}]}}\n' > "$resp/1.out"
+  out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_HOME="$home" \
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_workspace_find fmtest' "$ROOT" )
+  [ -z "$out" ] || fail "a secondmate home has no legacy label and must never adopt the primary's workspace, got '$out'"
+  pass "fm_backend_herdr_workspace_find: a secondmate home never falls back to the primary's crew workspace"
+}
+
+test_migrate_legacy_label_renames_in_place() {
+  local fb log resp home
+  IFS='|' read -r fb log resp <<EOF
+$(herdr_find_fixture migrate-rename)
+EOF
+  home="$TMP_ROOT/migrate-rename-home"; mkdir -p "$home"
+  printf '{"result":{"workspaces":[{"workspace_id":"wLegacy","label":"firstmate"}]}}\n' > "$resp/1.out"
+  printf '{"result":{"tabs":[{"tab_id":"wLegacy:t2","label":"fm-old-task"}]}}\n' > "$resp/2.out"
+  PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_HOME="$home" \
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_workspace_migrate_legacy_label fmtest' "$ROOT"
+  expect_code 0 $? "the migration is best-effort and must always succeed"
+  assert_contains "$(cat "$log")" $'\x1f''workspace'$'\x1f''rename'$'\x1f''wLegacy'$'\x1f''firstmate-crew' \
+    "the migration must rename the EXISTING workspace id in place, never create a second container"
+  pass "fm_backend_herdr_workspace_migrate_legacy_label: renames the legacy crew workspace in place, preserving its id, tabs, and panes"
+}
+
+test_migrate_legacy_label_skips_when_canonical_already_exists() {
+  local fb log resp home
+  IFS='|' read -r fb log resp <<EOF
+$(herdr_find_fixture migrate-already)
+EOF
+  home="$TMP_ROOT/migrate-already-home"; mkdir -p "$home"
+  printf '{"result":{"workspaces":[{"workspace_id":"wNew","label":"firstmate-crew"},{"workspace_id":"wLegacy","label":"firstmate"}]}}\n' > "$resp/1.out"
+  PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_HOME="$home" \
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_workspace_migrate_legacy_label fmtest' "$ROOT"
+  assert_not_contains "$(cat "$log")" $'\x1f''workspace'$'\x1f''rename' \
+    "with a canonical workspace already present, two containers must never be merged onto one label"
+  pass "fm_backend_herdr_workspace_migrate_legacy_label: no-op once a canonically labeled crew workspace exists"
+}
+
+test_migrate_legacy_label_leaves_a_task_tab_less_workspace_alone() {
+  local fb log resp home
+  IFS='|' read -r fb log resp <<EOF
+$(herdr_find_fixture migrate-human)
+EOF
+  home="$TMP_ROOT/migrate-human-home"; mkdir -p "$home"
+  printf '{"result":{"workspaces":[{"workspace_id":"wHuman","label":"firstmate"}]}}\n' > "$resp/1.out"
+  printf '{"result":{"tabs":[{"tab_id":"wHuman:t1","label":"1"}]}}\n' > "$resp/2.out"
+  PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_HOME="$home" \
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_workspace_migrate_legacy_label fmtest' "$ROOT"
+  assert_not_contains "$(cat "$log")" $'\x1f''workspace'$'\x1f''rename' \
+    "a workspace with no fm-<id> tab is not provably firstmate's own and must never be renamed"
+  pass "fm_backend_herdr_workspace_migrate_legacy_label: never renames a human's coincidentally labeled workspace"
+}
+
+test_migrate_legacy_label_is_a_noop_for_a_secondmate_home() {
+  local fb log resp home
+  IFS='|' read -r fb log resp <<EOF
+$(herdr_find_fixture migrate-secondmate)
+EOF
+  home="$TMP_ROOT/migrate-secondmate-home"; mkdir -p "$home"
+  printf 'sm-mig-1\n' > "$home/.fm-secondmate-home"
+  PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_HOME="$home" \
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_workspace_migrate_legacy_label fmtest' "$ROOT"
+  [ ! -s "$log" ] || fail "a secondmate home's label is unchanged, so the migration must not even query herdr"$'\n'"$(cat "$log")"
+  pass "fm_backend_herdr_workspace_migrate_legacy_label: costs a secondmate home nothing at all"
+}
+
+test_container_ensure_migrates_then_adopts_the_legacy_workspace() {
+  local fb log resp out home
+  IFS='|' read -r fb log resp <<EOF
+$(herdr_find_fixture container-migrate)
+EOF
+  home="$TMP_ROOT/container-migrate-home"; mkdir -p "$home"
+  printf '{"client":{"version":"0.7.1","protocol":14}}\n' > "$resp/1.out"
+  printf '{"server":{"running":true}}\n' > "$resp/2.out"
+  # 3-4: the migration sees the legacy workspace holding a real task tab...
+  printf '{"result":{"workspaces":[{"workspace_id":"wLegacy","label":"firstmate"}]}}\n' > "$resp/3.out"
+  printf '{"result":{"tabs":[{"tab_id":"wLegacy:t2","label":"fm-old-task"}]}}\n' > "$resp/4.out"
+  # 5: ...renames it (silent), then 6-7: workspace_find re-reads. The canned
+  # fake does not model the rename, so find still sees the legacy label - which
+  # is exactly the safety property under test: the same id is adopted whether or
+  # not the rename landed.
+  printf '{"result":{"workspaces":[{"workspace_id":"wLegacy","label":"firstmate"}]}}\n' > "$resp/6.out"
+  printf '{"result":{"tabs":[{"tab_id":"wLegacy:t2","label":"fm-old-task"}]}}\n' > "$resp/7.out"
+  out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_HERDR_SCRIPT_STATUS=1 FM_HOME="$home" HERDR_SESSION=fmtest \
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_container_ensure /tmp' "$ROOT" )
+  [ "$out" = $'fmtest:wLegacy\t' ] || fail "the spawn path must keep using the SAME pre-existing workspace id, got '$out'"
+  assert_contains "$(cat "$log")" $'\x1f''workspace'$'\x1f''rename'$'\x1f''wLegacy'$'\x1f''firstmate-crew' \
+    "container_ensure did not converge the legacy crew-workspace label"
+  assert_not_contains "$(cat "$log")" $'\x1f''workspace'$'\x1f''create' \
+    "a home with a pre-existing crew workspace must not gain a second one"
+  pass "fm_backend_herdr_container_ensure: a home with tasks under the old label keeps ONE container and the same workspace id"
+}
+
+# --- fm_backend_herdr_label_self: firstmate's own tab -----------------------
+
+test_label_self_renames_its_own_tab_from_the_injected_tab_id() {
+  local fb log resp home
+  IFS='|' read -r fb log resp <<EOF
+$(herdr_find_fixture label-self-tabid)
+EOF
+  home="$TMP_ROOT/label-self-tabid-home"; mkdir -p "$home"
+  PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_HOME="$home" \
+    HERDR_TAB_ID=wN:t3 HERDR_PANE_ID=wN:p3 \
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_label_self firstmate' "$ROOT"
+  expect_code 0 $? "label_self should succeed with herdr's own injected tab id"
+  assert_contains "$(cat "$log")" $'\x1f''tab'$'\x1f''rename'$'\x1f''wN:t3'$'\x1f''firstmate' \
+    "label_self did not rename its own tab"
+  assert_not_contains "$(cat "$log")" $'\x1f''pane'$'\x1f''get' \
+    "with HERDR_TAB_ID injected there is nothing to look up"
+  pass "fm_backend_herdr_label_self: labels the caller's own tab from herdr's injected tab id"
+}
+
+test_label_self_resolves_the_tab_from_the_pane_when_only_the_pane_is_injected() {
+  local fb log resp home
+  IFS='|' read -r fb log resp <<EOF
+$(herdr_find_fixture label-self-paneid)
+EOF
+  home="$TMP_ROOT/label-self-paneid-home"; mkdir -p "$home"
+  printf '{"result":{"pane":{"pane_id":"wN:p3","tab_id":"wN:t3"}}}\n' > "$resp/1.out"
+  PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_HOME="$home" \
+    HERDR_PANE_ID=wN:p3 \
+    bash -c 'unset HERDR_TAB_ID; . "$0/bin/backends/herdr.sh"; fm_backend_herdr_label_self firstmate' "$ROOT"
+  expect_code 0 $? "label_self should fall back to a pane_get lookup"
+  assert_contains "$(cat "$log")" $'\x1f''tab'$'\x1f''rename'$'\x1f''wN:t3'$'\x1f''firstmate' \
+    "label_self did not resolve its own tab through pane get"
+  pass "fm_backend_herdr_label_self: falls back to resolving its own tab from its own pane id"
+}
+
+test_label_self_refuses_outside_a_herdr_pane() {
+  local fb log resp home out status
+  IFS='|' read -r fb log resp <<EOF
+$(herdr_find_fixture label-self-nopane)
+EOF
+  home="$TMP_ROOT/label-self-nopane-home"; mkdir -p "$home"
+  out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_HOME="$home" \
+    bash -c 'unset HERDR_TAB_ID HERDR_PANE_ID; . "$0/bin/backends/herdr.sh"; fm_backend_herdr_label_self firstmate' "$ROOT" 2>&1 )
+  status=$?
+  [ "$status" -ne 0 ] || fail "label_self must refuse when it cannot identify its own endpoint"
+  assert_contains "$out" "not running inside a herdr pane" "label_self did not report why it refused"
+  assert_not_contains "$(cat "$log")" $'\x1f''tab'$'\x1f''rename' "a refusal must rename nothing"
+  pass "fm_backend_herdr_label_self: refuses rather than guessing when its own endpoint is unidentifiable"
+}
+
 # --- fm_backend_herdr_cli: session targeting (2026-07-02 incident fix) -------
 
 test_cli_helper_sets_env_and_appends_trailing_session_flag() {
@@ -294,19 +524,23 @@ test_container_ensure_starts_server_and_workspace() {
   # 3: `herdr server` backgrounded launch - no meaningful output
   # 4: server_ensure poll -> now running
   printf '{"server":{"running":true}}\n' > "$resp/4.out"
-  # 5: workspace list -> empty (no "firstmate" workspace yet)
+  # 5: the legacy-label migration's workspace list -> empty (nothing to migrate)
   printf '{"result":{"workspaces":[]}}\n' > "$resp/5.out"
-  # 6: workspace create -> w1, seeding default tab w1:t9 (real herdr returns
+  # 6: workspace_find's workspace list -> empty (no crew workspace yet)
+  printf '{"result":{"workspaces":[]}}\n' > "$resp/6.out"
+  # 7: workspace create -> w1, seeding default tab w1:t9 (real herdr returns
   # the seeded tab/pane ids in the SAME response - verified empirically).
-  printf '{"result":{"workspace":{"workspace_id":"w1","label":"firstmate"},"tab":{"tab_id":"w1:t9"},"root_pane":{"pane_id":"w1:p9"}}}\n' > "$resp/6.out"
+  printf '{"result":{"workspace":{"workspace_id":"w1","label":"firstmate-crew"},"tab":{"tab_id":"w1:t9"},"root_pane":{"pane_id":"w1:p9"}}}\n' > "$resp/7.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_HERDR_SCRIPT_STATUS=1 HERDR_SESSION=fmtest \
     bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_container_ensure /tmp' "$ROOT" )
   [ "$out" = $'fmtest:w1\tw1:t9' ] || fail "container_ensure should echo '<session>:<workspace_id>\\t<seeded_default_tab_id>', got '$out'"
   assert_contains "$(cat "$log")" "HERDR_SESSION=fmtest"$'\x1f''server' "container_ensure did not start the herdr server"
-  assert_contains "$(cat "$log")" $'\x1f''workspace'$'\x1f''create'$'\x1f''--cwd'$'\x1f''/tmp'$'\x1f''--label'$'\x1f''firstmate' \
-    "container_ensure did not create the firstmate workspace with the given cwd"
-  pass "fm_backend_herdr_container_ensure: version-gates, starts the server, ensures the firstmate workspace, echoes session:workspace_id + the seeded default tab id"
+  assert_contains "$(cat "$log")" $'\x1f''workspace'$'\x1f''create'$'\x1f''--cwd'$'\x1f''/tmp'$'\x1f''--label'$'\x1f''firstmate-crew' \
+    "container_ensure did not create the crew workspace with the given cwd"
+  assert_not_contains "$(cat "$log")" $'\x1f''workspace'$'\x1f''rename' \
+    "container_ensure must not rename anything when there is no legacy workspace to migrate"
+  pass "fm_backend_herdr_container_ensure: version-gates, starts the server, ensures the crew workspace, echoes session:workspace_id + the seeded default tab id"
 }
 
 test_container_ensure_reuses_existing_workspace() {
@@ -314,13 +548,17 @@ test_container_ensure_reuses_existing_workspace() {
   dir="$TMP_ROOT/container-reuse"; mkdir -p "$dir/responses"; log="$dir/log"; resp="$dir/responses"; : > "$log"
   printf '{"client":{"version":"0.7.1","protocol":14}}\n' > "$resp/1.out"
   printf '{"server":{"running":true}}\n' > "$resp/2.out"
-  printf '{"result":{"workspaces":[{"workspace_id":"w9","label":"firstmate"}]}}\n' > "$resp/3.out"
+  # 3: the migration's list already shows the canonical label, so it is a no-op.
+  printf '{"result":{"workspaces":[{"workspace_id":"w9","label":"firstmate-crew"}]}}\n' > "$resp/3.out"
+  # 4: workspace_find's own list.
+  printf '{"result":{"workspaces":[{"workspace_id":"w9","label":"firstmate-crew"}]}}\n' > "$resp/4.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_HERDR_SCRIPT_STATUS=1 HERDR_SESSION=fmtest \
     bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_container_ensure /tmp' "$ROOT" )
-  [ "$out" = $'fmtest:w9\t' ] || fail "container_ensure should reuse the existing firstmate workspace id with an EMPTY seeded-tab field (an ADOPTED workspace is never a prune candidate), got '$out'"
+  [ "$out" = $'fmtest:w9\t' ] || fail "container_ensure should reuse the existing crew workspace id with an EMPTY seeded-tab field (an ADOPTED workspace is never a prune candidate), got '$out'"
   assert_not_contains "$(cat "$log")" $'\x1f''workspace'$'\x1f''create' "container_ensure should not create a workspace that already exists"
-  pass "fm_backend_herdr_container_ensure: reuses an existing firstmate workspace without recreating it, and reports no seeded default tab (adopted, not created)"
+  assert_not_contains "$(cat "$log")" $'\x1f''workspace'$'\x1f''rename' "container_ensure must not rename a workspace that already carries the canonical label"
+  pass "fm_backend_herdr_container_ensure: reuses an existing crew workspace without recreating it, and reports no seeded default tab (adopted, not created)"
 }
 
 test_create_task_refuses_duplicate_label() {
@@ -574,13 +812,15 @@ test_container_ensure_creates_with_no_focus_flag() {
   dir="$TMP_ROOT/container-no-focus"; mkdir -p "$dir/responses"; log="$dir/log"; resp="$dir/responses"; : > "$log"
   printf '{"client":{"version":"0.7.1","protocol":14}}\n' > "$resp/1.out"
   printf '{"server":{"running":true}}\n' > "$resp/2.out"
+  # 3: the legacy-label migration's list, 4: workspace_find's list.
   printf '{"result":{"workspaces":[]}}\n' > "$resp/3.out"
-  printf '{"result":{"workspace":{"workspace_id":"w1","label":"firstmate"},"tab":{"tab_id":"w1:t1"},"root_pane":{"pane_id":"w1:p1"}}}\n' > "$resp/4.out"
+  printf '{"result":{"workspaces":[]}}\n' > "$resp/4.out"
+  printf '{"result":{"workspace":{"workspace_id":"w1","label":"firstmate-crew"},"tab":{"tab_id":"w1:t1"},"root_pane":{"pane_id":"w1:p1"}}}\n' > "$resp/5.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_HERDR_SCRIPT_STATUS=1 HERDR_SESSION=fmtest \
     bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_container_ensure /tmp' "$ROOT" )
   [ "$out" = $'fmtest:w1\tw1:t1' ] || fail "container_ensure should still echo '<session>:<workspace_id>\\t<seeded_default_tab_id>', got '$out'"
-  assert_contains "$(cat "$log")" $'\x1f''workspace'$'\x1f''create'$'\x1f''--cwd'$'\x1f''/tmp'$'\x1f''--label'$'\x1f''firstmate'$'\x1f''--no-focus' \
+  assert_contains "$(cat "$log")" $'\x1f''workspace'$'\x1f''create'$'\x1f''--cwd'$'\x1f''/tmp'$'\x1f''--label'$'\x1f''firstmate-crew'$'\x1f''--no-focus' \
     "container_ensure's workspace create did not pass --no-focus (focus-safety: never steal the captain's attention on spawn)"
   pass "fm_backend_herdr_container_ensure: workspace create passes --no-focus"
 }
@@ -599,7 +839,7 @@ test_container_ensure_uses_secondmate_home_label() {
   [ "$out" = $'fmtest:w9\tw9:t1' ] || fail "container_ensure did not echo the expected session:workspace_id + seeded default tab id, got '$out'"
   assert_contains "$(cat "$log")" $'\x1f''workspace'$'\x1f''create'$'\x1f''--cwd'$'\x1f''/tmp'$'\x1f''--label'$'\x1f''2ndmate-sshhip-h7' \
     "container_ensure did not create the workspace under this secondmate home's own label"
-  pass "fm_backend_herdr_container_ensure: creates the workspace under the SECONDMATE home's own label, not 'firstmate'"
+  pass "fm_backend_herdr_container_ensure: creates the workspace under the SECONDMATE home's own label, not the primary's"
 }
 
 test_create_task_creates_with_no_focus_flag() {
@@ -2505,9 +2745,9 @@ EOF
       bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_kill "$1"' "$ROOT" "fmtest:$pane" \
       || fail "cycle $i: kill failed"
   done
-  # exactly one firstmate workspace survives three spawn/teardown cycles
-  wscount=$(jq -r '[.workspaces[]|select(.label=="firstmate")]|length' "$state")
-  [ "$wscount" = 1 ] || fail "expected exactly 1 firstmate workspace after 3 cycles, got $wscount: $(jq -c '.workspaces' "$state")"
+  # exactly one crew workspace survives three spawn/teardown cycles
+  wscount=$(jq -r '[.workspaces[]|select(.label=="firstmate-crew")]|length' "$state")
+  [ "$wscount" = 1 ] || fail "expected exactly 1 crew workspace after 3 cycles, got $wscount: $(jq -c '.workspaces' "$state")"
   # and no orphaned workspaces of any label
   total=$(jq -r '.workspaces|length' "$state")
   [ "$total" = 1 ] || fail "expected no orphaned workspaces after 3 cycles, got $total total: $(jq -c '.workspaces' "$state")"
@@ -2546,7 +2786,7 @@ test_adopted_workspace_never_prunes_default_tab() {
   # previous session created it), with a single tab labeled "1" - the same
   # shape herdr's own auto-seeded default tab has, but this run's own
   # container_ensure never ran a `workspace create` call to produce it.
-  jq -n '{next:2,workspaces:[{workspace_id:"w1",label:"firstmate"}],tabs:[{tab_id:"w1:t1",label:"1",workspace_id:"w1",pane_id:"w1:p1"}],agent_status:{}}' > "$state"
+  jq -n '{next:2,workspaces:[{workspace_id:"w1",label:"firstmate-crew"}],tabs:[{tab_id:"w1:t1",label:"1",workspace_id:"w1",pane_id:"w1:p1"}],agent_status:{}}' > "$state"
   raw=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_FAKE_HERDR_STATE="$state" HERDR_SESSION=fmtest \
     bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_container_ensure /proj' "$ROOT" ) \
     || fail "container_ensure failed against the stateful fake"
@@ -2573,8 +2813,9 @@ EOF
 }
 
 test_label_collision_startup_workspace_leaves_live_tab_alone() {
-  # The exact live-fire incident shape (2026-07-02): a captain launches herdr
-  # directly inside a directory named "firstmate", so herdr auto-derives that
+  # The live-fire incident shape (2026-07-02): a captain launches herdr
+  # directly inside a directory whose basename equals the crew-workspace
+  # label, so herdr auto-derives that
   # workspace's DISPLAYED label from the cwd basename - "firstmate" - byte-
   # identical to the primary firstmate home's own derived label, with no
   # --label ever passed and no firstmate involvement at all. That workspace's
@@ -2583,12 +2824,15 @@ test_label_collision_startup_workspace_leaves_live_tab_alone() {
   local dir log state fb raw container seeded ids pane
   dir="$TMP_ROOT/label-collision"; mkdir -p "$dir"; log="$dir/log"; state="$dir/state.json"; : > "$log"
   fb=$(make_herdr_statefake "$dir")
-  # Mimic a bare `herdr workspace create --cwd <dir-named-firstmate>` (no
+  # Mimic a bare `herdr workspace create --cwd <dir-named-firstmate-crew>` (no
   # --label): the resulting workspace's label is the cwd basename, and its
   # one auto-created tab is still labeled "1" - indistinguishable, by label
   # alone, from firstmate's own freshly-seeded default tab. Its pane hosts a
   # live agent (agent_status=working), exactly like the captain's own pane.
-  jq -n '{next:2,workspaces:[{workspace_id:"w1",label:"firstmate"}],tabs:[{tab_id:"w1:t1",label:"1",workspace_id:"w1",pane_id:"w1:p1"}],agent_status:{"w1:p1":"working"}}' > "$state"
+  # The collision is far less likely now that the crew workspace carries the
+  # `-crew` suffix, but "less likely" is not a safety mechanism, so the
+  # structural created-vs-adopted gate is still what is under test here.
+  jq -n '{next:2,workspaces:[{workspace_id:"w1",label:"firstmate-crew"}],tabs:[{tab_id:"w1:t1",label:"1",workspace_id:"w1",pane_id:"w1:p1"}],agent_status:{"w1:p1":"working"}}' > "$state"
   raw=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_FAKE_HERDR_STATE="$state" HERDR_SESSION=fmtest \
     bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_container_ensure /proj' "$ROOT" ) \
     || fail "container_ensure failed against the stateful fake"
@@ -2612,6 +2856,27 @@ EOF
   pass "fm_backend_herdr_create_task: the label-collision startup-workspace scenario (2026-07-02 incident) leaves the captain's live tab untouched"
 }
 
+test_legacy_labeled_lookalike_is_not_adopted_at_all() {
+  # After the crew-workspace rename, a workspace still carrying the LEGACY
+  # label and holding no fm-<id> tab is not firstmate's own container by any
+  # evidence, so the spawn path leaves it entirely alone and mints its own.
+  # This is strictly stronger than the adopt-and-never-prune gate above.
+  local dir log state fb raw container
+  dir="$TMP_ROOT/legacy-lookalike"; mkdir -p "$dir"; log="$dir/log"; state="$dir/state.json"; : > "$log"
+  fb=$(make_herdr_statefake "$dir")
+  jq -n '{next:2,workspaces:[{workspace_id:"w1",label:"firstmate"}],tabs:[{tab_id:"w1:t1",label:"1",workspace_id:"w1",pane_id:"w1:p1"}],agent_status:{"w1:p1":"working"}}' > "$state"
+  raw=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_FAKE_HERDR_STATE="$state" HERDR_SESSION=fmtest \
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_container_ensure /proj' "$ROOT" ) \
+    || fail "container_ensure failed against the stateful fake"
+  container=${raw%%$'\t'*}
+  [ "$container" != "fmtest:w1" ] || fail "a legacy-labeled workspace with no task tab must not be adopted"
+  jq -e '.tabs[] | select(.tab_id == "w1:t1")' "$state" >/dev/null \
+    || fail "the untouched workspace's live tab was closed"
+  assert_not_contains "$(cat "$log")" $'\x1f''workspace'$'\x1f''rename' \
+    "a workspace with no fm-<id> tab must never be renamed into firstmate's own namespace"
+  pass "fm_backend_herdr_container_ensure: a legacy-labeled lookalike holding no task tab is neither adopted nor renamed"
+}
+
 test_prune_refuses_a_working_agent_pane_defense_in_depth() {
   # Defense in depth (not the primary safety mechanism): even for a
   # freshly-created workspace with a genuine non-empty seeded default tab id,
@@ -2981,6 +3246,20 @@ test_workspace_label_secondmate_home_uses_marker_id
 test_workspace_label_secondmate_marker_trims_whitespace
 test_workspace_label_empty_marker_falls_back_to_primary
 test_workspace_label_different_secondmates_get_different_labels
+test_workspace_label_primary_is_not_the_bare_supervisor_name
+test_workspace_legacy_label_primary_and_secondmate
+test_workspace_find_prefers_canonical_over_legacy
+test_workspace_find_adopts_legacy_label_holding_task_tabs
+test_workspace_find_ignores_legacy_label_without_task_tabs
+test_workspace_find_secondmate_never_falls_back_to_the_primary_label
+test_migrate_legacy_label_renames_in_place
+test_migrate_legacy_label_skips_when_canonical_already_exists
+test_migrate_legacy_label_leaves_a_task_tab_less_workspace_alone
+test_migrate_legacy_label_is_a_noop_for_a_secondmate_home
+test_container_ensure_migrates_then_adopts_the_legacy_workspace
+test_label_self_renames_its_own_tab_from_the_injected_tab_id
+test_label_self_resolves_the_tab_from_the_pane_when_only_the_pane_is_injected
+test_label_self_refuses_outside_a_herdr_pane
 test_cli_helper_sets_env_and_appends_trailing_session_flag
 test_container_ensure_starts_server_and_workspace
 test_container_ensure_reuses_existing_workspace
@@ -2990,6 +3269,7 @@ test_workspace_ensure_prunes_default_tab
 test_repeated_cycles_reuse_one_workspace_no_orphans
 test_adopted_workspace_never_prunes_default_tab
 test_label_collision_startup_workspace_leaves_live_tab_alone
+test_legacy_labeled_lookalike_is_not_adopted_at_all
 test_prune_refuses_a_working_agent_pane_defense_in_depth
 test_no_jq_reserved_keyword_arg_names
 test_create_task_refuses_duplicate_label
diff --git a/tests/fm-backend-tmux-smoke.test.sh b/tests/fm-backend-tmux-smoke.test.sh
index aa1e07c326..be600a8816 100755
--- a/tests/fm-backend-tmux-smoke.test.sh
+++ b/tests/fm-backend-tmux-smoke.test.sh
@@ -156,6 +156,43 @@ if fm_backend_tmux_resolve_bare_selector "no-such-window-xyz" 2>/dev/null; then
 fi
 pass "real tmux: fm_backend_tmux_resolve_bare_selector fails for a window that does not exist"
 
+# --- firstmate's OWN window label -------------------------------------------
+# fm_backend_tmux_label_self targets the caller's own window through tmux's own
+# $TMUX/$TMUX_PANE markers, so this supplies a real pane id the same way a real
+# firstmate process inherits one. The property that matters is that the label
+# STICKS: an agent harness rewrites its terminal title continuously, so a label
+# an OSC 2 sequence could overwrite would silently do nothing.
+#
+# The probe window is created with a plain `new-window` (NOT
+# fm_backend_tmux_create_task, which already pins the name) under deliberately
+# hostile global options, so the pinning is actually exercised. Its command
+# rewrites the terminal title in a loop and needs no interactive shell.
+
+tmux set-option -g allow-rename on >/dev/null 2>&1 || true
+tmux set-window-option -g automatic-rename on >/dev/null 2>&1 || true
+SELF_PANE=$(tmux new-window -dP -F '#{pane_id}' -t "$SESSION:" -n captain-launched \
+  "sh -c 'while :; do printf \"\\033]2;harness-title-probe\\007\"; sleep 0.2; done'") \
+  || fail "could not create the self-label probe window"
+[ -n "$SELF_PANE" ] || fail "could not resolve the self-label probe pane id"
+
+if TMUX='' TMUX_PANE="$SELF_PANE" fm_backend_tmux_label_self firstmate 2>/dev/null; then
+  fail "fm_backend_tmux_label_self must refuse outside tmux (\$TMUX unset)"
+fi
+
+TMUX="fake,1,0" TMUX_PANE="$SELF_PANE" fm_backend_tmux_label_self firstmate \
+  || fail "fm_backend_tmux_label_self failed against real tmux"
+SELF_NAME=$(tmux display-message -p -t "$SELF_PANE" '#{window_name}')
+[ "$SELF_NAME" = firstmate ] || fail "fm_backend_tmux_label_self did not rename its own window, got '$SELF_NAME'"
+
+sleep 1
+SELF_NAME=$(tmux display-message -p -t "$SELF_PANE" '#{window_name}')
+[ "$SELF_NAME" = firstmate ] \
+  || fail "a continuous application terminal-title rewrite overwrote firstmate's own window label, got '$SELF_NAME'"
+tmux kill-window -t "$SELF_PANE" >/dev/null 2>&1 || true
+tmux set-option -g allow-rename off >/dev/null 2>&1 || true
+tmux set-window-option -g automatic-rename off >/dev/null 2>&1 || true
+pass "real tmux: fm_backend_tmux_label_self labels firstmate's own window, refuses outside tmux, and the label survives a harness terminal-title rewrite"
+
 # --- kill and recovery-grade missing-window classification ------------------
 
 fm_backend_tmux_kill "$TARGET"
diff --git a/tests/fm-backend.test.sh b/tests/fm-backend.test.sh
index 74b469a619..8400c0249e 100755
--- a/tests/fm-backend.test.sh
+++ b/tests/fm-backend.test.sh
@@ -449,6 +449,23 @@ test_backend_name_explicit_beats_detection() {
   pass "fm_backend_name: an explicit FM_BACKEND or config/backend setting always wins over runtime auto-detection, including an ambient cmux marker"
 }
 
+# fm_backend_label_self is the only backend operation whose target is the
+# CALLER's own endpoint rather than a recorded task target, so a backend with no
+# verified way to identify that endpoint must say so rather than quietly
+# renaming something else. The two implemented arms need a real terminal and are
+# covered by tests/fm-backend-tmux-smoke.test.sh and
+# tests/fm-backend-herdr.test.sh.
+test_label_self_dispatch_reports_unsupported_backends() {
+  local backend out
+  for backend in zellij orca cmux; do
+    out=$(fm_backend_label_self "$backend" firstmate 2>&1) \
+      && fail "fm_backend_label_self must refuse the $backend backend"
+    assert_contains "$out" "no verified way to label firstmate's own endpoint" \
+      "fm_backend_label_self did not explain the $backend limitation"
+  done
+  pass "fm_backend_label_self: backends with no verified self-label operation report the limitation instead of faking it"
+}
+
 test_backend_validate_refuses_unknown() {
   fm_backend_validate tmux 2>/dev/null || fail "fm_backend_validate should accept tmux"
   fm_backend_validate orca 2>/dev/null || fail "fm_backend_validate should accept orca"
@@ -1098,6 +1115,7 @@ test_backend_name_cmux_fallback_notice
 test_backend_name_autodetect_notice
 test_backend_name_explicit_beats_detection
 test_backend_validate_refuses_unknown
+test_label_self_dispatch_reports_unsupported_backends
 test_backend_source_shell_portable
 test_backend_validate_spawn_accepts_orca
 test_meta_get_and_backend_of_meta
diff --git a/tests/fm-brief.test.sh b/tests/fm-brief.test.sh
index 74690eab42..eed091a5e1 100755
--- a/tests/fm-brief.test.sh
+++ b/tests/fm-brief.test.sh
@@ -307,6 +307,58 @@ test_herdr_lab_contract_applies_to_scouts_but_not_secondmates() {
   pass "fm-brief.sh: Herdr lab contract covers scouts and rejects secondmate misuse"
 }
 
+# Pane identity (2026-07-26 incident): the captain opened a crewmate pane
+# believing it was firstmate and gave it cross-lane instructions. Nothing was
+# lost only because that crewmate volunteered its identity and asked first, and
+# firstmate's own records still went stale for a day. Both halves are contract
+# now, in ship AND scout scaffolds.
+test_crewmate_scaffolds_carry_the_pane_identity_contract() {
+  local home id brief
+  home="$TMP_ROOT/pane-identity-home"
+  mkdir -p "$home/data"
+
+  for id in pane-identity-ship pane-identity-scout; do
+    case "$id" in
+      *-scout) FM_HOME="$home" "$ROOT/bin/fm-brief.sh" "$id" some-proj --scout >/dev/null 2>&1 ;;
+      *) FM_HOME="$home" "$ROOT/bin/fm-brief.sh" "$id" some-proj >/dev/null 2>&1 ;;
+    esac
+    brief="$home/data/$id/brief.md"
+    assert_present "$brief" "$id: brief was not scaffolded"
+    assert_grep "You are not firstmate" "$brief" \
+      "$id: brief does not require the crewmate to identify itself before acting outside its task"
+    assert_grep "you are a worker on task \`$id\`" "$brief" \
+      "$id: the identity statement must name this exact task"
+    assert_grep "wait for their answer" "$brief" \
+      "$id: the crewmate must confirm before proceeding, not just announce"
+    assert_grep "acted outside this brief on captain instruction" "$brief" \
+      "$id: brief does not require a durable record of a captain override"
+    # The recorded override must classify as a nonterminal phase event. A
+    # blocked:/needs-decision: line would OPEN a keyed decision that only an
+    # explicit resolution closes (bin/fm-classify-lib.sh's status_open_decisions),
+    # which is the wrong shape for an action that is already finished.
+    assert_grep "working: acted outside this brief" "$brief" \
+      "$id: the override record must use the nonterminal working: verb"
+  done
+  pass "fm-brief.sh: ship and scout scaffolds require a crewmate to identify itself and to durably record a captain override"
+}
+
+# The recorded override line must actually fold the way the brief claims: a
+# nonterminal phase that the task's own done: closes, never a decision left open.
+test_override_record_classifies_as_a_nonterminal_phase() {
+  local status_file open_decisions open_activities
+  status_file="$TMP_ROOT/override-classify.status"
+  mkdir -p "$TMP_ROOT"
+  {
+    printf 'working: acted outside this brief on captain instruction - merged PR 42 in another lane\n'
+    printf 'done: fix implemented\n'
+  } > "$status_file"
+  open_decisions=$(bash -c '. "$0/bin/fm-classify-lib.sh"; status_open_decisions "$1"' "$ROOT" "$status_file")
+  [ -z "$open_decisions" ] || fail "the override record must not leave an open decision behind: $open_decisions"
+  open_activities=$(bash -c '. "$0/bin/fm-classify-lib.sh"; status_open_activities "$1"' "$ROOT" "$status_file")
+  [ -z "$open_activities" ] || fail "the task's own done: must close the override phase: $open_activities"
+  pass "fm-classify-lib: a captain-override record folds as a nonterminal phase and never as an unresolved blocker"
+}
+
 test_pause_verb_override_renders_all_brief_scaffolds() {
   local home kind id brief
   home="$TMP_ROOT/pause-verb-home"
@@ -395,5 +447,7 @@ test_herdr_lab_contract_applies_to_scouts_but_not_secondmates
 test_secondmate_no_projects_charter
 test_secondmate_marked_request_reporting_contract
 test_pause_verb_override_renders_all_brief_scaffolds
+test_crewmate_scaffolds_carry_the_pane_identity_contract
+test_override_record_classifies_as_a_nonterminal_phase
 test_scout_and_secondmate_load_decision_hold_policy
 test_scout_and_secondmate_scaffold
diff --git a/tests/fm-session-start.test.sh b/tests/fm-session-start.test.sh
index 29cf02d347..2164cf5188 100755
--- a/tests/fm-session-start.test.sh
+++ b/tests/fm-session-start.test.sh
@@ -1355,7 +1355,98 @@ EOF
   pass "session start rejects Pi loaded markers from previous sessions"
 }
 
+# --- firstmate's own endpoint label (bin/fm-label-self.sh) -------------------
+#
+# The supervisor was the one endpoint with no standing label, which is how a
+# captain came to steer a crewmate pane believing it was firstmate. These pin
+# the refusals that keep a cosmetic convenience from damaging endpoint
+# IDENTITY, plus the digest wiring.
+
+# tests/lib.sh disables self-labeling suite-wide so a run from inside a real
+# terminal never relabels the developer's own window or tab; these tests turn it
+# back on for exactly their own invocation, with every runtime marker stripped
+# so no real endpoint is ever a candidate.
+label_self() {  # <home> [env-assignments...] -> the script's stdout
+  local home=$1
+  shift
+  env -u TMUX -u TMUX_PANE -u HERDR_ENV -u HERDR_TAB_ID -u HERDR_PANE_ID -u CMUX_WORKSPACE_ID \
+    FM_SELF_LABEL=firstmate FM_HOME="$home" FM_ROOT_OVERRIDE="$ROOT" "$@" "$ROOT/bin/fm-label-self.sh" 2>&1
+}
+
+test_label_self_refuses_in_a_secondmate_home() {
+  local rec root home fakebin out
+  rec=$(new_world label-self-secondmate)
+  IFS='|' read -r root home fakebin <<EOF
+$rec
+EOF
+  : "$root" "$fakebin"
+  printf 'sm-label-1\n' > "$home/.fm-secondmate-home"
+  out=$(label_self "$home" TMUX=fake,1,0 TMUX_PANE=%0)
+  case "$out" in
+    *"secondmate home"*) : ;;
+    *) fail "a secondmate home's endpoint label is its parent's identity handle and must not be renamed"$'\n'"$out" ;;
+  esac
+  pass "fm-label-self.sh: refuses in a secondmate home, whose fm- endpoint label the main firstmate reaches it by"
+}
+
+test_label_self_refuses_a_task_namespace_label() {
+  local rec root home fakebin out
+  rec=$(new_world label-self-reserved)
+  IFS='|' read -r root home fakebin <<EOF
+$rec
+EOF
+  : "$root" "$fakebin"
+  out=$(label_self "$home" FM_SELF_LABEL=fm-not-a-task TMUX=fake,1,0 TMUX_PANE=%0)
+  case "$out" in
+    *"reserved for worker endpoints"*) : ;;
+    *) fail "the fm- prefix is the task-endpoint namespace and must be refused"$'\n'"$out" ;;
+  esac
+  pass "fm-label-self.sh: refuses to put firstmate's own endpoint in the reserved fm- task namespace"
+}
+
+test_label_self_reports_an_unlabelable_runtime() {
+  local rec root home fakebin out
+  rec=$(new_world label-self-noruntime)
+  IFS='|' read -r root home fakebin <<EOF
+$rec
+EOF
+  : "$root" "$fakebin"
+  out=$(label_self "$home")
+  case "$out" in
+    *"not running inside a terminal runtime"*) : ;;
+    *) fail "with no runtime markers the script must say so, not silently claim success"$'\n'"$out" ;;
+  esac
+  pass "fm-label-self.sh: reports a runtime that cannot label its own tab instead of faking it"
+}
+
+test_session_start_runs_the_self_label_step() {
+  local rec root home fakebin out
+  rec=$(new_world label-self-digest)
+  IFS='|' read -r root home fakebin <<EOF
+$rec
+EOF
+  make_fake_toolchain "$fakebin"
+  make_fake_ps_claude "$fakebin"
+  out=$(env -u TMUX -u TMUX_PANE -u HERDR_ENV -u HERDR_TAB_ID -u HERDR_PANE_ID -u CMUX_WORKSPACE_ID \
+    -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
+    FM_SELF_LABEL=firstmate FM_HOME="$home" FM_ROOT_OVERRIDE="$ROOT" PATH="$fakebin:$BASE_PATH" \
+    "$SESSION_START")
+  case "$out" in
+    *"not running inside a terminal runtime"*) : ;;
+    *) fail "the session-start digest did not run the self-label step"$'\n'"$out" ;;
+  esac
+  case "$out" in
+    *"not running inside a terminal runtime"*"BOOTSTRAP"*) : ;;
+    *) fail "the self-label step must run before the bootstrap section"$'\n'"$out" ;;
+  esac
+  pass "fm-session-start.sh: labels firstmate's own endpoint at session start and reports when it cannot"
+}
+
 test_context_digest_absent_empty_present
+test_label_self_refuses_in_a_secondmate_home
+test_label_self_refuses_a_task_namespace_label
+test_label_self_reports_an_unlabelable_runtime
+test_session_start_runs_the_self_label_step
 test_lock_refusal_read_only_path
 test_lock_write_failure_read_only_path
 test_session_lock_concurrent_single_winner
diff --git a/tests/lib.sh b/tests/lib.sh
index d33062915f..4f4242c92d 100644
--- a/tests/lib.sh
+++ b/tests/lib.sh
@@ -34,6 +34,16 @@ FM_TEST_LIB_SOURCED=1
 # strips this to verify real refusal.
 export FM_GATE_REFUSE_BYPASS=1
 
+# Keep the suite out of the developer's OWN terminal. bin/fm-label-self.sh
+# labels the endpoint its caller is running in, and several suites drive the
+# real bin/fm-session-start.sh, which invokes it - so a suite run from inside a
+# real tmux window or herdr tab would otherwise relabel that window or tab. An
+# empty label is the script's documented no-op, so this disables it suite-wide;
+# a test that needs the real behavior sets FM_SELF_LABEL explicitly for exactly
+# that invocation.
+FM_SELF_LABEL=''
+export FM_SELF_LABEL
+
 # Resolve the repo root from this library's own location. Consumed by sourcing
 # test files, not by this library, so it reads as "unused" here.
 # shellcheck disable=SC2034

From 50d4410ea16e198a4d049b9dc61bea028321bde4 Mon Sep 17 00:00:00 2001
From: Shane Bracewell <sbracewell64@gmail.com>
Date: Sun, 26 Jul 2026 11:07:10 -0400
Subject: [PATCH 2/6] no-mistakes(review): guard self-label, split override
 verb, dedupe workspace lookup

---
 bin/backends/herdr.sh               | 144 ++++++++++++++++++++++------
 bin/backends/tmux.sh                |  31 +++++-
 bin/fm-backend.sh                   |  23 +++++
 bin/fm-brief.sh                     |  54 ++++++++---
 bin/fm-label-self.sh                |  18 ++++
 docs/herdr-backend.md               |   1 +
 docs/tmux-backend.md                |   1 +
 tests/fm-backend-herdr.test.sh      | 126 ++++++++++++++++++++----
 tests/fm-backend-tmux-smoke.test.sh |  24 +++++
 tests/fm-backend.test.sh            |  16 ++++
 tests/fm-brief.test.sh              |  30 +++++-
 tests/fm-crew-state.test.sh         |  26 +++++
 tests/fm-session-start.test.sh      |  90 +++++++++++++++++
 13 files changed, 517 insertions(+), 67 deletions(-)

diff --git a/bin/backends/herdr.sh b/bin/backends/herdr.sh
index 9f10a63dda..5dbdfbacce 100644
--- a/bin/backends/herdr.sh
+++ b/bin/backends/herdr.sh
@@ -267,6 +267,19 @@ fm_backend_herdr_label_self() {  # <label>
   local label=$1 session tab
   [ -n "$label" ] || { echo "error: fm_backend_herdr_label_self needs a label" >&2; return 1; }
   fm_backend_herdr_tool_check || return 1
+  tab=$(fm_backend_herdr_self_tab_id) || return 1
+  session=$(fm_backend_herdr_session)
+  fm_backend_herdr_cli "$session" tab rename "$tab" "$label" >/dev/null 2>&1 \
+    || { echo "error: herdr tab rename failed for $tab" >&2; return 1; }
+  return 0
+}
+
+# fm_backend_herdr_self_tab_id: the tab id the CALLER ITSELF is running in,
+# resolved from herdr's own injected HERDR_TAB_ID and falling back to a `pane
+# get` on HERDR_PANE_ID. Shared by the two self-endpoint operations so both
+# address exactly the same tab, and so neither ever resolves one by label.
+fm_backend_herdr_self_tab_id() {
+  local session tab
   session=$(fm_backend_herdr_session)
   tab=${HERDR_TAB_ID:-}
   if [ -z "$tab" ]; then
@@ -275,9 +288,29 @@ fm_backend_herdr_label_self() {  # <label>
       | jq -r '.result.pane.tab_id // empty' 2>/dev/null)
   fi
   [ -n "$tab" ] || { echo "error: could not resolve this herdr pane's own tab id" >&2; return 1; }
-  fm_backend_herdr_cli "$session" tab rename "$tab" "$label" >/dev/null 2>&1 \
-    || { echo "error: herdr tab rename failed for $tab" >&2; return 1; }
-  return 0
+  printf '%s' "$tab"
+}
+
+# fm_backend_herdr_current_self_label: the label the caller's OWN tab carries
+# right now, or a failure with an explanation. bin/fm-label-self.sh reads this
+# before renaming anything and fails closed on an error, so an unreadable label
+# must never be reported as an empty-but-successful one.
+#
+# Session-wide `tab list` (no --workspace) is the same shape
+# fm_backend_herdr_resolve_bare_selector already uses: the caller's own tab is
+# in whatever workspace the captain happened to launch it in, which is exactly
+# the workspace this home's own container lookup does NOT resolve.
+fm_backend_herdr_current_self_label() {
+  local session tab tabs label
+  fm_backend_herdr_tool_check || return 1
+  tab=$(fm_backend_herdr_self_tab_id) || return 1
+  session=$(fm_backend_herdr_session)
+  tabs=$(fm_backend_herdr_cli "$session" tab list 2>/dev/null) \
+    || { echo "error: herdr tab list failed for session $session" >&2; return 1; }
+  label=$(printf '%s' "$tabs" | jq -r --arg t "$tab" \
+    '.result.tabs[]? | select(.tab_id == $t) | select((.label | type) == "string") | .label' 2>/dev/null | head -1)
+  [ -n "$label" ] || { echo "error: could not read the current label of herdr tab $tab" >&2; return 1; }
+  printf '%s' "$label"
 }
 
 # fm_backend_herdr_projection_id: generate a compact 128-bit base64url token.
@@ -953,25 +986,37 @@ fm_backend_herdr_workspace_task_tab_count() {  # <session> <workspace-id>
   printf '%s' "$n"
 }
 
-# fm_backend_herdr_workspace_find: this HOME's own workspace id inside
-# <session> (fm_backend_herdr_workspace_label), or empty (never creates).
-# Read-only, safe for recovery/list paths.
+# fm_backend_herdr_workspace_resolve: the SINGLE place the canonical/legacy
+# crew-workspace precedence rule lives. Echoes "<workspace-id><TAB><origin>",
+# where <origin> is `canonical` or `legacy`, or nothing at all when this home
+# has no adoptable workspace. Read-only: one `workspace list`, plus one `tab
+# list` only on the legacy branch (a canonical match never needs a task-tab
+# probe).
 #
-# Legacy fallback (the primary's pre-migration "firstmate" label): when no
-# canonically labeled workspace exists, a legacy-labeled one is adopted ONLY
-# when it actually holds at least one fm-<id> task tab. That keeps every task
-# already recorded under the old label reachable - both for spawn adoption and
-# for fm_backend_herdr_list_live recovery, which scopes to this function's
-# result - while a tab-less legacy match is deliberately NOT adopted: it holds
-# no recoverable task by definition, and refusing it removes the residual
-# adopt-a-human's-lookalike-workspace hazard that the seeded-default-tab prune
-# incident below is about.
-fm_backend_herdr_workspace_find() {  # <session>
+# Precedence, in order:
+#   - a workspace carrying this home's canonical label
+#     (fm_backend_herdr_workspace_label) always wins;
+#   - otherwise the primary's pre-migration "firstmate" label
+#     (fm_backend_herdr_workspace_legacy_label; empty for a secondmate home) is
+#     adopted ONLY when that workspace actually holds at least one fm-<id> task
+#     tab. That keeps every task already recorded under the old label reachable
+#     - both for spawn adoption and for fm_backend_herdr_list_live recovery,
+#     which scopes to fm_backend_herdr_workspace_find's result - while a
+#     tab-less legacy match is deliberately NOT adopted: it holds no recoverable
+#     task by definition, and refusing it removes the residual
+#     adopt-a-human's-lookalike-workspace hazard that the seeded-default-tab
+#     prune incident below is about.
+#
+# The <origin> field is what lets fm_backend_herdr_workspace_migrate_legacy_label
+# reuse this same resolution instead of repeating it: "legacy" is exactly the
+# state that needs renaming, and "canonical" is exactly the state that must
+# refuse to rename so two containers are never merged onto one label.
+fm_backend_herdr_workspace_resolve() {  # <session> -> "<workspace-id>\t<canonical|legacy>"
   local session=$1 list wsid legacy
   list=$(fm_backend_herdr_cli "$session" workspace list 2>/dev/null) || return 0
   wsid=$(fm_backend_herdr_workspace_id_in_list "$list" "$(fm_backend_herdr_workspace_label)")
   if [ -n "$wsid" ]; then
-    printf '%s' "$wsid"
+    printf '%s\tcanonical' "$wsid"
     return 0
   fi
   legacy=$(fm_backend_herdr_workspace_legacy_label)
@@ -979,7 +1024,17 @@ fm_backend_herdr_workspace_find() {  # <session>
   wsid=$(fm_backend_herdr_workspace_id_in_list "$list" "$legacy")
   [ -n "$wsid" ] || return 0
   [ "$(fm_backend_herdr_workspace_task_tab_count "$session" "$wsid")" -gt 0 ] || return 0
-  printf '%s' "$wsid"
+  printf '%s\tlegacy' "$wsid"
+}
+
+# fm_backend_herdr_workspace_find: this HOME's own workspace id inside
+# <session> (fm_backend_herdr_workspace_label), or empty (never creates).
+# Read-only, safe for recovery/list paths. The id half of
+# fm_backend_herdr_workspace_resolve, which owns the precedence rule.
+fm_backend_herdr_workspace_find() {  # <session>
+  local resolved
+  resolved=$(fm_backend_herdr_workspace_resolve "$1")
+  printf '%s' "${resolved%%$'\t'*}"
 }
 
 # fm_backend_herdr_workspace_migrate_legacy_label: rename this home's
@@ -1003,19 +1058,34 @@ fm_backend_herdr_workspace_find() {  # <session>
 #     is the same positive proof of ownership fm_backend_herdr_workspace_find
 #     requires before adopting it. A human's coincidentally-labeled workspace
 #     is therefore never renamed.
-fm_backend_herdr_workspace_migrate_legacy_label() {  # <session>
-  local session=$1 canonical legacy list wsid
+#
+# All three are read straight off fm_backend_herdr_workspace_resolve rather than
+# re-derived here: a `legacy` origin means precisely "no canonical workspace
+# exists AND this legacy-labeled one holds a task tab", so the precedence rule
+# has exactly one implementation and cannot drift between the two callers. The
+# secondmate short-circuit stays ABOVE the resolve call, so a home with no
+# legacy label still makes zero herdr calls for the migration.
+#
+# <resolved> is an optional pre-computed fm_backend_herdr_workspace_resolve
+# result, so fm_backend_herdr_container_ensure pays for ONE `workspace list` per
+# spawn instead of one for the migration and another for the ensure. Omitting it
+# resolves inline, which is what the standalone/test call shape does.
+fm_backend_herdr_workspace_migrate_legacy_label() {  # <session> [resolved]
+  local session=$1 canonical legacy resolved wsid
   legacy=$(fm_backend_herdr_workspace_legacy_label)
   [ -n "$legacy" ] || return 0
   canonical=$(fm_backend_herdr_workspace_label)
   if [ "$canonical" = "$legacy" ]; then
     return 0
   fi
-  list=$(fm_backend_herdr_cli "$session" workspace list 2>/dev/null) || return 0
-  [ -z "$(fm_backend_herdr_workspace_id_in_list "$list" "$canonical")" ] || return 0
-  wsid=$(fm_backend_herdr_workspace_id_in_list "$list" "$legacy")
+  if [ "$#" -ge 2 ]; then
+    resolved=$2
+  else
+    resolved=$(fm_backend_herdr_workspace_resolve "$session")
+  fi
+  [ "${resolved#*$'\t'}" = "legacy" ] || return 0
+  wsid=${resolved%%$'\t'*}
   [ -n "$wsid" ] || return 0
-  [ "$(fm_backend_herdr_workspace_task_tab_count "$session" "$wsid")" -gt 0 ] || return 0
   fm_backend_herdr_cli "$session" workspace rename "$wsid" "$canonical" >/dev/null 2>&1 || true
   return 0
 }
@@ -1119,11 +1189,20 @@ fm_backend_herdr_workspace_prune_seeded_default_tab() {  # <session> <workspace_
 # focuses regardless of --no-focus (herdr always needs something focused to
 # attach to). --no-focus is passed unconditionally anyway, for defense in
 # depth and because it is a no-op in the already-safe case.
-fm_backend_herdr_workspace_ensure() {  # <session> <cwd>
+#
+# <resolved> is an optional pre-computed fm_backend_herdr_workspace_resolve
+# result. Passing it reuses that ONE lookup instead of repeating it; a rename
+# moves no workspace id, so a result resolved before the legacy-label migration
+# is still correct after it. Omitting it looks the workspace up inline.
+fm_backend_herdr_workspace_ensure() {  # <session> <cwd> [resolved]
   local session=$1 cwd=$2 wsid out label
   FM_BACKEND_HERDR_WS_ID=""
   FM_BACKEND_HERDR_WS_SEEDED_TAB_ID=""
-  wsid=$(fm_backend_herdr_workspace_find "$session")
+  if [ "$#" -ge 3 ]; then
+    wsid=${3%%$'\t'*}
+  else
+    wsid=$(fm_backend_herdr_workspace_find "$session")
+  fi
   if [ -n "$wsid" ]; then
     FM_BACKEND_HERDR_WS_ID=$wsid
     printf '%s' "$wsid"
@@ -1154,16 +1233,19 @@ fm_backend_herdr_workspace_ensure() {  # <session> <cwd>
 # must be threaded through to fm_backend_herdr_create_task, which is the only
 # function allowed to prune it (fm_backend_herdr_workspace_prune_seeded_default_tab).
 fm_backend_herdr_container_ensure() {  # <cwd-for-a-fresh-workspace>
-  local cwd=${1:-$PWD} session label
+  local cwd=${1:-$PWD} session label resolved
   fm_backend_herdr_version_check || return 1
   session=$(fm_backend_herdr_session)
   fm_backend_herdr_server_ensure "$session" || return 1
+  # Resolve this home's container ONCE and hand the same answer to both steps
+  # below, so a spawn costs one `workspace list` rather than two.
+  resolved=$(fm_backend_herdr_workspace_resolve "$session")
   # Converge a pre-migration crew-workspace label before the ensure below, so a
   # home carrying tasks under the old label keeps ONE container instead of
-  # gaining a second one. Best-effort and never fatal: workspace_find adopts
-  # the legacy label either way.
-  fm_backend_herdr_workspace_migrate_legacy_label "$session"
-  fm_backend_herdr_workspace_ensure "$session" "$cwd" >/dev/null || { label=$(fm_backend_herdr_workspace_label); echo "error: failed to ensure herdr workspace '$label' in session '$session'" >&2; return 1; }
+  # gaining a second one. Best-effort and never fatal: the resolved id is the
+  # same one either way, because a rename moves no workspace id.
+  fm_backend_herdr_workspace_migrate_legacy_label "$session" "$resolved"
+  fm_backend_herdr_workspace_ensure "$session" "$cwd" "$resolved" >/dev/null || { label=$(fm_backend_herdr_workspace_label); echo "error: failed to ensure herdr workspace '$label' in session '$session'" >&2; return 1; }
   if [ -z "$FM_BACKEND_HERDR_WS_ID" ]; then
     label=$(fm_backend_herdr_workspace_label)
     echo "error: failed to ensure herdr workspace '$label' in session '$session'" >&2
diff --git a/bin/backends/tmux.sh b/bin/backends/tmux.sh
index d71a693d65..b67c3df3b9 100644
--- a/bin/backends/tmux.sh
+++ b/bin/backends/tmux.sh
@@ -111,6 +111,19 @@ fm_backend_tmux_create_task() {  # <session> <window-name> <proj-abs> -> prints
 fm_backend_tmux_label_self() {  # <label>
   local label=$1 wid
   [ -n "$label" ] || { echo "error: fm_backend_tmux_label_self needs a label" >&2; return 1; }
+  wid=$(fm_backend_tmux_self_window_id) || return 1
+  tmux rename-window -t "$wid" "$label" 2>/dev/null || { echo "error: tmux rename-window failed for $wid" >&2; return 1; }
+  tmux set-window-option -t "$wid" automatic-rename off 2>/dev/null || true
+  tmux set-window-option -t "$wid" allow-rename off 2>/dev/null || true
+  return 0
+}
+
+# fm_backend_tmux_self_window_id: the window id of the window the CALLER ITSELF
+# runs in, resolved from tmux's own $TMUX_PANE and falling back to the client's
+# current window. Shared by the two self-endpoint operations so both address
+# exactly the same window, and so neither ever resolves one by label.
+fm_backend_tmux_self_window_id() {
+  local wid
   [ -n "${TMUX:-}" ] || { echo "error: not running inside tmux (\$TMUX is unset)" >&2; return 1; }
   if [ -n "${TMUX_PANE:-}" ]; then
     wid=$(tmux display-message -p -t "$TMUX_PANE" '#{window_id}' 2>/dev/null)
@@ -118,10 +131,20 @@ fm_backend_tmux_label_self() {  # <label>
     wid=$(tmux display-message -p '#{window_id}' 2>/dev/null)
   fi
   [ -n "$wid" ] || { echo "error: could not resolve this tmux pane's own window id" >&2; return 1; }
-  tmux rename-window -t "$wid" "$label" 2>/dev/null || { echo "error: tmux rename-window failed for $wid" >&2; return 1; }
-  tmux set-window-option -t "$wid" automatic-rename off 2>/dev/null || true
-  tmux set-window-option -t "$wid" allow-rename off 2>/dev/null || true
-  return 0
+  printf '%s' "$wid"
+}
+
+# fm_backend_tmux_current_self_label: the name the caller's OWN window carries
+# right now, or a failure with an explanation. bin/fm-label-self.sh reads this
+# before renaming anything and fails closed on an error, so an unreadable name
+# must never be reported as an empty-but-successful one.
+fm_backend_tmux_current_self_label() {
+  local wid name
+  wid=$(fm_backend_tmux_self_window_id) || return 1
+  name=$(tmux display-message -p -t "$wid" '#{window_name}' 2>/dev/null) \
+    || { echo "error: tmux display-message failed for $wid" >&2; return 1; }
+  [ -n "$name" ] || { echo "error: could not read the current name of tmux window $wid" >&2; return 1; }
+  printf '%s' "$name"
 }
 
 # fm_backend_tmux_current_path: the live pane's current working directory, or
diff --git a/bin/fm-backend.sh b/bin/fm-backend.sh
index d6235e7e7d..d545cd124e 100644
--- a/bin/fm-backend.sh
+++ b/bin/fm-backend.sh
@@ -603,6 +603,29 @@ fm_backend_label_self() {  # <backend> <label>
   esac
 }
 
+# fm_backend_current_self_label: the label the caller's OWN endpoint carries
+# right now, printed on stdout. The read half of fm_backend_label_self, and the
+# reason bin/fm-label-self.sh can tell firstmate's own unlabeled endpoint apart
+# from a worker endpoint it must never touch: a crewmate running
+# bin/fm-session-start.sh in a firstmate-repo worktree passes every other
+# refusal, so without reading the CURRENT label the self-label step would rename
+# a live fm-<task-id> tab out of the namespace herdr's recovery scan
+# (fm_backend_herdr_list_live) selects on. Each arm resolves the caller's own
+# endpoint from the backend's own ambient markers, never from a label lookup,
+# and returns non-zero rather than an empty label when it cannot read one, so
+# the caller can fail closed. Only the two runtime-auto-detected backends
+# implement it, matching fm_backend_label_self exactly.
+fm_backend_current_self_label() {  # <backend>
+  local backend=$1
+  shift
+  fm_backend_source "$backend" || return 1
+  case "$backend" in
+    tmux) fm_backend_tmux_current_self_label "$@" ;;
+    herdr) fm_backend_herdr_current_self_label "$@" ;;
+    *) echo "error: backend '$backend' has no verified way to read firstmate's own endpoint label" >&2; return 1 ;;
+  esac
+}
+
 fm_backend_remove_worktree() {  # <backend> <worktree-id>
   local backend=$1
   shift
diff --git a/bin/fm-brief.sh b/bin/fm-brief.sh
index b49c5bad63..e6bdae5093 100755
--- a/bin/fm-brief.sh
+++ b/bin/fm-brief.sh
@@ -42,11 +42,19 @@
 # Every crewmate scaffold (ship and scout) also carries the pane-identity pair:
 # state plainly that you are a worker on this task and not firstmate before
 # acting on anything a human asks outside the brief, and record any override
-# actually carried out with a nonterminal "working:" line, so firstmate's own
-# records self-heal instead of silently going stale. That verb is deliberate -
-# bin/fm-classify-lib.sh's keyed fold makes "blocked:"/"needs-decision:" OPEN a
-# decision that only an explicit resolution closes, which is the wrong shape for
-# a completed action.
+# actually carried out with a status line, so firstmate's own records self-heal
+# instead of silently going stale. Both the verb and the two branches it comes
+# in are deliberate. bin/fm-classify-lib.sh's keyed fold makes
+# "blocked:"/"needs-decision:" OPEN a decision that only an explicit resolution
+# closes, which is the wrong shape for a completed action, so neither is used.
+# bin/fm-crew-state.sh's map_log_state then reconciles a task from its LAST
+# status line, so the record must not change the state the task is really in:
+# before the task reports a terminal state a nonterminal "working:" line is
+# right and the task's own later "done:" closes it, but AFTER "done:"/"failed:"
+# the record is appended under that SAME terminal verb instead - otherwise a
+# trailing "working:" would reopen a finished task and leave an activity nothing
+# can ever close. A captain dropping into an already-idle, already-done pane is
+# the common case, so the terminal branch is the one that usually applies.
 # Ship tasks include a project-memory section so durable project-intrinsic
 # learnings can be committed to AGENTS.md through the project's delivery path;
 # it carries the AGENTS.md authoring bar (widely useful knowledge only, pointers
@@ -274,12 +282,20 @@ The report is the only thing that survives, so anything worth keeping must be in
    for anything outside this task, say so plainly BEFORE you act: you are a worker on task \`$ID\`,
    not firstmate, and merges, cross-lane work, other lanes' state, and fleet supervision belong to
    firstmate. Then ask whether they still want you to proceed, and wait for their answer.
-9. If you do act outside this brief on the captain's explicit instruction, leave a durable record:
-   append \`working: acted outside this brief on captain instruction - {what you did, and where}\`.
+9. If you do act outside this brief on the captain's explicit instruction, leave a durable record.
    You cannot write another lane's records, so that line is the only way firstmate learns of it and
-   keeps its own records accurate. \`working:\` is the deliberate choice here - \`blocked:\` and
-   \`needs-decision:\` would open a decision that stays open until it is explicitly closed, and a
-   completed action is neither.
+   keeps its own records accurate. Firstmate reconciles your state from the LAST status line, so
+   which verb you use depends on where this task already is:
+   - You have NOT reported a terminal state yet: append
+     \`working: acted outside this brief on captain instruction - {what you did, and where}\`.
+     Your own later \`done:\` closes that phase.
+   - You have ALREADY reported \`done:\` or \`failed:\`: append the record under that SAME terminal
+     verb, e.g. \`done: acted outside this brief on captain instruction - {what you did, and where}; task deliverable unchanged\`.
+     A captain dropping into an already-idle, already-done pane is the COMMON case, so this is
+     usually the branch you want. A bare \`working:\` line here would reopen a task that is really
+     finished, and leave a phase open that you have no further verb to close.
+   Never record this with \`blocked:\` or \`needs-decision:\`: those open a decision that stays open
+   until it is explicitly closed, and a completed action is neither.
 
 # Definition of done
 Write your findings to \`$DATA/$ID/report.md\`.
@@ -396,12 +412,20 @@ $RULE1
    for anything outside this task, say so plainly BEFORE you act: you are a worker on task \`$ID\`,
    not firstmate, and merges, cross-lane work, other lanes' state, and fleet supervision belong to
    firstmate. Then ask whether they still want you to proceed, and wait for their answer.
-9. If you do act outside this brief on the captain's explicit instruction, leave a durable record:
-   append \`working: acted outside this brief on captain instruction - {what you did, and where}\`.
+9. If you do act outside this brief on the captain's explicit instruction, leave a durable record.
    You cannot write another lane's records, so that line is the only way firstmate learns of it and
-   keeps its own records accurate. \`working:\` is the deliberate choice here - \`blocked:\` and
-   \`needs-decision:\` would open a decision that stays open until it is explicitly closed, and a
-   completed action is neither.
+   keeps its own records accurate. Firstmate reconciles your state from the LAST status line, so
+   which verb you use depends on where this task already is:
+   - You have NOT reported a terminal state yet: append
+     \`working: acted outside this brief on captain instruction - {what you did, and where}\`.
+     Your own later \`done:\` closes that phase.
+   - You have ALREADY reported \`done:\` or \`failed:\`: append the record under that SAME terminal
+     verb, e.g. \`done: acted outside this brief on captain instruction - {what you did, and where}; task deliverable unchanged\`.
+     A captain dropping into an already-idle, already-done pane is the COMMON case, so this is
+     usually the branch you want. A bare \`working:\` line here would reopen a task that is really
+     finished, and leave a phase open that you have no further verb to close.
+   Never record this with \`blocked:\` or \`needs-decision:\`: those open a decision that stays open
+   until it is explicitly closed, and a completed action is neither.
 
 # Project memory
 If \`AGENTS.md\` or \`CLAUDE.md\` already exists, or if this task produced durable project-intrinsic knowledge, run \`$FM_ROOT/bin/fm-ensure-agents-md.sh .\` in the worktree.
diff --git a/bin/fm-label-self.sh b/bin/fm-label-self.sh
index 8da96e792b..c6ebc34dda 100755
--- a/bin/fm-label-self.sh
+++ b/bin/fm-label-self.sh
@@ -33,6 +33,18 @@
 #   - Any label starting with `fm-` is refused, because that prefix is the
 #     reserved task-endpoint namespace: herdr's recovery scan treats every
 #     fm-* tab in a home's workspace as a live task.
+#   - An endpoint that ALREADY carries an fm- label is refused. A crewmate or
+#     scout working in a firstmate-repo worktree runs bin/fm-session-start.sh
+#     too, and its home has no secondmate marker and resolves the same
+#     "firstmate" label, so every other refusal here passes: without reading the
+#     label the endpoint currently carries, this step would rename a live
+#     fm-<task-id> worker endpoint to "firstmate", dropping it out of the
+#     namespace fm_backend_herdr_list_live scans for recovery and orphan
+#     discovery, and putting the supervisor's name on a crewmate pane - the
+#     exact incident above, inverted. The current label is read through
+#     fm_backend_current_self_label and this FAILS CLOSED: a label that cannot
+#     be read at all is not evidence the endpoint is safe to rename, so it is
+#     refused too.
 #   - A runtime with no verified self-label operation is reported, not faked.
 #
 # The runtime is resolved with fm_backend_detect (the runtime this process is
@@ -84,6 +96,12 @@ fi
 RUNTIME=$(fm_backend_detect 2>/dev/null) || RUNTIME=""
 [ -n "$RUNTIME" ] || note "this firstmate is not running inside a terminal runtime that can label its own tab."
 
+CURRENT=$(fm_backend_current_self_label "$RUNTIME" 2>&1) || \
+  note "could not read what this terminal tab is currently called in $RUNTIME, so it was left alone rather than risk renaming a worker endpoint. ${CURRENT:-no detail reported}"
+case "$CURRENT" in
+  fm-*) note "this terminal tab is already a worker endpoint called '$CURRENT', so it was left alone: that is the name firstmate reaches its crew by, and this pane is not firstmate." ;;
+esac
+
 OUT=$(fm_backend_label_self "$RUNTIME" "$LABEL" 2>&1) || \
   note "could not label this firstmate's own terminal tab in $RUNTIME; it keeps its previous name. ${OUT:-no detail reported}"
 
diff --git a/docs/herdr-backend.md b/docs/herdr-backend.md
index a9bf11e4a4..3a3cfc04b1 100644
--- a/docs/herdr-backend.md
+++ b/docs/herdr-backend.md
@@ -43,6 +43,7 @@ The secondmate process and every child it launches resolve the same home label;
 Firstmate labels its own tab `firstmate` at session start through `bin/fm-label-self.sh`, so the supervisor is identifiable beside the `fm-<task-id>` worker tabs.
 An explicitly set tab label is independent of the pane's `terminal_title`, which the harness rewrites continuously, so the label persists.
 A secondmate home is refused: its own tab is labeled `fm-<secondmate-id>` and the main Firstmate reaches it by that label.
+A tab that already carries an `fm-` label is refused too, because that tab is a worker endpoint and renaming it would drop the task out of the label-matched recovery scan; the current label is read with `tab list` and an unreadable label is refused rather than renamed.
 
 Attach to the selected named Herdr session and switch to the relevant home workspace to watch its task tabs.
 Routine supervision uses `bin/fm-peek.sh <id>` and `FM_HOME=<home> bin/fm-send.sh <id> '<text>'` without attaching.
diff --git a/docs/tmux-backend.md b/docs/tmux-backend.md
index 07fbb4c41a..f5c449cd27 100644
--- a/docs/tmux-backend.md
+++ b/docs/tmux-backend.md
@@ -34,6 +34,7 @@ Each task window is named `fm-<id>`.
 Firstmate names its own window `firstmate` at session start through `bin/fm-label-self.sh`, so the supervisor is identifiable beside those worker windows.
 The name is pinned with `automatic-rename` and `allow-rename` off, exactly like a task window, so an agent's terminal-title rewrite cannot replace it.
 A secondmate home is refused: its own window is named `fm-<secondmate-id>` and the main Firstmate reaches it by that name.
+A window that is already named `fm-<id>` is refused too, because that window is a worker endpoint; the current name is read with `display-message -p '#{window_name}'` and an unreadable name is refused rather than renamed.
 
 ```sh
 tmux list-windows -t <session-name>
diff --git a/tests/fm-backend-herdr.test.sh b/tests/fm-backend-herdr.test.sh
index 22432e4723..b3901aa90f 100755
--- a/tests/fm-backend-herdr.test.sh
+++ b/tests/fm-backend-herdr.test.sh
@@ -427,15 +427,13 @@ EOF
   home="$TMP_ROOT/container-migrate-home"; mkdir -p "$home"
   printf '{"client":{"version":"0.7.1","protocol":14}}\n' > "$resp/1.out"
   printf '{"server":{"running":true}}\n' > "$resp/2.out"
-  # 3-4: the migration sees the legacy workspace holding a real task tab...
+  # 3-4: ONE container resolution sees the legacy workspace holding a real task
+  # tab, and 5 is the rename it feeds (silent). The migration and the ensure
+  # share that single resolution, so there is deliberately no second
+  # `workspace list` here to answer - the same id is used whether or not the
+  # rename landed, which is the safety property under test.
   printf '{"result":{"workspaces":[{"workspace_id":"wLegacy","label":"firstmate"}]}}\n' > "$resp/3.out"
   printf '{"result":{"tabs":[{"tab_id":"wLegacy:t2","label":"fm-old-task"}]}}\n' > "$resp/4.out"
-  # 5: ...renames it (silent), then 6-7: workspace_find re-reads. The canned
-  # fake does not model the rename, so find still sees the legacy label - which
-  # is exactly the safety property under test: the same id is adopted whether or
-  # not the rename landed.
-  printf '{"result":{"workspaces":[{"workspace_id":"wLegacy","label":"firstmate"}]}}\n' > "$resp/6.out"
-  printf '{"result":{"tabs":[{"tab_id":"wLegacy:t2","label":"fm-old-task"}]}}\n' > "$resp/7.out"
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_HERDR_SCRIPT_STATUS=1 FM_HOME="$home" HERDR_SESSION=fmtest \
     bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_container_ensure /tmp' "$ROOT" )
   [ "$out" = $'fmtest:wLegacy\t' ] || fail "the spawn path must keep using the SAME pre-existing workspace id, got '$out'"
@@ -443,7 +441,9 @@ EOF
     "container_ensure did not converge the legacy crew-workspace label"
   assert_not_contains "$(cat "$log")" $'\x1f''workspace'$'\x1f''create' \
     "a home with a pre-existing crew workspace must not gain a second one"
-  pass "fm_backend_herdr_container_ensure: a home with tasks under the old label keeps ONE container and the same workspace id"
+  [ "$(grep -c $'\x1f''workspace'$'\x1f''list' "$log")" -eq 1 ] \
+    || fail "the migration and the ensure must share ONE workspace list, got $(grep -c $'\x1f''workspace'$'\x1f''list' "$log")"
+  pass "fm_backend_herdr_container_ensure: a home with tasks under the old label keeps ONE container and the same workspace id, from one shared lookup"
 }
 
 # --- fm_backend_herdr_label_self: firstmate's own tab -----------------------
@@ -496,6 +496,95 @@ EOF
   pass "fm_backend_herdr_label_self: refuses rather than guessing when its own endpoint is unidentifiable"
 }
 
+test_current_self_label_reads_the_callers_own_tab_label() {
+  local fb log resp home out
+  IFS='|' read -r fb log resp <<EOF
+$(herdr_find_fixture current-self-label)
+EOF
+  home="$TMP_ROOT/current-self-label-home"; mkdir -p "$home"
+  printf '{"result":{"tabs":[{"tab_id":"wC:t1","label":"fm-live-task"},{"tab_id":"wN:t3","label":"1"}]}}\n' > "$resp/1.out"
+  out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_HOME="$home" \
+    HERDR_TAB_ID=wC:t1 \
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_current_self_label' "$ROOT" )
+  [ "$out" = "fm-live-task" ] || fail "current_self_label must report the caller's OWN tab label, got '$out'"
+  assert_not_contains "$(cat "$log")" $'\x1f''tab'$'\x1f''rename' "reading the current label must mutate nothing"
+  pass "fm_backend_herdr_current_self_label: reports the label the caller's own tab carries right now"
+}
+
+test_current_self_label_refuses_an_unreadable_label() {
+  local fb log resp home out status
+  IFS='|' read -r fb log resp <<EOF
+$(herdr_find_fixture current-self-label-unreadable)
+EOF
+  home="$TMP_ROOT/current-self-label-unreadable-home"; mkdir -p "$home"
+  printf '{"result":{"tabs":[{"tab_id":"wOther:t9","label":"1"}]}}\n' > "$resp/1.out"
+  out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_HOME="$home" \
+    HERDR_TAB_ID=wC:t1 \
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_current_self_label' "$ROOT" 2>&1 )
+  status=$?
+  [ "$status" -ne 0 ] || fail "a tab whose label cannot be read must refuse, not report an empty label its caller would read as unlabeled"
+  assert_contains "$out" "could not read the current label" "current_self_label did not report why it refused"
+  pass "fm_backend_herdr_current_self_label: refuses when it cannot read its own tab's label, so its caller can fail closed"
+}
+
+# The exact 2026-07-26 incident shape, inverted: a crewmate working in a
+# firstmate-repo worktree runs bin/fm-session-start.sh too, and its home has no
+# secondmate marker and resolves the same "firstmate" label, so every other
+# refusal passes. Without the current-label guard this would rename a live
+# fm-<task-id> tab out of the namespace fm_backend_herdr_list_live scans.
+label_self_script() {  # <fakebin> <log> <resp> <home> [env...] -> stdout
+  local fb=$1 log=$2 resp=$3 home=$4
+  shift 4
+  env -u TMUX -u TMUX_PANE -u CMUX_WORKSPACE_ID \
+    PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
+    FM_HOME="$home" FM_ROOT_OVERRIDE="$ROOT" FM_SELF_LABEL=firstmate \
+    HERDR_ENV=1 "$@" "$ROOT/bin/fm-label-self.sh" 2>&1
+}
+
+test_label_self_script_leaves_a_worker_endpoint_tab_alone() {
+  local fb log resp home out
+  IFS='|' read -r fb log resp <<EOF
+$(herdr_find_fixture label-self-script-worker)
+EOF
+  home="$TMP_ROOT/label-self-script-worker-home"; mkdir -p "$home"
+  printf '{"result":{"tabs":[{"tab_id":"wC:t1","label":"fm-crew-pane-identity-guardrails"}]}}\n' > "$resp/1.out"
+  out=$(label_self_script "$fb" "$log" "$resp" "$home" HERDR_TAB_ID=wC:t1)
+  assert_contains "$out" "already a worker endpoint" \
+    "a crewmate's own tab must be refused with a plain note, never silently skipped"
+  assert_not_contains "$(cat "$log")" $'\x1f''tab'$'\x1f''rename' \
+    "renaming a live fm-<task-id> tab drops the task out of label-matched recovery and must never happen"
+  pass "fm-label-self.sh: refuses an endpoint that is already a worker endpoint, leaving its fm- label intact"
+}
+
+test_label_self_script_still_labels_an_unlabeled_endpoint() {
+  local fb log resp home out
+  IFS='|' read -r fb log resp <<EOF
+$(herdr_find_fixture label-self-script-positional)
+EOF
+  home="$TMP_ROOT/label-self-script-positional-home"; mkdir -p "$home"
+  printf '{"result":{"tabs":[{"tab_id":"wN:t3","label":"1"}]}}\n' > "$resp/1.out"
+  out=$(label_self_script "$fb" "$log" "$resp" "$home" HERDR_TAB_ID=wN:t3)
+  [ -z "$out" ] || fail "a successful labeling is silent, got: $out"
+  assert_contains "$(cat "$log")" $'\x1f''tab'$'\x1f''rename'$'\x1f''wN:t3'$'\x1f''firstmate' \
+    "the new guard must not refuse everything: a bare positional tab is still firstmate's own front door"
+  pass "fm-label-self.sh: still labels a genuinely unlabeled captain-launched endpoint"
+}
+
+test_label_self_script_fails_closed_on_an_unreadable_label() {
+  local fb log resp home out
+  IFS='|' read -r fb log resp <<EOF
+$(herdr_find_fixture label-self-script-unreadable)
+EOF
+  home="$TMP_ROOT/label-self-script-unreadable-home"; mkdir -p "$home"
+  printf '{"result":{"tabs":[]}}\n' > "$resp/1.out"
+  out=$(label_self_script "$fb" "$log" "$resp" "$home" HERDR_TAB_ID=wN:t3)
+  assert_contains "$out" "could not read what this terminal tab is currently called" \
+    "an unreadable current label must be reported, not treated as safe"
+  assert_not_contains "$(cat "$log")" $'\x1f''tab'$'\x1f''rename' \
+    "an unreadable current label is not evidence the endpoint is safe to rename"
+  pass "fm-label-self.sh: fails closed when it cannot read what the endpoint is currently called"
+}
+
 # --- fm_backend_herdr_cli: session targeting (2026-07-02 incident fix) -------
 
 test_cli_helper_sets_env_and_appends_trailing_session_flag() {
@@ -524,13 +613,13 @@ test_container_ensure_starts_server_and_workspace() {
   # 3: `herdr server` backgrounded launch - no meaningful output
   # 4: server_ensure poll -> now running
   printf '{"server":{"running":true}}\n' > "$resp/4.out"
-  # 5: the legacy-label migration's workspace list -> empty (nothing to migrate)
+  # 5: the ONE shared container resolution's workspace list -> empty (nothing to
+  # migrate, and no crew workspace yet); the migration and the ensure both read
+  # that single answer.
   printf '{"result":{"workspaces":[]}}\n' > "$resp/5.out"
-  # 6: workspace_find's workspace list -> empty (no crew workspace yet)
-  printf '{"result":{"workspaces":[]}}\n' > "$resp/6.out"
-  # 7: workspace create -> w1, seeding default tab w1:t9 (real herdr returns
+  # 6: workspace create -> w1, seeding default tab w1:t9 (real herdr returns
   # the seeded tab/pane ids in the SAME response - verified empirically).
-  printf '{"result":{"workspace":{"workspace_id":"w1","label":"firstmate-crew"},"tab":{"tab_id":"w1:t9"},"root_pane":{"pane_id":"w1:p9"}}}\n' > "$resp/7.out"
+  printf '{"result":{"workspace":{"workspace_id":"w1","label":"firstmate-crew"},"tab":{"tab_id":"w1:t9"},"root_pane":{"pane_id":"w1:p9"}}}\n' > "$resp/6.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_HERDR_SCRIPT_STATUS=1 HERDR_SESSION=fmtest \
     bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_container_ensure /tmp' "$ROOT" )
@@ -812,10 +901,10 @@ test_container_ensure_creates_with_no_focus_flag() {
   dir="$TMP_ROOT/container-no-focus"; mkdir -p "$dir/responses"; log="$dir/log"; resp="$dir/responses"; : > "$log"
   printf '{"client":{"version":"0.7.1","protocol":14}}\n' > "$resp/1.out"
   printf '{"server":{"running":true}}\n' > "$resp/2.out"
-  # 3: the legacy-label migration's list, 4: workspace_find's list.
+  # 3: the ONE shared container resolution's list, feeding both the migration
+  # and the ensure. 4: workspace create.
   printf '{"result":{"workspaces":[]}}\n' > "$resp/3.out"
-  printf '{"result":{"workspaces":[]}}\n' > "$resp/4.out"
-  printf '{"result":{"workspace":{"workspace_id":"w1","label":"firstmate-crew"},"tab":{"tab_id":"w1:t1"},"root_pane":{"pane_id":"w1:p1"}}}\n' > "$resp/5.out"
+  printf '{"result":{"workspace":{"workspace_id":"w1","label":"firstmate-crew"},"tab":{"tab_id":"w1:t1"},"root_pane":{"pane_id":"w1:p1"}}}\n' > "$resp/4.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_HERDR_SCRIPT_STATUS=1 HERDR_SESSION=fmtest \
     bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_container_ensure /tmp' "$ROOT" )
@@ -3260,6 +3349,11 @@ test_container_ensure_migrates_then_adopts_the_legacy_workspace
 test_label_self_renames_its_own_tab_from_the_injected_tab_id
 test_label_self_resolves_the_tab_from_the_pane_when_only_the_pane_is_injected
 test_label_self_refuses_outside_a_herdr_pane
+test_current_self_label_reads_the_callers_own_tab_label
+test_current_self_label_refuses_an_unreadable_label
+test_label_self_script_leaves_a_worker_endpoint_tab_alone
+test_label_self_script_still_labels_an_unlabeled_endpoint
+test_label_self_script_fails_closed_on_an_unreadable_label
 test_cli_helper_sets_env_and_appends_trailing_session_flag
 test_container_ensure_starts_server_and_workspace
 test_container_ensure_reuses_existing_workspace
diff --git a/tests/fm-backend-tmux-smoke.test.sh b/tests/fm-backend-tmux-smoke.test.sh
index be600a8816..bfc180e2bc 100755
--- a/tests/fm-backend-tmux-smoke.test.sh
+++ b/tests/fm-backend-tmux-smoke.test.sh
@@ -193,6 +193,30 @@ tmux set-option -g allow-rename off >/dev/null 2>&1 || true
 tmux set-window-option -g automatic-rename off >/dev/null 2>&1 || true
 pass "real tmux: fm_backend_tmux_label_self labels firstmate's own window, refuses outside tmux, and the label survives a harness terminal-title rewrite"
 
+# A crewmate runs bin/fm-session-start.sh too, and in a firstmate-repo worktree
+# every other refusal passes - so the ONE thing standing between the self-label
+# step and a renamed live worker window is reading the name it already carries.
+WORKER_PANE=$(tmux new-window -dP -F '#{pane_id}' -t "$SESSION:" -n fm-smoke-worker sh) \
+  || fail "could not create the worker-endpoint probe window"
+[ -n "$WORKER_PANE" ] || fail "could not resolve the worker-endpoint probe pane id"
+
+WORKER_LABEL=$(TMUX="fake,1,0" TMUX_PANE="$WORKER_PANE" fm_backend_tmux_current_self_label) \
+  || fail "fm_backend_tmux_current_self_label failed against real tmux"
+[ "$WORKER_LABEL" = fm-smoke-worker ] \
+  || fail "fm_backend_tmux_current_self_label must report the window's real current name, got '$WORKER_LABEL'"
+
+SELF_OUT=$(env TMUX="fake,1,0" TMUX_PANE="$WORKER_PANE" FM_SELF_LABEL=firstmate \
+  FM_HOME="$SHIM_DIR" FM_ROOT_OVERRIDE="$ROOT" "$ROOT/bin/fm-label-self.sh" 2>&1)
+case "$SELF_OUT" in
+  *"already a worker endpoint"*) : ;;
+  *) fail "fm-label-self.sh must refuse a window that is already a worker endpoint"$'\n'"$SELF_OUT" ;;
+esac
+WORKER_NAME=$(tmux display-message -p -t "$WORKER_PANE" '#{window_name}')
+[ "$WORKER_NAME" = fm-smoke-worker ] \
+  || fail "a live fm-<id> worker window was renamed to '$WORKER_NAME'; that drops the task out of label-matched recovery"
+tmux kill-window -t "$WORKER_PANE" >/dev/null 2>&1 || true
+pass "real tmux: fm_backend_tmux_current_self_label reads the real window name, and fm-label-self.sh leaves an fm-<id> worker window alone"
+
 # --- kill and recovery-grade missing-window classification ------------------
 
 fm_backend_tmux_kill "$TARGET"
diff --git a/tests/fm-backend.test.sh b/tests/fm-backend.test.sh
index 8400c0249e..23199369dd 100755
--- a/tests/fm-backend.test.sh
+++ b/tests/fm-backend.test.sh
@@ -466,6 +466,21 @@ test_label_self_dispatch_reports_unsupported_backends() {
   pass "fm_backend_label_self: backends with no verified self-label operation report the limitation instead of faking it"
 }
 
+# The read half of the same operation. bin/fm-label-self.sh fails CLOSED on it,
+# so a backend that cannot read the caller's own current label must return
+# non-zero rather than an empty-but-successful answer that would read as
+# "unlabeled, safe to rename".
+test_current_self_label_dispatch_reports_unsupported_backends() {
+  local backend out
+  for backend in zellij orca cmux; do
+    out=$(fm_backend_current_self_label "$backend" 2>&1) \
+      && fail "fm_backend_current_self_label must refuse the $backend backend"
+    assert_contains "$out" "no verified way to read firstmate's own endpoint label" \
+      "fm_backend_current_self_label did not explain the $backend limitation"
+  done
+  pass "fm_backend_current_self_label: backends with no verified way to read their own label refuse instead of reporting an empty one"
+}
+
 test_backend_validate_refuses_unknown() {
   fm_backend_validate tmux 2>/dev/null || fail "fm_backend_validate should accept tmux"
   fm_backend_validate orca 2>/dev/null || fail "fm_backend_validate should accept orca"
@@ -1116,6 +1131,7 @@ test_backend_name_autodetect_notice
 test_backend_name_explicit_beats_detection
 test_backend_validate_refuses_unknown
 test_label_self_dispatch_reports_unsupported_backends
+test_current_self_label_dispatch_reports_unsupported_backends
 test_backend_source_shell_portable
 test_backend_validate_spawn_accepts_orca
 test_meta_get_and_backend_of_meta
diff --git a/tests/fm-brief.test.sh b/tests/fm-brief.test.sh
index eed091a5e1..3513b469c2 100755
--- a/tests/fm-brief.test.sh
+++ b/tests/fm-brief.test.sh
@@ -338,8 +338,16 @@ test_crewmate_scaffolds_carry_the_pane_identity_contract() {
     # which is the wrong shape for an action that is already finished.
     assert_grep "working: acted outside this brief" "$brief" \
       "$id: the override record must use the nonterminal working: verb"
+    # ...but firstmate reconciles state from the LAST status line
+    # (bin/fm-crew-state.sh's map_log_state), so an override recorded AFTER the
+    # task already reported done: must reuse that terminal verb instead, or the
+    # record would reopen a finished task. Both branches must be present.
+    assert_grep "done: acted outside this brief" "$brief" \
+      "$id: the override record must have an already-finished branch that keeps the terminal verb"
+    assert_grep "COMMON case" "$brief" \
+      "$id: the brief must say the already-done pane is the common case, so the terminal branch is the one usually applied"
   done
-  pass "fm-brief.sh: ship and scout scaffolds require a crewmate to identify itself and to durably record a captain override"
+  pass "fm-brief.sh: ship and scout scaffolds require a crewmate to identify itself and to durably record a captain override under the right verb"
 }
 
 # The recorded override line must actually fold the way the brief claims: a
@@ -359,6 +367,25 @@ test_override_record_classifies_as_a_nonterminal_phase() {
   pass "fm-classify-lib: a captain-override record folds as a nonterminal phase and never as an unresolved blocker"
 }
 
+# The ordering the mid-task branch above does NOT cover, and the common one: the
+# captain drops into a pane that already reported done:, so the override record
+# lands LAST. Under the terminal-verb branch it must still fold clean - no open
+# decision, and no open activity the crewmate has no further verb left to close.
+test_override_record_after_done_folds_clean() {
+  local status_file open_decisions open_activities
+  status_file="$TMP_ROOT/override-classify-after-done.status"
+  mkdir -p "$TMP_ROOT"
+  {
+    printf 'done: fix implemented\n'
+    printf 'done: acted outside this brief on captain instruction - merged PR 42 in another lane; task deliverable unchanged\n'
+  } > "$status_file"
+  open_decisions=$(bash -c '. "$0/bin/fm-classify-lib.sh"; status_open_decisions "$1"' "$ROOT" "$status_file")
+  [ -z "$open_decisions" ] || fail "an override recorded after done: must not open a decision: $open_decisions"
+  open_activities=$(bash -c '. "$0/bin/fm-classify-lib.sh"; status_open_activities "$1"' "$ROOT" "$status_file")
+  [ -z "$open_activities" ] || fail "an override recorded after done: must leave no activity nothing can close: $open_activities"
+  pass "fm-classify-lib: an override recorded after the task already finished leaves nothing open"
+}
+
 test_pause_verb_override_renders_all_brief_scaffolds() {
   local home kind id brief
   home="$TMP_ROOT/pause-verb-home"
@@ -449,5 +476,6 @@ test_secondmate_marked_request_reporting_contract
 test_pause_verb_override_renders_all_brief_scaffolds
 test_crewmate_scaffolds_carry_the_pane_identity_contract
 test_override_record_classifies_as_a_nonterminal_phase
+test_override_record_after_done_folds_clean
 test_scout_and_secondmate_load_decision_hold_policy
 test_scout_and_secondmate_scaffold
diff --git a/tests/fm-crew-state.test.sh b/tests/fm-crew-state.test.sh
index bc0161d624..31721e9948 100755
--- a/tests/fm-crew-state.test.sh
+++ b/tests/fm-crew-state.test.sh
@@ -877,6 +877,31 @@ test_no_run_idle_pane_uses_log() {
   pass "no run + idle pane uses the status-log verb"
 }
 
+# The captain-override record bin/fm-brief.sh rule 9 requires lands on an
+# already-idle, already-done pane in the common case, and a scout has no
+# no-mistakes run to override this fallback path. Because map_log_state
+# reconciles from the LAST status line, that record must reuse the task's own
+# terminal verb: a bare `working:` appended after `done:` would report a
+# finished task as working again, which is exactly the stale-records failure the
+# rule exists to prevent.
+test_override_record_after_done_keeps_the_task_done() {
+  reset_fakes
+  local d; d=$(new_case override-after-done)
+  make_repo_on_branch "$d/wt" fm/feat-override
+  make_fakebin "$d" >/dev/null
+  fm_write_meta "$d/state/feat-override.meta" "window=fm:fm-feat-override" "worktree=$d/wt" "kind=scout"
+  {
+    printf 'done: reproduced the bug and wrote the report\n'
+    printf 'done: acted outside this brief on captain instruction - merged PR 42 in another lane; task deliverable unchanged\n'
+  } > "$d/state/feat-override.status"
+  FM_FAKE_AXI_STATUS=""
+  FM_FAKE_BUSY=0
+  local out; out=$(run_crew_state "$d" feat-override)
+  assert_contains "$out" "state: done" "an override recorded after done: must not reopen a finished task"
+  assert_contains "$out" "acted outside this brief" "the override record must stay visible to firstmate"
+  pass "a captain-override record appended after done: keeps the task done and stays visible"
+}
+
 test_no_run_idle_pane_uses_keyed_log() {
   reset_fakes
   local d; d=$(new_case keyed-idle)
@@ -1261,6 +1286,7 @@ test_no_run_herdr_unknown_uses_backend_capture
 test_no_run_herdr_idle_agent_status_corroborated_by_busy_pane
 test_no_run_herdr_idle_agent_status_and_idle_pane_stays_idle
 test_no_run_idle_pane_uses_log
+test_override_record_after_done_keeps_the_task_done
 test_no_run_idle_pane_uses_keyed_log
 test_no_run_idle_pane_paused
 test_no_run_idle_pane_custom_paused_verb
diff --git a/tests/fm-session-start.test.sh b/tests/fm-session-start.test.sh
index 2164cf5188..41b1b20eb4 100755
--- a/tests/fm-session-start.test.sh
+++ b/tests/fm-session-start.test.sh
@@ -1404,6 +1404,93 @@ EOF
   pass "fm-label-self.sh: refuses to put firstmate's own endpoint in the reserved fm- task namespace"
 }
 
+# make_fake_tmux_window: a `tmux` stub that reports <name> as the caller's own
+# window name and logs every invocation, so the self-label step can be driven
+# without a real tmux server. The window id lookup and the name lookup are the
+# same `display-message -p` call shape bin/backends/tmux.sh uses.
+make_fake_tmux_window() {  # <fakebin> <window-name> <log>
+  local fakebin=$1 name=$2 log=$3
+  cat > "$fakebin/tmux" <<SH
+#!/usr/bin/env bash
+set -u
+printf '%s\n' "\$*" >> "$log"
+if [ "\${1:-}" = display-message ]; then
+  case " \$* " in
+    *'#{window_id}'*) printf '@7\n' ;;
+    *'#{window_name}'*) printf '%s\n' '$name' ;;
+  esac
+fi
+exit 0
+SH
+  chmod +x "$fakebin/tmux"
+}
+
+# The exact 2026-07-26 incident shape, inverted: a crewmate or scout in a
+# firstmate-repo worktree runs bin/fm-session-start.sh too, its home carries no
+# secondmate marker, and the resolved label is plain "firstmate" - so every
+# other refusal passes and only reading the CURRENT label stops this step from
+# renaming a live worker endpoint out of the fm- namespace recovery scans.
+test_label_self_refuses_an_endpoint_that_is_already_a_worker() {
+  local rec root home fakebin out log
+  rec=$(new_world label-self-worker)
+  IFS='|' read -r root home fakebin <<EOF
+$rec
+EOF
+  : "$root"
+  log="$home/tmux.log"
+  make_fake_tmux_window "$fakebin" "fm-crew-pane-identity-guardrails" "$log"
+  out=$(label_self "$home" PATH="$fakebin:$BASE_PATH" TMUX=fake,1,0 TMUX_PANE=%0)
+  case "$out" in
+    *"already a worker endpoint"*) : ;;
+    *) fail "a worker endpoint must be refused with a plain note, not renamed"$'\n'"$out" ;;
+  esac
+  case "$(cat "$log" 2>/dev/null)" in
+    *rename-window*) fail "renaming a live fm-<task-id> endpoint drops the task out of label-matched recovery"$'\n'"$(cat "$log")" ;;
+  esac
+  pass "fm-label-self.sh: leaves an endpoint that already carries an fm- worker label alone"
+}
+
+# The guard must not pass by refusing everything: a genuinely positional,
+# captain-launched endpoint is still labeled.
+test_label_self_labels_a_positional_endpoint() {
+  local rec root home fakebin out log
+  rec=$(new_world label-self-positional)
+  IFS='|' read -r root home fakebin <<EOF
+$rec
+EOF
+  : "$root"
+  log="$home/tmux.log"
+  make_fake_tmux_window "$fakebin" "1" "$log"
+  out=$(label_self "$home" PATH="$fakebin:$BASE_PATH" TMUX=fake,1,0 TMUX_PANE=%0)
+  [ -z "$out" ] || fail "a successful labeling is silent, got: $out"
+  case "$(cat "$log" 2>/dev/null)" in
+    *"rename-window -t @7 firstmate"*) : ;;
+    *) fail "firstmate's own positional endpoint must still be labeled"$'\n'"$(cat "$log" 2>/dev/null)" ;;
+  esac
+  pass "fm-label-self.sh: still labels a genuinely unlabeled, captain-launched endpoint"
+}
+
+# An unreadable current label is not evidence the endpoint is safe to rename.
+test_label_self_fails_closed_on_an_unreadable_current_label() {
+  local rec root home fakebin out log
+  rec=$(new_world label-self-unreadable)
+  IFS='|' read -r root home fakebin <<EOF
+$rec
+EOF
+  : "$root"
+  log="$home/tmux.log"
+  make_fake_tmux_window "$fakebin" "" "$log"
+  out=$(label_self "$home" PATH="$fakebin:$BASE_PATH" TMUX=fake,1,0 TMUX_PANE=%0)
+  case "$out" in
+    *"could not read what this terminal tab is currently called"*) : ;;
+    *) fail "an unreadable current name must be reported, not treated as safe"$'\n'"$out" ;;
+  esac
+  case "$(cat "$log" 2>/dev/null)" in
+    *rename-window*) fail "the self-label step must fail closed when it cannot read the current name" ;;
+  esac
+  pass "fm-label-self.sh: fails closed when the endpoint's current name cannot be read"
+}
+
 test_label_self_reports_an_unlabelable_runtime() {
   local rec root home fakebin out
   rec=$(new_world label-self-noruntime)
@@ -1445,6 +1532,9 @@ EOF
 test_context_digest_absent_empty_present
 test_label_self_refuses_in_a_secondmate_home
 test_label_self_refuses_a_task_namespace_label
+test_label_self_refuses_an_endpoint_that_is_already_a_worker
+test_label_self_labels_a_positional_endpoint
+test_label_self_fails_closed_on_an_unreadable_current_label
 test_label_self_reports_an_unlabelable_runtime
 test_session_start_runs_the_self_label_step
 test_lock_refusal_read_only_path

From f5526e8b01767f7cb52e691edb1b7e3bc2de0667 Mon Sep 17 00:00:00 2001
From: Shane Bracewell <sbracewell64@gmail.com>
Date: Sun, 26 Jul 2026 11:44:03 -0400
Subject: [PATCH 3/6] no-mistakes(test): test(herdr): read primary workspace
 label from adapter constant

---
 .../fm-backend-herdr-presentation-e2e.test.sh | 30 ++++++++++++-------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/tests/fm-backend-herdr-presentation-e2e.test.sh b/tests/fm-backend-herdr-presentation-e2e.test.sh
index 194d2053ce..1526914035 100755
--- a/tests/fm-backend-herdr-presentation-e2e.test.sh
+++ b/tests/fm-backend-herdr-presentation-e2e.test.sh
@@ -34,6 +34,14 @@ mkdir -p "$FAKEBIN"
 : > "$MOVE_CALL_LOG"
 : > "$FOCUS_AUDIT_LOG"
 REAL_MOVER="$ROOT/bin/backends/herdr-workspace-move.py"
+# The PRIMARY home's own crew-workspace label, read from its single owner
+# (bin/backends/herdr.sh) rather than restated here, so a future rename cannot
+# leave this suite asserting a label the adapter no longer creates. Only the
+# TOP-LEVEL primary parent uses it; the "firstmate/<id> · p:<token>" LEGACY
+# projection-child labels below are a different, deliberately unaliased format
+# (see fm_backend_herdr_projection_order_best_effort's is_legacy_child note).
+PRIMARY_LABEL=$(bash -c '. "$0/bin/backends/herdr.sh"; printf %s "$FM_BACKEND_HERDR_PRIMARY_LABEL"' "$ROOT")
+[ -n "$PRIMARY_LABEL" ] || { echo "not ok - could not resolve the primary crew-workspace label" >&2; exit 1; }
 export REAL_HERDR REAL_TREEHOUSE REAL_MOVER HERDR_CALL_LOG TREEHOUSE_CALL_LOG MOVE_CALL_LOG FOCUS_AUDIT_LOG HERDR_ORIGINAL_PATH HERDR_LAB_HELPER
 export ACTIVE_SEEDED_CONTROL POST_CREATE_ABORT_CONTROL TMP_ROOT
 
@@ -682,9 +690,9 @@ remember_meta_worktree "$ORDER_B_META" >/dev/null
 
 ORDER_LIST=$(lab workspace list) || fail "could not inspect concurrent presentation ordering"
 CREATED_LABELS=$(projection_labels_from_log "$PROJECTION_ORDER_START")
-EXPECTED_LABELS=$(printf 'firstmate\n%s\n%s\n2ndmate-alpha\n2ndmate-bravo' "$PROJECTED_LABEL" "$CREATED_LABELS")
+EXPECTED_LABELS=$(printf '%s\n%s\n%s\n2ndmate-alpha\n2ndmate-bravo' "$PRIMARY_LABEL" "$PROJECTED_LABEL" "$CREATED_LABELS")
 ACTUAL_LABELS=$(printf '%s' "$ORDER_LIST" | jq -r '.result.workspaces[].label')
-[ "$ACTUAL_LABELS" = "$EXPECTED_LABELS" ] || fail "workspace order was not firstmate, stable primary block, secondmates: $ACTUAL_LABELS"
+[ "$ACTUAL_LABELS" = "$EXPECTED_LABELS" ] || fail "workspace order was not $PRIMARY_LABEL, stable primary block, secondmates: $ACTUAL_LABELS"
 PRIMARY_IDS=$(printf '%s' "$ORDER_LIST" | jq -r '
   .result.workspaces[]
   | select((.label | startswith("└ ")) or (.label | startswith("firstmate/")))
@@ -830,8 +838,8 @@ for ROUND in 1 2 3; do
   assert_focus_is "$CAPTAIN_FOCUS" "focus wave $ROUND concurrent spawns"
   assert_raw_presentation_mutations_preserved_since "$WAVE_FOCUS_START" "focus wave $ROUND concurrent spawns"
   WAVE_LABELS=$(projection_labels_from_log "$WAVE_LOG_START")
-  WAVE_EXPECTED=$(printf 'firstmate\n%s\n2ndmate-alpha\n2ndmate-bravo' "$WAVE_LABELS")
-  WAVE_ACTUAL=$(lab workspace list | jq -r '.result.workspaces[] | select(.label == "firstmate" or (.label | startswith("└ ")) or (.label | startswith("2ndmate-"))) | .label')
+  WAVE_EXPECTED=$(printf '%s\n%s\n2ndmate-alpha\n2ndmate-bravo' "$PRIMARY_LABEL" "$WAVE_LABELS")
+  WAVE_ACTUAL=$(lab workspace list | jq -r --arg primary "$PRIMARY_LABEL" '.result.workspaces[] | select(.label == $primary or (.label | startswith("└ ")) or (.label | startswith("2ndmate-"))) | .label')
   [ "$WAVE_ACTUAL" = "$WAVE_EXPECTED" ] \
     || fail "focus wave $ROUND lost stable contiguous ordering: $WAVE_ACTUAL"
   WAVE_SECOND_ORDER=$(lab workspace list | jq -r '.result.workspaces[] | select(.label | startswith("2ndmate-")) | .workspace_id')
@@ -846,7 +854,7 @@ for ROUND in 1 2 3; do
   wait "$WAVE_B_TEARDOWN_PID" || fail "focus wave $ROUND teardown B failed"
   assert_focus_is "$CAPTAIN_FOCUS" "focus wave $ROUND concurrent teardowns"
   WAVE_REMAINING=$(lab workspace list | jq -r '.result.workspaces[].label')
-  [ "$WAVE_REMAINING" = $'firstmate\n2ndmate-alpha\n2ndmate-bravo' ] \
+  [ "$WAVE_REMAINING" = "$(printf '%s\n2ndmate-alpha\n2ndmate-bravo' "$PRIMARY_LABEL")" ] \
     || fail "focus wave $ROUND cleanup left a projected workspace behind: $WAVE_REMAINING"
 done
 pass "real Herdr lab: three repeated concurrent create/order/cleanup waves have zero active workspace or tab drift"
@@ -966,10 +974,10 @@ case "$B1_LABEL" in $'└ b1 · p:'*) ;; *) fail "secondmate B b1 label wrong: $
 case "$B2_LABEL" in $'└ b2 · p:'*) ;; *) fail "secondmate B b2 label wrong: $B2_LABEL" ;; esac
 
 MULTI_LIST=$(lab workspace list) || fail "could not list multi-home topology"
-MULTI_LABELS=$(printf '%s' "$MULTI_LIST" | jq -r '
+MULTI_LABELS=$(printf '%s' "$MULTI_LIST" | jq -r --arg primary "$PRIMARY_LABEL" '
   .result.workspaces[]
   | select(
-      .label == "firstmate"
+      .label == $primary
       or .label == "2ndmate-alpha"
       or .label == "2ndmate-bravo"
       or (.label | startswith("└ "))
@@ -977,7 +985,7 @@ MULTI_LABELS=$(printf '%s' "$MULTI_LIST" | jq -r '
   | .label
 ')
 MULTI_EXPECTED=$(printf '%s\n' \
-  firstmate "$P1_LABEL" "$P2_LABEL" \
+  "$PRIMARY_LABEL" "$P1_LABEL" "$P2_LABEL" \
   2ndmate-alpha "$A1_LABEL" "$A2_LABEL" \
   2ndmate-bravo "$B1_LABEL" "$B2_LABEL")
 [ "$MULTI_LABELS" = "$MULTI_EXPECTED" ] \
@@ -1005,8 +1013,8 @@ remember_meta_worktree "$SECOND_HOME_B/state/bcw.meta" >/dev/null
 assert_focus_is "$CAPTAIN_FOCUS" "cross-home concurrent wave"
 assert_raw_presentation_mutations_preserved_since "$WAVE_CROSS_FOCUS" "cross-home concurrent wave"
 CROSS_LIST=$(lab workspace list)
-printf '%s' "$CROSS_LIST" | jq -e '
-  ([.result.workspaces[].label] | index("firstmate")) as $fm
+printf '%s' "$CROSS_LIST" | jq -e --arg primary "$PRIMARY_LABEL" '
+  ([.result.workspaces[].label] | index($primary)) as $fm
   | ([.result.workspaces[].label] | index("2ndmate-alpha")) as $a
   | ([.result.workspaces[].label] | index("2ndmate-bravo")) as $b
   | $fm != null and $a != null and $b != null
@@ -1015,7 +1023,7 @@ printf '%s' "$CROSS_LIST" | jq -e '
 PCW_LABEL=$(lab workspace get "$(grep '^herdr_workspace_id=' "$HOME_DIR/state/pcw.meta" | cut -d= -f2-)" | jq -r '.result.workspace.label')
 ACW_LABEL=$(lab workspace get "$(grep '^herdr_workspace_id=' "$SECOND_HOME_A/state/acw.meta" | cut -d= -f2-)" | jq -r '.result.workspace.label')
 BCW_LABEL=$(lab workspace get "$(grep '^herdr_workspace_id=' "$SECOND_HOME_B/state/bcw.meta" | cut -d= -f2-)" | jq -r '.result.workspace.label')
-case "$PCW_LABEL" in $'└ pcw · p:'*|firstmate) ;; *) fail "cross-home primary label wrong: $PCW_LABEL" ;; esac
+case "$PCW_LABEL" in $'└ pcw · p:'*|"$PRIMARY_LABEL") ;; *) fail "cross-home primary label wrong: $PCW_LABEL" ;; esac
 case "$ACW_LABEL" in $'└ acw · p:'*|2ndmate-alpha) ;; *) fail "cross-home A label wrong: $ACW_LABEL" ;; esac
 case "$BCW_LABEL" in $'└ bcw · p:'*|2ndmate-bravo) ;; *) fail "cross-home B label wrong: $BCW_LABEL" ;; esac
 pass "real Herdr lab: concurrent primary/A/B spawns preserve parent order and exact focus"

From 8cdb429b3eb6621fc43a983da1535f8759bf24ed Mon Sep 17 00:00:00 2001
From: Shane Bracewell <sbracewell64@gmail.com>
Date: Sun, 26 Jul 2026 12:12:06 -0400
Subject: [PATCH 4/6] no-mistakes(document): docs: correct herdr crew-workspace
 label and self-label facts

---
 docs/architecture.md                  | 2 +-
 docs/cmux-backend.md                  | 1 +
 docs/configuration.md                 | 4 +++-
 docs/scripts.md                       | 1 +
 docs/verification/runtime-backends.md | 5 +++++
 5 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/docs/architecture.md b/docs/architecture.md
index d1bbb1c1ff..89d0db47cb 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -101,7 +101,7 @@ That poll loop is the default event source for backends with no native push even
 For capable Herdr sessions, the same watcher replaces its terminal sleep with a bounded native event wait that immediately surfaces `blocked`; [Push events and polling fallback](herdr-backend.md#push-events-and-polling-fallback) owns the current mechanism and capability gates, while [runtime backend verification](verification/runtime-backends.md#native-blocked-event) owns the active evidence.
 The deeper session-start agent-process liveness probe is separate from that busy-state poll: tmux and Herdr have verified classifiers for secondmate recovery, Zellij remains unverified, and Orca and cmux do not support secondmate spawns.
 Herdr is experimental and can be selected explicitly or by runtime auto-detection: Treehouse remains its worktree provider, [`herdr-backend.md`](herdr-backend.md) owns current setup and safety limits, and [`verification/runtime-backends.md`](verification/runtime-backends.md#herdr) owns active empirical evidence.
-Herdr's durable default container shape is workspace-per-home plus tab-per-task: the primary home uses workspace label `firstmate`, secondmate homes use `2ndmate-<secondmate-id>`, and recovery/list-live scopes to the current `FM_HOME`'s workspace.
+Herdr's durable default container shape is workspace-per-home plus tab-per-task: the primary home uses workspace label `firstmate-crew`, secondmate homes use `2ndmate-<secondmate-id>`, and recovery/list-live scopes to the current `FM_HOME`'s workspace.
 Its optional default-off presentation projection may place one clean new task in a disposable workspace without changing endpoint authority or lifecycle ownership; [Optional presentation spaces](herdr-backend.md#optional-presentation-spaces) owns that conditional design and its narrow home-local restored-shell cleanup at locked session start.
 Zellij is experimental and selected only explicitly: Treehouse remains its worktree provider, [`zellij-backend.md`](zellij-backend.md) owns current setup and limits, and [`verification/runtime-backends.md`](verification/runtime-backends.md#zellij) owns active empirical evidence.
 Zellij's container shape is simpler than herdr's: one shared `firstmate` session, one tab per task, with no per-home workspace split; visible tab titles are scoped by the active home label plus a short hash of the resolved `FM_ROOT` path.
diff --git a/docs/cmux-backend.md b/docs/cmux-backend.md
index 4bd438bc74..fd72226bea 100644
--- a/docs/cmux-backend.md
+++ b/docs/cmux-backend.md
@@ -119,6 +119,7 @@ Real tests share the captain's running app rather than creating an isolated cmux
 - The only-workspace cleanup path leaves a fresh default workspace and cannot close the window.
 - Label lookup and recovery are currently scoped to the current cmux window, so a task moved to a non-current window is a known recovery blind spot.
 - Workspace ids do not survive app relaunch and are never recovery authority.
+- Firstmate cannot label its own cmux workspace, so session start reports that limitation once instead of renaming anything.
 
 ## Regression entry points
 
diff --git a/docs/configuration.md b/docs/configuration.md
index 896b98ae31..591903960b 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -78,7 +78,8 @@ A metadata-routed selector returns the recorded backend target (`terminal=` for
 Only metadata-routed task selectors carry secondmate-marker and Codex-harness context; explicit endpoint escape hatches do not.
 These five sentences are the single owner of the task-selector vocabulary; backend guides and other documents point here instead of restating the resolution order.
 `fm-teardown.sh <id>` takes a task id directly and uses the same recorded backend target fields after loading `state/<id>.meta`.
-By default, Herdr workspaces are derived from `FM_HOME`: the primary home uses `firstmate`, and a secondmate home marked by `.fm-secondmate-home` uses `2ndmate-<secondmate-id>`.
+By default, Herdr workspaces are derived from `FM_HOME`: the primary home uses `firstmate-crew`, and a secondmate home marked by `.fm-secondmate-home` uses `2ndmate-<secondmate-id>`.
+[`herdr-backend.md`](herdr-backend.md#watching-and-task-containers) owns those labels and the automatic in-place migration of a workspace still carrying the earlier `firstmate` label.
 The default-container spawn, list-live, and recovery paths read that label from the active home, so a secondmate's own crewmates stay inside that secondmate home's herdr space.
 The optional local `config/herdr-presentation-spaces` presence flag instead enables Herdr's default-off disposable single-task visual projection; [Optional presentation spaces](herdr-backend.md#optional-presentation-spaces) owns its behavior, safety limits, recovery contract, and narrow locked session-start cleanup of exact restored idle-shell children.
 The flag is default-off and inherited into secondmate homes under the primary-authoritative contract owned by [`secondmate-provisioning`](../.agents/skills/secondmate-provisioning/SKILL.md).
@@ -384,6 +385,7 @@ FM_BACKEND_CMUX_COMPOSER_LINES=20  # cmux-only: tail lines scanned to locate the
 FM_BACKEND_CMUX_IDLE_RE='^Type a message\.\.\.$'  # cmux-only: empty-composer placeholder regex after border/prompt stripping
 CMUX_SOCKET_PASSWORD=   # cmux-only: socket password fallback when config/cmux-socket-password is absent (docs/cmux-backend.md)
 FM_SESSION_START_STATUS_TAIL=5   # state/*.status lines printed per task in the session-start digest
+FM_SELF_LABEL=firstmate   # label bin/fm-label-self.sh gives firstmate's own tmux window or Herdr tab at session start; set it empty to switch self-labeling off
 FM_BOOTSTRAP_DETECT_ONLY=0   # internal/read-only session-start mode: skip bootstrap's mutating sweeps and print advisory TANGLE wording
 FM_GUARD_READ_ONLY=0    # internal/read-only guard mode: keep alarms but suppress drain, supervision repair, and checkout repair commands
 FM_GUARD_CONTINUE_LINE='This is a supervision warning only; the guarded operation WILL still run.'   # banner continuation line; fm-send.sh overrides it to name the requested message specifically
diff --git a/docs/scripts.md b/docs/scripts.md
index 6a10d1310a..c7901e7f23 100644
--- a/docs/scripts.md
+++ b/docs/scripts.md
@@ -9,6 +9,7 @@ The shared no-mistakes gate refusal for fleet lifecycle entrypoints is summarize
 | ------------------------ | ------------------------------------------------------------------------------------ |
 | `fm-session-start.sh`    | Compose lock, bootstrap, and wake drain into the single ordered session-start digest |
 | `fm-sessionstart-nudge.sh` | Print the native session-start hook nudge when the primary has not already run the digest |
+| `fm-label-self.sh`       | Give firstmate's own terminal endpoint a standing label, refusing every worker endpoint |
 | `fm-operational-input.sh` | Construct and parse the canonical cross-language operational-input protocol |
 | `fm-bootstrap.sh`        | Detect toolchain and fleet problems, run the locked session-start sweeps, and install approved tools |
 | `fm-fleet-sync.sh`       | Refresh project clones with safe fast-forwards, self-heals, `STUCK:` reports, branch pruning, and bounded recovery from an orphaned `.git/packed-refs.lock` |
diff --git a/docs/verification/runtime-backends.md b/docs/verification/runtime-backends.md
index 0c154c9760..bf1c00922a 100644
--- a/docs/verification/runtime-backends.md
+++ b/docs/verification/runtime-backends.md
@@ -32,6 +32,10 @@ Claude, Codex, OpenCode, and Grok were observed under their own process names.
 Kimi Code CLI 0.29.1 was observed under `kimi` on 2026-07-25.
 Pi remained a generic `node` process and is intentionally inconclusive.
 
+Window-name persistence was verified on 2026-07-26 with tmux 3.6a on a private socket.
+`rename-window` alone already turned `automatic-rename` off for that window, and the new name survived a continuous application OSC 2 title rewrite under default options and under `allow-rename on` plus global `automatic-rename on`.
+`tests/fm-backend-tmux-smoke.test.sh` pins that persistence for firstmate's own window label, together with the refusal to rename a window that already carries an `fm-<id>` worker name.
+
 The structural multi-row composer reader, Kimi pointer-delivery path, and OpenCode 1.18.4 busy-queue behavior are pinned by:
 
 ```sh
@@ -75,6 +79,7 @@ The CLI matrix was checked directly:
 | Native state | `herdr agent get <pane>` | Working and done transitions were visible; long foreground tool waits required rendered-busy corroboration. |
 | Restart | guarded named-session stop then start | Workspace, tab, pane, and labels persisted; the agent process and registration did not. |
 | Close | `herdr pane close <pane> --session <name>` | The exact one-pane task tab closed; closing a final tab could remove the workspace. |
+| Label independence | `herdr pane get <pane>` | A live agent pane reported its continuously rewritten `terminal_title` as a field separate from its tab `label`, which still carried its spawn-time `fm-<id>` name, so an explicitly set tab label persists. |
 
 All destructive verification used `bin/fm-herdr-lab.sh` with a non-default `fm-lab-` name and a byte-identical default-session tripwire.
 No ambient `herdr server stop` command is a supported test operation.

From 8bab78f89faefd5ea9167d98f7c062ca041176b2 Mon Sep 17 00:00:00 2001
From: Shane Bracewell <sbracewell64@gmail.com>
Date: Sun, 26 Jul 2026 12:39:44 -0400
Subject: [PATCH 5/6] no-mistakes(review): resolve self endpoint once and fail
 closed without TMUX_PANE

---
 bin/backends/herdr.sh               | 32 ++++++++++++++----
 bin/backends/tmux.sh                | 51 +++++++++++++++++++++--------
 bin/fm-backend.sh                   | 35 ++++++++++++++++++--
 bin/fm-label-self.sh                | 40 +++++++++++++++++++---
 docs/herdr-backend.md               |  1 +
 docs/tmux-backend.md                |  2 ++
 tests/fm-backend-herdr.test.sh      |  8 +++--
 tests/fm-backend-tmux-smoke.test.sh | 32 ++++++++++++++++++
 tests/fm-backend.test.sh            | 16 +++++++++
 9 files changed, 188 insertions(+), 29 deletions(-)

diff --git a/bin/backends/herdr.sh b/bin/backends/herdr.sh
index 5dbdfbacce..50ec379294 100644
--- a/bin/backends/herdr.sh
+++ b/bin/backends/herdr.sh
@@ -255,6 +255,11 @@ fm_backend_herdr_session() {
 # a `pane get` on HERDR_PANE_ID for a herdr build that injects only the pane.
 # Neither is a lookup by label, so this never touches another tab.
 #
+# <tab-id> is an optional pre-resolved fm_backend_herdr_self_tab_id result.
+# bin/fm-label-self.sh passes the SAME id it read the current label from, so the
+# refusal and the rename can never land on two different tabs. Omitting it
+# resolves inline, which is what the standalone/test call shape does.
+#
 # Verified (herdr 0.7.5, real default session, read-only `pane get` on a live
 # Claude crewmate pane): herdr tracks a pane's `terminal_title` - the OSC title
 # the harness rewrites continuously - as a field SEPARATE from its tab `label`.
@@ -263,11 +268,16 @@ fm_backend_herdr_session() {
 # an explicitly set tab label is not overwritten by the harness. That is the
 # same property firstmate's whole label-based recovery
 # (fm_backend_herdr_list_live) already depends on.
-fm_backend_herdr_label_self() {  # <label>
+fm_backend_herdr_label_self() {  # <label> [tab-id]
   local label=$1 session tab
   [ -n "$label" ] || { echo "error: fm_backend_herdr_label_self needs a label" >&2; return 1; }
   fm_backend_herdr_tool_check || return 1
-  tab=$(fm_backend_herdr_self_tab_id) || return 1
+  if [ "$#" -ge 2 ]; then
+    tab=$2
+    [ -n "$tab" ] || { echo "error: fm_backend_herdr_label_self was given an empty tab id" >&2; return 1; }
+  else
+    tab=$(fm_backend_herdr_self_tab_id) || return 1
+  fi
   session=$(fm_backend_herdr_session)
   fm_backend_herdr_cli "$session" tab rename "$tab" "$label" >/dev/null 2>&1 \
     || { echo "error: herdr tab rename failed for $tab" >&2; return 1; }
@@ -276,8 +286,10 @@ fm_backend_herdr_label_self() {  # <label>
 
 # fm_backend_herdr_self_tab_id: the tab id the CALLER ITSELF is running in,
 # resolved from herdr's own injected HERDR_TAB_ID and falling back to a `pane
-# get` on HERDR_PANE_ID. Shared by the two self-endpoint operations so both
-# address exactly the same tab, and so neither ever resolves one by label.
+# get` on HERDR_PANE_ID. The single resolution both self-endpoint operations
+# address their tab through, so neither ever resolves one by label. Both inputs
+# are process-stable, so this never answers with some other tab the way a
+# client-relative "current tab" lookup could.
 fm_backend_herdr_self_tab_id() {
   local session tab
   session=$(fm_backend_herdr_session)
@@ -300,10 +312,18 @@ fm_backend_herdr_self_tab_id() {
 # fm_backend_herdr_resolve_bare_selector already uses: the caller's own tab is
 # in whatever workspace the captain happened to launch it in, which is exactly
 # the workspace this home's own container lookup does NOT resolve.
-fm_backend_herdr_current_self_label() {
+#
+# <tab-id> is the same optional pre-resolved fm_backend_herdr_self_tab_id
+# result fm_backend_herdr_label_self takes.
+fm_backend_herdr_current_self_label() {  # [tab-id]
   local session tab tabs label
   fm_backend_herdr_tool_check || return 1
-  tab=$(fm_backend_herdr_self_tab_id) || return 1
+  if [ "$#" -ge 1 ]; then
+    tab=$1
+    [ -n "$tab" ] || { echo "error: fm_backend_herdr_current_self_label was given an empty tab id" >&2; return 1; }
+  else
+    tab=$(fm_backend_herdr_self_tab_id) || return 1
+  fi
   session=$(fm_backend_herdr_session)
   tabs=$(fm_backend_herdr_cli "$session" tab list 2>/dev/null) \
     || { echo "error: herdr tab list failed for session $session" >&2; return 1; }
diff --git a/bin/backends/tmux.sh b/bin/backends/tmux.sh
index b67c3df3b9..8bb27ed796 100644
--- a/bin/backends/tmux.sh
+++ b/bin/backends/tmux.sh
@@ -98,8 +98,13 @@ fm_backend_tmux_create_task() {  # <session> <window-name> <proj-abs> -> prints
 # firstmate's own pane has a standing front door instead of tmux's positional
 # default name. Called only through bin/fm-label-self.sh, which owns the
 # refusals that make this safe (never in a secondmate home, never an fm-<id>
-# label). The window is resolved from tmux's own $TMUX_PANE, falling back to
-# the client's current window, so this never targets a task window by name.
+# label). The window is resolved from tmux's own $TMUX_PANE, so this never
+# targets a task window by name.
+#
+# <window-id> is an optional pre-resolved fm_backend_tmux_self_window_id
+# result. bin/fm-label-self.sh passes the SAME id it read the current name from,
+# so the refusal and the rename can never land on two different windows.
+# Omitting it resolves inline, which is what the standalone/test call shape does.
 #
 # The name is pinned exactly like fm_backend_tmux_create_task pins a task
 # window: verified with real tmux 3.6a on a private socket that `rename-window`
@@ -108,10 +113,15 @@ fm_backend_tmux_create_task() {  # <session> <window-name> <proj-abs> -> prints
 # under a hostile `allow-rename on` + global `automatic-rename on` config; the
 # two explicit set-window-option calls are the same defense in depth the task
 # path uses.
-fm_backend_tmux_label_self() {  # <label>
+fm_backend_tmux_label_self() {  # <label> [window-id]
   local label=$1 wid
   [ -n "$label" ] || { echo "error: fm_backend_tmux_label_self needs a label" >&2; return 1; }
-  wid=$(fm_backend_tmux_self_window_id) || return 1
+  if [ "$#" -ge 2 ]; then
+    wid=$2
+    [ -n "$wid" ] || { echo "error: fm_backend_tmux_label_self was given an empty window id" >&2; return 1; }
+  else
+    wid=$(fm_backend_tmux_self_window_id) || return 1
+  fi
   tmux rename-window -t "$wid" "$label" 2>/dev/null || { echo "error: tmux rename-window failed for $wid" >&2; return 1; }
   tmux set-window-option -t "$wid" automatic-rename off 2>/dev/null || true
   tmux set-window-option -t "$wid" allow-rename off 2>/dev/null || true
@@ -119,17 +129,22 @@ fm_backend_tmux_label_self() {  # <label>
 }
 
 # fm_backend_tmux_self_window_id: the window id of the window the CALLER ITSELF
-# runs in, resolved from tmux's own $TMUX_PANE and falling back to the client's
-# current window. Shared by the two self-endpoint operations so both address
-# exactly the same window, and so neither ever resolves one by label.
+# runs in, resolved from tmux's own $TMUX_PANE. The single resolution both
+# self-endpoint operations address their window through, so neither ever
+# resolves one by label.
+#
+# There is deliberately NO fallback to the client-relative
+# `tmux display-message -p '#{window_id}'`: that answers with the ATTACHED
+# CLIENT's CURRENT window, which is not the caller's own window and can be any
+# window in the session - including a live fm-<task-id> worker's. Renaming that
+# is precisely the mislabel the self-label refusals exist to prevent, so without
+# $TMUX_PANE the caller's own window is treated as unidentifiable and this FAILS
+# CLOSED, exactly like an unreadable current name.
 fm_backend_tmux_self_window_id() {
   local wid
   [ -n "${TMUX:-}" ] || { echo "error: not running inside tmux (\$TMUX is unset)" >&2; return 1; }
-  if [ -n "${TMUX_PANE:-}" ]; then
-    wid=$(tmux display-message -p -t "$TMUX_PANE" '#{window_id}' 2>/dev/null)
-  else
-    wid=$(tmux display-message -p '#{window_id}' 2>/dev/null)
-  fi
+  [ -n "${TMUX_PANE:-}" ] || { echo "error: \$TMUX_PANE is unset, so this process's own tmux window cannot be identified" >&2; return 1; }
+  wid=$(tmux display-message -p -t "$TMUX_PANE" '#{window_id}' 2>/dev/null)
   [ -n "$wid" ] || { echo "error: could not resolve this tmux pane's own window id" >&2; return 1; }
   printf '%s' "$wid"
 }
@@ -138,9 +153,17 @@ fm_backend_tmux_self_window_id() {
 # right now, or a failure with an explanation. bin/fm-label-self.sh reads this
 # before renaming anything and fails closed on an error, so an unreadable name
 # must never be reported as an empty-but-successful one.
-fm_backend_tmux_current_self_label() {
+#
+# <window-id> is the same optional pre-resolved
+# fm_backend_tmux_self_window_id result fm_backend_tmux_label_self takes.
+fm_backend_tmux_current_self_label() {  # [window-id]
   local wid name
-  wid=$(fm_backend_tmux_self_window_id) || return 1
+  if [ "$#" -ge 1 ]; then
+    wid=$1
+    [ -n "$wid" ] || { echo "error: fm_backend_tmux_current_self_label was given an empty window id" >&2; return 1; }
+  else
+    wid=$(fm_backend_tmux_self_window_id) || return 1
+  fi
   name=$(tmux display-message -p -t "$wid" '#{window_name}' 2>/dev/null) \
     || { echo "error: tmux display-message failed for $wid" >&2; return 1; }
   [ -n "$name" ] || { echo "error: could not read the current name of tmux window $wid" >&2; return 1; }
diff --git a/bin/fm-backend.sh b/bin/fm-backend.sh
index d545cd124e..41534683b7 100644
--- a/bin/fm-backend.sh
+++ b/bin/fm-backend.sh
@@ -584,6 +584,30 @@ fm_backend_kill() {  # <backend> <target>
   esac
 }
 
+# fm_backend_self_endpoint_id: the id of the terminal endpoint the CALLER ITSELF
+# occupies - a tmux window id, a herdr tab id - resolved from the backend's own
+# process-stable ambient markers ($TMUX_PANE, HERDR_TAB_ID/HERDR_PANE_ID) and
+# never from a label lookup or a client-relative "current" lookup, which would
+# answer with whatever endpoint an attached client happens to be focused on.
+#
+# This exists so bin/fm-label-self.sh resolves its own endpoint EXACTLY ONCE and
+# hands that one id to both fm_backend_current_self_label and
+# fm_backend_label_self: two independent resolutions could disagree, letting the
+# fm-<task-id> refusal pass on one endpoint while the rename lands on another -
+# the very mislabel those refusals exist to prevent. It returns non-zero rather
+# than an empty id when the caller's own endpoint cannot be identified, so the
+# caller fails closed and renames nothing.
+fm_backend_self_endpoint_id() {  # <backend>
+  local backend=$1
+  shift
+  fm_backend_source "$backend" || return 1
+  case "$backend" in
+    tmux) fm_backend_tmux_self_window_id "$@" ;;
+    herdr) fm_backend_herdr_self_tab_id "$@" ;;
+    *) echo "error: backend '$backend' has no verified way to identify firstmate's own endpoint" >&2; return 1 ;;
+  esac
+}
+
 # fm_backend_label_self: label the terminal endpoint FIRSTMATE ITSELF occupies,
 # so the supervisor is identifiable at a glance next to the fm-<task-id> worker
 # endpoints it spawns. This is the only backend operation whose target is the
@@ -592,7 +616,10 @@ fm_backend_kill() {  # <backend> <target>
 # bin/fm-label-self.sh is the sole caller and owns the safety refusals.
 # Only the two runtime-auto-detected backends implement it; the rest report the
 # limitation rather than pretending to have labeled anything.
-fm_backend_label_self() {  # <backend> <label>
+#
+# <endpoint-id> is an optional pre-resolved fm_backend_self_endpoint_id result,
+# passed straight through to the arm.
+fm_backend_label_self() {  # <backend> <label> [endpoint-id]
   local backend=$1
   shift
   fm_backend_source "$backend" || return 1
@@ -615,7 +642,11 @@ fm_backend_label_self() {  # <backend> <label>
 # and returns non-zero rather than an empty label when it cannot read one, so
 # the caller can fail closed. Only the two runtime-auto-detected backends
 # implement it, matching fm_backend_label_self exactly.
-fm_backend_current_self_label() {  # <backend>
+#
+# <endpoint-id> is the same optional pre-resolved fm_backend_self_endpoint_id
+# result fm_backend_label_self takes; passing the one id to both is what makes
+# the refusal and the rename address the same endpoint.
+fm_backend_current_self_label() {  # <backend> [endpoint-id]
   local backend=$1
   shift
   fm_backend_source "$backend" || return 1
diff --git a/bin/fm-label-self.sh b/bin/fm-label-self.sh
index c6ebc34dda..9f06659bce 100755
--- a/bin/fm-label-self.sh
+++ b/bin/fm-label-self.sh
@@ -33,6 +33,13 @@
 #   - Any label starting with `fm-` is refused, because that prefix is the
 #     reserved task-endpoint namespace: herdr's recovery scan treats every
 #     fm-* tab in a home's workspace as a live task.
+#   - An endpoint that cannot be IDENTIFIED is refused. The caller's own
+#     endpoint is resolved exactly once, through fm_backend_self_endpoint_id,
+#     and that one id is handed to both the current-label read and the rename:
+#     two separate resolutions could disagree, so the refusal below could pass
+#     on one endpoint while the rename landed on another. A backend whose
+#     ambient markers cannot name the caller's own endpoint reports that and
+#     renames nothing.
 #   - An endpoint that ALREADY carries an fm- label is refused. A crewmate or
 #     scout working in a firstmate-repo worktree runs bin/fm-session-start.sh
 #     too, and its home has no secondmate marker and resolves the same
@@ -96,13 +103,38 @@ fi
 RUNTIME=$(fm_backend_detect 2>/dev/null) || RUNTIME=""
 [ -n "$RUNTIME" ] || note "this firstmate is not running inside a terminal runtime that can label its own tab."
 
-CURRENT=$(fm_backend_current_self_label "$RUNTIME" 2>&1) || \
-  note "could not read what this terminal tab is currently called in $RUNTIME, so it was left alone rather than risk renaming a worker endpoint. ${CURRENT:-no detail reported}"
+# stderr is captured to its own file rather than folded into the command
+# substitution: the value below is what the `fm-*` worker-endpoint refusal
+# matches on, and a warning printed alongside a successful read would otherwise
+# prepend text to it, break the prefix match, and let this step rename a live
+# worker endpoint. A missing sink degrades to dropping the explanatory detail,
+# never to mixing it into the label.
+ERRFILE=$(mktemp "${TMPDIR:-/tmp}/fm-label-self-detail.XXXXXX" 2>/dev/null) || ERRFILE=""
+ERRSINK=${ERRFILE:-/dev/null}
+trap '[ -z "$ERRFILE" ] || rm -f "$ERRFILE"' EXIT
+
+# The captured stderr of the last call, collapsed to one line so a note stays a
+# single line.
+detail() {
+  local text=""
+  [ -n "$ERRFILE" ] && [ -s "$ERRFILE" ] && text=$(tr '\n' ' ' < "$ERRFILE")
+  printf '%s' "${text:-no detail reported}"
+}
+
+# Resolve the caller's OWN endpoint exactly once and address both the read and
+# the rename below through that one id, so a refusal can never pass on one
+# endpoint while the rename lands on another.
+ENDPOINT=$(fm_backend_self_endpoint_id "$RUNTIME" 2>"$ERRSINK") || ENDPOINT=""
+[ -n "$ENDPOINT" ] || \
+  note "could not work out which $RUNTIME terminal tab this firstmate is running in, so nothing was renamed. $(detail)"
+
+CURRENT=$(fm_backend_current_self_label "$RUNTIME" "$ENDPOINT" 2>"$ERRSINK") || \
+  note "could not read what this terminal tab is currently called in $RUNTIME, so it was left alone rather than risk renaming a worker endpoint. $(detail)"
 case "$CURRENT" in
   fm-*) note "this terminal tab is already a worker endpoint called '$CURRENT', so it was left alone: that is the name firstmate reaches its crew by, and this pane is not firstmate." ;;
 esac
 
-OUT=$(fm_backend_label_self "$RUNTIME" "$LABEL" 2>&1) || \
-  note "could not label this firstmate's own terminal tab in $RUNTIME; it keeps its previous name. ${OUT:-no detail reported}"
+fm_backend_label_self "$RUNTIME" "$LABEL" "$ENDPOINT" >/dev/null 2>"$ERRSINK" || \
+  note "could not label this firstmate's own terminal tab in $RUNTIME; it keeps its previous name. $(detail)"
 
 exit 0
diff --git a/docs/herdr-backend.md b/docs/herdr-backend.md
index 3a3cfc04b1..d9495a9364 100644
--- a/docs/herdr-backend.md
+++ b/docs/herdr-backend.md
@@ -44,6 +44,7 @@ Firstmate labels its own tab `firstmate` at session start through `bin/fm-label-
 An explicitly set tab label is independent of the pane's `terminal_title`, which the harness rewrites continuously, so the label persists.
 A secondmate home is refused: its own tab is labeled `fm-<secondmate-id>` and the main Firstmate reaches it by that label.
 A tab that already carries an `fm-` label is refused too, because that tab is a worker endpoint and renaming it would drop the task out of the label-matched recovery scan; the current label is read with `tab list` and an unreadable label is refused rather than renamed.
+The tab is resolved once from `HERDR_TAB_ID`, or from a `pane get` on `HERDR_PANE_ID`, and that one tab id is used for both the label read and the rename, so the refusal and the rename can never address different tabs.
 
 Attach to the selected named Herdr session and switch to the relevant home workspace to watch its task tabs.
 Routine supervision uses `bin/fm-peek.sh <id>` and `FM_HOME=<home> bin/fm-send.sh <id> '<text>'` without attaching.
diff --git a/docs/tmux-backend.md b/docs/tmux-backend.md
index f5c449cd27..412c9405ec 100644
--- a/docs/tmux-backend.md
+++ b/docs/tmux-backend.md
@@ -35,6 +35,8 @@ Firstmate names its own window `firstmate` at session start through `bin/fm-labe
 The name is pinned with `automatic-rename` and `allow-rename` off, exactly like a task window, so an agent's terminal-title rewrite cannot replace it.
 A secondmate home is refused: its own window is named `fm-<secondmate-id>` and the main Firstmate reaches it by that name.
 A window that is already named `fm-<id>` is refused too, because that window is a worker endpoint; the current name is read with `display-message -p '#{window_name}'` and an unreadable name is refused rather than renamed.
+The window is resolved from `$TMUX_PANE` exactly once, and that one window id is used for both the name read and the rename, so the refusal and the rename can never address different windows.
+Without `$TMUX_PANE` the caller's own window is not identifiable at all: a client-relative `display-message -p '#{window_id}'` answers with the attached client's current window, which may be any window in the session, so self-labeling refuses instead of naming a bystander.
 
 ```sh
 tmux list-windows -t <session-name>
diff --git a/tests/fm-backend-herdr.test.sh b/tests/fm-backend-herdr.test.sh
index b3901aa90f..55dc2c4b69 100755
--- a/tests/fm-backend-herdr.test.sh
+++ b/tests/fm-backend-herdr.test.sh
@@ -637,16 +637,18 @@ test_container_ensure_reuses_existing_workspace() {
   dir="$TMP_ROOT/container-reuse"; mkdir -p "$dir/responses"; log="$dir/log"; resp="$dir/responses"; : > "$log"
   printf '{"client":{"version":"0.7.1","protocol":14}}\n' > "$resp/1.out"
   printf '{"server":{"running":true}}\n' > "$resp/2.out"
-  # 3: the migration's list already shows the canonical label, so it is a no-op.
+  # 3: the ONE shared container resolution's list already shows the canonical
+  # label, so the migration is a no-op and the ensure adopts w9 from that same
+  # answer - there is deliberately no second `workspace list` to stage.
   printf '{"result":{"workspaces":[{"workspace_id":"w9","label":"firstmate-crew"}]}}\n' > "$resp/3.out"
-  # 4: workspace_find's own list.
-  printf '{"result":{"workspaces":[{"workspace_id":"w9","label":"firstmate-crew"}]}}\n' > "$resp/4.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_HERDR_SCRIPT_STATUS=1 HERDR_SESSION=fmtest \
     bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_container_ensure /tmp' "$ROOT" )
   [ "$out" = $'fmtest:w9\t' ] || fail "container_ensure should reuse the existing crew workspace id with an EMPTY seeded-tab field (an ADOPTED workspace is never a prune candidate), got '$out'"
   assert_not_contains "$(cat "$log")" $'\x1f''workspace'$'\x1f''create' "container_ensure should not create a workspace that already exists"
   assert_not_contains "$(cat "$log")" $'\x1f''workspace'$'\x1f''rename' "container_ensure must not rename a workspace that already carries the canonical label"
+  [ "$(grep -c $'\x1f''workspace'$'\x1f''list' "$log")" -eq 1 ] \
+    || fail "the migration and the ensure must share ONE workspace list, got $(grep -c $'\x1f''workspace'$'\x1f''list' "$log")"
   pass "fm_backend_herdr_container_ensure: reuses an existing crew workspace without recreating it, and reports no seeded default tab (adopted, not created)"
 }
 
diff --git a/tests/fm-backend-tmux-smoke.test.sh b/tests/fm-backend-tmux-smoke.test.sh
index bfc180e2bc..9266c6dd67 100755
--- a/tests/fm-backend-tmux-smoke.test.sh
+++ b/tests/fm-backend-tmux-smoke.test.sh
@@ -217,6 +217,38 @@ WORKER_NAME=$(tmux display-message -p -t "$WORKER_PANE" '#{window_name}')
 tmux kill-window -t "$WORKER_PANE" >/dev/null 2>&1 || true
 pass "real tmux: fm_backend_tmux_current_self_label reads the real window name, and fm-label-self.sh leaves an fm-<id> worker window alone"
 
+# Without $TMUX_PANE the caller's own window is not identifiable: tmux's
+# client-relative default target answers with whatever window is CURRENT, which
+# can be any window in the session - here a live fm-<id> worker. A resolution
+# that guessed it could pass the fm- refusal against one window and rename
+# another, so both self operations must refuse instead of naming a bystander.
+BYSTANDER_PANE=$(tmux new-window -dP -F '#{pane_id}' -t "$SESSION:" -n fm-smoke-bystander sh) \
+  || fail "could not create the bystander worker-endpoint probe window"
+tmux select-window -t "$BYSTANDER_PANE" >/dev/null 2>&1 \
+  || fail "could not focus the bystander window as the session's current window"
+
+if TMUX="fake,1,0" TMUX_PANE='' fm_backend_tmux_self_window_id 2>/dev/null; then
+  fail "fm_backend_tmux_self_window_id must refuse when \$TMUX_PANE is unset instead of answering with the client's current window"
+fi
+if TMUX="fake,1,0" TMUX_PANE='' fm_backend_tmux_current_self_label 2>/dev/null; then
+  fail "fm_backend_tmux_current_self_label must refuse when \$TMUX_PANE is unset"
+fi
+if TMUX="fake,1,0" TMUX_PANE='' fm_backend_tmux_label_self firstmate 2>/dev/null; then
+  fail "fm_backend_tmux_label_self must refuse when \$TMUX_PANE is unset"
+fi
+
+SELF_OUT=$(env -u TMUX_PANE TMUX="fake,1,0" FM_SELF_LABEL=firstmate \
+  FM_HOME="$SHIM_DIR" FM_ROOT_OVERRIDE="$ROOT" "$ROOT/bin/fm-label-self.sh" 2>&1)
+case "$SELF_OUT" in
+  *"could not work out which tmux terminal tab"*) : ;;
+  *) fail "fm-label-self.sh must report that it could not identify its own window"$'\n'"$SELF_OUT" ;;
+esac
+BYSTANDER_NAME=$(tmux display-message -p -t "$BYSTANDER_PANE" '#{window_name}')
+[ "$BYSTANDER_NAME" = fm-smoke-bystander ] \
+  || fail "the client's current window was renamed to '$BYSTANDER_NAME'; a window nobody identified as the caller's own must never be labeled"
+tmux kill-window -t "$BYSTANDER_PANE" >/dev/null 2>&1 || true
+pass "real tmux: with \$TMUX_PANE unset the self operations fail closed and the client's current window keeps its name"
+
 # --- kill and recovery-grade missing-window classification ------------------
 
 fm_backend_tmux_kill "$TARGET"
diff --git a/tests/fm-backend.test.sh b/tests/fm-backend.test.sh
index 23199369dd..c5a4667422 100755
--- a/tests/fm-backend.test.sh
+++ b/tests/fm-backend.test.sh
@@ -481,6 +481,21 @@ test_current_self_label_dispatch_reports_unsupported_backends() {
   pass "fm_backend_current_self_label: backends with no verified way to read their own label refuse instead of reporting an empty one"
 }
 
+# The one resolution both halves address their endpoint through, so a refusal on
+# the current label and the rename that follows it can never land on two
+# different endpoints. A backend that cannot name the caller's own endpoint from
+# its own ambient markers must refuse rather than guess at one.
+test_self_endpoint_id_dispatch_reports_unsupported_backends() {
+  local backend out
+  for backend in zellij orca cmux; do
+    out=$(fm_backend_self_endpoint_id "$backend" 2>&1) \
+      && fail "fm_backend_self_endpoint_id must refuse the $backend backend"
+    assert_contains "$out" "no verified way to identify firstmate's own endpoint" \
+      "fm_backend_self_endpoint_id did not explain the $backend limitation"
+  done
+  pass "fm_backend_self_endpoint_id: backends that cannot identify the caller's own endpoint refuse instead of guessing at one"
+}
+
 test_backend_validate_refuses_unknown() {
   fm_backend_validate tmux 2>/dev/null || fail "fm_backend_validate should accept tmux"
   fm_backend_validate orca 2>/dev/null || fail "fm_backend_validate should accept orca"
@@ -1132,6 +1147,7 @@ test_backend_name_explicit_beats_detection
 test_backend_validate_refuses_unknown
 test_label_self_dispatch_reports_unsupported_backends
 test_current_self_label_dispatch_reports_unsupported_backends
+test_self_endpoint_id_dispatch_reports_unsupported_backends
 test_backend_source_shell_portable
 test_backend_validate_spawn_accepts_orca
 test_meta_get_and_backend_of_meta

From 0e4aaf8ff08444a8d22b185f7e149795489f564e Mon Sep 17 00:00:00 2001
From: Shane Bracewell <sbracewell64@gmail.com>
Date: Sun, 26 Jul 2026 13:05:33 -0400
Subject: [PATCH 6/6] no-mistakes(document): document self-label limits for
 zellij and orca backends

---
 docs/orca-backend.md   | 1 +
 docs/zellij-backend.md | 1 +
 2 files changed, 2 insertions(+)

diff --git a/docs/orca-backend.md b/docs/orca-backend.md
index 9812993e83..afcf56dd4c 100644
--- a/docs/orca-backend.md
+++ b/docs/orca-backend.md
@@ -69,6 +69,7 @@ It never raw-deletes an Orca worktree.
 - Escape is unsupported.
 - Orca exposes no stable CLI version or protocol marker, so readiness is the compatibility gate rather than a version floor.
 - Only the verified terminal-handle and worktree result fields are accepted; speculative response shapes are rejected.
+- Firstmate cannot label its own Orca terminal, so session start prints one plain note instead of renaming anything.
 
 ## Regression entry points
 
diff --git a/docs/zellij-backend.md b/docs/zellij-backend.md
index 367da98ebb..738209f6b0 100644
--- a/docs/zellij-backend.md
+++ b/docs/zellij-backend.md
@@ -97,6 +97,7 @@ Real test cleanup uses only an isolated non-`firstmate` session and the guard in
 - CLI exit status is not meaningful; a target can still disappear after structural readiness checks.
 - Worktree cwd discovery requires the spawn-time marker probe.
 - An ambiguous unscoped legacy title requires manual cleanup and respawn.
+- Firstmate cannot label its own Zellij tab, so session start prints one plain note instead of renaming anything.
 
 ## Regression entry points