From 1fd42e6eed5ed0f60af03f180d323c8b37aceec4 Mon Sep 17 00:00:00 2001
From: Firstmate Crew <crew@firstmate.invalid>
Date: Fri, 31 Jul 2026 19:35:38 -0400
Subject: [PATCH 01/12] fix(home): refuse an ambiently inherited FM_HOME
 instead of misrouting

FM_HOME is inherited down every launch line, so a session opened from
another home's pane carries that home's FM_HOME. Nearly every bin/fm-*.sh
opened with a copied `FM_HOME="${FM_HOME:-...}"` line that accepted the
inherited value unconditionally, with no check that it had anything to do
with where the session was running.

On 2026-07-31 that took a second mate's session lock from a session whose
working directory was the primary home, printed the mate's registry,
backlog and fleet state as the primary's, and marked three of the mate's
tasks done. Nothing detected it.

No environment variable can separate "handed to this process" from
"inherited from an ancestor": a child and a grandchild see byte-identical
environments, so a launch token is inherited exactly as far as FM_HOME is.
The one observable difference is on disk, so resolution now anchors there
and refuses rather than guessing when the working directory and FM_HOME
are both firstmate home roots naming different homes.

bin/fm-home-anchor-lib.sh is the single owner of that rule; the scripts
that carried their own copy of the resolution line now defer to it.
FM_HOME_BINDING declares a deliberate cross-home selection by naming the
home it was issued for, and fm-spawn blanks it on every launch line so it
cannot be inherited into an agent session.

The test is narrow in both directions: the working directory must BE a
home root, never merely be inside one, so a pooled task worktree and a
home's own projects/<name> clone keep the home that launched them.
---
 AGENTS.md                            |   1 +
 bin/backends/cmux.sh                 |   6 +-
 bin/backends/herdr.sh                |   6 +-
 bin/backends/zellij.sh               |   6 +-
 bin/fm-afk-launch.sh                 |  14 +-
 bin/fm-afk-return.sh                 |   6 +-
 bin/fm-afk-start.sh                  |   6 +-
 bin/fm-arm-pretool-check.sh          |  13 +-
 bin/fm-backend.sh                    |   6 +-
 bin/fm-backlog-handoff.sh            |   6 +-
 bin/fm-bootstrap.sh                  |   6 +-
 bin/fm-brief.sh                      |   7 +-
 bin/fm-check-register.sh             |   6 +-
 bin/fm-claude-stop-autoarm.sh        |   6 +-
 bin/fm-config-inherit-lib.sh         |   8 +-
 bin/fm-config-push.sh                |   6 +-
 bin/fm-crew-state.sh                 |   6 +-
 bin/fm-decision-hold.sh              |   6 +-
 bin/fm-fleet-snapshot.sh             |   6 +-
 bin/fm-fleet-sync.sh                 |   6 +-
 bin/fm-guard.sh                      |   6 +-
 bin/fm-harness.sh                    |   6 +-
 bin/fm-herdr-session-cleanup.sh      |   6 +-
 bin/fm-home-anchor-lib.sh            | 158 ++++++++++++++++++++
 bin/fm-home-seed.sh                  |   8 +-
 bin/fm-lock.sh                       |   6 +-
 bin/fm-merge-local.sh                |   6 +-
 bin/fm-peek.sh                       |   6 +-
 bin/fm-pending-reply-lib.sh          |   3 +-
 bin/fm-pr-check-migrate.sh           |   6 +-
 bin/fm-pr-check.sh                   |   6 +-
 bin/fm-pr-merge.sh                   |   6 +-
 bin/fm-primary-scope-lib.sh          |   8 +-
 bin/fm-project-mode.sh               |   6 +-
 bin/fm-promote.sh                    |   6 +-
 bin/fm-review-diff.sh                |   6 +-
 bin/fm-send.sh                       |   9 ++
 bin/fm-session-start.sh              |   6 +-
 bin/fm-sessionstart-nudge.sh         |   6 +-
 bin/fm-spawn.sh                      |  12 +-
 bin/fm-startup-memory-budget.sh      |   6 +-
 bin/fm-subagent-pretool-check.sh     |   8 +-
 bin/fm-supervise-daemon.sh           |   6 +-
 bin/fm-supervision-instructions.sh   |   6 +-
 bin/fm-teardown.sh                   |   6 +-
 bin/fm-test-run.sh                   |  11 ++
 bin/fm-turnend-guard.sh              |   6 +-
 bin/fm-update.sh                     |   6 +-
 bin/fm-wake-lib.sh                   |   6 +-
 bin/fm-watch.sh                      |   6 +-
 bin/fm-x-dismiss.sh                  |   6 +-
 bin/fm-x-followup.sh                 |   6 +-
 bin/fm-x-link.sh                     |   6 +-
 bin/fm-x-poll.sh                     |   6 +-
 bin/fm-x-reply.sh                    |   6 +-
 docs/configuration.md                |   7 +
 tests/fm-afk-return.test.sh          |   1 +
 tests/fm-backend.test.sh             |   1 +
 tests/fm-claude-stop-autoarm.test.sh |   1 +
 tests/fm-gotmp.test.sh               |   6 +
 tests/fm-home-anchor.test.sh         | 206 +++++++++++++++++++++++++++
 tests/fm-sessionstart-nudge.test.sh  |   1 +
 tests/fm-turnend-guard.test.sh       |   1 +
 tests/lib.sh                         |  16 +++
 64 files changed, 691 insertions(+), 61 deletions(-)
 create mode 100644 bin/fm-home-anchor-lib.sh
 create mode 100755 tests/fm-home-anchor.test.sh

diff --git a/AGENTS.md b/AGENTS.md
index c75eeb7759..50a5673abe 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -48,6 +48,7 @@ Never add an agent name as a commit co-author.
 
 `docs/configuration.md` is the single owner of the top-level operational-home layout and configuration schemas; each producing script's header and help own exact child fields and mutation mechanics.
 `FM_HOME` selects an instance's private `data/`, `state/`, `config/`, and `projects/`, while scripts continue to come from their tracked code root.
+`bin/fm-home-anchor-lib.sh` owns how `FM_HOME` resolves and refuses when the working directory and `FM_HOME` name different homes, so an inherited value cannot silently route a session into another home.
 Each secondmate has a persistent isolated `FM_HOME`, including its own state, backlog, projects, and session lock.
 `bin/fm-send.sh` fails closed unless `FM_HOME` is explicit, so a steer cannot silently resolve against another home.
 
diff --git a/bin/backends/cmux.sh b/bin/backends/cmux.sh
index 12dc7629eb..bd090dddfd 100644
--- a/bin/backends/cmux.sh
+++ b/bin/backends/cmux.sh
@@ -109,7 +109,11 @@
 # bin/backends/zellij.sh's identical fallback.
 FM_BACKEND_CMUX_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-${FM_ROOT:-$FM_BACKEND_CMUX_ROOT}}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$FM_BACKEND_CMUX_ROOT/bin/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 
 # shellcheck source=bin/fm-backend-hometag-lib.sh
 . "$FM_BACKEND_CMUX_ROOT/bin/fm-backend-hometag-lib.sh"
diff --git a/bin/backends/herdr.sh b/bin/backends/herdr.sh
index 237d2348c5..99ea4bf536 100644
--- a/bin/backends/herdr.sh
+++ b/bin/backends/herdr.sh
@@ -60,7 +60,11 @@
 # pre-P3 behavior when a test does not care about home-specific labeling).
 FM_BACKEND_HERDR_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-${FM_ROOT:-$FM_BACKEND_HERDR_ROOT}}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$FM_BACKEND_HERDR_ROOT/bin/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 
 # Shared composer-content classifier (empty|pending|unknown, and the fleet-wide
 # dead-shell-vs-agent-composer rule). Owned by bin/fm-composer-lib.sh, reused by
diff --git a/bin/backends/zellij.sh b/bin/backends/zellij.sh
index 20d53a3c2d..f2f575e226 100644
--- a/bin/backends/zellij.sh
+++ b/bin/backends/zellij.sh
@@ -114,7 +114,11 @@
 # below.
 FM_BACKEND_ZELLIJ_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-${FM_ROOT:-$FM_BACKEND_ZELLIJ_ROOT}}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$FM_BACKEND_ZELLIJ_ROOT/bin/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 
 # shellcheck source=bin/fm-backend-hometag-lib.sh
 . "$FM_BACKEND_ZELLIJ_ROOT/bin/fm-backend-hometag-lib.sh"
diff --git a/bin/fm-afk-launch.sh b/bin/fm-afk-launch.sh
index 3bc1a1cbac..4327d59144 100755
--- a/bin/fm-afk-launch.sh
+++ b/bin/fm-afk-launch.sh
@@ -47,7 +47,11 @@ set -u
 
 FM_AFK_LAUNCH_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$FM_AFK_LAUNCH_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$FM_AFK_LAUNCH_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 case "$FM_HOME" in
   /*) ;;
   *)
@@ -416,8 +420,8 @@ fm_afk_launch_create_herdr() {  # <captain-target> <captain-backend>
     IFS=$'\t' read -r wsid pane <<< "$recovered"
   fi
   entry=$(fm_afk_launch_entry_cmd)
-  cmd=$(printf 'exec env FM_HOME=%q FM_SUPERVISOR_TARGET=%q FM_SUPERVISOR_BACKEND=%q %q' \
-    "$FM_HOME" "$captain_target" "$captain_backend" "$entry")
+  cmd=$(printf 'exec env FM_HOME=%q FM_HOME_BINDING=%q FM_SUPERVISOR_TARGET=%q FM_SUPERVISOR_BACKEND=%q %q' \
+    "$FM_HOME" "$FM_HOME" "$captain_target" "$captain_backend" "$entry")
   if ! fm_afk_launch_record_write herdr "$session:$pane" "$wsid"; then
     fm_afk_launch_log "failed to persist herdr daemon terminal record; closing $session:$pane"
     fm_afk_launch_close_terminal herdr "$session:$pane"
@@ -443,8 +447,8 @@ fm_afk_launch_create_tmux() {  # <captain-target> <captain-backend>
   nonce="$$-${RANDOM:-0}-$(date '+%s')"
   session="fm-afk-daemon-$hash-$nonce"
   entry=$(fm_afk_launch_entry_cmd)
-  cmd=$(printf 'exec env FM_HOME=%q FM_SUPERVISOR_TARGET=%q FM_SUPERVISOR_BACKEND=%q %q' \
-    "$FM_HOME" "$captain_target" "$captain_backend" "$entry")
+  cmd=$(printf 'exec env FM_HOME=%q FM_HOME_BINDING=%q FM_SUPERVISOR_TARGET=%q FM_SUPERVISOR_BACKEND=%q %q' \
+    "$FM_HOME" "$FM_HOME" "$captain_target" "$captain_backend" "$entry")
   if ! fm_afk_launch_record_write tmux "$session" ""; then
     fm_afk_launch_log "failed to persist planned tmux daemon session '$session'"
     return 1
diff --git a/bin/fm-afk-return.sh b/bin/fm-afk-return.sh
index 316479852f..6610865d65 100755
--- a/bin/fm-afk-return.sh
+++ b/bin/fm-afk-return.sh
@@ -24,7 +24,11 @@ set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 GATE="$STATE/.afk-return-catchup"
 LOCK="$STATE/.afk-return-catchup.lock"
diff --git a/bin/fm-afk-start.sh b/bin/fm-afk-start.sh
index 532d57b7ce..8f3e8c6b74 100755
--- a/bin/fm-afk-start.sh
+++ b/bin/fm-afk-start.sh
@@ -34,7 +34,11 @@ set -eu
 
 FM_AFK_START_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$FM_AFK_START_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$FM_AFK_START_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 FM_AFK_STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 FM_AFK_LOCK="$FM_AFK_STATE/.supervise-daemon.lock"
 FM_AFK_DAEMON="$FM_AFK_START_DIR/fm-supervise-daemon.sh"
diff --git a/bin/fm-arm-pretool-check.sh b/bin/fm-arm-pretool-check.sh
index 6ac8941b95..170cb03a4c 100755
--- a/bin/fm-arm-pretool-check.sh
+++ b/bin/fm-arm-pretool-check.sh
@@ -144,7 +144,18 @@ esac
 
 SCRIPT_DIR=$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" 2>/dev/null && pwd -P) || exit 0
 ROOT=$(CDPATH='' cd -- "$SCRIPT_DIR/.." 2>/dev/null && pwd -P) || exit 0
-ACTIVE_HOME=${FM_HOME:-$ROOT}
+# FM_HOME resolution, including the refusal on an ambiently inherited home, has
+# one owner: bin/fm-home-anchor-lib.sh. When it cannot say which home this
+# session belongs to, anchor on this checkout instead of trusting the inherited
+# value: the policy then declines to recognize another home's watcher as this
+# session's own, which can only widen the deny, never narrow it.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+if fm_home_anchor_resolve "$ROOT" quiet; then
+  ACTIVE_HOME=$FM_HOME
+else
+  ACTIVE_HOME=$ROOT
+fi
 POLICY="$ROOT/bin/fm-arm-command-policy.mjs"
 
 command -v node >/dev/null 2>&1 || exit 0
diff --git a/bin/fm-backend.sh b/bin/fm-backend.sh
index e505b99f75..f654d253f3 100644
--- a/bin/fm-backend.sh
+++ b/bin/fm-backend.sh
@@ -51,7 +51,11 @@ FM_BACKEND_LIB_DIR="$(cd "$(dirname "$FM_BACKEND_SCRIPT")" && pwd)"
 unset FM_BACKEND_SCRIPT
 FM_BACKEND_DEFAULT_ROOT="$(cd "$FM_BACKEND_LIB_DIR/.." && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-${FM_ROOT:-$FM_BACKEND_DEFAULT_ROOT}}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$FM_BACKEND_LIB_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 FM_BACKEND_CONFIG_DIR="${FM_CONFIG_OVERRIDE:-$FM_HOME/config}"
 
 # Verified backend adapters. Extend only after a backend gets its own
diff --git a/bin/fm-backlog-handoff.sh b/bin/fm-backlog-handoff.sh
index 66da67b8a8..c179314e5a 100755
--- a/bin/fm-backlog-handoff.sh
+++ b/bin/fm-backlog-handoff.sh
@@ -47,7 +47,11 @@ set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 DATA="${FM_DATA_OVERRIDE:-$FM_HOME/data}"
 REG="$DATA/secondmates.md"
 MAIN_BACKLOG="$DATA/backlog.md"
diff --git a/bin/fm-bootstrap.sh b/bin/fm-bootstrap.sh
index 16102adfa4..fbb6c543b7 100755
--- a/bin/fm-bootstrap.sh
+++ b/bin/fm-bootstrap.sh
@@ -90,7 +90,11 @@ set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 PROJECTS="${FM_PROJECTS_OVERRIDE:-$FM_HOME/projects}"
 CONFIG="${FM_CONFIG_OVERRIDE:-$FM_HOME/config}"
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
diff --git a/bin/fm-brief.sh b/bin/fm-brief.sh
index 9c98723b01..fdf3c51e7b 100755
--- a/bin/fm-brief.sh
+++ b/bin/fm-brief.sh
@@ -80,7 +80,12 @@ resolve_directory_input() {
 }
 
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME=$(resolve_directory_input FM_HOME "${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}") || exit 1
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
+FM_HOME=$(resolve_directory_input FM_HOME "$FM_HOME") || exit 1
 if [ -n "${FM_DATA_OVERRIDE:-}" ]; then
   DATA=$(resolve_directory_input FM_DATA_OVERRIDE "$FM_DATA_OVERRIDE") || exit 1
 else
diff --git a/bin/fm-check-register.sh b/bin/fm-check-register.sh
index d77d02b64f..60f9ecf3c5 100755
--- a/bin/fm-check-register.sh
+++ b/bin/fm-check-register.sh
@@ -5,7 +5,11 @@ set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 
 # shellcheck source=bin/fm-pr-lib.sh
diff --git a/bin/fm-claude-stop-autoarm.sh b/bin/fm-claude-stop-autoarm.sh
index df9ee1128f..33b968912d 100755
--- a/bin/fm-claude-stop-autoarm.sh
+++ b/bin/fm-claude-stop-autoarm.sh
@@ -47,7 +47,11 @@ set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" quiet || exit 0
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 CONFIG="${FM_CONFIG_OVERRIDE:-$FM_HOME/config}"
 GRACE=${FM_GUARD_GRACE:-300}
diff --git a/bin/fm-config-inherit-lib.sh b/bin/fm-config-inherit-lib.sh
index bffbd5234d..882ab92a4f 100644
--- a/bin/fm-config-inherit-lib.sh
+++ b/bin/fm-config-inherit-lib.sh
@@ -806,7 +806,7 @@ fm_config_reread_send_failure() {
 
 # fm_config_reread_send_pointer <id> <instruction-path>
 fm_config_reread_send_pointer() {
-  local id=$1 instruction_path=$2 pending_path selector out rc send_bin message pending_pointer
+  local id=$1 instruction_path=$2 pending_path selector out rc send_bin message pending_pointer home
   pending_path="$instruction_path.pending"
   if [ ! -f "$instruction_path" ] || [ -L "$instruction_path" ]; then
     printf 'CONFIG_REREAD: secondmate %s: send failed: pending instruction file is missing\n' "$id"
@@ -828,7 +828,11 @@ fm_config_reread_send_pointer() {
     return 1
   fi
   message="CONFIG_REREAD: $instruction_path"
-  out=$(FM_HOME="$FM_HOME" \
+  # Read once so the binding cannot be read out of the assignment prefix that is
+  # setting FM_HOME in the same command.
+  home=$FM_HOME
+  out=$(FM_HOME="$home" \
+    FM_HOME_BINDING="$home" \
     FM_ROOT_OVERRIDE="${FM_ROOT_OVERRIDE:-}" \
     FM_STATE_OVERRIDE="${FM_STATE_OVERRIDE:-}" \
     FM_SEND_SETTLE="${FM_SEND_SETTLE:-0}" \
diff --git a/bin/fm-config-push.sh b/bin/fm-config-push.sh
index b760666dd1..5e3ecd70d2 100755
--- a/bin/fm-config-push.sh
+++ b/bin/fm-config-push.sh
@@ -61,7 +61,11 @@ esac
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 CONFIG="${FM_CONFIG_OVERRIDE:-$FM_HOME/config}"
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 DATA="${FM_DATA_OVERRIDE:-$FM_HOME/data}"
diff --git a/bin/fm-crew-state.sh b/bin/fm-crew-state.sh
index 32dff23668..095f533079 100755
--- a/bin/fm-crew-state.sh
+++ b/bin/fm-crew-state.sh
@@ -53,7 +53,11 @@ set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 
 # shellcheck source=bin/fm-tmux-lib.sh
diff --git a/bin/fm-decision-hold.sh b/bin/fm-decision-hold.sh
index aeb140a296..067ff53c6d 100755
--- a/bin/fm-decision-hold.sh
+++ b/bin/fm-decision-hold.sh
@@ -41,7 +41,11 @@ set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 DATA="${FM_DATA_OVERRIDE:-$FM_HOME/data}"
 
diff --git a/bin/fm-fleet-snapshot.sh b/bin/fm-fleet-snapshot.sh
index 1dee81bb84..4836f36395 100755
--- a/bin/fm-fleet-snapshot.sh
+++ b/bin/fm-fleet-snapshot.sh
@@ -59,7 +59,11 @@ set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 DATA="${FM_DATA_OVERRIDE:-$FM_HOME/data}"
 CONFIG="${FM_CONFIG_OVERRIDE:-$FM_HOME/config}"
diff --git a/bin/fm-fleet-sync.sh b/bin/fm-fleet-sync.sh
index 5c338edf68..3da89dec96 100755
--- a/bin/fm-fleet-sync.sh
+++ b/bin/fm-fleet-sync.sh
@@ -31,7 +31,11 @@ set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 PROJECTS="${FM_PROJECTS_OVERRIDE:-$FM_HOME/projects}"
 # shellcheck source=bin/fm-lock-lib.sh
 . "$SCRIPT_DIR/fm-lock-lib.sh"
diff --git a/bin/fm-guard.sh b/bin/fm-guard.sh
index e36b7f46b0..65c0a79c6c 100755
--- a/bin/fm-guard.sh
+++ b/bin/fm-guard.sh
@@ -21,7 +21,11 @@ set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 CONFIG="${FM_CONFIG_OVERRIDE:-$FM_HOME/config}"
 GRACE=${FM_GUARD_GRACE:-300}
diff --git a/bin/fm-harness.sh b/bin/fm-harness.sh
index 824b95804d..440bceea18 100755
--- a/bin/fm-harness.sh
+++ b/bin/fm-harness.sh
@@ -24,7 +24,11 @@ set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 CONFIG="${FM_CONFIG_OVERRIDE:-$FM_HOME/config}"
 
 detect_own() {
diff --git a/bin/fm-herdr-session-cleanup.sh b/bin/fm-herdr-session-cleanup.sh
index 05b6db9f94..9bbf602ba1 100755
--- a/bin/fm-herdr-session-cleanup.sh
+++ b/bin/fm-herdr-session-cleanup.sh
@@ -25,7 +25,11 @@ set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 
 # shellcheck source=bin/fm-wake-lib.sh
diff --git a/bin/fm-home-anchor-lib.sh b/bin/fm-home-anchor-lib.sh
new file mode 100644
index 0000000000..c4ca9e6f03
--- /dev/null
+++ b/bin/fm-home-anchor-lib.sh
@@ -0,0 +1,158 @@
+#!/usr/bin/env bash
+# fm-home-anchor-lib.sh - the single owner of firstmate's FM_HOME resolution.
+# Sourced by every bin/fm-*.sh and bin/backends/*.sh that needs a home; it has
+# no side effects on source.
+#
+# Why this exists
+# ---------------
+# FM_HOME is inherited down every launch line, so a session opened from another
+# home's pane silently carries that home's FM_HOME. The variable alone cannot
+# say whether it was handed to THIS process deliberately or merely inherited
+# from an ancestor that had nothing to do with it, and no environment variable
+# can: a child and a grandchild see byte-identical environments, so a launch
+# token is inherited exactly as far as FM_HOME is.
+#
+# The one observable difference is on disk. When a process is standing IN a
+# firstmate home root that is not the FM_HOME it was handed, two different homes
+# are claiming the same command and nothing in the environment can say which is
+# right. This resolver refuses that case with a diagnostic instead of guessing,
+# because a silent misroute takes another home's session lock and edits another
+# home's durable records.
+#
+# The contract
+# ------------
+#   1. FM_HOME unset          -> FM_ROOT_OVERRIDE, else the caller's code root.
+#   2. Any FM_*_OVERRIDE set  -> the caller has taken explicit control of where
+#      this home's material lives, so FM_HOME is accepted as given.
+#   3. FM_HOME_BINDING naming the same home as FM_HOME -> a deliberate
+#      cross-home selection; FM_HOME is accepted as given. It names the home it
+#      was issued for, so a stale inherited binding cannot bless a different
+#      FM_HOME. bin/fm-spawn.sh blanks it on every launch line, so it can never
+#      reach an agent session by inheritance.
+#   4. Otherwise, when the working directory and FM_HOME are BOTH firstmate home
+#      roots and are not the same home -> refuse, naming both candidates.
+#   5. Otherwise FM_HOME stands.
+#
+# Rule 4 is deliberately narrow in both directions. The working directory must
+# BE a home root, never merely be contained in one: crewmates legitimately run
+# inside a home's projects/<name> clone and inside pooled task worktrees, and
+# promoting either to that home would be its own misroute. FM_HOME must also be
+# a real home root, so a temp path or a half-built fixture is never treated as a
+# rival claim.
+#
+# Usage, after the caller has resolved its own FM_ROOT (the code root):
+#   # shellcheck source=bin/fm-home-anchor-lib.sh
+#   . "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+#   fm_home_anchor_resolve "$FM_ROOT" || exit 1
+#
+# Hooks that must never act on the wrong home, but must also never break a turn,
+# pass `quiet` and treat a non-zero return as "do not act":
+#   fm_home_anchor_resolve "$FM_ROOT" quiet || exit 0
+
+if [ -n "${FM_HOME_ANCHOR_LIB_SOURCED:-}" ]; then
+  return 0
+fi
+FM_HOME_ANCHOR_LIB_SOURCED=1
+
+FM_HOME_ANCHOR_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# The secondmate-home marker predicate has one owner; reuse it rather than
+# re-deriving what a valid marker looks like.
+# shellcheck source=bin/fm-primary-scope-lib.sh
+. "$FM_HOME_ANCHOR_LIB_DIR/fm-primary-scope-lib.sh"
+
+# Physical path of $1, or empty when it does not resolve to a directory.
+fm_home_anchor_physical() {  # <dir>
+  [ -n "${1:-}" ] || return 0
+  (CDPATH='' cd -- "$1" 2>/dev/null && pwd -P) || true
+}
+
+# Return 0 when $1 is provably a firstmate HOME root - not merely a firstmate
+# code root, and never something that only lives inside one.
+#
+# Ordered so the cheapest rejection comes first: this runs inside per-turn hooks,
+# and only the last test forks git.
+fm_home_anchor_is_home_root() {  # <dir>
+  local dir=${1:-} parent git_dir git_common
+  [ -n "$dir" ] || return 1
+  # Every home root is also a firstmate code root.
+  [ -f "$dir/AGENTS.md" ] || return 1
+  [ -d "$dir/bin" ] || return 1
+  # A valid marker is definitive: only bin/fm-home-seed.sh writes one.
+  if fm_root_is_secondmate_home "$dir"; then
+    return 0
+  fi
+  # Otherwise a home must carry this home's own private material. Both dirs are
+  # gitignored, so a pooled task worktree and a fresh clone have neither, and
+  # this rejects them without forking git.
+  [ -d "$dir/data" ] || [ -d "$dir/state" ] || return 1
+  # A clone under some home's projects/ can accumulate those directories over
+  # time; it is still that home's project, never a home of its own.
+  parent=${dir%/*}
+  if [ "${parent##*/}" = projects ] && [ -f "${parent%/*}/AGENTS.md" ]; then
+    return 1
+  fi
+  # A linked worktree of a home is not that home.
+  git_dir=$(git -C "$dir" rev-parse --git-dir 2>/dev/null) || return 1
+  git_common=$(git -C "$dir" rev-parse --git-common-dir 2>/dev/null) || return 1
+  [ "$git_dir" = "$git_common" ]
+}
+
+fm_home_anchor_refuse() {  # <cwd-home> <given> <given-physical>
+  local cwd_home=$1 given=$2 given_phys=$3 shown=$2
+  [ "$given_phys" = "$given" ] || shown="$given (resolves to $given_phys)"
+  {
+    echo "error: FM_HOME names a different firstmate home than the one this command is running in."
+    echo "  running in: $cwd_home"
+    echo "  FM_HOME:    $shown"
+    echo "FM_HOME is inherited by every process launched from another home's session, so it cannot"
+    echo "show by itself whether it was chosen for this command or carried in from an unrelated"
+    echo "ancestor. Refusing rather than picking one, because guessing wrong takes the other home's"
+    echo "session lock and writes to its durable records."
+    echo "  to use the home you are standing in:   unset FM_HOME"
+    echo "  to confirm the other home on purpose:  FM_HOME_BINDING=\"\$FM_HOME\" <command>"
+  } >&2
+}
+
+# Resolve FM_HOME for this process. Sets FM_HOME; returns non-zero only when
+# resolution is genuinely ambiguous, after printing the diagnostic above unless
+# the caller asked for `quiet`.
+fm_home_anchor_resolve() {  # <default-root> [quiet]
+  local default_root=${1:-} quiet=${2:-} given cwd home_phys bound
+
+  if [ -z "${FM_HOME:-}" ]; then
+    FM_HOME="${FM_ROOT_OVERRIDE:-$default_root}"
+    return 0
+  fi
+  given=$FM_HOME
+
+  if [ -n "${FM_ROOT_OVERRIDE:-}" ] || [ -n "${FM_STATE_OVERRIDE:-}" ] ||
+    [ -n "${FM_DATA_OVERRIDE:-}" ] || [ -n "${FM_PROJECTS_OVERRIDE:-}" ] ||
+    [ -n "${FM_CONFIG_OVERRIDE:-}" ]; then
+    return 0
+  fi
+
+  # Fork-free rejections before any path normalization.
+  if [ "${PWD:-}" = "$given" ]; then
+    return 0
+  fi
+  fm_home_anchor_is_home_root "${PWD:-}" || return 0
+  fm_home_anchor_is_home_root "$given" || return 0
+
+  cwd=$(fm_home_anchor_physical "${PWD:-}")
+  home_phys=$(fm_home_anchor_physical "$given")
+  if [ -z "$cwd" ] || [ -z "$home_phys" ] || [ "$cwd" = "$home_phys" ]; then
+    return 0
+  fi
+
+  if [ -n "${FM_HOME_BINDING:-}" ]; then
+    bound=$(fm_home_anchor_physical "$FM_HOME_BINDING")
+    [ -n "$bound" ] || bound=$FM_HOME_BINDING
+    if [ "$bound" = "$home_phys" ]; then
+      return 0
+    fi
+  fi
+
+  [ "$quiet" = quiet ] || fm_home_anchor_refuse "$cwd" "$given" "$home_phys"
+  return 1
+}
diff --git a/bin/fm-home-seed.sh b/bin/fm-home-seed.sh
index d506b95e4f..550968c1ed 100755
--- a/bin/fm-home-seed.sh
+++ b/bin/fm-home-seed.sh
@@ -33,7 +33,11 @@ set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 DATA="${FM_DATA_OVERRIDE:-$FM_HOME/data}"
 PROJECTS="${FM_PROJECTS_OVERRIDE:-$FM_HOME/projects}"
 REG="$DATA/secondmates.md"
@@ -734,7 +738,7 @@ registry_line_for_project() {
 project_mode_in_home() {
   local home=$1 project=$2 mode
   read -r mode _ <<EOF
-$(FM_ROOT_OVERRIDE='' FM_STATE_OVERRIDE='' FM_DATA_OVERRIDE='' FM_PROJECTS_OVERRIDE='' FM_CONFIG_OVERRIDE='' FM_HOME="$home" "$FM_ROOT/bin/fm-project-mode.sh" "$project")
+$(FM_ROOT_OVERRIDE='' FM_STATE_OVERRIDE='' FM_DATA_OVERRIDE='' FM_PROJECTS_OVERRIDE='' FM_CONFIG_OVERRIDE='' FM_HOME="$home" FM_HOME_BINDING="$home" "$FM_ROOT/bin/fm-project-mode.sh" "$project")
 EOF
   printf '%s\n' "$mode"
 }
diff --git a/bin/fm-lock.sh b/bin/fm-lock.sh
index 083675b2be..293c03f685 100755
--- a/bin/fm-lock.sh
+++ b/bin/fm-lock.sh
@@ -9,7 +9,11 @@ set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 LOCK="$STATE/.lock"
 mkdir -p "$STATE" 2>/dev/null || {
diff --git a/bin/fm-merge-local.sh b/bin/fm-merge-local.sh
index fdc8011488..6ce549c802 100755
--- a/bin/fm-merge-local.sh
+++ b/bin/fm-merge-local.sh
@@ -14,7 +14,11 @@ set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 "$FM_ROOT/bin/fm-guard.sh" || true
 ID=${1:?usage: fm-merge-local.sh <task-id>}
diff --git a/bin/fm-peek.sh b/bin/fm-peek.sh
index 97d2ffe2d2..1e58b4a622 100755
--- a/bin/fm-peek.sh
+++ b/bin/fm-peek.sh
@@ -7,7 +7,11 @@ set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 
 # shellcheck source=bin/fm-backend.sh
diff --git a/bin/fm-pending-reply-lib.sh b/bin/fm-pending-reply-lib.sh
index 5d04b65d67..4234056e65 100755
--- a/bin/fm-pending-reply-lib.sh
+++ b/bin/fm-pending-reply-lib.sh
@@ -681,7 +681,8 @@ fm_pending_reply_send_recovery() {  # <state-dir> <corr_id>
   else
     if [ -z "$parent_home" ] || [ ! -d "$parent_home" ]; then
       send_status=1
-    elif ! env FM_HOME="$parent_home" FM_PENDING_REPLY_EXISTING_CORR="$corr" \
+    elif ! env FM_HOME="$parent_home" FM_HOME_BINDING="$parent_home" \
+      FM_PENDING_REPLY_EXISTING_CORR="$corr" \
       "$_FM_PENDING_REPLY_LIB_DIR/fm-send.sh" "$task_id" "$msg"; then
       send_status=1
     fi
diff --git a/bin/fm-pr-check-migrate.sh b/bin/fm-pr-check-migrate.sh
index e81d105e20..813f446dcc 100755
--- a/bin/fm-pr-check-migrate.sh
+++ b/bin/fm-pr-check-migrate.sh
@@ -11,7 +11,11 @@ set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 TEMPLATE="$SCRIPT_DIR/fm-pr-poll.sh"
 LOG="$STATE/.pr-check-migration.log"
diff --git a/bin/fm-pr-check.sh b/bin/fm-pr-check.sh
index 57858db376..c96443734a 100755
--- a/bin/fm-pr-check.sh
+++ b/bin/fm-pr-check.sh
@@ -10,7 +10,11 @@ set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 
 # shellcheck source=bin/fm-pr-lib.sh
diff --git a/bin/fm-pr-merge.sh b/bin/fm-pr-merge.sh
index 8226798a67..493055bcbd 100755
--- a/bin/fm-pr-merge.sh
+++ b/bin/fm-pr-merge.sh
@@ -12,7 +12,11 @@ set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 
 # shellcheck source=bin/fm-pr-lib.sh
diff --git a/bin/fm-primary-scope-lib.sh b/bin/fm-primary-scope-lib.sh
index 536e62e7ab..1814cb56c7 100755
--- a/bin/fm-primary-scope-lib.sh
+++ b/bin/fm-primary-scope-lib.sh
@@ -5,10 +5,10 @@
 
 # Return 0 when $1 carries a genuine secondmate-home marker.
 fm_root_is_secondmate_home() {
-  local marker="$1/.fm-secondmate-home" id LC_ALL=C
-  [ -L "$marker" ] && return 1
-  [ -f "$marker" ] || return 1
-  IFS= read -r id < "$marker" 2>/dev/null || return 1
+  local scope_marker="$1/.fm-secondmate-home" id LC_ALL=C
+  [ -L "$scope_marker" ] && return 1
+  [ -f "$scope_marker" ] || return 1
+  IFS= read -r id < "$scope_marker" 2>/dev/null || return 1
   id=${id//[[:space:]]/}
   [ -n "$id" ] || return 1
   case "$id" in
diff --git a/bin/fm-project-mode.sh b/bin/fm-project-mode.sh
index 6a6754c10d..06b72f4010 100755
--- a/bin/fm-project-mode.sh
+++ b/bin/fm-project-mode.sh
@@ -23,7 +23,11 @@ set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 DATA="${FM_DATA_OVERRIDE:-$FM_HOME/data}"
 REG="$DATA/projects.md"
 NAME=${1:?usage: fm-project-mode.sh <project-name>}
diff --git a/bin/fm-promote.sh b/bin/fm-promote.sh
index 827c17998f..be5da685ce 100755
--- a/bin/fm-promote.sh
+++ b/bin/fm-promote.sh
@@ -11,7 +11,11 @@ set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 "$FM_ROOT/bin/fm-guard.sh" || true
 ID=$1
diff --git a/bin/fm-review-diff.sh b/bin/fm-review-diff.sh
index 06e0efb5bd..2d8fe6e477 100755
--- a/bin/fm-review-diff.sh
+++ b/bin/fm-review-diff.sh
@@ -16,7 +16,11 @@ set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 "$FM_ROOT/bin/fm-guard.sh" || true
 
diff --git a/bin/fm-send.sh b/bin/fm-send.sh
index dfae6f49e6..372289cd5b 100755
--- a/bin/fm-send.sh
+++ b/bin/fm-send.sh
@@ -59,6 +59,15 @@ if [ -z "${FM_HOME+x}" ] || [ -z "${FM_HOME:-}" ]; then
   exit 1
 fi
 
+# The set-FM_HOME requirement above is fm-send's own, and stays. It proves only
+# that SOMETHING chose a home, never that this process was the one it was chosen
+# for, so the shared resolver still gets to refuse an ambiently inherited home
+# (bin/fm-home-anchor-lib.sh). Both checks are fail-closed and neither relaxes
+# the other.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
+
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 if [ ! -d "$FM_HOME" ]; then
   echo "error: FM_HOME '$FM_HOME' is not a directory; fm-send cannot resolve this home's state" >&2
diff --git a/bin/fm-session-start.sh b/bin/fm-session-start.sh
index 1abbace4bf..f2f4fa3a57 100755
--- a/bin/fm-session-start.sh
+++ b/bin/fm-session-start.sh
@@ -93,7 +93,11 @@ set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 DATA="${FM_DATA_OVERRIDE:-$FM_HOME/data}"
 CONFIG="${FM_CONFIG_OVERRIDE:-$FM_HOME/config}"
diff --git a/bin/fm-sessionstart-nudge.sh b/bin/fm-sessionstart-nudge.sh
index fccf775dd9..6001879f8a 100755
--- a/bin/fm-sessionstart-nudge.sh
+++ b/bin/fm-sessionstart-nudge.sh
@@ -7,7 +7,11 @@ set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 
 # shellcheck source=bin/fm-gate-refuse-lib.sh
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 3526572550..5917f1b657 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -123,7 +123,11 @@ case "${1:-}" in
 esac
 
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 
 resolve_directory_input() {
   local name=$1 path=$2 resolved
@@ -1523,7 +1527,11 @@ if [ "$HARNESS" = claude ] && [ -n "${CLAUDE_CONFIG_DIR:-}" ]; then
 fi
 if [ "$KIND" = secondmate ]; then
   sq_home=$(shell_quote "$PROJ_ABS")
-  LAUNCH="FM_ROOT_OVERRIDE= FM_STATE_OVERRIDE= FM_DATA_OVERRIDE= FM_PROJECTS_OVERRIDE= FM_CONFIG_OVERRIDE= FM_HOME=$sq_home $LAUNCH"
+  # FM_HOME_BINDING is blanked with the layout overrides so a binding issued for
+  # some other home can never ride an inherited environment into an agent
+  # session and bless an FM_HOME that session never chose
+  # (bin/fm-home-anchor-lib.sh).
+  LAUNCH="FM_ROOT_OVERRIDE= FM_STATE_OVERRIDE= FM_DATA_OVERRIDE= FM_PROJECTS_OVERRIDE= FM_CONFIG_OVERRIDE= FM_HOME_BINDING= FM_HOME=$sq_home $LAUNCH"
 fi
 # Export GOTMPDIR into the crewmate's pane shell so the agent and every child
 # process (go build, go test, ...) inherit it. Sent before the launch command so
diff --git a/bin/fm-startup-memory-budget.sh b/bin/fm-startup-memory-budget.sh
index 715da54948..727f219013 100755
--- a/bin/fm-startup-memory-budget.sh
+++ b/bin/fm-startup-memory-budget.sh
@@ -14,7 +14,11 @@ set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 CONFIG="${FM_CONFIG_OVERRIDE:-$FM_HOME/config}"
 DATA="${FM_DATA_OVERRIDE:-$FM_HOME/data}"
 
diff --git a/bin/fm-subagent-pretool-check.sh b/bin/fm-subagent-pretool-check.sh
index 8edb507218..aa237613ce 100755
--- a/bin/fm-subagent-pretool-check.sh
+++ b/bin/fm-subagent-pretool-check.sh
@@ -172,7 +172,13 @@ done
 
 SCRIPT_DIR=$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" 2>/dev/null && pwd -P) || exit 0
 FM_ROOT=${FM_ROOT_OVERRIDE:-$(CDPATH='' cd -- "$SCRIPT_DIR/.." 2>/dev/null && pwd -P)} || exit 0
-FM_HOME=${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}
+# FM_HOME resolution, including the refusal on an ambiently inherited home, has
+# one owner: bin/fm-home-anchor-lib.sh. An unresolvable home is inert here for
+# the same reason every other failure below is: this check never blocks a call it
+# cannot confirm.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" quiet || exit 0
 STATE=${FM_STATE_OVERRIDE:-$FM_HOME/state}
 
 # Scope to a genuine primary home, exactly as the session-start nudge and the
diff --git a/bin/fm-supervise-daemon.sh b/bin/fm-supervise-daemon.sh
index 30554edbbd..fd0206a40c 100755
--- a/bin/fm-supervise-daemon.sh
+++ b/bin/fm-supervise-daemon.sh
@@ -144,7 +144,11 @@ set -u
 
 FM_DAEMON_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$FM_DAEMON_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$FM_DAEMON_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 
 # Shared tmux pane primitives for supervisor injection (busy/composer detection
 # + verify-retry submit). Sourced at top level so BOTH the executed daemon and
diff --git a/bin/fm-supervision-instructions.sh b/bin/fm-supervision-instructions.sh
index 6cd87699b0..10a0c6e2c0 100755
--- a/bin/fm-supervision-instructions.sh
+++ b/bin/fm-supervision-instructions.sh
@@ -6,7 +6,11 @@ set -eu
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$REPO_ROOT}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 CONFIG="${FM_CONFIG_OVERRIDE:-$FM_HOME/config}"
 DOC_DIR="$REPO_ROOT/docs/supervision-protocols"
 
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index 6164ebdd78..0f488bb2b3 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -90,7 +90,11 @@ set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 DATA="${FM_DATA_OVERRIDE:-$FM_HOME/data}"
 CONFIG="${FM_CONFIG_OVERRIDE:-$FM_HOME/config}"
diff --git a/bin/fm-test-run.sh b/bin/fm-test-run.sh
index f89a6bade5..e56f49da08 100755
--- a/bin/fm-test-run.sh
+++ b/bin/fm-test-run.sh
@@ -122,6 +122,7 @@ family_for_basename() {
     fm-composer-ghost.test.sh|fm-composer-lib.test.sh|\
     fm-crew-state.test.sh|fm-decision-hold-lifecycle.test.sh|\
     fm-documentation-audiences.test.sh|fm-ensure-agents-md.test.sh|fm-grok-harness.test.sh|\
+    fm-home-anchor.test.sh|\
     fm-kimi-harness.test.sh|fm-herdr-lab.test.sh|fm-lint.test.sh|\
     fm-operational-input.test.sh|fm-pi-primary-types.test.sh|\
     fm-send-popup-settle.test.sh|fm-send-settle.test.sh|\
@@ -653,6 +654,16 @@ families_for_changed_path() {
     bin/fm-config-inherit-lib.sh|bin/fm-config-push.sh|bin/fm-shared*)
       printf '%s\n' secondmate
       ;;
+    bin/fm-home-anchor-lib.sh)
+      # Every script defers its FM_HOME resolution to this lib, so a change here
+      # can reroute any home-scoped command. Select every family that resolves a
+      # home rather than only the unit that owns the rule.
+      printf '%s\n' pure-contract-unit
+      printf '%s\n' session-bootstrap
+      printf '%s\n' secondmate
+      printf '%s\n' backend-dispatch
+      printf '%s\n' watcher-wake-lock
+      ;;
     bin/fm-session-start.sh|bin/fm-bootstrap.sh|bin/fm-fleet-sync.sh|\
     bin/fm-sessionstart-nudge.sh|bin/fm-tangle*|bin/fm-update.sh|\
     bin/fm-gate-refuse*|bin/fm-lock*)
diff --git a/bin/fm-turnend-guard.sh b/bin/fm-turnend-guard.sh
index 2e96fb33e4..56b767a1e9 100755
--- a/bin/fm-turnend-guard.sh
+++ b/bin/fm-turnend-guard.sh
@@ -61,7 +61,11 @@ set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" quiet || exit 0
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 CONFIG="${FM_CONFIG_OVERRIDE:-$FM_HOME/config}"
 GRACE=${FM_GUARD_GRACE:-300}
diff --git a/bin/fm-update.sh b/bin/fm-update.sh
index c3b0e674f7..1870bd531b 100755
--- a/bin/fm-update.sh
+++ b/bin/fm-update.sh
@@ -31,7 +31,11 @@ set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 SECONDMATES_MD="$FM_HOME/data/secondmates.md"
 # shellcheck source=bin/fm-ff-lib.sh
diff --git a/bin/fm-wake-lib.sh b/bin/fm-wake-lib.sh
index 8cec58bec1..3c71e4bd06 100755
--- a/bin/fm-wake-lib.sh
+++ b/bin/fm-wake-lib.sh
@@ -4,7 +4,11 @@
 FM_WAKE_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_WAKE_DEFAULT_ROOT="$(cd "$FM_WAKE_LIB_DIR/.." && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-${FM_ROOT:-$FM_WAKE_DEFAULT_ROOT}}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$FM_WAKE_LIB_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-${STATE:-$FM_HOME/state}}"
 FM_WAKE_QUEUE="${FM_WAKE_QUEUE:-$STATE/.wake-queue}"
 FM_WAKE_QUEUE_LOCK="${FM_WAKE_QUEUE_LOCK:-$STATE/.wake-queue.lock}"
diff --git a/bin/fm-watch.sh b/bin/fm-watch.sh
index e5501f852b..278670e021 100755
--- a/bin/fm-watch.sh
+++ b/bin/fm-watch.sh
@@ -55,7 +55,11 @@ set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 mkdir -p "$STATE"
 
diff --git a/bin/fm-x-dismiss.sh b/bin/fm-x-dismiss.sh
index 0654d4e6e3..e802b7cc56 100755
--- a/bin/fm-x-dismiss.sh
+++ b/bin/fm-x-dismiss.sh
@@ -32,7 +32,11 @@ set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 # shellcheck source=bin/fm-x-lib.sh
 . "$SCRIPT_DIR/fm-x-lib.sh"
diff --git a/bin/fm-x-followup.sh b/bin/fm-x-followup.sh
index 603678cfca..d28f49911e 100755
--- a/bin/fm-x-followup.sh
+++ b/bin/fm-x-followup.sh
@@ -59,7 +59,11 @@ set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 # shellcheck source=bin/fm-x-lib.sh
 . "$SCRIPT_DIR/fm-x-lib.sh"
diff --git a/bin/fm-x-link.sh b/bin/fm-x-link.sh
index 5301359a45..f1f207ddd9 100755
--- a/bin/fm-x-link.sh
+++ b/bin/fm-x-link.sh
@@ -39,7 +39,11 @@ set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 # shellcheck source=bin/fm-x-lib.sh
 . "$SCRIPT_DIR/fm-x-lib.sh"
diff --git a/bin/fm-x-poll.sh b/bin/fm-x-poll.sh
index db7c1ebba0..b8c0e773e6 100755
--- a/bin/fm-x-poll.sh
+++ b/bin/fm-x-poll.sh
@@ -30,7 +30,11 @@ set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 # shellcheck source=bin/fm-x-lib.sh
 . "$SCRIPT_DIR/fm-x-lib.sh"
diff --git a/bin/fm-x-reply.sh b/bin/fm-x-reply.sh
index 44e85cb469..5b3dda7235 100755
--- a/bin/fm-x-reply.sh
+++ b/bin/fm-x-reply.sh
@@ -82,7 +82,11 @@ set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+# FM_HOME resolution, including the refusal on an ambiently inherited home,
+# has one owner: bin/fm-home-anchor-lib.sh.
+# shellcheck source=bin/fm-home-anchor-lib.sh
+. "$SCRIPT_DIR/fm-home-anchor-lib.sh"
+fm_home_anchor_resolve "$FM_ROOT" || exit 1
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 # shellcheck source=bin/fm-x-lib.sh
 . "$SCRIPT_DIR/fm-x-lib.sh"
diff --git a/docs/configuration.md b/docs/configuration.md
index b226ec6888..9493a49476 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -183,6 +183,12 @@ When it is unset, most scripts use the repo root as the home; when it is set, sc
 When `FM_HOME` is unset, it also behaves as the old whole-root override.
 `bin/fm-send.sh` is intentionally stricter than that general fallback: it requires `FM_HOME` to be set before resolving a target, so operator steers cannot silently resolve against the wrong home.
 `FM_STATE_OVERRIDE`, `FM_DATA_OVERRIDE`, `FM_PROJECTS_OVERRIDE`, and `FM_CONFIG_OVERRIDE` override individual operational directories for tests and specialized harness setup.
+
+`FM_HOME` is inherited by every process launched from a session, so a session opened from another home's pane carries that home's `FM_HOME` even though the selection was never made for it.
+`bin/fm-home-anchor-lib.sh` is the single owner of the resulting resolution rule, and its header states that rule in full; every other script defers to it rather than resolving `FM_HOME` itself.
+The rule in short: a set `FM_HOME` stands, except that when the working directory and `FM_HOME` are both firstmate home roots and name different homes, resolution refuses with a diagnostic naming both candidates instead of guessing which one the command was meant for.
+Setting any `FM_*_OVERRIDE` directory, or setting `FM_HOME_BINDING` to the same home as `FM_HOME`, declares the selection deliberate and is accepted as given; `bin/fm-spawn.sh` blanks `FM_HOME_BINDING` on every launch line so a binding can never be inherited into an agent session.
+A pooled task worktree and a home's own `projects/<name>` clone are never home roots, so a crewmate working in either keeps the home that launched it.
 Before `fm-brief.sh`, `fm-spawn.sh`, or `fm-afk-launch.sh` persists a path or passes it to another process, it resolves each applicable relative `FM_HOME`, `FM_STATE_OVERRIDE`, or `FM_DATA_OVERRIDE` directory against the caller's working directory, preserves absolute spellings unchanged, and rejects an unresolvable relative directory with the offending variable named.
 Bootstrap applies the same relative `FM_HOME` resolution only when embedding that home in the generated X-mode poll shim; other transient consumers retain their existing shell-relative behavior.
 For the herdr backend, `FM_HOME` also determines the workspace label used by the adapter.
@@ -385,6 +391,7 @@ Runtime tuning via environment variables (defaults shown):
 
 ```sh
 FM_HOME=                 # optional operational home for most scripts, unset means this repo root; fm-send requires it explicitly
+FM_HOME_BINDING=         # declares a deliberate cross-home FM_HOME by naming the same home; see the FM_HOME section
 FM_ROOT_OVERRIDE=        # override firstmate repo root, tangle-guard target, and zellij/cmux home-title hash; also legacy whole-root override when FM_HOME is unset
 FM_STATE_OVERRIDE=       # alternate state dir, mainly for tests
 FM_DATA_OVERRIDE=        # alternate data dir, mainly for tests
diff --git a/tests/fm-afk-return.test.sh b/tests/fm-afk-return.test.sh
index aa3107440b..1dfea02526 100755
--- a/tests/fm-afk-return.test.sh
+++ b/tests/fm-afk-return.test.sh
@@ -16,6 +16,7 @@ TMP_ROOT=$(fm_test_tmproot fm-afk-return-tests)
 install_runner() {  # <case-dir>
   local dir=$1
   mkdir -p "$dir/bin" "$dir/home/state" "$dir/home/data" "$dir/home/config"
+  fm_copy_core_libs "$dir/bin"
   cp "$ROOT/bin/fm-afk-return.sh" "$dir/bin/"
   cp "$ROOT/bin/fm-wake-lib.sh" "$dir/bin/"
   cp "$ROOT/bin/fm-classify-lib.sh" "$dir/bin/"
diff --git a/tests/fm-backend.test.sh b/tests/fm-backend.test.sh
index 7ac873f087..6810dae77f 100755
--- a/tests/fm-backend.test.sh
+++ b/tests/fm-backend.test.sh
@@ -151,6 +151,7 @@ build_old_bin() {  # <name> -> echoes root dir (root/bin/<script> is the entry p
   root="$TMP_ROOT/$name"
   bin="$root/bin"
   mkdir -p "$bin"
+  fm_copy_core_libs "$bin"
   for f in $OLD_BIN_UNCHANGED_SIBLINGS; do
     cp "$ROOT/bin/$f" "$bin/$f"
   done
diff --git a/tests/fm-claude-stop-autoarm.test.sh b/tests/fm-claude-stop-autoarm.test.sh
index 6be8bc1533..23285152fd 100755
--- a/tests/fm-claude-stop-autoarm.test.sh
+++ b/tests/fm-claude-stop-autoarm.test.sh
@@ -26,6 +26,7 @@ export FAKE_CLAUDE
 install_autoarm_scripts() {
   local dir=$1
   mkdir -p "$dir/bin"
+  fm_copy_core_libs "$dir/bin"
   cp "$ROOT/bin/fm-claude-stop-autoarm.sh" "$dir/bin/fm-claude-stop-autoarm.sh"
   cp "$ROOT/bin/fm-primary-scope-lib.sh" "$dir/bin/fm-primary-scope-lib.sh"
   cp "$ROOT/bin/fm-supervision-lib.sh" "$dir/bin/fm-supervision-lib.sh"
diff --git a/tests/fm-gotmp.test.sh b/tests/fm-gotmp.test.sh
index 2fc7c8d78c..996d7efa8e 100755
--- a/tests/fm-gotmp.test.sh
+++ b/tests/fm-gotmp.test.sh
@@ -48,6 +48,9 @@ make_fake_root() {
   local id=$1 tasktmp=$2
   local fake="$TMP_ROOT/$id"
   mkdir -p "$fake/bin/backends" "$fake/state"
+  # Every bin/fm-*.sh resolves its home through these two before doing anything.
+  ln -s "$ROOT/bin/fm-home-anchor-lib.sh" "$fake/bin/fm-home-anchor-lib.sh"
+  ln -s "$ROOT/bin/fm-primary-scope-lib.sh" "$fake/bin/fm-primary-scope-lib.sh"
   # Symlink the REAL teardown so the test exercises actual code, not a copy.
   ln -s "$TEARDOWN" "$fake/bin/fm-teardown.sh"
   # fm-backend.sh + its tmux adapter: symlink the REAL files (teardown sources
@@ -120,6 +123,9 @@ test_teardown_skips_gracefully_without_tasktmp() {
   local id=td-absent-z3
   local fake="$TMP_ROOT/$id-root"
   mkdir -p "$fake/bin/backends" "$fake/state"
+  # Every bin/fm-*.sh resolves its home through these two before doing anything.
+  ln -s "$ROOT/bin/fm-home-anchor-lib.sh" "$fake/bin/fm-home-anchor-lib.sh"
+  ln -s "$ROOT/bin/fm-primary-scope-lib.sh" "$fake/bin/fm-primary-scope-lib.sh"
   ln -s "$TEARDOWN" "$fake/bin/fm-teardown.sh"
   ln -s "$ROOT/bin/fm-backend.sh" "$fake/bin/fm-backend.sh"
   ln -s "$ROOT/bin/backends/tmux.sh" "$fake/bin/backends/tmux.sh"
diff --git a/tests/fm-home-anchor.test.sh b/tests/fm-home-anchor.test.sh
new file mode 100755
index 0000000000..02e7fbf436
--- /dev/null
+++ b/tests/fm-home-anchor.test.sh
@@ -0,0 +1,206 @@
+#!/usr/bin/env bash
+# Behavior tests for firstmate's FM_HOME resolution (bin/fm-home-anchor-lib.sh).
+#
+# FM_HOME is inherited down every launch line, so a session opened from another
+# home's pane carries that home's FM_HOME with nothing in the environment able to
+# say the selection was never meant for it. On 2026-07-31 that took a second
+# mate's session lock and marked three of its tasks done from a session whose
+# working directory was the primary home. These cases pin the resolution rule
+# through a real executable that reveals WHICH home it read: fm-project-mode.sh
+# prints the delivery mode recorded in $FM_HOME/data/projects.md, so a misroute
+# shows up as the other home's mode rather than as a missing error message.
+#
+#   (a) primary cwd + inherited second mate FM_HOME  -> refuse, read neither
+#   (b) second mate cwd + inherited primary FM_HOME  -> refuse, read neither
+#   (c) second mate standing in its own home root    -> works
+#   (d) crewmate in a pooled task worktree           -> FM_HOME stands
+#   (e) worker inside <home>/projects/<name>         -> FM_HOME stands, no promotion
+#   (f) FM_*_OVERRIDE layout control                 -> accepted as given
+#   (g) FM_HOME_BINDING naming the same home         -> accepted as given
+#   (h) FM_HOME_BINDING naming a different home      -> still refused
+#   (i) FM_HOME unset                                -> the code root's own home
+#   (j) FM_HOME that is not a home root              -> no rival claim, stands
+#   (k) fm-send keeps its own fail-closed contract and gains the refusal
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+MODE="$ROOT/bin/fm-project-mode.sh"
+SEND="$ROOT/bin/fm-send.sh"
+TMP_ROOT=$(fm_test_tmproot fm-home-anchor)
+fm_git_identity fmtest fmtest@example.invalid
+
+# A firstmate home root: a plain checkout carrying this home's own private
+# material. <mate-id> makes it a second mate home by writing the identity marker
+# bin/fm-home-seed.sh writes. <mode> is recorded for project "alpha" so the
+# helper's output names the home that was actually read.
+make_home() {  # <dir> <mode> [mate-id]
+  local dir=$1 mode=$2 mate_id=${3:-}
+  mkdir -p "$dir/bin" "$dir/data" "$dir/state" "$dir/config" "$dir/projects"
+  printf '# home\n' > "$dir/AGENTS.md"
+  printf -- '- alpha [%s] - fixture (added 2026-07-31)\n' "$mode" > "$dir/data/projects.md"
+  git -C "$dir" init -q
+  git -C "$dir" add -A >/dev/null 2>&1 || true
+  git -C "$dir" -c user.name=fmtest -c user.email=fmtest@example.invalid \
+    commit -qm home >/dev/null 2>&1 || true
+  [ -z "$mate_id" ] || printf '%s\n' "$mate_id" > "$dir/.fm-secondmate-home"
+}
+
+# Run <cmd...> with cwd=<dir> and the given environment, capturing merged output.
+# Echoes "<exit>|<output>" so a case can assert on both without a temp file.
+run_in() {  # <dir> <cmd...>
+  local dir=$1 out rc=0
+  shift
+  out=$( (cd "$dir" && "$@") 2>&1 ) || rc=$?
+  printf '%s|%s' "$rc" "$out"
+}
+
+PRIMARY="$TMP_ROOT/primary"
+MATE="$TMP_ROOT/mate"
+make_home "$PRIMARY" no-mistakes
+make_home "$MATE" local-only fitrpg
+
+# ---------------------------------------------------------------------------
+# (a) The reported defect: cwd is the primary home, FM_HOME was inherited from a
+# second mate's pane. The command must not read the mate's registry.
+# ---------------------------------------------------------------------------
+res=$(run_in "$PRIMARY" env FM_HOME="$MATE" "$MODE" alpha)
+rc=${res%%|*}
+out=${res#*|}
+expect_code 1 "$rc" "inherited mate FM_HOME from the primary home must refuse"
+assert_not_contains "$out" "local-only" "refusal must not report the mate's delivery mode"
+assert_contains "$out" "$PRIMARY" "diagnostic must name the home the command is running in"
+assert_contains "$out" "$MATE" "diagnostic must name the FM_HOME candidate"
+assert_contains "$out" "unset FM_HOME" "diagnostic must offer the local-home remedy"
+assert_contains "$out" "FM_HOME_BINDING" "diagnostic must offer the deliberate cross-home remedy"
+pass "primary cwd + inherited second mate FM_HOME refuses and names both homes"
+
+# ---------------------------------------------------------------------------
+# (b) The same misroute in the other direction, which the display-side fix on
+# 2026-07-31 did not cover.
+# ---------------------------------------------------------------------------
+res=$(run_in "$MATE" env FM_HOME="$PRIMARY" "$MODE" alpha)
+rc=${res%%|*}
+out=${res#*|}
+expect_code 1 "$rc" "inherited primary FM_HOME from a mate home must refuse"
+assert_not_contains "$out" "no-mistakes" "refusal must not report the primary's delivery mode"
+assert_contains "$out" "$MATE" "diagnostic must name the mate home it is running in"
+assert_contains "$out" "$PRIMARY" "diagnostic must name the primary FM_HOME candidate"
+pass "second mate cwd + inherited primary FM_HOME refuses and names both homes"
+
+# ---------------------------------------------------------------------------
+# (c) A second mate launched by fm-spawn with an explicit FM_HOME, standing in
+# its own home root. This is agreement, not ambiguity.
+# ---------------------------------------------------------------------------
+res=$(run_in "$MATE" env FM_HOME="$MATE" "$MODE" alpha)
+expect_code 0 "${res%%|*}" "a mate in its own home root must resolve"
+assert_contains "${res#*|}" "local-only" "a mate in its own home root must read its own registry"
+pass "second mate at its own home root with an explicit FM_HOME still works"
+
+# A relative FM_HOME naming the same home is the same home, not a rival claim.
+res=$(run_in "$MATE" env FM_HOME=. "$MODE" alpha)
+expect_code 0 "${res%%|*}" "a relative FM_HOME naming the same home must resolve"
+assert_contains "${res#*|}" "local-only" "relative FM_HOME must read the same home's registry"
+pass "an unnormalized FM_HOME naming the same home is not treated as a conflict"
+
+# ---------------------------------------------------------------------------
+# (d) A crewmate in a pooled task worktree: cwd is a linked worktree of the same
+# repo, with none of the home's private material. No anchor is available there,
+# so the launching home's FM_HOME must stand.
+# ---------------------------------------------------------------------------
+WT_REPO="$TMP_ROOT/wt-repo"
+WORKTREE="$TMP_ROOT/pool/task-1"
+mkdir -p "$TMP_ROOT/pool"
+fm_git_worktree "$WT_REPO" "$WORKTREE" fm/task-1
+printf '# firstmate\n' > "$WORKTREE/AGENTS.md"
+mkdir -p "$WORKTREE/bin"
+res=$(run_in "$WORKTREE" env FM_HOME="$PRIMARY" "$MODE" alpha)
+expect_code 0 "${res%%|*}" "a crewmate worktree must not be treated as a rival home"
+assert_contains "${res#*|}" "no-mistakes" "a crewmate must read its launching home's registry"
+pass "crewmate in a pooled task worktree keeps its launching home"
+
+# Even a worktree that has accumulated state/ stays a worktree, never a home.
+mkdir -p "$WORKTREE/state" "$WORKTREE/data"
+res=$(run_in "$WORKTREE" env FM_HOME="$PRIMARY" "$MODE" alpha)
+expect_code 0 "${res%%|*}" "a worktree with private dirs is still not a home"
+assert_contains "${res#*|}" "no-mistakes" "worktree must still read its launching home"
+pass "a task worktree is never promoted to a home, even carrying data/ and state/"
+
+# ---------------------------------------------------------------------------
+# (e) A worker inside a home's own projects/<name> clone. Containment must never
+# resolve a home: this worker belongs to whichever home launched it.
+# ---------------------------------------------------------------------------
+CLONE="$MATE/projects/firstmate"
+make_home "$CLONE" direct-PR
+res=$(run_in "$CLONE" env FM_HOME="$MATE" "$MODE" alpha)
+expect_code 0 "${res%%|*}" "a worker in a mate's project clone must not refuse"
+assert_contains "${res#*|}" "local-only" "a worker in a clone must read the mate's registry"
+pass "worker inside <home>/projects/<name> keeps the mate that launched it"
+
+res=$(run_in "$CLONE" env FM_HOME="$PRIMARY" "$MODE" alpha)
+expect_code 0 "${res%%|*}" "a clone under a mate must not promote a worker to that mate"
+assert_contains "${res#*|}" "no-mistakes" "the launching home must still win inside a clone"
+pass "a project clone never promotes a worker to the home containing it"
+
+# ---------------------------------------------------------------------------
+# (f) The layout overrides are explicit control and are accepted as given.
+# ---------------------------------------------------------------------------
+res=$(run_in "$PRIMARY" env FM_HOME="$MATE" FM_DATA_OVERRIDE="$MATE/data" "$MODE" alpha)
+expect_code 0 "${res%%|*}" "an explicit data override must be accepted"
+assert_contains "${res#*|}" "local-only" "an explicit override must select the named home"
+pass "FM_DATA_OVERRIDE keeps working across homes"
+
+res=$(run_in "$PRIMARY" env FM_HOME="$MATE" FM_ROOT_OVERRIDE="$ROOT" "$MODE" alpha)
+expect_code 0 "${res%%|*}" "an explicit root override must be accepted"
+assert_contains "${res#*|}" "local-only" "FM_ROOT_OVERRIDE must not re-anchor the home"
+pass "FM_ROOT_OVERRIDE keeps working across homes"
+
+# ---------------------------------------------------------------------------
+# (g)/(h) The binding declares a deliberate cross-home selection, and names the
+# home it was issued for so a stale one cannot bless a different FM_HOME.
+# ---------------------------------------------------------------------------
+res=$(run_in "$PRIMARY" env FM_HOME="$MATE" FM_HOME_BINDING="$MATE" "$MODE" alpha)
+expect_code 0 "${res%%|*}" "a matching binding must be accepted"
+assert_contains "${res#*|}" "local-only" "a matching binding must select the named home"
+pass "a binding naming the same home confirms a deliberate cross-home command"
+
+res=$(run_in "$PRIMARY" env FM_HOME="$MATE" FM_HOME_BINDING="$PRIMARY" "$MODE" alpha)
+expect_code 1 "${res%%|*}" "a binding for another home must not bless this FM_HOME"
+assert_not_contains "${res#*|}" "local-only" "a mismatched binding must not reach the mate"
+pass "a binding naming a different home does not bless an inherited FM_HOME"
+
+# ---------------------------------------------------------------------------
+# (i) With FM_HOME unset there is nothing ambient to second-guess: the code root
+# supplies the home, exactly as before.
+# ---------------------------------------------------------------------------
+res=$(run_in "$PRIMARY" env -u FM_HOME "$MODE" alpha)
+expect_code 0 "${res%%|*}" "unset FM_HOME must resolve to the code root's home"
+assert_contains "${res#*|}" "warn:" "the repo checkout has no fixture registry, so it must warn"
+pass "an unset FM_HOME still resolves to the code root"
+
+# ---------------------------------------------------------------------------
+# (j) An FM_HOME that is not a home root is not a rival claim. This is what keeps
+# fixture homes and temp paths in the rest of the suite working unchanged.
+# ---------------------------------------------------------------------------
+PLAIN="$TMP_ROOT/plain"
+mkdir -p "$PLAIN/data" "$PLAIN/state"
+printf -- '- alpha [direct-PR] - fixture (added 2026-07-31)\n' > "$PLAIN/data/projects.md"
+res=$(run_in "$PRIMARY" env FM_HOME="$PLAIN" "$MODE" alpha)
+expect_code 0 "${res%%|*}" "a non-home FM_HOME must not trigger the refusal"
+assert_contains "${res#*|}" "direct-PR" "a non-home FM_HOME must still be honored"
+pass "an FM_HOME that is not a home root raises no rival claim"
+
+# ---------------------------------------------------------------------------
+# (k) fm-send's own fail-closed contract is unchanged, and it now also refuses an
+# ambiently inherited home rather than steering into another home's fleet.
+# ---------------------------------------------------------------------------
+res=$(run_in "$PRIMARY" env -u FM_HOME "$SEND" fm-nope hello)
+expect_code 1 "${res%%|*}" "fm-send must still refuse without an explicit FM_HOME"
+assert_contains "${res#*|}" "FM_HOME is not set" "fm-send must keep its own diagnostic"
+pass "fm-send still refuses to resolve targets without an explicit home"
+
+res=$(run_in "$PRIMARY" env FM_HOME="$MATE" "$SEND" fm-nope hello)
+expect_code 1 "${res%%|*}" "fm-send must refuse an ambiently inherited home"
+assert_contains "${res#*|}" "$MATE" "fm-send's refusal must name the inherited candidate"
+pass "fm-send refuses to steer a fleet reached through an inherited home"
diff --git a/tests/fm-sessionstart-nudge.test.sh b/tests/fm-sessionstart-nudge.test.sh
index 878295cba5..a3bce7b1bf 100755
--- a/tests/fm-sessionstart-nudge.test.sh
+++ b/tests/fm-sessionstart-nudge.test.sh
@@ -112,6 +112,7 @@ test_owned_lock_is_silent() {
 test_opencode_plugin_delivers_exact_nudge_once() {
   local root="$TMP_ROOT/opencode-primary" out status=0
   make_primary "$root"
+  fm_copy_core_libs "$root/bin"
   cp "$ROOT/bin/fm-sessionstart-nudge.sh" "$ROOT/bin/fm-primary-scope-lib.sh" \
     "$ROOT/bin/fm-gate-refuse-lib.sh" "$ROOT/bin/fm-operational-input.sh" "$root/bin/"
   chmod +x "$root/bin/fm-sessionstart-nudge.sh"
diff --git a/tests/fm-turnend-guard.test.sh b/tests/fm-turnend-guard.test.sh
index 242407c1a3..aa5a1b07b0 100755
--- a/tests/fm-turnend-guard.test.sh
+++ b/tests/fm-turnend-guard.test.sh
@@ -99,6 +99,7 @@ test_predicate_x_mode_needs_supervision() {
 install_guard_scripts() {
   local dir=$1
   mkdir -p "$dir/bin"
+  fm_copy_core_libs "$dir/bin"
   cp "$ROOT/bin/fm-turnend-guard.sh" "$dir/bin/fm-turnend-guard.sh"
   cp "$ROOT/bin/fm-turnend-guard-grok.sh" "$dir/bin/fm-turnend-guard-grok.sh"
   cp "$ROOT/bin/fm-operational-input.sh" "$dir/bin/fm-operational-input.sh"
diff --git a/tests/lib.sh b/tests/lib.sh
index ee3b1d1476..8872cbe7ad 100644
--- a/tests/lib.sh
+++ b/tests/lib.sh
@@ -216,3 +216,19 @@ assert_absent() {
 assert_present() {
   [ -e "$1" ] || fail "$2"
 }
+
+# --- partial bin/ fixtures --------------------------------------------------
+#
+# fm_copy_core_libs <dest-bin-dir> copies the libs that every bin/fm-*.sh needs
+# before it can do anything at all, so a suite that assembles a partial bin/ from
+# named scripts does not have to know that list. Suites that copy the whole bin/
+# tree already have them.
+FM_TEST_CORE_LIBS="fm-home-anchor-lib.sh fm-primary-scope-lib.sh"
+
+fm_copy_core_libs() {
+  local dest=$1 lib
+  mkdir -p "$dest"
+  for lib in $FM_TEST_CORE_LIBS; do
+    cp "$ROOT/bin/$lib" "$dest/$lib"
+  done
+}

From 7792d56a8df749a44d7c7ca439a4a9e6a062ae37 Mon Sep 17 00:00:00 2001
From: Firstmate Crew <crew@firstmate.invalid>
Date: Fri, 31 Jul 2026 20:18:49 -0400
Subject: [PATCH 02/12] fix(home): tighten the declaration rule and cover the
 harness arm paths

Two gaps in the first pass.

A partial set of layout overrides was treated as explicit control, which the
Pi and OpenCode watcher-arm paths trip: both derive FM_CONFIG_OVERRIDE from
the ambient FM_HOME and set FM_ROOT_OVERRIDE, so an inherited home laundered
itself into a declaration and armed a watcher on the wrong home. Only a
complete set of home-material overrides now counts, because only then does
FM_HOME select nothing left to misroute. FM_ROOT_OVERRIDE never counts on its
own - it relocates the code root, not the home.

Resolving a home now also declares it to the processes that home's scripts
launch, so a child never has to re-derive its parent's reasoning from a
partial set of overrides. Exports reach only descendants, so this cannot
travel back to the session that invoked the script.

The refusal fires whenever the working directory is a live firstmate home,
which is exactly what the captain's primary home is, so running the suite
there refused across roughly a third of the tests. The suite now declares
itself with the process-tree form of the binding: every fixture home is built
by the test that then selects it, so nothing it hands down is ambient.
fm-spawn already blanks the binding on every launch line, and the secondmate
lifecycle test now pins that so the declaration cannot follow an agent out.
---
 bin/fm-home-anchor-lib.sh                 |  67 ++++++++++---
 bin/fm-test-run.sh                        |   6 ++
 docs/configuration.md                     |   8 +-
 tests/fm-home-anchor.test.sh              | 110 ++++++++++++++++++++--
 tests/fm-secondmate-lifecycle-e2e.test.sh |   5 +
 tests/lib.sh                              |   9 ++
 6 files changed, 183 insertions(+), 22 deletions(-)

diff --git a/bin/fm-home-anchor-lib.sh b/bin/fm-home-anchor-lib.sh
index c4ca9e6f03..a12489b396 100644
--- a/bin/fm-home-anchor-lib.sh
+++ b/bin/fm-home-anchor-lib.sh
@@ -22,13 +22,24 @@
 # The contract
 # ------------
 #   1. FM_HOME unset          -> FM_ROOT_OVERRIDE, else the caller's code root.
-#   2. Any FM_*_OVERRIDE set  -> the caller has taken explicit control of where
-#      this home's material lives, so FM_HOME is accepted as given.
-#   3. FM_HOME_BINDING naming the same home as FM_HOME -> a deliberate
-#      cross-home selection; FM_HOME is accepted as given. It names the home it
-#      was issued for, so a stale inherited binding cannot bless a different
-#      FM_HOME. bin/fm-spawn.sh blanks it on every launch line, so it can never
-#      reach an agent session by inheritance.
+#   2. EVERY home-material override set (FM_STATE_OVERRIDE, FM_DATA_OVERRIDE,
+#      FM_PROJECTS_OVERRIDE, FM_CONFIG_OVERRIDE) -> FM_HOME no longer selects any
+#      of this home's material, so there is nothing left for it to misroute and
+#      it is accepted as given. A partial set is deliberately not enough: the
+#      directories that were not overridden still come from FM_HOME, and a
+#      caller that derives one override FROM an ambient FM_HOME would otherwise
+#      launder that ambient value into a declaration. FM_ROOT_OVERRIDE never
+#      counts on its own, because it relocates the code root, not the home.
+#   3. FM_HOME_BINDING declares the selection deliberate, in one of two forms.
+#      A PATH naming the same home as FM_HOME is the per-invocation form every
+#      cross-home caller in bin/ uses; because it names the home it was issued
+#      for, a stale inherited binding cannot bless a different FM_HOME. The
+#      literal `test-harness` is the process-tree form, for a caller that
+#      constructs and names every home it hands down - firstmate's own test
+#      runner is the only such caller, since each fixture home is built by the
+#      test that then selects it. bin/fm-spawn.sh blanks FM_HOME_BINDING on
+#      every launch line, so neither form can reach an agent session by
+#      inheritance.
 #   4. Otherwise, when the working directory and FM_HOME are BOTH firstmate home
 #      roots and are not the same home -> refuse, naming both candidates.
 #   5. Otherwise FM_HOME stands.
@@ -114,6 +125,29 @@ fm_home_anchor_refuse() {  # <cwd-home> <given> <given-physical>
   } >&2
 }
 
+# Declare the home this process settled on to everything it launches, so a child
+# script does not have to re-derive the parent's reasoning from a partial set of
+# overrides. Exports never travel upward or sideways, so this reaches only this
+# process's own descendants - never the harness session that invoked it, and
+# never a sibling command.
+#
+# A child handed a DIFFERENT FM_HOME still sees this binding as a mismatch and
+# must declare its own, which is why firstmate's genuine cross-home calls set
+# FM_HOME_BINDING at the call site.
+# The process-tree declaration (contract rule 3). Kept as a constant so the one
+# literal firstmate's test runner exports has exactly one spelling.
+FM_HOME_ANCHOR_HARNESS_BINDING=test-harness
+
+fm_home_anchor_declare() {
+  # A process-tree declaration outranks a per-process one and must keep reaching
+  # the whole tree its owner drives, so never overwrite it with this home.
+  if [ "${FM_HOME_BINDING:-}" = "$FM_HOME_ANCHOR_HARNESS_BINDING" ]; then
+    return 0
+  fi
+  FM_HOME_BINDING=$FM_HOME
+  export FM_HOME_BINDING
+}
+
 # Resolve FM_HOME for this process. Sets FM_HOME; returns non-zero only when
 # resolution is genuinely ambiguous, after printing the diagnostic above unless
 # the caller asked for `quiet`.
@@ -122,33 +156,42 @@ fm_home_anchor_resolve() {  # <default-root> [quiet]
 
   if [ -z "${FM_HOME:-}" ]; then
     FM_HOME="${FM_ROOT_OVERRIDE:-$default_root}"
+    fm_home_anchor_declare
     return 0
   fi
   given=$FM_HOME
 
-  if [ -n "${FM_ROOT_OVERRIDE:-}" ] || [ -n "${FM_STATE_OVERRIDE:-}" ] ||
-    [ -n "${FM_DATA_OVERRIDE:-}" ] || [ -n "${FM_PROJECTS_OVERRIDE:-}" ] ||
-    [ -n "${FM_CONFIG_OVERRIDE:-}" ]; then
+  if [ -n "${FM_STATE_OVERRIDE:-}" ] && [ -n "${FM_DATA_OVERRIDE:-}" ] &&
+    [ -n "${FM_PROJECTS_OVERRIDE:-}" ] && [ -n "${FM_CONFIG_OVERRIDE:-}" ]; then
+    fm_home_anchor_declare
     return 0
   fi
 
   # Fork-free rejections before any path normalization.
   if [ "${PWD:-}" = "$given" ]; then
+    fm_home_anchor_declare
+    return 0
+  fi
+  if ! fm_home_anchor_is_home_root "${PWD:-}" || ! fm_home_anchor_is_home_root "$given"; then
+    fm_home_anchor_declare
     return 0
   fi
-  fm_home_anchor_is_home_root "${PWD:-}" || return 0
-  fm_home_anchor_is_home_root "$given" || return 0
 
   cwd=$(fm_home_anchor_physical "${PWD:-}")
   home_phys=$(fm_home_anchor_physical "$given")
   if [ -z "$cwd" ] || [ -z "$home_phys" ] || [ "$cwd" = "$home_phys" ]; then
+    fm_home_anchor_declare
     return 0
   fi
 
+  if [ "${FM_HOME_BINDING:-}" = "$FM_HOME_ANCHOR_HARNESS_BINDING" ]; then
+    return 0
+  fi
   if [ -n "${FM_HOME_BINDING:-}" ]; then
     bound=$(fm_home_anchor_physical "$FM_HOME_BINDING")
     [ -n "$bound" ] || bound=$FM_HOME_BINDING
     if [ "$bound" = "$home_phys" ]; then
+      fm_home_anchor_declare
       return 0
     fi
   fi
diff --git a/bin/fm-test-run.sh b/bin/fm-test-run.sh
index e56f49da08..d6bb2de6e0 100755
--- a/bin/fm-test-run.sh
+++ b/bin/fm-test-run.sh
@@ -67,6 +67,12 @@ set -eu
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$ROOT" || exit 1
 
+# Declare this process tree to the FM_HOME resolver (bin/fm-home-anchor-lib.sh)
+# for the scripts that do not source tests/lib.sh. The runner works from the code
+# root, which on a captain's machine is also a live firstmate home, while every
+# fixture home a test selects is one the test itself built.
+export FM_HOME_BINDING=test-harness
+
 MODE=
 LIST_ONLY=0
 LIST_FAMILIES=0
diff --git a/docs/configuration.md b/docs/configuration.md
index 9493a49476..67326dceda 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -187,7 +187,11 @@ When `FM_HOME` is unset, it also behaves as the old whole-root override.
 `FM_HOME` is inherited by every process launched from a session, so a session opened from another home's pane carries that home's `FM_HOME` even though the selection was never made for it.
 `bin/fm-home-anchor-lib.sh` is the single owner of the resulting resolution rule, and its header states that rule in full; every other script defers to it rather than resolving `FM_HOME` itself.
 The rule in short: a set `FM_HOME` stands, except that when the working directory and `FM_HOME` are both firstmate home roots and name different homes, resolution refuses with a diagnostic naming both candidates instead of guessing which one the command was meant for.
-Setting any `FM_*_OVERRIDE` directory, or setting `FM_HOME_BINDING` to the same home as `FM_HOME`, declares the selection deliberate and is accepted as given; `bin/fm-spawn.sh` blanks `FM_HOME_BINDING` on every launch line so a binding can never be inherited into an agent session.
+Setting `FM_HOME_BINDING` to the same home as `FM_HOME` declares the selection deliberate and is accepted as given, and a script that resolves its home exports that declaration to the processes it launches so a child never has to re-derive its parent's reasoning.
+`FM_HOME_BINDING=test-harness` is the process-tree form of that declaration, for a caller that constructs and names every home it hands down; firstmate's own test runner is the only such caller, because each fixture home is built by the test that then selects it.
+`bin/fm-spawn.sh` blanks `FM_HOME_BINDING` on every launch line, so neither form can be inherited into an agent session.
+Relocating every one of this home's directories at once - `FM_STATE_OVERRIDE`, `FM_DATA_OVERRIDE`, `FM_PROJECTS_OVERRIDE`, and `FM_CONFIG_OVERRIDE` together - is also accepted, because `FM_HOME` then selects no material left to misroute.
+A partial set is deliberately not enough, since whatever was not overridden still comes from `FM_HOME`, and `FM_ROOT_OVERRIDE` never declares a home on its own because it relocates the code root rather than the home.
 A pooled task worktree and a home's own `projects/<name>` clone are never home roots, so a crewmate working in either keeps the home that launched it.
 Before `fm-brief.sh`, `fm-spawn.sh`, or `fm-afk-launch.sh` persists a path or passes it to another process, it resolves each applicable relative `FM_HOME`, `FM_STATE_OVERRIDE`, or `FM_DATA_OVERRIDE` directory against the caller's working directory, preserves absolute spellings unchanged, and rejects an unresolvable relative directory with the offending variable named.
 Bootstrap applies the same relative `FM_HOME` resolution only when embedding that home in the generated X-mode poll shim; other transient consumers retain their existing shell-relative behavior.
@@ -391,7 +395,7 @@ Runtime tuning via environment variables (defaults shown):
 
 ```sh
 FM_HOME=                 # optional operational home for most scripts, unset means this repo root; fm-send requires it explicitly
-FM_HOME_BINDING=         # declares a deliberate cross-home FM_HOME by naming the same home; see the FM_HOME section
+FM_HOME_BINDING=         # declares a deliberate FM_HOME: the same home's path, or test-harness for a whole process tree; see the FM_HOME section
 FM_ROOT_OVERRIDE=        # override firstmate repo root, tangle-guard target, and zellij/cmux home-title hash; also legacy whole-root override when FM_HOME is unset
 FM_STATE_OVERRIDE=       # alternate state dir, mainly for tests
 FM_DATA_OVERRIDE=        # alternate data dir, mainly for tests
diff --git a/tests/fm-home-anchor.test.sh b/tests/fm-home-anchor.test.sh
index 02e7fbf436..75dd500fae 100755
--- a/tests/fm-home-anchor.test.sh
+++ b/tests/fm-home-anchor.test.sh
@@ -26,8 +26,14 @@ set -u
 # shellcheck source=tests/lib.sh
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
+# This suite is the one place that must see the resolver's real behavior, so it
+# drops the process-tree declaration tests/lib.sh exports for every other suite.
+# Cases that need a declaration set one explicitly.
+unset FM_HOME_BINDING
+
 MODE="$ROOT/bin/fm-project-mode.sh"
 SEND="$ROOT/bin/fm-send.sh"
+LOCK="$ROOT/bin/fm-lock.sh"
 TMP_ROOT=$(fm_test_tmproot fm-home-anchor)
 fm_git_identity fmtest fmtest@example.invalid
 
@@ -144,17 +150,37 @@ assert_contains "${res#*|}" "no-mistakes" "the launching home must still win ins
 pass "a project clone never promotes a worker to the home containing it"
 
 # ---------------------------------------------------------------------------
-# (f) The layout overrides are explicit control and are accepted as given.
+# (f) Relocating every one of this home's directories leaves FM_HOME selecting
+# no material at all, so there is nothing left for it to misroute. This is the
+# shape firstmate's own cross-home calls use.
 # ---------------------------------------------------------------------------
+res=$(run_in "$PRIMARY" env FM_HOME="$MATE" FM_STATE_OVERRIDE="$MATE/state" \
+  FM_DATA_OVERRIDE="$MATE/data" FM_PROJECTS_OVERRIDE="$MATE/projects" \
+  FM_CONFIG_OVERRIDE="$MATE/config" "$MODE" alpha)
+expect_code 0 "${res%%|*}" "a complete set of home-material overrides must be accepted"
+assert_contains "${res#*|}" "local-only" "a complete override set must select the named home"
+pass "a complete home-material override set keeps working across homes"
+
+# A partial set is not a declaration: whatever was not overridden still comes
+# from FM_HOME, so the ambiguity is real. This is the shape the Pi and OpenCode
+# watcher-arm paths use - they derive FM_CONFIG_OVERRIDE from the ambient
+# FM_HOME, which would otherwise launder that ambient value into a declaration.
 res=$(run_in "$PRIMARY" env FM_HOME="$MATE" FM_DATA_OVERRIDE="$MATE/data" "$MODE" alpha)
-expect_code 0 "${res%%|*}" "an explicit data override must be accepted"
-assert_contains "${res#*|}" "local-only" "an explicit override must select the named home"
-pass "FM_DATA_OVERRIDE keeps working across homes"
+expect_code 1 "${res%%|*}" "a partial override set must not declare an inherited home deliberate"
+pass "a partial home-material override set does not wave an inherited home through"
+
+res=$(run_in "$PRIMARY" env FM_HOME="$MATE" FM_ROOT_OVERRIDE="$ROOT" \
+  FM_CONFIG_OVERRIDE="$MATE/config" "$MODE" alpha)
+expect_code 1 "${res%%|*}" "the harness arm-path override shape must not bypass anchoring"
+assert_not_contains "${res#*|}" "local-only" "the arm-path shape must not reach the mate"
+pass "FM_ROOT_OVERRIDE plus a derived config override is not a declaration"
 
-res=$(run_in "$PRIMARY" env FM_HOME="$MATE" FM_ROOT_OVERRIDE="$ROOT" "$MODE" alpha)
-expect_code 0 "${res%%|*}" "an explicit root override must be accepted"
-assert_contains "${res#*|}" "local-only" "FM_ROOT_OVERRIDE must not re-anchor the home"
-pass "FM_ROOT_OVERRIDE keeps working across homes"
+# FM_ROOT_OVERRIDE relocates the code root, not the home, so it never declares a
+# home on its own - but it must still supply the home when FM_HOME is unset.
+res=$(run_in "$PRIMARY" env -u FM_HOME FM_ROOT_OVERRIDE="$MATE" "$MODE" alpha)
+expect_code 0 "${res%%|*}" "FM_ROOT_OVERRIDE must still stand in for an unset FM_HOME"
+assert_contains "${res#*|}" "local-only" "FM_ROOT_OVERRIDE must supply the home when FM_HOME is unset"
+pass "FM_ROOT_OVERRIDE still behaves as the whole-root override when FM_HOME is unset"
 
 # ---------------------------------------------------------------------------
 # (g)/(h) The binding declares a deliberate cross-home selection, and names the
@@ -170,6 +196,26 @@ expect_code 1 "${res%%|*}" "a binding for another home must not bless this FM_HO
 assert_not_contains "${res#*|}" "local-only" "a mismatched binding must not reach the mate"
 pass "a binding naming a different home does not bless an inherited FM_HOME"
 
+# The process-tree form covers a caller that builds every home it hands down, so
+# nothing it passes can be ambient. This suite's own runner is that caller.
+res=$(run_in "$PRIMARY" env FM_HOME="$MATE" FM_HOME_BINDING=test-harness "$MODE" alpha)
+expect_code 0 "${res%%|*}" "the process-tree declaration must be accepted"
+assert_contains "${res#*|}" "local-only" "the process-tree declaration must select the named home"
+pass "the process-tree declaration covers a caller that names every home it hands down"
+
+# It must survive the hand-off, or a nested call would lose it and refuse.
+# shellcheck disable=SC2016 # $1/$2 are the inner shell's positional args, not ours.
+res=$(run_in "$PRIMARY" env FM_HOME="$PRIMARY" FM_HOME_BINDING=test-harness bash -c \
+  'FM_HOME="$1" "$2" alpha' _ "$MATE" "$MODE")
+expect_code 0 "${res%%|*}" "the process-tree declaration must survive a nested hand-off"
+assert_contains "${res#*|}" "local-only" "a nested hand-off must still reach the named home"
+pass "the process-tree declaration is not overwritten by a resolved home"
+
+# A misspelling is not the declaration, and must not be read as a path either.
+res=$(run_in "$PRIMARY" env FM_HOME="$MATE" FM_HOME_BINDING=test_harness "$MODE" alpha)
+expect_code 1 "${res%%|*}" "only the exact process-tree literal may declare a tree"
+pass "a near-miss of the process-tree literal declares nothing"
+
 # ---------------------------------------------------------------------------
 # (i) With FM_HOME unset there is nothing ambient to second-guess: the code root
 # supplies the home, exactly as before.
@@ -204,3 +250,51 @@ res=$(run_in "$PRIMARY" env FM_HOME="$MATE" "$SEND" fm-nope hello)
 expect_code 1 "${res%%|*}" "fm-send must refuse an ambiently inherited home"
 assert_contains "${res#*|}" "$MATE" "fm-send's refusal must name the inherited candidate"
 pass "fm-send refuses to steer a fleet reached through an inherited home"
+
+# ---------------------------------------------------------------------------
+# The consequence the incident actually had: the session lock. Taking the other
+# home's lock locks that home out of its own session, so this is the assertion
+# that matters most - the refusal must leave no lock behind.
+# ---------------------------------------------------------------------------
+res=$(run_in "$PRIMARY" env FM_HOME="$MATE" "$LOCK")
+expect_code 1 "${res%%|*}" "the session lock must not be taken through an inherited home"
+assert_absent "$MATE/state/.lock" "a refused session must not hold the other home's session lock"
+pass "an inherited home cannot take another home's session lock"
+
+res=$(run_in "$MATE" env FM_HOME="$MATE" "$LOCK")
+expect_code 0 "${res%%|*}" "a mate must still take its own session lock"
+assert_present "$MATE/state/.lock" "a mate standing in its own home must hold its own lock"
+rm -f "$MATE/state/.lock"
+pass "a home standing in itself still takes its own session lock"
+
+# ---------------------------------------------------------------------------
+# bin/fm-spawn.sh blanks the layout overrides on every launch line, so a blanked
+# override is an empty value, not explicit control. An empty spelling must not
+# read as a declaration and wave the inherited home through.
+# ---------------------------------------------------------------------------
+res=$(run_in "$PRIMARY" env FM_HOME="$MATE" FM_ROOT_OVERRIDE= FM_STATE_OVERRIDE= \
+  FM_DATA_OVERRIDE= FM_PROJECTS_OVERRIDE= FM_CONFIG_OVERRIDE= FM_HOME_BINDING= "$MODE" alpha)
+expect_code 1 "${res%%|*}" "blanked overrides must not declare an inherited home deliberate"
+assert_not_contains "${res#*|}" "local-only" "blanked overrides must not reach the mate's registry"
+pass "blanked overrides and a blanked binding are not a deliberate declaration"
+
+# ---------------------------------------------------------------------------
+# A script that resolves its home declares it to the processes it launches, so a
+# child does not have to re-derive the parent's reasoning. The declaration must
+# reach descendants and must NOT leak back to the caller, or a single resolved
+# command would permanently bless the shell it ran in.
+# ---------------------------------------------------------------------------
+declared=$( (cd "$PRIMARY" && FM_HOME="$MATE" FM_HOME_BINDING="$MATE" \
+  "$ROOT/bin/fm-project-mode.sh" alpha >/dev/null 2>&1; printf '%s' "${FM_HOME_BINDING:-none}") )
+[ "$declared" = none ] || fail "a resolved home leaked a binding back into the calling shell: $declared"
+pass "a resolved home does not leak its declaration back to the caller"
+
+# The declaration lets a same-home hand-off through even when the child is given
+# only a partial override set, which is the shape firstmate's own nudge and
+# config-reread calls use.
+# shellcheck disable=SC2016 # $1/$2 are the inner shell's positional args, not ours.
+res=$(run_in "$MATE" env FM_HOME="$MATE" bash -c \
+  'FM_HOME="$1" FM_STATE_OVERRIDE="$1/state" "$2" alpha' _ "$MATE" "$MODE")
+expect_code 0 "${res%%|*}" "a declared same-home hand-off must reach the child"
+assert_contains "${res#*|}" "local-only" "a declared hand-off must keep reading the same home"
+pass "a resolved home is declared to the processes it launches"
diff --git a/tests/fm-secondmate-lifecycle-e2e.test.sh b/tests/fm-secondmate-lifecycle-e2e.test.sh
index 31af58c127..95a3b353b7 100755
--- a/tests/fm-secondmate-lifecycle-e2e.test.sh
+++ b/tests/fm-secondmate-lifecycle-e2e.test.sh
@@ -126,6 +126,11 @@ phase_spawn() {
   assert_grep "FM_HOME='$SUB_ABS'" "$LOG" "secondmate launch did not set FM_HOME to the subhome"
   assert_grep 'FM_ROOT_OVERRIDE= FM_STATE_OVERRIDE= FM_DATA_OVERRIDE= FM_PROJECTS_OVERRIDE=' "$LOG" "launch did not clear operational overrides"
   assert_grep 'FM_CONFIG_OVERRIDE=' "$LOG" "launch did not clear the config override"
+  # A home declaration must never follow an agent out of the launching session,
+  # or the crewmate would treat any inherited FM_HOME as chosen for it
+  # (bin/fm-home-anchor-lib.sh).
+  assert_grep 'FM_HOME_BINDING=' "$LOG" "launch did not clear the home declaration"
+  assert_no_grep 'FM_HOME_BINDING=test-harness' "$LOG" "launch carried the test harness declaration into the agent"
   assert_grep "$SUB_ABS/data/charter.md" "$LOG" "launch did not use the persistent charter"
   assert_no_grep 'notify=' "$LOG" "secondmate codex launch included the parent turn-end notify hook"
   assert_no_grep 'turn-ended' "$LOG" "secondmate codex launch referenced a parent turn-ended signal"
diff --git a/tests/lib.sh b/tests/lib.sh
index 8872cbe7ad..353e6aea9c 100644
--- a/tests/lib.sh
+++ b/tests/lib.sh
@@ -34,6 +34,15 @@ FM_TEST_LIB_SOURCED=1
 # strips this to verify real refusal.
 export FM_GATE_REFUSE_BYPASS=1
 
+# Declare this process tree to the FM_HOME resolver (bin/fm-home-anchor-lib.sh).
+# Every fixture home in this suite is built by the test that then selects it, so
+# an FM_HOME handed to a script here was always chosen, never inherited. Without
+# this the suite would refuse whenever the checkout it runs from is itself a live
+# firstmate home - which is exactly what the captain's primary home is. The
+# declaration reaches only this tree, and bin/fm-spawn.sh blanks it on every
+# launch line so it cannot follow a crewmate out of the suite.
+export FM_HOME_BINDING=test-harness
+
 # Resolve the repo root from this library's own location. Consumed by sourcing
 # test files, not by this library, so it reads as "unused" here.
 # shellcheck disable=SC2034

From f2b9089edd4cffa734d390640700f8dc58d338d9 Mon Sep 17 00:00:00 2001
From: Firstmate Crew <crew@firstmate.invalid>
Date: Fri, 31 Jul 2026 20:47:48 -0400
Subject: [PATCH 03/12] docs(verification): record the home-resolution harness,
 backend, and hook sweep

Captures the axes tests/fm-home-anchor.test.sh cannot assert: which primary
harness and runtime backend surfaces carry a home of their own, which are not
applicable, and what each hook does when resolution refuses - including the one
hook that must stay protective rather than decline.
---
 docs/documentation-audiences.json    |  4 +++
 docs/verification/home-resolution.md | 51 ++++++++++++++++++++++++++++
 2 files changed, 55 insertions(+)
 create mode 100644 docs/verification/home-resolution.md

diff --git a/docs/documentation-audiences.json b/docs/documentation-audiences.json
index 8f70cd346c..3bb52b8a9b 100644
--- a/docs/documentation-audiences.json
+++ b/docs/documentation-audiences.json
@@ -303,6 +303,10 @@
       "path": "docs/turnend-guard.md",
       "audience": "operator-current"
     },
+    {
+      "path": "docs/verification/home-resolution.md",
+      "audience": "maintainer-verification"
+    },
     {
       "path": "docs/verification/runtime-backends.md",
       "audience": "maintainer-verification"
diff --git a/docs/verification/home-resolution.md b/docs/verification/home-resolution.md
new file mode 100644
index 0000000000..ec609daab8
--- /dev/null
+++ b/docs/verification/home-resolution.md
@@ -0,0 +1,51 @@
+# Home resolution verification
+
+Audience: maintainer verification.
+
+This record supports the current guarantee that an ambiently inherited `FM_HOME` cannot route a command into a home it was not chosen for.
+The rule itself is owned by `bin/fm-home-anchor-lib.sh`, and the operator-facing description lives in [`docs/configuration.md`](../configuration.md) under "FM_HOME".
+Executable coverage of the rule is `tests/fm-home-anchor.test.sh`; this record holds only the axes a test cannot assert - which integration surfaces were inspected, and what the hooks do when resolution refuses.
+
+## Primary harnesses
+
+Checked on 2026-07-31 against every verified adapter.
+
+Resolution is a shell-level concern, so `claude`, `codex`, `opencode`, `pi`, `pi-signed`, `grok`, and `kimi` share one path through `bin/fm-home-anchor-lib.sh` whenever they invoke a `bin/fm-*.sh`.
+The harness-specific surfaces that carry a home of their own are these:
+
+- `bin/fm-turnend-guard.sh` is the shared Stop guard for every harness; `bin/fm-turnend-guard-grok.sh` delegates to it and reads no home itself, and `bin/fm-kimi-turnend-hook.sh` reads no `FM_*` variable at all.
+- `bin/fm-claude-stop-autoarm.sh`, `bin/fm-arm-pretool-check.sh`, `bin/fm-cd-pretool-check.sh`, and `bin/fm-subagent-pretool-check.sh` are the Claude-registered hooks. `fm-cd-pretool-check.sh` never reads `FM_HOME` and is not applicable.
+- `.pi/extensions/fm-primary-pi-watch.ts` and `.opencode/plugins/fm-primary-watch-arm.js` compute their own `FM_HOME` candidate in TypeScript and JavaScript. They remain candidates, not resolutions: each hands the value to `bin/fm-watch-arm.sh`, which resolves through the shared owner. Both set `FM_ROOT_OVERRIDE` and derive `FM_CONFIG_OVERRIDE` from that candidate, which is why a partial override set does not declare a home - see the contract in the owner's header.
+
+## Runtime backends
+
+Checked on 2026-07-31 against every spawn backend.
+
+`bin/backends/herdr.sh`, `bin/backends/zellij.sh`, and `bin/backends/cmux.sh` each carried their own copy of the resolution line for direct unit sourcing and now defer to the shared owner.
+`bin/backends/tmux.sh` and `bin/backends/orca.sh` read no `FM_HOME` and are not applicable.
+`codex-app` is not a selectable spawn backend and is not applicable.
+
+## Hook behavior when resolution refuses
+
+Reproduced with two synthetic home roots, the second carrying a `.fm-secondmate-home` marker, running each hook from the first with `FM_HOME` naming the second.
+Every hook declined without writing into the other home, and the count of files under the other home's `state/` was 0 before and 0 after:
+
+```
+fm-turnend-guard.sh            exit=0   (silent decline)
+fm-claude-stop-autoarm.sh      exit=0   (silent decline)
+fm-subagent-pretool-check.sh   exit=0   (inert, never blocks a call it cannot confirm)
+fm-cd-pretool-check.sh         exit=0   (does not read FM_HOME)
+fm-arm-pretool-check.sh        exit=2   (a broad watcher kill is still denied)
+fm-watch.sh --status           exit=1   error: FM_HOME names a different firstmate home ...
+```
+
+The same sweep with `FM_HOME` naming the home it stands in is the control: `fm-watch.sh` proceeds and writes that home's own watcher state, so the refusal above is the anchoring decision rather than an inert environment.
+
+`bin/fm-arm-pretool-check.sh` is the one hook that must stay protective under refusal, because declining to act would allow the dangerous command it exists to deny.
+It anchors on its own checkout when resolution cannot say which home the session belongs to, which can only widen the deny.
+
+## Suite behavior from a home root
+
+The captain's primary home is both the code root and a live firstmate home, so the suite runs from a directory that is itself a home root while each test selects a fixture home.
+`bin/fm-test-run.sh` and `tests/lib.sh` therefore export the process-tree form of the declaration described in the owner's header.
+Without it, roughly a third of the suite refuses in that configuration; `tests/fm-secondmate-lifecycle-e2e.test.sh` pins that `bin/fm-spawn.sh` blanks the declaration on every launch line, so it cannot follow an agent out of the suite.

From ba3c47a62052f57a1efd7d984d64ec70440fed63 Mon Sep 17 00:00:00 2001
From: Bchue <bchue@homeserver.tail25a02d.ts.net>
Date: Mon, 3 Aug 2026 16:11:17 -0400
Subject: [PATCH 04/12] test(lint): ask the lint owner's shellcheck question in
 the pre-tool checks

Both pre-tool tests ran bare `shellcheck <file>`, which is a second copy of
the lint definition that bin/fm-lint.sh owns - and a copy that asks a
different question. The owner passes --external-sources, so it resolves
`# shellcheck source=` directives; bare shellcheck reports every sourced
library as unfollowed (SC1091) and exits non-zero.

That divergence was latent until bin/fm-arm-pretool-check.sh grew a `.` line
for the shared FM_HOME resolver. The script is clean under the owner, CI, and
the pre-push gate, and fails only here, so the failure says nothing about the
script.

Align both invocations with the owner and note the cross-reference.
--source-path keeps the directive resolving from whatever directory the suite
runs in, since the spelling in the directive is repo-root-relative. The sibling
check sources nothing today but would have inherited the identical false
failure the day it does.

This is strictly more checking than before, not less: --external-sources also
lints the sourced file. Verified a deliberately broken copy still fails under
the new invocation.
---
 tests/fm-arm-pretool-check.test.sh | 9 ++++++++-
 tests/fm-cd-pretool-check.test.sh  | 5 ++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/tests/fm-arm-pretool-check.test.sh b/tests/fm-arm-pretool-check.test.sh
index 5ba750aea0..07fb8a08f3 100755
--- a/tests/fm-arm-pretool-check.test.sh
+++ b/tests/fm-arm-pretool-check.test.sh
@@ -443,7 +443,14 @@ test_allow_is_silent_both_modes() {
 
 test_shellcheck_clean() {
   command -v shellcheck >/dev/null 2>&1 || { pass "shellcheck not installed, skipping"; return; }
-  shellcheck "$CHECK" >/dev/null 2>&1 || fail "bin/fm-arm-pretool-check.sh is not shellcheck-clean"
+  # bin/fm-lint.sh owns the lint definition and resolves `# shellcheck source=`
+  # directives, so this check must ask the same question it does. Bare shellcheck
+  # asks a different one: it reports every sourced lib as unfollowed, which turns
+  # any script that grows a `.` line into a false failure here while the owner,
+  # CI, and the pre-push gate all still pass. --source-path keeps that resolution
+  # working from whatever directory this suite happens to run in.
+  shellcheck --norc --external-sources --source-path="$ROOT" "$CHECK" >/dev/null 2>&1 \
+    || fail "bin/fm-arm-pretool-check.sh is not shellcheck-clean"
   pass "bin/fm-arm-pretool-check.sh is shellcheck-clean"
 }
 
diff --git a/tests/fm-cd-pretool-check.test.sh b/tests/fm-cd-pretool-check.test.sh
index 80f8c03fc9..077b554762 100755
--- a/tests/fm-cd-pretool-check.test.sh
+++ b/tests/fm-cd-pretool-check.test.sh
@@ -374,7 +374,10 @@ test_policy_cli_direct() {
 
 test_scripts_are_shellcheck_clean() {
   command -v shellcheck >/dev/null 2>&1 || { pass "shellcheck not installed, skipping"; return; }
-  shellcheck "$ROOT/bin/fm-cd-pretool-check.sh" >/dev/null 2>&1 \
+  # Same question bin/fm-lint.sh asks; see the note in tests/fm-arm-pretool-check.test.sh.
+  # This script sources nothing today, so it is the sibling check that would have
+  # inherited the identical false failure the day it does.
+  shellcheck --norc --external-sources --source-path="$ROOT" "$ROOT/bin/fm-cd-pretool-check.sh" >/dev/null 2>&1 \
     || fail "bin/fm-cd-pretool-check.sh is not shellcheck-clean"
   pass "bin/fm-cd-pretool-check.sh is shellcheck-clean"
 }

From 430b3b9345f3cf98664d3f661ad116d3ee196786 Mon Sep 17 00:00:00 2001
From: Bchue <bchue@homeserver.tail25a02d.ts.net>
Date: Mon, 3 Aug 2026 20:46:13 -0400
Subject: [PATCH 05/12] no-mistakes(review): fix(home): close binding gaps and
 restore hook exit-0

---
 bin/fm-home-anchor-lib.sh    |  9 +++++++--
 bin/fm-sessionstart-nudge.sh |  2 +-
 bin/fm-spawn.sh              | 11 ++++++-----
 bin/fm-teardown.sh           |  2 +-
 4 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/bin/fm-home-anchor-lib.sh b/bin/fm-home-anchor-lib.sh
index a12489b396..f0c1db6433 100644
--- a/bin/fm-home-anchor-lib.sh
+++ b/bin/fm-home-anchor-lib.sh
@@ -65,7 +65,7 @@ if [ -n "${FM_HOME_ANCHOR_LIB_SOURCED:-}" ]; then
 fi
 FM_HOME_ANCHOR_LIB_SOURCED=1
 
-FM_HOME_ANCHOR_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+FM_HOME_ANCHOR_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)"
 
 # The secondmate-home marker predicate has one owner; reuse it rather than
 # re-deriving what a valid marker looks like.
@@ -144,7 +144,12 @@ fm_home_anchor_declare() {
   if [ "${FM_HOME_BINDING:-}" = "$FM_HOME_ANCHOR_HARNESS_BINDING" ]; then
     return 0
   fi
-  FM_HOME_BINDING=$FM_HOME
+  # A descendant reads this binding from its own working directory, so declare
+  # the physical path: a relative FM_HOME would name a different home there.
+  local declared
+  declared=$(fm_home_anchor_physical "$FM_HOME")
+  [ -n "$declared" ] || declared=$FM_HOME
+  FM_HOME_BINDING=$declared
   export FM_HOME_BINDING
 }
 
diff --git a/bin/fm-sessionstart-nudge.sh b/bin/fm-sessionstart-nudge.sh
index 6001879f8a..5a9025065d 100755
--- a/bin/fm-sessionstart-nudge.sh
+++ b/bin/fm-sessionstart-nudge.sh
@@ -11,7 +11,7 @@ FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
 # has one owner: bin/fm-home-anchor-lib.sh.
 # shellcheck source=bin/fm-home-anchor-lib.sh
 . "$SCRIPT_DIR/fm-home-anchor-lib.sh"
-fm_home_anchor_resolve "$FM_ROOT" || exit 1
+fm_home_anchor_resolve "$FM_ROOT" quiet || exit 0
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 
 # shellcheck source=bin/fm-gate-refuse-lib.sh
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 5917f1b657..ed030a08a8 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -1525,13 +1525,14 @@ LAUNCH=${LAUNCH//__OPINPUT__/$sq_opinput}
 if [ "$HARNESS" = claude ] && [ -n "${CLAUDE_CONFIG_DIR:-}" ]; then
   LAUNCH="CLAUDE_CONFIG_DIR=$(shell_quote "$CLAUDE_CONFIG_DIR") $LAUNCH"
 fi
+# FM_HOME_BINDING is blanked on every launch line, whatever the kind, so a
+# binding issued for some other home can never ride an inherited environment
+# into an agent session and bless an FM_HOME that session never chose
+# (bin/fm-home-anchor-lib.sh).
+LAUNCH="FM_HOME_BINDING= $LAUNCH"
 if [ "$KIND" = secondmate ]; then
   sq_home=$(shell_quote "$PROJ_ABS")
-  # FM_HOME_BINDING is blanked with the layout overrides so a binding issued for
-  # some other home can never ride an inherited environment into an agent
-  # session and bless an FM_HOME that session never chose
-  # (bin/fm-home-anchor-lib.sh).
-  LAUNCH="FM_ROOT_OVERRIDE= FM_STATE_OVERRIDE= FM_DATA_OVERRIDE= FM_PROJECTS_OVERRIDE= FM_CONFIG_OVERRIDE= FM_HOME_BINDING= FM_HOME=$sq_home $LAUNCH"
+  LAUNCH="FM_ROOT_OVERRIDE= FM_STATE_OVERRIDE= FM_DATA_OVERRIDE= FM_PROJECTS_OVERRIDE= FM_CONFIG_OVERRIDE= FM_HOME=$sq_home $LAUNCH"
 fi
 # Export GOTMPDIR into the crewmate's pane shell so the agent and every child
 # process (go build, go test, ...) inherit it. Sent before the launch command so
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index 0f488bb2b3..0a17c87c6e 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -1002,7 +1002,7 @@ cleanup_firstmate_home_children() {
       if [ "$child_backend" = zellij ]; then
         # Zellij titles are scoped by the owning home tag, so forced secondmate
         # cleanup must verify child tabs as that child home, not the parent.
-        ( unset FM_ROOT_OVERRIDE; FM_HOME=$home FM_ROOT=$home fm_backend_kill "$child_backend" "$child_t" "$(meta_value "$child_meta" zellij_tab_id)" "fm-$child_id" ) 2>/dev/null || true
+        ( unset FM_ROOT_OVERRIDE; FM_HOME=$home FM_HOME_BINDING=$home FM_ROOT=$home fm_backend_kill "$child_backend" "$child_t" "$(meta_value "$child_meta" zellij_tab_id)" "fm-$child_id" ) 2>/dev/null || true
       else
         fm_backend_kill "$child_backend" "$child_t" "$(meta_value "$child_meta" zellij_tab_id)" "fm-$child_id" 2>/dev/null || true
       fi

From 470c79fcb4ab073a5dc5d97609b9a5bc66ca350d Mon Sep 17 00:00:00 2001
From: Bchue <bchue@homeserver.tail25a02d.ts.net>
Date: Mon, 3 Aug 2026 20:53:38 -0400
Subject: [PATCH 06/12] no-mistakes(review): test(spawn): expect the cleared
 binding on every launch line

---
 docs/verification/home-resolution.md    | 4 ++++
 tests/fm-kimi-harness.test.sh           | 4 ++--
 tests/fm-spawn-dispatch-profile.test.sh | 4 ++--
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/docs/verification/home-resolution.md b/docs/verification/home-resolution.md
index ec609daab8..b05148fd62 100644
--- a/docs/verification/home-resolution.md
+++ b/docs/verification/home-resolution.md
@@ -15,6 +15,9 @@ The harness-specific surfaces that carry a home of their own are these:
 
 - `bin/fm-turnend-guard.sh` is the shared Stop guard for every harness; `bin/fm-turnend-guard-grok.sh` delegates to it and reads no home itself, and `bin/fm-kimi-turnend-hook.sh` reads no `FM_*` variable at all.
 - `bin/fm-claude-stop-autoarm.sh`, `bin/fm-arm-pretool-check.sh`, `bin/fm-cd-pretool-check.sh`, and `bin/fm-subagent-pretool-check.sh` are the Claude-registered hooks. `fm-cd-pretool-check.sh` never reads `FM_HOME` and is not applicable.
+- `bin/fm-sessionstart-nudge.sh` is the one session-open command every adapter invokes, registered by `.claude/settings.json`, `.codex/hooks.json`, `.grok/hooks/fm-primary-sessionstart-nudge.json`, and `.opencode/plugins/fm-primary-sessionstart-nudge.js`, with Pi reaching it through `.pi/extensions/fm-primary-turnend-guard.ts`.
+  It reads `FM_HOME` for the state directory it checks, and declines silently under refusal because a Claude `SessionStart` non-zero exit blocks session initialization.
+  `docs/sessionstart-nudge.md` owns that transport and exit contract.
 - `.pi/extensions/fm-primary-pi-watch.ts` and `.opencode/plugins/fm-primary-watch-arm.js` compute their own `FM_HOME` candidate in TypeScript and JavaScript. They remain candidates, not resolutions: each hands the value to `bin/fm-watch-arm.sh`, which resolves through the shared owner. Both set `FM_ROOT_OVERRIDE` and derive `FM_CONFIG_OVERRIDE` from that candidate, which is why a partial override set does not declare a home - see the contract in the owner's header.
 
 ## Runtime backends
@@ -33,6 +36,7 @@ Every hook declined without writing into the other home, and the count of files
 ```
 fm-turnend-guard.sh            exit=0   (silent decline)
 fm-claude-stop-autoarm.sh      exit=0   (silent decline)
+fm-sessionstart-nudge.sh       exit=0   (silent decline, no nudge printed)
 fm-subagent-pretool-check.sh   exit=0   (inert, never blocks a call it cannot confirm)
 fm-cd-pretool-check.sh         exit=0   (does not read FM_HOME)
 fm-arm-pretool-check.sh        exit=2   (a broad watcher kill is still denied)
diff --git a/tests/fm-kimi-harness.test.sh b/tests/fm-kimi-harness.test.sh
index 8e27052d8c..8c11c314b6 100755
--- a/tests/fm-kimi-harness.test.sh
+++ b/tests/fm-kimi-harness.test.sh
@@ -192,7 +192,7 @@ test_kimi_launch_then_send_is_verified() {
   assert_contains "$out" "spawned $id harness=kimi" "kimi spawn did not report success"
 
   launch=$(cat "$CASE_DIR/launch.log")
-  [ "$launch" = "'$FAKEBIN_DIR/kimi' --model 'kimi-code/k3' --auto" ] \
+  [ "$launch" = "FM_HOME_BINDING= '$FAKEBIN_DIR/kimi' --model 'kimi-code/k3' --auto" ] \
     || fail "kimi launch did not use the absolute binary, model, and --auto only: $launch"
   assert_not_contains "$launch" "--effort" "kimi launch emitted a nonexistent effort flag"
   assert_not_contains "$launch" "turn-ended" "kimi launch embedded a turn-end path"
@@ -449,7 +449,7 @@ test_kimi_falls_back_to_expanded_home_binary() {
   rc=$?
   expect_code 0 "$rc" "Kimi HOME fallback spawn should succeed"
   launch=$(cat "$CASE_DIR/launch.log")
-  [ "$launch" = "'$fallback' --auto" ] \
+  [ "$launch" = "FM_HOME_BINDING= '$fallback' --auto" ] \
     || fail "Kimi fallback did not expand HOME into an absolute executable: $launch"
   pass "fm-spawn: Kimi fallback expands the active HOME"
 }
diff --git a/tests/fm-spawn-dispatch-profile.test.sh b/tests/fm-spawn-dispatch-profile.test.sh
index e5f017608d..7e57655218 100755
--- a/tests/fm-spawn-dispatch-profile.test.sh
+++ b/tests/fm-spawn-dispatch-profile.test.sh
@@ -123,7 +123,7 @@ test_no_profile_keeps_claude_profile_defaults() {
   assert_meta_profile "$HOME_DIR/state/$id.meta" claude default default
 
   launch=$(cat "$LAUNCH_LOG")
-  expected="CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false claude --dangerously-skip-permissions \"\$('${ROOT}/bin/fm-operational-input.sh' encode launch-brief < '$HOME_DIR/data/$id/brief.md')\""
+  expected="FM_HOME_BINDING= CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false claude --dangerously-skip-permissions \"\$('${ROOT}/bin/fm-operational-input.sh' encode launch-brief < '$HOME_DIR/data/$id/brief.md')\""
   [ "$launch" = "$expected" ] || fail "no-profile claude launch did not use the canonical launch kind"$'\n'"expected: $expected"$'\n'"actual:   $launch"
   pass "no --model/--effort records defaults and types the claude launch instructions"
 }
@@ -356,7 +356,7 @@ test_active_dispatch_profile_allows_raw_launch_command() {
   assert_contains "$out" "spawned $id harness=custom-agent" "spawn did not report raw command harness"
   assert_meta_profile "$HOME_DIR/state/$id.meta" custom-agent default default
   launch=$(cat "$LAUNCH_LOG")
-  [ "$launch" = "custom-agent --flag" ] || fail "raw launch command changed"$'\n'"actual: $launch"
+  [ "$launch" = "FM_HOME_BINDING= custom-agent --flag" ] || fail "raw launch command changed"$'\n'"actual: $launch"
   pass "active crew-dispatch profile allows the raw launch-command escape hatch"
 }
 

From 7f6e5983d827268b8c067ef5c61a8d662fd16aaf Mon Sep 17 00:00:00 2001
From: Bchue <bchue@homeserver.tail25a02d.ts.net>
Date: Tue, 4 Aug 2026 20:46:19 -0400
Subject: [PATCH 07/12] no-mistakes(review): fix(home): stop exporting the home
 declaration to descendants

---
 bin/fm-home-anchor-lib.sh            | 36 +++----------
 docs/configuration.md                |  3 +-
 docs/verification/home-resolution.md |  8 +++
 tests/fm-home-anchor.test.sh         | 75 ++++++++++++++++++++++------
 4 files changed, 76 insertions(+), 46 deletions(-)

diff --git a/bin/fm-home-anchor-lib.sh b/bin/fm-home-anchor-lib.sh
index f0c1db6433..e710b56f43 100644
--- a/bin/fm-home-anchor-lib.sh
+++ b/bin/fm-home-anchor-lib.sh
@@ -40,6 +40,12 @@
 #      test that then selects it. bin/fm-spawn.sh blanks FM_HOME_BINDING on
 #      every launch line, so neither form can reach an agent session by
 #      inheritance.
+#      Resolution READS a binding and never issues one. Nothing here is
+#      exported, so a declaration covers the command tree its caller chose to
+#      hand it to and no other: a long-lived process started from a home - the
+#      multiplexer server bin/backends/tmux.sh and bin/backends/zellij.sh create,
+#      whose every later pane inherits its environment - can only capture a
+#      declaration that was deliberately handed to it.
 #   4. Otherwise, when the working directory and FM_HOME are BOTH firstmate home
 #      roots and are not the same home -> refuse, naming both candidates.
 #   5. Otherwise FM_HOME stands.
@@ -125,34 +131,10 @@ fm_home_anchor_refuse() {  # <cwd-home> <given> <given-physical>
   } >&2
 }
 
-# Declare the home this process settled on to everything it launches, so a child
-# script does not have to re-derive the parent's reasoning from a partial set of
-# overrides. Exports never travel upward or sideways, so this reaches only this
-# process's own descendants - never the harness session that invoked it, and
-# never a sibling command.
-#
-# A child handed a DIFFERENT FM_HOME still sees this binding as a mismatch and
-# must declare its own, which is why firstmate's genuine cross-home calls set
-# FM_HOME_BINDING at the call site.
 # The process-tree declaration (contract rule 3). Kept as a constant so the one
 # literal firstmate's test runner exports has exactly one spelling.
 FM_HOME_ANCHOR_HARNESS_BINDING=test-harness
 
-fm_home_anchor_declare() {
-  # A process-tree declaration outranks a per-process one and must keep reaching
-  # the whole tree its owner drives, so never overwrite it with this home.
-  if [ "${FM_HOME_BINDING:-}" = "$FM_HOME_ANCHOR_HARNESS_BINDING" ]; then
-    return 0
-  fi
-  # A descendant reads this binding from its own working directory, so declare
-  # the physical path: a relative FM_HOME would name a different home there.
-  local declared
-  declared=$(fm_home_anchor_physical "$FM_HOME")
-  [ -n "$declared" ] || declared=$FM_HOME
-  FM_HOME_BINDING=$declared
-  export FM_HOME_BINDING
-}
-
 # Resolve FM_HOME for this process. Sets FM_HOME; returns non-zero only when
 # resolution is genuinely ambiguous, after printing the diagnostic above unless
 # the caller asked for `quiet`.
@@ -161,31 +143,26 @@ fm_home_anchor_resolve() {  # <default-root> [quiet]
 
   if [ -z "${FM_HOME:-}" ]; then
     FM_HOME="${FM_ROOT_OVERRIDE:-$default_root}"
-    fm_home_anchor_declare
     return 0
   fi
   given=$FM_HOME
 
   if [ -n "${FM_STATE_OVERRIDE:-}" ] && [ -n "${FM_DATA_OVERRIDE:-}" ] &&
     [ -n "${FM_PROJECTS_OVERRIDE:-}" ] && [ -n "${FM_CONFIG_OVERRIDE:-}" ]; then
-    fm_home_anchor_declare
     return 0
   fi
 
   # Fork-free rejections before any path normalization.
   if [ "${PWD:-}" = "$given" ]; then
-    fm_home_anchor_declare
     return 0
   fi
   if ! fm_home_anchor_is_home_root "${PWD:-}" || ! fm_home_anchor_is_home_root "$given"; then
-    fm_home_anchor_declare
     return 0
   fi
 
   cwd=$(fm_home_anchor_physical "${PWD:-}")
   home_phys=$(fm_home_anchor_physical "$given")
   if [ -z "$cwd" ] || [ -z "$home_phys" ] || [ "$cwd" = "$home_phys" ]; then
-    fm_home_anchor_declare
     return 0
   fi
 
@@ -196,7 +173,6 @@ fm_home_anchor_resolve() {  # <default-root> [quiet]
     bound=$(fm_home_anchor_physical "$FM_HOME_BINDING")
     [ -n "$bound" ] || bound=$FM_HOME_BINDING
     if [ "$bound" = "$home_phys" ]; then
-      fm_home_anchor_declare
       return 0
     fi
   fi
diff --git a/docs/configuration.md b/docs/configuration.md
index 67326dceda..ee177c5d6e 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -187,7 +187,8 @@ When `FM_HOME` is unset, it also behaves as the old whole-root override.
 `FM_HOME` is inherited by every process launched from a session, so a session opened from another home's pane carries that home's `FM_HOME` even though the selection was never made for it.
 `bin/fm-home-anchor-lib.sh` is the single owner of the resulting resolution rule, and its header states that rule in full; every other script defers to it rather than resolving `FM_HOME` itself.
 The rule in short: a set `FM_HOME` stands, except that when the working directory and `FM_HOME` are both firstmate home roots and name different homes, resolution refuses with a diagnostic naming both candidates instead of guessing which one the command was meant for.
-Setting `FM_HOME_BINDING` to the same home as `FM_HOME` declares the selection deliberate and is accepted as given, and a script that resolves its home exports that declaration to the processes it launches so a child never has to re-derive its parent's reasoning.
+Setting `FM_HOME_BINDING` to the same home as `FM_HOME` declares the selection deliberate and is accepted as given; every genuine cross-home call in `bin/` sets it per invocation, alongside the `FM_HOME` it is declaring.
+Resolution reads that declaration and never issues one of its own, so a binding reaches only the command tree its caller handed it to and can never be picked up by an unrelated descendant of a process that merely resolved a home.
 `FM_HOME_BINDING=test-harness` is the process-tree form of that declaration, for a caller that constructs and names every home it hands down; firstmate's own test runner is the only such caller, because each fixture home is built by the test that then selects it.
 `bin/fm-spawn.sh` blanks `FM_HOME_BINDING` on every launch line, so neither form can be inherited into an agent session.
 Relocating every one of this home's directories at once - `FM_STATE_OVERRIDE`, `FM_DATA_OVERRIDE`, `FM_PROJECTS_OVERRIDE`, and `FM_CONFIG_OVERRIDE` together - is also accepted, because `FM_HOME` then selects no material left to misroute.
diff --git a/docs/verification/home-resolution.md b/docs/verification/home-resolution.md
index b05148fd62..ae5b37cb73 100644
--- a/docs/verification/home-resolution.md
+++ b/docs/verification/home-resolution.md
@@ -48,6 +48,14 @@ The same sweep with `FM_HOME` naming the home it stands in is the control: `fm-w
 `bin/fm-arm-pretool-check.sh` is the one hook that must stay protective under refusal, because declining to act would allow the dangerous command it exists to deny.
 It anchors on its own checkout when resolution cannot say which home the session belongs to, which can only widen the deny.
 
+## How far a declaration reaches
+
+Resolution reads `FM_HOME_BINDING` and never sets or exports one, so a declaration reaches only the command tree whose caller passed it.
+That boundary is load-bearing for the long-lived process trees firstmate creates.
+`bin/backends/tmux.sh` and `bin/backends/zellij.sh` ensure a multiplexer server by running a create command from whatever environment the spawning command had, and when no server is running yet that call starts one, whose captured environment every later pane inherits.
+A declaration minted by resolution and exported to descendants would have been captured there, and would then have blessed an inherited `FM_HOME` for a human session opened in one of those panes from a different home root - the exact misroute this rule exists to refuse.
+The per-invocation form firstmate's own cross-home calls use is unaffected, because each of those callers names the home it is declaring on the same command line.
+
 ## Suite behavior from a home root
 
 The captain's primary home is both the code root and a live firstmate home, so the suite runs from a directory that is itself a home root while each test selects a fixture home.
diff --git a/tests/fm-home-anchor.test.sh b/tests/fm-home-anchor.test.sh
index 75dd500fae..5eed5adb2a 100755
--- a/tests/fm-home-anchor.test.sh
+++ b/tests/fm-home-anchor.test.sh
@@ -21,6 +21,7 @@
 #   (i) FM_HOME unset                                -> the code root's own home
 #   (j) FM_HOME that is not a home root              -> no rival claim, stands
 #   (k) fm-send keeps its own fail-closed contract and gains the refusal
+#   (l) resolving a home issues no declaration of its own to descendants
 set -u
 
 # shellcheck source=tests/lib.sh
@@ -279,22 +280,66 @@ assert_not_contains "${res#*|}" "local-only" "blanked overrides must not reach t
 pass "blanked overrides and a blanked binding are not a deliberate declaration"
 
 # ---------------------------------------------------------------------------
-# A script that resolves its home declares it to the processes it launches, so a
-# child does not have to re-derive the parent's reasoning. The declaration must
-# reach descendants and must NOT leak back to the caller, or a single resolved
-# command would permanently bless the shell it ran in.
+# How far a declaration reaches. Resolving a home must not mint a binding of its
+# own, or a process that resolved once would hand that declaration to every
+# descendant - including the multiplexer server a spawn starts, whose captured
+# environment every later pane inherits - and bless an inherited FM_HOME for a
+# session that stands in a different home entirely.
+#
+# This stand-in is the shape of the ~50 bin/fm-*.sh that source the resolver: it
+# resolves a home, carries FM_HOME onward the way a launched session carries it,
+# then runs a command from another directory.
 # ---------------------------------------------------------------------------
-declared=$( (cd "$PRIMARY" && FM_HOME="$MATE" FM_HOME_BINDING="$MATE" \
-  "$ROOT/bin/fm-project-mode.sh" alpha >/dev/null 2>&1; printf '%s' "${FM_HOME_BINDING:-none}") )
-[ "$declared" = none ] || fail "a resolved home leaked a binding back into the calling shell: $declared"
-pass "a resolved home does not leak its declaration back to the caller"
-
-# The declaration lets a same-home hand-off through even when the child is given
-# only a partial override set, which is the shape firstmate's own nudge and
-# config-reread calls use.
+CALLER="$TMP_ROOT/resolve-then-run.sh"
+cat > "$CALLER" <<'EOF'
+#!/usr/bin/env bash
+# usage: resolve-then-run.sh <lib> <default-root> <cd-to> <cmd...>
+set -u
+lib=$1 default_root=$2 dir=$3
+shift 3
+# shellcheck source=/dev/null
+. "$lib"
+fm_home_anchor_resolve "$default_root" || exit 1
+export FM_HOME
+cd "$dir" || exit 1
+exec "$@"
+EOF
+chmod +x "$CALLER"
+LIB="$ROOT/bin/fm-home-anchor-lib.sh"
+# shellcheck disable=SC2016 # the binding is read in the launched process, not here.
+SHOW_BINDING=('bash' '-c' 'printf %s "${FM_HOME_BINDING-none}"')
+
+res=$(run_in "$MATE" env FM_HOME="$MATE" "$CALLER" "$LIB" "$ROOT" "$PRIMARY" "$MODE" alpha)
+expect_code 1 "${res%%|*}" "a resolved home must not bless a descendant standing in another home"
+assert_not_contains "${res#*|}" "local-only" "a leaked declaration must not reach the mate's registry"
+pass "resolving a home does not bless a later command standing in a different home"
+
+res=$(run_in "$MATE" env FM_HOME="$MATE" "$CALLER" "$LIB" "$ROOT" "$MATE" "${SHOW_BINDING[@]}")
+expect_code 0 "${res%%|*}" "the stand-in must resolve its own home"
+[ "${res#*|}" = none ] || fail "resolution handed a declaration to the process it launched: ${res#*|}"
+pass "resolution hands no declaration to the processes it launches"
+
+# The per-invocation form every cross-home caller in bin/ uses still reaches the
+# command tree its caller chose, because that caller passes it explicitly.
+res=$(run_in "$PRIMARY" env FM_HOME="$MATE" FM_HOME_BINDING="$MATE" \
+  "$CALLER" "$LIB" "$ROOT" "$PRIMARY" "${SHOW_BINDING[@]}")
+expect_code 0 "${res%%|*}" "an explicit cross-home binding must still resolve"
+[ "${res#*|}" = "$MATE" ] || fail "an explicitly passed binding did not reach the command it was issued for: ${res#*|}"
+pass "a binding passed per invocation still reaches the command tree it was issued for"
+
+# The process-tree form belongs to the harness that exported it, so it must keep
+# reaching the whole tree and must not be replaced by a resolved home.
+res=$(run_in "$PRIMARY" env FM_HOME="$MATE" FM_HOME_BINDING=test-harness \
+  "$CALLER" "$LIB" "$ROOT" "$PRIMARY" "${SHOW_BINDING[@]}")
+expect_code 0 "${res%%|*}" "the process-tree declaration must still resolve"
+[ "${res#*|}" = test-harness ] || fail "the process-tree declaration did not survive resolution: ${res#*|}"
+pass "the process-tree declaration keeps reaching the tree its owner drives"
+
+# A same-home hand-off carrying only a partial override set still reaches the
+# child, which is the shape firstmate's own nudge and config-reread calls use.
 # shellcheck disable=SC2016 # $1/$2 are the inner shell's positional args, not ours.
 res=$(run_in "$MATE" env FM_HOME="$MATE" bash -c \
   'FM_HOME="$1" FM_STATE_OVERRIDE="$1/state" "$2" alpha' _ "$MATE" "$MODE")
-expect_code 0 "${res%%|*}" "a declared same-home hand-off must reach the child"
-assert_contains "${res#*|}" "local-only" "a declared hand-off must keep reading the same home"
-pass "a resolved home is declared to the processes it launches"
+expect_code 0 "${res%%|*}" "a same-home hand-off must reach the child"
+assert_contains "${res#*|}" "local-only" "a same-home hand-off must keep reading the same home"
+pass "a same-home hand-off with a partial override set still reaches the child"

From 7adcc3120b06e362892be3dfc97822fcbf9a2aa7 Mon Sep 17 00:00:00 2001
From: Bchue <bchue@homeserver.tail25a02d.ts.net>
Date: Tue, 4 Aug 2026 22:46:59 -0400
Subject: [PATCH 08/12] no-mistakes(review): fix(home): record the process's
 resolution and bind hand-offs

---
 bin/fm-bootstrap.sh                        |  4 +-
 bin/fm-home-anchor-lib.sh                  | 54 ++++++++++++++++++-
 bin/fm-home-seed.sh                        |  4 +-
 bin/fm-teardown.sh                         |  2 +-
 bin/fm-watch.sh                            |  2 +-
 docs/configuration.md                      |  2 +
 docs/verification/home-resolution.md       | 11 ++++
 tests/fm-calm-pi-extension.test.sh         |  2 +-
 tests/fm-home-anchor.test.sh               | 63 ++++++++++++++++++++++
 tests/fm-opencode-primary-live-e2e.test.sh |  1 +
 tests/fm-pi-primary-live-e2e.test.sh       |  3 ++
 11 files changed, 140 insertions(+), 8 deletions(-)

diff --git a/bin/fm-bootstrap.sh b/bin/fm-bootstrap.sh
index fbb6c543b7..5e8b61a2d0 100755
--- a/bin/fm-bootstrap.sh
+++ b/bin/fm-bootstrap.sh
@@ -264,7 +264,7 @@ secondmate_sync() {
       echo "NUDGE_SECONDMATES: secondmate $id: send failed: cannot record retry marker"
       return 0
     fi
-    if out=$(FM_HOME="$FM_HOME" FM_ROOT_OVERRIDE="$FM_ROOT" FM_STATE_OVERRIDE="$STATE" "$SCRIPT_DIR/fm-send.sh" "$selector" "$SECOND_MATE_NUDGE_MESSAGE" 2>&1); then
+    if out=$(FM_HOME="$FM_HOME" FM_HOME_BINDING="$FM_HOME" FM_ROOT_OVERRIDE="$FM_ROOT" FM_STATE_OVERRIDE="$STATE" "$SCRIPT_DIR/fm-send.sh" "$selector" "$SECOND_MATE_NUDGE_MESSAGE" 2>&1); then
       rm -f "$marker"
       echo "BOOTSTRAP_INFO: nudged $selector with '$SECOND_MATE_NUDGE_MESSAGE'"
     else
@@ -324,7 +324,7 @@ secondmate_sync() {
         echo "NUDGE_SECONDMATES: secondmate $id: send failed: retry target is not at recorded instruction commit"
         continue
       }
-      if out=$(FM_HOME="$FM_HOME" FM_ROOT_OVERRIDE="$FM_ROOT" FM_STATE_OVERRIDE="$STATE" "$SCRIPT_DIR/fm-send.sh" "$selector" "$SECOND_MATE_NUDGE_MESSAGE" 2>&1); then
+      if out=$(FM_HOME="$FM_HOME" FM_HOME_BINDING="$FM_HOME" FM_ROOT_OVERRIDE="$FM_ROOT" FM_STATE_OVERRIDE="$STATE" "$SCRIPT_DIR/fm-send.sh" "$selector" "$SECOND_MATE_NUDGE_MESSAGE" 2>&1); then
         rm -f "$marker"
         echo "BOOTSTRAP_INFO: nudged $selector with '$SECOND_MATE_NUDGE_MESSAGE'"
       else
diff --git a/bin/fm-home-anchor-lib.sh b/bin/fm-home-anchor-lib.sh
index e710b56f43..b13812a355 100644
--- a/bin/fm-home-anchor-lib.sh
+++ b/bin/fm-home-anchor-lib.sh
@@ -50,6 +50,20 @@
 #      roots and are not the same home -> refuse, naming both candidates.
 #   5. Otherwise FM_HOME stands.
 #
+# Resolution is idempotent within one process. Rule 1 turns an unset FM_HOME
+# into a set one, and no environment variable can record that THIS process made
+# that choice, so a later resolve - the libraries a script sources re-resolve at
+# source time - would re-judge the value the first resolve assigned as if it had
+# been inherited, and a process standing in a home root whose code root is a
+# different home root would refuse itself. Resolution therefore records the home
+# it settled on, as a physical path, in a plain non-exported shell variable, and
+# reads that record back instead of re-judging. The record is bound to this
+# process by PID, because bash presents an environment variable of the same name
+# as an ordinary shell variable and a value arriving from outside must never be
+# read as a decision this process made. It is honored only while FM_HOME still
+# names that same home: it records a decision about one specific home, never a
+# blanket blessing of whatever FM_HOME holds later.
+#
 # Rule 4 is deliberately narrow in both directions. The working directory must
 # BE a home root, never merely be contained in one: crewmates legitimately run
 # inside a home's projects/<name> clone and inside pooled task worktrees, and
@@ -135,10 +149,44 @@ fm_home_anchor_refuse() {  # <cwd-home> <given> <given-physical>
 # literal firstmate's test runner exports has exactly one spelling.
 FM_HOME_ANCHOR_HARNESS_BINDING=test-harness
 
+# This process's own resolution, never exported. Cleared here on the first source
+# so a same-named value inherited from the environment starts out as no record at
+# all, and PID-bound below so it could not be honored even if it arrived already
+# exported.
+FM_HOME_ANCHOR_RESOLVED_PID=
+FM_HOME_ANCHOR_RESOLVED_HOME=
+
+# Remember that this process resolved to $1, so a later resolve reads the
+# decision back rather than re-judging it.
+fm_home_anchor_record() {  # <resolved>
+  local phys
+  phys=$(fm_home_anchor_physical "${1:-}")
+  [ -n "$phys" ] || phys=${1:-}
+  FM_HOME_ANCHOR_RESOLVED_HOME=$phys
+  FM_HOME_ANCHOR_RESOLVED_PID=$$
+}
+
+# Return 0 when THIS process already resolved to the home $1 names.
+fm_home_anchor_recorded() {  # <given>
+  local given=${1:-} phys
+  [ "${FM_HOME_ANCHOR_RESOLVED_PID:-}" = "$$" ] || return 1
+  [ -n "${FM_HOME_ANCHOR_RESOLVED_HOME:-}" ] || return 1
+  [ "$given" != "$FM_HOME_ANCHOR_RESOLVED_HOME" ] || return 0
+  phys=$(fm_home_anchor_physical "$given")
+  [ -n "$phys" ] && [ "$phys" = "$FM_HOME_ANCHOR_RESOLVED_HOME" ]
+}
+
 # Resolve FM_HOME for this process. Sets FM_HOME; returns non-zero only when
 # resolution is genuinely ambiguous, after printing the diagnostic above unless
-# the caller asked for `quiet`.
+# the caller asked for `quiet`. A resolution that stands is recorded, so every
+# later resolve in the same process settles the same way.
 fm_home_anchor_resolve() {  # <default-root> [quiet]
+  fm_home_anchor_judge "${1:-}" "${2:-}" || return 1
+  fm_home_anchor_record "$FM_HOME"
+}
+
+# The judgement itself, with no record of its own: contract rules 1 to 5.
+fm_home_anchor_judge() {  # <default-root> [quiet]
   local default_root=${1:-} quiet=${2:-} given cwd home_phys bound
 
   if [ -z "${FM_HOME:-}" ]; then
@@ -147,6 +195,10 @@ fm_home_anchor_resolve() {  # <default-root> [quiet]
   fi
   given=$FM_HOME
 
+  if fm_home_anchor_recorded "$given"; then
+    return 0
+  fi
+
   if [ -n "${FM_STATE_OVERRIDE:-}" ] && [ -n "${FM_DATA_OVERRIDE:-}" ] &&
     [ -n "${FM_PROJECTS_OVERRIDE:-}" ] && [ -n "${FM_CONFIG_OVERRIDE:-}" ]; then
     return 0
diff --git a/bin/fm-home-seed.sh b/bin/fm-home-seed.sh
index 550968c1ed..7b6310f870 100755
--- a/bin/fm-home-seed.sh
+++ b/bin/fm-home-seed.sh
@@ -544,7 +544,7 @@ clone_project() {
   [ -d "$src" ] || { echo "error: project $project not found at $src" >&2; return 1; }
   git -C "$src" rev-parse --is-inside-work-tree >/dev/null 2>&1 || { echo "error: project $project is not a git repo" >&2; return 1; }
   read -r mode _ <<EOF
-$(FM_HOME="$FM_HOME" FM_DATA_OVERRIDE="$DATA" "$FM_ROOT/bin/fm-project-mode.sh" "$project")
+$(FM_HOME="$FM_HOME" FM_HOME_BINDING="$FM_HOME" FM_DATA_OVERRIDE="$DATA" "$FM_ROOT/bin/fm-project-mode.sh" "$project")
 EOF
   if [ "$mode" = local-only ]; then
     echo "error: project $project is local-only; secondmate routes support only no-mistakes and direct-PR projects" >&2
@@ -571,7 +571,7 @@ validate_seed_project() {
   [ -d "$src" ] || { echo "error: project $project not found at $src" >&2; return 1; }
   git -C "$src" rev-parse --is-inside-work-tree >/dev/null 2>&1 || { echo "error: project $project is not a git repo" >&2; return 1; }
   read -r mode _ <<EOF
-$(FM_HOME="$FM_HOME" FM_DATA_OVERRIDE="$DATA" "$FM_ROOT/bin/fm-project-mode.sh" "$project")
+$(FM_HOME="$FM_HOME" FM_HOME_BINDING="$FM_HOME" FM_DATA_OVERRIDE="$DATA" "$FM_ROOT/bin/fm-project-mode.sh" "$project")
 EOF
   if [ "$mode" = local-only ]; then
     echo "error: project $project is local-only; secondmate routes support only no-mistakes and direct-PR projects" >&2
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index 0a17c87c6e..a5a61de8ec 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -1089,7 +1089,7 @@ if [ "$KIND" = scout ] && [ "$FORCE" != "--force" ]; then
     echo "The report is the work product. Have the crewmate write it, or use --force after explicit discard approval." >&2
     exit 1
   fi
-  if ! FM_HOME="$FM_HOME" FM_STATE_OVERRIDE="$STATE" FM_DATA_OVERRIDE="$DATA" \
+  if ! FM_HOME="$FM_HOME" FM_HOME_BINDING="$FM_HOME" FM_STATE_OVERRIDE="$STATE" FM_DATA_OVERRIDE="$DATA" \
       FM_CONFIG_OVERRIDE="$CONFIG" "$SCRIPT_DIR/fm-decision-hold.sh" verify "$ID" >/dev/null; then
     echo "REFUSED: scout task $ID has not passed the unresolved-decision completion gate." >&2
     echo "Inventory its report and any visual review through bin/fm-decision-hold.sh before teardown." >&2
diff --git a/bin/fm-watch.sh b/bin/fm-watch.sh
index 278670e021..ce9c612be7 100755
--- a/bin/fm-watch.sh
+++ b/bin/fm-watch.sh
@@ -754,7 +754,7 @@ while :; do
       if [ "$(basename "$c")" = x-watch.check.sh ]; then
         if fmx_poll_shim_valid "$c" "$FM_HOME" "$FM_ROOT" \
           && [ -f "$FM_ROOT/bin/fm-x-poll.sh" ] && [ ! -L "$FM_ROOT/bin/fm-x-poll.sh" ]; then
-          FM_HOME="$FM_HOME" run_check_capture "$FM_ROOT/bin/fm-x-poll.sh" || exit 1
+          FM_HOME="$FM_HOME" FM_HOME_BINDING="$FM_HOME" run_check_capture "$FM_ROOT/bin/fm-x-poll.sh" || exit 1
           out=$FM_CHECK_RESULT
         else
           rejected_checks="$rejected_checks $c"
diff --git a/docs/configuration.md b/docs/configuration.md
index ee177c5d6e..d2d38bdd60 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -194,6 +194,8 @@ Resolution reads that declaration and never issues one of its own, so a binding
 Relocating every one of this home's directories at once - `FM_STATE_OVERRIDE`, `FM_DATA_OVERRIDE`, `FM_PROJECTS_OVERRIDE`, and `FM_CONFIG_OVERRIDE` together - is also accepted, because `FM_HOME` then selects no material left to misroute.
 A partial set is deliberately not enough, since whatever was not overridden still comes from `FM_HOME`, and `FM_ROOT_OVERRIDE` never declares a home on its own because it relocates the code root rather than the home.
 A pooled task worktree and a home's own `projects/<name>` clone are never home roots, so a crewmate working in either keeps the home that launched it.
+Within one process the rule is idempotent: resolution records the home it settled on and reads that record back when a script's sourced libraries resolve again, so a command whose code root is a different home root from the one it is standing in never refuses the home it assigned itself.
+That record is a non-exported shell variable bound to the resolving process, it is honored only while `FM_HOME` still names the same home, and a same-named value arriving in the environment is never read as a decision the process made - so it is a within-process detail and never a way to declare a home.
 Before `fm-brief.sh`, `fm-spawn.sh`, or `fm-afk-launch.sh` persists a path or passes it to another process, it resolves each applicable relative `FM_HOME`, `FM_STATE_OVERRIDE`, or `FM_DATA_OVERRIDE` directory against the caller's working directory, preserves absolute spellings unchanged, and rejects an unresolvable relative directory with the offending variable named.
 Bootstrap applies the same relative `FM_HOME` resolution only when embedding that home in the generated X-mode poll shim; other transient consumers retain their existing shell-relative behavior.
 For the herdr backend, `FM_HOME` also determines the workspace label used by the adapter.
diff --git a/docs/verification/home-resolution.md b/docs/verification/home-resolution.md
index ae5b37cb73..4b93e96511 100644
--- a/docs/verification/home-resolution.md
+++ b/docs/verification/home-resolution.md
@@ -56,6 +56,17 @@ That boundary is load-bearing for the long-lived process trees firstmate creates
 A declaration minted by resolution and exported to descendants would have been captured there, and would then have blessed an inherited `FM_HOME` for a human session opened in one of those panes from a different home root - the exact misroute this rule exists to refuse.
 The per-invocation form firstmate's own cross-home calls use is unaffected, because each of those callers names the home it is declaring on the same command line.
 
+## Idempotence within one process
+
+Because resolution mints no declaration, a process has nothing in its environment saying it already chose a home.
+Scripts source libraries that resolve again at source time - `bin/fm-wake-lib.sh`, `bin/fm-backend.sh`, and the `bin/backends/*.sh` adapters - so a command standing in one home root whose code root is a different home root would re-judge the home its own first resolve assigned and refuse itself.
+Resolution therefore records that decision in a non-exported shell variable inside the owner, bound to the resolving process and honored only while `FM_HOME` still names the same home.
+The boundary above is unchanged by it: the record never leaves the process, so `tests/fm-home-anchor.test.sh` still pins that a resolved home blesses nothing in a command the process launches, and that a same-named value arriving in the environment - even one carrying the reading process's own PID, which `exec` makes reachable - declares nothing.
+
+The cross-process half of the same problem is the hand-off, where a parent passes a child the `FM_HOME` its own rule-1 resolve assigned.
+A record cannot reach a child, so those call sites pass the per-invocation binding alongside the home, as every cross-home caller already did: `bin/fm-home-seed.sh` for both project-mode reads, `bin/fm-teardown.sh` for the unresolved-decision gate, `bin/fm-bootstrap.sh` for both secondmate nudges, and `bin/fm-watch.sh` for the X-mode poll dispatch.
+`bin/fm-fleet-snapshot.sh` needs none, because both of its cross-home calls already relocate every one of the home's directories.
+
 ## Suite behavior from a home root
 
 The captain's primary home is both the code root and a live firstmate home, so the suite runs from a directory that is itself a home root while each test selects a fixture home.
diff --git a/tests/fm-calm-pi-extension.test.sh b/tests/fm-calm-pi-extension.test.sh
index a8e09be145..313eab0f34 100755
--- a/tests/fm-calm-pi-extension.test.sh
+++ b/tests/fm-calm-pi-extension.test.sh
@@ -1627,9 +1627,9 @@ test_interactive_terminal_e2e() {
   cp "$ROOT/.pi/extensions/lib/fm-operational-input.ts" "$project/.pi/extensions/lib/fm-operational-input.ts"
   cp "$WATCH_EXT" "$project/.pi/extensions/fm-primary-pi-watch.ts"
   cp "$ROOT/.pi/extensions/fm-primary-turnend-guard.ts" "$project/.pi/extensions/fm-primary-turnend-guard.ts"
+  fm_copy_core_libs "$project/bin"
   cp \
     "$ROOT/bin/fm-sessionstart-nudge.sh" \
-    "$ROOT/bin/fm-primary-scope-lib.sh" \
     "$ROOT/bin/fm-gate-refuse-lib.sh" \
     "$ROOT/bin/fm-operational-input.sh" \
     "$project/bin/"
diff --git a/tests/fm-home-anchor.test.sh b/tests/fm-home-anchor.test.sh
index 5eed5adb2a..e15614f442 100755
--- a/tests/fm-home-anchor.test.sh
+++ b/tests/fm-home-anchor.test.sh
@@ -22,6 +22,8 @@
 #   (j) FM_HOME that is not a home root              -> no rival claim, stands
 #   (k) fm-send keeps its own fail-closed contract and gains the refusal
 #   (l) resolving a home issues no declaration of its own to descendants
+#   (m) a second resolve in the same process settles the same way
+#   (n) a resolution record from outside the process declares nothing
 set -u
 
 # shellcheck source=tests/lib.sh
@@ -343,3 +345,64 @@ res=$(run_in "$MATE" env FM_HOME="$MATE" bash -c \
 expect_code 0 "${res%%|*}" "a same-home hand-off must reach the child"
 assert_contains "${res#*|}" "local-only" "a same-home hand-off must keep reading the same home"
 pass "a same-home hand-off with a partial override set still reaches the child"
+
+# The same hand-off from a home root OTHER than the one the parent resolved. The
+# parent's FM_HOME is the one it assigned itself, so without a binding the child
+# would judge it ambient and refuse - which for fm-home-seed.sh's project-mode
+# read would empty the captured mode and clone a local-only project anyway.
+# shellcheck disable=SC2016 # $1/$2 are the inner shell's positional args, not ours.
+res=$(run_in "$PRIMARY" env -u FM_HOME bash -c \
+  'FM_HOME="$1" FM_HOME_BINDING="$1" FM_DATA_OVERRIDE="$1/data" "$2" alpha' _ "$MATE" "$MODE")
+expect_code 0 "${res%%|*}" "a bound cross-home hand-off must reach the child"
+assert_contains "${res#*|}" "local-only" "a bound hand-off must read the home it names"
+pass "a hand-off that binds the home it passes reaches the child from any home root"
+
+# ---------------------------------------------------------------------------
+# Resolution is idempotent within one process. Rule 1 assigns FM_HOME from the
+# code root, and the libraries a script sources resolve again at source time, so
+# without a record of this process's own decision the second resolve would judge
+# the value the first one assigned as inherited - and a command standing in one
+# home root whose code root is a different home root would refuse itself.
+# ---------------------------------------------------------------------------
+TWICE="$TMP_ROOT/resolve-twice.sh"
+cat > "$TWICE" <<'EOF'
+#!/usr/bin/env bash
+# usage: resolve-twice.sh <lib> <default-root> <switch-to>
+# The shape of a bin/fm-*.sh that resolves its home, then sources a library that
+# resolves again at source time. <switch-to> is `-` to keep the resolved home, or
+# a path to re-point FM_HOME the way a caller that changes home mid-run would.
+# Prints the home the second resolve settled on.
+set -u
+lib=$1 default_root=$2 switch=$3
+# shellcheck source=/dev/null
+. "$lib"
+fm_home_anchor_resolve "$default_root" || exit 1
+[ "$switch" = - ] || FM_HOME=$switch
+fm_home_anchor_resolve "$default_root" || exit 1
+printf '%s\n' "$FM_HOME"
+EOF
+chmod +x "$TWICE"
+
+res=$(run_in "$MATE" env -u FM_HOME "$TWICE" "$LIB" "$PRIMARY" -)
+expect_code 0 "${res%%|*}" "a second resolve must not refuse the home the first one assigned"
+[ "${res#*|}" = "$PRIMARY" ] || fail "the second resolve did not settle on the first one's home: ${res#*|}"
+pass "a process standing in another home root does not refuse its own resolved home"
+
+# The record covers the one home it was made for, so re-pointing FM_HOME at a
+# different home puts the command back under the full rule.
+res=$(run_in "$PRIMARY" env -u FM_HOME "$TWICE" "$LIB" "$PRIMARY" "$MATE")
+expect_code 1 "${res%%|*}" "a recorded resolution must not bless a later, different FM_HOME"
+assert_contains "${res#*|}" "$MATE" "the refusal must name the re-pointed candidate"
+pass "a resolved home is a decision about that home, not a blanket blessing"
+
+# The record is a shell variable, so bash presents a same-named environment value
+# as an ordinary one. `exec` keeps the PID, so the value below arrives carrying
+# the resolving process's OWN PID - the strongest form of the forgery - and must
+# still count for nothing.
+# shellcheck disable=SC2016 # $$ and the arguments expand in the launched shell.
+res=$(run_in "$PRIMARY" env FM_HOME="$MATE" bash -c \
+  'export FM_HOME_ANCHOR_RESOLVED_HOME="$1" FM_HOME_ANCHOR_RESOLVED_PID=$$; exec "$2" alpha' \
+  _ "$MATE" "$MODE")
+expect_code 1 "${res%%|*}" "a resolution record from outside must not bless an inherited home"
+assert_not_contains "${res#*|}" "local-only" "an environment-supplied record must not reach the mate"
+pass "a resolution record arriving in the environment is not a decision this process made"
diff --git a/tests/fm-opencode-primary-live-e2e.test.sh b/tests/fm-opencode-primary-live-e2e.test.sh
index 3c34d9541a..9a9643ea9b 100755
--- a/tests/fm-opencode-primary-live-e2e.test.sh
+++ b/tests/fm-opencode-primary-live-e2e.test.sh
@@ -159,6 +159,7 @@ run_ahoy_transcript_regressions() {
     "$AHOY_PROJECT/.opencode/plugins/"
   cp \
     "$ROOT/bin/fm-sessionstart-nudge.sh" \
+    "$ROOT/bin/fm-home-anchor-lib.sh" \
     "$ROOT/bin/fm-primary-scope-lib.sh" \
     "$ROOT/bin/fm-gate-refuse-lib.sh" \
     "$ROOT/bin/fm-operational-input.sh" \
diff --git a/tests/fm-pi-primary-live-e2e.test.sh b/tests/fm-pi-primary-live-e2e.test.sh
index a365f06b9c..79c3e510fe 100755
--- a/tests/fm-pi-primary-live-e2e.test.sh
+++ b/tests/fm-pi-primary-live-e2e.test.sh
@@ -179,6 +179,7 @@ run_native_ahoy_regressions() {
   cp "$ROOT/.pi/extensions/lib/fm-operational-input.ts" "$AHOY_PROJECT/.pi/extensions/lib/"
   cp \
     "$ROOT/bin/fm-sessionstart-nudge.sh" \
+    "$ROOT/bin/fm-home-anchor-lib.sh" \
     "$ROOT/bin/fm-primary-scope-lib.sh" \
     "$ROOT/bin/fm-gate-refuse-lib.sh" \
     "$ROOT/bin/fm-operational-input.sh" \
@@ -259,6 +260,8 @@ cp "$ROOT/.pi/extensions/fm-primary-turnend-guard.ts" "$PROJECT/.pi/extensions/f
 cp "$ROOT/bin/fm-watch-arm.sh" "$PROJECT/bin/fm-watch-arm.sh"
 cp "$ROOT/bin/fm-operational-input.sh" "$PROJECT/bin/fm-operational-input.sh"
 cp "$ROOT/bin/fm-supervision-instructions.sh" "$PROJECT/bin/fm-supervision-instructions.sh"
+cp "$ROOT/bin/fm-home-anchor-lib.sh" "$PROJECT/bin/fm-home-anchor-lib.sh"
+cp "$ROOT/bin/fm-primary-scope-lib.sh" "$PROJECT/bin/fm-primary-scope-lib.sh"
 chmod +x "$PROJECT/bin/fm-operational-input.sh"
 mkdir -p "$HOME_DIR/state" "$HOME_DIR/config"
 

From 9e01009fda6499ee2c4bff3b9f7aba62f1470ddd Mon Sep 17 00:00:00 2001
From: Bchue <bchue@homeserver.tail25a02d.ts.net>
Date: Tue, 4 Aug 2026 23:09:02 -0400
Subject: [PATCH 09/12] no-mistakes(document): point hook docs at the FM_HOME
 resolution owner

---
 docs/arm-pretool-check.md  | 2 +-
 docs/scripts.md            | 1 +
 docs/sessionstart-nudge.md | 1 +
 docs/turnend-guard.md      | 1 +
 4 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/docs/arm-pretool-check.md b/docs/arm-pretool-check.md
index f4747e0abd..956fff9cfe 100644
--- a/docs/arm-pretool-check.md
+++ b/docs/arm-pretool-check.md
@@ -29,7 +29,7 @@ It tokenizes the bytes and classifies lexical execution positions only.
 - `--claude` to preserve Claude's stderr-only deny requirement.
 
 The wrapper discovers the code root from its own location.
-The active firstmate home is `${FM_HOME:-<code-root>}`.
+The active firstmate home comes from `bin/fm-home-anchor-lib.sh`, the single owner of `FM_HOME` resolution described in [configuration.md](configuration.md#fm_home); when that resolution refuses because it cannot say which home this session belongs to, the wrapper anchors on its own code root instead, which can only widen the deny.
 It passes both roots and the exact command string to the Node policy owner.
 
 The wrapper fast-allows a command without invoking the Node policy owner only when the command cannot contain the `fm-watch` byte sequence even after the classifier's decoders run.
diff --git a/docs/scripts.md b/docs/scripts.md
index 6a10d1310a..af4b3099f4 100644
--- a/docs/scripts.md
+++ b/docs/scripts.md
@@ -28,6 +28,7 @@ The shared no-mistakes gate refusal for fleet lifecycle entrypoints is summarize
 | `fm-ensure-agents-md.sh` | Ensure a project's real `AGENTS.md`, its `CLAUDE.md` symlink, and the canonical self-governance section |
 | `fm-guard.sh`            | Warn on primary-checkout tangles, pending queued wakes, and stale watcher liveness   |
 | `fm-primary-scope-lib.sh` | Shared marker-or-plain-checkout primary-home predicate for tracked hooks             |
+| `fm-home-anchor-lib.sh`  | Single owner of `FM_HOME` resolution and its refusal on an ambiently inherited home (docs/configuration.md) |
 | `fm-session-lock-lib.sh` | Shared session-lock harness identity (ancestry walk and holder liveness) for fm-lock.sh and the Claude Stop auto-arm |
 | `fm-claude-stop-autoarm.sh` | Claude Stop `asyncRewake` hook owning tokenless watcher continuity with single-flight exit-2 rewake (docs/watcher-continuity.md) |
 | `fm-turnend-guard.sh`    | Shared primary turn-end guard predicate so no turn ends blind (docs/turnend-guard.md) |
diff --git a/docs/sessionstart-nudge.md b/docs/sessionstart-nudge.md
index c39c814925..b61176a977 100644
--- a/docs/sessionstart-nudge.md
+++ b/docs/sessionstart-nudge.md
@@ -11,6 +11,7 @@ The Ahoy skill owns the rule that this marked operational input is never a capta
 It sources `bin/fm-gate-refuse-lib.sh` and stays silent for a no-mistakes gate agent identified by `NO_MISTAKES_GATE` or a `.no-mistakes/repos/*.git` git-common-dir.
 It shares `bin/fm-primary-scope-lib.sh` with `bin/fm-turnend-guard.sh`, so the hooks use one primary-detection owner.
 The Shared Predicate section of [`turnend-guard.md`](turnend-guard.md#shared-predicate) owns marker validation, plain-checkout detection, and required Firstmate-shaped paths.
+It resolves the home through `bin/fm-home-anchor-lib.sh` ([configuration.md](configuration.md#fm_home)) and stays silent when that resolution refuses, because it is only an enforcement layer for a digest the primary can still run itself, and the exit-0 rule below forbids a louder failure.
 
 Before printing, the wrapper reads `state/.lock` and walks at most eight parents from its own pid in its own separate, hard-coded loop, independent of `bin/fm-lock.sh`'s ancestry walk (`fm_harness_ancestry_pid()` in `bin/fm-session-lock-lib.sh`, which now walks up to sixteen parents and can extend past a claude-named match to a still-more-ancestral one) and of Pi's `lockOwnership()`.
 If the lock names a live pid in that ancestry, session start already ran in this harness session and the wrapper stays silent.
diff --git a/docs/turnend-guard.md b/docs/turnend-guard.md
index 8ee750de39..8414f2a7cd 100644
--- a/docs/turnend-guard.md
+++ b/docs/turnend-guard.md
@@ -33,6 +33,7 @@ A stale beacon blocks even when a watcher pid is live.
 A fresh leftover beacon blocks when the lock is missing, dead, or identity-mismatched.
 
 `FM_STATE_OVERRIDE` wins over `FM_HOME/state`, and `FM_HOME` wins over repository-root `state/`.
+`FM_HOME` itself resolves through `bin/fm-home-anchor-lib.sh` ([configuration.md](configuration.md#fm_home)); when that resolution refuses because it cannot say which home this session belongs to, the guard exits 0 rather than guarding a turn against another home's state.
 `FM_GUARD_GRACE` controls beacon freshness and defaults to 300 seconds.
 If `jq` is missing or hook stdin is empty, the guard exits 0 because it cannot safely read loop-guard fields.
 

From f58d33714a0174348754e9ecf6680a3e1d3b61d5 Mon Sep 17 00:00:00 2001
From: Bchue <bchue@homeserver.tail25a02d.ts.net>
Date: Tue, 4 Aug 2026 23:15:28 -0400
Subject: [PATCH 10/12] no-mistakes(lint): read FM_HOME once at per-invocation
 binding hand-off sites

---
 bin/fm-bootstrap.sh | 14 ++++++++++----
 bin/fm-home-seed.sh | 14 ++++++++++----
 bin/fm-teardown.sh  |  5 ++++-
 bin/fm-watch.sh     |  5 ++++-
 4 files changed, 28 insertions(+), 10 deletions(-)

diff --git a/bin/fm-bootstrap.sh b/bin/fm-bootstrap.sh
index 5e8b61a2d0..3bac0c1d89 100755
--- a/bin/fm-bootstrap.sh
+++ b/bin/fm-bootstrap.sh
@@ -254,7 +254,7 @@ secondmate_sync() {
   }
 
   secondmate_send_nudge() {
-    local id=$1 home=$2 commit=$3 instr=$4 selector marker out
+    local id=$1 home=$2 commit=$3 instr=$4 selector marker out caller_home
     selector="fm-$id"
     marker=$(secondmate_nudge_marker_path "$id") || {
       echo "NUDGE_SECONDMATES: secondmate $id: send failed: unsafe id"
@@ -264,7 +264,10 @@ secondmate_sync() {
       echo "NUDGE_SECONDMATES: secondmate $id: send failed: cannot record retry marker"
       return 0
     fi
-    if out=$(FM_HOME="$FM_HOME" FM_HOME_BINDING="$FM_HOME" FM_ROOT_OVERRIDE="$FM_ROOT" FM_STATE_OVERRIDE="$STATE" "$SCRIPT_DIR/fm-send.sh" "$selector" "$SECOND_MATE_NUDGE_MESSAGE" 2>&1); then
+    # Read once so the binding cannot be read out of the assignment prefix that
+    # is setting FM_HOME in the same command. This is our own home, not $home.
+    caller_home=$FM_HOME
+    if out=$(FM_HOME="$caller_home" FM_HOME_BINDING="$caller_home" FM_ROOT_OVERRIDE="$FM_ROOT" FM_STATE_OVERRIDE="$STATE" "$SCRIPT_DIR/fm-send.sh" "$selector" "$SECOND_MATE_NUDGE_MESSAGE" 2>&1); then
       rm -f "$marker"
       echo "BOOTSTRAP_INFO: nudged $selector with '$SECOND_MATE_NUDGE_MESSAGE'"
     else
@@ -278,8 +281,11 @@ secondmate_sync() {
   }
 
   secondmate_retry_pending_nudges() {
-    local marker id selector home commit message expected_marker meta meta_home home_real head
+    local marker id selector home commit message expected_marker meta meta_home home_real head caller_home
     [ -d "$SECOND_MATE_NUDGE_PENDING_DIR" ] || return 0
+    # Read once so the binding cannot be read out of the assignment prefix that
+    # is setting FM_HOME in the same command. This is our own home, not $home.
+    caller_home=$FM_HOME
     for marker in "$SECOND_MATE_NUDGE_PENDING_DIR"/*.pending; do
       [ -f "$marker" ] || continue
       id=$(fm_meta_get "$marker" id)
@@ -324,7 +330,7 @@ secondmate_sync() {
         echo "NUDGE_SECONDMATES: secondmate $id: send failed: retry target is not at recorded instruction commit"
         continue
       }
-      if out=$(FM_HOME="$FM_HOME" FM_HOME_BINDING="$FM_HOME" FM_ROOT_OVERRIDE="$FM_ROOT" FM_STATE_OVERRIDE="$STATE" "$SCRIPT_DIR/fm-send.sh" "$selector" "$SECOND_MATE_NUDGE_MESSAGE" 2>&1); then
+      if out=$(FM_HOME="$caller_home" FM_HOME_BINDING="$caller_home" FM_ROOT_OVERRIDE="$FM_ROOT" FM_STATE_OVERRIDE="$STATE" "$SCRIPT_DIR/fm-send.sh" "$selector" "$SECOND_MATE_NUDGE_MESSAGE" 2>&1); then
         rm -f "$marker"
         echo "BOOTSTRAP_INFO: nudged $selector with '$SECOND_MATE_NUDGE_MESSAGE'"
       else
diff --git a/bin/fm-home-seed.sh b/bin/fm-home-seed.sh
index 7b6310f870..a6c7e5ee2d 100755
--- a/bin/fm-home-seed.sh
+++ b/bin/fm-home-seed.sh
@@ -538,13 +538,16 @@ EOF
 }
 
 clone_project() {
-  local project=$1 home=$2 src dst url dst_url mode
+  local project=$1 home=$2 src dst url dst_url mode caller_home
   src="$PROJECTS/$project"
   dst=$(validate_project_destination "$home" "$project") || return 1
   [ -d "$src" ] || { echo "error: project $project not found at $src" >&2; return 1; }
   git -C "$src" rev-parse --is-inside-work-tree >/dev/null 2>&1 || { echo "error: project $project is not a git repo" >&2; return 1; }
+  # Read once so the binding cannot be read out of the assignment prefix that is
+  # setting FM_HOME in the same command. This is our own home, not $home.
+  caller_home=$FM_HOME
   read -r mode _ <<EOF
-$(FM_HOME="$FM_HOME" FM_HOME_BINDING="$FM_HOME" FM_DATA_OVERRIDE="$DATA" "$FM_ROOT/bin/fm-project-mode.sh" "$project")
+$(FM_HOME="$caller_home" FM_HOME_BINDING="$caller_home" FM_DATA_OVERRIDE="$DATA" "$FM_ROOT/bin/fm-project-mode.sh" "$project")
 EOF
   if [ "$mode" = local-only ]; then
     echo "error: project $project is local-only; secondmate routes support only no-mistakes and direct-PR projects" >&2
@@ -566,12 +569,15 @@ EOF
 }
 
 validate_seed_project() {
-  local project=$1 src mode url
+  local project=$1 src mode url caller_home
   src="$PROJECTS/$project"
   [ -d "$src" ] || { echo "error: project $project not found at $src" >&2; return 1; }
   git -C "$src" rev-parse --is-inside-work-tree >/dev/null 2>&1 || { echo "error: project $project is not a git repo" >&2; return 1; }
+  # Read once so the binding cannot be read out of the assignment prefix that is
+  # setting FM_HOME in the same command.
+  caller_home=$FM_HOME
   read -r mode _ <<EOF
-$(FM_HOME="$FM_HOME" FM_HOME_BINDING="$FM_HOME" FM_DATA_OVERRIDE="$DATA" "$FM_ROOT/bin/fm-project-mode.sh" "$project")
+$(FM_HOME="$caller_home" FM_HOME_BINDING="$caller_home" FM_DATA_OVERRIDE="$DATA" "$FM_ROOT/bin/fm-project-mode.sh" "$project")
 EOF
   if [ "$mode" = local-only ]; then
     echo "error: project $project is local-only; secondmate routes support only no-mistakes and direct-PR projects" >&2
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index a5a61de8ec..b8929ceb44 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -1089,7 +1089,10 @@ if [ "$KIND" = scout ] && [ "$FORCE" != "--force" ]; then
     echo "The report is the work product. Have the crewmate write it, or use --force after explicit discard approval." >&2
     exit 1
   fi
-  if ! FM_HOME="$FM_HOME" FM_HOME_BINDING="$FM_HOME" FM_STATE_OVERRIDE="$STATE" FM_DATA_OVERRIDE="$DATA" \
+  # Read once so the binding cannot be read out of the assignment prefix that is
+  # setting FM_HOME in the same command.
+  caller_home=$FM_HOME
+  if ! FM_HOME="$caller_home" FM_HOME_BINDING="$caller_home" FM_STATE_OVERRIDE="$STATE" FM_DATA_OVERRIDE="$DATA" \
       FM_CONFIG_OVERRIDE="$CONFIG" "$SCRIPT_DIR/fm-decision-hold.sh" verify "$ID" >/dev/null; then
     echo "REFUSED: scout task $ID has not passed the unresolved-decision completion gate." >&2
     echo "Inventory its report and any visual review through bin/fm-decision-hold.sh before teardown." >&2
diff --git a/bin/fm-watch.sh b/bin/fm-watch.sh
index ce9c612be7..9142eb46f3 100755
--- a/bin/fm-watch.sh
+++ b/bin/fm-watch.sh
@@ -754,7 +754,10 @@ while :; do
       if [ "$(basename "$c")" = x-watch.check.sh ]; then
         if fmx_poll_shim_valid "$c" "$FM_HOME" "$FM_ROOT" \
           && [ -f "$FM_ROOT/bin/fm-x-poll.sh" ] && [ ! -L "$FM_ROOT/bin/fm-x-poll.sh" ]; then
-          FM_HOME="$FM_HOME" FM_HOME_BINDING="$FM_HOME" run_check_capture "$FM_ROOT/bin/fm-x-poll.sh" || exit 1
+          # Read once so the binding cannot be read out of the assignment prefix
+          # that is setting FM_HOME in the same command.
+          home=$FM_HOME
+          FM_HOME="$home" FM_HOME_BINDING="$home" run_check_capture "$FM_ROOT/bin/fm-x-poll.sh" || exit 1
           out=$FM_CHECK_RESULT
         else
           rejected_checks="$rejected_checks $c"

From 613e623b708769feccdc68842d3dfe8ba1c958e9 Mon Sep 17 00:00:00 2001
From: Bchue <bchue@homeserver.tail25a02d.ts.net>
Date: Wed, 5 Aug 2026 15:50:34 -0400
Subject: [PATCH 11/12] fix(test): stub harness ps for fm-lock.sh's
 real-acquire assertion

fm-lock.sh's real session-lock acquisition requires
fm_harness_ancestry_pid() to find an actual harness process via ps.
CI's runner has no such process, so "a mate must still take its own
session lock" failed there with "cannot locate harness process in
ancestry" while passing locally by accident (a real harness process
happens to be in the local dev ancestry). Every other lock-touching
test file stubs this with a fake ps reporting a claude process;
fm-home-anchor.test.sh was the one missing it.

Verified: reproduced the CI failure in isolation with an empty ps
stub (exit 1, same error), then confirmed the fake-claude ps stub
fixes it (exit 0, lock acquired) - independent of the two automated
CI fix-agent attempts, which both misdiagnosed the failure as an
unrelated, actually-passing test (fm-calm-pi-extension.test.sh).
---
 tests/fm-home-anchor.test.sh | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/tests/fm-home-anchor.test.sh b/tests/fm-home-anchor.test.sh
index e15614f442..f6a46e2654 100755
--- a/tests/fm-home-anchor.test.sh
+++ b/tests/fm-home-anchor.test.sh
@@ -264,7 +264,23 @@ expect_code 1 "${res%%|*}" "the session lock must not be taken through an inheri
 assert_absent "$MATE/state/.lock" "a refused session must not hold the other home's session lock"
 pass "an inherited home cannot take another home's session lock"
 
-res=$(run_in "$MATE" env FM_HOME="$MATE" "$LOCK")
+# fm-lock.sh's real acquire path requires fm_harness_ancestry_pid() to find an
+# actual harness process by walking `ps`. CI has no such process in the runner's
+# ancestry, so this needs the same fake-ps stub every other lock-touching suite
+# uses (see make_fake_ps_claude in tests/fm-session-start.test.sh) - without it
+# this assertion only passes by accident, when run from inside a real harness.
+FAKE_PS_BIN=$(mktemp -d)
+printf '%s\n' \
+  '#!/usr/bin/env bash' \
+  'set -u' \
+  'case "$*" in' \
+  '  *"comm="*) printf "/usr/local/bin/claude\n"; exit 0 ;;' \
+  '  *"args="*) printf "claude\n"; exit 0 ;;' \
+  'esac' \
+  'exit 1' > "$FAKE_PS_BIN/ps"
+chmod +x "$FAKE_PS_BIN/ps"
+res=$(run_in "$MATE" env FM_HOME="$MATE" PATH="$FAKE_PS_BIN:$PATH" "$LOCK")
+rm -rf "$FAKE_PS_BIN"
 expect_code 0 "${res%%|*}" "a mate must still take its own session lock"
 assert_present "$MATE/state/.lock" "a mate standing in its own home must hold its own lock"
 rm -f "$MATE/state/.lock"

From 35176f020770f2987f3aefe5733c8594128bd27b Mon Sep 17 00:00:00 2001
From: Bchue <bchue@homeserver.tail25a02d.ts.net>
Date: Wed, 5 Aug 2026 16:06:28 -0400
Subject: [PATCH 12/12] no-mistakes(document): docs(backend): add
 FM_HOME_BINDING to cross-home fm-send examples

---
 docs/cmux-backend.md   | 2 +-
 docs/herdr-backend.md  | 2 +-
 docs/orca-backend.md   | 2 +-
 docs/tmux-backend.md   | 2 +-
 docs/zellij-backend.md | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/docs/cmux-backend.md b/docs/cmux-backend.md
index 4bd438bc74..91c4a70ada 100644
--- a/docs/cmux-backend.md
+++ b/docs/cmux-backend.md
@@ -43,7 +43,7 @@ It can also be runtime auto-detected when Firstmate itself runs inside cmux.
 A spawn stops with an actionable setup message when the app, minimum version, `jq`, socket access, or password is unavailable.
 The adapter may launch the app with `open -a cmux` only when the socket is down; it does not relaunch the app for access-denied or authentication errors.
 
-Routine supervision uses `bin/fm-peek.sh <id>` and `FM_HOME=<home> bin/fm-send.sh <id> '<text>'` without bringing the cmux window forward.
+Routine supervision uses `bin/fm-peek.sh <id>` and `FM_HOME=<home> FM_HOME_BINDING=<home> bin/fm-send.sh <id> '<text>'` without bringing the cmux window forward.
 Task workspace and surface creation use `focus=false`.
 
 Verify setup by spawning a small task and confirming metadata contains `backend=cmux`, `cmux_workspace_id=`, and `cmux_surface_id=`.
diff --git a/docs/herdr-backend.md b/docs/herdr-backend.md
index 91047bcc6f..499e8cc876 100644
--- a/docs/herdr-backend.md
+++ b/docs/herdr-backend.md
@@ -39,7 +39,7 @@ A secondmate home uses `2ndmate-<secondmate-id>`, derived from its validated `.f
 The secondmate process and every child it launches resolve the same home label; a secondmate launched by the primary receives a narrowly scoped home override during container creation.
 
 Attach to the selected named Herdr session and switch to the relevant home workspace to watch its task tabs.
-Routine supervision uses `bin/fm-peek.sh <id>` and `FM_HOME=<home> bin/fm-send.sh <id> '<text>'` without attaching.
+Routine supervision uses `bin/fm-peek.sh <id>` and `FM_HOME=<home> FM_HOME_BINDING=<home> bin/fm-send.sh <id> '<text>'` without attaching.
 
 Workspace and tab creation use `--no-focus`.
 The first workspace in a completely empty Herdr session must become focused because no prior target exists, but later task creation does not intentionally steal focus.
diff --git a/docs/orca-backend.md b/docs/orca-backend.md
index 9812993e83..53f11df5c2 100644
--- a/docs/orca-backend.md
+++ b/docs/orca-backend.md
@@ -23,7 +23,7 @@ The first task for a project registers that repository with `orca repo add --pat
 No manual repository registration is required.
 
 Open the Orca app to watch a task's terminal.
-Routine supervision uses the recorded endpoint through `bin/fm-peek.sh <id>` and `FM_HOME=<home> bin/fm-send.sh <id> '<text>'`.
+Routine supervision uses the recorded endpoint through `bin/fm-peek.sh <id>` and `FM_HOME=<home> FM_HOME_BINDING=<home> bin/fm-send.sh <id> '<text>'`.
 Enter and Ctrl-C are supported; Escape is not.
 
 ## Task shape and metadata
diff --git a/docs/tmux-backend.md b/docs/tmux-backend.md
index 3bf20fe9d1..a1c340f0c2 100644
--- a/docs/tmux-backend.md
+++ b/docs/tmux-backend.md
@@ -38,7 +38,7 @@ tmux select-window -t <session-name>:fm-<id>
 ```
 
 Typing into an attached task window is authoritative direct intervention.
-Routine supervision does not require attachment: `bin/fm-peek.sh <id>` captures a bounded tail and `FM_HOME=<home> bin/fm-send.sh <id> '<text>'` steers the recorded endpoint.
+Routine supervision does not require attachment: `bin/fm-peek.sh <id>` captures a bounded tail and `FM_HOME=<home> FM_HOME_BINDING=<home> bin/fm-send.sh <id> '<text>'` steers the recorded endpoint.
 
 Verify setup by spawning a small task and confirming its `fm-<id>` window appears in the selected session.
 
diff --git a/docs/zellij-backend.md b/docs/zellij-backend.md
index 367da98ebb..77f72b65b3 100644
--- a/docs/zellij-backend.md
+++ b/docs/zellij-backend.md
@@ -27,7 +27,7 @@ zellij attach <session-name>
 ```
 
 Routine supervision does not require attachment.
-Use `bin/fm-peek.sh <id>` and `FM_HOME=<home> bin/fm-send.sh <id> '<text>'` against the metadata-routed endpoint.
+Use `bin/fm-peek.sh <id>` and `FM_HOME=<home> FM_HOME_BINDING=<home> bin/fm-send.sh <id> '<text>'` against the metadata-routed endpoint.
 
 Verify setup by spawning a small task and confirming metadata contains `backend=zellij`, `zellij_session=`, `zellij_tab_id=`, and `zellij_pane_id=`.