Fix treehouse teardown path and slot rebind safety

[wonder-media]

Summary

• Record Treehouse pool worktrees in their managed symlink form while resolving legacy physical-path metadata by path identity during teardown.
• Allow already-returned or not-managed slots to complete record retirement only after the full landed-work test passes and the recorded worktree is confirmed gone or clean.
• Detect fast slot rebinding before touching a recorded pool path; if another live task owns the slot, retire only the stale task records without modifying, cleaning, reclaiming, or returning that worktree.

Covered scenarios

1. A legacy physical path for a managed slot still leased to this task resolves to the managed path and returns successfully.
2. An already-returned slot retires task records when landed-work and clean-or-gone checks pass.
3. A slot rebound to a different live task retires only stale records and provably leaves the live worker worktree untouched.
4. Genuine uncommitted or unpushed work retains the existing teardown refusal behavior.

Validation

• Full fm-teardown shell test suite passed.
• Spawn worktree-settle regression coverage passed.
• Changed shell roots passed ShellCheck 0.11.0.

no-mistakes bypassed: headless-claude outage, independent review substituted

[wonder-media]

FAIL

Independent review — PR 5

Reviewed head 5c80eeb479efd030bcaaeb3040eb3a5fd1ae12e6 against origin/main at 392635e3d5b976eeced23856ebb8ff3f062df619. I read the complete five-file diff, traced every destructive teardown path, ran the two changed behavior suites, ran the repository-owned pinned ShellCheck command, exercised live physical/managed path resolution, and added three adversarial one-off fixtures without changing the PR.

Findings

1. Critical — the “fresh” rebind check is still a TOCTOU check; a slot rebound immediately afterward is modified and returned

Evidence: bin/fm-teardown.sh:2585-2591 performs the second identity read, then describes it as freezing the destructive decision. It does not hold a Treehouse lock, compare a lease generation atomically, or pass the parsed lease_id to the return. After the check, bin/fm-teardown.sh:2600-2603 invokes no-mistakes and scans/reaps through the worktree; bin/fm-teardown.sh:2644-2665 detaches/deletes the branch, removes worktree hooks, and calls treehouse return --force with only the path.

I injected a deterministic rebind at the first command after the second prepare_treehouse_task_slot call: the fake no-mistakes status command replaced .fm-treehouse-owner with task_id=new-live-task and created a new worker hook. Teardown returned 0 with:

rc=0 target_meta=absent live_hook=removed branch=DETACHED return_calls=1 owner=new-live-task

The new task's hook was deleted, its branch was detached, and Treehouse return was invoked even though the owner marker identified the new task. The colocated rebound test does not cover this interval: it installs the competing metadata before teardown (tests/fm-teardown.test.sh:2687-2703), so teardown exits at the first rebound check and never reaches the destructive sequence.

This violates contract scenario 3. Rechecking is not a proof of ownership. The destructive operation needs an atomic Treehouse compare-and-return keyed by lease ID/generation, or an ownership lock covering every worktree mutation and return. Merely adding another pre-mutation check would only move the race.

2. High — any other syntactically valid metadata record is treated as a live claimant, bypassing the landed-work refusal

Evidence: bin/fm-teardown.sh:1243-1259 accepts another .meta file based only on filename/endpoint_task_id agreement and path identity; it performs no backend liveness or current-generation check. bin/fm-teardown.sh:1342-1345 turns that record into TREEHOUSE_SLOT_STATE=rebound, and bin/fm-teardown.sh:1394-1401 retires the target task's runtime records. The early call at bin/fm-teardown.sh:2560 occurs before the landed-work check at bin/fm-teardown.sh:2572-2584.

Adversarial fixture: task task-x1 had a genuine unpushed commit; a second, stale (not live) .meta record claimed the same managed path. Teardown output was:

rc=0 target_meta=absent stale_meta=present wt_exists=yes
teardown: slot ... is claimed by different task stale-other; retiring only stale records for task-x1
teardown task-x1 complete (stale records retired; rebound worktree ... untouched)

There was no work not on any remote and not landed refusal. Although the physical worktree remained, teardown declared success and erased its authoritative task record. Before this PR, the same inspectable worktree reached validate_worktree_teardown_safety and refused. This is an explicit weakening of hard rule 3 and therefore independently makes the verdict FAIL.

Treat a competing metadata record as rebound evidence only after current endpoint/generation verification. Ambiguity must refuse; it must not retire either task's records.

3. High — an already-returned or no-longer-managed missing worktree is declared “landed-work ... passed” without running any landed-work test

Evidence: the landed-work check is conditional on -d "$WT" at bin/fm-teardown.sh:2572-2584. For already-returned|not-managed, bin/fm-teardown.sh:1369-1391 performs no alternate commit/branch check when the path is gone, sets TREEHOUSE_RETURN_COMPLETED=1, and prints that the landed-work check passed.

Adversarial fixture: I created a genuine unpushed commit, externally removed its worktree while preserving the task branch ref in the project repository, then ran teardown. Result:

rc=0 target_meta=absent wt_exists=no branch_ref=present
teardown: Treehouse slot ... is already returned; landed-work and cleanliness checks passed

No landed-work check ran. This contradicts contract scenario 2's requirement that record retirement occur only when the landed-work test passes and the worktree is gone/clean. If the path is gone and landing cannot be proven from retained refs/metadata, teardown should refuse instead of claiming the gate passed.

4. High — a failed JSON status read is treated as legacy support when status --help also fails, allowing destructive worktree changes with no identity proof

Evidence: bin/fm-treehouse-lib.sh:55-62 captures treehouse status --help with || true and returns the legacy/unavailable code whenever the captured text lacks --json, including command failure or empty output. Both callers continue on that code (bin/fm-teardown.sh:1363-1367; bin/fm-spawn.sh:2454-2457). In teardown, this disables the ownership gate while leaving all later worktree mutations enabled.

Adversarial fixture: a fake Treehouse failed both status --json and status --help, and failed the eventual return. Teardown did not print the authoritative-status refusal. It detached the branch and removed the live hook before return failed:

rc=1 target_meta=present live_hook=removed branch=DETACHED return_calls=1
error: treehouse return failed for worktree ...; teardown aborted

Legacy support needs positive capability/version evidence. An unreadable or failing help surface must be code 3 (fail closed), not code 2.

Required contract scenarios

1. Physical /Volumes path resolves to managed ~/.treehouse path: the intended path works. fm_treehouse_paths_match resolves existing directories with pwd -P (bin/fm-treehouse-lib.sh:31-53), teardown replaces WT with the status-owned spelling (bin/fm-teardown.sh:1300-1303), and the changed test verifies the managed path reaches treehouse return (tests/fm-teardown.test.sh:2631-2646). I also queried the installed Treehouse against this review worktree: physical path, physical path with trailing slash, managed path, managed path with trailing slash, and a two-link symlink chain all resolved to /Users/patrick/.treehouse/firstmate-59d3a9/2/firstmate with status in-use.
2. Already returned: the clean, landed, still-inspectable case passes, and the inspectable unpushed case refuses in the shipped tests. The missing-worktree branch does not satisfy the stated landed-work contract (finding 3).
3. Slot rebound to another live task: a competitor present at the first check is left untouched by the shipped test, but the post-check race modifies and returns the rebound worktree (finding 1). A stale record also produces an unsafe false rebound classification (finding 2).
4. Uncommitted/unpushed work: ordinary cases remain covered and pass, but the new stale-claimant early exit bypasses the refusal (finding 2). Hard rule 3 is therefore not preserved on every new path.

Diff classification

• bin/fm-treehouse-lib.sh: adds physical-resolution lookup, JSON status parsing, owner-marker writing, and the legacy fallback. The resolution mechanism is appropriate for existing paths and passed trailing-slash/symlink-chain probes. The fallback is fail-open on help failure (finding 4).
• bin/fm-spawn.sh: sources the helper, canonicalizes WT to Treehouse's managed spelling at bin/fm-spawn.sh:2435-2457, writes an owner marker at bin/fm-spawn.sh:2485-2491, and records that canonical WT at bin/fm-spawn.sh:2844-2857. This is the correct forward format; the physical-path teardown test supplies backward compatibility. Moving SPAWN_GEN earlier supports the marker and does not itself loosen teardown safety.
• bin/fm-teardown.sh: extracts record retirement into a callable helper and introduces early successful retirement for rebound/already-returned states. Those are refusal-path loosenings. Findings 1-3 show they are not sufficiently justified or guarded. The added Herdr adapter-presence check at bin/fm-teardown.sh:2265-2271 is unrelated but fail-closed.
• tests/fm-spawn-worktree-settle.test.sh: updates the Treehouse double and verifies canonical managed metadata plus owner marker.
• tests/fm-teardown.test.sh: makes older doubles ignore new status probes and adds the four named regressions. The positive-path tests pass, but rebound is tested only when detectable before any destructive work, and there is no stale-claimant, post-final-check rebind, failing-help, or missing-worktree/unlanded case.

Commands and actual results

• gh-axi pr diff 5 --full: complete five-file diff reviewed; 544 insertions, 28 deletions.
• bin/fm-test-run.sh tests/fm-spawn-worktree-settle.test.sh tests/fm-teardown.test.sh: PASS, FM_TEST_SUMMARY total=2 failed=0 skipped_gate=0 duration_ms=196886; spawn suite 9,479 ms, teardown suite 187,313 ms. All four new named tests reported ok.
• Direct shellcheck was initially unavailable on PATH. I installed the repository-pinned verified build into a worktree-local scratch directory with bin/fm-install-shellcheck.sh, then ran the repository-owned lint definition: PATH="$PWD/.review-tools/bin:$PATH" bin/fm-lint.sh bin/fm-spawn.sh bin/fm-teardown.sh bin/fm-treehouse-lib.sh tests/fm-spawn-worktree-settle.test.sh tests/fm-teardown.test.sh. PASS, ShellCheck 0.11.0 (pinned 0.11.0), exit 0.
• git diff --check origin/main...HEAD: PASS, no output.
• Direct installed-Treehouse path probes: PASS for physical/managed spellings, trailing slashes, and a two-link symlink chain.
• Adversarial stale-claimant fixture: FAILS contract, teardown returned 0 and retired metadata for genuine unpushed work.
• Adversarial post-final-check rebind fixture: FAILS contract, teardown removed the new hook, detached the branch, and invoked return.
• Adversarial missing-worktree/unpushed-ref fixture: FAILS contract, teardown returned 0 without a landed-work check.
• Adversarial failed-status-and-help fixture: FAILS closed-safety expectation, teardown modified the worktree before its eventual return failure.

Recommendation

Do not merge PR 5 in its current form. The physical/managed path normalization is sound for existing paths and should be retained, but record retirement must not bypass landed-work safety on unverified claimant records, and worktree mutation/return must be protected by an atomic lease/generation contract rather than a check-then-act sequence.

[wonder-media]

FAIL

PR 5 re-review — fix round a9b82e7

Reviewed only the fix round from 5c80eeb479efd030bcaaeb3040eb3a5fd1ae12e6 to a9b82e79c4df2ab6645287fb84ca55ecc25ce43f, as requested. I did not rerun the earlier full suites or repeat the already-passing physical-path probes. I traced every production and test surface changed by this round, ran the four new closure regressions directly, ran the updated spawn lock-publication test directly, and linted only the five shell files touched by the fix round.

Verdict

Three of the four prior blockers are closed. The highest-consequence slot-rebind blocker remains open because pooled relaunches bypass the new shared Treehouse operation lock and overwrite a foreign live lease/owner marker without validating either. That uncovered writer can still race another task's teardown, so the round is not safe to merge.

Prior finding closure matrix

1. NOT CLOSED — the shared lock excludes fresh allocation, but not pooled relaunch

The fix correctly makes teardown hold one host-user-wide operation lock from its first occupancy read through worktree mutation and return (bin/fm-teardown.sh:2640-2648, released by the exit trap at bin/fm-teardown.sh:203-226). Fresh pooled spawn takes the same lock before treehouse get (bin/fm-spawn.sh:2395-2402) and releases it only after owner-marker and metadata publication (bin/fm-spawn.sh:2917-2929). The new checks after landed-work inspection, no-mistakes handling, and immediately before mutation (bin/fm-teardown.sh:2751-2755, 2764-2768, 2794-2803) also catch out-of-protocol owner changes at those points.

However, the relaunch branch ends at bin/fm-spawn.sh:2378-2394; the lock acquisition is only in the following fresh-spawn elif at 2395-2402. Relaunch then enters the common Treehouse lookup at 2450-2473, accepts any in-use|leased slot without checking lease_holder or the existing owner marker, and unconditionally overwrites .fm-treehouse-owner at 2500-2507. Because the relaunch never sets SPAWN_TREEHOUSE_LOCK_HELD, the later release block cannot help.

Independent reproduction used a stale task rly whose recorded endpoint shell still sat in the pooled path while authoritative Treehouse status said the slot was leased to other-live-task with lease_id=lease-new, and the worktree owner marker also said task_id=other-live-task. fm-spawn.sh rly --relaunch --harness claude returned success and replaced the live owner's marker:

rc=0 owner_after=rly status_holder=other-live-task
spawned rly harness=claude kind=ship mode=no-mistakes yolo=off window=fmses:fm-rly worktree=.../wt

This is the same rebind hazard through an uncovered Firstmate writer. A relaunch for stale task A can run while teardown for live task B holds the operation lock (their per-task control locks differ), overwrite B's owner marker after B's final check, and let B's teardown mutate/return the slot. The critical section is therefore not closed over every Firstmate path that can republish pooled ownership.

Required fix: ordinary pooled relaunch must take the same operation lock before Treehouse lookup and hold it through owner/meta publication. It must also refuse when authoritative lease_holder or the current owner marker identifies another task; it must not overwrite that evidence. Add a regression that relaunch cannot proceed against a foreign lease/owner and a concurrency regression proving relaunch waits behind another task's operation lock.

2. CLOSED — a stale competing record no longer bypasses landed-work protection

treehouse_claim_meta_state now requires matching endpoint identity, optional owner generation, and current backend liveness (bin/fm-teardown.sh:1339-1360). Competing stale/dead records are ignored; unverifiable or contradictory records refuse (bin/fm-teardown.sh:1387-1415, 1472-1503). The target therefore reaches the ordinary landed-work check instead of early record retirement.

Targeted regression result:

ok - a stale competing record cannot bypass landed-work protection

3. CLOSED — a missing worktree must prove its retained task branch landed

validate_missing_worktree_teardown_safety now requires an inspectable project and retained refs/heads/fm/<task-id> commit, then applies remote reachability/local merge/PR-or-content landing proof using the project repository and retained ref (bin/fm-teardown.sh:1244-1290). The main path calls it whenever the worktree is absent and teardown is not forced (bin/fm-teardown.sh:2734-2750).

Targeted regression result:

ok - a missing worktree must still prove its retained task branch landed

4. CLOSED — failed JSON status plus failed/empty help now fails closed

fm_treehouse_status_unavailable_rc now returns authoritative-read failure when treehouse status --help fails or is empty; only a successful, nonempty help surface that positively lacks --json gets the legacy compatibility code (bin/fm-treehouse-lib.sh:57-65).

Targeted regression result:

ok - a failing Treehouse JSON and help surface refuses before worktree mutation

Fix-round surface review

• bin/fm-treehouse-lib.sh: help-failure classification is now fail-closed; the shared lock path is stable per host user and shared by spawn/teardown. No issue found in this file's new code.
• bin/fm-teardown.sh: missing-worktree Git context/ref plumbing is consistently used by PR, patch-id, and content-in-default proofs. Claimant liveness/generation logic fails closed on uncertainty. The operation lock spans the teardown destructive interval. No additional teardown-local blocker found.
• bin/fm-spawn.sh: fresh allocation lock coverage is correct, including abort cleanup and release after publication. Pooled relaunch is the uncovered ownership writer and remains blocking.
• tests/fm-teardown.test.sh: the four new targeted regressions passed. The post-check test proves the lock is held and that one injected owner change is caught, but it does not exercise a concurrent --relaunch, which is why the production gap remained invisible.
• tests/fm-spawn-worktree-settle.test.sh: the updated targeted test passed and proves fresh spawn holds the lock during managed-path publication. It does not cover relaunch.

Commands and actual results

• Fix diff reviewed: git diff 5c80eeb479efd030bcaaeb3040eb3a5fd1ae12e6..a9b82e79c4df2ab6645287fb84ca55ecc25ce43f — five files, 535 insertions, 87 deletions.
• Four new closure tests invoked directly from the teardown fixture definitions: 4/4 passed.
• Updated managed-path/fresh-spawn lock-publication test invoked directly: passed.
• Repository-owned lint over the five fix-round shell files with pinned ShellCheck 0.11.0: passed, exit 0.
• git diff --check 5c80eeb...a9b82e7: passed, no output.
• Independent foreign-lease relaunch counterexample: failed safety contract — relaunch returned 0 and overwrote other-live-task with its own owner ID.

Recommendation

Do not merge a9b82e7. Extend the shared Treehouse operation lock and foreign-ownership validation to pooled relaunch, then rerun only the relaunch-specific counterexample and the targeted lock/closure tests.

[wonder-media]

FAIL

PR 5 round-three re-review — 706d31b

Reviewed only the slot-rebind safety finding and every surface changed from a9b82e7 to 706d31b4ac7662924b6a3c83a3dd666e342a2fb3, as requested. Earlier passing findings stand and were not re-verified.

Verdict

The former slot-rebind race is closed: pooled relaunch now takes the host-user-wide Treehouse operation lock before inspecting the slot, refuses a foreign authoritative lease or owner marker, and holds the lock through owner-marker and task-metadata publication. However, the new generation validation introduces a blocking rollback defect on that same publication path. A pre-publication relaunch failure can leave the owner marker at the replacement generation while retaining the prior task record. Subsequent relaunch and teardown both refuse the mismatch, so the documented recovery path is stranded.

Blocking finding

bin/fm-spawn.sh:2534 — aborted relaunch does not restore the prior owner generation

The relaunch first proves that the existing owner marker agrees with the prior task record (bin/fm-spawn.sh:2478-2504). It then writes a new owner generation to .fm-treehouse-owner at bin/fm-spawn.sh:2534-2540, well before publishing the replacement task record at bin/fm-spawn.sh:2941-2949.

If anything fails between those writes, including the atomic metadata mv, spawn_abort_cleanup removes replacement wiring and releases the shared Treehouse lock but never restores the prior owner marker (bin/fm-spawn.sh:730-825). The prior metadata remains authoritative by the relaunch rollback contract, but the marker now has the unpublished replacement generation. The new entry check at bin/fm-spawn.sh:2499-2503 then refuses every retry, and teardown independently refuses the same mismatch at bin/fm-teardown.sh:1461-1465.

Independent reproduction used the existing hermetic relaunch fixtures, started with matching spawn_gen=s-prior metadata and owner marker, and injected failure only into the atomic replacement-metadata publication. Actual result:

first_rc=1 meta_gen=s-prior owner_gen=s1788212957.41639.3807 second_rc=1
error: Treehouse slot '.../wt' owner generation does not match task rly2 metadata; refusing to overwrite unverified ownership during relaunch

This contradicts the documented promise that a launch failure before publication keeps the prior record for later recovery (docs/agent-control.md:77-81). Restore the previous marker on every abort before replacement metadata publication, while still holding the shared Treehouse lock, or make owner and metadata publication recoverably transactional. Add a regression that fails metadata publication after marker replacement and proves the old generation is restored and a retry remains possible.

Slot-rebind closure evidence

The high-consequence foreign-task race itself now behaves correctly:

• Lock acquisition moved ahead of relaunch slot adoption at bin/fm-spawn.sh:2379-2385.
• Authoritative foreign leases and foreign/mismatched owner markers refuse before any owner write at bin/fm-spawn.sh:2478-2504.
• The lock is released only after owner and task metadata publication at bin/fm-spawn.sh:2958-2962; abort cleanup releases it at bin/fm-spawn.sh:814-817.
• fm_treehouse_read_owner centralizes strict, non-symlink marker parsing for both spawn and teardown (bin/fm-treehouse-lib.sh:135-149; bin/fm-teardown.sh:1297-1305).

The two new colocated tests were invoked directly without rerunning earlier cases, and both passed:

ok - fm-spawn relaunch: foreign Treehouse leases and owner markers are never overwritten
ok - fm-spawn relaunch: shared Treehouse lock covers slot inspection through owner publication

I also ran a combined adversarial race not present as one test: relaunch waited while the operation lock was held; the slot was then rebound to other-live-task before lock release. Actual result:

rc=1 lookup_before_release=no marker_unchanged=yes launch_bytes=0
error: Treehouse slot '.../wt' is leased to different task other-live-task; refusing to overwrite foreign ownership during relaunch

This proves the waiting relaunch neither inspected the slot early, overwrote the new owner's marker, nor delivered launch bytes.

Changed-surface checks

• Diff reviewed: four files, 203 insertions and 24 deletions (bin/fm-spawn.sh, bin/fm-teardown.sh, bin/fm-treehouse-lib.sh, tests/fm-control-relaunch.test.sh).
• Repository lint over all four changed shell files with pinned ShellCheck 0.11.0: passed, exit 0.
• git diff --check a9b82e7..706d31b: passed, no output.
• Earlier round-two passing scenarios were intentionally not rerun.

Recommendation

Do not merge 706d31b. The slot-rebind exclusion is now correct, but relaunch rollback must preserve or restore the owner generation whenever replacement metadata was not published.

[wonder-media]

PASS

PR 5 round-four re-review — f7726bd

Reviewed only the aborted-relaunch ownership-recovery finding and every surface changed from 706d31b to f7726bd9ccbb729a7883a2b83864d14eacfc7e18, as requested. Earlier passing findings stand and were not re-verified.

Verdict

The blocking ownership-recovery finding is closed. A pooled relaunch now snapshots whether a valid prior owner marker exists and, if metadata publication aborts, restores that prior marker—or removes the transient replacement marker for legacy no-marker metadata—before releasing the shared Treehouse operation lock. Successful metadata publication cancels restoration. Retry then publishes matching owner and metadata generations.

No blocking or non-blocking findings were found in the round-four diff.

Code-path evidence

• bin/fm-spawn.sh:707-711 records explicit restore state independently of replacement wiring cleanup.
• bin/fm-spawn.sh:737-781 restores the prior task/generation, removes only the exact transient owner written by this relaunch when no prior marker existed, and refuses to overwrite a marker that changed to another owner or generation.
• bin/fm-spawn.sh:2540-2569 validates and snapshots the prior owner only after the foreign-lease/foreign-owner checks pass.
• bin/fm-spawn.sh:2599-2607 arms restoration before replacing the owner marker, so owner-write and every later pre-publication failure are covered.
• bin/fm-spawn.sh:866-878 performs restoration while SPAWN_TREEHOUSE_LOCK_HELD=1, then releases the shared lock.
• bin/fm-spawn.sh:3011-3019 cancels restoration only after the replacement metadata mv succeeds.
• tests/fm-control-relaunch.test.sh:1059-1095 extends the existing prepublication-failure fixture to prove prior generation restoration, successful retry, and matching retry generations.

Tests and adversarial probes

The changed colocated regression was invoked directly without rerunning earlier cases:

ok - fm-spawn relaunch: prepublication abort restores ownership and permits retry

Independent legacy no-marker counterfactual:

first_rc=1 marker_after_abort=absent retry_rc=0 generations_match=yes

This proves old metadata without an owner marker remains backward-compatible: abort removes only the transient marker, and retry succeeds with matching durable generations.

Independent foreign-change safety probe injected a different live owner after replacement-marker publication but before abort cleanup:

rc=1 owner_after_abort=other-live-task generation=s-foreign
warning: Treehouse owner changed unexpectedly during aborted relaunch of rlsafe; refusing to overwrite other-live-task at generation s-foreign
warning: could not restore Treehouse ownership after aborted relaunch of rlsafe

The cleanup preserved foreign ownership rather than forcing the stale prior marker back into place.

Changed-surface checks

• Diff reviewed: two files, 89 insertions and 2 deletions (bin/fm-spawn.sh, tests/fm-control-relaunch.test.sh).
• Repository lint over both changed shell files with pinned ShellCheck 0.11.0: passed, exit 0.
• git diff --check 706d31b..f7726bd: passed, no output.
• Earlier passing scenarios were intentionally not rerun.

Recommendation

The round-four fix is safe to pass this independent gate. PR 5 may proceed subject to its normal merge authority.

[wonder-media]

PASS

PR 5 light fixture review — abaa2b5

Reviewed only f7726bd..abaa2b56c52476a3e71446eff70c38ec7d839310, as requested. Earlier PR findings and passes stand. This commit changes tests only: 19 files, 135 insertions and 37 deletions.

Verdict

PASS. Every edit is either corrected fixture DATA or diagnostic result-capture plumbing, except one narrowly scoped RULE edit in the GOTMP suite. That rule edit is justified and does not loosen the behavior being tested. No threshold was lowered, matcher widened, or test case skipped.

Classification of every changed file

File	Class	Classification
tests/lib.sh	DATA	Adds fm_fake_treehouse_legacy, an explicit fixture declaring that JSON status is unsupported while legacy status help is available. This narrows the former all-commands-exit-0 double rather than widening behavior.
tests/fm-backend.test.sh	DATA	Replaces two ambiguous Treehouse exit-0 doubles and makes one custom double explicitly advertise legacy status capability.
tests/fm-busy-adapter-wiring.test.sh	DATA	Replaces the generic Treehouse double with the explicit legacy fixture.
tests/fm-decision-hold-lifecycle.test.sh	DATA	Replaces two generic Treehouse doubles with the explicit legacy fixture.
tests/fm-gate-refuse.test.sh	DATA	Replaces/overlays two generic Treehouse doubles with explicit legacy capability data.
tests/fm-gotmp.test.sh	DATA + RULE	DATA: supplies newly required sourced libraries and executable stubs, adds the fake bin to PATH, and preserves failure output. RULE: adds --force to three teardown calls; justification below.
tests/fm-grok-harness.test.sh	DATA	Replaces the generic Treehouse double with explicit legacy capability data.
tests/fm-kimi-harness.test.sh	DATA	Replaces the generic Treehouse double with explicit legacy capability data.
tests/fm-muse-harness.test.sh	DATA	Replaces the generic Treehouse double with explicit legacy capability data.
tests/fm-pr-check-security.test.sh	DATA	Adds the explicit legacy Treehouse fixture to the isolated fake-bin world.
tests/fm-public-followup.test.sh	DATA	Updates Treehouse doubles; builds an inspectable landed Git branch/remote fixture for the missing-worktree teardown path; captures teardown diagnostics without changing exact pass/fail assertions.
tests/fm-remote-secondmate-parent-binding.test.sh	DATA	Overlays the generic Treehouse executable with explicit legacy capability data.
tests/fm-secondmate-harness.test.sh	DATA	Adds explicit legacy Treehouse data to one fixture and extends a lease-capable custom double with explicit legacy status responses.
tests/fm-shared-captain-inheritance.test.sh	DATA	Replaces the generic Treehouse bootstrap double with explicit legacy capability data.
tests/fm-spawn-dispatch-profile.test.sh	DATA	Replaces the generic Treehouse double with explicit legacy capability data.
tests/fm-spawn-pool-base-freshen.test.sh	DATA	Replaces the generic Treehouse double with explicit legacy capability data.
tests/fm-tangle-guard.test.sh	DATA	Replaces two generic Treehouse doubles with explicit legacy capability data.
tests/fm-teardown-endpoint-safety.test.sh	DATA	Makes the custom Treehouse runtime double capability-explicit; changes wait plumbing to capture the exit code under set -e while retaining the exact expect_code 0 rule.
tests/fm-trace-context-spawn.test.sh	DATA	Replaces the generic Treehouse double with explicit legacy capability data.

RULE justification

tests/fm-gotmp.test.sh:146, :225, and :238 add --force to three teardown invocations. This is justified because the suite explicitly tests only whether tasktmp= is removed, absent, or already missing; its hermetic metadata intentionally points at nonexistent worktree/project paths. The newer landed-work safety gate correctly refuses those artificial paths before reaching task-temp cleanup unless the fixture opts out. --force isolates the stated GOTMP behavior without changing its exact assertions, removing a case, weakening a matcher, or altering production code. Landed-work refusal remains owned by the dedicated teardown tests whose earlier results stand.

Checks

• Full diff read and classified: 19 test files; no production files.
• git diff --check f7726bd..abaa2b5: passed with no output.
• No suite was rerun, consistent with the requested light diff-only review.

Recommendation

Accept abaa2b5 as a CI fixture correction.

[wonder-media]

PASS

PR 5 light fixture review — f703ed4

Reviewed only abaa2b5..f703ed48542c150b65eade305b86110b51e78057, as requested. Earlier findings and passes stand.

Verdict

PASS. Both edits are DATA. There are no RULE edits: no threshold, matcher, timing, assertion, or test-case selection changed.

Edit classification

Evidence	Class	Assessment
tests/fm-backend-zellij.test.sh:854	DATA	Adds fm_fake_treehouse_legacy "$fb" to the missing-worktree Zellij scout teardown fixture. It supplies explicit capability values—JSON status unsupported, legacy status help available—in place of accidental reliance on the real machine-wide Treehouse behavior.
tests/fm-backend-zellij.test.sh:901	DATA	Adds the same explicit Treehouse capability fixture to forced secondmate teardown with a Zellij child. It changes only fixture data; the forced-cleanup assertion and Zellij endpoint checks are unchanged.

The edits do not touch the watcher-race test, alter its timing, widen a matcher, suppress a failure, or skip a case. They only make the two teardown worlds hermetic against the Treehouse capability detection introduced earlier in PR 5.

Checks

• Diff reviewed in full: one test file, two inserted fixture lines, no deletions and no production edits.
• git diff --check abaa2b5..f703ed4: passed with no output.
• No suite was rerun, consistent with the requested light diff-only review.

Recommendation

Accept f703ed4 as a fixture-data correction.