diff --git a/.agents/skills/bootstrap-diagnostics/SKILL.md b/.agents/skills/bootstrap-diagnostics/SKILL.md
index 102071b58..115b38f2e 100644
--- a/.agents/skills/bootstrap-diagnostics/SKILL.md
+++ b/.agents/skills/bootstrap-diagnostics/SKILL.md
@@ -2,7 +2,7 @@
 name: bootstrap-diagnostics
 description: >-
   Agent-only handling playbook for session-start bootstrap diagnostics.
-  Use whenever the session-start digest's bootstrap section prints an actionable diagnostic line - MISSING, MISSING_MANUAL, BACKEND_INVALID, NEEDS_GH_AUTH, TANGLE, CREW_DISPATCH invalid, FLEET_SYNC, PR_CHECK_MIGRATION, SECONDMATE_SYNC, SECONDMATE_LIVENESS, NUDGE_SECONDMATES, or FMX - or when a standalone bin/fm-bootstrap.sh run prints one of those lines.
+  Use whenever the session-start digest's bootstrap section prints an actionable diagnostic line - MISSING, MISSING_MANUAL, BACKEND_INVALID, NEEDS_GH_AUTH, TANGLE, CREW_DISPATCH invalid, FLEET_SYNC, PR_CHECK_MIGRATION, SECONDMATE_SYNC, SECONDMATE_LIVENESS, NUDGE_SECONDMATES, FMX, SERVICE_FAILED, AUTODEPLOY_FAILED, AUTODEPLOY_INERT, or UPSTREAM_DRIFT - or when a standalone bin/fm-bootstrap.sh run prints one of those lines.
   A silent bootstrap section, or a BOOTSTRAP_INFO fact, means no skill load.
 user-invocable: false
 metadata:
@@ -27,7 +27,7 @@ When any diagnostic needs captain attention, report the plain consequence and re
 - `TANGLE: <remediation>` - the primary checkout is stranded on a feature branch instead of its default branch; `AGENTS.md` section 8 explains why this guard exists and what it protects.
   The work is safe on that branch ref; restore the primary to its default branch with the printed `git -C <root> checkout <default>`, then re-validate that branch in a proper worktree.
   This is the only sanctioned firstmate-initiated git write to the primary, and it is a non-destructive branch switch that strands nothing.
-- `CREW_DISPATCH: invalid config/crew-dispatch.json - <reason>` - the optional dispatch profile file exists but failed low-cost bootstrap validation; continue with the normal fallback chain, resolve and pass the chosen fallback harness explicitly while the file remains present, fix the malformed schema, unverified harness name, unknown selector, or invalid harness/effort pair when convenient, and do not select a bad profile.
+- `CREW_DISPATCH: invalid config/crew-dispatch.json - <reason>` - the optional dispatch profile file exists but failed low-cost bootstrap validation; continue with the normal fallback chain, resolve and pass the chosen fallback harness explicitly while the file remains present, fix the malformed schema, unverified harness name, unknown selector, invalid harness/effort pair, non-boolean `ultracode`, or non-string `ultracode_role` when convenient, and do not select a bad profile.
 - `FLEET_SYNC: <repo>: skipped: <reason>` - a benign one-off skip (offline, no origin, local-only); bootstrap continued, investigate only if it blocks work.
   A skip can also report the bounded fleet-refresh timeout (`FM_FLEET_SYNC_BOOTSTRAP_TIMEOUT`, or a fleet-size-aware default with a 20 second floor); a timeout never blocks startup.
 - `FLEET_SYNC: <repo>: recovered: <detail>` - the clone had drifted onto a clean detached HEAD holding no unique commits and the sync self-healed it (re-attached the default branch and fast-forwarded); no action needed, it is reported only so the self-heal is visible.
@@ -50,3 +50,17 @@ When any diagnostic needs captain attention, report the plain consequence and re
   Inspect the reason, keep the pending marker under `state/.secondmate-nudge-pending/` intact, and rerun session start after the endpoint or metadata issue is fixed so bootstrap can retry the exact same marked send.
 - `FMX: X mode on ...` / `FMX: X mode off ...` - bootstrap confirmed or removed the local X-mode poll artifacts (`docs/configuration.md` "X mode (.env)").
   Only when a running watcher needs the cadence transition applied immediately, restart the home-scoped watcher through the emitted harness supervision protocol; bootstrap deliberately never restarts the watcher itself.
+- `SERVICE_FAILED: <unit> - failed since <timestamp>` - a systemd unit named in the optional local `config/critical-services` file is in the failed state (`docs/configuration.md` "Critical service watch"); a pure read-only detection (`systemctl is-failed`, no root), so a read-only session still surfaces it.
+  Report it to the captain in plain language; never restart the unit yourself - a unit that failed may be unsafe to restart without knowing why.
+  An absent or empty config file, a host without `systemctl`, or no failed unit all print nothing.
+- `AUTODEPLOY_FAILED: <label> - <last line>` - the last line of a status log named in the optional local `config/autodeploy-logs` file reports failure (`bin/fm-watch.sh`'s `autodeploy_scan` owns the failure convention; `bin/fm-bootstrap.sh`'s `autodeploy_logs_check` is its session-start counterpart, a pure read-only detection that catches a deploy that failed while no watcher was armed to sweep it).
+  Tell the captain plainly that the live deploy for `<label>` is failing, relaying the log line; firstmate never touches the deploy itself.
+  An absent or empty config file, a missing or transiently unreadable log (a NAS hiccup), or a healthy last line all print nothing.
+- `AUTODEPLOY_INERT: config/autodeploy-logs is set but no timeout mechanism (timeout, gtimeout, or perl) is on PATH; autodeploy-alert checks cannot run` - the host has none of the three mechanisms `fm-autodeploy-lib.sh`'s `fm_autodeploy_read_last_line` needs to bound a log read, so every autodeploy check silently no-ops on both the bootstrap check and the watcher's periodic sweep.
+  Tell the captain plainly that autodeploy alerting is disabled on this host until `timeout` (coreutils), `gtimeout` (macOS via Homebrew's coreutils), or `perl` is installed; this is a one-time-per-session capability gap, not a deploy failure.
+- `UPSTREAM_DRIFT: local main is <ahead> ahead / <behind> behind upstream/main, last reconciled <days>d ago (<date>)` - the always-on FYI variant: firstmate's OWN repo tracking how far it has drifted from its read-only upstream template (`kunchenguid/firstmate`, the `upstream` remote after the remote swap).
+  It prints every session; record it silently like any capability fact and take no action while the wording stays FYI.
+  It only reports - the network fetch that refreshes the ref runs in the locked fleet-sync sweep, and reconciling upstream is never a bootstrap side effect.
+- `UPSTREAM_DRIFT: this repo's upstream sync needs attention - ...` - the escalated variant (local main more than ~30 commits behind `upstream/main`, or the merge-base older than 10 days).
+  Surface it to the captain in plain outcome language and, on their go-ahead, dispatch a deliberately-reviewed firstmate-repo reconciliation ship task - fetch `upstream`, merge it into local `main`, resolve conflicts, and land local-only (`AGENTS.md` section 1) - the same shape that reconciled the divergence before.
+  Never automate the merge; keeping the gap small also keeps the pipeline's opportunistic upstream PR's diff clean (`AGENTS.md` section 1).
diff --git a/.agents/skills/harness-adapters/SKILL.md b/.agents/skills/harness-adapters/SKILL.md
index 1e44bff54..68c847ff6 100644
--- a/.agents/skills/harness-adapters/SKILL.md
+++ b/.agents/skills/harness-adapters/SKILL.md
@@ -133,6 +133,13 @@ Its broader dark-TRUECOLOR placeholder handling and dark-theme tradeoff are docu
 That styled capture is internal to the boolean detector only.
 `fm-peek` and every other human or LLM-facing capture path stays plain `tmux capture-pane` with no escape codes.
 
+**Auto-compaction fact (verified 2026-07-09, Claude Code 2.1.206; shipped constant raised to 300000 2026-07-11).**
+`bin/fm-spawn.sh` launches every claude crewmate and secondmate with `CLAUDE_CODE_AUTO_COMPACT_WINDOW=300000`, scoped the same way as `CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false` above, so these separately-launched processes auto-compact around 300k tokens the way the primary already does via its own `.claude/settings.local.json` (which they never inherit).
+The var is read once at process startup and is capped at the model's real context window, so it can only lower the effective trigger, never raise it past the real ceiling: `min(300000, window)` is `300000` once `window` exceeds it, but a no-op (stays at `window`) below that.
+This is not a universal guarantee for every possible future model choice - a differently-configured account/model capped at the plain ~200k window would see no change - but it is true for the window tier crew actually runs on today: `--model sonnet` on this account, the standard crewmate spawn, resolves to the ~1M-context beta, well above 300000.
+Verified live in a tmux pane at the original 200000 value (the mechanism is unchanged, only the shipped constant moved to 300000): `claude --model sonnet` on this account resolves to a ~967k-token auto-compact window with no override (`/context` reported `Auto-compact window: 967k tokens`, i.e. the 1M-context beta, not the 200k a plain Sonnet window would imply); relaunched with `CLAUDE_CODE_AUTO_COMPACT_WINDOW=200000` set, `/context` reported `39.5k/200k tokens (20%)` and `Auto-compact window: 200k tokens` - the window pinned to the override as expected.
+This is why the primary's own two-var form (`CLAUDE_CODE_AUTO_COMPACT_WINDOW=1000000` + `CLAUDE_AUTOCOMPACT_PCT_OVERRIDE=20`) is not copied here: that pair assumes a 1M window, and would silently cap a smaller-window model/account combination to a far more aggressive trigger.
+
 **Primary-session guard fact (verified 2026-07-04, Claude Code 2.1.201; preserved 2026-07-08, Claude Code 2.1.204).**
 This is separate from the per-task crewmate turn-end hook above (that one just `touch`es a marker file in a task's own `.claude/settings.local.json`).
 The firstmate PRIMARY's own `.claude/settings.json` registers `bin/fm-turnend-guard.sh` as a Stop hook, and exiting with status 2 plus stderr reliably forces the model to continue.
diff --git a/.agents/skills/updatefirstmate/SKILL.md b/.agents/skills/updatefirstmate/SKILL.md
index 42b6827ba..4648c88ab 100644
--- a/.agents/skills/updatefirstmate/SKILL.md
+++ b/.agents/skills/updatefirstmate/SKILL.md
@@ -18,6 +18,9 @@ It never forces, never creates a merge commit, never stashes, and advances a tar
 A tracked-files fast-forward leaves the gitignored operational dirs (data/, state/, config/, projects/, .no-mistakes/) untouched, so a secondmate's in-flight work is never disrupted.
 This touches only the firstmate repo and its own worktrees, never anything under `projects/`.
 
+Post-swap, this pull follows `origin`, which is the captain's fork, so `/updatefirstmate` converges the whole fleet onto that fork and does nothing on the primary checkout, which is itself the source every fork tracks.
+It deliberately never reaches for the read-only `upstream` template: folding template improvements into local `main` is a separate, reviewed reconciliation ship task, the one the `UPSTREAM_DRIFT:` bootstrap diagnostic surfaces, and it never rides in on a self-update.
+
 ## What it does
 
 1. **Run the updater:**
diff --git a/.agents/skills/verify-trivial/SKILL.md b/.agents/skills/verify-trivial/SKILL.md
new file mode 100644
index 000000000..a097bcecf
--- /dev/null
+++ b/.agents/skills/verify-trivial/SKILL.md
@@ -0,0 +1,46 @@
+---
+name: verify-trivial
+description: >-
+  Agent-only Light verification tier for a task dispatched at the trivial (haiku/low) model/effort tier.
+  Use when authoring or filling in a Light-tier brief's Task section (a brief scaffolded with `bin/fm-brief.sh --light-verify`), when working a task whose brief points here, or when reviewing such a task's done report before PR-ready.
+  Cites `verify-rigorously` for the AC bar, its 3 verification shapes, its pass/fail matrix, and its "what wasn't verified" footer; layers 3 deltas on top: a cap of 3 acceptance criteria instead of an uncapped set, a 3-attempt cap-out that escalates the task's tier rather than failing it outright, and a mandatory side-effect confidence gate before shipping.
+user-invocable: false
+metadata:
+  internal: true
+---
+
+# verify-trivial
+
+Light verification tier for a task dispatched at the trivial (haiku/low) model/effort tier (see `AGENTS.md` section 7's escalation-trigger paragraph).
+Such a task is scaffolded with `bin/fm-brief.sh --light-verify`; its brief points here instead of the default, uncapped verification workflow.
+
+## Cite, don't copy
+
+Load `verify-rigorously` and apply it in full: named observable pass/fail acceptance criteria, one of its 3 verification shapes per criterion, the criterion x shape pass/fail matrix, and the closing "what wasn't verified" footer.
+This skill does not restate that contract - `verify-rigorously` is its sole owner.
+Everything below is a delta on top of it that applies only to a Light-tier task.
+
+## Delta 1: cap acceptance criteria at 3
+
+Name at most 3 acceptance criteria, not verify-rigorously's uncapped set.
+A trivial-tier task is scoped small enough by definition (`bin/fm-tier-guard.sh`'s envelope: at most 2 changed files, at most 30 changed lines) that 3 observable criteria should describe "done" completely.
+If the task genuinely needs more than 3 to state what done means, that is itself a signal the task has outgrown the trivial tier: report it per Delta 2 instead of naming a 4th criterion.
+
+## Delta 2: a 3-attempt cap-out escalates, it does not fail
+
+verify-rigorously's own 3-attempt cap says: stop and report what's failing, what was tried, and the likely cause.
+On the Light tier, that report is not a terminal failure - it is a request to escalate the task off this tier.
+Append `needs-decision: {criterion} failed verification after 3 attempts, requesting escalation to a heavier tier` (or `blocked:` if the same obstacle recurred, per the brief's own rule for that case) and stop; do not report `failed:` for a cap-out alone.
+Firstmate escalates the task's model/effort in place per `AGENTS.md` section 7's escalation-trigger paragraph, exactly as a `bin/fm-tier-guard.sh` envelope escalation would, and the task continues under the ordinary uncapped `verify-rigorously` workflow from there.
+Never drop the task back to the Light tier afterward - this mirrors section 7's "never silently de-escalate for the rest of that task's life."
+
+## Delta 3: mandatory side-effect confidence gate before shipping
+
+Before reporting `done:` (ship tasks) or writing the report (scout tasks), state explicitly, in one line, whether the change has any side effects outside the files it touches - a shared config default, a migration, a public interface, a cross-task or cross-project coupling - and your confidence in that assessment.
+An unstated "no side effects" is not the same as a stated one: silence here is exactly the gap verify-rigorously's own footer warns against, so this gate is mandatory even when the answer is "none found."
+If confidence is anything less than high, that uncertainty is itself grounds for a Delta 2 escalation rather than shipping on the Light tier.
+
+## Wiring this tier's no-mistakes validation
+
+For a no-mistakes-mode ship task on this tier, firstmate's validation trigger skips the document step (`no-mistakes axi run --skip=document`): the side-effect confidence gate above already covers what that step would otherwise catch at this tier's scale.
+This is firstmate's own action at Validate time (`AGENTS.md` section 7), not something the crewmate invokes itself.
diff --git a/.gitignore b/.gitignore
index 5ed2da0c3..fa0bc89c2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,4 +15,6 @@ config/backlog-backend
 config/backend
 config/x-mode.env
 config/cmux-socket-password
+config/autodeploy-logs
 config/wedge-alarm
+config/critical-services
diff --git a/AGENTS.md b/AGENTS.md
index a541c7781..812065c53 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -36,12 +36,19 @@ Hard rules, in priority order:
 5. **Report outcomes faithfully.**
    If work failed, say so plainly with the evidence.
 
-You may maintain this repo's private operational state directly.
-Shared tracked material is `AGENTS.md`, `README.md`, `CONTRIBUTING.md`, `.tasks.toml`, `.github/workflows/`, `bin/`, `.agents/skills/`, and public `skills/`.
-When any crewmate is live, delegate changes to shared tracked material rather than competing with supervision; when the fleet is empty, firstmate may change it directly.
-This repo is a shared template, while `.env`, `data/`, `state/`, `config/`, `projects/`, and `.no-mistakes/` are captain-private and gitignored.
-Ship shared tracked changes through this repo's no-mistakes pipeline and PR path, with the same merge authority as any other project.
-Never add an agent name as a commit co-author.
+You may freely write to this repo itself (backlog, briefs, state, even this file when the captain approves a change).
+Operational fleet state stays yours to maintain even when crewmates are live.
+Shared, tracked material means `AGENTS.md`, `README.md`, `CONTRIBUTING.md`, `.tasks.toml`, `.github/workflows/`, `bin/`, `.agents/skills/`, and public `skills/`.
+When one or more crewmates are in flight, delegate changes to shared, tracked material to a crewmate through the normal scout or ship machinery instead of hand-editing them yourself.
+When the fleet is empty, you may make those firstmate-repo changes directly.
+Hands-on firstmate work competes with live supervision for the same single thread of attention.
+This repo is a shared template, not the captain's personal project.
+The tracking principle: shared, tracked material is tracked under git; anything personal to this captain's fleet (.env, data/, state/, config/, projects/, .no-mistakes/) is not.
+Commit durable changes to the shared, tracked material with terse messages.
+This repo is itself behind the no-mistakes gate: ship shared, tracked material through the pipeline - branch, commit, run the pipeline, PR - and the captain's merge rule applies here exactly as it does to projects.
+This repo's own upstream (`kunchenguid/firstmate`, the `upstream` remote after the remote swap) is read-only to this fleet with no merge rights, ever, so firstmate-repo ship tasks land local-only: branch, commit, firstmate reviews the diff, the captain approves, and firstmate fast-forwards local `main`.
+The pipeline still auto-opens a PR against that upstream, but it is a non-blocking, purely opportunistic contribution back - never a merge gate here and never waited on - and its diff stays clean only while the `UPSTREAM_DRIFT:` gap (section 3) is small, since a large gap makes the PR carry a lot of unrelated local-only history.
+Never add an agent name as co-author.
 
 ## 2. Layout and state
 
@@ -71,11 +78,14 @@ config/backend  runtime session-provider backend override for new tasks; LOCAL,
 config/cmux-socket-password  optional cmux control-socket password; LOCAL, gitignored; read fresh on every cmux CLI call and passed through without ever overriding an operator's own ambient CMUX_SOCKET_PASSWORD when absent (docs/cmux-backend.md "Setup")
 config/wedge-alarm  optional away-mode wedge-alarm active-alert directives; LOCAL, gitignored; absent means auto (macOS Notification Center when available); see docs/wedge-alarm.md
 config/x-mode.env    generated X-mode watcher cadence; LOCAL, gitignored; source before arming watcher when present
+config/critical-services  optional systemd unit names to watch for the failed state, one per line, blank lines and full-line "#" comments ignored; LOCAL, gitignored; absent or empty = no-op; each failed unit surfaces as a read-only bootstrap SERVICE_FAILED diagnostic at every session start (section 3); NOT inherited into secondmate homes, whose same-machine bootstrap would only re-check the same units; see docs/examples/critical-services for a copyable sample
+config/autodeploy-logs  optional poll-based autodeploy status-log paths to watch for failure, one per line, blank lines and full-line "#" comments ignored; LOCAL, gitignored; absent or empty = no-op; each log's last line is read on the watcher's periodic heartbeat sweep and a failure (an "ALERT ..." rollup or a STUCK:/FAILED:/needs-attention line, per bin/fm-autodeploy-lib.sh's fm_autodeploy_line_failed match set) surfaces once as a check wake until it clears, while a missing/unreadable log is skipped silently (bin/fm-watch.sh's autodeploy_scan); the same failure also surfaces as a read-only bootstrap AUTODEPLOY_FAILED diagnostic at every session start (bin/fm-bootstrap.sh's autodeploy_logs_check), so an idle fleet still catches it at the next session even when no watcher swept between sessions; when the log-read timeout mechanism (timeout, gtimeout, or perl) is absent on this host, that same bootstrap check instead prints a one-time AUTODEPLOY_INERT diagnostic so the captain learns alerting is disabled rather than assuming a silently healthy deploy; NOT inherited into secondmate homes, whose same-machine bootstrap and sweep would only re-check the same logs; see docs/examples/autodeploy-logs for a copyable sample
 data/                personal fleet records; LOCAL, gitignored as a whole
   backlog.md         task queue, dependencies, history
   captain.md         this home's domain-local captain preferences and working style; LOCAL, gitignored, canonical even if harness memory mirrors it, and updated with inspect-then-update
   captain-shared.md  main-authoritative shared captain preferences propagated read-only to secondmate homes; LOCAL, gitignored, owned by secondmate-provisioning
   learnings.md       fleet-local operational facts and gotchas; LOCAL, gitignored; dated, evidence-backed, curated, and updated with inspect-then-update - rewrite and prune rather than append forever, the same contract as captain.md; created lazily, absent until this home has a learning to store
+  nas-deployments.md hand-maintained pipe-table mapping a project to its live NAS deployment, one row per deployed project: "| <project> | <nas_repo_path> | <pm2_process(es)> |" (comma-separated when more than one pm2 process serves it); read by bin/fm-nas-deploy-sync.sh (section 7); absent or a project missing a row means that project has no known live deployment, not an error
   projects.md        thin fleet navigation registry; firstmate-private, parsed by fm-project-mode.sh (section 6)
   secondmates.md      secondmate routing table; firstmate-private, maintained by fm-home-seed.sh (section 6)
   <id>/brief.md      per-task crewmate brief, or per-secondmate charter brief when kind=secondmate
@@ -85,9 +95,10 @@ state/               volatile runtime signals; gitignored
   <id>.status        appended by crewmates: "<state>: <note>" wake-event lines, not current-state truth
   <id>.turn-ended    touched by turn-end hooks
   <id>.grok-turnend-token   firstmate-owned grok hook registry token for the task; removed by teardown
-  <id>.meta          written by fm-spawn: window=, worktree=, project=, harness=, model=, effort=, kind=, mode=, yolo=, tasktmp=; kind=secondmate also records home= and projects=; a non-default runtime backend records further backend-specific fields (docs/configuration.md "Runtime backend"; bin/fm-backend.sh, section 8); fm-pr-check, including through fm-pr-merge, records one canonical pr= and GitHub's pr_head= when available; fm-x-link appends x_request=, x_request_ts=, x_followups=, and optional x_platform=/x_reply_max_chars= for an X-mode-originated task (section 14)
+  <id>.meta          written by fm-spawn: window=, worktree=, project=, harness=, model=, effort=, kind=, mode=, yolo=, tasktmp=; a ship/scout task also records compose_project=, a Docker-Compose-safe project name derived from the worktree's pool-slot path (docs/configuration.md "Docker Compose project isolation"), while kind=secondmate omits it and instead records home= and projects=; a non-default runtime backend records further backend-specific fields (docs/configuration.md "Runtime backend"; bin/fm-backend.sh, section 8); fm-pr-check, including through fm-pr-merge, records one canonical pr= and GitHub's pr_head= when available; fm-x-link appends x_request=, x_request_ts=, x_followups=, and optional x_platform=/x_reply_max_chars= for an X-mode-originated task (section 14)
   <id>.check.sh      authenticated slow poll; the watcher dispatches validated PR data and the byte-identified X shim through trusted repository scripts, runs registered custom checks from hash-validated private snapshots, and rejects every other state check without execution
   <id>.check-trust   private content binding created by fm-check-register.sh for an intentional custom check
+  <id>.ultracode     present when the dispatched profile set ultracode=true or a risk-floor tripwire hit flagged it; role=<ultracode_role>, plus reviewed_by=<reviewer-task-id> once bin/fm-ultracode-guard.sh confirms an independent second pass ran (section 4)
   <id>.pr-poll       private validated data sidecar for the byte-static PR merge poll
   <id>.pr-poll-registration  private transactional provenance record binding the task, canonical metadata identity, sidecar, and static poll publication
   .pr-check-quarantine/  private non-runnable storage for checks neutralized by the non-executing migration
@@ -162,6 +173,14 @@ Do not add model-specific versions of that policy.
 Dispatch only on a backend that `fm-spawn` validates as spawn-capable.
 A missing dependency, authentication failure, unsupported backend, or version refusal is a blocker; never silently retry on another backend.
 
+Never select a configured harness, or a dispatch rule's non-default model, that has not been verified end-to-end on a trivial supervised task, including any advisor or sub-agent tool path its harness exposes; do not copy an unverified model into a live `config/crew-dispatch.json`.
+When the resolved profile sets `ultracode`, run `bin/fm-ultracode-guard.sh flag <id> <ultracode_role>` right after spawn so the independent-review requirement is tracked mechanically instead of resting on memory.
+
+**Risk floor (mechanical, applies after any dispatch match).**
+Run `bin/fm-risk-tripwire.sh <id>` right after profile resolution, and again once the task has a brief or a diff.
+A hit floors the model/effort to the safety-critical profile (`opus`/`xhigh`) and flags ultracode `independent-review` via `bin/fm-ultracode-guard.sh flag <id> independent-review`, regardless of which rule matched; a hit discovered only at Validate time still floors the task in place and is never silently downgraded afterward.
+`bin/fm-dispatch-select.sh` owns `quota-balanced` selection determinism and degrades to the first array element whenever quota data is unusable; quota trouble must never block dispatch.
+
 ## 5. Recovery
 
 After the one session-start digest, reconcile reality with durable records before taking new work.
@@ -280,6 +299,18 @@ Running, fixing, or CI states remain working; parked approval or fix-review stat
 A worker hand-editing, committing, aborting, or restarting during an active validation run duplicates pipeline ownership; steer it back to the gate response flow.
 The worker reports the PR when CI first becomes green rather than waiting for merge monitoring to finish.
 
+**Escalation triggers (mechanical, never rest on self-report alone).**
+For a task assigned the trivial tier (Haiku/low), run `bin/fm-tier-guard.sh <id>` during Validate, or whenever a heartbeat review touches it, to check whether its diff or elapsed time has outgrown that tier's envelope; any tier also escalates once its diff crosses the script's general heavy-scale ceiling.
+A report escalates the task to at least Sonnet/high in place, without losing its branch or context, mirroring `bin/fm-promote.sh`'s in-place promotion.
+A crewmate's own report - it cannot find root cause, a "confirmed" fix touches a shared path, or it raised a tradeoff buried in seemingly mechanical work - is a second, non-mechanical trigger with the same effect.
+Either way, escalate the model/effort in place and never silently de-escalate for the rest of that task's life.
+
+A trivial-tier task also runs the Light verification tier: scaffold its brief with `bin/fm-brief.sh --light-verify` (section 11) so it cites `verify-trivial` instead of the default full verification workflow, and for a no-mistakes-mode task, skip the document step when triggering its validation (`no-mistakes axi run --skip=document`) since that tier's mandatory side-effect confidence gate already covers what the step would check.
+A tier-guard or self-reported escalation above lifts the task off the Light verification tier for the rest of its life, exactly like the model/effort escalation it rides alongside.
+
+**Ultracode confirmation.**
+Before advancing an ultracode-flagged task to PR-ready, run `bin/fm-ultracode-guard.sh check <id>`; it refuses until a genuinely separate task - dispatched independently, never a sub-task the flagged crewmate spawned itself - has reviewed the finished diff and its findings were addressed, recorded with `bin/fm-ultracode-guard.sh reviewed <id> <reviewer-task-id>`.
+
 ### PR ready, landing, and teardown
 
 For PR-based ship tasks, the ready signal depends on mode: `no-mistakes` reports `done: PR <url> checks green` after CI is green, while `direct-PR` reports `done: PR <url>` after opening the PR.
@@ -431,6 +462,7 @@ Every ship brief must retain the worktree-isolation assertion and stop if launch
 If a ship task touches firstmate's shared tracked material, explicitly require `firstmate-coding-guidelines` before editing.
 If a task will drive Herdr lifecycle behavior, scaffold with `--herdr-lab`; if that need appears after an unguarded scaffold, stop and regenerate rather than adding commands by hand.
 The generated Herdr contract must use a named non-`default` isolated lab and its guarded helper for every lifecycle action.
+For a task dispatched at the trivial (Haiku/low) tier, scaffold with `--light-verify` so the brief cites `verify-trivial` instead of the default verification workflow; the flag is rejected for `--secondmate` briefs.
 
 Load `secondmate-provisioning` before creating or using a charter brief and preserve its idle-by-default and marked-return-channel contracts.
 Status appends are sparse supervisor-actionable events, not routine progress; `bin/fm-classify-lib.sh` owns keyed open and resolved semantics.
@@ -441,13 +473,15 @@ The scaffold is a safety contract, not a suggestion.
 Firstmate's shared instruction surface reaches running homes only after it lands on the default branch and those homes fast-forward.
 Only `AGENTS.md`, `bin/`, and `.agents/skills/` are loaded by a running firstmate; public `skills/` is an installer-facing surface.
 When the captain invokes `/updatefirstmate` or asks to update firstmate, load the `/updatefirstmate` skill.
-It performs guarded fast-forward updates of firstmate and registered secondmate homes, refreshes instructions, and never touches anything under `projects/`.
+It performs guarded fast-forward updates of firstmate and registered secondmate homes, refreshes instructions, nudges updated live secondmates, and never touches anything under `projects/`.
+Post-swap, `origin` is the captain's fork, so `/updatefirstmate` only ever converges the fleet onto that fork and is a no-op on the primary checkout, which is itself the fleet's source of truth.
+It never pulls the read-only `upstream` template; folding upstream-template improvements into local `main` is the separate reviewed reconciliation task the `UPSTREAM_DRIFT:` bootstrap line surfaces (section 3), never a self-update.
 
 ## 13. Agent-only reference skills
 
 These skills are not captain-invocable; load them only at their precise triggers.
 
-- `bootstrap-diagnostics` - load whenever the session-start digest's bootstrap section prints an actionable diagnostic line (`MISSING:`, `MISSING_MANUAL:`, `BACKEND_INVALID:`, `NEEDS_GH_AUTH`, `TANGLE:`, `CREW_DISPATCH: invalid`, `FLEET_SYNC:`, `PR_CHECK_MIGRATION:`, `SECONDMATE_SYNC:`, `SECONDMATE_LIVENESS:`, `NUDGE_SECONDMATES:`, or `FMX:`); silence and `BOOTSTRAP_INFO:` need no load.
+- `bootstrap-diagnostics` - load whenever the session-start digest's bootstrap section prints an actionable diagnostic line (`MISSING:`, `MISSING_MANUAL:`, `BACKEND_INVALID:`, `NEEDS_GH_AUTH`, `TANGLE:`, `CREW_DISPATCH: invalid`, `FLEET_SYNC:`, `PR_CHECK_MIGRATION:`, `SECONDMATE_SYNC:`, `SECONDMATE_LIVENESS:`, `NUDGE_SECONDMATES:`, `FMX:`, `SERVICE_FAILED:`, `AUTODEPLOY_FAILED:`, `AUTODEPLOY_INERT:`, or `UPSTREAM_DRIFT:`); silence and `BOOTSTRAP_INFO:` need no load.
 - `diagnostic-reasoning` - load before scoping a reported bug and before acting on a diagnostic report.
 - `harness-adapters` - load before spawning or recovering a crewmate or secondmate, handling a trust dialog, sending a harness-specific skill invocation, interrupting or exiting an agent, resuming an exited agent, or verifying a new harness adapter.
 - `firstmate-orca` - load before switching to Orca, spawning or supervising Orca-backed work, smoke-testing Orca backend behavior, debugging Orca task state, or reconciling Orca-backed task metadata.
@@ -458,6 +492,7 @@ These skills are not captain-invocable; load them only at their precise triggers
 - `fmx-respond` - load on an `x-mention <request_id>` `check:` wake to handle the mention, on an `x-mode-error ...` `check:` wake to report the X-mode configuration blocker, and on any milestone or terminal wake for an X-mode-linked task before posting its completion follow-up; relevant only when X mode is on.
 - `firstmate-codexapp` - load before coordinating a visible Codex Desktop thread, evaluating a Codex App backend request, or reconciling Codex Desktop host-tool smoke evidence for Firstmate work.
 - `firstmate-coding-guidelines` - load before changing firstmate's shared, tracked material, as defined by section 1's list, whether editing directly or briefing a crewmate for a firstmate-repo task.
+- `verify-trivial` - load before authoring or filling in a Light-tier brief's Task section (a brief scaffolded with `bin/fm-brief.sh --light-verify`, section 11) and before advancing such a task to PR-ready.
 
 ## 14. X mode
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 4e7bd8154..52e790d91 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -30,6 +30,8 @@ Dependency bots are exempt so their automation keeps working, but regular contri
 
 See the [no-mistakes quick start](https://kunchenguid.github.io/no-mistakes/start-here/quick-start/) for the full first-run walkthrough.
 
+Note: a firstmate maintainer's own working copy uses the inverted remote layout - there `origin` is the maintainer's fork and `upstream` is this parent repo - so if you are ever reading such a copy's git config rather than your own fresh clone, expect `origin` and `upstream` swapped from the step 1 layout above.
+
 ## Repo conventions
 
 - This repo is a template for running a firstmate orchestrator agent.
diff --git a/bin/backends/cmux.sh b/bin/backends/cmux.sh
index 69dc0b53b..478e9ee50 100644
--- a/bin/backends/cmux.sh
+++ b/bin/backends/cmux.sh
@@ -398,8 +398,15 @@ fm_backend_cmux_parse_target() {  # <target>
 # (fm_backend_zellij_pane_exists) rather than the design sketch's original
 # read-screen-based suggestion.
 fm_backend_cmux_surface_exists() {  # <workspace_id> <surface_id>
-  local wsid=$1 sfid=$2
-  fm_backend_cmux_cli list-panes --workspace "$wsid" --json --id-format uuids 2>/dev/null \
+  local wsid=$1 sfid=$2 out
+  # Capture the list-panes call and gate on its OWN exit/output before piping to
+  # jq: an absent target makes list-panes fail with no output, and `jq -e` on
+  # empty input exits 0 on jq 1.6 (only 1.7+ reports the no-result exit 4), so
+  # relying on the pipe's trailing jq status alone would false-positive the
+  # surface as present on older jq. A failed or empty list-panes means no surface.
+  out=$(fm_backend_cmux_cli list-panes --workspace "$wsid" --json --id-format uuids 2>/dev/null) || return 1
+  [ -n "$out" ] || return 1
+  printf '%s' "$out" \
     | jq -e --arg s "$sfid" '[.panes[]? | select(.surface_ids // [] | index($s))] | length > 0' >/dev/null 2>&1
 }
 
diff --git a/bin/fm-afk-launch.sh b/bin/fm-afk-launch.sh
index a6ddcbcc6..90c503eb5 100755
--- a/bin/fm-afk-launch.sh
+++ b/bin/fm-afk-launch.sh
@@ -77,22 +77,39 @@ fm_afk_launch_lock_owned() {
 }
 
 fm_afk_launch_lock_acquire() {
-  local i incomplete=0 identity
+  local i incomplete=0 identity pending=""
   mkdir -p "$FM_AFK_LAUNCH_STATE" || return 1
   for i in $(seq 1 200); do
     if mkdir "$FM_AFK_LAUNCH_LOCK" 2>/dev/null; then
+      # The pid file (and the ps-backed identity lookup after it) take a few
+      # milliseconds to land. A TERM/INT arriving in that window would hit
+      # fm_afk_launch_main's normal 'exit N' traps before the lock is
+      # ownership-tagged, so fm_afk_launch_lock_release couldn't recognize
+      # and release it. Record the signal instead of exiting immediately,
+      # then act on it right after publishing finishes.
+      trap 'pending=TERM' TERM
+      trap 'pending=INT' INT
       if ! printf '%s' "$$" > "$FM_AFK_LAUNCH_LOCK/pid"; then
         rm -rf "$FM_AFK_LAUNCH_LOCK"
+        trap 'exit 143' TERM; trap 'exit 130' INT
         return 1
       fi
       identity=$(fm_pid_identity "$$" 2>/dev/null) || {
         rm -rf "$FM_AFK_LAUNCH_LOCK"
+        trap 'exit 143' TERM; trap 'exit 130' INT
         return 1
       }
       if [ -z "$identity" ] || ! printf '%s' "$identity" > "$FM_AFK_LAUNCH_LOCK/pid-identity"; then
         rm -rf "$FM_AFK_LAUNCH_LOCK"
+        trap 'exit 143' TERM; trap 'exit 130' INT
         return 1
       fi
+      trap 'exit 143' TERM
+      trap 'exit 130' INT
+      case "$pending" in
+        TERM) fm_afk_launch_lock_release; exit 143 ;;
+        INT) fm_afk_launch_lock_release; exit 130 ;;
+      esac
       return 0
     fi
     if [ ! -s "$FM_AFK_LAUNCH_LOCK/pid" ] || [ ! -s "$FM_AFK_LAUNCH_LOCK/pid-identity" ]; then
@@ -603,10 +620,15 @@ fm_afk_launch_stop() {
 
 fm_afk_launch_main() {
   local result
-  fm_afk_launch_lock_acquire || return 1
+  # Traps go up before lock_acquire, not after: fm_afk_launch_lock_release
+  # is a no-op until the lock's pid file names this process, so installing
+  # them early is safe and closes the window where a TERM/INT arriving right
+  # after the lock directory is created but before the trap is set would
+  # kill the process via the default disposition and leak the lock.
   trap fm_afk_launch_lock_release EXIT
   trap 'exit 130' INT
   trap 'exit 143' TERM
+  fm_afk_launch_lock_acquire || return 1
   case "${1:-start}" in
     start) fm_afk_launch_start ;;
     start-native) fm_afk_launch_start_native ;;
diff --git a/bin/fm-autodeploy-lib.sh b/bin/fm-autodeploy-lib.sh
new file mode 100644
index 000000000..d4964d8f4
--- /dev/null
+++ b/bin/fm-autodeploy-lib.sh
@@ -0,0 +1,40 @@
+# shellcheck shell=bash
+# Shared autodeploy-log helpers. Usage: . bin/fm-autodeploy-lib.sh
+#
+# fm_autodeploy_line_failed tests a status log's last line for failure. The log
+# format is whatever an external per-project autodeploy tool writes (e.g.
+# beamanalyzer's deploy job): a healthy run ends in an "ok ..." rollup and a
+# failed one in an "ALERT ..." rollup, plus firstmate's own
+# STUCK:/FAILED:/needs-attention alert-line format (bin/fm-fleet-sync.sh emits
+# the STUCK: variant). The ok/ALERT rollup is the deploy tool's own convention,
+# not something bin/fm-fleet-sync.sh produces. Both readers of
+# config/autodeploy-logs - the periodic sweep (bin/fm-watch.sh's autodeploy_scan)
+# and the session-start bootstrap check (bin/fm-bootstrap.sh's
+# autodeploy_logs_check) - source this so the match set has exactly one
+# definition.
+
+# True (0) when <line> reports an autodeploy failure.
+fm_autodeploy_line_failed() {
+  printf '%s' "$1" | grep -Eq 'STUCK:|FAILED:|needs attention|(^|[[:space:]])ALERT([[:space:]]|$)'
+}
+
+# True (0) when a read-timeout mechanism fm_autodeploy_read_last_line can use
+# (timeout, gtimeout, or perl) is on PATH. fm-bootstrap.sh's autodeploy_logs_check
+# uses this to warn the captain once when config/autodeploy-logs is configured but
+# the whole feature would otherwise go silently inert on this host.
+fm_autodeploy_read_timeout_available() {
+  command -v timeout >/dev/null 2>&1 || command -v gtimeout >/dev/null 2>&1 || command -v perl >/dev/null 2>&1
+}
+
+fm_autodeploy_read_last_line() {
+  local log=$1 timeout_secs=${FM_AUTODEPLOY_LOG_READ_TIMEOUT:-5}
+  if command -v timeout >/dev/null 2>&1; then
+    timeout "$timeout_secs" tail -n 1 "$log" 2>/dev/null
+  elif command -v gtimeout >/dev/null 2>&1; then
+    gtimeout "$timeout_secs" tail -n 1 "$log" 2>/dev/null
+  elif command -v perl >/dev/null 2>&1; then
+    perl -e 'my $t = shift; my $pid = fork; die "fork failed" unless defined $pid; if (!$pid) { setpgrp(0, 0); exec @ARGV } local $SIG{ALRM} = sub { kill "TERM", -$pid; select undef, undef, undef, 0.2; kill "KILL", -$pid; exit 124 }; alarm $t; waitpid $pid, 0; exit($? >> 8)' "$timeout_secs" tail -n 1 "$log" 2>/dev/null
+  else
+    return 1
+  fi
+}
diff --git a/bin/fm-bootstrap.sh b/bin/fm-bootstrap.sh
index 753c5cec3..721a0bdad 100755
--- a/bin/fm-bootstrap.sh
+++ b/bin/fm-bootstrap.sh
@@ -16,7 +16,10 @@
 #                 "NUDGE_SECONDMATES: secondmate <id>: send failed: <reason>",
 #                 "BOOTSTRAP_INFO: nudged fm-<id> with '<message>'",
 #                 "SECONDMATE_LIVENESS: secondmate <id>: skipped: <reason>|respawn failed: <reason>",
-#                 "FMX: X mode on ..." or "FMX: X mode off ...".
+#                 "FMX: X mode on ..." or "FMX: X mode off ...",
+#                 "SERVICE_FAILED: <unit> - failed since <timestamp>",
+#                 "UPSTREAM_DRIFT: local main <ahead> ahead / <behind> behind
+#                 upstream/main ... (needs-attention wording when far behind or stale)".
 #          When a RUNNING secondmate worktree is fast-forwarded to firstmate's
 #          own current default-branch commit (a purely LOCAL fast-forward, never
 #          an origin fetch) AND its loaded instruction surface (AGENTS.md, bin/,
@@ -57,8 +60,30 @@
 #          X mode is OPTIONAL and inert unless FM_HOME/.env has a non-empty
 #          FMX_PAIRING_TOKEN. When opted in, bootstrap requires curl+jq, writes
 #          the relay poll shim and 30s cadence config, and prints an FMX line.
+#          A SERVICE_FAILED line means a systemd unit named in the optional local
+#          config/critical-services file is in the failed state; it is a pure
+#          read-only detection (systemctl is-failed, no root) so a read-only
+#          session still surfaces it. Absent config file, no systemctl, or no
+#          failed unit all print nothing. The timestamp clause is omitted when
+#          StateChangeTimestamp is unavailable.
+#          An UPSTREAM_DRIFT line reports, every session, how far firstmate's OWN
+#          local main and its read-only upstream template (upstream/main after the
+#          remote swap; kunchenguid/firstmate) have diverged in both directions,
+#          plus days since their last shared merge-base. It reads whatever
+#          refs/remotes/upstream/main currently holds and NEVER fetches, so it
+#          prints in the read-only/no-lock path too; the network fetch that
+#          refreshes that ref runs only in the locked mutating fleet-sync sweep
+#          below (bounded by FM_UPSTREAM_FETCH_TIMEOUT, default 20s). The wording
+#          escalates from a plain FYI to "this repo's upstream sync needs
+#          attention" once local main is more than 30 commits behind upstream/main
+#          or the merge-base is older than 10 days. It only REPORTS; reconciling
+#          upstream is always a deliberately dispatched, reviewed ship task, never
+#          automated. No-op when there is no upstream remote or no upstream/main
+#          ref yet.
 #          Fleet sync fetches, fast-forwards safe default-branch states, reports
-#          recovered and STUCK clone drift, and prunes gone local branches; it is
+#          recovered and STUCK clone drift, and prunes gone local branches, and it
+#          also refreshes firstmate's own upstream template for the UPSTREAM_DRIFT
+#          report above; it is
 #          bounded by FM_FLEET_SYNC_BOOTSTRAP_TIMEOUT when it is a non-empty
 #          numeric override, while non-numeric values fall back to 20s.
 #          When the override is unset or blank, the timeout is
@@ -100,6 +125,8 @@ DATA="${FM_DATA_OVERRIDE:-$FM_HOME/data}"
 . "$SCRIPT_DIR/fm-x-lib.sh"
 # shellcheck source=bin/fm-backend.sh disable=SC1091
 . "$SCRIPT_DIR/fm-backend.sh"
+# shellcheck source=bin/fm-autodeploy-lib.sh disable=SC1091
+. "$SCRIPT_DIR/fm-autodeploy-lib.sh"
 
 fleet_sync_origin_backed_project_count() {
   local count proj
@@ -151,7 +178,94 @@ fleet_sync_relay_all_output() {
   done < "$tmp"
 }
 
+# Upstream-drift diagnostic for firstmate's OWN repo (both halves defined here).
+# firstmate's upstream template (upstream/main after the remote swap;
+# kunchenguid/firstmate) is read-only to this fleet - it can never be pushed or
+# merged from here - so local main and upstream/main drift apart silently over
+# time, and firstmate-repo ship tasks land local-only instead (AGENTS.md prime
+# directives). The report reads whatever refs/remotes/upstream/main currently
+# holds WITHOUT fetching, so it is safe in the read-only/no-lock detect path; the
+# fetch runs only in the locked fleet-sync sweep. It only REPORTS - reconciling
+# upstream stays a deliberately dispatched, reviewed ship task, never automated.
+UPSTREAM_DRIFT_BEHIND_MAX=30
+UPSTREAM_DRIFT_DAYS_MAX=10
+
+# Count-and-report half: unconditional (detect section), no network. Prints one
+# FYI line every session with how far local main is ahead/behind upstream/main and
+# days since their merge-base, escalating the wording to "needs attention" once
+# local main is more than UPSTREAM_DRIFT_BEHIND_MAX commits behind OR the
+# merge-base is older than UPSTREAM_DRIFT_DAYS_MAX days. No-op without an upstream
+# remote, an upstream/main ref, or a local main.
+upstream_drift_report() {
+  local behind ahead base="" base_ct="" base_date="unknown" now="" days="?" attention=0
+  git -C "$FM_ROOT" remote get-url upstream >/dev/null 2>&1 || return 0
+  git -C "$FM_ROOT" rev-parse --verify --quiet refs/remotes/upstream/main >/dev/null 2>&1 || return 0
+  git -C "$FM_ROOT" rev-parse --verify --quiet refs/heads/main >/dev/null 2>&1 || return 0
+  behind=$(git -C "$FM_ROOT" rev-list --count main..upstream/main 2>/dev/null) || return 0
+  ahead=$(git -C "$FM_ROOT" rev-list --count upstream/main..main 2>/dev/null) || return 0
+  base=$(git -C "$FM_ROOT" merge-base main upstream/main 2>/dev/null || true)
+  if [ -n "$base" ]; then
+    base_date=$(git -C "$FM_ROOT" log -1 --format=%cd --date=short "$base" 2>/dev/null || echo unknown)
+    base_ct=$(git -C "$FM_ROOT" log -1 --format=%ct "$base" 2>/dev/null || true)
+    now=$(date +%s 2>/dev/null || true)
+    if [ -n "$base_ct" ] && [ -n "$now" ]; then
+      days=$(( (now - base_ct) / 86400 ))
+    fi
+  fi
+  case "$behind" in ''|*[!0-9]*) ;; *) [ "$behind" -gt "$UPSTREAM_DRIFT_BEHIND_MAX" ] && attention=1 ;; esac
+  case "$days" in ''|*[!0-9]*) ;; *) [ "$days" -gt "$UPSTREAM_DRIFT_DAYS_MAX" ] && attention=1 ;; esac
+  if [ "$attention" -eq 1 ]; then
+    echo "UPSTREAM_DRIFT: this repo's upstream sync needs attention - local main is $behind behind / $ahead ahead of upstream/main, last reconciled ${days}d ago ($base_date); dispatch a reviewed reconciliation ship task"
+  else
+    echo "UPSTREAM_DRIFT: local main is $ahead ahead / $behind behind upstream/main, last reconciled ${days}d ago ($base_date)"
+  fi
+}
+
+# Fetch half: MUTATING/network, called only from fleet_sync (the locked sweep), so
+# the detect-only/read-only path never fetches. Best-effort and bounded - offline,
+# a transient failure, or a stalled connection just leaves the last-fetched ref in
+# place, and a bound always caps a stall so session start never hangs: `timeout`
+# when available, `gtimeout` on a platform that only has the Homebrew coreutils
+# name for it (mirrors bin/fm-nas-deploy-sync.sh's HAVE_TIMEOUT fallback), and a
+# background-then-kill fallback (mirrors fleet_sync's own pattern below) when
+# neither binary is installed at all. No-op without an upstream remote.
+upstream_drift_fetch() {
+  git -C "$FM_ROOT" remote get-url upstream >/dev/null 2>&1 || return 0
+  local seconds="${FM_UPSTREAM_FETCH_TIMEOUT:-20}" pid start monitor_was_on=0
+  if command -v timeout >/dev/null 2>&1; then
+    timeout "$seconds" git -C "$FM_ROOT" fetch --quiet upstream 2>/dev/null || true
+    return 0
+  fi
+  if command -v gtimeout >/dev/null 2>&1; then
+    gtimeout "$seconds" git -C "$FM_ROOT" fetch --quiet upstream 2>/dev/null || true
+    return 0
+  fi
+  case $- in *m*) monitor_was_on=1 ;; esac
+  set -m 2>/dev/null || true
+  git -C "$FM_ROOT" fetch --quiet upstream 2>/dev/null &
+  pid=$!
+  start=$SECONDS
+  while kill -0 "$pid" 2>/dev/null; do
+    if [ "$((SECONDS - start))" -ge "$seconds" ]; then
+      kill -TERM "-$pid" 2>/dev/null || kill "$pid" 2>/dev/null || true
+      wait "$pid" 2>/dev/null || true
+      [ "$monitor_was_on" -eq 1 ] || set +m 2>/dev/null || true
+      return 0
+    fi
+    sleep 1
+  done
+  wait "$pid" 2>/dev/null || true
+  [ "$monitor_was_on" -eq 1 ] || set +m 2>/dev/null || true
+}
+
 fleet_sync() {
+  # Refresh firstmate's own read-only upstream template first, independent of the
+  # project-clone sync below (so it runs even with no clones present). This is the
+  # mutating/network half of the UPSTREAM_DRIFT diagnostic; upstream_drift_report
+  # in the detect section never fetches, keeping that report safe in the
+  # read-only detect-only path.
+  upstream_drift_fetch
+
   [ -x "$FM_ROOT/bin/fm-fleet-sync.sh" ] || return 0
   [ -d "$PROJECTS" ] || return 0
 
@@ -679,6 +793,16 @@ crew_dispatch_validate() {
       | map(select(. as $p | effort_ok($p.h; $p.e) | not))
       | map("\(.h):\(.e)")
       | unique;
+    def bad_ultracode:
+      ([(.rules // [])[]? | use_profiles(.use?)[]? | select(has("ultracode")) | .ultracode]
+        | map(select(type != "boolean"))
+        | map(tojson)
+        | unique);
+    def bad_ultracode_role:
+      ([(.rules // [])[]? | use_profiles(.use?)[]? | select(has("ultracode_role")) | .ultracode_role]
+        | map(select((type != "string") or (length == 0)))
+        | map(tojson)
+        | unique);
     if type != "object" then "top-level value must be an object"
     elif has("rules") and (.rules | type) != "array" then "rules must be an array"
     elif [(.rules // [])[]? | select(type != "object")] | length > 0 then "each rule must be an object"
@@ -699,6 +823,8 @@ crew_dispatch_validate() {
         | unique) as $bad_harnesses
       | if ($bad_harnesses | length) > 0 then "unverified harness: " + ($bad_harnesses | join(", "))
         elif (bad_efforts | length) > 0 then "invalid effort: " + (bad_efforts | join(", "))
+        elif (bad_ultracode | length) > 0 then "ultracode must be a boolean: " + (bad_ultracode | join(", "))
+        elif (bad_ultracode_role | length) > 0 then "ultracode_role must be a non-empty string: " + (bad_ultracode_role | join(", "))
         else empty
         end
     end
@@ -729,6 +855,73 @@ crew_dispatch_validate() {
   fi
 }
 
+# Detect critical systemd units in the failed state. Reads one unit name per
+# line from config/critical-services (blank lines and full-line # comments
+# ignored) and prints one SERVICE_FAILED line per failed unit. Pure read-only
+# detection via systemctl is-failed (no root); absent config file, no systemctl,
+# or no failed unit all print nothing.
+critical_services_check() {
+  local file unit ts
+  file="$CONFIG/critical-services"
+  [ -f "$file" ] || return 0
+  command -v systemctl >/dev/null 2>&1 || return 0
+  while IFS= read -r unit || [ -n "$unit" ]; do
+    unit="${unit#"${unit%%[![:space:]]*}"}"
+    unit="${unit%"${unit##*[![:space:]]}"}"
+    [ -n "$unit" ] || continue
+    case "$unit" in '#'*) continue ;; esac
+    if systemctl is-failed --quiet "$unit" >/dev/null 2>&1; then
+      ts=$(systemctl show "$unit" --property=StateChangeTimestamp --value 2>/dev/null || true)
+      if [ -n "$ts" ]; then
+        echo "SERVICE_FAILED: $unit - failed since $ts"
+      else
+        echo "SERVICE_FAILED: $unit - in failed state"
+      fi
+    fi
+  done < "$file"
+}
+
+# Detect autodeploy-log failures. Reads one status-log path per line from
+# config/autodeploy-logs (blank lines and full-line # comments ignored, same
+# parsing as critical_services_check above) and prints one AUTODEPLOY_FAILED
+# line per log whose last line reports failure. The failure predicate and
+# fail-quiet-on-unreadable behavior are owned by fm-autodeploy-lib.sh's
+# fm_autodeploy_line_failed, the same definition bin/fm-watch.sh's periodic
+# autodeploy_scan uses; this is that sweep's session-start counterpart, for
+# whenever no watcher is armed to catch a failure between sessions. Pure
+# read-only detection: no state writes, no queued signals.
+#
+# When config/autodeploy-logs names at least one log but no read-timeout
+# mechanism is on PATH, fm_autodeploy_read_last_line would return 1 for every
+# call and the whole feature would silently never alert; print a one-time
+# AUTODEPLOY_INERT diagnostic instead of the usual per-log AUTODEPLOY_FAILED
+# checks so the captain learns the feature is disabled instead of assuming a
+# healthy deploy. A missing or transiently unreadable log stays fail-quiet -
+# that is a different, transient condition, not a permanent feature-disable.
+autodeploy_logs_check() {
+  local file log last label
+  file="$CONFIG/autodeploy-logs"
+  [ -f "$file" ] || return 0
+  if ! fm_autodeploy_read_timeout_available; then
+    if grep -Eq '^[[:space:]]*[^#[:space:]]' "$file"; then
+      echo "AUTODEPLOY_INERT: config/autodeploy-logs is set but no timeout mechanism (timeout, gtimeout, or perl) is on PATH; autodeploy-alert checks cannot run"
+    fi
+    return 0
+  fi
+  while IFS= read -r log || [ -n "$log" ]; do
+    log="${log#"${log%%[![:space:]]*}"}"
+    log="${log%"${log##*[![:space:]]}"}"
+    [ -n "$log" ] || continue
+    case "$log" in '#'*) continue ;; esac
+    last=$(fm_autodeploy_read_last_line "$log") || continue
+    [ -n "$last" ] || continue
+    if fm_autodeploy_line_failed "$last"; then
+      label=$(basename "$(dirname "$log")")
+      echo "AUTODEPLOY_FAILED: $label - $last"
+    fi
+  done < "$file"
+}
+
 if [ "${1:-}" = "install" ]; then
   shift
   [ $# -gt 0 ] || { echo "usage: fm-bootstrap.sh install <tool>..." >&2; exit 1; }
@@ -799,6 +992,9 @@ if [ "${FM_BOOTSTRAP_VERBOSE_FACTS:-0}" = 1 ] \
   && ! fm_backlog_backend_manual "$CONFIG" && fm_tasks_axi_compatible; then
   echo "BOOTSTRAP_INFO: tasks-axi available"
 fi
+critical_services_check
+autodeploy_logs_check
+upstream_drift_report
 if [ "${FM_BOOTSTRAP_DETECT_ONLY:-0}" != 1 ]; then
   secondmate_sync
   secondmate_liveness_sweep
diff --git a/bin/fm-brief.sh b/bin/fm-brief.sh
index a1b9cb540..e9145b062 100755
--- a/bin/fm-brief.sh
+++ b/bin/fm-brief.sh
@@ -6,7 +6,7 @@
 # description, acceptance criteria, and context, and may adjust other sections
 # when the task genuinely deviates (e.g. working an existing external PR instead
 # of shipping a new one).
-# Usage: fm-brief.sh <task-id> <repo-name> [--scout] [--herdr-lab]
+# Usage: fm-brief.sh <task-id> <repo-name> [--scout] [--herdr-lab] [--light-verify]
 #        fm-brief.sh <task-id> --secondmate {<project>...|--no-projects}
 #   --scout writes the scout contract instead: the deliverable is a report at
 #   data/<task-id>/report.md (no branch, no push, no PR) and the worktree is scratch.
@@ -26,6 +26,13 @@
 #   The flag must be explicit because {TASK} is filled after scaffolding and the
 #   caller-supplied repo string cannot reliably identify this repo. Briefs made
 #   without it carry a loud declaration so an omitted contract cannot be silent.
+#   --light-verify marks a ship or scout brief for the Light verification tier
+#   (see AGENTS.md section 7 and the verify-trivial skill): firstmate decides to
+#   pass this when the task is dispatched at the trivial (haiku/low) tier. It
+#   points the crewmate at verify-trivial instead of the default full
+#   verification workflow and, for a no-mistakes-mode ship task, notes that
+#   firstmate's validation trigger will skip the document step. Rejected for
+#   --secondmate briefs, which are never tier-dispatched.
 # For ship tasks, the definition of done is shaped by the project's delivery mode
 # (data/projects.md via fm-project-mode.sh; see the project-management skill
 # and AGENTS.md task lifecycle):
@@ -34,6 +41,9 @@
 #   local-only   implement on branch, stop and report "ready in branch" (no push/PR);
 #                captain approves, firstmate merges to local main
 # Ship briefs begin with a worktree-isolation assertion before the branch step.
+# Both ship and scout briefs include a docker-compose isolation note telling the
+# crewmate to read .treehouse-compose-project and pass it on every docker
+# compose invocation (docs/configuration.md "Docker Compose project isolation").
 # Scout tasks ignore mode - their deliverable is a report, not a merge.
 # Every scaffold's status protocol distinguishes the configured
 # declared-external-wait verb (FM_CLASSIFY_PAUSED_VERB, default "paused") from
@@ -73,6 +83,7 @@ STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 KIND=ship
 HERDR_LAB=0
 NO_PROJECTS=0
+LIGHT_VERIFY=0
 POS=()
 for a in "$@"; do
   case "$a" in
@@ -80,6 +91,7 @@ for a in "$@"; do
     --secondmate) KIND=secondmate ;;
     --herdr-lab) HERDR_LAB=1 ;;
     --no-projects) NO_PROJECTS=1 ;;
+    --light-verify) LIGHT_VERIFY=1 ;;
     *) POS+=("$a") ;;
   esac
 done
@@ -90,6 +102,11 @@ if [ "$KIND" = secondmate ] && [ "$HERDR_LAB" -eq 1 ]; then
   exit 1
 fi
 
+if [ "$KIND" = secondmate ] && [ "$LIGHT_VERIFY" -eq 1 ]; then
+  echo "error: --light-verify applies only to crewmate ship or scout briefs" >&2
+  exit 1
+fi
+
 if [ "$NO_PROJECTS" -eq 1 ] && [ "$KIND" != secondmate ]; then
   echo "error: --no-projects applies only to --secondmate charters" >&2
   exit 1
@@ -221,6 +238,20 @@ EOF
 )
 fi
 
+if [ "$LIGHT_VERIFY" -eq 1 ]; then
+VERIFY_TRIVIAL_PATH=$(shell_quote "$FM_ROOT/.agents/skills/verify-trivial/SKILL.md")
+# shellcheck disable=SC2016  # single quotes are deliberate: this is literal brief text whose backtick-wrapped names must reach the reading agent verbatim, not expand at scaffold time; only the '"$VAR"' break-outs interpolate.
+VERIFY_TIER_SECTION=$(printf '%s\n' \
+'# Verification tier: Light' \
+'This brief was scaffolded with `--light-verify`: read '"$VERIFY_TRIVIAL_PATH"' for the acceptance-criteria cap, the escalate-not-fail cap-out, and the mandatory side-effect confidence gate that apply to this task instead of the default full verification workflow.' \
+'That file itself points to `verify-rigorously` (load it normally) for the AC bar, verification shapes, pass/fail matrix, and "what wasn'\''t verified" footer this tier still applies in full.')
+VERIFY_TIER_BLOCK=$'\n'"$VERIFY_TIER_SECTION"$'\n'
+LIGHT_VERIFY_DOD_NOTE=$'\n'"This task runs the Light verification tier (see the Verification tier section above): when firstmate sends the validation trigger for this task, it skips the document step, since the side-effect confidence gate already covers what that step would check at this scale."
+else
+VERIFY_TIER_BLOCK=""
+LIGHT_VERIFY_DOD_NOTE=""
+fi
+
 if [ "$KIND" = scout ]; then
 cat > "$BRIEF" <<EOF
 You are a crewmate: an autonomous worker agent managed by firstmate. Work on your own; do not wait for a human.
@@ -229,13 +260,19 @@ You are a crewmate: an autonomous worker agent managed by firstmate. Work on you
 {TASK}
 
 $HERDR_SECTION
-
+$VERIFY_TIER_BLOCK
 # Setup
 You are in a disposable git worktree of $REPO, at a detached HEAD on a clean default branch.
 This is a SCOUT task: the deliverable is a written report, not a PR.
 The worktree is your laboratory - install, run, edit, and make scratch commits freely; all of it is discarded at teardown.
 The report is the only thing that survives, so anything worth keeping must be in it.
 
+This worktree also carries a docker-compose isolation marker at \`.treehouse-compose-project\` in the worktree root.
+If this task starts docker or docker-compose, read that file and pass its contents explicitly on every \`docker compose\` invocation, e.g. \`docker compose -p "\$(cat .treehouse-compose-project)" up -d\`.
+Exported env vars do not reliably persist between separate tool-call invocations, so if you use \`export COMPOSE_PROJECT_NAME=\$(cat .treehouse-compose-project)\` instead, restate it at the start of every docker-related shell command rather than exporting once and assuming it sticks.
+Without this, Compose's default project-naming (derived from the worktree's directory basename) collides with every other worktree of this same project, and both fight over the same container/volume/network names.
+A second, related collision vector is fixed host ports: prefer not publishing a hard-coded host port and query the assigned one with \`docker compose port <service> <container-port>\`, or otherwise pick a deterministic per-worktree-derived port, since two isolated stacks can still fight over a shared host port even with different project names.
+
 # Rules
 1. Never push to any remote and never open a PR.
 2. Stay inside this worktree; the only files you may write outside it are the report and the status file below.
@@ -321,6 +358,7 @@ Two firstmate-specific rules layer on top of that guidance:
 - Avoid \`--yes\`: the captain, not you, owns the ask-user decisions it would silently auto-resolve.
 
 After /no-mistakes reports CI green (the CI-ready return point - do not wait for it to keep monitoring in the background until merge), append \`done: PR {url} checks green\` and stop. You are finished.
+$LIGHT_VERIFY_DOD_NOTE
 EOF
 )
     ;;
@@ -333,7 +371,7 @@ You are a crewmate: an autonomous worker agent managed by firstmate. Work on you
 {TASK}
 
 $HERDR_SECTION
-
+$VERIFY_TIER_BLOCK
 # Setup
 You are in a disposable git worktree of $REPO, at a detached HEAD on a clean default branch.
 
@@ -341,6 +379,12 @@ You are in a disposable git worktree of $REPO, at a detached HEAD on a clean def
 The path check is authoritative: \`git rev-parse --git-dir\` and \`git rev-parse --git-common-dir\` can help inspect the repo, but they do not prove you are outside the primary checkout.
 If the top-level path is the primary checkout or not the worktree you were launched in, STOP - do not branch or commit here - append \`blocked: launched in primary checkout, not an isolated worktree\` to the status file and stop.
 
+This worktree also carries a docker-compose isolation marker at \`.treehouse-compose-project\` in the worktree root.
+If this task starts docker or docker-compose, read that file and pass its contents explicitly on every \`docker compose\` invocation, e.g. \`docker compose -p "\$(cat .treehouse-compose-project)" up -d\`.
+Exported env vars do not reliably persist between separate tool-call invocations, so if you use \`export COMPOSE_PROJECT_NAME=\$(cat .treehouse-compose-project)\` instead, restate it at the start of every docker-related shell command rather than exporting once and assuming it sticks.
+Without this, Compose's default project-naming (derived from the worktree's directory basename) collides with every other worktree of this same project, and both fight over the same container/volume/network names.
+A second, related collision vector is fixed host ports: prefer not publishing a hard-coded host port and query the assigned one with \`docker compose port <service> <container-port>\`, or otherwise pick a deterministic per-worktree-derived port, since two isolated stacks can still fight over a shared host port even with different project names.
+
 1. First action: create your branch: \`git checkout -b fm/$ID\`$SETUP2
 
 # Rules
diff --git a/bin/fm-classify-lib.sh b/bin/fm-classify-lib.sh
index db39f4c8a..713c7ac65 100755
--- a/bin/fm-classify-lib.sh
+++ b/bin/fm-classify-lib.sh
@@ -273,6 +273,72 @@ signal_reason_is_actionable() {  # <file> ...
   return 1
 }
 
+# Hard-timeout mechanism shared by fm-crew-state.sh's own no-mistakes bound and
+# the outer crew-state-read bound below. Detected once at source time. Plain
+# `timeout N cmd` (no -k/--kill-after) is only ADVISORY once N elapses: it sends
+# the initial signal but never force-kills a command that ignores or is stuck
+# past it - e.g. a CLI blocked on a slow/queued daemon RPC under concurrent
+# validation load, the exact failure mode behind the 2026-07-09 89-minute
+# watcher stall (crew_is_provably_working -> fm-crew-state.sh -> `no-mistakes
+# axi status` never returned, so the watcher's poll loop, and therefore its
+# liveness beacon touch, never came back around). The perl fallback (no
+# timeout/gtimeout on PATH) already force-kills a whole process group, so it
+# needs no separate -k equivalent, just the same kill-after grace parameter.
+_FM_HARD_TIMEOUT_BIN=none
+if command -v timeout >/dev/null 2>&1; then _FM_HARD_TIMEOUT_BIN=timeout
+elif command -v gtimeout >/dev/null 2>&1; then _FM_HARD_TIMEOUT_BIN=gtimeout
+elif command -v perl >/dev/null 2>&1; then _FM_HARD_TIMEOUT_BIN=perl
+fi
+
+# fm_sanitize_timeout_bound <value> <default>
+# Validates a positive-integer fm_hard_timeout bound, falling back to
+# <default> for anything empty, non-numeric, or all-zero digits ("0", "00",
+# "000", ...) - GNU `timeout` treats ANY all-zero duration spelling as "no
+# timeout" (`timeout -k 1 00 sleep 5` runs the full 5s, identical to a literal
+# 0), which would silently defeat the hard-timeout guarantee every caller of
+# this sanitizer relies on.
+fm_sanitize_timeout_bound() {
+  local v=$1 default=$2
+  case "$v" in
+    ''|*[!0-9]*) v=$default ;;
+    *[1-9]*) ;;
+    *) v=$default ;;
+  esac
+  printf '%s' "$v"
+}
+
+# fm_hard_timeout <secs> <kill-after-secs> <cmd> [args...]
+# Runs <cmd> bounded to <secs>, GUARANTEEING it is gone by <secs>+<kill-after-secs>:
+# still alive that long after the initial signal means a SIGKILL, not just another
+# SIGTERM. Prints <cmd>'s stdout. Exit reflects <cmd>'s own code, or the forced-kill
+# wrapper's own (124) when it had to intervene. With no bounding tool on PATH at
+# all, refuses outright (124) rather than risk an unbounded call.
+fm_hard_timeout() {
+  local secs=$1 kill_after=$2
+  shift 2
+  case "$_FM_HARD_TIMEOUT_BIN" in
+    timeout)  timeout -k "$kill_after" "$secs" "$@" ;;
+    gtimeout) gtimeout -k "$kill_after" "$secs" "$@" ;;
+    perl)
+      # shellcheck disable=SC2016  # single quotes are deliberate: Perl expands its own variables.
+      perl -e 'my ($t, $k) = (shift, shift); my $pid = fork; die "fork failed" unless defined $pid; if (!$pid) { setpgrp(0, 0); exec @ARGV } local $SIG{ALRM} = sub { kill "TERM", -$pid; select undef, undef, undef, $k; kill "KILL", -$pid; exit 124 }; alarm $t; waitpid $pid, 0; exit($? >> 8)' "$secs" "$kill_after" "$@"
+      ;;
+    *) return 124 ;;
+  esac
+}
+
+# Outer bound wrapping the ENTIRE fm-crew-state.sh read below - defense in depth
+# alongside that script's OWN internal per-call no-mistakes bound
+# (FM_CREW_STATE_NM_TIMEOUT/FM_CREW_STATE_NM_KILL_AFTER). fm-crew-state.sh can
+# make several sequential no-mistakes calls in one read (axi status, the
+# cross-branch runs fallback, a ci log tail), so this stays comfortably above
+# their worst-case legitimate total, while still guaranteeing the watcher's own
+# poll loop - and therefore its liveness beacon - can never block on this read
+# past a fixed ceiling, even if some future call site inside fm-crew-state.sh
+# forgets to route a no-mistakes call through its own bound.
+FM_CREW_ABSORB_TIMEOUT=$(fm_sanitize_timeout_bound "${FM_CREW_ABSORB_TIMEOUT:-45}" 45)
+FM_CREW_ABSORB_KILL_AFTER=$(fm_sanitize_timeout_bound "${FM_CREW_ABSORB_KILL_AFTER:-5}" 5)
+
 # Classify WHY an idle/stale crew MIGHT be safely absorbed instead of surfaced,
 # from bin/fm-crew-state.sh's one authoritative current-state line
 # ("state: <s> · source: <src> · <detail>"). Prints exactly one token:
@@ -282,7 +348,10 @@ signal_reason_is_actionable() {  # <file> ...
 #   paused  - the crew's authoritative current state is a declared external-wait
 #             pause (paused:), which is EXPECTED to idle;
 #   none    - neither, so the wake must surface (a stopped/finished/parked/failed/
-#             torn-down/unknown crew, or an unreadable verdict).
+#             torn-down/unknown crew, or an unreadable verdict) - INCLUDING a
+#             fm-crew-state.sh read that hit the hard timeout above: a timed-out
+#             read must never read as working, or a genuinely wedged crew behind
+#             a hung no-mistakes call would be absorbed instead of surfaced.
 # One fm-crew-state.sh read serves BOTH absorb reasons at once. Reading the state
 # authoritatively (not the status log) is what keeps run-step precedence: a crew
 # that appended paused: but then STARTED a run reports working, never paused.
@@ -292,7 +361,7 @@ signal_reason_is_actionable() {  # <file> ...
 crew_absorb_class() {  # <id>
   local id=$1 line state src
   [ -n "$id" ] || { printf 'none'; return; }
-  line=$("$FM_CREW_STATE_BIN" "$id" 2>/dev/null) || true
+  line=$(fm_hard_timeout "$FM_CREW_ABSORB_TIMEOUT" "$FM_CREW_ABSORB_KILL_AFTER" "$FM_CREW_STATE_BIN" "$id" 2>/dev/null) || true
   case "$line" in state:*) ;; *) printf 'none'; return ;; esac
   state=${line#state: }; state=${state%% *}
   if [ "$state" = paused ]; then printf 'paused'; return; fi
diff --git a/bin/fm-composer-lib.sh b/bin/fm-composer-lib.sh
index 437b8c689..75e563584 100644
--- a/bin/fm-composer-lib.sh
+++ b/bin/fm-composer-lib.sh
@@ -179,9 +179,39 @@ fm_composer_idle_matches() {
   esac
 }
 
+# No-break space characters a TUI uses to pad its composer so the terminal will
+# not collapse or wrap the padding. Captured live (task fm-composer-nbsp): claude
+# draws its cleared prompt as the glyph "❯" followed by U+00A0, not an ASCII
+# space. glibc's UTF-8 [:space:] does NOT classify these as whitespace, so without
+# normalizing them an otherwise-empty composer keeps a phantom no-break space and
+# misreads as `pending` - the false "Enter swallowed" fm-send's submit loop
+# reported against a genuinely-submitted steer. Built as literal UTF-8 bytes so
+# the substitution stays bash-3.2 safe and locale-independent, the same convention
+# as the border strip in fm-tmux-lib.sh.
+FM_COMPOSER_NBSP=$(printf '\302\240')       # U+00A0 NO-BREAK SPACE (claude padding)
+FM_COMPOSER_NNBSP=$(printf '\342\200\257')  # U+202F NARROW NO-BREAK SPACE (sibling)
+
+# fm_composer_normalize_ws: map the no-break spaces above to an ASCII space and
+# trim surrounding ASCII whitespace, writing the result into the caller's named
+# variable. A no-break space between real words becomes an ordinary separator, so
+# genuine typed text is preserved (and still classifies pending); a composer empty
+# but for no-break padding trims to empty. Idempotent for ASCII-only content.
+fm_composer_normalize_ws() {  # <string> <out-var-name>
+  local s=$1
+  s=${s//"$FM_COMPOSER_NBSP"/ }
+  s=${s//"$FM_COMPOSER_NNBSP"/ }
+  s="${s#"${s%%[![:space:]]*}"}"
+  s="${s%"${s##*[![:space:]]}"}"
+  printf -v "$2" '%s' "$s"
+}
+
 fm_composer_classify_content() {  # <bordered> <content> [idle_re] [idle_case] [plain_content]
   local bordered=$1 content=$2 idle_re=${3:-} idle_case=${4:-sensitive} plain_content
   plain_content=${5:-$content}
+  # A composer padded with a no-break space (claude's cleared prompt) is empty
+  # but ASCII whitespace trimming cannot see it; normalize before classifying.
+  fm_composer_normalize_ws "$content" content
+  fm_composer_normalize_ws "$plain_content" plain_content
   if [ "$bordered" != 1 ] && [ -z "$content" ] && [ -n "$plain_content" ]; then
     case "$plain_content" in
       '❯'|'›') printf 'empty'; return 0 ;;
diff --git a/bin/fm-crew-state.sh b/bin/fm-crew-state.sh
index 0ffdc1034..a4adf05ba 100755
--- a/bin/fm-crew-state.sh
+++ b/bin/fm-crew-state.sh
@@ -61,8 +61,7 @@ ID=${1:-}
 
 META="$STATE/$ID.meta"
 LOG="$STATE/$ID.status"
-NM_TIMEOUT=${FM_CREW_STATE_NM_TIMEOUT:-10}
-case "$NM_TIMEOUT" in ''|*[!0-9]*) NM_TIMEOUT=10 ;; esac
+NM_TIMEOUT=$(fm_sanitize_timeout_bound "${FM_CREW_STATE_NM_TIMEOUT:-10}" 10)
 # How many of the most recent `no-mistakes runs` rows the cross-branch fallback
 # (nm_runs_status_for_branch, below) scans. Generous enough to still find a
 # branch's own run on a busy multi-crew fleet without listing the entire
@@ -201,18 +200,15 @@ strip_quotes() {
 }
 
 # Bounded no-mistakes call in the worktree; stdout only, never fails the script.
-HAVE_TIMEOUT=none
-if command -v timeout >/dev/null 2>&1; then HAVE_TIMEOUT=timeout
-elif command -v gtimeout >/dev/null 2>&1; then HAVE_TIMEOUT=gtimeout
-elif command -v perl >/dev/null 2>&1; then HAVE_TIMEOUT=perl
-fi
+# fm_hard_timeout (bin/fm-classify-lib.sh, sourced above) guarantees this call is
+# gone by NM_TIMEOUT+NM_KILL_AFTER seconds even if `no-mistakes` ignores or is
+# stuck past the initial signal (a hung daemon RPC under concurrent validation
+# load) - a plain `timeout N cmd` with no kill-after is only advisory once N
+# elapses, and defeating that soft bound was the root cause of the 2026-07-09
+# 89-minute watcher stall.
+NM_KILL_AFTER=$(fm_sanitize_timeout_bound "${FM_CREW_STATE_NM_KILL_AFTER:-2}" 2)
 nm_run() {  # <args...>
-  case "$HAVE_TIMEOUT" in
-    timeout)  ( cd "$WT" && timeout "$NM_TIMEOUT" no-mistakes "$@" ) 2>/dev/null || true ;;
-    gtimeout) ( cd "$WT" && gtimeout "$NM_TIMEOUT" no-mistakes "$@" ) 2>/dev/null || true ;;
-    perl)     ( cd "$WT" && perl -e 'my $t = shift; my $pid = fork; die "fork failed" unless defined $pid; if (!$pid) { setpgrp(0, 0); exec @ARGV } local $SIG{ALRM} = sub { kill "TERM", -$pid; select undef, undef, undef, 0.2; kill "KILL", -$pid; exit 124 }; alarm $t; waitpid $pid, 0; exit($? >> 8)' "$NM_TIMEOUT" no-mistakes "$@" ) 2>/dev/null || true ;;
-    *)        true ;;
-  esac
+  ( cd "$WT" && fm_hard_timeout "$NM_TIMEOUT" "$NM_KILL_AFTER" no-mistakes "$@" ) 2>/dev/null || true
 }
 
 # Scalar value of a TOON key in the captured run output ($RUN_OUT).
diff --git a/bin/fm-decision-hold.sh b/bin/fm-decision-hold.sh
index aeb140a29..57a5aeaa7 100755
--- a/bin/fm-decision-hold.sh
+++ b/bin/fm-decision-hold.sh
@@ -343,10 +343,10 @@ command_verify() {
   validate_slug origin-id "$origin"
   meta="$STATE/$origin.meta"
   [ -f "$meta" ] || fail "origin metadata is absent: $meta"
-  require_tasks_axi
   reviewed=$(meta_value "$meta" decisions_reviewed)
   [ "$reviewed" = 1 ] || fail "origin $origin has no completed unresolved-decision inventory"
   keys=$(meta_value "$meta" decision_keys)
+  [ -n "$keys" ] && require_tasks_axi
   if [ -n "$keys" ]; then
     while IFS= read -r key; do
       [ -n "$key" ] || continue
diff --git a/bin/fm-dispatch-select.sh b/bin/fm-dispatch-select.sh
index c626e9a95..894a33c43 100755
--- a/bin/fm-dispatch-select.sh
+++ b/bin/fm-dispatch-select.sh
@@ -7,6 +7,13 @@
 # profile object, or an ordered array of profile objects.
 # Output is one compact JSON profile object on stdout.
 #
+# A profile's `ultracode` must be a JSON boolean and `ultracode_role` a
+# non-empty string (docs/configuration.md "Crew dispatch profiles"); a
+# present-but-wrong-type value exits 2 with an explanation instead of being
+# silently dropped from the resolved profile, since a rule that looks
+# ultracode-flagged but resolves as inert would skip the mandatory
+# independent-review guard (bin/fm-ultracode-guard.sh) without anyone noticing.
+#
 # quota-balanced is deterministic, and this header is the single owner of its
 # contract:
 #   - It runs quota-axi --json (or the --quota-json fixture).
@@ -110,12 +117,24 @@ profiles_json=$(printf '%s\n' "$SPEC_JSON" | jq -ec '
 profile_count=$(printf '%s\n' "$profiles_json" | jq 'length')
 [ "$profile_count" -gt 0 ] || { echo "error: dispatch profile array must not be empty" >&2; exit 2; }
 
+bad_ultracode=$(printf '%s\n' "$profiles_json" | jq -r '
+  [.[] | select(has("ultracode")) | .ultracode | select(type != "boolean") | tojson] | unique | join(", ")
+')
+[ -z "$bad_ultracode" ] || { echo "error: ultracode must be a boolean, got: $bad_ultracode" >&2; exit 2; }
+
+bad_ultracode_role=$(printf '%s\n' "$profiles_json" | jq -r '
+  [.[] | select(has("ultracode_role")) | .ultracode_role | select((type != "string") or (length == 0)) | tojson] | unique | join(", ")
+')
+[ -z "$bad_ultracode_role" ] || { echo "error: ultracode_role must be a non-empty string, got: $bad_ultracode_role" >&2; exit 2; }
+
 first_profile() {
   printf '%s\n' "$profiles_json" | jq -c '
     def clean($p):
       {harness: $p.harness}
       + (if ($p.model? | type) == "string" then {model: $p.model} else {} end)
-      + (if ($p.effort? | type) == "string" then {effort: $p.effort} else {} end);
+      + (if ($p.effort? | type) == "string" then {effort: $p.effort} else {} end)
+      + (if ($p.ultracode? | type) == "boolean" then {ultracode: $p.ultracode} else {} end)
+      + (if ($p.ultracode_role? | type) == "string" then {ultracode_role: $p.ultracode_role} else {} end);
     clean(.[0])
   '
 }
@@ -169,7 +188,9 @@ selection=$(printf '%s\n' "$quota_json" | jq -ec \
   def clean($p):
     {harness: $p.harness}
     + (if ($p.model? | type) == "string" then {model: $p.model} else {} end)
-    + (if ($p.effort? | type) == "string" then {effort: $p.effort} else {} end);
+    + (if ($p.effort? | type) == "string" then {effort: $p.effort} else {} end)
+    + (if ($p.ultracode? | type) == "boolean" then {ultracode: $p.ultracode} else {} end)
+    + (if ($p.ultracode_role? | type) == "string" then {ultracode_role: $p.ultracode_role} else {} end);
   def provider_for($h): [.providers[]? | select(.provider == $h)][0];
   def general_ids($h):
     if $h == "claude" then ["five_hour", "seven_day"]
diff --git a/bin/fm-fleet-sync.sh b/bin/fm-fleet-sync.sh
index 5c338edf6..0b3c9388f 100755
--- a/bin/fm-fleet-sync.sh
+++ b/bin/fm-fleet-sync.sh
@@ -162,8 +162,15 @@ packed_refs_lock_path() {
 fetch_with_packed_refs_lock_guard() {
   local rc attempt=0 lock lock_desc
   FETCH_OUTPUT=$(git -C "$PROJ" fetch origin --prune --quiet 2>&1); rc=$?
-  [ "$rc" -eq 0 ] && return 0
-  is_packed_refs_lock_error "$FETCH_OUTPUT" || return "$rc"
+  # Git treats a failed ref-prune (blocked by the lock) as non-fatal when the
+  # fetch itself otherwise succeeds, so rc alone cannot prove the lock is gone -
+  # the output must be checked for the signature even when rc is 0.
+  if [ "$rc" -eq 0 ] && ! is_packed_refs_lock_error "$FETCH_OUTPUT"; then
+    return 0
+  fi
+  if [ "$rc" -ne 0 ]; then
+    is_packed_refs_lock_error "$FETCH_OUTPUT" || return "$rc"
+  fi
 
   lock=$(packed_refs_lock_path) || lock=""
   lock_desc=${lock:-packed-refs.lock}
@@ -172,14 +179,16 @@ fetch_with_packed_refs_lock_guard() {
     echo "$label: fetch blocked by packed-refs lock ($lock_desc); waiting ${FLEET_SYNC_PACKED_REFS_LOCK_RETRY_WAIT_SECS}s and retrying ($attempt/${FLEET_SYNC_PACKED_REFS_LOCK_RETRIES}) (owning process may be exiting)" >&2
     sleep "$FLEET_SYNC_PACKED_REFS_LOCK_RETRY_WAIT_SECS"
     FETCH_OUTPUT=$(git -C "$PROJ" fetch origin --prune --quiet 2>&1); rc=$?
-    if [ "$rc" -eq 0 ]; then
+    if [ "$rc" -eq 0 ] && ! is_packed_refs_lock_error "$FETCH_OUTPUT"; then
       echo "$label: fetch succeeded on retry; packed-refs lock cleared on its own" >&2
       # One stdout summary so a session-start refresh (which discards fleet-sync
       # stderr and relays only stdout) still surfaces the recovery.
       echo "$label: recovered: packed-refs lock cleared on its own during retry"
       return 0
     fi
-    is_packed_refs_lock_error "$FETCH_OUTPUT" || return "$rc"
+    if [ "$rc" -ne 0 ]; then
+      is_packed_refs_lock_error "$FETCH_OUTPUT" || return "$rc"
+    fi
   done
 
   # Retries exhausted and still the lock signature. Clear ONLY if provably stale.
@@ -192,22 +201,22 @@ fetch_with_packed_refs_lock_guard() {
     if fm_lock_is_provably_stale "$lock" "$PROJ" "$FLEET_SYNC_PACKED_REFS_LOCK_AGE_SECS"; then
       if ! rm -f "$lock"; then
         echo "$label: failed to remove provably-stale packed-refs lock $lock; leaving it in place" >&2
-        return "$rc"
+        return 1
       fi
       echo "$label: removed provably-stale packed-refs lock $lock (age >= ${FLEET_SYNC_PACKED_REFS_LOCK_AGE_SECS}s, no live holder) and retrying fetch" >&2
       FETCH_OUTPUT=$(git -C "$PROJ" fetch origin --prune --quiet 2>&1); rc=$?
-      if [ "$rc" -eq 0 ]; then
+      if [ "$rc" -eq 0 ] && ! is_packed_refs_lock_error "$FETCH_OUTPUT"; then
         echo "$label: fetch succeeded after stale packed-refs lock cleanup" >&2
         echo "$label: recovered: removed a stale packed-refs lock (no live holder)"
         return 0
       fi
-      return "$rc"
+      return 1
     fi
     echo "$label: fetch blocked by packed-refs lock $lock that persisted across ${FLEET_SYNC_PACKED_REFS_LOCK_RETRIES} retries and is not provably stale (may belong to a live process); leaving it in place" >&2
-    return "$rc"
+    return 1
   fi
   echo "$label: fetch packed-refs lock signature persisted across ${FLEET_SYNC_PACKED_REFS_LOCK_RETRIES} retries even after the lock file disappeared" >&2
-  return "$rc"
+  return 1
 }
 
 prune_gone_branches() {
diff --git a/bin/fm-merge-local.sh b/bin/fm-merge-local.sh
index fdc801148..bff5b98f9 100755
--- a/bin/fm-merge-local.sh
+++ b/bin/fm-merge-local.sh
@@ -9,7 +9,21 @@
 # auto-approves), and only as a clean fast-forward - it refuses a diverged branch
 # and tells you to have the crewmate rebase. See AGENTS.md prime directives,
 # project management, and task lifecycle.
-# Usage: fm-merge-local.sh <task-id>
+#
+# After the fast-forward, the project's origin is pushed only when the project
+# IS firstmate's own repo (PROJ resolves to the same real path as FM_ROOT) - that
+# is the deliberate fork-sync case (AGENTS.md prime directives; section 12's
+# self-update model), where origin is the captain's own fork and keeping its
+# default branch in sync is intended. A local-only PROJECT's contract is "no
+# remote, no PR" (AGENTS.md section 6); auto-pushing an arbitrary local-only
+# project's origin would silently break that promise, so every other project
+# needs the explicit --push-origin flag to opt in.
+#
+# Usage: fm-merge-local.sh <task-id> [--push-origin]
+#   --push-origin  push the fast-forwarded default branch to origin even when
+#                  PROJ is not firstmate's own repo. Only pass this on the
+#                  captain's explicit request for that project; firstmate's own
+#                  repo pushes automatically without it.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -17,7 +31,12 @@ FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
 FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 "$FM_ROOT/bin/fm-guard.sh" || true
-ID=${1:?usage: fm-merge-local.sh <task-id>}
+ID=${1:?usage: fm-merge-local.sh <task-id> [--push-origin]}
+PUSH_ORIGIN_OPT=${2:-}
+case "$PUSH_ORIGIN_OPT" in
+  ''|--push-origin) ;;
+  *) echo "error: unknown argument '$PUSH_ORIGIN_OPT'; usage: fm-merge-local.sh <task-id> [--push-origin]" >&2; exit 1 ;;
+esac
 META="$STATE/$ID.meta"
 [ -f "$META" ] || { echo "error: no meta for task $ID at $META" >&2; exit 1; }
 
@@ -66,3 +85,35 @@ before=$(git -C "$PROJ" rev-parse --short "$DEFAULT")
 git -C "$PROJ" merge --ff-only "$BRANCH" >/dev/null
 after=$(git -C "$PROJ" rev-parse --short "$DEFAULT")
 echo "merged $BRANCH into local $DEFAULT ($before -> $after) in $PROJ"
+
+# Keep a push-backed default branch synced with the merge that just landed, so
+# the remote never silently drifts behind local main - but ONLY when PROJ is
+# firstmate's own repo (the deliberate fork-sync case; see header) or the caller
+# passed --push-origin explicitly. Best-effort by design when it does push: the
+# local fast-forward above is the operation that matters, so a push failure
+# (offline, transient network, or a non-fast-forward rejection) is reported but
+# never fails the merge. A pure local-only project with no origin remote has
+# nowhere to push and is skipped silently - not every local-only project is
+# remote-backed. The push is non-interactive (GIT_TERMINAL_PROMPT=0) and bounded
+# by timeout when available, so a credential prompt or stalled connection never
+# hangs the merge command.
+proj_abs=$(cd "$PROJ" && pwd -P)
+fm_root_abs=$(cd "$FM_ROOT" && pwd -P)
+is_firstmate_repo=0
+[ "$proj_abs" = "$fm_root_abs" ] && is_firstmate_repo=1
+
+if [ "$is_firstmate_repo" -eq 1 ] || [ "$PUSH_ORIGIN_OPT" = "--push-origin" ]; then
+  if git -C "$PROJ" remote get-url origin >/dev/null 2>&1; then
+    pushed=0
+    if command -v timeout >/dev/null 2>&1; then
+      GIT_TERMINAL_PROMPT=0 timeout "${FM_LOCAL_PUSH_TIMEOUT:-20}" git -C "$PROJ" push origin "$DEFAULT" >/dev/null 2>&1 && pushed=1
+    else
+      GIT_TERMINAL_PROMPT=0 git -C "$PROJ" push origin "$DEFAULT" >/dev/null 2>&1 && pushed=1
+    fi
+    if [ "$pushed" = 1 ]; then
+      echo "pushed $DEFAULT to origin in $PROJ"
+    else
+      echo "warning: local $DEFAULT merged, but syncing it to origin failed in $PROJ (best-effort; merge succeeded)" >&2
+    fi
+  fi
+fi
diff --git a/bin/fm-nas-deploy-sync.sh b/bin/fm-nas-deploy-sync.sh
new file mode 100755
index 000000000..1233dc9f7
--- /dev/null
+++ b/bin/fm-nas-deploy-sync.sh
@@ -0,0 +1,316 @@
+#!/usr/bin/env bash
+# Best-effort, non-fatal deploy sync for a single project's live NAS checkout: a
+# merged PR lands in the project's GitHub default branch, but the live app on this
+# host runs from its own separate checkout under /mnt/nas/experiments/<name>/,
+# managed by pm2 - that checkout does not update itself (see the 2026-07-04 entry
+# in data/learnings.md). This script closes that gap after a landed ship task.
+#
+# Looks the project up in data/nas-deployments.md, a pipe-table with one row per
+# deployed project: "| <project> | <nas_repo_path> | <pm2_process(es)> |" (comma-
+# separated when more than one process serves the app). A project absent from
+# that table - or a fresh checkout with no data/nas-deployments.md at all - has no
+# known live deployment, which is not an error: prints one skip line and exits 0.
+#
+# When present: fetches the NAS checkout's origin and fast-forward-only merges to
+# origin/<default>, mirroring bin/fm-fleet-sync.sh's dirty/diverged safety exactly
+# - never force, never discard local changes, never touch a checkout that is off
+# its default branch, dirty, or diverged (reported as STUCK, left untouched).
+# Restarts the recorded pm2 process(es) only when the merge actually advanced
+# HEAD, then verifies each is back online via `pm2 jlist`. Always prints exactly
+# one clear result line and exits 0 - this script is best-effort and must never
+# fail or block its caller (see the post-teardown call in bin/fm-teardown.sh).
+#
+# Usage: fm-nas-deploy-sync.sh <project-name>
+#
+# Overrides (test injection): FM_DATA_OVERRIDE points at an alternate data/ dir
+# (same knob bin/fm-project-mode.sh uses); FM_NAS_DEPLOYMENTS_OVERRIDE points at
+# an alternate mapping file directly. pm2 is invoked via PATH, so a fakebin shim
+# ahead of it on PATH intercepts restart/list during tests - real tests must never
+# reach the real /mnt/nas/experiments or a real pm2 process.
+#
+# Every filesystem/git touch of $NAS_PATH is wrapped in a bounded timeout
+# (FM_NAS_SYNC_TIMEOUT seconds, default 15): the mount is a NAS, and an
+# unreachable one is a hang risk (a stuck stat/read), not a fast failure, which
+# would otherwise stall fm-teardown.sh's caller and break this script's
+# non-blocking contract.
+#
+# $NAS_PATH is one single shared live-deployment checkout - unlike a project's
+# projects/<name> dev clone, which is scoped to one firstmate home, two ship
+# tasks for the same project landing moments apart can both reach the SAME
+# NAS checkout from concurrent teardowns. That races the fetch on an orphaned
+# .git/packed-refs.lock exactly like bin/fm-fleet-sync.sh's fetch had to guard
+# against; fetch_with_packed_refs_lock_guard below mirrors that recovery,
+# sharing the staleness proof from bin/fm-lock-lib.sh, bounded by
+# FM_NAS_SYNC_PACKED_REFS_LOCK_RETRIES / _RETRY_WAIT_SECS / _AGE_SECS.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
+FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+DATA="${FM_DATA_OVERRIDE:-$FM_HOME/data}"
+MAP="${FM_NAS_DEPLOYMENTS_OVERRIDE:-$DATA/nas-deployments.md}"
+NAS_SYNC_TIMEOUT="${FM_NAS_SYNC_TIMEOUT:-15}"
+# shellcheck source=bin/fm-lock-lib.sh
+. "$SCRIPT_DIR/fm-lock-lib.sh"
+FM_LOCK_LOG_PREFIX=nas-deploy-sync
+
+NAS_SYNC_PACKED_REFS_LOCK_RETRIES=${FM_NAS_SYNC_PACKED_REFS_LOCK_RETRIES:-3}
+NAS_SYNC_PACKED_REFS_LOCK_RETRY_WAIT_SECS=${FM_NAS_SYNC_PACKED_REFS_LOCK_RETRY_WAIT_SECS:-1}
+NAS_SYNC_PACKED_REFS_LOCK_AGE_SECS=${FM_NAS_SYNC_PACKED_REFS_LOCK_AGE_SECS:-30}
+case "$NAS_SYNC_PACKED_REFS_LOCK_RETRIES" in ''|*[!0-9]*) NAS_SYNC_PACKED_REFS_LOCK_RETRIES=3 ;; esac
+case "$NAS_SYNC_PACKED_REFS_LOCK_AGE_SECS" in ''|*[!0-9]*) NAS_SYNC_PACKED_REFS_LOCK_AGE_SECS=30 ;; esac
+if ! [[ "$NAS_SYNC_PACKED_REFS_LOCK_RETRY_WAIT_SECS" =~ ^([0-9]+([.][0-9]*)?|[.][0-9]+)$ ]]; then
+  echo "nas-deploy-sync: invalid packed-refs lock retry wait '$NAS_SYNC_PACKED_REFS_LOCK_RETRY_WAIT_SECS'; using 1s" >&2
+  NAS_SYNC_PACKED_REFS_LOCK_RETRY_WAIT_SECS=1
+fi
+
+HAVE_TIMEOUT=none
+if command -v timeout >/dev/null 2>&1; then
+  HAVE_TIMEOUT=timeout
+elif command -v gtimeout >/dev/null 2>&1; then
+  HAVE_TIMEOUT=gtimeout
+fi
+
+# bounded <args...>: run <args...>, killed after $NAS_SYNC_TIMEOUT seconds when
+# a `timeout`/`gtimeout` binary is available, run directly otherwise.
+bounded() {
+  case "$HAVE_TIMEOUT" in
+    timeout) timeout "$NAS_SYNC_TIMEOUT" "$@" ;;
+    gtimeout) gtimeout "$NAS_SYNC_TIMEOUT" "$@" ;;
+    *) "$@" ;;
+  esac
+}
+
+# git_nas <args...>: git -C "$NAS_PATH" <args...>, bounded.
+git_nas() {
+  bounded git -C "$NAS_PATH" "$@"
+}
+
+usage() {
+  echo "usage: fm-nas-deploy-sync.sh <project-name>" >&2
+}
+
+if [ "${1:-}" = "--help" ] || [ "${1:-}" = "-h" ]; then
+  usage
+  exit 0
+fi
+[ $# -eq 1 ] || { usage; exit 1; }
+NAME=$1
+
+first_line() {
+  printf '%s\n' "$1" | sed -n '1s/[[:space:]]\{1,\}/ /g;1p'
+}
+
+# True when git stderr shows the packed-refs.lock "File exists" race, mirroring
+# bin/fm-fleet-sync.sh's is_packed_refs_lock_error.
+is_packed_refs_lock_error() {
+  printf '%s\n' "$1" | grep -Eq "Unable to create ['\"].*packed-refs\\.lock['\"]: File exists"
+}
+
+# Absolute path to $NAS_PATH's packed-refs.lock, or empty when it cannot be
+# resolved.
+packed_refs_lock_path() {
+  local lock abs
+  lock=$(git_nas rev-parse --git-path packed-refs.lock 2>/dev/null) || return 1
+  [ -n "$lock" ] || return 1
+  case "$lock" in
+    /*) printf '%s\n' "$lock" ;;
+    *)
+      abs=$(cd "$NAS_PATH" && pwd -P) || return 1
+      printf '%s/%s\n' "$abs" "$lock"
+      ;;
+  esac
+}
+
+# Run `git_nas fetch origin --quiet`, tolerating an orphaned packed-refs.lock
+# left by a second landed-teardown racing this exact NAS checkout. Sets
+# FETCH_OUTPUT and returns the fetch's exit status; mirrors bin/fm-fleet-sync.sh's
+# fetch_with_packed_refs_lock_guard retry-then-provably-stale-clear contract,
+# sharing the staleness proof from bin/fm-lock-lib.sh.
+fetch_with_packed_refs_lock_guard() {
+  local rc attempt=0 lock lock_desc
+  FETCH_OUTPUT=$(git_nas fetch origin --quiet 2>&1); rc=$?
+  [ "$rc" -eq 0 ] && return 0
+  is_packed_refs_lock_error "$FETCH_OUTPUT" || return "$rc"
+
+  lock=$(packed_refs_lock_path) || lock=""
+  lock_desc=${lock:-packed-refs.lock}
+  while [ "$attempt" -lt "$NAS_SYNC_PACKED_REFS_LOCK_RETRIES" ]; do
+    attempt=$(( attempt + 1 ))
+    echo "$NAME: fetch blocked by packed-refs lock ($lock_desc) at $NAS_PATH; waiting ${NAS_SYNC_PACKED_REFS_LOCK_RETRY_WAIT_SECS}s and retrying ($attempt/${NAS_SYNC_PACKED_REFS_LOCK_RETRIES}) (owning process may be exiting)" >&2
+    sleep "$NAS_SYNC_PACKED_REFS_LOCK_RETRY_WAIT_SECS"
+    FETCH_OUTPUT=$(git_nas fetch origin --quiet 2>&1); rc=$?
+    if [ "$rc" -eq 0 ]; then
+      echo "$NAME: fetch succeeded on retry; packed-refs lock cleared on its own" >&2
+      return 0
+    fi
+    is_packed_refs_lock_error "$FETCH_OUTPUT" || return "$rc"
+  done
+
+  # Retries exhausted and still the lock signature. Clear ONLY if provably stale.
+  lock=$(packed_refs_lock_path) || lock=""
+  if [ -n "$lock" ] && [ -e "$lock" ]; then
+    if fm_lock_is_provably_stale "$lock" "$NAS_PATH" "$NAS_SYNC_PACKED_REFS_LOCK_AGE_SECS"; then
+      if ! rm -f "$lock"; then
+        echo "$NAME: failed to remove provably-stale packed-refs lock $lock; leaving it in place" >&2
+        return "$rc"
+      fi
+      echo "$NAME: removed provably-stale packed-refs lock $lock (age >= ${NAS_SYNC_PACKED_REFS_LOCK_AGE_SECS}s, no live holder) and retrying fetch" >&2
+      FETCH_OUTPUT=$(git_nas fetch origin --quiet 2>&1); rc=$?
+      if [ "$rc" -eq 0 ]; then
+        echo "$NAME: fetch succeeded after stale packed-refs lock cleanup" >&2
+        return 0
+      fi
+      return "$rc"
+    fi
+    echo "$NAME: fetch blocked by packed-refs lock $lock that persisted across ${NAS_SYNC_PACKED_REFS_LOCK_RETRIES} retries and is not provably stale (may belong to a live process); leaving it in place" >&2
+    return "$rc"
+  fi
+  echo "$NAME: fetch packed-refs lock signature persisted across ${NAS_SYNC_PACKED_REFS_LOCK_RETRIES} retries even after the lock file disappeared" >&2
+  return "$rc"
+}
+
+# lookup_row: print "<nas_repo_path>|<pm2_processes>" for $NAME's row in $MAP, or
+# nothing when the file is absent or has no matching row.
+lookup_row() {
+  [ -f "$MAP" ] || return 0
+  # $3 ~ /^\// excludes the header ("nas_repo_path") and separator ("---") rows -
+  # a real NAS path is always absolute - so a project literally named "project"
+  # cannot collide with the header's own column label.
+  awk -F'|' -v n="$NAME" '
+    { for (i = 1; i <= NF; i++) { gsub(/^[ \t]+|[ \t]+$/, "", $i) } }
+    NF >= 4 && $2 == n && $3 ~ /^\// { print $3 "|" $4; exit }
+  ' "$MAP"
+}
+
+row=$(lookup_row)
+if [ -z "$row" ]; then
+  echo "$NAME: skipped: no recorded NAS deployment"
+  exit 0
+fi
+NAS_PATH=${row%%|*}
+PROCS=${row#*|}
+
+if ! bounded test -d "$NAS_PATH"; then
+  echo "$NAME: skipped: NAS path $NAS_PATH not a directory"
+  exit 0
+fi
+if ! git_nas rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  echo "$NAME: skipped: $NAS_PATH not a git repo"
+  exit 0
+fi
+if ! git_nas remote get-url origin >/dev/null 2>&1; then
+  echo "$NAME: skipped: no origin remote at $NAS_PATH"
+  exit 0
+fi
+
+if ! fetch_with_packed_refs_lock_guard; then
+  reason="fetch failed"
+  [ -z "$FETCH_OUTPUT" ] || reason="$reason: $(first_line "$FETCH_OUTPUT")"
+  echo "$NAME: skipped: $reason"
+  exit 0
+fi
+
+default_branch() {
+  local ref branch
+  ref=$(git_nas symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null || true)
+  if [ -n "$ref" ]; then
+    echo "${ref#origin/}"
+    return 0
+  fi
+  for branch in main master; do
+    if git_nas show-ref --verify --quiet "refs/heads/$branch"; then
+      echo "$branch"
+      return 0
+    fi
+  done
+  return 1
+}
+
+DEFAULT=$(default_branch) || {
+  echo "$NAME: skipped: cannot determine default branch at $NAS_PATH"
+  exit 0
+}
+BASE="origin/$DEFAULT"
+if ! git_nas rev-parse --verify --quiet "$BASE^{commit}" >/dev/null; then
+  echo "$NAME: skipped: $BASE does not exist at $NAS_PATH"
+  exit 0
+fi
+
+cur=$(git_nas symbolic-ref --quiet --short HEAD 2>/dev/null || echo "")
+dirty=no
+[ -z "$(git_nas status --porcelain 2>/dev/null | head -1)" ] || dirty=yes
+
+if [ "$cur" != "$DEFAULT" ]; then
+  echo "$NAME: STUCK: NAS checkout at $NAS_PATH is not on $DEFAULT - needs attention"
+  exit 0
+fi
+if [ "$dirty" = yes ]; then
+  echo "$NAME: STUCK: NAS checkout at $NAS_PATH has uncommitted changes - needs attention"
+  exit 0
+fi
+
+local_rev=""
+if ! local_rev=$(git_nas rev-parse --verify --quiet "$DEFAULT"); then
+  echo "$NAME: skipped: cannot read local $DEFAULT at $NAS_PATH"
+  exit 0
+fi
+remote_rev=""
+if ! remote_rev=$(git_nas rev-parse --verify --quiet "$BASE"); then
+  echo "$NAME: skipped: cannot read $BASE at $NAS_PATH"
+  exit 0
+fi
+if [ "$local_rev" = "$remote_rev" ]; then
+  echo "$NAME: already current"
+  exit 0
+fi
+if ! git_nas merge-base --is-ancestor "$DEFAULT" "$BASE"; then
+  behind=$(git_nas rev-list --count "HEAD..$BASE" 2>/dev/null) || behind="?"
+  echo "$NAME: STUCK: NAS checkout at $NAS_PATH diverged from $BASE, $behind commits behind - needs attention"
+  exit 0
+fi
+
+before=$(git_nas rev-parse --short "$DEFAULT")
+merge_output=""
+if ! merge_output=$(git_nas merge --ff-only "$BASE" 2>&1); then
+  reason="fast-forward failed"
+  [ -z "$merge_output" ] || reason="$reason: $(first_line "$merge_output")"
+  echo "$NAME: skipped: $reason"
+  exit 0
+fi
+after=$(git_nas rev-parse --short "$DEFAULT")
+
+# process_online <proc>: true when pm2 currently reports EVERY instance of
+# <proc> as online (a clustered app can register several jlist entries under
+# the same name; one lagging instance must not be masked by the others).
+process_online() {
+  local proc=$1 status
+  status=$(pm2 jlist 2>/dev/null | jq -r --arg n "$proc" \
+    '[.[] | select(.name == $n) | .pm2_env.status] as $s
+     | if ($s | length) == 0 then "missing"
+       elif all($s[]; . == "online") then "online"
+       else "not-online"
+       end' 2>/dev/null) || status="missing"
+  [ "$status" = "online" ]
+}
+
+restart_problems=""
+IFS=',' read -r -a procs <<< "$PROCS"
+for proc in "${procs[@]}"; do
+  proc="${proc#"${proc%%[![:space:]]*}"}"
+  proc="${proc%"${proc##*[![:space:]]}"}"
+  [ -n "$proc" ] || continue
+  if ! pm2 restart "$proc" >/dev/null 2>&1; then
+    restart_problems="$restart_problems $proc(restart failed)"
+    continue
+  fi
+  if ! process_online "$proc"; then
+    restart_problems="$restart_problems $proc(not online after restart)"
+  fi
+done
+
+if [ -n "$restart_problems" ]; then
+  echo "$NAME: synced $before..$after but restart verification failed:$restart_problems - needs attention"
+  exit 0
+fi
+echo "$NAME: synced $before..$after, restarted $PROCS and verified online"
diff --git a/bin/fm-risk-tripwire.sh b/bin/fm-risk-tripwire.sh
new file mode 100755
index 000000000..e684eff57
--- /dev/null
+++ b/bin/fm-risk-tripwire.sh
@@ -0,0 +1,248 @@
+#!/usr/bin/env bash
+# Mechanical risk trip-wire (guardrail #2): greps a task's brief text and, once
+# code exists, its changed file paths for migration/auth/schema/security
+# signals - a second, structurally different check from the natural-language
+# "when" match a crew-dispatch rule already made, so a misclassified risky task
+# cannot slip to a cheap model/effort tier on a single judgment call
+# (data/research-resource-tiering-synthesis.md).
+#
+# Usage: fm-risk-tripwire.sh <task-id>
+#
+# Checks whatever is available for <task-id>:
+#   - data/<task-id>/brief.md, if it exists (works before spawn, right after
+#     bin/fm-brief.sh scaffolds it - the first checkpoint)
+#   - the worktree's changed file paths vs its project's default branch, if
+#     state/<task-id>.meta records worktree=/project= (works after spawn, at
+#     Validate time - the second, binding checkpoint against the real diff)
+# Exit codes:
+#   0  no risk signal found
+#   1  a RISK hit fired (one "RISK: <reason>" line per hit is printed)
+#   2  could not check: a malformed invocation, neither a brief nor a usable
+#      worktree/project exists yet (nothing to check), or the worktree/project
+#      exist but their diff base could not be resolved, so the binding diff
+#      checkpoint could not run (warned to stderr, never a silent clean pass)
+# Distinct codes matter so a caller branching on $? cannot mistake a malformed
+# invocation for a real risk hit. A hit means: floor this task's model/effort to
+# the safety-critical profile (opus/xhigh, ultracode independent-review)
+# regardless of which rule the natural-language dispatch match picked, per
+# AGENTS.md section 4's risk floor.
+#
+# This is a coarse, unpushed-diff-vs-default-branch name-only comparison, not
+# the PR-aware exact diff bin/fm-review-diff.sh computes - good enough for a
+# keyword scan, not a substitute for that script's authoritative base.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
+FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
+DATA="${FM_DATA_OVERRIDE:-$FM_HOME/data}"
+
+# shellcheck source=bin/fm-tangle-lib.sh
+. "$SCRIPT_DIR/fm-tangle-lib.sh"
+
+usage() {
+  echo "usage: fm-risk-tripwire.sh <task-id>" >&2
+}
+
+if [ "${1:-}" = "-h" ] || [ "${1:-}" = "--help" ]; then
+  usage
+  exit 0
+fi
+
+ID=${1:-}
+[ -n "$ID" ] || { usage; exit 2; }
+[ $# -le 1 ] || { usage; exit 2; }
+
+# Case-insensitive, word-bounded match against the brief's prose, tolerating the
+# inflections and affixes real task phrasing uses. Word bounding stops substring
+# false positives like "auth" inside "authoritative", but three things must still
+# reach the scan or a genuinely risky task slips to a cheap tier (the dangerous
+# direction for a safety floor):
+#   - verb forms need their own stems: appending the outer (s|ed|ing|ion|...)
+#     suffix to a bare NOUN literal cannot reach the verb, so "migration" alone
+#     could only become "migrations", never "migrate"/"migrating"/"migrated",
+#     and the bare "auth" branch never reaches "authorize"/"authenticate".
+#   - the un/re/de/pre prefixes ("unauthorized"/"unauthenticated" - the most
+#     common access-control phrasing) glue a letter onto the stem's front, so
+#     the auth stems carry an explicit optional prefix.
+#   - a bare "auth"-anything stem is still avoided, so "authoritative"/"author"
+#     stay shut.
+# Word bounding is done by splitting the body into whole tokens (below), NOT by
+# grep's \< / \> anchors: those are a GNU extension BSD grep does not honor, so
+# on macOS they would silently match nothing and let every risky brief through -
+# a false negative in the dangerous direction. Whole-token matching is identical
+# on GNU and BSD grep and, unlike a boundary-consuming grep -o pattern, still
+# reports BOTH words of an adjacent risk pair like "session token" (a consumed
+# shared delimiter would drop the second). Single-word keywords go in WORD_REGEX;
+# the multi-word phrases have no lone token and are matched on the
+# space-normalized stream via PHRASE_REGEX.
+WORD_KEYWORDS='auth|authentication|authorization|(un|re|de|pre)?authoriz(e|ed|es|ing|ation|ations|er|ers)?|(un|re|de|pre)?authenticat(e|ed|es|ing|ion|ions|or|ors)?|session|credential|password|secret|token|payment|billing|migrat(e|ed|es|ing|ion|ions)|schema|security|encrypt|decrypt|permission'
+WORD_REGEX="(${WORD_KEYWORDS})(s|es|ed|ing|ion|ions)?"
+PHRASE_REGEX='(access[[:space:]]+control|data[[:space:]]+deletion|bulk[[:space:]]+mutation|public[[:space:]]+exposure|breaking[[:space:]]+change)(s|es|ed|ing|ion|ions)?'
+
+# Scan only the task-specific body of the brief (the # Task section up to the
+# next scaffold section heading), never the fixed scaffold boilerplate
+# bin/fm-brief.sh writes into every brief - that boilerplate contains benign
+# words like "authoritative" and "future session" that would otherwise trip the
+# wire on every task. The Herdr block bin/fm-brief.sh injects immediately after
+# # Task (either the # Herdr isolation ... hard-safety contract, whose text is
+# dense with "session"/"--session", or the # Herdr lifecycle declaration ...
+# not-enabled stub) is scaffold boilerplate too, so its heading is a boundary as
+# well; without it every --herdr-lab brief would trip on the contract's own
+# "session" wording rather than the real task text. The section boundary is one
+# of the scaffold's own known headings (# Herdr isolation .../# Herdr lifecycle
+# declaration .../# Setup/# Rules/# Project memory/# Definition of done), not any
+# column-0 "# " line: a shell/code comment embedded in the task body (e.g.
+# "# then run the schema migration") must NOT end the scan, or the risk words
+# after it are silently dropped - the dangerous direction for a safety floor.
+# A boundary heading must also be blank-line-preceded, as every real scaffold
+# heading is (bin/fm-brief.sh emits a blank line before each), so a task body
+# that itself quotes a bare "# Setup" line inline does not cut the scan short.
+# Lines inside a fenced code block are likewise never treated as a boundary.
+# Falls back to the whole brief when there is no # Task section (a non-standard
+# or hand-written brief), keeping the permissive safety bias.
+brief_task_body() {
+  local body
+  body=$(awk '
+    { blank = ($0 ~ /^[[:space:]]*$/) }
+    /^```/ { fence = !fence; prevblank = blank; next }
+    !fence && /^# Task[[:space:]]*$/ { intask=1; prevblank = blank; next }
+    intask && !fence && prevblank && /^# (Herdr isolation.*|Herdr lifecycle declaration.*|Setup|Rules|Project memory|Definition of done)[[:space:]]*$/ { intask=0 }
+    intask { print }
+    { prevblank = blank }
+  ' "$1")
+  if [ -n "$body" ]; then
+    printf '%s\n' "$body"
+  else
+    cat "$1"
+  fi
+}
+
+# Component/token match against one changed file's path (already lowercased by
+# the caller). Deliberately NOT a blanket bin/* match: firstmate's own
+# supervision backbone lives under bin/ and is routed by an explicit dispatch
+# rule (see docs/examples/crew-dispatch.json), so flooring every bin/ change
+# here would override that rule and defeat the finer tiers.
+#
+# The same word-boundary discipline as the brief-text scan applies here, so a
+# risk word must be a real path component or delimited token, not a bare
+# substring: "strong" words (auth/migrat/schema/... families) match anywhere
+# they appear as a /, -, _, or . delimited token, catching bin/auth-setup.sh,
+# bin/run-migration.sh, and db/schema.sql; the weaker "session" matches only as
+# a whole path component or filename base (lib/auth/session.rb,
+# app/models/session.rb), never as a hyphen fragment - otherwise the
+# supervision backbone bin/fm-session-start.sh would over-match. Bare-substring
+# false positives like "auth" inside AUTHORS/docs/authors.md no longer trip.
+# The flip side is intentional: a risk word glued into a compound component with
+# NO delimiter (e.g. "authsetup.rb") is not matched, because catching it would
+# require substring matching again and reopen exactly those false positives; the
+# brief-text scan and the delimiter tokenization below cover the realistic cases.
+PATH_STRONG_REGEX='^(auth|authn|authz|authoriz(e|ed|es|ing|ation|ations|er|ers)?|authenticat(e|ed|es|ing|ion|ions|or|ors)?|migrat(e|ed|es|ing|ion|ions)|schema|schemas|secret|secrets|credential|credentials|payment|payments|billing|security|password|passwords|token|tokens|permission|permissions|encrypt(s|ed|ing|ion|ions)?|decrypt(s|ed|ing|ion|ions)?)$'
+PATH_WEAK_REGEX='^(session|sessions)$'
+path_is_risky() {
+  local path=$1 comp base
+  case "$path" in
+    .github/workflows/*|*/.github/workflows/*) return 0 ;;
+    *dockerfile*|*docker-compose*) return 0 ;;
+  esac
+  while IFS= read -r comp; do
+    [ -n "$comp" ] || continue
+    base=${comp%.*}
+    # Whole path component or filename base equal to a strong or weak word.
+    if printf '%s\n%s\n' "$comp" "$base" | grep -Eiq "$PATH_STRONG_REGEX|$PATH_WEAK_REGEX"; then
+      return 0
+    fi
+    # Strong words also match as a ., -, or _ delimited token inside a compound
+    # name (e.g. config.schema.json, run-migration.sh), the fail-safe direction.
+    if printf '%s\n' "$base" | tr '._-' '\n' | grep -Eiq "$PATH_STRONG_REGEX"; then
+      return 0
+    fi
+  done < <(printf '%s\n' "$path" | tr '/' '\n')
+  return 1
+}
+
+FOUND=0
+CHECKED=0
+DIFF_UNRESOLVED=0
+
+BRIEF="$DATA/$ID/brief.md"
+if [ -f "$BRIEF" ]; then
+  CHECKED=1
+  lc=$(brief_task_body "$BRIEF" | tr '[:upper:]' '[:lower:]')
+  # Split on every non-alnum char so each word is its own token (this also
+  # splits snake_case identifiers like run_schema_migration), then match whole
+  # tokens; phrases keep their inter-word gap on the space-normalized stream.
+  word_hits=$(printf '%s\n' "$lc" | tr -c '[:alnum:]' '\n' | grep -xE "$WORD_REGEX" || true)
+  phrase_hits=$(printf '%s\n' "$lc" | tr -c '[:alnum:]' ' ' | tr -s ' ' | grep -oE "$PHRASE_REGEX" || true)
+  hit=$(printf '%s\n%s\n' "$word_hits" "$phrase_hits" | sed '/^$/d' | sort -u | tr '\n' ',' | sed 's/,$//')
+  if [ -n "$hit" ]; then
+    echo "RISK: brief for $ID mentions risk-adjacent term(s): $hit"
+    FOUND=1
+  fi
+fi
+
+META="$STATE/$ID.meta"
+if [ -f "$META" ]; then
+  WT=$(grep '^worktree=' "$META" | tail -1 | cut -d= -f2- || true)
+  PROJ=$(grep '^project=' "$META" | tail -1 | cut -d= -f2- || true)
+  if [ -n "$WT" ] && [ -n "$PROJ" ] && [ -d "$WT" ] && [ -d "$PROJ" ]; then
+    CHECKED=1
+    diff_base_resolved=0
+    # The base resolution below duplicates bin/fm-review-diff.sh's origin fetch
+    # and origin/<default> verification on purpose: this scan needs the changed
+    # PATH LIST, but fm-review-diff.sh only exposes --stat (a diffstat), not a
+    # --name-only path list, so there is nothing to reuse for a name scan.
+    # Adding a --name-only mode to that script is the clean fix and is left as a
+    # follow-up rather than expanding this task's scope into another owner.
+    DEFAULT=$(fm_default_branch "$PROJ" 2>/dev/null || true)
+    if [ -n "$DEFAULT" ]; then
+      BASE="$DEFAULT"
+      if git -C "$PROJ" remote get-url origin >/dev/null 2>&1; then
+        git -C "$WT" fetch origin "+refs/heads/$DEFAULT:refs/remotes/origin/$DEFAULT" --quiet 2>/dev/null || true
+        git -C "$WT" rev-parse --verify --quiet "refs/remotes/origin/$DEFAULT^{commit}" >/dev/null 2>&1 && BASE="origin/$DEFAULT"
+      fi
+      if git -C "$WT" rev-parse --verify --quiet "$BASE^{commit}" >/dev/null 2>&1; then
+        diff_base_resolved=1
+        diff_paths=$(git -C "$WT" diff --name-only "$BASE...HEAD" -- 2>/dev/null || true)
+        risky_paths=
+        if [ -n "$diff_paths" ]; then
+          while IFS= read -r path; do
+            [ -n "$path" ] || continue
+            lower_path=$(printf '%s' "$path" | tr '[:upper:]' '[:lower:]')
+            if path_is_risky "$lower_path"; then
+              risky_paths="${risky_paths}${risky_paths:+, }$path"
+            fi
+          done <<< "$diff_paths"
+        fi
+        if [ -n "$risky_paths" ]; then
+          echo "RISK: diff for $ID touches risk-adjacent path(s): $risky_paths"
+          FOUND=1
+        fi
+      fi
+    fi
+    # The worktree/project exist, so the binding diff checkpoint was expected to
+    # run - but the diff base could not be resolved (no default branch, or the
+    # base commit does not verify in the worktree). Do not let that read as a
+    # clean pass: warn loudly, like the sibling bin/fm-review-diff.sh, and mark
+    # the run not-checkable so a caller branching on $? floors the task rather
+    # than trusting a silent 0 - the safe direction for this guardrail.
+    if [ "$diff_base_resolved" -eq 0 ]; then
+      echo "warning: could not resolve a diff base for $ID (project $PROJ, default branch '${DEFAULT:-unresolved}'); the diff checkpoint did not run - reporting not-checkable (exit 2), not a clean pass" >&2
+      DIFF_UNRESOLVED=1
+    fi
+  fi
+fi
+
+if [ "$CHECKED" -eq 0 ]; then
+  echo "error: neither $BRIEF nor a usable worktree/project in $META was found for $ID; nothing to check" >&2
+  exit 2
+fi
+
+# A real risk hit (exit 1) always wins over an unresolvable diff base; only when
+# nothing tripped does an unresolvable base downgrade the run to could-not-check.
+if [ "$FOUND" -eq 0 ] && [ "$DIFF_UNRESOLVED" -eq 1 ]; then
+  exit 2
+fi
+
+exit "$FOUND"
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 3b56763d2..368ad1689 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -79,6 +79,19 @@
 # On success prints: spawned <id> harness=<name> kind=<ship|scout|secondmate> mode=<mode> yolo=<on|off> window=<backend-target> worktree=<path>
 # mode/yolo are resolved per-project from data/projects.md for ship/scout tasks;
 # secondmate spawns record mode=secondmate, yolo=off, home=, and projects=.
+# Ship/scout spawns also derive a Docker-Compose-safe project name from the
+# worktree's own pool-slot path, write it to <worktree>/.treehouse-compose-project
+# (excluded from git via .git/info/exclude, like the per-harness turn-end hook
+# files below), and record it in meta as compose_project=<name>, so two
+# worktrees of the same project never collide on Compose's default
+# project-naming (fm-brief.sh documents how a crewmate consumes it).
+# claude launches (crewmate, scout, and secondmate) carry
+# CLAUDE_CODE_AUTO_COMPACT_WINDOW=300000 so they auto-compact the way the primary
+# interactive session already does via its own .claude/settings.local.json, which a
+# separately-launched claude process never inherits; see the comment on the claude
+# case in launch_template() below for why 300000 (not the primary's
+# WINDOW=1000000 + PCT_OVERRIDE=20 pair) is safe to hardcode: it is capped at the
+# real context window, so it is a no-op below that window and takes effect above it.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -324,7 +337,25 @@ launch_template() {
     # does NOT suppress the interactive ghost text (verified empirically), so the env
     # var is the correct control. The dim-aware composer reader in fm-tmux-lib.sh is
     # the defense-in-depth backstop for any pane this flag cannot reach.
-    claude) printf '%s' 'CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false claude --dangerously-skip-permissions __MODELFLAG____EFFORTFLAG__"$(cat __BRIEF__)"' ;;
+    #
+    # CLAUDE_CODE_AUTO_COMPACT_WINDOW=300000 gives claude crewmates and secondmates
+    # a higher auto-compaction ceiling than the plain-window default, the same way
+    # the primary interactive session already has via its own
+    # .claude/settings.local.json, which these separately-launched processes never
+    # inherit. The var is read once at startup and is CAPPED at the model's actual
+    # context window, so it can only lower the effective trigger, never raise it past
+    # the real ceiling: min(300000, window) is 300000 once window exceeds it, but a
+    # no-op (stays at window) below that. This is not a universal guarantee for every
+    # possible future model choice - a differently-configured account/model capped at
+    # the plain ~200k window would see no change - but it is true for the window tier
+    # crew actually runs on today: as verified for --model sonnet on this account
+    # (the standard crewmate spawn), the window resolves to the ~1M-context beta,
+    # well above 300000.
+    # Do not copy the primary's two-var form (WINDOW=1000000 + PCT_OVERRIDE=20):
+    # that pair assumes a 1M window and is not safe for a harness/account
+    # combination with a smaller one. See the harness-adapters skill's claude
+    # section for the dated /context verification.
+    claude) printf '%s' 'CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false CLAUDE_CODE_AUTO_COMPACT_WINDOW=300000 claude --dangerously-skip-permissions __MODELFLAG____EFFORTFLAG__"$(cat __BRIEF__)"' ;;
     codex)
       if [ "$kind" = secondmate ]; then
         printf '%s' 'codex __MODELFLAG____EFFORTFLAG__--dangerously-bypass-approvals-and-sandbox "$(cat __BRIEF__)"'
@@ -431,6 +462,50 @@ shell_quote() {
   printf "'"
 }
 
+# Appends a path (relative to a worktree root) to that worktree's own
+# .git/info/exclude, so a firstmate-owned pointer/marker file never blocks
+# teardown's dirty-worktree check or leaks into a crewmate's commit. Shared by
+# every per-harness turn-end hook file below and the docker-compose isolation
+# marker. Operates on $WT, which callers must have already resolved.
+exclude_path() {
+  local rel=$1 EXCL
+  EXCL=$(git -C "$WT" rev-parse --git-path info/exclude 2>/dev/null || true)
+  [ -n "$EXCL" ] || return 0
+  mkdir -p "$(dirname "$EXCL")"
+  grep -qxF "$rel" "$EXCL" 2>/dev/null || echo "$rel" >> "$EXCL"
+}
+
+# Derives a unique, Docker-Compose-safe project name from a worktree's own
+# pool-slot path (AGENTS.md "Layout and state"; a treehouse pool worktree is
+# .../<project>-<hash>/<slot>/<repo-name>), so two worktrees of the same
+# project - which always share the same leaf directory basename, e.g.
+# "wealthsync" - never collide on Compose's default project-naming (derived
+# from cwd basename) for container/volume/network names. Stable across
+# respawns into the same pool slot, so a stale stack left behind by a prior
+# task in that slot is superseded rather than orphaned under a new name;
+# distinct across the fleet because no two live tasks occupy the same slot at
+# once. Falls back to the worktree's own leaf name, then the task id, when the
+# path does not have two parent directories (e.g. a non-treehouse backend).
+fm_compose_project_name() {  # <worktree-abs-path> <fallback-tag>
+  local wt=$1 fallback=$2 slot pool raw name
+  slot=$(basename "$(dirname "$wt")" 2>/dev/null || true)
+  pool=$(basename "$(dirname "$(dirname "$wt")")" 2>/dev/null || true)
+  if [ -n "$slot" ] && [ "$slot" != / ] && [ -n "$pool" ] && [ "$pool" != / ]; then
+    raw="$pool-$slot"
+  else
+    raw=$(basename "$wt")
+  fi
+  name=$(printf '%s' "$raw" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9-]/-/g' | tr -s '-' | sed 's/^-//; s/-$//')
+  if [ -z "$name" ]; then
+    name=$(printf '%s' "wt-$fallback" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9-]/-/g' | tr -s '-' | sed 's/^-//; s/-$//')
+  fi
+  case "$name" in
+    [a-z0-9]*) : ;;
+    *) name="wt-$name" ;;
+  esac
+  printf '%s\n' "$name"
+}
+
 model_flag_for_harness() {
   local harness=$1 model=$2
   [ -n "$model" ] && [ "$model" != default ] || return 0
@@ -859,6 +934,18 @@ if [ "$KIND" != secondmate ] && [ "$BACKEND" != orca ]; then
   validate_spawn_worktree "treehouse get" "$T"
 fi
 
+# Docker Compose isolation marker (ship/scout only; a secondmate operates in
+# its own firstmate home, not a per-task pool worktree). Two treehouse
+# worktrees of the same project share a leaf directory basename, so Compose's
+# default project-naming collides across them; drop a stable, worktree-scoped
+# name here that the crewmate's brief (fm-brief.sh) tells it to pass on every
+# docker/docker-compose invocation.
+if [ "$KIND" != secondmate ]; then
+  COMPOSE_PROJECT=$(fm_compose_project_name "$WT" "$ID")
+  printf '%s\n' "$COMPOSE_PROJECT" > "$WT/.treehouse-compose-project"
+  exclude_path '.treehouse-compose-project'
+fi
+
 # Per-task temp root: /tmp/fm-<id>/ with Go's build temp nested at gotmp/. Go won't
 # create GOTMPDIR, so mkdir before it is used; fm-teardown removes the whole root.
 # Nested (not a bare /tmp/fm-<id>/gotmp) so other per-task temp can live alongside
@@ -873,13 +960,6 @@ mkdir -p "$TASK_TMP/gotmp"
 mkdir -p "$STATE"
 STATE_REAL=$(cd "$STATE" && pwd -P)
 TURNEND="$STATE_REAL/$ID.turn-ended"
-exclude_path() {
-  local rel=$1 EXCL
-  EXCL=$(git -C "$WT" rev-parse --git-path info/exclude 2>/dev/null || true)
-  [ -n "$EXCL" ] || return 0
-  mkdir -p "$(dirname "$EXCL")"
-  grep -qxF "$rel" "$EXCL" 2>/dev/null || echo "$rel" >> "$EXCL"
-}
 if [ "$KIND" != secondmate ]; then
   case "$HARNESS" in
     claude*)
@@ -999,6 +1079,7 @@ META_WINDOW=$T
   echo "tasktmp=$TASK_TMP"
   echo "model=${MODEL:-default}"
   echo "effort=${EFFORT:-default}"
+  [ "$KIND" = secondmate ] || echo "compose_project=$COMPOSE_PROJECT"
   # backend= is written only for a non-default (non-tmux) backend, so the
   # default path's meta stays byte-identical (absent backend= means tmux;
   # data/fm-backend-design-d7's P1 compatibility contract).
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index 9d84f4d6c..0a252fe85 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -356,29 +356,51 @@ pr_is_merged() {
   unpushed_patches_are_in_pr_head "$head"
 }
 
-# Is the branch's content already present in the up-to-date default branch? Fetches
-# first, then 3-way merges the default branch with HEAD: when HEAD introduces nothing
-# the default branch does not already contain (e.g. its change landed via squash) the
-# merged tree equals the default branch's tree. This isolates branch-only changes, so
-# unrelated commits the default branch gained past the merge-base do not count as
-# "added". Returns non-zero when inconclusive (no default ref, or a merge conflict),
-# so the caller refuses rather than guesses.
+# Does the given ref's tree already contain everything HEAD introduces? 3-way merges
+# the ref (ours) with HEAD (theirs) off their merge base into a throwaway index: when
+# HEAD introduces nothing the ref does not already contain (e.g. its change landed via
+# squash), the merged tree equals the ref's tree. read-tree + write-tree is used
+# instead of `git merge-tree --write-tree` (git >= 2.38 only) so this stays portable to
+# older git; a real merge conflict leaves unmerged index entries, write-tree fails, and
+# the check stays inconclusive so the caller refuses rather than guesses.
+content_matches_ref() {
+  local ref=$1 default_tree base merged_tree tmpdir rc
+  default_tree=$(git -C "$WT" rev-parse --quiet --verify "$ref^{tree}" 2>/dev/null) || return 1
+  [ -n "$default_tree" ] || return 1
+  base=$(git -C "$WT" merge-base "$ref" HEAD 2>/dev/null) || return 1
+  tmpdir=$(mktemp -d 2>/dev/null) || return 1
+  GIT_INDEX_FILE="$tmpdir/index" git -C "$WT" read-tree -im --aggressive \
+    "$base^{tree}" "$ref^{tree}" "HEAD^{tree}" 2>/dev/null \
+    && merged_tree=$(GIT_INDEX_FILE="$tmpdir/index" git -C "$WT" write-tree 2>/dev/null)
+  rc=$?
+  rm -rf "$tmpdir"
+  [ "$rc" -eq 0 ] || return 1
+  [ -n "$merged_tree" ] || return 1
+  [ "$merged_tree" = "$default_tree" ]
+}
+
+# Is the branch's content already present in the up-to-date default branch? Checks
+# two candidate refs, succeeding if either already contains HEAD's content: the
+# fetched remote-tracking ref refs/remotes/origin/$name (the normal PR-merged case),
+# and the LOCAL refs/heads/$name (a worktree and its project's primary checkout are
+# linked worktrees of the same repository, so this local ref already reflects a
+# firstmate-performed local fast-forward merge, even for a project whose delivery
+# mode is not local-only - e.g. a PR closed unmerged upstream but the branch was
+# landed into local main by hand on the captain's approval). A fetch failure only
+# rules out the remote-tracking path; the local ref is still tried. Returns
+# non-zero only when neither candidate ref exists or matches.
 content_in_default() {
-  local name ref default_tree merged_tree
+  local name
   name=$(default_branch) || return 1
   if git -C "$WT" remote get-url origin >/dev/null 2>&1; then
-    git -C "$WT" fetch --quiet origin "+refs/heads/$name:refs/remotes/origin/$name" >/dev/null 2>&1 || return 1
-    ref="refs/remotes/origin/$name"
-  elif git -C "$WT" rev-parse --quiet --verify "refs/heads/$name" >/dev/null 2>&1; then
-    ref="refs/heads/$name"
-  else
-    return 1
+    if git -C "$WT" fetch --quiet origin "+refs/heads/$name:refs/remotes/origin/$name" >/dev/null 2>&1; then
+      content_matches_ref "refs/remotes/origin/$name" && return 0
+    fi
   fi
-  default_tree=$(git -C "$WT" rev-parse --quiet --verify "$ref^{tree}" 2>/dev/null) || return 1
-  [ -n "$default_tree" ] || return 1
-  merged_tree=$(git -C "$WT" merge-tree --write-tree "$ref" HEAD 2>/dev/null) || return 1
-  merged_tree=$(printf '%s\n' "$merged_tree" | head -1)
-  [ "$merged_tree" = "$default_tree" ]
+  if git -C "$WT" rev-parse --quiet --verify "refs/heads/$name" >/dev/null 2>&1; then
+    content_matches_ref "refs/heads/$name" && return 0
+  fi
+  return 1
 }
 
 # Has the worktree's committed work actually LANDED, though its commits are not
@@ -1136,9 +1158,22 @@ fm_backend_clear_transition "$BACKEND" "$STATE" "$T" || true
 # Read before the state-file rm below; empty (pre-fix tasks without tasktmp=) is a no-op.
 [ -n "$TASK_TMP" ] && rm -rf "$TASK_TMP"
 remove_pr_poll_artifacts "$STATE" "$ID" || exit 1
-rm -f "$STATE/$ID.status" "$STATE/$ID.turn-ended" "$STATE/$ID.meta" "$STATE/$ID.pi-ext.ts" "$STATE/$ID.grok-turnend-token"
+rm -f "$STATE/$ID.status" "$STATE/$ID.turn-ended" "$STATE/$ID.meta" "$STATE/$ID.pi-ext.ts" "$STATE/$ID.grok-turnend-token" "$STATE/$ID.ultracode"
 if [ "$KIND" != scout ] && [ "$KIND" != secondmate ] && [ "$MODE" != local-only ]; then
   "$FM_ROOT/bin/fm-fleet-sync.sh" "$PROJ" || true
 fi
+# Best-effort, non-blocking: a landed ship task (PR merged, or a local-only merge
+# to local main) may have a live NAS deployment that also needs pulling and
+# restarting - see bin/fm-nas-deploy-sync.sh's header. Scouts and secondmates
+# never land a project change, so they are excluded the same as the fleet-sync
+# call above; unlike that call, local-only IS included here, since a local-only
+# merge is just as much a landed change as a PR merge. A forced teardown carries
+# no landed-work guarantee at all (--force is the explicit discard path, used
+# precisely when the safety checks above were skipped), so it is excluded too -
+# otherwise a discard of unlanded work would still trigger a live NAS pull and
+# pm2 restart for no reason.
+if [ "$KIND" != scout ] && [ "$KIND" != secondmate ] && [ "$FORCE" != "--force" ]; then
+  "$FM_ROOT/bin/fm-nas-deploy-sync.sh" "$(basename "$PROJ")" || true
+fi
 echo "teardown $ID complete (window $T, worktree $WT)"
 backlog_refresh_reminder
diff --git a/bin/fm-tier-guard.sh b/bin/fm-tier-guard.sh
new file mode 100755
index 000000000..934a5bfb4
--- /dev/null
+++ b/bin/fm-tier-guard.sh
@@ -0,0 +1,152 @@
+#!/usr/bin/env bash
+# Escalation-trigger guard for the trivial (Haiku/low) dispatch tier: mechanically
+# checks whether a task's actual diff size or elapsed time has outgrown the
+# resource envelope its assigned model/effort tier implies, so under-resourcing
+# is never caught by the crewmate's own self-report alone (guardrail #1,
+# data/research-resource-tiering-synthesis.md). Read-only: never edits meta,
+# the worktree, or the branch.
+#
+# Usage: fm-tier-guard.sh <task-id>
+#
+# Reads state/<task-id>.meta for model=/effort=, and that file's own mtime as a
+# best-effort spawn-time proxy for the age check - NOT authoritative. A later
+# append to meta (bin/fm-pr-check.sh recording pr=/pr_head=, or fm-x-link
+# recording X-mode fields) resets the mtime, so a long-running task can read as
+# younger than it is and slip the age ceiling; the diff size/file ceilings are
+# the primary signal and are unaffected by that reset. Reuses
+# bin/fm-review-diff.sh --stat for the actual diff size instead of re-deriving
+# the authoritative base/PR-head resolution here.
+#
+# Prints one "ESCALATE: <reason>" line per triggered condition. Exit codes:
+#   0  within the tier's envelope (silent)
+#   1  at least one escalation fired
+#   2  usage or setup error (bad args, missing meta, or fm-review-diff failed)
+# Distinct codes let a caller branching on $? tell a real escalation from a
+# malformed invocation, matching the sibling guardrail bin/fm-risk-tripwire.sh.
+# Only the trivial (Haiku/low) tier has a size/age ceiling checked here; every
+# other tier is covered only by the general, tier-independent ceiling below.
+# On an escalation, bump the task's model/effort in place per AGENTS.md
+# section 7's Validate step; never silently de-escalate afterward.
+#
+# Env overrides (starting points from
+# data/scout-nomistakes-tiering-t8/report.md section 3, not yet calibrated
+# against this fleet's own diff-size history):
+#   FM_TIER_TRIVIAL_MAX_LINES        default 30
+#   FM_TIER_TRIVIAL_MAX_FILES        default 2
+#   FM_TIER_TRIVIAL_MAX_AGE_SECONDS  default 1800 (30 minutes)
+#   FM_TIER_HEAVY_MIN_LINES          default 400
+#   FM_TIER_HEAVY_MIN_FILES          default 8
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
+FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
+
+TRIVIAL_MAX_LINES=${FM_TIER_TRIVIAL_MAX_LINES:-30}
+TRIVIAL_MAX_FILES=${FM_TIER_TRIVIAL_MAX_FILES:-2}
+TRIVIAL_MAX_AGE=${FM_TIER_TRIVIAL_MAX_AGE_SECONDS:-1800}
+HEAVY_MIN_LINES=${FM_TIER_HEAVY_MIN_LINES:-400}
+HEAVY_MIN_FILES=${FM_TIER_HEAVY_MIN_FILES:-8}
+
+usage() {
+  echo "usage: fm-tier-guard.sh <task-id>" >&2
+}
+
+if [ "${1:-}" = "-h" ] || [ "${1:-}" = "--help" ]; then
+  usage
+  exit 0
+fi
+
+ID=${1:-}
+[ -n "$ID" ] || { usage; exit 2; }
+[ $# -le 1 ] || { usage; exit 2; }
+
+META="$STATE/$ID.meta"
+[ -f "$META" ] || { echo "error: no meta for task $ID at $META" >&2; exit 2; }
+
+MODEL=$(grep '^model=' "$META" | tail -1 | cut -d= -f2- || true)
+EFFORT=$(grep '^effort=' "$META" | tail -1 | cut -d= -f2- || true)
+
+# Portable mtime; Linux stat lacks -f, macOS stat lacks -c (mirrors
+# bin/fm-supervision-lib.sh's fm_sup_stat_mtime; not sourced from there to keep
+# this script's only dependency on that library's actual contract-bearing
+# function, fm_supervision_status, out of scope here).
+tier_guard_stat_mtime() {
+  if [ "$(uname)" = Darwin ]; then
+    stat -f %m "$1" 2>/dev/null
+  else
+    stat -c %Y "$1" 2>/dev/null
+  fi
+}
+
+is_trivial_tier() {
+  case "$MODEL" in
+    *haiku*)
+      if [ "$EFFORT" = low ] || [ "$EFFORT" = default ]; then
+        return 0
+      fi
+      ;;
+  esac
+  return 1
+}
+
+STAT_ERR=$(mktemp)
+STAT_OUT=$("$SCRIPT_DIR/fm-review-diff.sh" "$ID" --stat 2>"$STAT_ERR") || {
+  echo "error: fm-review-diff.sh failed for $ID" >&2
+  rm -f "$STAT_ERR"
+  exit 2
+}
+# fm-review-diff.sh still exits 0 but warns when it cannot resolve an open PR's
+# head and falls back to the possibly-stale local branch, so the size measured
+# below may under-count the real PR diff. Blanket-discarding that warning (the
+# 2>/dev/null this replaces) made a degraded read indistinguishable from an
+# authoritative one - the dangerous under-report direction for this guardrail.
+# Detect only that specific marker (not all of fm-review-diff.sh's stderr, which
+# also carries fm-guard.sh's supervision banner) and surface it below.
+DIFF_MAY_LAG_PR=0
+if grep -q 'PR head unavailable' "$STAT_ERR"; then
+  DIFF_MAY_LAG_PR=1
+fi
+rm -f "$STAT_ERR"
+
+FILES=0
+LINES=0
+if ! printf '%s\n' "$STAT_OUT" | grep -q '^no changes vs'; then
+  FILES=$(printf '%s\n' "$STAT_OUT" | grep -oE '[0-9]+ files? changed' | grep -oE '^[0-9]+' || true)
+  INS=$(printf '%s\n' "$STAT_OUT" | grep -oE '[0-9]+ insertions?\(\+\)' | grep -oE '^[0-9]+' || true)
+  DEL=$(printf '%s\n' "$STAT_OUT" | grep -oE '[0-9]+ deletions?\(-\)' | grep -oE '^[0-9]+' || true)
+  FILES=${FILES:-0}
+  INS=${INS:-0}
+  DEL=${DEL:-0}
+  LINES=$((INS + DEL))
+fi
+
+FOUND=0
+
+if is_trivial_tier; then
+  if [ "$FILES" -gt "$TRIVIAL_MAX_FILES" ] || [ "$LINES" -gt "$TRIVIAL_MAX_LINES" ]; then
+    echo "ESCALATE: trivial (haiku/low) task $ID has grown to $FILES files / $LINES changed lines, past the trivial envelope ($TRIVIAL_MAX_FILES files / $TRIVIAL_MAX_LINES lines) - bump to at least sonnet/high"
+    FOUND=1
+  fi
+  AGE_SRC=$(tier_guard_stat_mtime "$META" || true)
+  if [ -n "$AGE_SRC" ]; then
+    NOW=$(date +%s)
+    AGE=$((NOW - AGE_SRC))
+    if [ "$AGE" -gt "$TRIVIAL_MAX_AGE" ]; then
+      echo "ESCALATE: trivial (haiku/low) task $ID has run ${AGE}s, past the trivial tier's ${TRIVIAL_MAX_AGE}s ceiling - bump to at least sonnet/high"
+      FOUND=1
+    fi
+  fi
+fi
+
+if [ "$FILES" -gt "$HEAVY_MIN_FILES" ] || [ "$LINES" -gt "$HEAVY_MIN_LINES" ]; then
+  echo "ESCALATE: task $ID's diff ($FILES files / $LINES changed lines) exceeds the heavy-scale ceiling ($HEAVY_MIN_FILES files / $HEAVY_MIN_LINES lines) regardless of its assigned tier - re-check whether it still matches its dispatched rule"
+  FOUND=1
+fi
+
+if [ "$DIFF_MAY_LAG_PR" -eq 1 ]; then
+  echo "warning: the diff for $ID was sized against a possibly-stale local branch because the open PR head could not be resolved; the ceilings above may under-count the real PR diff - re-check against the current PR before trusting a within-envelope result" >&2
+fi
+
+exit "$FOUND"
diff --git a/bin/fm-turnend-guard.sh b/bin/fm-turnend-guard.sh
index eef947f85..39a145cb5 100755
--- a/bin/fm-turnend-guard.sh
+++ b/bin/fm-turnend-guard.sh
@@ -44,6 +44,13 @@ STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 CONFIG="${FM_CONFIG_OVERRIDE:-$FM_HOME/config}"
 GRACE=${FM_GUARD_GRACE:-300}
 WATCH="$SCRIPT_DIR/fm-watch.sh"
+# A legitimate watcher re-arm (bin/fm-watch-arm.sh, backgrounded) needs a brief
+# moment to fork the watcher and register its lock after the old watcher
+# released it; fm_watcher_healthy demands a live lock with zero grace, so
+# without this the hook would block on that normal handoff gap, not just a
+# genuine supervision lapse (docs/turnend-guard.md "Shared Predicate"). Default
+# to the arm's own confirm budget so the two stay in lockstep.
+ARM_WAIT=${FM_TURNEND_ARM_WAIT:-${FM_ARM_CONFIRM_TIMEOUT:-10}}
 
 # shellcheck source=bin/fm-supervision-lib.sh
 . "$SCRIPT_DIR/fm-supervision-lib.sh"
@@ -114,7 +121,18 @@ fi
 
 fm_supervision_status "$STATE" "$GRACE"
 [ "$FM_SUP_IN_FLIGHT" -gt 0 ] || exit 0
-fm_watcher_healthy "$STATE" "$WATCH" "$GRACE" "$FM_HOME" && exit 0
+
+# Bounded poll, not an immediate block: give an in-flight re-arm the same
+# handful-of-seconds tolerance bin/fm-guard.sh already grants via beacon grace,
+# expressed correctly for this predicate's live-lock check. A watcher that is
+# truly gone (or never was) still blocks - it just takes up to $ARM_WAIT to say
+# so, mirroring the poll bin/fm-watch-arm.sh:180 runs on itself.
+arm_deadline=$(( $(date +%s) + ARM_WAIT ))
+while :; do
+  fm_watcher_healthy "$STATE" "$WATCH" "$GRACE" "$FM_HOME" && exit 0
+  [ "$(date +%s)" -ge "$arm_deadline" ] && break
+  sleep 0.2
+done
 
 afk=0
 [ -e "$STATE/.afk" ] && afk=1
diff --git a/bin/fm-ultracode-guard.sh b/bin/fm-ultracode-guard.sh
new file mode 100755
index 000000000..90a79f113
--- /dev/null
+++ b/bin/fm-ultracode-guard.sh
@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+# Ultracode enforcement (guardrail #3): mechanically confirms a genuinely
+# independent second pass ran on an ultracode-flagged task's finished diff
+# before it can go PR-ready - not a sub-task the same crewmate spawned itself
+# (data/research-resource-tiering-synthesis.md). Tracks state via a plain
+# marker file, state/<task-id>.ultracode, the same convention as other
+# firstmate state/ markers (state/.afk, state/<id>.turn-ended); it never
+# touches fm-spawn.sh or the task's own meta.
+#
+# Usage:
+#   fm-ultracode-guard.sh flag <task-id> [<role>]
+#     Records that <task-id> was dispatched under a crew-dispatch rule whose
+#     resolved profile set ultracode=true. <role> defaults to
+#     "independent-review" (the only role this fleet's rules use today; see
+#     docs/examples/crew-dispatch.json). Firstmate runs this right after
+#     spawning the task.
+#   fm-ultracode-guard.sh reviewed <task-id> <reviewer-task-id>
+#     Records that <reviewer-task-id> - a distinct, separately dispatched task
+#     (its own state/<reviewer-task-id>.meta must exist) - independently
+#     reviewed <task-id>'s finished diff and its findings were addressed.
+#     Refuses if <reviewer-task-id> equals <task-id> or has no recorded meta,
+#     so a sub-task the same crewmate spawned itself cannot satisfy this.
+#   fm-ultracode-guard.sh check <task-id>
+#     Exits 0 if <task-id> was never flagged, or was flagged and reviewed.
+#     Exits 1 with an explanatory message if flagged but not yet reviewed -
+#     firstmate runs this before treating an ultracode-flagged task as
+#     PR-ready (AGENTS.md section 7's Validate step).
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
+FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
+
+usage() {
+  echo "usage: fm-ultracode-guard.sh flag <task-id> [<role>]" >&2
+  echo "       fm-ultracode-guard.sh reviewed <task-id> <reviewer-task-id>" >&2
+  echo "       fm-ultracode-guard.sh check <task-id>" >&2
+}
+
+if [ "${1:-}" = "-h" ] || [ "${1:-}" = "--help" ]; then
+  usage
+  exit 0
+fi
+
+CMD=${1:-}
+ID=${2:-}
+if [ -z "$CMD" ] || [ -z "$ID" ]; then
+  usage
+  exit 1
+fi
+
+MARKER="$STATE/$ID.ultracode"
+
+cmd_flag() {
+  local role=${3:-independent-review}
+  [ $# -le 3 ] || { usage; exit 1; }
+  # The marker is a line-based file (see cmd_reviewed/cmd_check), so a role
+  # containing a newline or other control character could inject a forged
+  # reviewed_by= line and bypass the independent-review requirement entirely.
+  case "$role" in
+    *[!A-Za-z0-9_-]*|'')
+      echo "error: role '$role' must be non-empty and contain only letters, digits, '-', or '_'" >&2
+      exit 1
+      ;;
+  esac
+  mkdir -p "$STATE"
+  # Overwrites any existing marker: re-flagging (e.g. after an escalation)
+  # deliberately clears a prior reviewed_by=, since that review was against an
+  # earlier version of the diff and the requirement starts over.
+  echo "role=$role" > "$MARKER"
+  echo "flagged $ID ultracode role=$role"
+}
+
+cmd_reviewed() {
+  local reviewer=${3:-}
+  [ $# -eq 3 ] || { usage; exit 1; }
+  [ -n "$reviewer" ] || { echo "error: reviewed requires a reviewer-task-id" >&2; exit 1; }
+  [ -f "$MARKER" ] || { echo "error: $ID is not ultracode-flagged (no $MARKER); nothing to mark reviewed" >&2; exit 1; }
+  if [ "$reviewer" = "$ID" ]; then
+    echo "error: reviewer-task-id must be a task distinct from $ID - a task cannot independently review itself" >&2
+    exit 1
+  fi
+  if [ ! -f "$STATE/$reviewer.meta" ]; then
+    echo "error: $reviewer has no recorded state/$reviewer.meta - it must be a genuinely, separately dispatched task, not a made-up id or a sub-task $ID spawned itself" >&2
+    exit 1
+  fi
+  grep -qx "reviewed_by=$reviewer" "$MARKER" 2>/dev/null || echo "reviewed_by=$reviewer" >> "$MARKER"
+  echo "recorded $reviewer as the independent review of $ID"
+}
+
+cmd_check() {
+  [ $# -eq 2 ] || { usage; exit 1; }
+  if [ ! -f "$MARKER" ]; then
+    exit 0
+  fi
+  if grep -q '^reviewed_by=' "$MARKER" 2>/dev/null; then
+    exit 0
+  fi
+  role=$(grep '^role=' "$MARKER" | tail -1 | cut -d= -f2- || true)
+  echo "error: $ID is ultracode-flagged (role=${role:-independent-review}) but has no recorded independent review yet - dispatch a genuinely separate task to review the finished diff, then run: fm-ultracode-guard.sh reviewed $ID <reviewer-task-id>" >&2
+  exit 1
+}
+
+case "$CMD" in
+  flag) cmd_flag "$@" ;;
+  reviewed) cmd_reviewed "$@" ;;
+  check) cmd_check "$@" ;;
+  *) usage; exit 1 ;;
+esac
diff --git a/bin/fm-watch.sh b/bin/fm-watch.sh
index 4ea6da70a..99d4316fb 100755
--- a/bin/fm-watch.sh
+++ b/bin/fm-watch.sh
@@ -45,6 +45,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
 FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
+CONFIG="${FM_CONFIG_OVERRIDE:-$FM_HOME/config}"
 mkdir -p "$STATE"
 
 # shellcheck source=bin/fm-wake-lib.sh
@@ -76,6 +77,8 @@ mkdir -p "$STATE"
 . "$SCRIPT_DIR/fm-x-lib.sh"
 # shellcheck source=bin/fm-check-lib.sh
 . "$SCRIPT_DIR/fm-check-lib.sh"
+# shellcheck source=bin/fm-autodeploy-lib.sh
+. "$SCRIPT_DIR/fm-autodeploy-lib.sh"
 
 WATCH_LOCK="$STATE/.watch.lock"
 WATCH_PATH="$SCRIPT_DIR/fm-watch.sh"
@@ -527,6 +530,64 @@ mark_all_captain_relevant_surfaced() {
   done < <(scan_captain_relevant_statuses "$STATE")
 }
 
+# --- Periodic autodeploy-log sweep ------------------------------------------
+# The always-on twin of bootstrap's critical_services_check, but for poll-based
+# autodeploy jobs that write their own durable status log in the failure
+# convention bin/fm-autodeploy-lib.sh's fm_autodeploy_line_failed matches, so a deploy failure
+# between sessions surfaces on the periodic sweep instead of waiting for the next
+# session start. bin/fm-bootstrap.sh's autodeploy_logs_check is the session-start
+# counterpart for whenever no watcher is armed to run this sweep; both share the
+# failure predicate in bin/fm-autodeploy-lib.sh. Each non-empty, non-"#" line of
+# config/autodeploy-logs names one such status log. The LAST line of each log is
+# the authoritative per-run health: a healthy run ends in an "ok ..." rollup, a
+# failed one in an "ALERT ..." rollup or a STUCK:/FAILED: alert line, so a later
+# successful run self-clears the alarm. Absent config, an unreadable log (a NAS
+# hiccup), or a healthy last line are all silent - the check is cheap and
+# fail-quiet so it can run on every heartbeat.
+_autodeploy_marker_path() {  # <log-path> -> per-log surfaced-marker path
+  printf '%s/.autodeploy-surfaced-%s' "$STATE" "$(printf '%s' "$1" | tr -c 'A-Za-z0-9' '_')"
+}
+
+# Strip a leading ISO-8601 (date -Is) timestamp so a persistent identical failure
+# dedupes across runs despite each run stamping a fresh time. A non-ISO fallback
+# timestamp is left intact (degrades to re-surfacing per run, never to a miss).
+_autodeploy_strip_ts() {  # <line> -> line without a leading ISO timestamp
+  printf '%s' "$1" | sed 's/^[0-9]\{4\}-[0-9]\{2\}-[0-9]\{2\}T[0-9:.,+-]*[[:space:]]*//'
+}
+
+# Sweep config/autodeploy-logs. For each configured log whose last line reports a
+# failure not already surfaced, enqueue a check wake carrying that line and record
+# it surfaced; clear the record when a log reports healthy again so a recurrence
+# re-arms. The enqueue happens BEFORE the marker advances, so a kill in between
+# re-surfaces (at-least-once) rather than dropping the failure. Returns 0 when it
+# enqueued at least one new failure (the caller then wakes), 1 otherwise.
+autodeploy_scan() {
+  local file="$CONFIG/autodeploy-logs" log last stripped marker mfile label reason found=1
+  [ -f "$file" ] || return 1
+  while IFS= read -r log || [ -n "$log" ]; do
+    log="${log#"${log%%[![:space:]]*}"}"
+    log="${log%"${log##*[![:space:]]}"}"
+    [ -n "$log" ] || continue
+    case "$log" in '#'*) continue ;; esac
+    mfile=$(_autodeploy_marker_path "$log")
+    last=$(fm_autodeploy_read_last_line "$log") || continue
+    [ -n "$last" ] || continue
+    if fm_autodeploy_line_failed "$last"; then
+      stripped=$(_autodeploy_strip_ts "$last")
+      marker=$(cat "$mfile" 2>/dev/null || true)
+      [ "$stripped" = "$marker" ] && continue       # this exact failure already surfaced
+      label=$(basename "$(dirname "$log")")
+      reason="check: autodeploy $label reports failure: $last"
+      fm_wake_append check "$log" "$reason" || return 1
+      printf '%s' "$stripped" > "$mfile"
+      found=0
+    else
+      rm -f "$mfile"                                 # healthy run re-arms the alarm
+    fi
+  done < "$file"
+  return "$found"
+}
+
 # Cheap heartbeat fleet-scan (the always-on twin of the daemon's catch-all). 0 if
 # any captain-relevant status has NOT already been surfaced to firstmate (its
 # content differs from the .hb-surfaced-<task> marker). Pure detect, no side
@@ -996,6 +1057,12 @@ EOF
   hb=$(( HEARTBEAT * (1 << streak) ))
   [ "$hb" -gt "$HEARTBEAT_MAX" ] && hb=$HEARTBEAT_MAX
   if [ "$(age_of "$STATE/.last-heartbeat")" -ge "$hb" ]; then
+    # Periodic autodeploy-log sweep, independent of the crew fleet-scan: enqueues a
+    # check wake per new failure and records it surfaced. Runs in every mode (the
+    # check wake it enqueues rides along in whatever wake this block emits, and the
+    # away-mode daemon escalates check wakes) so a deploy failure is caught whether
+    # or not the fleet has other work.
+    autodeploy_new=1; autodeploy_scan && autodeploy_new=0
     # Triage: in always-on mode a heartbeat is benign unless the cheap fleet-scan
     # turns up a captain-relevant status the per-wake path missed. Absorb the
     # no-change case (advance the schedule and back off exactly as wake() would,
@@ -1013,6 +1080,10 @@ EOF
       touch "$STATE/.last-heartbeat"
       mark_all_captain_relevant_surfaced
       wake "heartbeat"
+    elif [ "$autodeploy_new" = 0 ]; then
+      # A new autodeploy failure was enqueued above; surface it now as a check.
+      touch "$STATE/.last-heartbeat"
+      wake "check: autodeploy failure"
     else
       touch "$STATE/.last-heartbeat"
       echo $(( $(cat "$STATE/.heartbeat-streak" 2>/dev/null || echo 0) + 1 )) > "$STATE/.heartbeat-streak"
diff --git a/docs/architecture.md b/docs/architecture.md
index 6e8ad3f0f..18bab7036 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -17,12 +17,16 @@ A crew that declares `paused:` for a known external wait is separately absorbed
 Its initial normal-mode status signal still surfaces through the no-verb path, while away mode self-handles that routine signal and owns the later recheck.
 Fresh stale panes use the same current-state read before trusting the status log, so an active run or busy pane outranks an old captain-relevant status-log line left behind before validation.
 No-change heartbeats are also benign.
+Independent of the crew fleet-scan, every heartbeat also sweeps the optional local `config/autodeploy-logs` list (`bin/fm-watch.sh`'s `autodeploy_scan`): each configured status log's last line is read against the autodeploy failure convention (`bin/fm-autodeploy-lib.sh`'s `fm_autodeploy_line_failed`, shared with `bin/fm-bootstrap.sh`'s session-start counterpart check), a new failure enqueues a `check:` wake and is marked surfaced so it does not repeat, and a later healthy line clears that marker so a recurrence re-arms.
 Absorbed wakes advance their suppression markers, log to `state/.watch-triage.log`, and keep the watcher blocking without a queue record or LLM turn.
 After each drain, `fm-wake-drain.sh` runs the same liveness guard as the supervision scripts, so a lapsed watcher chain surfaces even on a turn that only drains and handles queued wakes.
 Routine watcher polling, supervision no-ops, elapsed waiting time, and absorbed benign wakes stay silent.
 A declared external wait trades that silence for one bounded recheck per pause window, so a forgotten pause cannot remain invisible indefinitely.
 Crew status files are append-only wake-event logs, not current-state fields.
 `bin/fm-crew-state.sh <id>` is the cheap current-state read for an actionable heartbeat review: it attributes the matching no-mistakes run, active or terminal, to the crew's own branch and keeps that run-step authoritative even if the pane has closed.
+Every no-mistakes call inside that read, and the whole read itself as watched from `crew_absorb_class`, is force-killed on a hard timeout (`FM_CREW_STATE_NM_TIMEOUT`/`FM_CREW_STATE_NM_KILL_AFTER`, `FM_CREW_ABSORB_TIMEOUT`/`FM_CREW_ABSORB_KILL_AFTER`) rather than merely signaled.
+A plain `timeout N cmd` with no kill-after is only advisory once N elapses, and an uncooperative no-mistakes CLI defeating that soft bound under concurrent validation load caused the watcher's liveness beacon to stall for 89 minutes on 2026-07-09 before this fix landed.
+A timed-out read reads as `none` (not provably working), never a false `working`, so it surfaces rather than being silently absorbed.
 During no-mistakes' `ci` monitor phase, it also reads the ci step log tail because `axi status` reports both "still waiting on checks" and "checks green, waiting on merge" as `ci,running`.
 The most recent recognized ci log marker wins, so checks-green monitoring reports done while a later re-arm, failed-check, or issue marker returns the crew to working.
 Only when no matching run exists does it fall back to the pane busy-signature and then a status-log event whose verb maps to a recognized run-state; a dead pane without a run reports unknown instead of trusting a stale log.
@@ -95,6 +99,7 @@ Codex App support is recorded in `docs/codex-app-backend.md`; it is not selectab
 
 Crewmates never intentionally touch your project clone; [treehouse](https://github.com/kunchenguid/treehouse) pools clean worktrees for tmux, herdr, zellij, and cmux tasks, while Orca creates its own worktrees for `backend=orca`.
 For ship and scout work, `fm-spawn.sh` refuses to launch unless the resolved task path is a real git worktree root that is distinct from the project primary checkout.
+Pooled worktrees of the same project share a leaf directory basename, which collides on Docker Compose's default project-naming; see `docs/configuration.md` "Docker Compose project isolation" for the per-worktree `compose_project=` name `fm-spawn.sh` derives to avoid it.
 
 The firstmate repo has one extra exposure because it can dispatch crewmates to work on itself.
 Its operating checkout (`FM_ROOT`) and the disposable crewmate worktrees are all linked git worktrees of the same repository, so the valid discriminator is branch state, not whether the checkout is linked.
@@ -129,6 +134,13 @@ Secondmate launches are exempt because they resolve the secondmate harness and a
 Unsupported effort values are still recorded in task meta when passed to `fm-spawn.sh`, but the launch template omits any effort flag that the selected harness does not accept.
 That keeps spawn launch compatible across claude, codex, grok, pi, and opencode while preserving the requested profile for later audit.
 
+A crew-dispatch profile can also carry `ultracode: true` with an optional `ultracode_role` (today only `independent-review`): a task matched to that profile must get a genuinely independent second pass on its finished diff, dispatched as its own separate task rather than a sub-task the implementing crewmate spawns, before it can go PR-ready.
+Three mechanical guardrails back this tiering, each a structurally separate check from the natural-language rule match so a misclassified task cannot slip a cheaper tier on one judgment call.
+`bin/fm-risk-tripwire.sh` greps a task's brief text and, once code exists, its changed file paths for migration, auth, schema, and security signals; a hit floors the task to the safety-critical profile (`opus`/`xhigh`, ultracode `independent-review`) regardless of which rule was matched.
+`bin/fm-tier-guard.sh` is a read-only Validate-time check that escalates a trivial (`haiku`/`low`) task in place once its actual diff size or elapsed time outgrows that tier's envelope, plus a general heavy-scale ceiling that escalates any tier once its diff crosses it; it reuses `bin/fm-review-diff.sh --stat` for the authoritative diff size.
+`bin/fm-ultracode-guard.sh` tracks the ultracode requirement through a plain `state/<id>.ultracode` marker (`role=`, then `reviewed_by=`), the same marker convention as `state/.afk`: it flags the requirement right after spawn (also on a risk-tripwire hit), records a distinct separately-dispatched reviewer task as the independent review, and refuses to let an ultracode-flagged task go PR-ready until that review is recorded.
+None of the three modify `fm-spawn.sh` or task meta.
+
 ## Optional secondmates
 
 `data/secondmates.md` records persistent domain supervisors with natural-language scopes, project clone lists, and home paths.
@@ -228,6 +240,12 @@ Fetches blocked by an orphaned `.git/packed-refs.lock` use bounded retries and r
 Local-only projects, clones without an origin remote, and fetch failures remain benign skips.
 The refresh also prunes local branches whose remote is gone and that no worktree still needs.
 
+A landed ship task's `projects/<name>` dev clone is not the same checkout as a live deployment of that project running elsewhere on the host.
+When a project has a row in `data/nas-deployments.md`, non-scout, non-secondmate, non-forced teardown also best-effort fast-forwards that project's separate live NAS checkout and restarts its recorded pm2 process(es), verifying each comes back online (`bin/fm-nas-deploy-sync.sh`).
+A forced teardown (`--force`) skips this sync, since it carries no landed-work guarantee.
+It mirrors the same clean/fast-forward-only safety as the clone refresh above, including the bounded orphaned-packed-refs-lock recovery, and reports a diverged or dirty checkout as `STUCK:` rather than touching it; a project absent from the mapping is a silent no-op.
+Every filesystem/git touch of the NAS checkout is time-bounded so an unreachable mount cannot hang the teardown call that triggered it.
+
 ## Self-updates stay safe
 
 `/updatefirstmate` fast-forwards the running firstmate repo and registered secondmate homes from `origin`, then re-reads updated instructions and nudges updated secondmates without touching project clones.
diff --git a/docs/cmux-backend.md b/docs/cmux-backend.md
index 5859e7f2d..305a582e6 100644
--- a/docs/cmux-backend.md
+++ b/docs/cmux-backend.md
@@ -173,7 +173,7 @@ No session field is needed - unlike herdr/zellij there is no session layer to re
 | Duplicate task check | `cmux workspace list --json --id-format uuids`, match by home-scoped `.title` | cmux enforces NO title uniqueness for workspaces OR surfaces/tabs - verified live: two workspaces, and two surfaces within one workspace, all created successfully sharing one title. The adapter's own duplicate check is required, mirroring herdr/zellij, and it checks the scoped title such as `fm-firstmate-<8hex>-<id>`. |
 | Create task workspace | `cmux new-workspace --name <scoped-title> --cwd <dir> --focus false --id-format uuids` | Creates a workspace with exactly one default surface. `--focus` verified to already default to `false` for workspace/surface/pane creation - no focus-restore dance needed, unlike zellij. The caller passes `fm-<id>`, but the adapter creates `fm-<home-label>-<id>`. |
 | Workspace/surface id resolution | `cmux workspace list --json --id-format uuids` (find by home-scoped title), then `cmux list-panes --workspace <id> --json --id-format uuids` (`.panes[0].selected_surface_id`) | A freshly created workspace already has exactly one surface, so no separate `new-surface` call is needed. `--id-format uuids` (or `both`) is required to get a bare `id` field in JSON; the default JSON shape returns only short `ref` strings like `"workspace:2"`. |
-| Liveness / target readiness | `cmux list-panes --workspace <id> --json --id-format uuids`, checking the surface id appears in `.panes[].surface_ids` | Structural existence check, NOT a content read - see "read-screen fails on a genuinely fresh surface" below for why `read-screen` cannot be used here. Verified reliable on a completely untouched fresh surface, unlike `read-screen`. |
+| Liveness / target readiness | `cmux list-panes --workspace <id> --json --id-format uuids`, checking the surface id appears in `.panes[].surface_ids` | Structural existence check, NOT a content read - see "read-screen fails on a genuinely fresh surface" below for why `read-screen` cannot be used here. Verified reliable on a completely untouched fresh surface, unlike `read-screen`. `fm_backend_cmux_surface_exists` captures `list-panes`' own output and checks ITS exit status before piping into `jq -e`: on jq 1.6, `jq -e` over truly empty stdin exits 0, so piping a failed/empty `list-panes` call straight into `jq` would misread a dead target as a live one. |
 | Send literal (unsubmitted) | `cmux send --workspace <id> --surface <id> -- <text>` | Verified live: does NOT auto-submit - text sits at the prompt, unexecuted, until a separate Enter. Matches every other backend's "literal-then-separate-Enter" contract. The `--` separator keeps option-shaped text such as `--help` literal. |
 | Send key | `cmux send-key --workspace <id> --surface <id> <key>` | Verified names: `enter`, `escape`, `ctrl-c` all work directly (lowercase, hyphenated). Escape is natively supported (unlike Orca); Ctrl-C correctly interrupted a running `sleep 100` in a live test. cmux's own key vocabulary is richer still (`ctrl-d`/`ctrl-z`/`ctrl-\\`, semantic aliases `sigint`/`sigtstp`/`sigquit`), but firstmate's shared vocabulary only needs these three today. |
 | Send + submit, composed | `send` then `send-key enter` | cmux has no single-call atomic "type and submit" primitive (unlike tmux's `send-keys ... Enter` or herdr's `pane run`); `fm_backend_cmux_send_text_line` composes the two calls, mirroring zellij's equivalent composition. |
diff --git a/docs/configuration.md b/docs/configuration.md
index 20d7fa4f3..c26fa74ae 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -80,6 +80,15 @@ The caller-facing label remains `fm-<id>`, but the actual cmux workspace title i
 Test cleanup must use the guarded path described in [`docs/cmux-backend.md`](cmux-backend.md)'s "Test safety" section, never enumerate-and-close every workspace.
 The `config/backend` file is not inherited by secondmate homes.
 
+## Docker Compose project isolation (per-worktree)
+
+Two treehouse worktrees of the same project always share the same leaf directory basename (e.g. `wealthsync`), so Docker Compose's default project-naming, derived from the current directory's basename, collides across them on container, volume, and network names.
+For every ship/scout spawn, regardless of runtime backend, `fm-spawn.sh` derives a stable, Compose-safe project name from the worktree's own pool-slot path once it is resolved (a treehouse pool worktree is `.../<project>-<hash>/<slot>/<repo-name>`; the name is `<pool>-<slot>`, lowercased, with non-`[a-z0-9-]` characters replaced by `-` and repeats collapsed), falling back to the worktree's own leaf name or the task id when the path lacks that pool-slot shape (e.g. a non-treehouse backend).
+The name is written to `.treehouse-compose-project` in the worktree root, excluded from git via that worktree's own `.git/info/exclude` so it never blocks teardown's dirty-worktree check or leaks into a crewmate's commit, and recorded in `state/<id>.meta` as `compose_project=<name>`.
+It is stable across respawns into the same pool slot, not per task id, so a stale Compose stack left by a prior task in that slot is naturally superseded rather than accumulating orphaned volumes under a new name every respawn.
+Secondmates never get this marker or meta field; they run in their own firstmate home, not a per-task pool worktree.
+`fm-brief.sh` tells the crewmate, in both ship and scout briefs, to read `.treehouse-compose-project` and pass it explicitly on every `docker compose` invocation (e.g. `docker compose -p "$(cat .treehouse-compose-project)" up -d`), since exported env vars do not reliably persist across separate tool-call invocations; it also flags fixed host ports as a related collision vector and recommends `docker compose port <service> <container-port>` or another deterministic per-worktree-derived port instead of a hard-coded one.
+
 ## Away-mode supervisor backend (FM_SUPERVISOR_BACKEND / FM_SUPERVISOR_TARGET)
 
 The `/afk` sub-supervisor injects escalation digests into firstmate's own pane independently of where new task endpoints are spawned.
@@ -90,6 +99,24 @@ That keeps a tmux pane nested inside herdr on the tmux transport, matching the r
 Target detection uses `FM_SUPERVISOR_TARGET`, then `$TMUX_PANE`, then `"${HERDR_SESSION:-default}:${HERDR_PANE_ID}"` under herdr, then the legacy `firstmate:0` tmux fallback with a warning.
 Selecting any other supervisor backend, including `zellij`, `orca`, or `cmux`, refuses at daemon startup instead of trying tmux injection primitives against a non-tmux pane.
 
+## Critical service watch (config/critical-services)
+
+`config/critical-services` (local, gitignored) lists systemd unit names, one per non-empty, non-comment line, that firstmate watches for the `failed` state.
+At every session start bootstrap runs `systemctl is-failed` (read-only, no root) on each listed unit and prints `SERVICE_FAILED: <unit> - failed since <timestamp>` for any that are failed, dropping the `failed since` clause when the unit's `StateChangeTimestamp` is unavailable.
+It exists so a silently-failed critical unit, the kind of boot-time oneshot whose failure can otherwise go unnoticed for days, surfaces the next time firstmate starts rather than never.
+An absent or empty file is a no-op, and a host without `systemctl` (no systemd) silently does nothing.
+The file is not inherited by secondmate homes, whose same-machine bootstrap would only re-check the same units.
+See [`examples/critical-services`](examples/critical-services) for a copyable config; report a failed unit to the captain in plain language and never restart it, since a unit that failed may be unsafe to restart without knowing why.
+
+## Upstream drift watch (upstream remote)
+
+For a firstmate maintainer's own working copy, post remote-swap `origin` is the captain's fork and `upstream` is the read-only parent template (`kunchenguid/firstmate`); see [`CONTRIBUTING.md`](../CONTRIBUTING.md) for the inverted layout.
+At every session start bootstrap prints an always-on FYI line, `UPSTREAM_DRIFT: local main is <ahead> ahead / <behind> behind upstream/main, last reconciled <days>d ago (<date>)`, computed unconditionally from whatever `refs/remotes/upstream/main` currently holds, without ever fetching in that detect-only path.
+The network fetch that refreshes `upstream/main` runs only in the locked fleet-sync sweep, bounded by `FM_UPSTREAM_FETCH_TIMEOUT` (default 20s); a stalled or offline fetch there just leaves the last-fetched ref in place.
+The wording escalates to `UPSTREAM_DRIFT: this repo's upstream sync needs attention - ...` once local `main` is more than 30 commits behind `upstream/main`, or their merge-base is older than 10 days.
+Either way the line only reports - reconciling upstream (fetch, merge into local `main`, resolve conflicts, land local-only) stays a deliberately dispatched, reviewed ship task, never automated.
+It is a no-op without an `upstream` remote, an `upstream/main` ref, or a local `main` branch.
+
 ## Away-mode wedge alarm channels (config/wedge-alarm)
 
 When away-mode injection wedges past `FM_MAX_DEFER_SECS`, the sub-supervisor raises a loud, rate-limited alarm.
@@ -210,6 +237,10 @@ This section is the single owner of the canonical schema and its per-field seman
 Per rule, `when` and `use` are required.
 `use` may be a single profile object or an ordered array of profile objects; the single-object form stays fully backward-compatible, and every profile needs `harness`.
 `use.model`, `use.effort`, and `why` are optional.
+`use.ultracode` and `use.ultracode_role` are optional.
+A profile with `ultracode: true` means a task matched to this rule must get a genuinely independent second pass on its finished diff before PR-ready, launched as its own separately dispatched task, never a sub-task the implementing crewmate spawns itself; `ultracode_role` is a short label for what that pass should do (`independent-review` is the only role this fleet's own rules use today).
+`bin/fm-ultracode-guard.sh` tracks this mechanically; `AGENTS.md` section 4's dispatch procedure covers when firstmate flags it, and section 7's Validate step covers the PR-ready gate it backs.
+`ultracode` must be a JSON boolean and `ultracode_role`, when present, a non-empty string; both bootstrap validation and `bin/fm-dispatch-select.sh` reject a present-but-wrong-type value outright rather than silently dropping it, because a rule that looks ultracode-flagged but resolves as inert would skip the independent-review guard without anyone noticing.
 `select` is optional and currently supports `quota-balanced`.
 Absent `select` means use the first array element, or the only object in the single-object form; the first array element is the deterministic tie-break and the ultimate fallback.
 `default` is optional.
@@ -219,7 +250,7 @@ If a selected profile carries an effort value the chosen harness does not accept
 See [`docs/examples/crew-dispatch.json`](examples/crew-dispatch.json) for a starting point to copy into local `config/crew-dispatch.json`.
 When the file exists, bootstrap validates it with `jq`.
 Valid files stay silent by default; with `FM_BOOTSTRAP_VERBOSE_FACTS=1`, bootstrap emits `BOOTSTRAP_INFO: crew dispatch active config/crew-dispatch.json` plus one `BOOTSTRAP_INFO:` fact per rule and default profile.
-Malformed JSON, an unverified harness, a malformed array profile, an unknown `select`, or an effort value unsupported by that harness is reported as `CREW_DISPATCH: invalid config/crew-dispatch.json - ...`; missing `jq` is reported through the normal `MISSING: jq` install-consent flow.
+Malformed JSON, an unverified harness, a malformed array profile, an unknown `select`, an effort value unsupported by that harness, a non-boolean `ultracode`, or a non-string `ultracode_role` is reported as `CREW_DISPATCH: invalid config/crew-dispatch.json - ...`; missing `jq` is reported through the normal `MISSING: jq` install-consent flow.
 If no dispatch rule fits, firstmate uses the dispatch profile `default` when present, then falls back to `config/crew-harness`.
 Because the spawn backstop is gated by file presence, any fallback path after a missing match, validation error, or missing `jq` still passes a resolved harness explicitly until the file is fixed or removed.
 Secondmate homes inherit this file from the primary, so a secondmate's own crewmates apply the same dispatch profile behavior.
@@ -368,9 +399,12 @@ FM_HEARTBEAT_MAX=7200   # heartbeat backoff cap
 FM_CHECK_INTERVAL=300   # seconds between slow checks (authenticated merge polls, custom checks, or X-mode dispatch)
 FM_CHECK_TIMEOUT=30     # seconds allowed per slow check script
 FM_CODEX_WATCH_CHECKPOINT=180   # seconds per foreground watcher checkpoint in Codex primary supervision
-FM_CREW_STATE_NM_TIMEOUT=10   # seconds allowed per no-mistakes query inside fm-crew-state.sh
+FM_CREW_STATE_NM_TIMEOUT=10   # seconds allowed per no-mistakes query inside fm-crew-state.sh before its initial signal
+FM_CREW_STATE_NM_KILL_AFTER=2   # grace seconds after that signal before a still-running no-mistakes query is force-killed (SIGKILL), not just asked to stop
 FM_CREW_STATE_RUNS_LIMIT=200  # recent no-mistakes runs rows scanned when cross-branch attribution falls back from axi status
 FM_CREW_STATE_BIN=bin/fm-crew-state.sh   # test override for the current-state reader used by working/paused watcher triage
+FM_CREW_ABSORB_TIMEOUT=45   # seconds allowed for the ENTIRE fm-crew-state.sh read inside crew_absorb_class before its initial signal - defense in depth around FM_CREW_STATE_NM_TIMEOUT, bounding the watcher's own liveness beacon against a hung read regardless of cause
+FM_CREW_ABSORB_KILL_AFTER=5   # grace seconds after that signal before a still-running fm-crew-state.sh read is force-killed
 FMX_PAIRING_TOKEN=      # X mode pairing token; .env opt-in authorizes replies and eligible lifecycle actions
 FMX_RELAY_URL=https://myfirstmate.io   # optional X relay override, mainly for local relay development
 FMX_ENV_FILE=           # optional alternate .env file for direct X client invocations; bootstrap still checks $FM_HOME/.env
@@ -384,6 +418,7 @@ FM_LOCK_STALE_AFTER=2   # seconds before dead-pid lock records can be reclaimed;
 FM_GUARD_GRACE=300      # seconds before guard warnings, arm health checks, and the primary turn-end guard treat a watcher beacon as stale
 FM_ARM_CONFIRM_TIMEOUT=10   # seconds fm-watch-arm waits to confirm a fresh watcher before reporting FAILED
 FM_ARM_ATTACH_POLL=0.5  # seconds between checks while fm-watch-arm is attached to an existing healthy watcher cycle
+FM_TURNEND_ARM_WAIT=    # seconds the turn-end guard polls fm_watcher_healthy before blocking, giving a backgrounded re-arm time to register its lock; unset defaults to FM_ARM_CONFIRM_TIMEOUT (docs/turnend-guard.md "Shared Predicate")
 FM_OPENCODE_ARM_READY_TIMEOUT_MS=12000   # milliseconds the OpenCode primary watcher plugin waits for an arm attempt to report started, healthy, wake, or failure
 FM_WATCHER_STALE_GRACE=300   # defaults to FM_GUARD_GRACE; seconds a live watcher lock may have a stale beacon before re-arm errors
 FM_SIGNAL_GRACE=30      # seconds to coalesce nearby status and turn-end signals into one wake
@@ -392,9 +427,22 @@ FM_CLASSIFY_PAUSED_VERB=paused     # leading status verb for a declared external
 FM_STALE_ESCALATE_SECS=240         # idle seconds before a provably-working stale pane escalates; stale panes whose crew is not provably working surface immediately unless they declare the pause verb
 FM_PAUSE_RESURFACE_SECS=3600       # seconds before an idle declared external wait re-surfaces for a recheck in the watcher or away-mode daemon
 FM_WEDGE_DEMAND_INSPECT_COUNT=3    # consecutive provably-working stale escalations on the same unchanged pane before demand-deep-inspection is added
+FM_TIER_TRIVIAL_MAX_LINES=30       # fm-tier-guard.sh: changed-line count a trivial (haiku/low) task may reach before escalation fires
+FM_TIER_TRIVIAL_MAX_FILES=2        # fm-tier-guard.sh: changed-file count a trivial (haiku/low) task may reach before escalation fires
+FM_TIER_TRIVIAL_MAX_AGE_SECONDS=1800   # fm-tier-guard.sh: elapsed seconds a trivial (haiku/low) task may run before escalation fires (30 min)
+FM_TIER_HEAVY_MIN_LINES=400        # fm-tier-guard.sh: changed-line count that escalates any tier via the general heavy-scale ceiling
+FM_TIER_HEAVY_MIN_FILES=8          # fm-tier-guard.sh: changed-file count that escalates any tier via the general heavy-scale ceiling
 FM_WATCH_TRIAGE_LOG_MAX_BYTES=262144   # size cap for the watcher's absorbed-wake debug log
 FM_FLEET_SYNC_BOOTSTRAP_TIMEOUT=     # optional seconds allowed for bootstrap's best-effort clone refresh; unset/blank defaults to max(20, 5 + 3 * origin-backed-project-count)
+FM_UPSTREAM_FETCH_TIMEOUT=20   # seconds allowed for the locked fleet-sync sweep's bounded `git fetch upstream` (UPSTREAM_DRIFT); bounded by timeout, gtimeout, or a background-kill fallback when neither binary is installed
 FM_FLEET_PRUNE=1        # set to 0 to skip pruning local branches whose upstream is gone
+FM_UPSTREAM_FETCH_TIMEOUT=20   # seconds allowed for the locked fleet-sync sweep's best-effort `git fetch upstream` behind the UPSTREAM_DRIFT diagnostic; a stall just leaves the last-fetched ref in place
+FM_AUTODEPLOY_LOG_READ_TIMEOUT=5   # seconds allowed per config/autodeploy-logs status-log read before fm-autodeploy-lib.sh's fm_autodeploy_read_last_line gives up on a hung/unreachable log (NAS hiccup)
+FM_NAS_DEPLOYMENTS_OVERRIDE=   # alternate data/nas-deployments.md path for fm-nas-deploy-sync.sh, mainly for tests
+FM_NAS_SYNC_TIMEOUT=15   # seconds allowed per filesystem/git touch of fm-nas-deploy-sync.sh's $NAS_PATH before it is killed, so an unreachable NAS mount cannot hang fm-teardown.sh's caller
+FM_NAS_SYNC_PACKED_REFS_LOCK_RETRIES=3        # fetch retries after fm-nas-deploy-sync.sh hits the orphaned .git/packed-refs.lock signature on the shared NAS checkout (two landed teardowns for the same project can race it)
+FM_NAS_SYNC_PACKED_REFS_LOCK_RETRY_WAIT_SECS=1 # seconds fm-nas-deploy-sync.sh waits before each of those retries
+FM_NAS_SYNC_PACKED_REFS_LOCK_AGE_SECS=30       # min mtime age before fm-nas-deploy-sync.sh treats a leftover packed-refs.lock as provably stale
 FM_STALE_WORKTREE_LOCK_AGE_SECS=30       # min mtime age before fm-teardown.sh treats a leftover worktree git index.lock as provably stale
 FM_TREEHOUSE_RETURN_LOCK_RETRIES=3        # retries after a treehouse return fails on the transient git index.lock signature
 FM_TREEHOUSE_RETURN_LOCK_RETRY_WAIT_SECS=1 # seconds fm-teardown.sh waits before each retry after that signature
diff --git a/docs/examples/autodeploy-logs b/docs/examples/autodeploy-logs
new file mode 100644
index 000000000..b3828ac86
--- /dev/null
+++ b/docs/examples/autodeploy-logs
@@ -0,0 +1,30 @@
+# config/autodeploy-logs - poll-based autodeploy status logs firstmate watches
+# for failure, on its periodic sweep (bin/fm-watch.sh's autodeploy_scan) and at
+# every session-start bootstrap (bin/fm-bootstrap.sh's autodeploy_logs_check).
+# Copy this into a local, gitignored config/autodeploy-logs and replace the
+# placeholder with your own status-log path(s). One absolute log path per
+# non-empty, non-comment line; blank lines and full-line "#" comments are
+# ignored.
+#
+# Each listed log is expected to be a durable, timestamped, append-only status
+# log written by an external per-project autodeploy tool (e.g. beamanalyzer's
+# deploy job), whose LAST line reports the most recent run's health: a healthy
+# run ends in an "ok ..." rollup and a failed one in an "ALERT ..." rollup, plus
+# firstmate's own STUCK:/FAILED:/needs-attention alert-line format. The match set
+# lives in bin/fm-autodeploy-lib.sh's fm_autodeploy_line_failed; the ok/ALERT
+# rollup is the deploy tool's own convention, not something bin/fm-fleet-sync.sh
+# produces. Both readers check only that last line; when it reports a failure,
+# the periodic sweep wakes and relays the line to the captain once, staying quiet
+# about that same failure until it changes or a later successful run clears it,
+# while bootstrap surfaces it fresh every session start as a read-only diagnostic
+# - the session-start counterpart for whenever no watcher was armed to catch it
+# between sessions. Neither ever touches the deploy: reading the log is the whole
+# job.
+#
+# An ABSENT or empty config/autodeploy-logs is a no-op. A missing or temporarily
+# unreadable log (e.g. a NAS mount hiccup) is silently skipped rather than
+# alarmed, so a transient outage does not spuriously wake the captain.
+#
+# The path below is an illustrative placeholder - list the status log(s) whose
+# silent deploy failure would actually matter for this fleet.
+/home/you/.local/state/my-app-autodeploy/status.log
diff --git a/docs/examples/crew-dispatch.json b/docs/examples/crew-dispatch.json
index 8aec19650..8f27118e6 100644
--- a/docs/examples/crew-dispatch.json
+++ b/docs/examples/crew-dispatch.json
@@ -18,6 +18,21 @@
       ],
       "select": "quota-balanced",
       "why": "Use a strong coding profile for broad design and implementation work."
+    },
+    {
+      "when": "The task changes this firstmate repo's own supervision backbone: bin/fm-watch.sh, bin/fm-guard.sh, a harness turnend-guard hook, or other logic the always-on watcher/guard rely on for correctness.",
+      "use": { "harness": "claude", "model": "sonnet", "effort": "xhigh" },
+      "why": "A narrow set of scripts backs every other task's supervision; a subtle regression here is silent and fleet-wide, so it earns deeper reasoning than the general firstmate-repo default even though the model tier does not need to change."
+    },
+    {
+      "when": "Safety-critical, security-sensitive, or hard-to-reverse work: schema or data migrations, auth/session/credential changes, payment or billing logic, or anything touching a frozen or safety-critical spec.",
+      "use": { "harness": "claude", "model": "opus", "effort": "xhigh", "ultracode": true, "ultracode_role": "independent-review" },
+      "why": "A model reviewing its own irreversible change has anchoring bias; an independent pass and the strongest available model are both cheap relative to the cost of a bad migration or a broken safety-flow."
+    },
+    {
+      "when": "A genuine architectural or product tradeoff with long-term consequences that the crewmate must reason through and justify, not just implement.",
+      "use": { "harness": "claude", "model": "opus", "effort": "xhigh" },
+      "why": "The deliverable's entire value is the quality of the argued judgment call; this is low-volume, high-stakes work, so the cost delta of the top model is bounded and well spent."
     }
   ],
   "default": { "harness": "codex", "model": "gpt-5.5", "effort": "medium" }
diff --git a/docs/examples/critical-services b/docs/examples/critical-services
new file mode 100644
index 000000000..5b4cf5373
--- /dev/null
+++ b/docs/examples/critical-services
@@ -0,0 +1,19 @@
+# config/critical-services - systemd units firstmate watches for the failed
+# state (bin/fm-bootstrap.sh's critical_services_check). Copy this into a local,
+# gitignored config/critical-services and replace the placeholders with your own
+# unit names. One systemd unit name per non-empty, non-comment line; blank lines
+# and full-line "#" comments are ignored.
+#
+# At every session start, firstmate runs `systemctl is-failed` (read-only, no
+# root) on each listed unit and surfaces a SERVICE_FAILED line for any that are
+# failed, then reports it to the captain in plain language. It never restarts a
+# unit: a unit that failed may be unsafe to restart without knowing why.
+#
+# An ABSENT or empty config/critical-services is a no-op. On a host without
+# systemd (no systemctl) the check silently does nothing.
+#
+# The names below are illustrative placeholders - list the units whose silent
+# failure would actually matter on this machine (the oneshot that runs a
+# production app at boot, a backup timer, a sync daemon, and so on).
+my-app.service
+nightly-backup.timer
diff --git a/docs/herdr-backend.md b/docs/herdr-backend.md
index 0bed40dd1..a9273ca7a 100644
--- a/docs/herdr-backend.md
+++ b/docs/herdr-backend.md
@@ -739,6 +739,18 @@ The agent prompt glyphs `❯` (claude) and `›` (codex) read `empty` either way
 Per-backend dead-shell coverage: `tests/fm-daemon.test.sh`'s `test_tmux_composer_state_bare_shell_is_unknown` and `test_inject_msg_defers_on_dead_shell_unknown` (tmux + the injector), `tests/fm-backend-herdr.test.sh`'s `test_composer_state_unknown_when_no_composer_row_found`, `tests/fm-backend-orca.test.sh`'s `test_composer_state_bare_shell_prompt_is_unknown`, and `tests/fm-backend-cmux.test.sh`'s `test_composer_state_unknown_when_no_composer_row_found`.
 The herdr incident regressions (`tests/fm-backend-herdr.test.sh`'s composer-state, wait-for-working, and send-text-submit sections) stay green, and `shellcheck bin/*.sh bin/backends/*.sh tests/*.sh` passes clean.
 
+## Incident (2026-07-14): no-break-space composer padding read as a false "Enter swallowed"
+
+`fm-send`'s submit-verify loop reported `exit 1` / "Enter swallowed; text left in composer" three times against a genuinely-submitted steer to a `claude` target, each time while the crewmate was already processing the message (`bin/fm-peek.sh` on the target confirmed the send had landed).
+Root cause: claude draws its cleared composer prompt as the glyph `❯` followed by a NON-BREAKING SPACE (U+00A0), not an ASCII space.
+Under a glibc UTF-8 locale, `[[:space:]]` does not classify U+00A0 as whitespace, so the shared classifier's ASCII-only trimming left the U+00A0 behind as phantom content and read the otherwise-empty composer as `pending`.
+`fm_tmux_submit_enter_core` then read `pending` on every retry, exhausted them, and returned the `pending` verdict that `fm-send` surfaces as the false swallow.
+The false alarm was intermittent because a busy footer or dim ghost text landing on the same cursor row both read empty, so the bare `❯<nbsp>` line only showed through on some captures, which is why it took three occurrences to pin.
+
+**Fix.** `fm_composer_classify_content` now normalizes U+00A0 and its narrow sibling U+202F to an ASCII space (`fm_composer_normalize_ws`, `bin/fm-composer-lib.sh`) before trimming, so a composer empty but for no-break padding reads `empty` on every backend, while real typed text separated by a no-break space still classifies `pending`.
+
+**Evidence and regression coverage.** `tests/fm-composer-nbsp.test.sh` records the exact captured cursor-row bytes (`tmux capture-pane -e -p`, tmux 3.x, 2026-07-14) and pins the fix at four layers: the shared classifier, `fm_tmux_composer_state` on the real styled line, `fm_tmux_submit_enter_core`, and the full `fm-send` exit code.
+
 ## Incident (2026-07-10): away-mode injection wedged all night on the primary claude-on-herdr composer's ghost text
 
 The captain woke to find away-mode had never injected: 20 escalations buffered, the max-defer wedge marker at 30623s undelivered, the wake queue at 65.
diff --git a/docs/orca-backend.md b/docs/orca-backend.md
index 6be2ad58f..b10e948e3 100644
--- a/docs/orca-backend.md
+++ b/docs/orca-backend.md
@@ -71,7 +71,7 @@ Spawn:
 1. Ensure the project repo is registered in Orca, adding it with `orca repo add --path` when needed.
 2. Create an independent Orca worktree with `orca worktree create --repo id:<repo> --name fm-<id> --no-parent --setup skip`.
 3. Reuse the terminal returned by Orca worktree creation only when it appears in the verified `result.terminal.handle` shape, or create a titled terminal in that worktree when Orca returns only the worktree.
-4. Install firstmate's per-harness turn-end hooks in the Orca worktree.
+4. Write the docker-compose isolation marker (`.treehouse-compose-project`) and install firstmate's per-harness turn-end hooks in the Orca worktree.
 5. Write metadata, then send `GOTMPDIR` export and the selected harness launch through the recorded Orca terminal.
 
 Operation routing:
diff --git a/docs/scripts.md b/docs/scripts.md
index d0815745c..7c89c918c 100644
--- a/docs/scripts.md
+++ b/docs/scripts.md
@@ -16,7 +16,7 @@ The shared no-mistakes gate refusal used by `fm-spawn.sh`, `fm-send.sh`, and `fm
 | `fm-update.sh`           | Fast-forward-only self-update of firstmate and secondmate homes from origin          |
 | `fm-backlog-handoff.sh`  | Validate and delegate queued backlog-item moves into a secondmate home               |
 | `fm-decision-hold.sh`    | Create, verify, complete, and resolve durable captain-held decisions                 |
-| `fm-brief.sh`            | Scaffold ship, scout, secondmate-charter, and Herdr-lab briefs                       |
+| `fm-brief.sh`            | Scaffold ship, scout, secondmate-charter, Herdr-lab, and Light-verify briefs         |
 | `fm-herdr-lab.sh`        | Provision and guardedly operate an isolated, never-default Herdr lab session         |
 | `fm-ensure-agents-md.sh` | Ensure a project's real `AGENTS.md`, its `CLAUDE.md` symlink, and the canonical self-governance section |
 | `fm-guard.sh`            | Warn on primary-checkout tangles, pending queued wakes, and stale watcher liveness   |
@@ -72,6 +72,7 @@ The shared no-mistakes gate refusal used by `fm-spawn.sh`, `fm-send.sh`, and `fm
 | `fm-pr-merge.sh`         | Record PR metadata, then merge a task's canonical full GitHub URL                    |
 | `fm-promote.sh`          | Promote a scout task in place to a protected ship task                               |
 | `fm-teardown.sh`         | Fail-closed teardown: return landed ship worktrees, require completed scout deliverables, retire secondmate homes |
+| `fm-nas-deploy-sync.sh`  | Best-effort fast-forward sync and pm2 restart of a project's live NAS checkout after a landed ship-task teardown |
 | `fm-harness.sh`          | Detect the running harness and resolve crew or secondmate harness, model, and effort |
 | `fm-lock.sh`             | Per-home firstmate session lock                                                      |
 | `fm-x-lib.sh`            | Shared X-mode config, relay, and reply-threading helpers                             |
diff --git a/docs/turnend-guard.md b/docs/turnend-guard.md
index 344417161..ecb631d8d 100644
--- a/docs/turnend-guard.md
+++ b/docs/turnend-guard.md
@@ -29,7 +29,9 @@ If no task is in flight, it exits silently.
 If work is in flight, it requires `fm_watcher_healthy <state-dir> <watch-path> [grace-seconds] [home]` from `bin/fm-wake-lib.sh`.
 That is the same identity-matched live lock and fresh beacon check used by `bin/fm-watch-arm.sh`.
 A stale beacon blocks even if a watcher pid is still live.
-A fresh leftover beacon blocks if the watcher lock is missing, dead, or identity-mismatched.
+A fresh leftover beacon does not block on the first unhealthy check: a legitimate re-arm (`bin/fm-watch-arm.sh`, backgrounded) needs a brief moment to fork the new watcher and register its lock after the old one released it, so the guard polls `fm_watcher_healthy` on a short interval and only blocks once a bounded deadline passes still unhealthy, exiting 0 the instant a live lock registers.
+That deadline defaults to the same budget `bin/fm-watch-arm.sh` gives a freshly forked watcher to confirm (`FM_ARM_CONFIRM_TIMEOUT`, 10 seconds) and is independently overridable via `FM_TURNEND_ARM_WAIT`.
+A watcher lock that is genuinely missing, dead, or identity-mismatched for the whole window still blocks; it just takes up to that deadline to say so instead of blocking on the first check.
 
 `FM_STATE_OVERRIDE` wins over `FM_HOME/state`, and `FM_HOME` wins over repo-root `state/`.
 `FM_GUARD_GRACE` controls the beacon freshness window and defaults to 300 seconds.
@@ -147,5 +149,6 @@ No Herdr command was issued and no fleet state was touched; the experiment wrote
 ## Tests
 
 `tests/fm-turnend-guard.test.sh` covers the shared predicate, primary scoping (including a secondmate's own home being guarded like the main primary while its child worktrees stay exempt), `FM_HOME` and `FM_STATE_OVERRIDE` precedence, Pi logical-run latch behavior for no-tool and multi-tool runs, fail-open behavior without `jq`, tracked hook registration for all five harnesses, and the Grok adapter's forced-resume loop guard and permission-mode regression.
+It also pins the bounded re-arm poll's timing: `test_hook_runs_fast` asserts the genuinely-blind path now blocks within the poll window instead of near-instantly (the stated tradeoff above), and `test_hook_allows_watcher_that_registers_mid_poll` confirms a watcher lock that registers partway through the window is let through rather than blocked.
 The default behavior suite does not invoke live language-model harnesses.
 `FM_PI_LIVE_E2E=1 tests/fm-pi-primary-live-e2e.test.sh` opts into the isolated interactive Pi regression recorded above.
diff --git a/tests/fm-backend-herdr.test.sh b/tests/fm-backend-herdr.test.sh
index 5186cca2c..e099b6b97 100755
--- a/tests/fm-backend-herdr.test.sh
+++ b/tests/fm-backend-herdr.test.sh
@@ -34,16 +34,24 @@ set -u
 LOG="${FM_HERDR_LOG:?}"
 RESP="${FM_HERDR_RESPONSES:?}"
 COUNT_FILE="$RESP/.count"
-next=$(( $(cat "$COUNT_FILE" 2>/dev/null || echo 0) + 1 ))
 {
   printf 'HERDR_SESSION=%s' "${HERDR_SESSION:-}"
   for a in "$@"; do printf '\x1f%s' "$a"; done
   printf '\n'
 } >> "$LOG"
+# `herdr server` is a fire-and-forget launch: server_ensure backgrounds it and
+# discards its output, so its timing relative to the immediately-following status
+# poll is non-deterministic. It must NOT consume a canned-response slot, or a lost
+# race with that poll would steal a status response and desync the whole sequence.
+# It is still logged above, so the "did it start the server" assertion holds.
+if [ "${1:-}" = server ]; then
+  exit 0
+fi
 if [ "${1:-}" = status ] && [ "${2:-}" = --json ] && [ "${FM_HERDR_SCRIPT_STATUS:-0}" != 1 ]; then
   printf '{"client":{"version":"0.7.1","protocol":14},"server":{"running":true}}\n'
   exit 0
 fi
+next=$(( $(cat "$COUNT_FILE" 2>/dev/null || echo 0) + 1 ))
 n=$next
 echo "$n" > "$COUNT_FILE"
 if [ -f "$RESP/$n.exit" ]; then
@@ -291,14 +299,15 @@ test_container_ensure_starts_server_and_workspace() {
   printf '{"client":{"version":"0.7.1","protocol":14}}\n' > "$resp/1.out"
   # 2: server_ensure's status --json check -> not running
   printf '{"server":{"running":false}}\n' > "$resp/2.out"
-  # 3: `herdr server` backgrounded launch - no meaningful output
-  # 4: server_ensure poll -> now running
-  printf '{"server":{"running":true}}\n' > "$resp/4.out"
-  # 5: workspace list -> empty (no "firstmate" workspace yet)
-  printf '{"result":{"workspaces":[]}}\n' > "$resp/5.out"
-  # 6: workspace create -> w1, seeding default tab w1:t9 (real herdr returns
+  # `herdr server` is backgrounded and consumes no response slot (see the fake),
+  # so the very next scripted response is the server_ensure poll.
+  # 3: server_ensure poll -> now running
+  printf '{"server":{"running":true}}\n' > "$resp/3.out"
+  # 4: workspace list -> empty (no "firstmate" workspace yet)
+  printf '{"result":{"workspaces":[]}}\n' > "$resp/4.out"
+  # 5: workspace create -> w1, seeding default tab w1:t9 (real herdr returns
   # the seeded tab/pane ids in the SAME response - verified empirically).
-  printf '{"result":{"workspace":{"workspace_id":"w1","label":"firstmate"},"tab":{"tab_id":"w1:t9"},"root_pane":{"pane_id":"w1:p9"}}}\n' > "$resp/6.out"
+  printf '{"result":{"workspace":{"workspace_id":"w1","label":"firstmate"},"tab":{"tab_id":"w1:t9"},"root_pane":{"pane_id":"w1:p9"}}}\n' > "$resp/5.out"
   fb=$(make_herdr_fakebin "$dir")
   out=$( PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_HERDR_SCRIPT_STATUS=1 HERDR_SESSION=fmtest \
     bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_container_ensure /tmp' "$ROOT" )
diff --git a/tests/fm-backend-orca.test.sh b/tests/fm-backend-orca.test.sh
index e0bce69cf..ba1b80baa 100755
--- a/tests/fm-backend-orca.test.sh
+++ b/tests/fm-backend-orca.test.sh
@@ -502,7 +502,7 @@ test_spawn_writes_orca_metadata_and_launches_harness() {
     "spawn should reuse the implicit terminal returned by Orca worktree creation"
   assert_contains "$(cat "$log")" $'orca\x1f''terminal'$'\x1f''send'$'\x1f''--terminal'$'\x1f''term-spawn'$'\x1f''--text'$'\x1f''export GOTMPDIR=/tmp/fm-orcaspawnz1/gotmp'$'\x1f''--enter'$'\x1f''--json' \
     "spawn did not export GOTMPDIR through the Orca terminal"
-  assert_contains "$(cat "$log")" "CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false claude --dangerously-skip-permissions" \
+  assert_contains "$(cat "$log")" "CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false CLAUDE_CODE_AUTO_COMPACT_WINDOW=300000 claude --dangerously-skip-permissions" \
     "spawn did not send the selected harness launch command through Orca"
   rm -rf "/tmp/fm-$id"
   pass "fm-spawn.sh --backend orca: reuses implicit terminal, records metadata, launches harness"
diff --git a/tests/fm-backlog-handoff.test.sh b/tests/fm-backlog-handoff.test.sh
index 9e10703e8..575127270 100755
--- a/tests/fm-backlog-handoff.test.sh
+++ b/tests/fm-backlog-handoff.test.sh
@@ -10,8 +10,11 @@ set -u
 . "$(dirname "${BASH_SOURCE[0]}")/secondmate-helpers.sh"
 
 # The move is delegated to `tasks-axi mv`, so this suite exercises the real
-# binary. Skip cleanly when it is absent (matching the backend smoke suites).
-command -v tasks-axi >/dev/null 2>&1 || { echo "skip: tasks-axi not found (required by the delegated handoff path)"; exit 0; }
+# binary. Skip cleanly when it is absent or too old for atomic multi-ID moves
+# (matching tests/fm-secondmate-lifecycle-e2e.test.sh's handoff phase).
+# shellcheck source=bin/fm-tasks-axi-lib.sh disable=SC1091
+. "$ROOT/bin/fm-tasks-axi-lib.sh"
+fm_tasks_axi_compatible || { echo "skip: tasks-axi not found or too old (required by the delegated handoff path)"; exit 0; }
 
 TMP_ROOT=$(fm_test_tmproot fm-backlog-handoff)
 
diff --git a/tests/fm-bootstrap.test.sh b/tests/fm-bootstrap.test.sh
index 851ba66ec..0f429acc0 100755
--- a/tests/fm-bootstrap.test.sh
+++ b/tests/fm-bootstrap.test.sh
@@ -83,6 +83,42 @@ SH
   chmod +x "$fakebin/quota-axi"
 }
 
+# Fake systemctl for the critical-services check. It shadows any real systemctl
+# on PATH so the test is deterministic on a systemd host. FM_FAKE_FAILED_UNITS is
+# a space-separated set of units reported as failed; FM_FAKE_SERVICE_TS is the
+# StateChangeTimestamp value returned for `show` (empty = unavailable). is-failed
+# prints its state to stdout (as the real one does without --quiet), so a case
+# expecting silence also proves the production call redirects that stream.
+add_fake_systemctl() {
+  local fakebin=$1
+  cat > "$fakebin/systemctl" <<'SH'
+#!/usr/bin/env bash
+case "${1:-}" in
+  is-failed)
+    shift
+    unit=
+    for a in "$@"; do
+      case "$a" in --*) ;; *) unit=$a ;; esac
+    done
+    for f in ${FM_FAKE_FAILED_UNITS:-}; do
+      if [ "$f" = "$unit" ]; then
+        printf '%s\n' failed
+        exit 0
+      fi
+    done
+    printf '%s\n' inactive
+    exit 1
+    ;;
+  show)
+    printf '%s\n' "${FM_FAKE_SERVICE_TS:-}"
+    exit 0
+    ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/systemctl"
+}
+
 add_tasks_axi() {
   local fakebin=$1 version=$2 archive_body=${3:-yes} multi_id=${4:-yes} archive_line mv_usage
   archive_line=""
@@ -782,12 +818,501 @@ empty array use is flagged^{"rules":[{"when":"big feature","use":[]}]}^exact^CRE
 array profile without harness is flagged^{"rules":[{"when":"big feature","use":[{"model":"gpt-5.5"}]}]}^exact^CREW_DISPATCH: invalid config/crew-dispatch.json - each use profile needs harness
 unknown select is flagged^{"rules":[{"when":"big feature","use":[{"harness":"claude"},{"harness":"codex"}],"select":"mystery"}]}^exact^CREW_DISPATCH: invalid config/crew-dispatch.json - unknown select: mystery
 array profile unsupported effort is flagged^{"rules":[{"when":"big feature","use":[{"harness":"codex","effort":"max"}]}]}^exact^CREW_DISPATCH: invalid config/crew-dispatch.json - invalid effort: codex:max
+ultracode boolean true is accepted^{"rules":[{"when":"safety-critical work","use":{"harness":"claude","ultracode":true,"ultracode_role":"independent-review"}}]}^empty^
+ultracode string value is flagged^{"rules":[{"when":"safety-critical work","use":{"harness":"claude","ultracode":"true"}}]}^exact^CREW_DISPATCH: invalid config/crew-dispatch.json - ultracode must be a boolean: "true"
+ultracode number value is flagged^{"rules":[{"when":"safety-critical work","use":[{"harness":"claude","ultracode":1}]}]}^exact^CREW_DISPATCH: invalid config/crew-dispatch.json - ultracode must be a boolean: 1
+ultracode_role non-string value is flagged^{"rules":[{"when":"safety-critical work","use":{"harness":"claude","ultracode":true,"ultracode_role":42}}]}^exact^CREW_DISPATCH: invalid config/crew-dispatch.json - ultracode_role must be a non-empty string: 42
+ultracode_role empty string is flagged^{"rules":[{"when":"safety-critical work","use":{"harness":"claude","ultracode":true,"ultracode_role":""}}]}^exact^CREW_DISPATCH: invalid config/crew-dispatch.json - ultracode_role must be a non-empty string: ""
 ROWS
   pass "bootstrap validates crew-dispatch.json and reports malformed or unverified configs"
 }
 
+# A home whose backlog backend is manual (suppresses TASKS_AXI) with a fully
+# present toolchain and a fake systemctl, so SERVICE_FAILED lines are the only
+# possible bootstrap output. Prints the fakebin path.
+setup_critical_case() {
+  local case_dir=$1 fakebin
+  mkdir -p "$case_dir/home/config"
+  printf '%s\n' manual > "$case_dir/home/config/backlog-backend"
+  fakebin=$(make_fake_toolchain "$case_dir")
+  add_fake_systemctl "$fakebin"
+  printf '%s\n' "$fakebin"
+}
+
+run_critical_bootstrap() {
+  local home=$1 fakebin=$2 failed=$3 ts=$4
+  PATH="$fakebin:$BASE_PATH" FM_HOME="$home" FM_ROOT_OVERRIDE="$home" \
+    FM_FAKE_TREEHOUSE_LEASE_HELP=1 \
+    FM_FAKE_FAILED_UNITS="$failed" FM_FAKE_SERVICE_TS="$ts" \
+    "$ROOT/bin/fm-bootstrap.sh"
+}
+
+test_critical_services_check() {
+  local case_dir home fakebin out ts expect bash_env
+  ts='Wed 2026-07-01 03:14:07 UTC'
+
+  # A failed unit with a StateChangeTimestamp surfaces with the since clause.
+  case_dir="$TMP_ROOT/critical-failed-ts"
+  home="$case_dir/home"
+  fakebin=$(setup_critical_case "$case_dir")
+  printf '%s\n' 'my-app.service' > "$home/config/critical-services"
+  out=$(run_critical_bootstrap "$home" "$fakebin" 'my-app.service' "$ts")
+  [ "$out" = "SERVICE_FAILED: my-app.service - failed since $ts" ] \
+    || fail "failed unit with timestamp: got: $out"
+
+  # A failed unit with no StateChangeTimestamp drops the since clause.
+  case_dir="$TMP_ROOT/critical-failed-no-ts"
+  home="$case_dir/home"
+  fakebin=$(setup_critical_case "$case_dir")
+  printf '%s\n' 'my-app.service' > "$home/config/critical-services"
+  out=$(run_critical_bootstrap "$home" "$fakebin" 'my-app.service' '')
+  [ "$out" = "SERVICE_FAILED: my-app.service - in failed state" ] \
+    || fail "failed unit without timestamp: got: $out"
+
+  # A listed unit that is not failed stays silent (also proves is-failed's stdout
+  # is redirected: the fake would otherwise leak 'inactive' into the output).
+  case_dir="$TMP_ROOT/critical-not-failed"
+  home="$case_dir/home"
+  fakebin=$(setup_critical_case "$case_dir")
+  printf '%s\n' 'my-app.service' > "$home/config/critical-services"
+  out=$(run_critical_bootstrap "$home" "$fakebin" 'other.service' "$ts")
+  [ -z "$out" ] || fail "not-failed unit should be silent, got: $out"
+
+  # Blank lines and full-line '#' comments are ignored, whitespace is trimmed,
+  # and only the listed units are reported, in file order.
+  case_dir="$TMP_ROOT/critical-comments"
+  home="$case_dir/home"
+  fakebin=$(setup_critical_case "$case_dir")
+  printf '%s\n' '# critical units' '' '  spaced.service  ' 'ok.timer' '#skip.service' 'down.service' \
+    > "$home/config/critical-services"
+  out=$(run_critical_bootstrap "$home" "$fakebin" 'spaced.service down.service' "$ts")
+  expect=$'SERVICE_FAILED: spaced.service - failed since '"$ts"$'\nSERVICE_FAILED: down.service - failed since '"$ts"
+  [ "$out" = "$expect" ] || fail "comment/whitespace handling: got: $out"
+
+  # An absent config file is a no-op even with systemctl present.
+  case_dir="$TMP_ROOT/critical-absent"
+  home="$case_dir/home"
+  fakebin=$(setup_critical_case "$case_dir")
+  out=$(run_critical_bootstrap "$home" "$fakebin" 'my-app.service' "$ts")
+  [ -z "$out" ] || fail "absent config should be a no-op, got: $out"
+
+  # Without systemctl on PATH (a non-systemd host) the check is a silent no-op
+  # even when the config lists a unit. Override `command -v systemctl` so the
+  # host's real systemctl cannot satisfy the guard.
+  case_dir="$TMP_ROOT/critical-no-systemctl"
+  home="$case_dir/home"
+  fakebin=$(setup_critical_case "$case_dir")
+  rm -f "$fakebin/systemctl"
+  printf '%s\n' 'my-app.service' > "$home/config/critical-services"
+  bash_env="$case_dir/no-systemctl.bash"
+  cat > "$bash_env" <<'SH'
+command() {
+  if [ "${1:-}" = -v ] && [ "${2:-}" = systemctl ]; then
+    return 1
+  fi
+  builtin command "$@"
+}
+SH
+  out=$(PATH="$fakebin:$BASE_PATH" BASH_ENV="$bash_env" FM_HOME="$home" FM_ROOT_OVERRIDE="$home" \
+    FM_FAKE_TREEHOUSE_LEASE_HELP=1 FM_FAKE_FAILED_UNITS='my-app.service' FM_FAKE_SERVICE_TS="$ts" \
+    "$ROOT/bin/fm-bootstrap.sh")
+  [ -z "$out" ] || fail "no systemctl should be a silent no-op, got: $out"
+
+  pass "bootstrap surfaces failed critical services and stays silent otherwise"
+}
+
+# A home whose backlog backend is manual (suppresses TASKS_AXI) with a fully
+# present toolchain, so AUTODEPLOY_FAILED lines are the only possible bootstrap
+# output. Prints the fakebin path.
+setup_autodeploy_case() {
+  local case_dir=$1 fakebin
+  mkdir -p "$case_dir/home/config"
+  printf '%s\n' manual > "$case_dir/home/config/backlog-backend"
+  fakebin=$(make_fake_toolchain "$case_dir")
+  printf '%s\n' "$fakebin"
+}
+
+run_autodeploy_bootstrap() {
+  local home=$1 fakebin=$2
+  PATH="$fakebin:$BASE_PATH" FM_HOME="$home" FM_ROOT_OVERRIDE="$home" \
+    FM_FAKE_TREEHOUSE_LEASE_HELP=1 \
+    "$ROOT/bin/fm-bootstrap.sh"
+}
+
+test_autodeploy_logs_check() {
+  local case_dir home fakebin out log elapsed real_tail bash_env
+
+  # A log whose last line reports failure surfaces with its label and content.
+  case_dir="$TMP_ROOT/autodeploy-failed"
+  home="$case_dir/home"
+  fakebin=$(setup_autodeploy_case "$case_dir")
+  mkdir -p "$case_dir/logs/beamanalyzer-autodeploy"
+  log="$case_dir/logs/beamanalyzer-autodeploy/status.log"
+  printf '2026-07-15T10:00:00+00:00 ok nas=unchanged prod=unchanged deployed=no\n' > "$log"
+  printf '2026-07-15T10:05:00+00:00 ALERT nas=unchanged prod=unsafe deployed=no\n' >> "$log"
+  printf '%s\n' "$log" > "$home/config/autodeploy-logs"
+  out=$(run_autodeploy_bootstrap "$home" "$fakebin")
+  [ "$out" = "AUTODEPLOY_FAILED: beamanalyzer-autodeploy - 2026-07-15T10:05:00+00:00 ALERT nas=unchanged prod=unsafe deployed=no" ] \
+    || fail "failed log surfaces AUTODEPLOY_FAILED: got: $out"
+
+  # A healthy last line stays silent.
+  case_dir="$TMP_ROOT/autodeploy-healthy"
+  home="$case_dir/home"
+  fakebin=$(setup_autodeploy_case "$case_dir")
+  mkdir -p "$case_dir/logs/deploy"
+  log="$case_dir/logs/deploy/status.log"
+  printf '2026-07-15T11:00:00+00:00 ALERT nas=unsafe prod=unchanged deployed=no\n' > "$log"
+  printf '2026-07-15T11:05:00+00:00 ok nas=unchanged prod=unchanged deployed=no\n' >> "$log"
+  printf '%s\n' "$log" > "$home/config/autodeploy-logs"
+  out=$(run_autodeploy_bootstrap "$home" "$fakebin")
+  [ -z "$out" ] || fail "healthy last line should be silent, got: $out"
+
+  # A missing or unreadable log path (a NAS mount hiccup) is skipped silently.
+  case_dir="$TMP_ROOT/autodeploy-missing"
+  home="$case_dir/home"
+  fakebin=$(setup_autodeploy_case "$case_dir")
+  printf '%s\n' "$case_dir/logs/does-not-exist/status.log" > "$home/config/autodeploy-logs"
+  out=$(run_autodeploy_bootstrap "$home" "$fakebin")
+  [ -z "$out" ] || fail "missing log should be silently skipped, got: $out"
+
+  case_dir="$TMP_ROOT/autodeploy-timeout"
+  home="$case_dir/home"
+  fakebin=$(setup_autodeploy_case "$case_dir")
+  real_tail=$(command -v tail)
+  cat > "$fakebin/tail" <<SH
+#!/usr/bin/env bash
+if [ "\${FM_FAKE_TAIL_SLEEP:-}" = 1 ]; then
+  perl -e 'sleep 20'
+  exit 0
+fi
+exec '$real_tail' "\$@"
+SH
+  chmod +x "$fakebin/tail"
+  mkdir -p "$case_dir/logs/hung-deploy"
+  log="$case_dir/logs/hung-deploy/status.log"
+  printf 'ALERT should time out\n' > "$log"
+  printf '%s\n' "$log" > "$home/config/autodeploy-logs"
+  SECONDS=0
+  out=$(FM_FAKE_TAIL_SLEEP=1 FM_AUTODEPLOY_LOG_READ_TIMEOUT=1 run_autodeploy_bootstrap "$home" "$fakebin")
+  elapsed=$SECONDS
+  [ -z "$out" ] || fail "timed-out log read should be silently skipped, got: $out"
+  [ "$elapsed" -lt 5 ] || fail "timed-out log read blocked bootstrap for ${elapsed}s"
+
+  # Blank lines and full-line '#' comments are ignored, whitespace is trimmed,
+  # and only the listed logs are reported, in file order.
+  case_dir="$TMP_ROOT/autodeploy-comments"
+  home="$case_dir/home"
+  fakebin=$(setup_autodeploy_case "$case_dir")
+  mkdir -p "$case_dir/logs/app-a" "$case_dir/logs/app-b"
+  printf '%s\n' 'STUCK: a has diverged - needs attention' > "$case_dir/logs/app-a/status.log"
+  printf '%s\n' 'deploy: build: FAILED: npm ERR code ELIFECYCLE' > "$case_dir/logs/app-b/status.log"
+  printf '%s\n' '# watched autodeploy logs' '' "  $case_dir/logs/app-a/status.log  " '#skip.log' \
+    "$case_dir/logs/app-b/status.log" > "$home/config/autodeploy-logs"
+  out=$(run_autodeploy_bootstrap "$home" "$fakebin")
+  expect=$'AUTODEPLOY_FAILED: app-a - STUCK: a has diverged - needs attention\nAUTODEPLOY_FAILED: app-b - deploy: build: FAILED: npm ERR code ELIFECYCLE'
+  [ "$out" = "$expect" ] || fail "comment/whitespace handling: got: $out"
+
+  # An absent config file is a no-op.
+  case_dir="$TMP_ROOT/autodeploy-absent"
+  home="$case_dir/home"
+  fakebin=$(setup_autodeploy_case "$case_dir")
+  out=$(run_autodeploy_bootstrap "$home" "$fakebin")
+  [ -z "$out" ] || fail "absent config should be a no-op, got: $out"
+
+  # With no timeout mechanism (timeout, gtimeout, perl) on PATH, the feature
+  # would otherwise silently never alert; a configured log surfaces a one-time
+  # AUTODEPLOY_INERT diagnostic instead of the usual per-log AUTODEPLOY_FAILED
+  # check. Shadow `command -v` for only those three names, mirroring the
+  # no-systemctl case above, so the check is deterministic on any host.
+  bash_env="$TMP_ROOT/no-timeout-mechanism.bash"
+  cat > "$bash_env" <<'SH'
+command() {
+  if [ "${1:-}" = -v ]; then
+    case "${2:-}" in
+      timeout|gtimeout|perl) return 1 ;;
+    esac
+  fi
+  builtin command "$@"
+}
+SH
+
+  case_dir="$TMP_ROOT/autodeploy-no-timeout-mechanism"
+  home="$case_dir/home"
+  fakebin=$(setup_autodeploy_case "$case_dir")
+  mkdir -p "$case_dir/logs/app-a"
+  log="$case_dir/logs/app-a/status.log"
+  printf 'ALERT should never be checked\n' > "$log"
+  printf '%s\n' "$log" > "$home/config/autodeploy-logs"
+  out=$(PATH="$fakebin:$BASE_PATH" BASH_ENV="$bash_env" FM_HOME="$home" FM_ROOT_OVERRIDE="$home" \
+    FM_FAKE_TREEHOUSE_LEASE_HELP=1 "$ROOT/bin/fm-bootstrap.sh")
+  [ "$out" = "AUTODEPLOY_INERT: config/autodeploy-logs is set but no timeout mechanism (timeout, gtimeout, or perl) is on PATH; autodeploy-alert checks cannot run" ] \
+    || fail "no timeout mechanism should surface AUTODEPLOY_INERT: got: $out"
+
+  # Same no-mechanism host, but the config lists only comments/blank lines:
+  # nothing is actually configured to warn about, so it stays silent.
+  case_dir="$TMP_ROOT/autodeploy-no-timeout-mechanism-empty"
+  home="$case_dir/home"
+  fakebin=$(setup_autodeploy_case "$case_dir")
+  printf '%s\n' '# nothing configured yet' '' > "$home/config/autodeploy-logs"
+  out=$(PATH="$fakebin:$BASE_PATH" BASH_ENV="$bash_env" FM_HOME="$home" FM_ROOT_OVERRIDE="$home" \
+    FM_FAKE_TREEHOUSE_LEASE_HELP=1 "$ROOT/bin/fm-bootstrap.sh")
+  [ -z "$out" ] || fail "empty config on a no-mechanism host should stay silent, got: $out"
+
+  pass "bootstrap surfaces failed autodeploy logs and stays silent otherwise"
+}
+
+# --- UPSTREAM_DRIFT diagnostic -------------------------------------------------
+# The always-on drift report reads firstmate's OWN repo (FM_ROOT) and needs a real
+# git repo with a `main` branch, an `upstream` remote, and a refs/remotes/upstream/main
+# ref - so these cases build one per scenario instead of the fake toolchain's
+# non-git home. It reads the ref WITHOUT fetching, so a dummy upstream URL is fine.
+make_drift_repo() {  # <repo>
+  local repo=$1
+  git init -q -b main "$repo"
+  git -C "$repo" config user.email t@t.test
+  git -C "$repo" config user.name tester
+}
+
+drift_commit() {  # <repo> <msg> [<iso-date>]
+  local repo=$1 msg=$2 date=${3:-}
+  if [ -n "$date" ]; then
+    GIT_AUTHOR_DATE="$date" GIT_COMMITTER_DATE="$date" \
+      git -C "$repo" commit -q --allow-empty -m "$msg"
+  else
+    git -C "$repo" commit -q --allow-empty -m "$msg"
+  fi
+}
+
+# Run bootstrap in detect-only mode (the drift report runs there and never
+# fetches) against a real git FM_ROOT, returning only the UPSTREAM_DRIFT line.
+run_drift_bootstrap() {  # <repo> <fakebin>
+  local repo=$1 fakebin=$2
+  PATH="$fakebin:$BASE_PATH" FM_HOME="$repo" FM_ROOT_OVERRIDE="$repo" \
+    FM_FAKE_TREEHOUSE_LEASE_HELP=1 FM_BOOTSTRAP_DETECT_ONLY=1 \
+    "$ROOT/bin/fm-bootstrap.sh" 2>/dev/null | grep '^UPSTREAM_DRIFT:' || true
+}
+
+test_upstream_drift_report() {
+  local case_dir repo fakebin out base tip i
+
+  # FYI variant: local main ahead, not behind, recent merge-base -> plain report.
+  case_dir="$TMP_ROOT/drift-fyi"; repo="$case_dir/repo"
+  mkdir -p "$case_dir"; make_drift_repo "$repo"
+  drift_commit "$repo" base
+  base=$(git -C "$repo" rev-parse HEAD)
+  git -C "$repo" remote add upstream https://example.invalid/upstream.git
+  git -C "$repo" update-ref refs/remotes/upstream/main "$base"
+  drift_commit "$repo" a1; drift_commit "$repo" a2; drift_commit "$repo" a3
+  fakebin=$(make_fake_toolchain "$case_dir")
+  out=$(run_drift_bootstrap "$repo" "$fakebin")
+  assert_contains "$out" "UPSTREAM_DRIFT: local main is 3 ahead / 0 behind upstream/main" \
+    "FYI drift line reports ahead/behind counts"
+  assert_not_contains "$out" "needs attention" "FYI variant must not escalate"
+
+  # Escalation via a stale merge-base (older than the 10-day threshold).
+  case_dir="$TMP_ROOT/drift-stale"; repo="$case_dir/repo"
+  mkdir -p "$case_dir"; make_drift_repo "$repo"
+  drift_commit "$repo" base "2020-01-01T00:00:00"
+  base=$(git -C "$repo" rev-parse HEAD)
+  git -C "$repo" remote add upstream https://example.invalid/upstream.git
+  git -C "$repo" update-ref refs/remotes/upstream/main "$base"
+  drift_commit "$repo" recent
+  fakebin=$(make_fake_toolchain "$case_dir")
+  out=$(run_drift_bootstrap "$repo" "$fakebin")
+  assert_contains "$out" "UPSTREAM_DRIFT: this repo's upstream sync needs attention" \
+    "a stale merge-base escalates the wording"
+  assert_contains "$out" "1 ahead" "stale case still reports the ahead count"
+
+  # Escalation via being more than 30 commits behind upstream/main.
+  case_dir="$TMP_ROOT/drift-behind"; repo="$case_dir/repo"
+  mkdir -p "$case_dir"; make_drift_repo "$repo"
+  drift_commit "$repo" base
+  git -C "$repo" checkout -q -b upstream-sim
+  i=1; while [ "$i" -le 31 ]; do drift_commit "$repo" "u$i"; i=$((i + 1)); done
+  tip=$(git -C "$repo" rev-parse HEAD)
+  git -C "$repo" checkout -q main
+  git -C "$repo" remote add upstream https://example.invalid/upstream.git
+  git -C "$repo" update-ref refs/remotes/upstream/main "$tip"
+  git -C "$repo" branch -q -D upstream-sim
+  fakebin=$(make_fake_toolchain "$case_dir")
+  out=$(run_drift_bootstrap "$repo" "$fakebin")
+  assert_contains "$out" "needs attention" "being far behind upstream escalates the wording"
+  assert_contains "$out" "31 behind" "far-behind case reports the behind count"
+
+  # No upstream remote -> silent no-op (no ref to count against).
+  case_dir="$TMP_ROOT/drift-none"; repo="$case_dir/repo"
+  mkdir -p "$case_dir"; make_drift_repo "$repo"
+  drift_commit "$repo" base
+  fakebin=$(make_fake_toolchain "$case_dir")
+  out=$(run_drift_bootstrap "$repo" "$fakebin")
+  [ -z "$out" ] || fail "no upstream remote must be silent, got: $out"
+
+  pass "bootstrap reports upstream drift (FYI, stale, and far-behind escalations) and stays silent without an upstream"
+}
+
+# --- upstream fetch bound (bin/fm-bootstrap.sh's upstream_drift_fetch) --------
+# The MUTATING half of the UPSTREAM_DRIFT diagnostic (git fetch upstream, run
+# only from the locked fleet_sync sweep) must never hang session start when the
+# network stalls, regardless of which bounding tool is available: `timeout` when
+# present, `gtimeout` as its Homebrew-coreutils-name fallback, and a pure
+# background-then-kill fallback when neither binary exists at all. Each case
+# points a fake `git fetch` at a long real sleep and proves the whole bootstrap
+# invocation still returns well within FM_UPSTREAM_FETCH_TIMEOUT.
+
+# Fake git: any `git -C <dir> fetch ...` sleeps for a long time (never legitimately
+# reached within the test's small FM_UPSTREAM_FETCH_TIMEOUT); every other git
+# subcommand passes straight through to the real git, since upstream_drift_report,
+# the tangle check, and crew-dispatch validation all still run in the same
+# bootstrap invocation. Args: fakebin
+add_hanging_upstream_fetch_git() {
+  local fakebin=$1 real_git
+  real_git=$(command -v git) || fail "git is required to build the fake upstream-fetch git wrapper"
+  cat > "$fakebin/git" <<SH
+#!/usr/bin/env bash
+if [ "\${1:-}" = -C ] && [ "\${3:-}" = fetch ]; then
+  exec sleep 300
+fi
+exec '$real_git' "\$@"
+SH
+  chmod +x "$fakebin/git"
+}
+
+# A userspace gtimeout stand-in (this host has no Homebrew coreutils), so the
+# gtimeout-fallback case can prove the fallback branch is actually reached and
+# actually bounds the hung fetch, rather than just asserting on elapsed time.
+add_fake_gtimeout() {
+  local fakebin=$1
+  cat > "$fakebin/gtimeout" <<'SH'
+#!/usr/bin/env bash
+secs=$1; shift
+"$@" &
+pid=$!
+( sleep "$secs"; kill "$pid" 2>/dev/null ) &
+watcher=$!
+wait "$pid" 2>/dev/null
+rc=$?
+kill "$watcher" 2>/dev/null
+exit "$rc"
+SH
+  chmod +x "$fakebin/gtimeout"
+}
+
+# A drift repo with an upstream remote (a dummy URL; the fetch itself is faked)
+# and no refs/remotes/upstream/main yet, so upstream_drift_report stays silent
+# and only the fetch-bound behavior is under test. Args: repo
+make_fetch_bound_repo() {
+  local repo=$1
+  make_drift_repo "$repo"
+  drift_commit "$repo" base
+  git -C "$repo" remote add upstream https://example.invalid/upstream.git
+}
+
+# Run bootstrap (NOT detect-only, so fleet_sync/upstream_drift_fetch actually
+# run) against a fetch-bound repo and echo real wall-clock elapsed seconds.
+# Args: repo fakebin fetch_timeout [bash_env]
+run_fetch_bound_bootstrap() {
+  local repo=$1 fakebin=$2 fetch_timeout=$3 bash_env=${4:-} start elapsed rc
+  # Wall-clock via `date +%s`, not $SECONDS: run_bootstrap_timeout_case above
+  # reassigns $SECONDS inside a subshell for its own fake-time trick, and
+  # ShellCheck's whole-file data-flow analysis for that special variable then
+  # flags any later $SECONDS read here too (SC2030/SC2031), even though the two
+  # functions never interact. `date +%s` sidesteps the false positive entirely.
+  start=$(date +%s)
+  set +e
+  if [ -n "$bash_env" ]; then
+    BASH_ENV="$bash_env" PATH="$fakebin:$BASE_PATH" FM_HOME="$repo" FM_ROOT_OVERRIDE="$repo" \
+      FM_UPSTREAM_FETCH_TIMEOUT="$fetch_timeout" FM_FAKE_TREEHOUSE_LEASE_HELP=1 \
+      "$ROOT/bin/fm-bootstrap.sh" >/dev/null 2>&1
+  else
+    PATH="$fakebin:$BASE_PATH" FM_HOME="$repo" FM_ROOT_OVERRIDE="$repo" \
+      FM_UPSTREAM_FETCH_TIMEOUT="$fetch_timeout" FM_FAKE_TREEHOUSE_LEASE_HELP=1 \
+      "$ROOT/bin/fm-bootstrap.sh" >/dev/null 2>&1
+  fi
+  rc=$?
+  set -e
+  elapsed=$(( $(date +%s) - start ))
+  [ "$rc" -eq 0 ] || fail "fetch-bound bootstrap should still exit 0 (best-effort fetch), got rc=$rc"
+  printf '%s\n' "$elapsed"
+}
+
+test_upstream_fetch_bounded_by_real_timeout() {
+  local case_dir repo fakebin elapsed
+  case_dir="$TMP_ROOT/fetch-timeout"; repo="$case_dir/repo"
+  mkdir -p "$case_dir"
+  make_fetch_bound_repo "$repo"
+  fakebin=$(make_fake_toolchain "$case_dir")
+  add_hanging_upstream_fetch_git "$fakebin"
+
+  elapsed=$(run_fetch_bound_bootstrap "$repo" "$fakebin" 1)
+
+  [ "$elapsed" -le 10 ] || fail "timeout-bounded fetch should return quickly, took ${elapsed}s (fake fetch sleeps 300s)"
+  pass "bootstrap bounds the upstream fetch with 'timeout' when available (bound 1s, elapsed ${elapsed}s, fake fetch hangs 300s)"
+}
+
+test_upstream_fetch_bounded_by_gtimeout_fallback() {
+  local case_dir repo fakebin bash_env elapsed
+  case_dir="$TMP_ROOT/fetch-gtimeout"; repo="$case_dir/repo"
+  mkdir -p "$case_dir"
+  make_fetch_bound_repo "$repo"
+  fakebin=$(make_fake_toolchain "$case_dir")
+  add_hanging_upstream_fetch_git "$fakebin"
+  add_fake_gtimeout "$fakebin"
+
+  bash_env="$case_dir/no-timeout.bash"
+  cat > "$bash_env" <<'SH'
+command() {
+  if [ "${1:-}" = -v ] && [ "${2:-}" = timeout ]; then
+    return 1
+  fi
+  builtin command "$@"
+}
+timeout() {
+  return 127
+}
+SH
+
+  elapsed=$(run_fetch_bound_bootstrap "$repo" "$fakebin" 1 "$bash_env")
+
+  [ "$elapsed" -le 10 ] || fail "gtimeout-bounded fetch should return quickly, took ${elapsed}s (fake fetch sleeps 300s)"
+  pass "bootstrap falls back to 'gtimeout' when 'timeout' is unavailable (bound 1s, elapsed ${elapsed}s, fake fetch hangs 300s)"
+}
+
+test_upstream_fetch_bounded_by_background_kill_fallback() {
+  local case_dir repo fakebin bash_env elapsed
+  case_dir="$TMP_ROOT/fetch-bg-kill"; repo="$case_dir/repo"
+  mkdir -p "$case_dir"
+  make_fetch_bound_repo "$repo"
+  fakebin=$(make_fake_toolchain "$case_dir")
+  add_hanging_upstream_fetch_git "$fakebin"
+
+  bash_env="$case_dir/no-timeout-no-gtimeout.bash"
+  cat > "$bash_env" <<'SH'
+command() {
+  if [ "${1:-}" = -v ] && { [ "${2:-}" = timeout ] || [ "${2:-}" = gtimeout ]; }; then
+    return 1
+  fi
+  builtin command "$@"
+}
+timeout() {
+  return 127
+}
+gtimeout() {
+  return 127
+}
+SH
+
+  elapsed=$(run_fetch_bound_bootstrap "$repo" "$fakebin" 1 "$bash_env")
+
+  [ "$elapsed" -le 10 ] || fail "background-kill-bounded fetch should return quickly, took ${elapsed}s (fake fetch sleeps 300s)"
+  pass "bootstrap falls back to a background-then-kill bound when neither 'timeout' nor 'gtimeout' exists (bound 1s, elapsed ${elapsed}s, fake fetch hangs 300s)"
+}
+
 test_bootstrap_reporting
 test_no_mistakes_min_version
+test_upstream_drift_report
+test_upstream_fetch_bounded_by_real_timeout
+test_upstream_fetch_bounded_by_gtimeout_fallback
+test_upstream_fetch_bounded_by_background_kill_fallback
 test_git_is_required_with_supported_install_instruction
 test_orca_backend_gates_orca_tool_only_when_selected
 test_session_provider_backends_do_not_require_tmux
@@ -807,3 +1332,5 @@ test_routine_bootstrap_contract_runs_under_system_bash
 test_bootstrap_info_is_no_load_and_actionable_lines_trigger
 test_crew_dispatch_active_rules_are_verbose_bootstrap_info
 test_crew_dispatch_validation
+test_critical_services_check
+test_autodeploy_logs_check
diff --git a/tests/fm-brief.test.sh b/tests/fm-brief.test.sh
index 3e925fa2f..9567d4737 100755
--- a/tests/fm-brief.test.sh
+++ b/tests/fm-brief.test.sh
@@ -253,6 +253,72 @@ test_herdr_lab_contract_applies_to_scouts_but_not_secondmates() {
   pass "fm-brief.sh: Herdr lab contract covers scouts and rejects secondmate misuse"
 }
 
+test_light_verify_points_to_verify_trivial() {
+  local home id brief
+  home="$TMP_ROOT/light-verify-home"
+  mkdir -p "$home/data"
+  id="brief-light-verify-e1"
+  FM_HOME="$home" "$ROOT/bin/fm-brief.sh" "$id" firstmate --scout --light-verify >/dev/null 2>&1
+  brief="$home/data/$id/brief.md"
+  assert_present "$brief" "Light-verify scout brief was not scaffolded"
+  assert_grep "# Verification tier: Light" "$brief" \
+    "Light-verify brief missing its Verification tier heading"
+  assert_grep "$ROOT/.agents/skills/verify-trivial/SKILL.md" "$brief" \
+    "Light-verify brief missing the absolute verify-trivial pointer"
+  assert_grep "verify-rigorously" "$brief" \
+    "Light-verify brief lost its verify-rigorously cross-reference"
+  pass "fm-brief.sh: --light-verify points the brief at verify-trivial"
+}
+
+test_light_verify_absent_by_default() {
+  local home id brief
+  home="$TMP_ROOT/no-light-verify-home"
+  mkdir -p "$home/data"
+  id="brief-no-light-verify-e2"
+  FM_HOME="$home" "$ROOT/bin/fm-brief.sh" "$id" firstmate >/dev/null 2>&1
+  brief="$home/data/$id/brief.md"
+  assert_no_grep "# Verification tier: Light" "$brief" \
+    "brief scaffolded without --light-verify should not mention the Light verification tier"
+  assert_no_grep "skips the document step" "$brief" \
+    "brief scaffolded without --light-verify should not carry the skip-document note"
+  pass "fm-brief.sh: omitting --light-verify leaves no Light-tier trace"
+}
+
+test_light_verify_skips_document_for_nomistakes_mode_only() {
+  local home brief
+  home="$TMP_ROOT/light-verify-dod-home"
+  mkdir -p "$home/data"
+  cat > "$home/data/projects.md" <<'EOF'
+- direct-proj [direct-PR] - fixture for direct-PR mode (added 2026-07-01)
+EOF
+
+  FM_HOME="$home" "$ROOT/bin/fm-brief.sh" brief-light-nomistakes-e3 no-registry-proj --light-verify >/dev/null 2>&1
+  brief="$home/data/brief-light-nomistakes-e3/brief.md"
+  assert_grep "skips the document step" "$brief" \
+    "no-mistakes-mode Light-verify brief missing the skip-document note"
+
+  FM_HOME="$home" "$ROOT/bin/fm-brief.sh" brief-light-directpr-e4 direct-proj --light-verify >/dev/null 2>&1
+  brief="$home/data/brief-light-directpr-e4/brief.md"
+  assert_grep "# Verification tier: Light" "$brief" \
+    "direct-PR Light-verify brief should still get the Task-section pointer"
+  assert_no_grep "skips the document step" "$brief" \
+    "direct-PR mode never runs no-mistakes, so it should not carry the skip-document note"
+
+  pass "fm-brief.sh: --light-verify's skip-document note is scoped to no-mistakes-mode ship tasks"
+}
+
+test_light_verify_rejected_for_secondmate() {
+  local home status=0
+  home="$TMP_ROOT/light-verify-secondmate-home"
+  mkdir -p "$home/data"
+  FM_HOME="$home" FM_SECONDMATE_CHARTER=x \
+    "$ROOT/bin/fm-brief.sh" sm-light-verify-e5 --secondmate --no-projects --light-verify >/dev/null 2>&1 || status=$?
+  expect_code 1 "$status" "secondmate --light-verify must be rejected"
+  assert_absent "$home/data/sm-light-verify-e5/brief.md" \
+    "rejected secondmate --light-verify still wrote a brief"
+  pass "fm-brief.sh: --light-verify is rejected for secondmate charters"
+}
+
 test_pause_verb_override_renders_all_brief_scaffolds() {
   local home kind id brief
   home="$TMP_ROOT/pause-verb-home"
@@ -319,5 +385,9 @@ test_herdr_lab_contract_quotes_foreign_firstmate_path
 test_herdr_lab_omission_is_loud_for_ship_and_scout
 test_herdr_lab_contract_applies_to_scouts_but_not_secondmates
 test_secondmate_no_projects_charter
+test_light_verify_points_to_verify_trivial
+test_light_verify_absent_by_default
+test_light_verify_skips_document_for_nomistakes_mode_only
+test_light_verify_rejected_for_secondmate
 test_pause_verb_override_renders_all_brief_scaffolds
 test_scout_and_secondmate_load_decision_hold_policy
diff --git a/tests/fm-composer-nbsp.test.sh b/tests/fm-composer-nbsp.test.sh
new file mode 100755
index 000000000..f3fce6857
--- /dev/null
+++ b/tests/fm-composer-nbsp.test.sh
@@ -0,0 +1,204 @@
+#!/usr/bin/env bash
+# tests/fm-composer-nbsp.test.sh - non-breaking-space composer padding.
+#
+# INCIDENT (2026-07-14, three occurrences, all against a claude composer target):
+# bin/fm-send.sh reported `exit 1` / "Enter swallowed; text left in composer"
+# even though the message had genuinely reached the target and been submitted
+# (fm-peek showed the crewmate processing it moments later). The caller could not
+# tell this false alarm apart from a real swallow without manually peeking.
+#
+# ROOT CAUSE (captured live from a working claude pane, tmux 3.x, 2026-07-14):
+# claude draws its composer prompt as the glyph "❯" (U+276F) followed by a
+# NON-BREAKING SPACE (U+00A0), not an ASCII space. The exact cursor-line bytes,
+# `tmux capture-pane -e -p` of the cursor row while the agent was working, were:
+#   1b 5b 33 37 6d   e2 9d af   c2 a0   1b 5b 33 39 6d
+#   ESC [ 3 7 m       ❯          <nbsp>  ESC [ 3 9 m
+# glibc's en_US.UTF-8 [:space:] does NOT classify U+00A0 as whitespace, so the
+# composer reader's ASCII whitespace trimming and its "❯ " (glyph + ASCII space)
+# strip both leave the U+00A0 behind as phantom "content". An empty composer that
+# has cleared to "❯ " therefore misclassifies as `pending`, and fm-send's
+# submit loop reads `pending` on every retry, exhausts them, and returns the
+# false swallow. Because the same idle line sometimes carries a busy footer or
+# dim ghost text on the cursor row (both read empty), the false alarm was
+# intermittent, which is why it took three occurrences to pin.
+#
+# FIX (bin/fm-composer-lib.sh): the shared classifier normalizes no-break space
+# characters (U+00A0 and its narrow sibling U+202F) to an ASCII space before
+# trimming, so an otherwise-empty composer reads empty on every backend. These
+# tests pin the fix at three layers - the shared classifier, the tmux composer
+# reader that captures the real styled bytes, and the submit loop / full fm-send
+# exit code that the incident actually surfaced through.
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+# shellcheck source=bin/fm-composer-lib.sh
+. "$ROOT/bin/fm-composer-lib.sh"
+# shellcheck source=bin/fm-tmux-lib.sh
+. "$ROOT/bin/fm-tmux-lib.sh"
+
+SEND="$ROOT/bin/fm-send.sh"
+TMP_ROOT=$(fm_test_tmproot fm-composer-nbsp)
+
+# The two no-break spaces the fix normalizes, as literal UTF-8 bytes.
+NBSP=$(printf '\302\240')      # U+00A0 NO-BREAK SPACE (claude's composer padding)
+NNBSP=$(printf '\342\200\257')  # U+202F NARROW NO-BREAK SPACE (its narrow sibling)
+
+# The EXACT styled cursor line captured live from a working claude pane: a white
+# (SGR 37) prompt glyph followed by a bare U+00A0, reset to default fg (SGR 39).
+CLAUDE_LINE=$(printf '\033[37m\xe2\x9d\xaf\xc2\xa0\033[39m')
+
+classify() { fm_composer_classify_content "$@"; }
+
+# A fake tmux that serves one styled cursor line (FM_FAKE_STYLED, a raw string in
+# the env) for `capture-pane -e` and the SGR-stripped plain form otherwise, with a
+# numeric cursor_y (FM_FAKE_CY) and always-succeeding send-keys. Mirrors the
+# harness in tests/fm-composer-ghost.test.sh but takes the line from the
+# environment so a test can pass raw bytes without a temp file.
+make_fake_tmux() {  # <dir> -> echoes fakebin dir
+  local dir=$1 fb="$1/fakebin"
+  mkdir -p "$fb"
+  cat > "$fb/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "${1:-}" in
+  send-keys) exit 0 ;;
+  display-message)
+    for a in "$@"; do case "$a" in *cursor_y*) printf '%s\n' "${FM_FAKE_CY:-0}"; exit 0 ;; esac; done
+    printf 'fakepane\n'; exit 0 ;;
+  capture-pane)
+    has_e=0; for a in "$@"; do [ "$a" = "-e" ] && has_e=1; done
+    if [ "$has_e" = 1 ]; then printf '%s\n' "${FM_FAKE_STYLED:-}"
+    else printf '%s\n' "${FM_FAKE_STYLED:-}" | LC_ALL=C sed 's/\x1b\[[0-9;:?]*[[:alpha:]]//g'; fi
+    exit 0 ;;
+  list-windows) exit 0 ;;
+esac
+exit 0
+SH
+  chmod +x "$fb/tmux"
+  cat > "$fb/sleep" <<'SH'
+#!/usr/bin/env bash
+exit 0
+SH
+  chmod +x "$fb/sleep"
+  printf '%s\n' "$fb"
+}
+
+# --- Layer 1: the shared classifier -----------------------------------------
+
+test_classify_nbsp_padded_agent_glyph_is_empty() {
+  local out
+  # claude's real cleared composer: agent glyph + a trailing non-breaking space.
+  out=$(classify 0 "❯$NBSP")
+  [ "$out" = empty ] || fail "bare '❯<nbsp>' (claude's cleared composer) must read empty, got '$out'"
+  out=$(classify 1 "❯$NBSP")
+  [ "$out" = empty ] || fail "bordered '❯<nbsp>' must read empty, got '$out'"
+  # Leading and surrounding no-break spaces trim away too.
+  out=$(classify 0 "$NBSP❯$NBSP")
+  [ "$out" = empty ] || fail "'<nbsp>❯<nbsp>' must read empty, got '$out'"
+  pass "fm_composer_classify_content: an agent glyph padded with U+00A0 reads empty"
+}
+
+test_classify_narrow_nbsp_padded_glyph_is_empty() {
+  local out
+  out=$(classify 0 "❯$NNBSP")
+  [ "$out" = empty ] || fail "'❯<narrow-nbsp>' (U+202F) must read empty, got '$out'"
+  pass "fm_composer_classify_content: an agent glyph padded with U+202F reads empty"
+}
+
+test_classify_nbsp_only_is_empty() {
+  local out
+  # A composer holding only no-break space is empty, not pending.
+  out=$(classify 1 "$NBSP")
+  [ "$out" = empty ] || fail "a bordered composer holding only U+00A0 must read empty, got '$out'"
+  pass "fm_composer_classify_content: a composer of only no-break space reads empty"
+}
+
+test_classify_nbsp_with_real_text_stays_pending() {
+  local out
+  # Real typed content must still win - the no-break space is just a separator.
+  out=$(classify 0 "❯${NBSP}fix findings 1 and 3")
+  [ "$out" = pending ] || fail "real text after a no-break space must stay pending, got '$out'"
+  out=$(classify 0 "deploy staging now$NBSP")
+  [ "$out" = pending ] || fail "real text with a trailing no-break space must stay pending, got '$out'"
+  pass "fm_composer_classify_content: no-break-space normalization never hides real typed text"
+}
+
+test_bare_shell_prompt_with_nbsp_stays_unknown() {
+  local out
+  # Safety contract preserved: a bare shell prompt padded with a no-break space
+  # is still a dead shell, never a safe injection target.
+  out=$(classify 0 "\$$NBSP")
+  [ "$out" = unknown ] || fail "a bare '\$<nbsp>' shell prompt must stay unknown, got '$out'"
+  pass "fm_composer_classify_content: a no-break-space-padded bare shell prompt stays unknown"
+}
+
+# --- Layer 2: the tmux composer reader on the real captured bytes ------------
+
+test_composer_state_reads_real_claude_line_empty() {
+  local dir fb out
+  dir="$TMP_ROOT/reader"; mkdir -p "$dir"
+  fb=$(make_fake_tmux "$dir")
+  out=$(PATH="$fb:$PATH" FM_FAKE_STYLED="$CLAUDE_LINE" FM_FAKE_CY=0 \
+        fm_tmux_composer_state fakepane)
+  [ "$out" = empty ] \
+    || fail "fm_tmux_composer_state on the real captured claude working line must read empty, got '$out'"
+  pass "fm_tmux_composer_state: claude's real '❯<nbsp>' working composer reads empty"
+}
+
+test_composer_state_still_pending_on_real_text_with_nbsp() {
+  local dir fb line out
+  dir="$TMP_ROOT/reader-pending"; mkdir -p "$dir"
+  fb=$(make_fake_tmux "$dir")
+  # A human mid-typing, whose text happens to contain a no-break space, is pending.
+  line=$(printf '\033[37m\xe2\x9d\xaf\xc2\xa0ship it now\033[39m')
+  out=$(PATH="$fb:$PATH" FM_FAKE_STYLED="$line" FM_FAKE_CY=0 \
+        fm_tmux_composer_state fakepane)
+  [ "$out" = pending ] \
+    || fail "fm_tmux_composer_state on real text containing a no-break space must read pending, got '$out'"
+  pass "fm_tmux_composer_state: real typed text with an embedded no-break space stays pending"
+}
+
+# --- Layer 3: the submit loop no longer reports a false swallow --------------
+
+test_submit_loop_not_false_pending_on_nbsp_composer() {
+  local dir fb out
+  dir="$TMP_ROOT/submit"; mkdir -p "$dir"
+  fb=$(make_fake_tmux "$dir")
+  # The composer has already cleared to claude's '❯<nbsp>' idle line: the submit
+  # landed. The verify loop must read that as `empty`, not the false `pending`
+  # that fm-send turns into exit 1 ("Enter swallowed").
+  out=$(PATH="$fb:$PATH" FM_FAKE_STYLED="$CLAUDE_LINE" FM_FAKE_CY=0 \
+        fm_tmux_submit_enter_core fakepane 3 0)
+  [ "$out" = empty ] \
+    || fail "fm_tmux_submit_enter_core against a cleared '❯<nbsp>' composer must return empty, got '$out'"
+  pass "fm_tmux_submit_enter_core: a cleared no-break-space composer is not a false swallow"
+}
+
+# --- Layer 4: the full fm-send exit code the incident surfaced through -------
+
+test_fm_send_succeeds_when_composer_clears_to_nbsp() {
+  local dir fb home err rc
+  dir="$TMP_ROOT/fmsend"; mkdir -p "$dir"
+  fb=$(make_fake_tmux "$dir")
+  home="$dir/home"; mkdir -p "$home/state"; err="$dir/send.err"
+  fm_write_meta "$home/state/lane-nbsp.meta" "window=sess:fm-lane-nbsp" "kind=ship" "harness=claude"
+
+  PATH="$fb:$PATH" FM_HOME="$home" FM_ROOT_OVERRIDE="$home" \
+    FM_FAKE_STYLED="$CLAUDE_LINE" FM_FAKE_CY=0 FM_SEND_SETTLE=0 FM_SEND_SLEEP=0 \
+    "$SEND" fm-lane-nbsp "steer the crewmate" >/dev/null 2>"$err"; rc=$?
+  expect_code 0 "$rc" "fm-send must succeed when the claude composer cleared to '❯<nbsp>'"
+  assert_not_contains "$(cat "$err")" "Enter swallowed" "fm-send must not report a false Enter swallow"
+  pass "fm-send: a genuinely-submitted steer to a claude composer no longer exits 1"
+}
+
+test_classify_nbsp_padded_agent_glyph_is_empty
+test_classify_narrow_nbsp_padded_glyph_is_empty
+test_classify_nbsp_only_is_empty
+test_classify_nbsp_with_real_text_stays_pending
+test_bare_shell_prompt_with_nbsp_stays_unknown
+test_composer_state_reads_real_claude_line_empty
+test_composer_state_still_pending_on_real_text_with_nbsp
+test_submit_loop_not_false_pending_on_nbsp_composer
+test_fm_send_succeeds_when_composer_clears_to_nbsp
diff --git a/tests/fm-crew-state.test.sh b/tests/fm-crew-state.test.sh
index e5ffd09a8..dc2878d0b 100755
--- a/tests/fm-crew-state.test.sh
+++ b/tests/fm-crew-state.test.sh
@@ -1040,6 +1040,107 @@ SH
   pass "no timeout command uses perl bound"
 }
 
+# Regression for the 2026-07-09 89-minute watcher stall: a `no-mistakes axi
+# status` call that ignores its initial signal (blocked deep in a slow/queued
+# daemon RPC under concurrent validation load) must still be gone by
+# NM_TIMEOUT+NM_KILL_AFTER, never merely asked to stop. Unlike
+# test_no_timeout_uses_perl_bound above (which forces the perl fallback by
+# hiding timeout/gtimeout from PATH), this deliberately runs with the REAL
+# system PATH so the PRIMARY `timeout` path - what production actually uses on
+# this box - is what gets exercised. A plain `timeout N cmd` with no
+# -k/--kill-after is only advisory: without nm_run's -k fix this test hangs
+# indefinitely instead of completing.
+test_uncooperative_no_mistakes_is_force_killed() {
+  reset_fakes
+  local d out start elapsed calls_file calls
+  d=$(new_case uncooperative)
+  make_repo_on_branch "$d/wt" fm/feat-uncooperative
+  make_fakebin "$d" >/dev/null
+  calls_file="$d/no-mistakes.calls"
+  : > "$calls_file"
+  cat > "$d/fakebin/no-mistakes" <<'SH'
+#!/usr/bin/env bash
+trap '' TERM
+printf '%s\n' "$*" >> "${FM_FAKE_NM_CALLS:-/dev/null}"
+while :; do sleep 1; done
+SH
+  chmod +x "$d/fakebin/no-mistakes"
+  fm_write_meta "$d/state/feat-uncooperative.meta" "window=fm:fm-feat-uncooperative" "worktree=$d/wt" "kind=ship"
+  FM_FAKE_BUSY=1
+  start=$SECONDS
+  out=$(FM_FAKE_NM_CALLS="$calls_file" PATH="$d/fakebin:$PATH" FM_STATE_OVERRIDE="$d/state" \
+    FM_CREW_STATE_NM_TIMEOUT=1 FM_CREW_STATE_NM_KILL_AFTER=1 "$CREW_STATE" feat-uncooperative)
+  elapsed=$((SECONDS - start))
+  assert_contains "$out" "state: working" "SIGTERM-ignoring no-mistakes falls back to pane"
+  assert_contains "$out" "source: pane" "SIGTERM-ignoring no-mistakes -> pane source"
+  [ "$elapsed" -lt 6 ] || fail "timeout -k did not force-kill an uncooperative no-mistakes call (elapsed ${elapsed}s)"
+  calls=$(awk 'END { print NR + 0 }' "$calls_file" 2>/dev/null || echo 0)
+  [ "$calls" -ge 1 ] || fail "the uncooperative no-mistakes call never ran"
+  pass "an uncooperative no-mistakes call is force-killed via timeout -k rather than left to hang"
+}
+
+# Regression: a prior version of the NM_TIMEOUT sanitizer only excluded '' and
+# non-digit strings, letting FM_CREW_STATE_NM_TIMEOUT=0 reach `timeout` as a
+# literal 0 - which GNU coreutils documents as disabling the timeout entirely
+# ("a duration of 0 disables the associated timeout"), defeating this whole
+# hard-timeout guarantee. Pins that 0 for both NM_TIMEOUT and NM_KILL_AFTER
+# falls back to their sanitized defaults instead. Intercepts `timeout` itself to
+# record the exact secs/kill-after it was invoked with, so the assertion is
+# instant regardless of what the sanitized default resolves to (no need to wait
+# out a real bound).
+test_zero_nm_timeout_values_sanitized_to_default() {
+  reset_fakes
+  local d calls_file out
+  d=$(new_case zero-nm-timeout)
+  make_repo_on_branch "$d/wt" fm/feat-zero-timeout
+  make_fakebin "$d" >/dev/null
+  calls_file="$d/timeout.calls"
+  : > "$calls_file"
+  cat > "$d/fakebin/timeout" <<SH
+#!/usr/bin/env bash
+printf 'kill_after=%s secs=%s\n' "\$2" "\$3" >> "$calls_file"
+shift 3
+exec "\$@"
+SH
+  chmod +x "$d/fakebin/timeout"
+  fm_write_meta "$d/state/feat-zero-timeout.meta" "window=fm:fm-feat-zero-timeout" "worktree=$d/wt" "kind=ship"
+  FM_FAKE_AXI_STATUS="$(run_running fm/feat-zero-timeout)"
+  out=$(FM_CREW_STATE_NM_TIMEOUT=0 FM_CREW_STATE_NM_KILL_AFTER=0 PATH="$d/fakebin:$PATH" FM_STATE_OVERRIDE="$d/state" "$CREW_STATE" feat-zero-timeout)
+  assert_contains "$out" "state: working" "the sanitized-timeout call still resolves the run-step normally"
+  assert_not_contains "$(cat "$calls_file")" "secs=0" "FM_CREW_STATE_NM_TIMEOUT=0 reached timeout as a literal 0 (disables the bound entirely)"
+  assert_not_contains "$(cat "$calls_file")" "kill_after=0" "FM_CREW_STATE_NM_KILL_AFTER=0 reached timeout -k as a literal 0"
+  pass "FM_CREW_STATE_NM_TIMEOUT=0 and FM_CREW_STATE_NM_KILL_AFTER=0 fall back to sanitized defaults, never a literal 0"
+}
+
+# Regression: the sanitizer fix above only excluded the literal string "0",
+# not other all-zero digit spellings GNU `timeout` also treats as "no
+# timeout" - verified empirically, `timeout -k 1 00 sleep N` runs the full N
+# seconds, identical to a literal 0. Pins that FM_CREW_STATE_NM_TIMEOUT=00 and
+# FM_CREW_STATE_NM_KILL_AFTER=00 also fall back to their sanitized defaults.
+test_zero_padded_nm_timeout_values_sanitized_to_default() {
+  reset_fakes
+  local d calls_file out
+  d=$(new_case zero-padded-nm-timeout)
+  make_repo_on_branch "$d/wt" fm/feat-zero-padded-timeout
+  make_fakebin "$d" >/dev/null
+  calls_file="$d/timeout.calls"
+  : > "$calls_file"
+  cat > "$d/fakebin/timeout" <<SH
+#!/usr/bin/env bash
+printf 'kill_after=%s secs=%s\n' "\$2" "\$3" >> "$calls_file"
+shift 3
+exec "\$@"
+SH
+  chmod +x "$d/fakebin/timeout"
+  fm_write_meta "$d/state/feat-zero-padded-timeout.meta" "window=fm:fm-feat-zero-padded-timeout" "worktree=$d/wt" "kind=ship"
+  FM_FAKE_AXI_STATUS="$(run_running fm/feat-zero-padded-timeout)"
+  out=$(FM_CREW_STATE_NM_TIMEOUT=00 FM_CREW_STATE_NM_KILL_AFTER=00 PATH="$d/fakebin:$PATH" FM_STATE_OVERRIDE="$d/state" "$CREW_STATE" feat-zero-padded-timeout)
+  assert_contains "$out" "state: working" "the sanitized zero-padded-timeout call still resolves the run-step normally"
+  assert_not_contains "$(cat "$calls_file")" "secs=00" "FM_CREW_STATE_NM_TIMEOUT=00 reached timeout as a zero-padded 0 (disables the bound entirely)"
+  assert_not_contains "$(cat "$calls_file")" "kill_after=00" "FM_CREW_STATE_NM_KILL_AFTER=00 reached timeout -k as a zero-padded 0"
+  pass "FM_CREW_STATE_NM_TIMEOUT=00 and FM_CREW_STATE_NM_KILL_AFTER=00 fall back to sanitized defaults, never a zero-padded 0"
+}
+
 # (i) kind=scout skips the run lookup entirely (its deliverable is a report).
 test_scout_skips_run_lookup() {
   reset_fakes
@@ -1172,6 +1273,9 @@ test_dead_window_ignores_stale_status_log
 test_dead_window_still_reports_terminal_run_step
 test_dead_window_still_reports_active_run_step
 test_no_timeout_uses_perl_bound
+test_uncooperative_no_mistakes_is_force_killed
+test_zero_nm_timeout_values_sanitized_to_default
+test_zero_padded_nm_timeout_values_sanitized_to_default
 test_scout_skips_run_lookup
 test_torn_down_worktree
 test_missing_meta
diff --git a/tests/fm-dispatch-select.test.sh b/tests/fm-dispatch-select.test.sh
index a9ae5b7bf..ff53c1f3a 100755
--- a/tests/fm-dispatch-select.test.sh
+++ b/tests/fm-dispatch-select.test.sh
@@ -174,6 +174,59 @@ SH
   pass "single-object use and no-select arrays preserve first-profile selection"
 }
 
+test_ultracode_boolean_is_preserved() {
+  local out
+  out=$("$ROOT/bin/fm-dispatch-select.sh" '{"harness":"claude","model":"opus","effort":"xhigh","ultracode":true,"ultracode_role":"independent-review"}')
+  [ "$out" = '{"harness":"claude","model":"opus","effort":"xhigh","ultracode":true,"ultracode_role":"independent-review"}' ] \
+    || fail "boolean ultracode true and its role should be preserved, got: $out"
+  pass "ultracode boolean true and ultracode_role pass through unchanged"
+}
+
+test_ultracode_non_boolean_string_fails_loud() {
+  local out err status
+  out=$("$ROOT/bin/fm-dispatch-select.sh" '{"harness":"claude","ultracode":"true"}' 2>"$TMP_ROOT/ultracode-string.err")
+  status=$?
+  err=$(cat "$TMP_ROOT/ultracode-string.err")
+  expect_code 2 "$status" "a hand-edited string ultracode should fail loud, not resolve"
+  [ -z "$out" ] || fail "a non-boolean ultracode must never resolve to a profile, got: $out"
+  assert_contains "$err" "ultracode must be a boolean" "a non-boolean ultracode should be reported"
+  pass "a JSON string ultracode value fails loud instead of being silently dropped"
+}
+
+test_ultracode_non_boolean_number_fails_loud() {
+  local out err status
+  out=$("$ROOT/bin/fm-dispatch-select.sh" '{"harness":"claude","ultracode":1}' 2>"$TMP_ROOT/ultracode-number.err")
+  status=$?
+  err=$(cat "$TMP_ROOT/ultracode-number.err")
+  expect_code 2 "$status" "a numeric ultracode should fail loud, not resolve"
+  [ -z "$out" ] || fail "a non-boolean ultracode must never resolve to a profile, got: $out"
+  assert_contains "$err" "ultracode must be a boolean" "a numeric ultracode should be reported"
+  pass "a numeric ultracode value fails loud instead of being silently coerced away"
+}
+
+test_ultracode_rejected_inside_quota_balanced_array() {
+  local out err status array_rule
+  array_rule='{"when":"big feature","use":[{"harness":"claude","ultracode":"true"},{"harness":"codex"}],"select":"quota-balanced"}'
+  out=$("$ROOT/bin/fm-dispatch-select.sh" "$array_rule" 2>"$TMP_ROOT/ultracode-array.err")
+  status=$?
+  err=$(cat "$TMP_ROOT/ultracode-array.err")
+  expect_code 2 "$status" "a non-boolean ultracode anywhere in a quota-balanced array should fail loud"
+  [ -z "$out" ] || fail "a non-boolean ultracode must never resolve to a profile, got: $out"
+  assert_contains "$err" "ultracode must be a boolean" "a non-boolean ultracode inside an array should be reported"
+  pass "a non-boolean ultracode inside a quota-balanced profile array fails loud before any selection runs"
+}
+
+test_ultracode_role_non_string_fails_loud() {
+  local out err status
+  out=$("$ROOT/bin/fm-dispatch-select.sh" '{"harness":"claude","ultracode":true,"ultracode_role":42}' 2>"$TMP_ROOT/ultracode-role.err")
+  status=$?
+  err=$(cat "$TMP_ROOT/ultracode-role.err")
+  expect_code 2 "$status" "a non-string ultracode_role should fail loud, not resolve"
+  [ -z "$out" ] || fail "a non-string ultracode_role must never resolve to a profile, got: $out"
+  assert_contains "$err" "ultracode_role must be a non-empty string" "a non-string ultracode_role should be reported"
+  pass "a non-string ultracode_role value fails loud instead of being silently dropped"
+}
+
 test_higher_min_vendor_wins
 test_exact_tie_uses_first_profile
 test_quota_missing_falls_back_to_first
@@ -182,5 +235,10 @@ test_bad_quota_json_falls_back_to_first
 test_stale_with_cache_needs_clear_margin_to_beat_fresh
 test_vendor_absent_or_unusable_falls_back_conservatively
 test_backward_compatible_first_selection
+test_ultracode_boolean_is_preserved
+test_ultracode_non_boolean_string_fails_loud
+test_ultracode_non_boolean_number_fails_loud
+test_ultracode_rejected_inside_quota_balanced_array
+test_ultracode_role_non_string_fails_loud
 
 echo "# all fm-dispatch-select tests passed"
diff --git a/tests/fm-gotmp.test.sh b/tests/fm-gotmp.test.sh
index 03f0afafa..1ab0c9dee 100755
--- a/tests/fm-gotmp.test.sh
+++ b/tests/fm-gotmp.test.sh
@@ -77,6 +77,13 @@ SH
 exit 0
 SH
   chmod +x "$fake/bin/fm-fleet-sync.sh"
+  # fm-nas-deploy-sync.sh: stub (called for the same non-scout/non-local-only
+  # teardowns, right after fm-fleet-sync.sh).
+  cat > "$fake/bin/fm-nas-deploy-sync.sh" <<'SH'
+#!/usr/bin/env bash
+exit 0
+SH
+  chmod +x "$fake/bin/fm-nas-deploy-sync.sh"
   # fm-tasks-axi-lib.sh: stub (teardown sources it). Report no backend so
   # backlog_refresh_reminder takes the plain-message path; no tasks-axi here.
   cat > "$fake/bin/fm-tasks-axi-lib.sh" <<'SH'
@@ -175,6 +182,11 @@ SH
 exit 0
 SH
   chmod +x "$fake/bin/fm-fleet-sync.sh"
+  cat > "$fake/bin/fm-nas-deploy-sync.sh" <<'SH'
+#!/usr/bin/env bash
+exit 0
+SH
+  chmod +x "$fake/bin/fm-nas-deploy-sync.sh"
   cat > "$fake/bin/fm-tasks-axi-lib.sh" <<'SH'
 fm_tasks_axi_backend_available() { return 1; }
 SH
diff --git a/tests/fm-merge-local.test.sh b/tests/fm-merge-local.test.sh
new file mode 100755
index 000000000..5e0f446c7
--- /dev/null
+++ b/tests/fm-merge-local.test.sh
@@ -0,0 +1,188 @@
+#!/usr/bin/env bash
+# Tests for bin/fm-merge-local.sh's push-to-origin scoping: after fast-forwarding
+# a local-only task's project to fm/<id>, the script must push the project's
+# origin ONLY when PROJ is firstmate's own repo (the deliberate fork-sync case)
+# or when the caller explicitly opts in with --push-origin. Every other
+# local-only project's "no remote, no PR" contract (AGENTS.md section 6) must
+# hold even when that project happens to carry an origin remote (e.g. kept only
+# for pulls).
+#
+# Matrix:
+#   (a) firstmate's own repo (PROJ == FM_ROOT)          -> pushes automatically
+#   (b) an arbitrary other local-only project + origin  -> does NOT push
+#   (c) same as (b), with --push-origin                 -> DOES push
+#   (d) an unknown second argument                       -> refuses before merging
+#   (e) a non-local-only task                            -> refuses before merging
+#   (f) firstmate's own repo but no origin remote at all -> merges, skips push silently
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+fm_git_identity fmtest fmtest@example.invalid
+
+MERGE_LOCAL="$ROOT/bin/fm-merge-local.sh"
+TMP_ROOT=$(fm_test_tmproot fm-merge-local-tests)
+
+# Build a project at <case_dir>/project with `main` checked out and a
+# fast-forwardable fm/task-x1 branch one commit ahead, plus a local-only ship
+# task meta pointing at it. Args: case_dir
+make_case() {
+  local case_dir=$1
+  mkdir -p "$case_dir/state"
+  git init -q -b main "$case_dir/project"
+  git -C "$case_dir/project" commit -q --allow-empty -m base
+  git -C "$case_dir/project" branch fm/task-x1
+  git -C "$case_dir/project" checkout -q fm/task-x1
+  git -C "$case_dir/project" commit -q --allow-empty -m "task work"
+  git -C "$case_dir/project" checkout -q main
+  fm_write_meta "$case_dir/state/task-x1.meta" \
+    "window=fm-task-x1" \
+    "worktree=$case_dir/project" \
+    "project=$case_dir/project" \
+    "kind=ship" \
+    "mode=local-only"
+}
+
+# Add a bare, empty origin remote to a case's project (no branches pushed yet).
+add_origin() {
+  local case_dir=$1 origin_abs
+  git init -q --bare "$case_dir/origin.git"
+  origin_abs=$(cd "$case_dir/origin.git" && pwd)
+  git -C "$case_dir/project" remote add origin "file://$origin_abs"
+}
+
+# Run fm-merge-local.sh with a given FM_ROOT_OVERRIDE, capturing stdout/stderr
+# to separate files in case_dir. Args: case_dir fm_root [script args...]
+run_merge_local() {
+  local case_dir=$1 fm_root=$2; shift 2
+  FM_ROOT_OVERRIDE="$fm_root" FM_STATE_OVERRIDE="$case_dir/state" \
+    "$MERGE_LOCAL" "$@" > "$case_dir/stdout" 2> "$case_dir/stderr"
+}
+
+test_firstmate_own_repo_pushes_automatically() {
+  local case_dir rc
+  case_dir="$TMP_ROOT/own-repo"
+  make_case "$case_dir"
+  add_origin "$case_dir"
+
+  set +e
+  run_merge_local "$case_dir" "$case_dir/project" task-x1
+  rc=$?
+  set -e
+
+  expect_code 0 "$rc" "own-repo: fm-merge-local should succeed"
+  assert_grep 'merged fm/task-x1 into local main' "$case_dir/stdout" \
+    "own-repo: merge confirmation missing"
+  assert_grep 'pushed main to origin' "$case_dir/stdout" \
+    "own-repo: firstmate's own repo should push to origin automatically"
+  pass "fm-merge-local pushes to origin automatically when PROJ is firstmate's own repo"
+}
+
+test_other_project_does_not_push_by_default() {
+  local case_dir rc origin_head
+  case_dir="$TMP_ROOT/other-project"
+  make_case "$case_dir"
+  add_origin "$case_dir"
+
+  set +e
+  run_merge_local "$case_dir" "$ROOT" task-x1
+  rc=$?
+  set -e
+
+  expect_code 0 "$rc" "other-project: fm-merge-local should still succeed (local merge only)"
+  assert_grep 'merged fm/task-x1 into local main' "$case_dir/stdout" \
+    "other-project: merge confirmation missing"
+  assert_no_grep 'pushed' "$case_dir/stdout" \
+    "other-project: an arbitrary local-only project must not auto-push its origin"
+  origin_head=$(git -C "$case_dir/origin.git" rev-parse --quiet --verify main 2>/dev/null || echo none)
+  [ "$origin_head" = none ] || fail "other-project: origin's main advanced despite no push"
+  pass "fm-merge-local does not push an arbitrary local-only project's origin by default"
+}
+
+test_other_project_pushes_with_explicit_opt_in() {
+  local case_dir rc project_head origin_head
+  case_dir="$TMP_ROOT/other-project-opt-in"
+  make_case "$case_dir"
+  add_origin "$case_dir"
+
+  set +e
+  run_merge_local "$case_dir" "$ROOT" task-x1 --push-origin
+  rc=$?
+  set -e
+
+  expect_code 0 "$rc" "other-project-opt-in: fm-merge-local should succeed"
+  assert_grep 'pushed main to origin' "$case_dir/stdout" \
+    "other-project-opt-in: --push-origin should push"
+  project_head=$(git -C "$case_dir/project" rev-parse main)
+  origin_head=$(git -C "$case_dir/origin.git" rev-parse main)
+  [ "$project_head" = "$origin_head" ] || fail "other-project-opt-in: origin did not actually advance to the merged commit"
+  pass "fm-merge-local pushes an arbitrary local-only project's origin when --push-origin is passed explicitly"
+}
+
+test_unknown_second_argument_refuses() {
+  local case_dir rc main_head task_head
+  case_dir="$TMP_ROOT/unknown-arg"
+  make_case "$case_dir"
+
+  set +e
+  run_merge_local "$case_dir" "$ROOT" task-x1 --bogus-flag
+  rc=$?
+  set -e
+
+  expect_code 1 "$rc" "unknown-arg: fm-merge-local should refuse an unrecognized second argument"
+  assert_grep "unknown argument '--bogus-flag'" "$case_dir/stderr" \
+    "unknown-arg: refusal did not name the bad argument"
+  main_head=$(git -C "$case_dir/project" rev-parse main)
+  task_head=$(git -C "$case_dir/project" rev-parse fm/task-x1)
+  [ "$main_head" != "$task_head" ] || fail "unknown-arg: merge happened despite the invalid argument"
+  pass "fm-merge-local refuses an unrecognized second argument before touching the project"
+}
+
+test_non_local_only_task_refuses() {
+  local case_dir rc
+  case_dir="$TMP_ROOT/non-local-only"
+  make_case "$case_dir"
+  fm_write_meta "$case_dir/state/task-x1.meta" \
+    "window=fm-task-x1" \
+    "worktree=$case_dir/project" \
+    "project=$case_dir/project" \
+    "kind=ship" \
+    "mode=no-mistakes"
+
+  set +e
+  run_merge_local "$case_dir" "$ROOT" task-x1
+  rc=$?
+  set -e
+
+  expect_code 1 "$rc" "non-local-only: fm-merge-local should refuse a non-local-only task"
+  assert_grep 'not local-only' "$case_dir/stderr" \
+    "non-local-only: refusal did not explain the mode mismatch"
+  pass "fm-merge-local refuses to run against a non-local-only task"
+}
+
+test_firstmate_own_repo_without_origin_skips_push_silently() {
+  local case_dir rc
+  case_dir="$TMP_ROOT/own-repo-no-origin"
+  make_case "$case_dir"
+
+  set +e
+  run_merge_local "$case_dir" "$case_dir/project" task-x1
+  rc=$?
+  set -e
+
+  expect_code 0 "$rc" "own-repo-no-origin: fm-merge-local should succeed"
+  assert_grep 'merged fm/task-x1 into local main' "$case_dir/stdout" \
+    "own-repo-no-origin: merge confirmation missing"
+  assert_no_grep 'pushed' "$case_dir/stdout" \
+    "own-repo-no-origin: no origin remote means nothing to push"
+  assert_no_grep 'warning:' "$case_dir/stderr" \
+    "own-repo-no-origin: no origin remote should not warn either"
+  pass "fm-merge-local skips the push silently when firstmate's own repo has no origin remote"
+}
+
+test_firstmate_own_repo_pushes_automatically
+test_other_project_does_not_push_by_default
+test_other_project_pushes_with_explicit_opt_in
+test_unknown_second_argument_refuses
+test_non_local_only_task_refuses
+test_firstmate_own_repo_without_origin_skips_push_silently
diff --git a/tests/fm-nas-deploy-sync.test.sh b/tests/fm-nas-deploy-sync.test.sh
new file mode 100755
index 000000000..ecffe6e29
--- /dev/null
+++ b/tests/fm-nas-deploy-sync.test.sh
@@ -0,0 +1,473 @@
+#!/usr/bin/env bash
+# Behavior tests for fm-nas-deploy-sync.sh.
+#
+# A merged PR does not, by itself, reach the live site: every deployed app runs
+# from its own separate checkout under /mnt/nas/experiments/<name>/, managed by
+# pm2, independent from the projects/<name> clone firstmate/crewmates develop in
+# (see the 2026-07-04 entry in data/learnings.md). fm-nas-deploy-sync.sh closes
+# that gap: fast-forward the NAS checkout, restart and verify the pm2
+# process(es) that serve it - mirroring bin/fm-fleet-sync.sh's dirty/diverged
+# safety exactly (never force, never touch a dirty or diverged checkout).
+#
+# This suite never touches a real /mnt/nas/experiments/ path or a real pm2
+# process: NAS checkouts are throwaway git repos under a per-test tmp home, and
+# pm2 is a PATH-shimmed stub that records restarts and reports them online.
+#
+# Covers:
+#   - a clean, behind checkout fast-forwards and its pm2 process(es) restart and
+#     verify online
+#   - a dirty checkout is left completely untouched (reported, not fast-forwarded)
+#   - a diverged checkout is reported STUCK-style and left completely untouched
+#   - a project absent from data/nas-deployments.md (or the file itself absent)
+#     is a silent no-op: one skip line, exit 0
+#   - bin/fm-teardown.sh's post-landing hook actually invokes the real script for
+#     a landed ship task, end to end (the NAS fixture fast-forwards and its pm2
+#     process is restarted as a side effect of running teardown)
+set -u
+
+# shellcheck source=tests/lib.sh disable=SC1091
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+fm_git_identity fmtest fmtest@example.invalid
+
+SYNC="$ROOT/bin/fm-nas-deploy-sync.sh"
+TEARDOWN="$ROOT/bin/fm-teardown.sh"
+TMP_ROOT=$(fm_test_tmproot fm-nas-deploy-sync-tests)
+HOME_N=0
+
+# --- generic fixtures --------------------------------------------------------
+
+new_home() {
+  HOME_N=$((HOME_N + 1))
+  local h="$TMP_ROOT/home-$HOME_N"
+  mkdir -p "$h/data" "$h/fakebin"
+  printf '%s\n' "$h"
+}
+
+commit_file() {
+  local dir=$1 file=$2 content=$3 msg=$4
+  printf '%s\n' "$content" > "$dir/$file"
+  git -C "$dir" add -- "$file"
+  git -C "$dir" commit -qm "$msg"
+}
+
+# build_nas_pair <home> <name>: a bare "remote" origin plus a "work" repo wired to
+# it (for advancing origin later) and a plain clone standing in for the NAS
+# checkout, all with one commit on main. Echoes the NAS checkout path.
+build_nas_pair() {
+  local home=$1 name=$2 work remote nas remote_abs
+  work="$home/work-$name"
+  remote="$home/remotes/$name.git"
+  nas="$home/nas-$name"
+  mkdir -p "$home/remotes"
+
+  git init -q "$work"
+  git -C "$work" symbolic-ref HEAD refs/heads/main
+  commit_file "$work" file.txt v0 C0
+
+  git clone --quiet --bare "$work" "$remote"
+  remote_abs=$(cd "$remote" && pwd)
+  git -C "$work" remote add origin "file://$remote_abs"
+  git -C "$work" push -q -u origin main
+
+  git clone --quiet "file://$remote_abs" "$nas"
+  printf '%s\n' "$nas"
+}
+
+# advance_origin <home> <name> <msg>: push one more commit to <name>'s origin via
+# its work repo, so the NAS checkout (until synced) is behind origin/main.
+advance_origin() {
+  local home=$1 name=$2 msg=$3 work
+  work="$home/work-$name"
+  commit_file "$work" file.txt "$msg" "$msg"
+  git -C "$work" push -q origin main
+}
+
+head_sha() { git -C "$1" rev-parse HEAD; }
+
+# write_map <home> <project> <nas_path> <pm2_procs>: (re)write a one-row
+# nas-deployments.md pipe table at $home/data/nas-deployments.md.
+write_map() {
+  local home=$1 project=$2 nas_path=$3 procs=$4
+  {
+    printf '| project | nas_repo_path | pm2_process(es) |\n'
+    printf '| --- | --- | --- |\n'
+    printf '| %s | %s | %s |\n' "$project" "$nas_path" "$procs"
+  } > "$home/data/nas-deployments.md"
+}
+
+# write_pm2_stub <fakebin> <restart_log>: `pm2 restart <name>` appends <name> to
+# $restart_log and succeeds; `pm2 jlist` reports every logged name as online, so a
+# process comes back "online" exactly when (and only when) it was restarted.
+write_pm2_stub() {
+  local fakebin=$1 log=$2
+  : > "$log"
+  cat > "$fakebin/pm2" <<SH
+#!/usr/bin/env bash
+case "\${1:-}" in
+  restart)
+    printf '%s\n' "\$2" >> "$log"
+    exit 0
+    ;;
+  jlist)
+    printf '['
+    first=1
+    while IFS= read -r name; do
+      [ -n "\$name" ] || continue
+      [ "\$first" = 1 ] || printf ','
+      first=0
+      printf '{"name":"%s","pm2_env":{"status":"online"}}' "\$name"
+    done < "$log"
+    printf ']\n'
+    ;;
+  *) exit 0 ;;
+esac
+SH
+  chmod +x "$fakebin/pm2"
+}
+
+# write_pm2_cluster_stub <fakebin> <restart_log> <proc>: like write_pm2_stub, but
+# `pm2 jlist` always reports TWO instances of <proc> - one online, one stopped -
+# regardless of what was restarted, simulating a clustered pm2 app where one
+# instance in the cluster never comes back after a restart.
+write_pm2_cluster_stub() {
+  local fakebin=$1 log=$2 proc=$3
+  : > "$log"
+  cat > "$fakebin/pm2" <<SH
+#!/usr/bin/env bash
+case "\${1:-}" in
+  restart)
+    printf '%s\n' "\$2" >> "$log"
+    exit 0
+    ;;
+  jlist)
+    printf '[{"name":"%s","pm2_env":{"status":"online"}},{"name":"%s","pm2_env":{"status":"stopped"}}]\n' "$proc" "$proc"
+    ;;
+  *) exit 0 ;;
+esac
+SH
+  chmod +x "$fakebin/pm2"
+}
+
+# run_sync <home> [args...]: run the sync script against an isolated home.
+run_sync() {
+  local home=$1
+  shift
+  FM_HOME="$home" PATH="$home/fakebin:$PATH" "$SYNC" "$@"
+}
+
+# write_git_hung_fetch_stub <fakebin>: any `fetch` call hangs indefinitely
+# (well past FM_NAS_SYNC_TIMEOUT), so only the bounded wrapper's `timeout` kill
+# can make the sync return promptly; every other call delegates to the real git.
+write_git_hung_fetch_stub() {
+  local fakebin=$1 realgit
+  realgit=$(command -v git)
+  cat > "$fakebin/git" <<SH
+#!/usr/bin/env bash
+real="$realgit"
+for a in "\$@"; do
+  if [ "\$a" = fetch ]; then
+    sleep 20
+    exit 0
+  fi
+done
+exec "\$real" "\$@"
+SH
+  chmod +x "$fakebin/git"
+}
+
+# write_git_transient_packed_refs_lock_stub <fakebin> <counter>: fail the FIRST
+# `fetch` with the packed-refs.lock "File exists" signature, then delegate every
+# later call - including the retried fetch - to the real git. Mirrors
+# tests/fm-fleet-sync.test.sh's git_transient_packed_refs_lock, adapted to fake
+# the stderr signature directly since fm-nas-deploy-sync.sh's fetch has no
+# --prune to organically trigger a real packed-refs rewrite.
+write_git_transient_packed_refs_lock_stub() {
+  local fakebin=$1 counter=$2 realgit
+  realgit=$(command -v git)
+  cat > "$fakebin/git" <<SH
+#!/usr/bin/env bash
+real="$realgit"
+is_fetch=0
+for a in "\$@"; do [ "\$a" = fetch ] && is_fetch=1; done
+if [ "\$is_fetch" = 1 ]; then
+  n=\$(cat "$counter" 2>/dev/null || echo 0); n=\$(( n + 1 ))
+  printf '%s\n' "\$n" > "$counter"
+  if [ "\$n" -eq 1 ]; then
+    echo "error: could not delete reference refs/remotes/origin/feature: Unable to create '.git/packed-refs.lock': File exists." >&2
+    exit 1
+  fi
+fi
+exec "\$real" "\$@"
+SH
+  chmod +x "$fakebin/git"
+}
+
+# --- tests: standalone script -------------------------------------------------
+
+test_clean_behind_fast_forwards_and_restarts() {
+  local home nas log out origin_head nas_head
+  home=$(new_home)
+  nas=$(build_nas_pair "$home" carscanner-test)
+  advance_origin "$home" carscanner-test C1
+  write_map "$home" carscanner-test "$nas" carscanner-test
+  log="$home/restart.log"
+  write_pm2_stub "$home/fakebin" "$log"
+
+  out=$(run_sync "$home" carscanner-test)
+
+  assert_contains "$out" "carscanner-test: synced" "clean-behind: did not report a sync"
+  assert_contains "$out" "restarted carscanner-test and verified online" "clean-behind: did not report a verified restart"
+  origin_head=$(git -C "$home/work-carscanner-test" rev-parse main)
+  nas_head=$(head_sha "$nas")
+  [ "$origin_head" = "$nas_head" ] || fail "clean-behind: NAS checkout did not fast-forward to origin"
+  assert_grep carscanner-test "$log" "clean-behind: pm2 restart was not invoked"
+  pass "a clean, behind NAS checkout fast-forwards and its pm2 process restarts and verifies online"
+}
+
+test_dirty_is_skipped_untouched() {
+  local home nas log out before after
+  home=$(new_home)
+  nas=$(build_nas_pair "$home" dirty-test)
+  advance_origin "$home" dirty-test C1
+  before=$(head_sha "$nas")
+  printf 'uncommitted\n' >> "$nas/file.txt"
+  write_map "$home" dirty-test "$nas" dirty-test
+  log="$home/restart.log"
+  write_pm2_stub "$home/fakebin" "$log"
+
+  out=$(run_sync "$home" dirty-test)
+
+  assert_contains "$out" "STUCK" "dirty: did not report STUCK"
+  assert_contains "$out" "uncommitted changes" "dirty: did not name the dirty reason"
+  after=$(head_sha "$nas")
+  [ "$before" = "$after" ] || fail "dirty: NAS checkout HEAD moved despite being dirty"
+  git -C "$nas" diff --quiet -- file.txt && fail "dirty: uncommitted change was discarded"
+  [ ! -s "$log" ] || fail "dirty: pm2 restart was invoked on an untouched checkout"
+  pass "a dirty NAS checkout is reported STUCK and left completely untouched"
+}
+
+test_diverged_is_stuck_untouched() {
+  local home nas log out before after
+  home=$(new_home)
+  nas=$(build_nas_pair "$home" diverged-test)
+  advance_origin "$home" diverged-test C1
+  commit_file "$nas" local-only.txt local "local-only commit not on origin"
+  before=$(head_sha "$nas")
+  write_map "$home" diverged-test "$nas" diverged-test
+  log="$home/restart.log"
+  write_pm2_stub "$home/fakebin" "$log"
+
+  out=$(run_sync "$home" diverged-test)
+
+  assert_contains "$out" "STUCK" "diverged: did not report STUCK"
+  assert_contains "$out" "diverged" "diverged: did not name the diverged reason"
+  after=$(head_sha "$nas")
+  [ "$before" = "$after" ] || fail "diverged: NAS checkout HEAD moved despite diverging"
+  [ ! -s "$log" ] || fail "diverged: pm2 restart was invoked on an untouched checkout"
+  pass "a diverged NAS checkout is reported STUCK and left completely untouched"
+}
+
+test_absent_project_is_silent_noop() {
+  local home nas out rc
+  home=$(new_home)
+  nas=$(build_nas_pair "$home" tracked-test)
+  write_map "$home" tracked-test "$nas" tracked-test
+
+  set +e
+  out=$(run_sync "$home" untracked-project)
+  rc=$?
+  set -e
+
+  expect_code 0 "$rc" "absent: sync should exit 0 for a project with no recorded deployment"
+  assert_contains "$out" "untracked-project: skipped: no recorded NAS deployment" "absent: did not report the expected skip line"
+  pass "a project absent from data/nas-deployments.md is a silent no-op"
+}
+
+test_clustered_partial_restart_is_not_masked_online() {
+  local home nas log out
+  home=$(new_home)
+  nas=$(build_nas_pair "$home" cluster-test)
+  advance_origin "$home" cluster-test C1
+  write_map "$home" cluster-test "$nas" cluster-test
+  log="$home/restart.log"
+  write_pm2_cluster_stub "$home/fakebin" "$log" cluster-test
+
+  out=$(run_sync "$home" cluster-test)
+
+  assert_contains "$out" "not online after restart" \
+    "clustered: did not report the lagging cluster instance as a restart problem"
+  assert_contains "$out" "needs attention" "clustered: did not flag the deployment as needing attention"
+  case "$out" in
+    *"verified online"*) fail "clustered: a lagging cluster instance was masked as fully verified online" ;;
+  esac
+  pass "a clustered pm2 app with one lagging instance is reported as a restart problem, not masked as online"
+}
+
+test_hung_fetch_is_bounded_by_timeout() {
+  local home nas out rc start elapsed
+  if ! command -v timeout >/dev/null 2>&1 && ! command -v gtimeout >/dev/null 2>&1; then
+    pass "SKIP (no timeout/gtimeout binary): hung-fetch timeout bound check"
+    return
+  fi
+  home=$(new_home)
+  nas=$(build_nas_pair "$home" hungfetch-test)
+  advance_origin "$home" hungfetch-test C1
+  write_map "$home" hungfetch-test "$nas" hungfetch-test
+  write_pm2_stub "$home/fakebin" "$home/restart.log"
+  write_git_hung_fetch_stub "$home/fakebin"
+
+  start=$SECONDS
+  set +e
+  out=$(FM_NAS_SYNC_TIMEOUT=1 run_sync "$home" hungfetch-test 2>/dev/null)
+  rc=$?
+  set -e
+  elapsed=$(( SECONDS - start ))
+
+  expect_code 0 "$rc" "hung-fetch: sync should still exit 0 when the fetch hangs"
+  [ "$elapsed" -lt 10 ] || fail "hung-fetch: sync took ${elapsed}s - the timeout bound did not stop the hung fetch (stub sleeps 20s)"
+  assert_contains "$out" "hungfetch-test: skipped: fetch failed" "hung-fetch: did not report the bounded fetch as a failure"
+  pass "a hung NAS fetch is killed by FM_NAS_SYNC_TIMEOUT instead of blocking the caller"
+}
+
+test_transient_packed_refs_lock_is_retried() {
+  local home nas out counter err
+  home=$(new_home)
+  nas=$(build_nas_pair "$home" locktrans-test)
+  advance_origin "$home" locktrans-test C1
+  write_map "$home" locktrans-test "$nas" locktrans-test
+  write_pm2_stub "$home/fakebin" "$home/restart.log"
+  counter="$home/git-fetch-count"; : > "$counter"
+  write_git_transient_packed_refs_lock_stub "$home/fakebin" "$counter"
+  err="$home/err-locktrans"
+
+  out=$(FM_NAS_SYNC_PACKED_REFS_LOCK_RETRIES=3 FM_NAS_SYNC_PACKED_REFS_LOCK_RETRY_WAIT_SECS=0 \
+    run_sync "$home" locktrans-test 2>"$err")
+
+  assert_contains "$out" "locktrans-test: synced" "transient lock: sync did not complete after the lock self-cleared"
+  assert_grep "cleared on its own" "$err" "transient lock: guard did not report the self-clear"
+  pass "a transient packed-refs.lock signature on the NAS fetch is retried instead of giving up immediately"
+}
+
+test_missing_map_file_is_silent_noop() {
+  local home out rc
+  home=$(new_home)
+  rm -f "$home/data/nas-deployments.md"
+
+  set +e
+  out=$(run_sync "$home" anything)
+  rc=$?
+  set -e
+
+  expect_code 0 "$rc" "no-map: sync should exit 0 when data/nas-deployments.md does not exist"
+  assert_contains "$out" "anything: skipped: no recorded NAS deployment" "no-map: did not report the expected skip line"
+  pass "a project checked with no data/nas-deployments.md at all is a silent no-op"
+}
+
+# --- tests: teardown integration ---------------------------------------------
+
+# make_teardown_case <name>: a trimmed fixture mirroring tests/fm-teardown.test.sh
+# make_case's ALLOW path (no-mistakes mode, task branch pushed to origin), plus a
+# NAS-fixture pair and a nas-deployments.md row for the project so the real
+# post-teardown fm-nas-deploy-sync.sh call has real work to do. Echoes the case dir.
+make_teardown_case() {
+  local name=$1 case_dir fakebin nas
+  case_dir="$TMP_ROOT/teardown-$name"
+  fakebin="$case_dir/fakebin"
+  mkdir -p "$case_dir/state" "$case_dir/config" "$case_dir/data" "$fakebin"
+
+  cat > "$fakebin/treehouse" <<'SH'
+#!/usr/bin/env bash
+exit 0
+SH
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+exit 0
+SH
+  cat > "$fakebin/gh-axi" <<'SH'
+#!/usr/bin/env bash
+case "${1:-} ${2:-}" in
+  "pr list") printf '%s\n' "count: 0 (showing first 0)" "pull_requests[]: []" ; exit 0 ;;
+  "pr view") echo "error: pull request not found" >&2 ; exit 1 ;;
+esac
+exit 0
+SH
+  cat > "$fakebin/gh" <<'SH'
+#!/usr/bin/env bash
+case "${1:-} ${2:-}" in
+  "pr view") echo "error: pull request not found" >&2 ; exit 1 ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/treehouse" "$fakebin/tmux" "$fakebin/gh-axi" "$fakebin/gh"
+
+  git init -q --bare "$case_dir/origin.git"
+  git -C "$case_dir/origin.git" symbolic-ref HEAD refs/heads/main
+  git clone -q "$case_dir/origin.git" "$case_dir/_seed" 2>/dev/null
+  git -C "$case_dir/_seed" commit -q --allow-empty -m "origin baseline"
+  git -C "$case_dir/_seed" push -q origin main
+  rm -rf "$case_dir/_seed"
+  git clone -q "$case_dir/origin.git" "$case_dir/project"
+  git -C "$case_dir/project" remote set-head origin main 2>/dev/null || true
+  git -C "$case_dir/project" worktree add -q -b fm/task-x1 "$case_dir/wt" main
+
+  touch "$case_dir/state/.last-watcher-beat"
+
+  fm_write_meta "$case_dir/state/task-x1.meta" \
+    "window=fm-task-x1" \
+    "worktree=$case_dir/wt" \
+    "project=$case_dir/project" \
+    "kind=ship" \
+    "mode=no-mistakes"
+
+  git -C "$case_dir/wt" commit -q --allow-empty -m "shippable work"
+  git -C "$case_dir/wt" push -q origin fm/task-x1
+  git -C "$case_dir/project" fetch -q origin
+
+  nas=$(build_nas_pair "$case_dir" project-nas)
+  advance_origin "$case_dir" project-nas C1
+  write_map "$case_dir" project "$nas" project-nas
+  write_pm2_stub "$fakebin" "$case_dir/restart.log"
+
+  printf '%s\n' "$case_dir"
+}
+
+run_teardown() {
+  local case_dir=$1
+  FM_ROOT_OVERRIDE="$ROOT" \
+  FM_STATE_OVERRIDE="$case_dir/state" \
+  FM_CONFIG_OVERRIDE="$case_dir/config" \
+  FM_NAS_DEPLOYMENTS_OVERRIDE="$case_dir/data/nas-deployments.md" \
+  PATH="$case_dir/fakebin:$PATH" \
+    "$TEARDOWN" task-x1
+}
+
+test_teardown_invokes_nas_deploy_sync_for_landed_project() {
+  local case_dir rc origin_head nas_head
+  case_dir=$(make_teardown_case invokes)
+
+  set +e
+  run_teardown "$case_dir" > "$case_dir/stdout" 2> "$case_dir/stderr"
+  rc=$?
+  set -e
+
+  expect_code 0 "$rc" "teardown-invokes: teardown should succeed for landed work"
+  ! grep -q REFUSED "$case_dir/stderr" || fail "teardown-invokes: teardown printed a REFUSED line"
+
+  origin_head=$(git -C "$case_dir/work-project-nas" rev-parse main)
+  nas_head=$(head_sha "$case_dir/nas-project-nas")
+  [ "$origin_head" = "$nas_head" ] \
+    || fail "teardown-invokes: post-teardown hook did not fast-forward the NAS fixture"
+  assert_grep project-nas "$case_dir/restart.log" \
+    "teardown-invokes: post-teardown hook did not restart the NAS deployment's pm2 process"
+  pass "a landed ship-task teardown invokes fm-nas-deploy-sync.sh, which syncs and restarts the live NAS deployment"
+}
+
+test_clean_behind_fast_forwards_and_restarts
+test_dirty_is_skipped_untouched
+test_diverged_is_stuck_untouched
+test_clustered_partial_restart_is_not_masked_online
+test_absent_project_is_silent_noop
+test_hung_fetch_is_bounded_by_timeout
+test_transient_packed_refs_lock_is_retried
+test_missing_map_file_is_silent_noop
+test_teardown_invokes_nas_deploy_sync_for_landed_project
diff --git a/tests/fm-risk-tripwire.test.sh b/tests/fm-risk-tripwire.test.sh
new file mode 100755
index 000000000..bccf020fa
--- /dev/null
+++ b/tests/fm-risk-tripwire.test.sh
@@ -0,0 +1,698 @@
+#!/usr/bin/env bash
+# Tests for bin/fm-risk-tripwire.sh: a brief mentioning a risk-adjacent term,
+# or a diff touching a risk-adjacent path, must trip the wire regardless of
+# how the task's dispatch rule classified it - the mechanical, structurally
+# different check behind AGENTS.md section 4's risk floor.
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+fm_git_identity fmtest fmtest@example.invalid
+
+TRIPWIRE="$ROOT/bin/fm-risk-tripwire.sh"
+TMP_ROOT=$(fm_test_tmproot fm-risk-tripwire-tests)
+
+make_case() {
+  local name=$1 case_dir
+  case_dir="$TMP_ROOT/$name"
+  mkdir -p "$case_dir/state" "$case_dir/data/task-x1"
+
+  git init -q --bare "$case_dir/origin.git"
+  git -C "$case_dir/origin.git" symbolic-ref HEAD refs/heads/main
+  git clone -q "$case_dir/origin.git" "$case_dir/_seed" 2>/dev/null
+  printf 'base\n' > "$case_dir/_seed/feature.txt"
+  git -C "$case_dir/_seed" add feature.txt
+  git -C "$case_dir/_seed" -c user.email=t@t -c user.name=t commit -qm "origin baseline"
+  git -C "$case_dir/_seed" push -q origin main
+  rm -rf "$case_dir/_seed"
+
+  git clone -q "$case_dir/origin.git" "$case_dir/project"
+  git -C "$case_dir/project" remote set-head origin main 2>/dev/null || true
+  git -C "$case_dir/project" worktree add -q -b "fm/$name" "$case_dir/wt" main
+
+  printf '%s\n' "$case_dir"
+}
+
+write_task_meta() {
+  local case_dir=$1
+  fm_write_meta "$case_dir/state/task-x1.meta" \
+    "window=fm-task-x1" \
+    "worktree=$case_dir/wt" \
+    "project=$case_dir/project"
+}
+
+run_tripwire() {
+  local case_dir=$1
+  FM_ROOT_OVERRIDE="$ROOT" \
+  FM_STATE_OVERRIDE="$case_dir/state" \
+  FM_DATA_OVERRIDE="$case_dir/data" \
+    "$TRIPWIRE" task-x1
+}
+
+# Scaffold a real ship brief via bin/fm-brief.sh, then substitute the {TASK}
+# placeholder with the given task text - exercising the actual scaffold
+# boilerplate rather than a hand-written stand-in. Any extra args (e.g.
+# --herdr-lab) are forwarded to fm-brief.sh so tests cover the real injected
+# sections, not a stand-in.
+scaffold_brief() {
+  local case_dir=$1 task=$2 brief
+  shift 2
+  mkdir -p "$case_dir/state"
+  FM_ROOT_OVERRIDE="$ROOT" FM_DATA_OVERRIDE="$case_dir/data" FM_STATE_OVERRIDE="$case_dir/state" \
+    "$ROOT/bin/fm-brief.sh" task-x1 someproject "$@" >/dev/null 2>&1
+  brief="$case_dir/data/task-x1/brief.md"
+  sed "s|{TASK}|$task|" "$brief" > "$brief.tmp" && mv "$brief.tmp" "$brief"
+}
+
+test_clean_brief_and_diff_passes() {
+  local case_dir out status
+  case_dir=$(make_case clean)
+  printf 'Add a --json flag to the status command.\n' > "$case_dir/data/task-x1/brief.md"
+  printf 'ordinary change\n' > "$case_dir/wt/feature.txt"
+  git -C "$case_dir/wt" add feature.txt
+  git -C "$case_dir/wt" commit -qm "ordinary change"
+  write_task_meta "$case_dir"
+
+  set +e
+  out=$(run_tripwire "$case_dir")
+  status=$?
+  set -e
+
+  expect_code 0 "$status" "clean: an ordinary brief and diff must not trip the wire"
+  [ -z "$out" ] || fail "clean: expected no RISK output, got: $out"
+  pass "fm-risk-tripwire passes a clean brief and diff"
+}
+
+test_brief_keyword_trips_wire() {
+  local case_dir out status
+  case_dir=$(make_case brief-keyword)
+  printf 'Add a data migration for the new billing schema.\n' > "$case_dir/data/task-x1/brief.md"
+  write_task_meta "$case_dir"
+
+  set +e
+  out=$(run_tripwire "$case_dir")
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "brief-keyword: a risk-worded brief must trip the wire"
+  assert_contains "$out" "RISK: brief for task-x1 mentions risk-adjacent term(s)" "brief-keyword: should name the brief hit"
+  assert_contains "$out" "migration" "brief-keyword: should surface the matched term"
+  pass "fm-risk-tripwire trips on a brief that mentions risk-adjacent terms"
+}
+
+test_diff_path_trips_wire() {
+  local case_dir out status
+  case_dir=$(make_case diff-path)
+  printf 'Fix a typo in the help text.\n' > "$case_dir/data/task-x1/brief.md"
+  mkdir -p "$case_dir/wt/lib/auth"
+  printf 'session handling\n' > "$case_dir/wt/lib/auth/session.rb"
+  git -C "$case_dir/wt" add lib/auth/session.rb
+  git -C "$case_dir/wt" commit -qm "touch auth session code"
+  write_task_meta "$case_dir"
+
+  set +e
+  out=$(run_tripwire "$case_dir")
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "diff-path: a diff touching an auth path must trip the wire"
+  assert_contains "$out" "RISK: diff for task-x1 touches risk-adjacent path(s)" "diff-path: should name the diff hit"
+  assert_contains "$out" "lib/auth/session.rb" "diff-path: should list the risky path"
+  pass "fm-risk-tripwire trips on a diff that touches an auth-adjacent path"
+}
+
+test_brief_only_mode_before_worktree_exists() {
+  local case_dir out status
+  case_dir="$TMP_ROOT/brief-only"
+  mkdir -p "$case_dir/state" "$case_dir/data/task-x1"
+  printf 'Rotate the payment provider credentials.\n' > "$case_dir/data/task-x1/brief.md"
+
+  set +e
+  out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" FM_DATA_OVERRIDE="$case_dir/data" "$TRIPWIRE" task-x1)
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "brief-only: brief-only checkpoint must work before any meta/worktree exists"
+  assert_contains "$out" "RISK:" "brief-only: should still trip on the brief text alone"
+  pass "fm-risk-tripwire checks the brief alone before a task has been spawned"
+}
+
+test_nothing_to_check_errors() {
+  local case_dir out status
+  case_dir="$TMP_ROOT/nothing-to-check"
+  mkdir -p "$case_dir/state" "$case_dir/data"
+
+  set +e
+  out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" FM_DATA_OVERRIDE="$case_dir/data" "$TRIPWIRE" task-x1 2>&1)
+  status=$?
+  set -e
+
+  expect_code 2 "$status" "nothing-to-check: neither a brief nor meta must error distinctly"
+  assert_contains "$out" "nothing to check" "nothing-to-check: should explain there was nothing to check"
+  pass "fm-risk-tripwire errors distinctly when neither a brief nor a usable worktree exists"
+}
+
+test_scaffolded_brief_boilerplate_does_not_trip() {
+  local case_dir out status
+  case_dir="$TMP_ROOT/scaffold-clean"
+  scaffold_brief "$case_dir" "Fix a typo in the CLI help text."
+
+  set +e
+  out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" FM_DATA_OVERRIDE="$case_dir/data" "$TRIPWIRE" task-x1 2>&1)
+  status=$?
+  set -e
+
+  expect_code 0 "$status" "scaffold-clean: a real scaffolded ship brief with a benign task must not trip"
+  [ -z "$out" ] || fail "scaffold-clean: expected no RISK output from scaffold boilerplate, got: $out"
+  pass "fm-risk-tripwire does not trip on fm-brief.sh scaffold boilerplate"
+}
+
+test_scaffolded_brief_risky_task_still_trips() {
+  local case_dir out status
+  case_dir="$TMP_ROOT/scaffold-risky"
+  scaffold_brief "$case_dir" "Rotate the payment credentials and run the schema migration."
+
+  set +e
+  out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" FM_DATA_OVERRIDE="$case_dir/data" "$TRIPWIRE" task-x1)
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "scaffold-risky: a risk-worded task body inside a real scaffold must still trip"
+  assert_contains "$out" "RISK: brief for task-x1" "scaffold-risky: should name the brief hit"
+  pass "fm-risk-tripwire still scans the task body of a scaffolded brief"
+}
+
+test_herdr_lab_boilerplate_does_not_trip() {
+  # The --herdr-lab contract fm-brief.sh injects between # Task and # Setup is
+  # dense with "session"/"--session"; it is scaffold boilerplate, so a benign
+  # task must not trip on it.
+  local case_dir out status
+  case_dir="$TMP_ROOT/scaffold-herdr-clean"
+  scaffold_brief "$case_dir" "Fix a typo in the CLI help text." --herdr-lab
+
+  set +e
+  out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" FM_DATA_OVERRIDE="$case_dir/data" "$TRIPWIRE" task-x1 2>&1)
+  status=$?
+  set -e
+
+  expect_code 0 "$status" "scaffold-herdr-clean: the --herdr-lab contract's own 'session' text must not trip a benign task"
+  [ -z "$out" ] || fail "scaffold-herdr-clean: expected no RISK output from --herdr-lab boilerplate, got: $out"
+  pass "fm-risk-tripwire does not trip on --herdr-lab scaffold boilerplate"
+}
+
+test_herdr_lab_risky_task_still_trips() {
+  # The Herdr block is now a scan boundary, so its "session" text is excluded -
+  # but the real task body between # Task and the Herdr heading must still be
+  # scanned, and the boilerplate's "session" must not leak into the hit list.
+  local case_dir out status
+  case_dir="$TMP_ROOT/scaffold-herdr-risky"
+  scaffold_brief "$case_dir" "Rotate the payment credentials and run the schema migration." --herdr-lab
+
+  set +e
+  out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" FM_DATA_OVERRIDE="$case_dir/data" "$TRIPWIRE" task-x1)
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "scaffold-herdr-risky: a risk-worded task body must still trip under --herdr-lab"
+  assert_contains "$out" "RISK: brief for task-x1" "scaffold-herdr-risky: should name the brief hit"
+  assert_contains "$out" "payment" "scaffold-herdr-risky: should surface the real task-body term"
+  case "$out" in
+    *session*) fail "scaffold-herdr-risky: the Herdr boilerplate's 'session' must not leak into the hit list, got: $out" ;;
+  esac
+  pass "fm-risk-tripwire scans the task body but excludes the --herdr-lab Herdr block"
+}
+
+test_word_boundary_avoids_substring_false_positive() {
+  local case_dir out status
+  case_dir="$TMP_ROOT/word-boundary"
+  mkdir -p "$case_dir/state" "$case_dir/data/task-x1"
+  printf '# Task\nMake the config loader the authoritative source of truth.\n\n# Setup\nnothing risky here.\n' \
+    > "$case_dir/data/task-x1/brief.md"
+
+  set +e
+  out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" FM_DATA_OVERRIDE="$case_dir/data" "$TRIPWIRE" task-x1)
+  status=$?
+  set -e
+
+  expect_code 0 "$status" "word-boundary: 'authoritative' must not match the 'auth' keyword"
+  [ -z "$out" ] || fail "word-boundary: expected no RISK output, got: $out"
+  pass "fm-risk-tripwire does not treat 'authoritative' as an auth keyword hit"
+}
+
+test_inflected_keyword_still_trips() {
+  local case_dir out status
+  case_dir="$TMP_ROOT/inflected"
+  mkdir -p "$case_dir/state" "$case_dir/data/task-x1"
+  printf '# Task\nRun the pending database migrations and rotate the tokens.\n\n# Setup\nx\n' \
+    > "$case_dir/data/task-x1/brief.md"
+
+  set +e
+  out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" FM_DATA_OVERRIDE="$case_dir/data" "$TRIPWIRE" task-x1)
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "inflected: a plural risk word must still trip (no false negative)"
+  assert_contains "$out" "migration" "inflected: should surface the matched migration term"
+  pass "fm-risk-tripwire still trips on inflected/plural risk words"
+}
+
+test_supervision_bin_path_does_not_trip() {
+  local case_dir out status
+  case_dir=$(make_case bin-path)
+  printf 'Tune the watcher poll cadence.\n' > "$case_dir/data/task-x1/brief.md"
+  mkdir -p "$case_dir/wt/bin"
+  printf 'watcher tweak\n' > "$case_dir/wt/bin/fm-watch.sh"
+  printf 'guard tweak\n' > "$case_dir/wt/bin/fm-guard.sh"
+  git -C "$case_dir/wt" add bin/fm-watch.sh bin/fm-guard.sh
+  git -C "$case_dir/wt" commit -qm "tweak supervision backbone"
+  write_task_meta "$case_dir"
+
+  set +e
+  out=$(run_tripwire "$case_dir")
+  status=$?
+  set -e
+
+  expect_code 0 "$status" "bin-path: a supervision-backbone bin/ change alone must not trip the wire"
+  [ -z "$out" ] || fail "bin-path: expected no RISK output, got: $out"
+  pass "fm-risk-tripwire does not trip on a supervision-backbone bin/ path"
+}
+
+test_usage_error_exit_code() {
+  local status
+  set +e
+  FM_ROOT_OVERRIDE="$ROOT" "$TRIPWIRE" >/dev/null 2>&1
+  status=$?
+  set -e
+  expect_code 2 "$status" "usage-empty-id: a malformed invocation must exit 2, not 1 (the RISK code)"
+
+  set +e
+  FM_ROOT_OVERRIDE="$ROOT" "$TRIPWIRE" one two >/dev/null 2>&1
+  status=$?
+  set -e
+  expect_code 2 "$status" "usage-extra-args: extra args must exit 2, not 1 (the RISK code)"
+  pass "fm-risk-tripwire uses a distinct exit code for malformed invocations"
+}
+
+test_embedded_comment_task_body_still_scanned() {
+  local case_dir out status
+  case_dir="$TMP_ROOT/embedded-comment"
+  mkdir -p "$case_dir/state" "$case_dir/data/task-x1"
+  # A column-0 "# " line inside the task body (a shell comment in an example
+  # command) must NOT end the Task-section scan, or the risk words after it are
+  # silently dropped - the dangerous direction for a safety floor.
+  printf '# Task\nImplement the DB runner. Example invocation:\n# then run the schema migration and rotate the tokens\n./run up\n\n# Setup\nnothing risky here.\n' \
+    > "$case_dir/data/task-x1/brief.md"
+
+  set +e
+  out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" FM_DATA_OVERRIDE="$case_dir/data" "$TRIPWIRE" task-x1)
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "embedded-comment: risk text after an embedded '# ' line must still be scanned"
+  assert_contains "$out" "schema" "embedded-comment: should surface the term on the embedded comment line"
+  assert_contains "$out" "migration" "embedded-comment: should surface the migration term after the comment line"
+  pass "fm-risk-tripwire keeps scanning the task body past an embedded '# ' comment line"
+}
+
+test_auth_verbs_trip_wire() {
+  local verb case_dir out status i=0
+  for verb in authorize authorized authorizing authenticate authenticated; do
+    i=$((i + 1))
+    case_dir="$TMP_ROOT/auth-verb-$i"
+    mkdir -p "$case_dir/state" "$case_dir/data/task-x1"
+    printf '# Task\nAdd middleware to %s admin requests.\n\n# Setup\nx\n' "$verb" \
+      > "$case_dir/data/task-x1/brief.md"
+
+    set +e
+    out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" FM_DATA_OVERRIDE="$case_dir/data" "$TRIPWIRE" task-x1)
+    status=$?
+    set -e
+
+    expect_code 1 "$status" "auth-verb: '$verb' must trip the wire"
+    assert_contains "$out" "RISK: brief for task-x1" "auth-verb: '$verb' should name the brief hit"
+  done
+  pass "fm-risk-tripwire trips on auth verbs (authorize/authenticate families)"
+}
+
+test_auth_nouns_do_not_false_positive() {
+  local word case_dir out status i=0
+  for word in authoritative author; do
+    i=$((i + 1))
+    case_dir="$TMP_ROOT/auth-noun-$i"
+    mkdir -p "$case_dir/state" "$case_dir/data/task-x1"
+    printf '# Task\nMake the loader the %s source of config.\n\n# Setup\nx\n' "$word" \
+      > "$case_dir/data/task-x1/brief.md"
+
+    set +e
+    out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" FM_DATA_OVERRIDE="$case_dir/data" "$TRIPWIRE" task-x1)
+    status=$?
+    set -e
+
+    expect_code 0 "$status" "auth-noun: '$word' must not trip the wire"
+    [ -z "$out" ] || fail "auth-noun: '$word' expected no RISK output, got: $out"
+  done
+  pass "fm-risk-tripwire does not treat 'authoritative'/'author' as auth hits"
+}
+
+test_session_start_bin_path_does_not_trip() {
+  local case_dir out status
+  case_dir=$(make_case session-start)
+  printf 'Tune the digest ordering.\n' > "$case_dir/data/task-x1/brief.md"
+  mkdir -p "$case_dir/wt/bin"
+  printf 'digest tweak\n' > "$case_dir/wt/bin/fm-session-start.sh"
+  git -C "$case_dir/wt" add bin/fm-session-start.sh
+  git -C "$case_dir/wt" commit -qm "tweak session-start"
+  write_task_meta "$case_dir"
+
+  set +e
+  out=$(run_tripwire "$case_dir")
+  status=$?
+  set -e
+
+  expect_code 0 "$status" "session-start: 'session' as a hyphen fragment of a supervision script must not trip"
+  [ -z "$out" ] || fail "session-start: expected no RISK output, got: $out"
+  pass "fm-risk-tripwire does not trip on bin/fm-session-start.sh"
+}
+
+test_auth_setup_bin_path_trips() {
+  local case_dir out status
+  case_dir=$(make_case auth-setup)
+  printf 'Wire up the setup helper.\n' > "$case_dir/data/task-x1/brief.md"
+  mkdir -p "$case_dir/wt/bin"
+  printf 'setup\n' > "$case_dir/wt/bin/auth-setup.sh"
+  git -C "$case_dir/wt" add bin/auth-setup.sh
+  git -C "$case_dir/wt" commit -qm "add auth setup"
+  write_task_meta "$case_dir"
+
+  set +e
+  out=$(run_tripwire "$case_dir")
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "auth-setup: 'auth' as a real hyphen token must still trip under bin/"
+  assert_contains "$out" "bin/auth-setup.sh" "auth-setup: should list the risky path"
+  pass "fm-risk-tripwire still trips on bin/auth-setup.sh via its auth token"
+}
+
+test_dot_delimited_strong_token_trips() {
+  local case_dir out status
+  case_dir=$(make_case dot-token)
+  printf 'Update the generated config file.\n' > "$case_dir/data/task-x1/brief.md"
+  mkdir -p "$case_dir/wt/config"
+  printf 'x\n' > "$case_dir/wt/config/db.schema.json"
+  git -C "$case_dir/wt" add config/db.schema.json
+  git -C "$case_dir/wt" commit -qm "add db schema config"
+  write_task_meta "$case_dir"
+
+  set +e
+  out=$(run_tripwire "$case_dir")
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "dot-token: 'schema' as an interior dot token must trip"
+  assert_contains "$out" "config/db.schema.json" "dot-token: should list the risky path"
+  pass "fm-risk-tripwire trips on a strong risk word as a dot-delimited token"
+}
+
+test_authors_doc_path_does_not_trip() {
+  local case_dir out status
+  case_dir=$(make_case authors-doc)
+  printf 'Add a contributors list.\n' > "$case_dir/data/task-x1/brief.md"
+  mkdir -p "$case_dir/wt/docs"
+  printf 'names\n' > "$case_dir/wt/docs/authors.md"
+  git -C "$case_dir/wt" add docs/authors.md
+  git -C "$case_dir/wt" commit -qm "add authors doc"
+  write_task_meta "$case_dir"
+
+  set +e
+  out=$(run_tripwire "$case_dir")
+  status=$?
+  set -e
+
+  expect_code 0 "$status" "authors-doc: 'authors' is not the 'auth' token, must not trip"
+  [ -z "$out" ] || fail "authors-doc: expected no RISK output, got: $out"
+  pass "fm-risk-tripwire does not trip on docs/authors.md"
+}
+
+test_migrate_verbs_trip_wire() {
+  local verb case_dir out status i=0
+  for verb in migrate migrating migrated; do
+    i=$((i + 1))
+    case_dir="$TMP_ROOT/migrate-verb-$i"
+    mkdir -p "$case_dir/state" "$case_dir/data/task-x1"
+    printf '# Task\n%s the customers table to the new engine.\n\n# Setup\nx\n' "$verb" \
+      > "$case_dir/data/task-x1/brief.md"
+
+    set +e
+    out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" FM_DATA_OVERRIDE="$case_dir/data" "$TRIPWIRE" task-x1)
+    status=$?
+    set -e
+
+    expect_code 1 "$status" "migrate-verb: '$verb' must trip the wire"
+    assert_contains "$out" "RISK: brief for task-x1" "migrate-verb: '$verb' should name the brief hit"
+  done
+  pass "fm-risk-tripwire trips on migrate verb forms (migrate/migrating/migrated)"
+}
+
+test_auth_prefix_forms_trip_wire() {
+  local word case_dir out status i=0
+  for word in unauthorized unauthenticated reauthenticate deauthorize; do
+    i=$((i + 1))
+    case_dir="$TMP_ROOT/auth-prefix-$i"
+    mkdir -p "$case_dir/state" "$case_dir/data/task-x1"
+    printf '# Task\nReject %s requests at the gateway.\n\n# Setup\nx\n' "$word" \
+      > "$case_dir/data/task-x1/brief.md"
+
+    set +e
+    out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" FM_DATA_OVERRIDE="$case_dir/data" "$TRIPWIRE" task-x1)
+    status=$?
+    set -e
+
+    expect_code 1 "$status" "auth-prefix: '$word' must trip the wire"
+  done
+  pass "fm-risk-tripwire trips on prefixed auth forms (unauthorized/unauthenticated/...)"
+}
+
+test_authenticator_noun_trips_wire() {
+  local word case_dir out status i=0
+  for word in authenticator authenticators; do
+    i=$((i + 1))
+    case_dir="$TMP_ROOT/authenticator-$i"
+    mkdir -p "$case_dir/state" "$case_dir/data/task-x1"
+    printf '# Task\nAdd support for hardware %s at login.\n\n# Setup\nx\n' "$word" \
+      > "$case_dir/data/task-x1/brief.md"
+
+    set +e
+    out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" FM_DATA_OVERRIDE="$case_dir/data" "$TRIPWIRE" task-x1)
+    status=$?
+    set -e
+
+    expect_code 1 "$status" "authenticator: '$word' must trip the wire"
+  done
+  pass "fm-risk-tripwire trips on authenticator/authenticators nouns"
+}
+
+test_snake_case_risk_word_trips() {
+  local case_dir out status
+  case_dir="$TMP_ROOT/snake-case"
+  mkdir -p "$case_dir/state" "$case_dir/data/task-x1"
+  printf '# Task\nImplement the runner. Call run_schema_migration_now to apply it.\n\n# Setup\nx\n' \
+    > "$case_dir/data/task-x1/brief.md"
+
+  set +e
+  out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" FM_DATA_OVERRIDE="$case_dir/data" "$TRIPWIRE" task-x1)
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "snake-case: a risk word inside a snake_case identifier must trip"
+  assert_contains "$out" "schema" "snake-case: should surface the schema token"
+  assert_contains "$out" "migration" "snake-case: should surface the migration token"
+  pass "fm-risk-tripwire splits snake_case identifiers so embedded risk words trip"
+}
+
+test_task_body_inline_heading_still_scanned() {
+  local case_dir out status
+  case_dir="$TMP_ROOT/inline-heading"
+  mkdir -p "$case_dir/state" "$case_dir/data/task-x1"
+  # A bare "# Setup" quoted inline in the task body (not blank-line-preceded, as
+  # the real scaffold heading always is) must NOT terminate the scan early.
+  printf '# Task\nDo the thing. Configuration follows:\n# Setup\nRotate the credentials and run the migration.\n\n# Setup\nbenign boilerplate goes here.\n' \
+    > "$case_dir/data/task-x1/brief.md"
+
+  set +e
+  out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" FM_DATA_OVERRIDE="$case_dir/data" "$TRIPWIRE" task-x1)
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "inline-heading: risk text after an inline (non-blank-preceded) '# Setup' must still be scanned"
+  assert_contains "$out" "credential" "inline-heading: should surface the credentials term"
+  assert_contains "$out" "migration" "inline-heading: should surface the migration term"
+  pass "fm-risk-tripwire keeps scanning past an inline heading that is not the scaffold boundary"
+}
+
+test_authorizer_path_trips() {
+  local case_dir out status
+  case_dir=$(make_case authorizer-path)
+  printf 'Refactor the request pipeline.\n' > "$case_dir/data/task-x1/brief.md"
+  mkdir -p "$case_dir/wt/app/authorizers"
+  printf 'x\n' > "$case_dir/wt/app/authorizers/user_authorizer.rb"
+  git -C "$case_dir/wt" add app/authorizers/user_authorizer.rb
+  git -C "$case_dir/wt" commit -qm "add user authorizer"
+  write_task_meta "$case_dir"
+
+  set +e
+  out=$(run_tripwire "$case_dir")
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "authorizer-path: an 'authorizer' component must trip (path authoriz stem parity)"
+  assert_contains "$out" "app/authorizers/user_authorizer.rb" "authorizer-path: should list the risky path"
+  pass "fm-risk-tripwire trips on authorizer paths"
+}
+
+test_bare_auth_matches_but_authoritative_does_not() {
+  # Guards the portable word boundary against silently no-op'ing on BSD grep: a
+  # no-op that matches nothing would miss the bare 'auth' (part b), and a no-op
+  # that matches substrings would trip on 'authoritative' (part a). Both asserted.
+  local case_dir out status
+  # (a) 'authoritative' alone must not match the 'auth' keyword.
+  case_dir="$TMP_ROOT/authoritative-only"
+  mkdir -p "$case_dir/state" "$case_dir/data/task-x1"
+  printf '# Task\nMake the loader the authoritative config source only.\n\n# Setup\nx\n' \
+    > "$case_dir/data/task-x1/brief.md"
+  set +e
+  out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" FM_DATA_OVERRIDE="$case_dir/data" "$TRIPWIRE" task-x1)
+  status=$?
+  set -e
+  expect_code 0 "$status" "authoritative-only: 'authoritative' must not match the auth keyword"
+  [ -z "$out" ] || fail "authoritative-only: expected no RISK output, got: $out"
+
+  # (b) a bare 'auth' word appearing mid-line (not at the string edges) must trip.
+  case_dir="$TMP_ROOT/bare-auth-midline"
+  mkdir -p "$case_dir/state" "$case_dir/data/task-x1"
+  printf '# Task\nPlease auth the request before the handler runs.\n\n# Setup\nx\n' \
+    > "$case_dir/data/task-x1/brief.md"
+  set +e
+  out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" FM_DATA_OVERRIDE="$case_dir/data" "$TRIPWIRE" task-x1)
+  status=$?
+  set -e
+  expect_code 1 "$status" "bare-auth-midline: a standalone mid-line 'auth' must trip the wire"
+  assert_contains "$out" "auth" "bare-auth-midline: should surface the auth token"
+  pass "fm-risk-tripwire matches a bare mid-line 'auth' but never 'authoritative'"
+}
+
+test_adjacent_keywords_both_reported() {
+  # A boundary-consuming grep -o pattern drops the second word of an adjacent
+  # pair (the shared delimiter is eaten); whole-token matching reports both.
+  local case_dir out status
+  case_dir="$TMP_ROOT/adjacent-pair"
+  mkdir -p "$case_dir/state" "$case_dir/data/task-x1"
+  printf '# Task\nRotate the session token on every login.\n\n# Setup\nx\n' \
+    > "$case_dir/data/task-x1/brief.md"
+  set +e
+  out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" FM_DATA_OVERRIDE="$case_dir/data" "$TRIPWIRE" task-x1)
+  status=$?
+  set -e
+  expect_code 1 "$status" "adjacent-pair: adjacent risk words must trip"
+  assert_contains "$out" "session" "adjacent-pair: should surface session"
+  assert_contains "$out" "token" "adjacent-pair: should surface the adjacent token too"
+  pass "fm-risk-tripwire reports both words of an adjacent risk pair"
+}
+
+test_unresolvable_diff_base_is_not_a_clean_pass() {
+  # A meta with a real worktree/project but an unresolvable diff base (no default
+  # branch, no origin) must NOT silently read as a clean pass (exit 0). The
+  # binding second checkpoint could not run, so it must warn and report
+  # could-not-check (2), matching the sibling fm-tier-guard.sh/fm-review-diff.sh.
+  local case_dir out status
+  case_dir="$TMP_ROOT/unresolvable-base"
+  mkdir -p "$case_dir/state" "$case_dir/wt"
+  git init -q "$case_dir/project"
+
+  fm_write_meta "$case_dir/state/task-x1.meta" \
+    "window=fm-task-x1" \
+    "worktree=$case_dir/wt" \
+    "project=$case_dir/project"
+
+  set +e
+  out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" FM_DATA_OVERRIDE="$case_dir/data" "$TRIPWIRE" task-x1 2>&1)
+  status=$?
+  set -e
+
+  expect_code 2 "$status" "unresolvable-base: an unresolvable diff base must read as could-not-check (2), not a clean pass (0)"
+  assert_contains "$out" "could not resolve a diff base" "unresolvable-base: should warn that the diff checkpoint did not run"
+  pass "fm-risk-tripwire reports could-not-check when the diff base is unresolvable, not a clean pass"
+}
+
+test_unresolvable_diff_base_still_reports_brief_hit() {
+  # A brief risk hit must still win (exit 1) even when the diff base is
+  # unresolvable - the risk floor beats the could-not-check downgrade.
+  local case_dir out status
+  case_dir="$TMP_ROOT/unresolvable-base-brief-hit"
+  mkdir -p "$case_dir/state" "$case_dir/wt" "$case_dir/data/task-x1"
+  git init -q "$case_dir/project"
+  printf 'Add a data migration for the new billing schema.\n' > "$case_dir/data/task-x1/brief.md"
+
+  fm_write_meta "$case_dir/state/task-x1.meta" \
+    "window=fm-task-x1" \
+    "worktree=$case_dir/wt" \
+    "project=$case_dir/project"
+
+  set +e
+  out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" FM_DATA_OVERRIDE="$case_dir/data" "$TRIPWIRE" task-x1 2>/dev/null)
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "unresolvable-base-brief-hit: a brief risk hit must still win (1) even when the diff base is unresolvable"
+  assert_contains "$out" "RISK: brief for task-x1" "unresolvable-base-brief-hit: should still name the brief hit"
+  pass "fm-risk-tripwire still reports a brief hit (1) when the diff base is unresolvable"
+}
+
+test_multiword_phrase_keyword_trips() {
+  local case_dir out status
+  case_dir="$TMP_ROOT/phrase-keyword"
+  mkdir -p "$case_dir/state" "$case_dir/data/task-x1"
+  printf '# Task\nEnforce access control and handle data deletion on the endpoint.\n\n# Setup\nx\n' \
+    > "$case_dir/data/task-x1/brief.md"
+  set +e
+  out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" FM_DATA_OVERRIDE="$case_dir/data" "$TRIPWIRE" task-x1)
+  status=$?
+  set -e
+  expect_code 1 "$status" "phrase-keyword: a multi-word risk phrase must still trip"
+  assert_contains "$out" "access control" "phrase-keyword: should surface the access control phrase"
+  pass "fm-risk-tripwire still trips on multi-word risk phrases"
+}
+
+test_clean_brief_and_diff_passes
+test_bare_auth_matches_but_authoritative_does_not
+test_adjacent_keywords_both_reported
+test_unresolvable_diff_base_is_not_a_clean_pass
+test_unresolvable_diff_base_still_reports_brief_hit
+test_multiword_phrase_keyword_trips
+test_brief_keyword_trips_wire
+test_diff_path_trips_wire
+test_brief_only_mode_before_worktree_exists
+test_nothing_to_check_errors
+test_scaffolded_brief_boilerplate_does_not_trip
+test_scaffolded_brief_risky_task_still_trips
+test_herdr_lab_boilerplate_does_not_trip
+test_herdr_lab_risky_task_still_trips
+test_word_boundary_avoids_substring_false_positive
+test_inflected_keyword_still_trips
+test_supervision_bin_path_does_not_trip
+test_usage_error_exit_code
+test_embedded_comment_task_body_still_scanned
+test_auth_verbs_trip_wire
+test_auth_nouns_do_not_false_positive
+test_session_start_bin_path_does_not_trip
+test_auth_setup_bin_path_trips
+test_dot_delimited_strong_token_trips
+test_authors_doc_path_does_not_trip
+test_migrate_verbs_trip_wire
+test_auth_prefix_forms_trip_wire
+test_authenticator_noun_trips_wire
+test_snake_case_risk_word_trips
+test_task_body_inline_heading_still_scanned
+test_authorizer_path_trips
+
+echo "# all fm-risk-tripwire tests passed"
diff --git a/tests/fm-secondmate-lifecycle-e2e.test.sh b/tests/fm-secondmate-lifecycle-e2e.test.sh
index fd71fdb35..3c7befc0b 100755
--- a/tests/fm-secondmate-lifecycle-e2e.test.sh
+++ b/tests/fm-secondmate-lifecycle-e2e.test.sh
@@ -27,6 +27,9 @@ set -u
 # shellcheck source=tests/secondmate-helpers.sh disable=SC1091
 . "$(dirname "${BASH_SOURCE[0]}")/secondmate-helpers.sh"
 
+# Reclaim any leftover root from a prior run killed abnormally (e.g. by the OOM
+# killer, which SIGKILLs and so bypasses every EXIT trap) before adding another.
+fm_test_sweep_stale_tmproots fm-secondmate-lifecycle
 TMP_ROOT=$(fm_test_tmproot fm-secondmate-lifecycle)
 export FM_BACKEND=tmux
 
@@ -130,6 +133,10 @@ phase_spawn() {
   assert_no_grep 'notify=' "$LOG" "secondmate codex launch included the parent turn-end notify hook"
   assert_no_grep 'turn-ended' "$LOG" "secondmate codex launch referenced a parent turn-ended signal"
   assert_no_grep 'treehouse get' "$LOG" "secondmate spawn ran a project treehouse get"
+  # A secondmate operates in its own persistent home, not a per-task pool
+  # worktree, so it never gets the docker-compose isolation marker.
+  assert_absent "$SUB/.treehouse-compose-project" "secondmate spawn wrongly wrote a compose-project marker into its home"
+  assert_no_grep 'compose_project=' "$meta" "secondmate spawn meta wrongly recorded compose_project="
   pass "spawn: launches in the subhome with persistent charter, records routing meta"
 }
 
@@ -151,10 +158,13 @@ phase_send() {
 }
 
 phase_handoff() {
-  # The move is delegated to `tasks-axi mv`; skip cleanly when it is absent (the
-  # downstream recovery and teardown phases do not depend on this phase).
-  if ! command -v tasks-axi >/dev/null 2>&1; then
-    echo "skip: tasks-axi not found (backlog handoff delegates to it)"
+  # The move is delegated to `tasks-axi mv`; skip cleanly when it is absent or
+  # too old for atomic multi-ID moves (the downstream recovery and teardown
+  # phases do not depend on this phase).
+  # shellcheck source=bin/fm-tasks-axi-lib.sh disable=SC1091
+  . "$ROOT/bin/fm-tasks-axi-lib.sh"
+  if ! fm_tasks_axi_compatible; then
+    echo "skip: tasks-axi not found or too old (backlog handoff delegates to it)"
     return 0
   fi
   cat > "$HOME_DIR/data/backlog.md" <<'EOF'
diff --git a/tests/fm-secondmate-safety.test.sh b/tests/fm-secondmate-safety.test.sh
index bf6551605..f31f970a7 100755
--- a/tests/fm-secondmate-safety.test.sh
+++ b/tests/fm-secondmate-safety.test.sh
@@ -10,6 +10,11 @@ set -u
 # shellcheck source=tests/secondmate-helpers.sh disable=SC1091
 . "$(dirname "${BASH_SOURCE[0]}")/secondmate-helpers.sh"
 
+# This suite clones the full firstmate repo (git clone --quiet "$ROOT") into
+# several fixtures, so a leftover root from a prior run killed abnormally (e.g.
+# by the OOM killer, which SIGKILLs and so bypasses every EXIT trap) is worth
+# reclaiming before adding another one of our own.
+fm_test_sweep_stale_tmproots fm-secondmate-safety
 TMP_ROOT=$(fm_test_tmproot fm-secondmate-safety)
 export FM_BACKEND=tmux
 
diff --git a/tests/fm-session-start.test.sh b/tests/fm-session-start.test.sh
index 6ae0d124b..987829d88 100755
--- a/tests/fm-session-start.test.sh
+++ b/tests/fm-session-start.test.sh
@@ -243,6 +243,10 @@ SH
 # (no ambient markers) still passes.
 run_session_start() {
   local home=$1 root=$2 path=$3
+  # Unset the harness environment markers so the faked `ps` is the sole source of
+  # harness detection. Run from inside a real harness session (e.g. CLAUDECODE=1),
+  # fm-harness.sh's env-marker layer would otherwise short-circuit detection and
+  # override the harness the fake `ps` is meant to report. A no-op in a clean shell.
   env -u CLAUDECODE -u PI_CODING_AGENT -u GROK_AGENT \
     FM_HOME="$home" FM_ROOT_OVERRIDE="$root" PATH="$path" \
     "$SESSION_START"
@@ -402,7 +406,10 @@ EOF
   make_fake_toolchain "$fakebin"
   make_fake_ps_claude "$fakebin"
   # Force a MISSING diagnostic line so the bootstrap section is non-trivial.
-  rm -f "$fakebin/node"
+  # Uses chrome-devtools-axi rather than node/tmux/gh: those are common system
+  # packages that can shadow the fakebin removal via $BASE_PATH's real system
+  # directories, making the diagnostic flakily disappear depending on the host.
+  rm -f "$fakebin/chrome-devtools-axi"
 
   printf 'window=fm-sess:w1\nkind=ship\n' > "$home/state/task-a.meta"
 
@@ -425,7 +432,7 @@ EOF
   [ "$context_line" -lt "$fleet_line" ] || fail "CONTEXT did not precede FLEET STATE"
   [ "$fleet_line" -lt "$next_line" ] || fail "FLEET STATE did not precede NEXT STEP"
 
-  missing_line=$(printf '%s\n' "$out" | grep -n 'MISSING: node' | head -1 | cut -d: -f1)
+  missing_line=$(printf '%s\n' "$out" | grep -n 'MISSING: chrome-devtools-axi' | head -1 | cut -d: -f1)
   [ -n "$missing_line" ] || fail "MISSING diagnostic did not appear at all"
   [ "$missing_line" -lt "$fleet_line" ] || fail "actionable MISSING diagnostic was buried after the bulk fleet-state digest"
 
@@ -585,7 +592,9 @@ $rec
 EOF
   make_fake_toolchain "$fakebin"
   make_fake_ps_claude "$fakebin"
-  rm -f "$fakebin/node"
+  # See test_output_ordering_diagnostics_lead: chrome-devtools-axi rather than
+  # node avoids a real system package shadowing the forced-missing tool.
+  rm -f "$fakebin/chrome-devtools-axi"
 
   append_wake "$home/state" signal task-z "needs-decision: pick a library"
 
@@ -594,7 +603,7 @@ EOF
   # fm-lock.sh's own exact success text.
   assert_contains "$out" "lock acquired: harness pid" "fm-lock.sh's real output did not appear (composition, not reimplementation)"
   # fm-bootstrap.sh's own exact MISSING-tool line format.
-  assert_contains "$out" "MISSING: node (install:" "fm-bootstrap.sh's real detect line did not appear verbatim"
+  assert_contains "$out" "MISSING: chrome-devtools-axi (install:" "fm-bootstrap.sh's real detect line did not appear verbatim"
   # fm-wake-drain.sh's real drained record (raw tab-separated queue line).
   assert_contains "$out" "$(printf 'signal\ttask-z\tneeds-decision: pick a library')" "fm-wake-drain.sh's real drained record did not appear"
 
diff --git a/tests/fm-spawn-compose-isolation.test.sh b/tests/fm-spawn-compose-isolation.test.sh
new file mode 100755
index 000000000..496c998ea
--- /dev/null
+++ b/tests/fm-spawn-compose-isolation.test.sh
@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+# tests/fm-spawn-compose-isolation.test.sh - behavior tests for the
+# docker-compose project-name isolation marker (AGENTS.md "Layout and state",
+# bin/fm-spawn.sh's fm_compose_project_name).
+#
+# Two treehouse worktrees of the SAME project always share the same leaf
+# directory basename (e.g. both are checked out at .../<pool>/<slot>/wealthsync),
+# so Compose's default project-naming (derived from cwd basename) collides
+# across them on container/volume/network names. fm-spawn.sh now derives a
+# stable name from the worktree's own pool-slot path and drops it at
+# <worktree>/.treehouse-compose-project, git-excluded so it never pollutes a
+# crewmate's dirty-worktree check or commits, and records it in the task's
+# meta as compose_project=<name>.
+#
+# Drives the REAL bin/fm-spawn.sh end to end, exactly like
+# tests/fm-tangle-guard.test.sh's isolation-abort case: a fake tmux reports
+# FM_FAKE_PANE_PATH as the post-`treehouse get` pane cwd, and a real git
+# worktree is added at a path shaped like a genuine treehouse pool slot
+# (.../<pool>-<hash>/<slot>/<repo-leaf-name>) so fm_compose_project_name sees
+# realistic input. `treehouse` itself is stubbed to exit 0 (unused: the fake
+# tmux answers the cwd query directly).
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+fm_git_identity fmtest fmtest@example.invalid
+
+# A fake tmux that reports FM_FAKE_PANE_PATH as the pane's cwd after
+# `treehouse get`, names the session on '#S', and swallows window ops.
+make_spawn_fakebin() {
+  local dir=$1 fakebin
+  fakebin=$(fm_fakebin "$dir")
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "$*" in
+  *"#{pane_current_path}"*) printf '%s\n' "${FM_FAKE_PANE_PATH:-}"; exit 0 ;;
+esac
+case "${1:-}" in
+  display-message) printf 'firstmate\n'; exit 0 ;;
+  list-windows) exit 0 ;;
+  has-session|new-session|new-window|send-keys) exit 0 ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/tmux"
+  fm_fake_exit0 "$fakebin" treehouse
+  printf '%s\n' "$fakebin"
+}
+
+run_spawn() {  # <home> <id> <proj> <pane> <fakebin> [extra-args...]
+  local home=$1 id=$2 proj=$3 pane=$4 fakebin=$5
+  shift 5
+  mkdir -p "$home/data/$id"
+  printf 'brief\n' > "$home/data/$id/brief.md"
+  FM_ROOT_OVERRIDE='' FM_HOME="$home" \
+    FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
+    FM_PROJECTS_OVERRIDE="$home/projects" FM_CONFIG_OVERRIDE="$home/config" \
+    FM_SPAWN_NO_GUARD=1 FM_FAKE_PANE_PATH="$pane" TMUX="fake,1,0" \
+    PATH="$fakebin:$PATH" \
+    "$ROOT/bin/fm-spawn.sh" "$id" "$proj" codex "$@" 2>&1
+}
+
+# --- two worktrees of the same project, same leaf basename, different pool
+# slots: this is the exact near-miss from the wealthsync incident this fix
+# targets. Each must get its own compose_project name. --------------------
+
+test_two_worktrees_same_leaf_get_distinct_compose_names() {
+  local tmp proj fakebin wt_a wt_b out_a out_b
+  tmp=$(fm_test_tmproot fm-spawn-compose)
+  proj=$(fm_git_init_commit "$tmp/proj" && printf '%s\n' "$tmp/proj")
+  fakebin=$(make_spawn_fakebin "$tmp/fake")
+
+  # Two pool-slot worktrees of the SAME project, sharing the leaf name
+  # "wealthsync" - mirrors a real treehouse pool: <pool>-<hash>/<slot>/<repo>.
+  wt_a="$tmp/wealthsync-323ec0/2/wealthsync"
+  wt_b="$tmp/wealthsync-323ec0/7/wealthsync"
+  git -C "$proj" worktree add -q --detach "$wt_a" || fail "setup: worktree add (slot 2) failed"
+  git -C "$proj" worktree add -q --detach "$wt_b" || fail "setup: worktree add (slot 7) failed"
+
+  out_a=$(run_spawn "$tmp/home" wealthsync-task-a "$proj" "$wt_a" "$fakebin")
+  expect_code 0 "$?" "spawn into pool slot 2 should succeed"
+  assert_contains "$out_a" "spawned wealthsync-task-a" "slot-2 spawn did not report success"
+
+  out_b=$(run_spawn "$tmp/home" wealthsync-task-b "$proj" "$wt_b" "$fakebin")
+  expect_code 0 "$?" "spawn into pool slot 7 should succeed"
+  assert_contains "$out_b" "spawned wealthsync-task-b" "slot-7 spawn did not report success"
+
+  assert_present "$wt_a/.treehouse-compose-project" "slot-2 worktree missing the compose-project marker"
+  assert_present "$wt_b/.treehouse-compose-project" "slot-7 worktree missing the compose-project marker"
+
+  local name_a name_b
+  name_a=$(cat "$wt_a/.treehouse-compose-project")
+  name_b=$(cat "$wt_b/.treehouse-compose-project")
+
+  [ "$name_a" = "wealthsync-323ec0-2" ] || fail "slot-2 compose project name: expected 'wealthsync-323ec0-2', got '$name_a'"
+  [ "$name_b" = "wealthsync-323ec0-7" ] || fail "slot-7 compose project name: expected 'wealthsync-323ec0-7', got '$name_b'"
+  [ "$name_a" != "$name_b" ] || fail "two worktrees of the same project must not collide on the same compose project name"
+
+  assert_grep "compose_project=$name_a" "$tmp/home/state/wealthsync-task-a.meta" "task-a meta missing compose_project="
+  assert_grep "compose_project=$name_b" "$tmp/home/state/wealthsync-task-b.meta" "task-b meta missing compose_project="
+
+  pass "fm-spawn: two worktrees of the same project (same leaf basename, different pool slots) get distinct, stable compose_project names"
+}
+
+# --- the marker must be invisible to the worktree's own git status, so it
+# never trips teardown's dirty-worktree check or leaks into a crewmate commit.
+
+test_marker_is_git_excluded() {
+  local tmp proj fakebin wt status_out
+  tmp=$(fm_test_tmproot fm-spawn-compose-excl)
+  proj=$(fm_git_init_commit "$tmp/proj" && printf '%s\n' "$tmp/proj")
+  fakebin=$(make_spawn_fakebin "$tmp/fake")
+
+  wt="$tmp/excltest-9ab1/3/excltest"
+  git -C "$proj" worktree add -q --detach "$wt" || fail "setup: worktree add failed"
+
+  run_spawn "$tmp/home" excl-task-c "$proj" "$wt" "$fakebin" >/dev/null
+  expect_code 0 "$?" "spawn should succeed"
+  assert_present "$wt/.treehouse-compose-project" "worktree missing the compose-project marker"
+
+  status_out=$(git -C "$wt" status --porcelain)
+  assert_not_contains "$status_out" ".treehouse-compose-project" "compose-project marker must be git-excluded, not shown as untracked"
+
+  pass "fm-spawn: the compose-project marker is excluded from the worktree's own git status"
+}
+
+# Secondmate spawns never write the marker (a secondmate runs in its own
+# persistent firstmate home, not a per-task pool worktree). Setting up a real
+# secondmate home's full validation contract (SUB_HOME_MARKER, AGENTS.md,
+# bin/, registry) duplicates tests/fm-secondmate-lifecycle-e2e.test.sh's own
+# fixture, so that suite's phase_spawn carries the corresponding assertions
+# instead of re-deriving the fixture here.
+
+test_two_worktrees_same_leaf_get_distinct_compose_names
+test_marker_is_git_excluded
diff --git a/tests/fm-spawn-dispatch-profile.test.sh b/tests/fm-spawn-dispatch-profile.test.sh
index d549c9bce..68717c985 100755
--- a/tests/fm-spawn-dispatch-profile.test.sh
+++ b/tests/fm-spawn-dispatch-profile.test.sh
@@ -118,7 +118,7 @@ test_no_profile_keeps_claude_launch_unchanged() {
   assert_meta_profile "$HOME_DIR/state/$id.meta" claude default default
 
   launch=$(cat "$LAUNCH_LOG")
-  expected="CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false claude --dangerously-skip-permissions \"\$(cat '$HOME_DIR/data/$id/brief.md')\""
+  expected="CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false CLAUDE_CODE_AUTO_COMPACT_WINDOW=300000 claude --dangerously-skip-permissions \"\$(cat '$HOME_DIR/data/$id/brief.md')\""
   [ "$launch" = "$expected" ] || fail "no-profile claude launch changed"$'\n'"expected: $expected"$'\n'"actual:   $launch"
   pass "no --model/--effort records defaults and keeps the claude launch byte-identical"
 }
@@ -221,9 +221,31 @@ test_claude_threads_model_and_effort() {
   launch=$(cat "$LAUNCH_LOG")
   assert_contains "$launch" "claude --dangerously-skip-permissions --model 'sonnet' --effort 'high'" \
     "claude launch did not thread model and effort flags"
+  assert_contains "$launch" "CLAUDE_CODE_AUTO_COMPACT_WINDOW=300000" \
+    "claude launch must carry the auto-compaction window env var regardless of model/effort flags"
   pass "claude receives --model and --effort profile flags"
 }
 
+# Only claude launches carry the auto-compaction env var; codex, opencode, and pi
+# ignore Claude Code env vars harmlessly, but firstmate should not set it for them
+# (grok is intentionally out of scope too - unverified whether its binary honors it).
+test_only_claude_launch_carries_autocompact_window() {
+  local rec id out status launch harness
+  for harness in codex opencode pi grok; do
+    id="profile-autocompact-$harness-z17"
+    rec=$(make_spawn_case "profile-autocompact-$harness" "$harness" "$id")
+    read_case_record "$rec"
+
+    out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" "$id" "$PROJ_DIR")
+    status=$?
+    expect_code 0 "$status" "$harness spawn without profile flags should succeed"
+    launch=$(cat "$LAUNCH_LOG")
+    assert_not_contains "$launch" "CLAUDE_CODE_AUTO_COMPACT_WINDOW" \
+      "$harness launch must not carry claude's auto-compaction env var"
+  done
+  pass "codex, opencode, pi, and grok launches never carry CLAUDE_CODE_AUTO_COMPACT_WINDOW"
+}
+
 test_codex_threads_model_and_effort() {
   local rec id out status launch
   id=profile-codex-z3
@@ -391,6 +413,7 @@ test_active_dispatch_profile_allows_explicit_harness
 test_active_dispatch_profile_allows_positional_harness
 test_active_dispatch_profile_allows_raw_launch_command
 test_claude_threads_model_and_effort
+test_only_claude_launch_carries_autocompact_window
 test_codex_threads_model_and_effort
 test_codex_omits_invalid_max_effort
 test_grok_threads_model_and_reasoning_effort
diff --git a/tests/fm-teardown.test.sh b/tests/fm-teardown.test.sh
index 95b7c006c..ebb319a4f 100755
--- a/tests/fm-teardown.test.sh
+++ b/tests/fm-teardown.test.sh
@@ -38,6 +38,8 @@
 #   (o) fm-pr-check rerun after HEAD moved                      -> no stale pr_head
 #   (p) fm-pr-check when local HEAD lags                        -> record remote PR head
 #   (q) no-mistakes + NO pr= recorded, PR discovered by branch  -> ALLOW  (yolo/no-CI merge)
+#   (z) no-mistakes + PR closed unmerged, never pushed, merged
+#       into LOCAL default branch by hand                       -> ALLOW  (local-land fix)
 #
 # Also covers backlog teardown-lock-race: a git index.lock left in the worktree by a
 # killed crew process (bin/fm-teardown.sh's teardown_treehouse_return).
@@ -236,6 +238,37 @@ SH
   chmod +x "$case_dir/fakebin/gh-axi" "$case_dir/fakebin/gh"
 }
 
+# Override GitHub lookups to report PR 7 as closed (unmerged) with the current
+# worktree HEAD as its head - simulates a PR deliberately closed without merging
+# (e.g. upstream repo not owned by this user).
+add_gh_pr_closed_for_head() {
+  local case_dir=$1 head=$2
+  cat > "$case_dir/fakebin/gh-axi" <<'SH'
+#!/usr/bin/env bash
+case "${1:-} ${2:-}" in
+  "pr list")
+    printf '%s\n' "count: 1 (showing first 1)" "pull_requests[1]{number,state}:" "  7,closed" ; exit 0 ;;
+  "pr view")
+    printf '%s\n' "pull_request:" "  number: 7" "  state: closed" ; exit 0 ;;
+esac
+exit 0
+SH
+  cat > "$case_dir/fakebin/gh" <<SH
+#!/usr/bin/env bash
+case "\${1:-} \${2:-}" in
+  "pr view")
+    case " \$* " in
+      *"state,headRefOid"*) printf '%s\t%s\n' 'CLOSED' '$head' ; exit 0 ;;
+      *"headRefOid"*) printf '%s\n' '$head' ; exit 0 ;;
+    esac
+    ;;
+esac
+echo "error: pull request not found" >&2
+exit 1
+SH
+  chmod +x "$case_dir/fakebin/gh-axi" "$case_dir/fakebin/gh"
+}
+
 append_pr_meta_for_current_head() {
   local case_dir=$1 head
   head=$(git -C "$case_dir/wt" rev-parse HEAD)
@@ -493,6 +526,7 @@ run_teardown() {
   FM_ROOT_OVERRIDE="$ROOT" \
   FM_STATE_OVERRIDE="$case_dir/state" \
   FM_CONFIG_OVERRIDE="$case_dir/config" \
+  FM_NAS_DEPLOYMENTS_OVERRIDE="$case_dir/data/nas-deployments.md" \
   PATH="$case_dir/fakebin:$PATH" \
     "$TEARDOWN" task-x1 "$@"
 }
@@ -609,6 +643,36 @@ test_no_mistakes_origin_remote_allows() {
   pass "no-mistakes worktree with HEAD on origin is torn down (no regression)"
 }
 
+test_teardown_removes_per_task_state_markers() {
+  local case_dir rc
+  case_dir=$(make_case state-markers)
+  write_meta "$case_dir" no-mistakes ship
+  wt_commit "$case_dir" "shippable work"
+  git -C "$case_dir/wt" push -q origin fm/task-x1
+  git -C "$case_dir/project" fetch -q origin
+  # Every per-task marker a teardown is responsible for reaping, including the
+  # ultracode flag written by fm-ultracode-guard.sh.
+  printf '%s\n' 'working: x' > "$case_dir/state/task-x1.status"
+  touch "$case_dir/state/task-x1.turn-ended"
+  printf '%s\n' 'exit 0' > "$case_dir/state/task-x1.check.sh"
+  printf '%s\n' 'ts' > "$case_dir/state/task-x1.pi-ext.ts"
+  printf '%s\n' 'tok' > "$case_dir/state/task-x1.grok-turnend-token"
+  printf '%s\n' 'role=independent-review' > "$case_dir/state/task-x1.ultracode"
+
+  set +e
+  run_teardown "$case_dir" > "$case_dir/stdout" 2> "$case_dir/stderr"
+  rc=$?
+  set -e
+
+  expect_code 0 "$rc" "state-markers: teardown should succeed when HEAD is on origin"
+  local marker
+  for marker in status turn-ended check.sh meta pi-ext.ts grok-turnend-token ultracode; do
+    [ ! -e "$case_dir/state/task-x1.$marker" ] \
+      || fail "state-markers: teardown left orphan state/task-x1.$marker"
+  done
+  pass "teardown removes every per-task state marker including .ultracode (no leak)"
+}
+
 test_no_mistakes_truly_unpushed_refuses() {
   local case_dir rc
   case_dir=$(make_case nm-unpushed)
@@ -627,6 +691,37 @@ test_no_mistakes_truly_unpushed_refuses() {
   pass "no-mistakes worktree with genuinely unlanded work is refused (safety preserved)"
 }
 
+# Reproduces the local-land false-negative: a project registered under the normal
+# no-mistakes delivery mode, whose task branch was never pushed to any remote and
+# whose PR was deliberately closed unmerged (e.g. the upstream repo is not owned by
+# this user), but which firstmate itself fast-forward-merged into the LOCAL default
+# branch by hand, on explicit prior captain approval. content_in_default() used to
+# only ever diff against the fetched refs/remotes/origin/$name, so it never saw this
+# local-only landing outside of mode=local-only; it must now also accept containment
+# in the LOCAL refs/heads/$name.
+test_no_mistakes_merged_to_local_main_allows() {
+  local case_dir rc pr_head
+  case_dir=$(make_case nm-local-land)
+  write_meta "$case_dir" no-mistakes ship
+  wt_commit_file "$case_dir" feature.txt hello "shippable work"
+  pr_head=$(git -C "$case_dir/wt" rev-parse HEAD)
+  append_pr_meta_url "$case_dir"
+  add_gh_pr_closed_for_head "$case_dir" "$pr_head"
+  # Never pushed to origin or any fork. Instead, firstmate fast-forwards the
+  # project's LOCAL main to the worktree's HEAD, exactly as bin/fm-merge-local.sh
+  # would for an explicitly approved local landing.
+  git -C "$case_dir/project" update-ref refs/heads/main "$pr_head"
+
+  set +e
+  run_teardown "$case_dir" > "$case_dir/stdout" 2> "$case_dir/stderr"
+  rc=$?
+  set -e
+
+  expect_code 0 "$rc" "nm-local-land: teardown should succeed when work is merged into local main"
+  ! grep -q REFUSED "$case_dir/stderr" || fail "nm-local-land: teardown printed a REFUSED line"
+  pass "no-mistakes worktree with a closed PR but work merged into local main is torn down (local-land fix)"
+}
+
 test_squash_merged_branch_deleted_allows() {
   local case_dir rc pr_head
   case_dir=$(make_case squash-merged)
@@ -1239,7 +1334,14 @@ test_local_only_force_overrides_unpushed() {
 
   expect_code 0 "$rc" "force-override: --force should bypass the unpushed-work check"
   ! grep -q REFUSED "$case_dir/stderr" || fail "force-override: REFUSED printed despite --force"
-  pass "local-only worktree with unpushed work is torn down under --force (escape hatch)"
+  # A forced teardown carries no landed-work guarantee (--force is the explicit
+  # discard path), so it must not call the NAS deploy sync hook at all. The real
+  # fm-nas-deploy-sync.sh runs unmocked in these tests (FM_ROOT_OVERRIDE=$ROOT)
+  # and always prints this exact line when it runs against the test's empty
+  # FM_NAS_DEPLOYMENTS_OVERRIDE map, so its absence proves the call was skipped.
+  assert_no_grep 'skipped: no recorded NAS deployment' "$case_dir/stdout" \
+    "force-override: forced teardown should skip the NAS deploy sync hook entirely"
+  pass "local-only worktree with unpushed work is torn down under --force and skips the NAS deploy sync hook"
 }
 
 test_herdr_teardown_clears_escalation_marker() {
@@ -1269,7 +1371,9 @@ test_teardown_manual_backend_prompts_hand_edit_even_when_tasks_axi_present
 test_local_only_truly_unpushed_refuses
 test_local_only_merged_to_local_main_allows
 test_no_mistakes_origin_remote_allows
+test_teardown_removes_per_task_state_markers
 test_no_mistakes_truly_unpushed_refuses
+test_no_mistakes_merged_to_local_main_allows
 test_local_only_force_overrides_unpushed
 test_herdr_teardown_clears_escalation_marker
 test_squash_merged_branch_deleted_allows
diff --git a/tests/fm-tier-guard.test.sh b/tests/fm-tier-guard.test.sh
new file mode 100755
index 000000000..0df6a3b0b
--- /dev/null
+++ b/tests/fm-tier-guard.test.sh
@@ -0,0 +1,244 @@
+#!/usr/bin/env bash
+# Tests for bin/fm-tier-guard.sh: the trivial (haiku/low) dispatch tier must
+# escalate when its actual diff or elapsed time outgrows its assigned envelope,
+# and any tier must escalate once its diff crosses the general heavy-scale
+# ceiling, regardless of model/effort.
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+fm_git_identity fmtest fmtest@example.invalid
+
+TIER_GUARD="$ROOT/bin/fm-tier-guard.sh"
+TMP_ROOT=$(fm_test_tmproot fm-tier-guard-tests)
+
+make_case() {
+  local name=$1 case_dir
+  case_dir="$TMP_ROOT/$name"
+  mkdir -p "$case_dir/state"
+
+  git init -q --bare "$case_dir/origin.git"
+  git -C "$case_dir/origin.git" symbolic-ref HEAD refs/heads/main
+  git clone -q "$case_dir/origin.git" "$case_dir/_seed" 2>/dev/null
+  printf 'base\n' > "$case_dir/_seed/feature.txt"
+  git -C "$case_dir/_seed" add feature.txt
+  git -C "$case_dir/_seed" -c user.email=t@t -c user.name=t commit -qm "origin baseline"
+  git -C "$case_dir/_seed" push -q origin main
+  rm -rf "$case_dir/_seed"
+
+  git clone -q "$case_dir/origin.git" "$case_dir/project"
+  git -C "$case_dir/project" remote set-head origin main 2>/dev/null || true
+  git -C "$case_dir/project" worktree add -q -b "fm/$name" "$case_dir/wt" main
+
+  printf '%s\n' "$case_dir"
+}
+
+write_task_meta() {
+  local case_dir=$1 id=$2
+  shift 2
+  fm_write_meta "$case_dir/state/$id.meta" \
+    "window=fm-$id" \
+    "worktree=$case_dir/wt" \
+    "project=$case_dir/project" \
+    "$@"
+}
+
+run_tier_guard() {
+  local case_dir=$1 id=$2
+  FM_ROOT_OVERRIDE="$ROOT" \
+  FM_STATE_OVERRIDE="$case_dir/state" \
+    "$TIER_GUARD" "$id"
+}
+
+test_trivial_tier_within_envelope_passes() {
+  local case_dir out status
+  case_dir=$(make_case within-envelope)
+  printf 'base\nsmall change\n' > "$case_dir/wt/feature.txt"
+  git -C "$case_dir/wt" add feature.txt
+  git -C "$case_dir/wt" commit -qm "small edit"
+  write_task_meta "$case_dir" task-x1 "model=claude-haiku-4-5" "effort=low"
+
+  set +e
+  out=$(run_tier_guard "$case_dir" task-x1)
+  status=$?
+  set -e
+
+  expect_code 0 "$status" "within-envelope: trivial task inside its size/age ceiling must pass"
+  [ -z "$out" ] || fail "within-envelope: expected no ESCALATE output, got: $out"
+  pass "fm-tier-guard passes a trivial task within its size and age envelope"
+}
+
+test_trivial_tier_exceeds_line_ceiling_escalates() {
+  local case_dir out status i
+  case_dir=$(make_case line-ceiling)
+  : > "$case_dir/wt/feature.txt"
+  for i in $(seq 1 40); do echo "line $i" >> "$case_dir/wt/feature.txt"; done
+  git -C "$case_dir/wt" add feature.txt
+  git -C "$case_dir/wt" commit -qm "big edit"
+  write_task_meta "$case_dir" task-x1 "model=claude-haiku-4-5" "effort=low"
+
+  set +e
+  out=$(run_tier_guard "$case_dir" task-x1)
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "line-ceiling: trivial task past the line ceiling must escalate"
+  assert_contains "$out" "ESCALATE: trivial (haiku/low) task task-x1" "line-ceiling: should name the trivial-tier escalation"
+  assert_contains "$out" "bump to at least sonnet/high" "line-ceiling: should say what to bump to"
+  pass "fm-tier-guard escalates a trivial task once its diff exceeds the line ceiling"
+}
+
+test_trivial_tier_exceeds_file_ceiling_escalates() {
+  local case_dir out status
+  case_dir=$(make_case file-ceiling)
+  printf 'a\n' > "$case_dir/wt/a.txt"
+  printf 'b\n' > "$case_dir/wt/b.txt"
+  printf 'c\n' > "$case_dir/wt/c.txt"
+  git -C "$case_dir/wt" add a.txt b.txt c.txt
+  git -C "$case_dir/wt" commit -qm "three new files"
+  write_task_meta "$case_dir" task-x1 "model=claude-haiku-4-5" "effort=low"
+
+  set +e
+  out=$(run_tier_guard "$case_dir" task-x1)
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "file-ceiling: trivial task past the file ceiling must escalate"
+  assert_contains "$out" "ESCALATE: trivial (haiku/low) task task-x1" "file-ceiling: should name the trivial-tier escalation"
+  pass "fm-tier-guard escalates a trivial task once its diff exceeds the file ceiling"
+}
+
+test_trivial_tier_stale_age_escalates() {
+  local case_dir out status
+  case_dir=$(make_case stale-age)
+  printf 'base\nsmall change\n' > "$case_dir/wt/feature.txt"
+  git -C "$case_dir/wt" add feature.txt
+  git -C "$case_dir/wt" commit -qm "small edit"
+  write_task_meta "$case_dir" task-x1 "model=claude-haiku-4-5" "effort=low"
+  touch -t 202001010000 "$case_dir/state/task-x1.meta"
+
+  set +e
+  out=$(run_tier_guard "$case_dir" task-x1)
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "stale-age: trivial task past the age ceiling must escalate"
+  assert_contains "$out" "has run" "stale-age: should name the age escalation"
+  assert_contains "$out" "bump to at least sonnet/high" "stale-age: should say what to bump to"
+  pass "fm-tier-guard escalates a trivial task that has run past its age ceiling"
+}
+
+test_non_trivial_tier_small_diff_no_ceiling() {
+  local case_dir out status i
+  case_dir=$(make_case non-trivial-ok)
+  : > "$case_dir/wt/feature.txt"
+  for i in $(seq 1 40); do echo "line $i" >> "$case_dir/wt/feature.txt"; done
+  git -C "$case_dir/wt" add feature.txt
+  git -C "$case_dir/wt" commit -qm "ordinary sonnet-tier edit"
+  write_task_meta "$case_dir" task-x1 "model=claude-sonnet-5" "effort=high"
+
+  set +e
+  out=$(run_tier_guard "$case_dir" task-x1)
+  status=$?
+  set -e
+
+  expect_code 0 "$status" "non-trivial-ok: sonnet/high has no trivial-tier ceiling to trip"
+  [ -z "$out" ] || fail "non-trivial-ok: expected no ESCALATE output, got: $out"
+  pass "fm-tier-guard does not apply the trivial-tier ceiling to a non-trivial task"
+}
+
+test_any_tier_past_heavy_scale_escalates() {
+  local case_dir out status i
+  case_dir=$(make_case heavy-scale)
+  : > "$case_dir/wt/feature.txt"
+  for i in $(seq 1 6); do echo "line $i" >> "$case_dir/wt/feature.txt"; done
+  git -C "$case_dir/wt" add feature.txt
+  git -C "$case_dir/wt" commit -qm "sonnet-tier edit that turned out large"
+  write_task_meta "$case_dir" task-x1 "model=claude-sonnet-5" "effort=high"
+
+  set +e
+  out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" \
+    FM_TIER_HEAVY_MIN_LINES=5 FM_TIER_HEAVY_MIN_FILES=5 "$TIER_GUARD" task-x1)
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "heavy-scale: any tier past the heavy-scale ceiling must escalate"
+  assert_contains "$out" "exceeds the heavy-scale ceiling" "heavy-scale: should name the general heavy-scale escalation"
+  pass "fm-tier-guard escalates any tier once its diff crosses the general heavy-scale ceiling"
+}
+
+test_unresolvable_pr_head_surfaces_degraded_diff_warning() {
+  # When state records pr= but the PR head cannot be resolved, fm-review-diff.sh
+  # falls back to the possibly-stale local branch and warns (still exit 0). The
+  # guard must NOT swallow that: the size it measured may under-count the real PR
+  # diff, so the degradation has to stay visible instead of reading as a clean,
+  # authoritative within-envelope pass - the same silent-reads-clean class as the
+  # sibling fm-risk-tripwire.sh unresolvable-base guard.
+  local case_dir out err status
+  case_dir=$(make_case degraded-diff)
+  printf 'base\nsmall change\n' > "$case_dir/wt/feature.txt"
+  git -C "$case_dir/wt" add feature.txt
+  git -C "$case_dir/wt" commit -qm "small local edit"
+  # pr= recorded, but pr_head is a bogus sha and origin has no matching PR ref,
+  # so resolve_pr_head fails and fm-review-diff.sh takes the stale-branch path.
+  write_task_meta "$case_dir" task-x1 "model=claude-haiku-4-5" "effort=low" \
+    "pr=https://github.com/o/r/pull/7" \
+    "pr_head=0000000000000000000000000000000000000000"
+
+  local errfile; errfile="$case_dir/stderr.txt"
+  set +e
+  out=$(FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$case_dir/state" "$TIER_GUARD" task-x1 2>"$errfile")
+  status=$?
+  set -e
+  err=$(cat "$errfile")
+
+  expect_code 0 "$status" "degraded-diff: a small stale-branch diff still measures within envelope (exit 0)"
+  [ -z "$out" ] || fail "degraded-diff: expected no ESCALATE on stdout, got: $out"
+  assert_contains "$err" "may under-count the real PR diff" "degraded-diff: the degraded measurement must be surfaced, not silently swallowed"
+  case "$err" in
+    *"WATCHER DOWN"*) fail "degraded-diff: must not leak fm-guard.sh's supervision banner from fm-review-diff.sh stderr, got: $err" ;;
+  esac
+  pass "fm-tier-guard surfaces a degraded (PR-head-unavailable) diff measurement instead of swallowing it"
+}
+
+test_missing_meta_errors() {
+  local case_dir out status
+  case_dir=$(make_case missing-meta)
+
+  set +e
+  out=$(run_tier_guard "$case_dir" task-x1 2>&1)
+  status=$?
+  set -e
+
+  expect_code 2 "$status" "missing-meta: no meta file must exit 2 (setup error), not 1 (an escalation)"
+  assert_contains "$out" "no meta for task" "missing-meta: should report the missing meta file"
+  pass "fm-tier-guard errors distinctly (exit 2) when the task has no recorded meta"
+}
+
+test_usage_error_exit_code() {
+  local status
+  set +e
+  FM_ROOT_OVERRIDE="$ROOT" "$TIER_GUARD" >/dev/null 2>&1
+  status=$?
+  set -e
+  expect_code 2 "$status" "usage-empty-id: a malformed invocation must exit 2, not 1 (the escalation code)"
+
+  set +e
+  FM_ROOT_OVERRIDE="$ROOT" "$TIER_GUARD" one two >/dev/null 2>&1
+  status=$?
+  set -e
+  expect_code 2 "$status" "usage-extra-args: extra args must exit 2, not 1 (the escalation code)"
+  pass "fm-tier-guard uses a distinct exit code for malformed invocations"
+}
+
+test_trivial_tier_within_envelope_passes
+test_trivial_tier_exceeds_line_ceiling_escalates
+test_trivial_tier_exceeds_file_ceiling_escalates
+test_trivial_tier_stale_age_escalates
+test_non_trivial_tier_small_diff_no_ceiling
+test_any_tier_past_heavy_scale_escalates
+test_unresolvable_pr_head_surfaces_degraded_diff_warning
+test_missing_meta_errors
+test_usage_error_exit_code
+
+echo "# all fm-tier-guard tests passed"
diff --git a/tests/fm-turnend-guard.test.sh b/tests/fm-turnend-guard.test.sh
index 3e5d54f82..ea1d280d7 100755
--- a/tests/fm-turnend-guard.test.sh
+++ b/tests/fm-turnend-guard.test.sh
@@ -21,6 +21,15 @@ fm_git_identity fmtest fmtest@example.invalid
 
 REQUIRED_REASON='resume supervision with bin/fm-watch-arm.sh as its own Claude Code background task'
 
+# The hook now polls fm_watcher_healthy for up to FM_TURNEND_ARM_WAIT (default
+# FM_ARM_CONFIRM_TIMEOUT, 10s in production) before blocking, so it can let a
+# genuine watcher re-arm land instead of blocking on the handoff gap. Most
+# tests below assert an eventual outcome (block or allow), not that timing, so
+# run_hook defaults every call to this short override to keep the suite fast;
+# test_hook_runs_fast and the new mid-poll test set their own values to
+# exercise the timing directly.
+FAST_ARM_WAIT=1
+
 # --- PREDICATE: bin/fm-supervision-lib.sh -----------------------------------
 
 test_predicate_healthy_no_inflight() {
@@ -168,7 +177,9 @@ make_secondmate_linked_home_dir() {
 run_hook() {
   local dir=$1 stop_active=$2 home
   home=$(cd "$dir" && pwd)
-  printf '{"stop_hook_active":%s}' "$stop_active" | CLAUDECODE=1 FM_HOME="$home" bash "$dir/bin/fm-turnend-guard.sh" 2>&1
+  printf '{"stop_hook_active":%s}' "$stop_active" \
+    | CLAUDECODE=1 FM_HOME="$home" FM_TURNEND_ARM_WAIT="${FM_TURNEND_ARM_WAIT:-$FAST_ARM_WAIT}" \
+      bash "$dir/bin/fm-turnend-guard.sh" 2>&1
 }
 
 nonexistent_pid() {
@@ -287,7 +298,7 @@ test_hook_blocks_from_fm_home_state() {
   home="$TMP_ROOT/hook-fm-home-op"
   mkdir -p "$home/state"
   : > "$home/state/task1.meta"
-  out=$(printf '{"stop_hook_active":false}' | CLAUDECODE=1 FM_HOME="$home" bash "$dir/bin/fm-turnend-guard.sh" 2>&1); status=$?
+  out=$(printf '{"stop_hook_active":false}' | CLAUDECODE=1 FM_HOME="$home" FM_TURNEND_ARM_WAIT="$FAST_ARM_WAIT" bash "$dir/bin/fm-turnend-guard.sh" 2>&1); status=$?
   expect_code 2 "$status" "hook must inspect the active FM_HOME state dir"
   assert_contains "$out" "$REQUIRED_REASON" "block reason must contain the exact required instruction"
   pass "fm-turnend-guard: blocks from active FM_HOME state, not only repo-root state"
@@ -325,7 +336,7 @@ test_hook_uses_state_override() {
   state="$TMP_ROOT/hook-state-override-active"
   mkdir -p "$home/state" "$state"
   : > "$state/task1.meta"
-  out=$(printf '{"stop_hook_active":false}' | CLAUDECODE=1 FM_HOME="$home" FM_STATE_OVERRIDE="$state" bash "$dir/bin/fm-turnend-guard.sh" 2>&1); status=$?
+  out=$(printf '{"stop_hook_active":false}' | CLAUDECODE=1 FM_HOME="$home" FM_STATE_OVERRIDE="$state" FM_TURNEND_ARM_WAIT="$FAST_ARM_WAIT" bash "$dir/bin/fm-turnend-guard.sh" 2>&1); status=$?
   expect_code 2 "$status" "hook must let FM_STATE_OVERRIDE win over FM_HOME/state"
   assert_contains "$out" "$REQUIRED_REASON" "block reason must contain the exact required instruction"
   pass "fm-turnend-guard: uses FM_STATE_OVERRIDE ahead of FM_HOME/state"
@@ -532,15 +543,59 @@ test_hook_silent_without_stdin() {
   pass "fm-turnend-guard: silent no-op on empty stdin"
 }
 
+# Tradeoff, stated plainly (docs/turnend-guard.md "Shared Predicate"): closing
+# the re-arm race means the genuinely-blind path (no watcher, no arm ever
+# registers) no longer blocks near-instantly - it polls for FM_TURNEND_ARM_WAIT
+# first, so a legitimate in-flight re-arm gets the same window to land. This
+# test pins that bound instead of asserting a near-instant return, and uses an
+# explicit short wait rather than the 10s production default so the suite
+# stays fast.
 test_hook_runs_fast() {
-  local dir start elapsed_s
+  local dir start elapsed_s poll_wait=2
   dir=$(make_primary_dir "$TMP_ROOT/hook-timing")
   : > "$dir/state/task1.meta"
   start=$SECONDS
-  run_hook "$dir" false >/dev/null
+  FM_TURNEND_ARM_WAIT=$poll_wait run_hook "$dir" false >/dev/null
+  elapsed_s=$((SECONDS - start))
+  [ "$elapsed_s" -ge 1 ] || fail "hook returned in ${elapsed_s}s; expected it to poll rather than block near-instantly"
+  [ "$elapsed_s" -lt $((poll_wait + 3)) ] || fail "hook took ${elapsed_s}s, expected the ${poll_wait}s poll window plus a generous 3s CI margin"
+  pass "fm-turnend-guard: genuinely-blind path blocks within the bounded re-arm poll window (${elapsed_s}s, wait=${poll_wait}s)"
+}
+
+# The actual fix under test: a re-arming watcher that registers its live lock
+# partway through the poll window must be let through, not blocked - this is
+# what distinguishes the bounded poll from a bare timeout. Simulates
+# bin/fm-watch-arm.sh's lock-registration gap (docs/scout-turnend-guard-race
+# report: ~0.25-0.3s measured) by writing a live, identity-matched lock shortly
+# after the hook starts polling.
+test_hook_allows_watcher_that_registers_mid_poll() {
+  local dir pid identity out status start elapsed_s poll_wait=5 writer_pid
+  dir=$(make_primary_dir "$TMP_ROOT/hook-arm-race")
+  : > "$dir/state/task1.meta"
+  touch "$dir/state/.last-watcher-beat"
+  sleep 60 &
+  pid=$!
+  identity=$(watcher_identity "$dir" "$pid") || {
+    kill "$pid" 2>/dev/null || true
+    wait "$pid" 2>/dev/null || true
+    fail "could not identify live watcher holder"
+  }
+  (
+    sleep 0.5
+    record_watcher_lock "$dir" "$pid" "$identity"
+    touch "$dir/state/.last-watcher-beat"
+  ) &
+  writer_pid=$!
+  start=$SECONDS
+  out=$(FM_TURNEND_ARM_WAIT=$poll_wait run_hook "$dir" false); status=$?
   elapsed_s=$((SECONDS - start))
-  [ "$elapsed_s" -lt 3 ] || fail "hook took ${elapsed_s}s, expected well under a second (generous 3s CI margin)"
-  pass "fm-turnend-guard: runs well under the generous timing margin (${elapsed_s}s)"
+  wait "$writer_pid" 2>/dev/null || true
+  kill "$pid" 2>/dev/null || true
+  wait "$pid" 2>/dev/null || true
+  expect_code 0 "$status" "hook must allow the stop once a re-arming watcher's lock registers mid-poll"
+  [ -z "$out" ] || fail "hook produced output after the watcher became healthy mid-poll: $out"
+  [ "$elapsed_s" -lt "$poll_wait" ] || fail "hook waited the full ${elapsed_s}s deadline instead of returning as soon as the lock registered"
+  pass "fm-turnend-guard: allows the stop once a re-arming watcher's lock registers mid-poll (${elapsed_s}s, wait=${poll_wait}s)"
 }
 
 test_grok_adapter_forces_one_resume_when_unhealthy() {
@@ -562,7 +617,7 @@ test_grok_adapter_forces_one_resume_when_unhealthy() {
 } >> "$log"
 EOF
   chmod +x "$fakebin/grok"
-  out=$(printf '{"sessionId":"session-test","hookEventName":"stop"}' | PATH="$fakebin:$PATH" GROK_WORKSPACE_ROOT="$dir" bash "$dir/bin/fm-turnend-guard-grok.sh" 2>&1); status=$?
+  out=$(printf '{"sessionId":"session-test","hookEventName":"stop"}' | PATH="$fakebin:$PATH" GROK_WORKSPACE_ROOT="$dir" FM_TURNEND_ARM_WAIT="$FAST_ARM_WAIT" bash "$dir/bin/fm-turnend-guard-grok.sh" 2>&1); status=$?
   expect_code 0 "$status" "grok adapter must fail open after queuing a forced resume"
   [ -z "$out" ] || fail "grok adapter printed output: $out"
   assert_contains "$(cat "$log")" 'active=1' "grok adapter must mark its forced resume as loop-guarded"
@@ -913,6 +968,7 @@ test_hook_silent_in_crewmate_worktree
 test_hook_silent_without_jq
 test_hook_silent_without_stdin
 test_hook_runs_fast
+test_hook_allows_watcher_that_registers_mid_poll
 test_grok_adapter_forces_one_resume_when_unhealthy
 test_grok_adapter_loop_guard_skips_resume
 test_settings_hook_uses_claude_project_dir
diff --git a/tests/fm-ultracode-guard.test.sh b/tests/fm-ultracode-guard.test.sh
new file mode 100755
index 000000000..3d39a3bee
--- /dev/null
+++ b/tests/fm-ultracode-guard.test.sh
@@ -0,0 +1,223 @@
+#!/usr/bin/env bash
+# Tests for bin/fm-ultracode-guard.sh: an ultracode-flagged task must not reach
+# PR-ready until a genuinely separate, independently-dispatched task recorded
+# itself as having reviewed the finished diff - never a self-reference or a
+# made-up id.
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+GUARD="$ROOT/bin/fm-ultracode-guard.sh"
+TMP_ROOT=$(fm_test_tmproot fm-ultracode-guard-tests)
+
+new_state_dir() {
+  local name=$1 dir
+  dir="$TMP_ROOT/$name/state"
+  mkdir -p "$dir"
+  printf '%s\n' "$dir"
+}
+
+run_guard() {
+  local state=$1
+  shift
+  FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state" "$GUARD" "$@"
+}
+
+test_check_passes_when_never_flagged() {
+  local state status
+  state=$(new_state_dir never-flagged)
+  fm_write_meta "$state/task-x1.meta" "worktree=/tmp/x" "project=/tmp/x"
+
+  set +e
+  run_guard "$state" check task-x1 >/dev/null 2>&1
+  status=$?
+  set -e
+
+  expect_code 0 "$status" "never-flagged: an unflagged task must pass check"
+  pass "fm-ultracode-guard check passes a task that was never ultracode-flagged"
+}
+
+test_flag_then_check_fails_until_reviewed() {
+  local state out status
+  state=$(new_state_dir flag-then-check)
+  fm_write_meta "$state/task-x1.meta" "worktree=/tmp/x" "project=/tmp/x"
+
+  run_guard "$state" flag task-x1 >/dev/null
+
+  set +e
+  out=$(run_guard "$state" check task-x1 2>&1)
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "flag-then-check: a flagged, unreviewed task must fail check"
+  assert_contains "$out" "is ultracode-flagged" "flag-then-check: should explain why it is blocked"
+  assert_contains "$out" "role=independent-review" "flag-then-check: should report the default role"
+  pass "fm-ultracode-guard check refuses a flagged task with no recorded review"
+}
+
+test_flag_custom_role_reported_in_check() {
+  local state out
+  state=$(new_state_dir custom-role)
+  fm_write_meta "$state/task-x1.meta" "worktree=/tmp/x" "project=/tmp/x"
+
+  run_guard "$state" flag task-x1 breadth-fanout >/dev/null
+
+  set +e
+  out=$(run_guard "$state" check task-x1 2>&1)
+  set -e
+
+  assert_contains "$out" "role=breadth-fanout" "custom-role: check should report the custom role"
+  pass "fm-ultracode-guard flag records a custom role and check reports it"
+}
+
+test_reviewed_by_self_is_refused() {
+  local state out status
+  state=$(new_state_dir self-review)
+  fm_write_meta "$state/task-x1.meta" "worktree=/tmp/x" "project=/tmp/x"
+  run_guard "$state" flag task-x1 >/dev/null
+
+  set +e
+  out=$(run_guard "$state" reviewed task-x1 task-x1 2>&1)
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "self-review: a task cannot review itself"
+  assert_contains "$out" "distinct from task-x1" "self-review: should explain the refusal"
+  pass "fm-ultracode-guard reviewed refuses a task naming itself as its own reviewer"
+}
+
+test_reviewed_by_unknown_task_is_refused() {
+  local state out status
+  state=$(new_state_dir unknown-reviewer)
+  fm_write_meta "$state/task-x1.meta" "worktree=/tmp/x" "project=/tmp/x"
+  run_guard "$state" flag task-x1 >/dev/null
+
+  set +e
+  out=$(run_guard "$state" reviewed task-x1 made-up-id 2>&1)
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "unknown-reviewer: a made-up reviewer id must be refused"
+  assert_contains "$out" "no recorded state/made-up-id.meta" "unknown-reviewer: should explain the refusal"
+  pass "fm-ultracode-guard reviewed refuses a reviewer id with no recorded meta"
+}
+
+test_reviewed_by_distinct_dispatched_task_passes_check() {
+  local state status
+  state=$(new_state_dir distinct-reviewer)
+  fm_write_meta "$state/task-x1.meta" "worktree=/tmp/x" "project=/tmp/x"
+  fm_write_meta "$state/task-x2.meta" "worktree=/tmp/y" "project=/tmp/y"
+  run_guard "$state" flag task-x1 >/dev/null
+
+  run_guard "$state" reviewed task-x1 task-x2 >/dev/null
+
+  set +e
+  run_guard "$state" check task-x1 >/dev/null 2>&1
+  status=$?
+  set -e
+
+  expect_code 0 "$status" "distinct-reviewer: a genuinely separate reviewer must satisfy check"
+  pass "fm-ultracode-guard check passes once a distinct dispatched task recorded the review"
+}
+
+test_reviewed_without_flag_is_refused() {
+  local state out status
+  state=$(new_state_dir no-flag)
+  fm_write_meta "$state/task-x1.meta" "worktree=/tmp/x" "project=/tmp/x"
+  fm_write_meta "$state/task-x2.meta" "worktree=/tmp/y" "project=/tmp/y"
+
+  set +e
+  out=$(run_guard "$state" reviewed task-x1 task-x2 2>&1)
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "no-flag: reviewed must refuse a task that was never flagged"
+  assert_contains "$out" "not ultracode-flagged" "no-flag: should explain the refusal"
+  pass "fm-ultracode-guard reviewed refuses to mark an unflagged task as reviewed"
+}
+
+test_reflag_clears_prior_review() {
+  local state out status
+  state=$(new_state_dir reflag-clears)
+  fm_write_meta "$state/task-x1.meta" "worktree=/tmp/x" "project=/tmp/x"
+  fm_write_meta "$state/task-x2.meta" "worktree=/tmp/y" "project=/tmp/y"
+  run_guard "$state" flag task-x1 >/dev/null
+  run_guard "$state" reviewed task-x1 task-x2 >/dev/null
+  run_guard "$state" flag task-x1 >/dev/null
+
+  set +e
+  out=$(run_guard "$state" check task-x1 2>&1)
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "reflag-clears: re-flagging must clear the prior review"
+  assert_contains "$out" "is ultracode-flagged" "reflag-clears: should be blocked again"
+  pass "fm-ultracode-guard re-flagging starts the review requirement over"
+}
+
+test_flag_rejects_newline_injection_in_role() {
+  local state out status payload
+  state=$(new_state_dir newline-injection)
+  fm_write_meta "$state/task-x1.meta" "worktree=/tmp/x" "project=/tmp/x"
+  payload=$'independent-review\nreviewed_by=evil-task'
+
+  set +e
+  out=$(run_guard "$state" flag task-x1 "$payload" 2>&1)
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "newline-injection: flag must refuse a role containing a newline"
+  assert_contains "$out" "must be non-empty and contain only letters, digits, '-', or '_'" \
+    "newline-injection: should explain the refusal"
+  assert_absent "$state/task-x1.ultracode" \
+    "newline-injection: no marker file should be written for a rejected role"
+  pass "fm-ultracode-guard flag refuses a role containing a newline (marker-injection defense)"
+}
+
+test_flag_rejects_role_with_disallowed_characters() {
+  local state out status
+  state=$(new_state_dir bad-chars)
+  fm_write_meta "$state/task-x1.meta" "worktree=/tmp/x" "project=/tmp/x"
+
+  set +e
+  out=$(run_guard "$state" flag task-x1 "bad role" 2>&1)
+  status=$?
+  set -e
+
+  expect_code 1 "$status" "bad-chars: flag must refuse a role containing a space"
+  assert_contains "$out" "must be non-empty and contain only letters, digits, '-', or '_'" \
+    "bad-chars: should explain the refusal"
+  assert_absent "$state/task-x1.ultracode" \
+    "bad-chars: no marker file should be written for a rejected role"
+  pass "fm-ultracode-guard flag refuses a role containing a disallowed character"
+}
+
+test_flag_accepts_role_with_digits_and_underscore() {
+  local state out
+  state=$(new_state_dir digits-underscore)
+  fm_write_meta "$state/task-x1.meta" "worktree=/tmp/x" "project=/tmp/x"
+
+  run_guard "$state" flag task-x1 safety_check-2 >/dev/null
+
+  set +e
+  out=$(run_guard "$state" check task-x1 2>&1)
+  set -e
+
+  assert_contains "$out" "role=safety_check-2" "digits-underscore: check should report the accepted role"
+  pass "fm-ultracode-guard flag accepts a role containing digits and underscores"
+}
+
+test_check_passes_when_never_flagged
+test_flag_then_check_fails_until_reviewed
+test_flag_custom_role_reported_in_check
+test_reviewed_by_self_is_refused
+test_reviewed_by_unknown_task_is_refused
+test_reviewed_by_distinct_dispatched_task_passes_check
+test_reviewed_without_flag_is_refused
+test_reflag_clears_prior_review
+test_flag_rejects_newline_injection_in_role
+test_flag_rejects_role_with_disallowed_characters
+test_flag_accepts_role_with_digits_and_underscore
+
+echo "# all fm-ultracode-guard tests passed"
diff --git a/tests/fm-watch-triage.test.sh b/tests/fm-watch-triage.test.sh
index 4cbc4de4f..322fa74bb 100755
--- a/tests/fm-watch-triage.test.sh
+++ b/tests/fm-watch-triage.test.sh
@@ -64,12 +64,36 @@ wait_numeric_file() {
   return 1
 }
 
+wait_path_exists() {
+  local file=$1 limit=${2:-30} i=0
+  while [ "$i" -lt "$limit" ]; do
+    [ -e "$file" ] && return 0
+    sleep 0.1
+    i=$((i + 1))
+  done
+  return 1
+}
+
 # Portable mtime in epoch seconds. Platform-detected, never the `stat -f || stat -c`
 # fallback (which writes a partial filesystem dump on Linux; see fm-watch.sh).
 file_mtime() {
   if [ "$(uname)" = Darwin ]; then stat -f %m "$1" 2>/dev/null; else stat -c %Y "$1" 2>/dev/null; fi
 }
 
+wait_mtime_after() {
+  local file=$1 before=$2 limit=${3:-80} i=0 m
+  while [ "$i" -lt "$limit" ]; do
+    m=$(file_mtime "$file" || true)
+    case "$m" in
+      ''|*[!0-9]*) ;;
+      *) [ "$m" -gt "$before" ] && return 0 ;;
+    esac
+    sleep 0.1
+    i=$((i + 1))
+  done
+  return 1
+}
+
 # Signature a primed .seen-* marker must hold so the per-poll signal scan does not
 # fire on a pre-existing status (mirrors fm-watch.sh's stat_sig exactly).
 seen_sig() {
@@ -245,6 +269,39 @@ test_crew_absorb_class_classifier() {
   pass "crew_absorb_class: working/paused/none from one read; crew_is_paused and crew_is_provably_working agree"
 }
 
+# Regression: FM_CREW_STATE_NM_TIMEOUT=0 previously slipped past its sanitizer
+# and reached `timeout` as a literal 0, which GNU coreutils treats as "disable
+# the timeout" - the exact failure mode this outer bound exists to guarantee
+# against. FM_CREW_ABSORB_TIMEOUT/FM_CREW_ABSORB_KILL_AFTER use the identical
+# exclusion pattern (bin/fm-classify-lib.sh), so pin that a literal 0 for either
+# one also falls back to its sanitized default rather than reaching
+# fm_hard_timeout unbounded. Re-sources the library after setting the env vars
+# so the sanitizer's case statement actually re-evaluates them.
+test_absorb_zero_env_values_sanitized_to_default() {
+  local out
+  out=$(FM_CREW_ABSORB_TIMEOUT=0 FM_CREW_ABSORB_KILL_AFTER=0 bash -c \
+    ". \"$ROOT/bin/fm-classify-lib.sh\"; printf 'timeout=%s kill_after=%s\n' \"\$FM_CREW_ABSORB_TIMEOUT\" \"\$FM_CREW_ABSORB_KILL_AFTER\"")
+  assert_not_contains "$out" "timeout=0 " "FM_CREW_ABSORB_TIMEOUT=0 was not sanitized away from a literal 0 (disables the outer hard-timeout bound)"
+  assert_not_contains "$out" "kill_after=0" "FM_CREW_ABSORB_KILL_AFTER=0 was not sanitized away from a literal 0"
+  assert_contains "$out" "timeout=45 kill_after=5" "FM_CREW_ABSORB_TIMEOUT/KILL_AFTER=0 fall back to their sanitized defaults (45/5)"
+  pass "FM_CREW_ABSORB_TIMEOUT=0 and FM_CREW_ABSORB_KILL_AFTER=0 fall back to sanitized defaults, never a literal 0"
+}
+
+# Regression: the exclusion pattern above only caught the literal string "0",
+# not other all-zero digit spellings GNU `timeout` also treats as "no
+# timeout" - verified empirically, `timeout -k 1 00 sleep N` runs the full N
+# seconds, identical to a literal 0. Pins that FM_CREW_ABSORB_TIMEOUT=00 and
+# FM_CREW_ABSORB_KILL_AFTER=00 also fall back to their sanitized defaults.
+test_absorb_zero_padded_env_values_sanitized_to_default() {
+  local out
+  out=$(FM_CREW_ABSORB_TIMEOUT=00 FM_CREW_ABSORB_KILL_AFTER=00 bash -c \
+    ". \"$ROOT/bin/fm-classify-lib.sh\"; printf 'timeout=%s kill_after=%s\n' \"\$FM_CREW_ABSORB_TIMEOUT\" \"\$FM_CREW_ABSORB_KILL_AFTER\"")
+  assert_not_contains "$out" "timeout=00 " "FM_CREW_ABSORB_TIMEOUT=00 was not sanitized away from a zero-padded 0 (disables the outer hard-timeout bound)"
+  assert_not_contains "$out" "kill_after=00" "FM_CREW_ABSORB_KILL_AFTER=00 was not sanitized away from a zero-padded 0"
+  assert_contains "$out" "timeout=45 kill_after=5" "FM_CREW_ABSORB_TIMEOUT/KILL_AFTER=00 fall back to their sanitized defaults (45/5)"
+  pass "FM_CREW_ABSORB_TIMEOUT=00 and FM_CREW_ABSORB_KILL_AFTER=00 fall back to sanitized defaults, never a zero-padded 0"
+}
+
 # signal_crew_provably_working: a no-verb "signal:" wake is benign ONLY when EVERY
 # task it references is provably working; if any crew has stopped, or no task can be
 # resolved, it surfaces. Files map to ids by stripping .status / .turn-ended.
@@ -352,6 +409,108 @@ test_working_note_not_working_surfaced() {
   pass "a no-verb working: note whose crew is idle with no running pipeline is surfaced"
 }
 
+# Regression for the 2026-07-09 89-minute watcher stall: crew_absorb_class's
+# read (which stands in for a real crew whose `no-mistakes axi status` call is
+# stuck behind a busy shared daemon) hangs past its own signal - a fake
+# fm-crew-state.sh that traps and ignores TERM, exactly like the real CLI can
+# under concurrent validation load. Before the outer hard-timeout
+# (bin/fm-classify-lib.sh's fm_hard_timeout, wrapping crew_absorb_class's call)
+# this blocked the watcher's poll loop indefinitely, so its liveness beacon
+# went stale for the incident's full 89 minutes. With the fix, the read is
+# force-killed and reads as "none" (not provably working) - fail toward the
+# safe side, never a false "working" - so the wake correctly surfaces rather
+# than hanging or being silently absorbed. Asserting the watcher exits within a
+# small bound (not the 40-tick/4s default used elsewhere, but still orders of
+# magnitude under an unbounded hang) is the direct proof: pre-fix this hangs
+# past the bound and the assertion fails instead of passing.
+test_hung_crew_state_read_does_not_stall_watcher() {
+  local dir state fakebin out drain_out status_file pid
+  dir=$(make_case hung-crew-state-read); state="$dir/state"; fakebin="$dir/fakebin"
+  out="$dir/watch.out"; drain_out="$dir/drain.out"
+  status_file="$state/task.status"
+  printf 'working: compiling step 2\n' > "$status_file"
+  # Overwrite make_case's default (instant, canned-verdict) fake fm-crew-state.sh
+  # with one that never answers on its own - it must be force-killed.
+  cat > "$fakebin/fm-crew-state.sh" <<'SH'
+#!/usr/bin/env bash
+trap '' TERM
+while :; do sleep 1; done
+SH
+  chmod +x "$fakebin/fm-crew-state.sh"
+  export FM_CREW_ABSORB_TIMEOUT=2 FM_CREW_ABSORB_KILL_AFTER=1
+  watch_bg "$state" "$fakebin" "$out"
+  pid=$!
+  wait_for_exit "$pid" 80 || fail "watcher did not resolve a hung crew-state read within a small bound (would hang indefinitely pre-fix)"
+  grep -F "signal: $status_file" "$out" >/dev/null || fail "watcher did not surface the signal once the hung read was force-killed"
+  [ -e "$state/.last-watcher-beat" ] || fail "watcher beacon was never touched"
+  FM_STATE_OVERRIDE="$state" "$DRAIN" > "$drain_out" 2>/dev/null || fail "drain after the hung-read surface failed"
+  grep "$(printf '\tsignal\t')" "$drain_out" | grep -F "$status_file" >/dev/null || fail "hung-read surface was not queued"
+  unset FM_CREW_ABSORB_TIMEOUT FM_CREW_ABSORB_KILL_AFTER
+  pass "a hung crew-state read is force-killed and correctly surfaces instead of stalling the watcher's poll loop"
+}
+
+test_hung_no_mistakes_status_does_not_freeze_watcher_beacon() {
+  local dir state fakebin out status_file calls_file wt pid beat1 beat2
+  dir=$(make_case hung-no-mistakes-status); state="$dir/state"; fakebin="$dir/fakebin"
+  out="$dir/watch.out"; status_file="$state/task.status"; calls_file="$dir/no-mistakes.calls"; wt="$dir/wt"
+  mkdir -p "$wt"
+  git -C "$wt" init -q
+  git -C "$wt" commit -q --allow-empty -m init
+  git -C "$wt" checkout -q -b fm/hung-no-mistakes-status
+  : > "$calls_file"
+  printf 'working: compiling step 2\n' > "$status_file"
+  fm_write_meta "$state/task.meta" "window=fm:fm-task" "worktree=$wt" "kind=ship"
+  cat > "$fakebin/no-mistakes" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "${1:-}" in
+  axi)
+    shift
+    case "${1:-}" in
+      status)
+        trap '' TERM
+        printf '%s\n' "$*" >> "${FM_FAKE_NM_CALLS:-/dev/null}"
+        while :; do sleep 1; done ;;
+    esac ;;
+esac
+exit 0
+SH
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "${1:-}" in
+  display-message)
+    printf '%%1\n'
+    exit 0 ;;
+  list-windows)
+    [ -n "${FM_FAKE_TMUX_WINDOW:-}" ] && printf '%s\n' "$FM_FAKE_TMUX_WINDOW"
+    exit 0 ;;
+  capture-pane)
+    printf 'work in progress\nesc to interrupt\n'
+    exit 0 ;;
+esac
+exit 1
+SH
+  chmod +x "$fakebin/no-mistakes" "$fakebin/tmux"
+  PATH="$fakebin:$PATH" FM_STATE_OVERRIDE="$state" FM_CREW_STATE_BIN="$ROOT/bin/fm-crew-state.sh" \
+    FM_FAKE_NM_CALLS="$calls_file" FM_CREW_STATE_NM_TIMEOUT=1 FM_CREW_STATE_NM_KILL_AFTER=1 \
+    FM_POLL=1 FM_SIGNAL_GRACE=1 FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
+  pid=$!
+  wait_path_exists "$state/.last-watcher-beat" 30 || { reap "$pid"; fail "watcher beacon was never touched"; }
+  beat1=$(file_mtime "$state/.last-watcher-beat")
+  wait_mtime_after "$state/.last-watcher-beat" "$beat1" 90 \
+    || { reap "$pid"; fail "watcher beacon did not advance after a hung no-mistakes status timed out"; }
+  beat2=$(file_mtime "$state/.last-watcher-beat")
+  kill -0 "$pid" 2>/dev/null || fail "watcher exited instead of absorbing the no-verb signal after no-mistakes timed out"
+  [ ! -s "$out" ] || { reap "$pid"; fail "watcher printed a wake reason after the bounded no-mistakes timeout: $(cat "$out")"; }
+  [ ! -s "$state/.wake-queue" ] || { reap "$pid"; fail "watcher enqueued a wake instead of continuing after the bounded no-mistakes timeout"; }
+  [ -s "$state/.seen-task_status" ] || { reap "$pid"; fail "watcher did not advance the signal suppressor after bounded no-mistakes timeout"; }
+  grep -F "status" "$calls_file" >/dev/null || { reap "$pid"; fail "fake no-mistakes axi status was never called"; }
+  [ "$beat2" -gt "$beat1" ] || { reap "$pid"; fail "watcher beacon mtime did not increase"; }
+  reap "$pid"
+  pass "a hung no-mistakes axi status is force-killed and the watcher beacon keeps advancing"
+}
+
 # --- actionable wakes are surfaced (queue + exit) ---------------------------
 
 test_actionable_signal_surfaced() {
@@ -1118,6 +1277,185 @@ test_afk_paused_changed_pane_hands_off_plain_stale() {
   pass "AFK changed paused panes hand off plain stale identities for daemon-owned pause triage"
 }
 
+# --- periodic autodeploy-log sweep (config/autodeploy-logs) ------------------
+
+# Run autodeploy_scan once against <state>/<config> by sourcing fm-watch.sh in a
+# subshell - its source guard returns before the runtime lock/loop, so only the
+# functions load. Echoes "rc=<exit>"; the durable wake queue and per-log surfaced
+# markers land under <state>. Keeps the scan hermetic (no real watcher, no timing).
+run_autodeploy_scan() {  # <state> <config>
+  # Pass fm-watch.sh as $1 (not $0), so its BASH_SOURCE[0] != $0 source guard
+  # fires and the runtime loop below it never starts (same trick as append_wake).
+  FM_STATE_OVERRIDE="$1" FM_CONFIG_OVERRIDE="$2" \
+    bash -c '. "$1"; autodeploy_scan; printf "rc=%s\n" "$?"' _ "$WATCH" 2>/dev/null
+}
+
+# Marker path fm-watch.sh's autodeploy_scan uses for a given log (mirror the
+# script's tr sanitization so a test can assert on the record directly).
+autodeploy_marker() {  # <state> <log-path>
+  printf '%s/.autodeploy-surfaced-%s' "$1" "$(printf '%s' "$2" | tr -c 'A-Za-z0-9' '_')"
+}
+
+test_autodeploy_absent_config_is_noop() {
+  local dir state config rc
+  dir=$(make_case autodeploy-absent); state="$dir/state"; config="$dir/config"
+  mkdir -p "$config"   # config dir present, but no autodeploy-logs file in it
+  rc=$(run_autodeploy_scan "$state" "$config")
+  [ "$rc" = "rc=1" ] || fail "absent config/autodeploy-logs was not a no-op (got $rc)"
+  [ ! -s "$state/.wake-queue" ] || fail "absent config enqueued a wake"
+  pass "an absent config/autodeploy-logs is a silent no-op"
+}
+
+test_autodeploy_failure_enqueues_labelled_check() {
+  local dir state config log rc
+  dir=$(make_case autodeploy-fail); state="$dir/state"; config="$dir/config"
+  mkdir -p "$config" "$state/beamanalyzer-autodeploy"
+  log="$state/beamanalyzer-autodeploy/status.log"
+  printf '%s\n' "$log" > "$config/autodeploy-logs"
+  # A failing run: an ok rollup, then a STUCK alert line, then the ALERT rollup
+  # that is the run's authoritative last line.
+  printf '2026-07-15T10:00:00+00:00 ok nas=unchanged prod=unchanged deployed=no\n' > "$log"
+  printf '2026-07-15T10:05:00+00:00 beamanalyzer-autodeploy: prod: STUCK: v2 has diverged - needs attention\n' >> "$log"
+  printf '2026-07-15T10:05:00+00:00 ALERT nas=unchanged prod=unsafe deployed=no\n' >> "$log"
+  rc=$(run_autodeploy_scan "$state" "$config")
+  [ "$rc" = "rc=0" ] || fail "a failing autodeploy last line was not actionable (got $rc)"
+  grep "$(printf '\tcheck\t')" "$state/.wake-queue" >/dev/null || fail "no check wake enqueued for the failure"
+  grep -F "ALERT nas=unchanged prod=unsafe" "$state/.wake-queue" >/dev/null || fail "check wake did not carry the failing last line"
+  grep -F "autodeploy beamanalyzer-autodeploy reports failure" "$state/.wake-queue" >/dev/null || fail "check wake did not label the deploy"
+  [ -s "$(autodeploy_marker "$state" "$log")" ] || fail "failure was not recorded surfaced"
+  pass "a failing autodeploy last line enqueues a labelled check wake and records it surfaced"
+}
+
+test_autodeploy_healthy_is_silent_and_rearms() {
+  local dir state config log marker rc
+  dir=$(make_case autodeploy-healthy); state="$dir/state"; config="$dir/config"
+  mkdir -p "$config" "$state/deploy"
+  log="$state/deploy/status.log"
+  printf '%s\n' "$log" > "$config/autodeploy-logs"
+  marker=$(autodeploy_marker "$state" "$log")
+  printf 'ALERT nas=unsafe prod=unchanged deployed=no' > "$marker"   # stale prior alarm
+  printf '2026-07-15T11:00:00+00:00 ok nas=unchanged prod=unchanged deployed=no\n' > "$log"
+  rc=$(run_autodeploy_scan "$state" "$config")
+  [ "$rc" = "rc=1" ] || fail "a healthy ok last line was treated as actionable (got $rc)"
+  [ ! -s "$state/.wake-queue" ] || fail "a healthy last line enqueued a wake"
+  [ ! -e "$marker" ] || fail "a healthy run did not clear the surfaced marker (alarm would never re-arm)"
+  pass "a healthy ok last line is silent and clears any prior surfaced marker"
+}
+
+test_autodeploy_persistent_failure_dedupes() {
+  local dir state config log rc1 rc2 count
+  dir=$(make_case autodeploy-dedupe); state="$dir/state"; config="$dir/config"
+  mkdir -p "$config" "$state/deploy"
+  log="$state/deploy/status.log"
+  printf '%s\n' "$log" > "$config/autodeploy-logs"
+  printf '2026-07-15T12:00:00+00:00 ALERT nas=unsafe prod=unchanged deployed=no\n' > "$log"
+  rc1=$(run_autodeploy_scan "$state" "$config")
+  # A later run reports the SAME failure but stamps a fresh time (autodeploy re-runs
+  # every few minutes); the timestamp must not defeat dedupe.
+  printf '2026-07-15T12:05:00+00:00 ALERT nas=unsafe prod=unchanged deployed=no\n' >> "$log"
+  rc2=$(run_autodeploy_scan "$state" "$config")
+  [ "$rc1" = "rc=0" ] || fail "first scan of a new failure was not actionable (got $rc1)"
+  [ "$rc2" = "rc=1" ] || fail "an unchanged persistent failure re-surfaced despite a fresh timestamp (got $rc2)"
+  count=$(grep -c "$(printf '\tcheck\t')" "$state/.wake-queue" 2>/dev/null || true)
+  [ "${count:-0}" = "1" ] || fail "persistent failure enqueued ${count:-0} check wakes, expected exactly 1"
+  pass "a persistent identical failure surfaces once despite each run's changing timestamp"
+}
+
+test_autodeploy_recurrence_after_clear_resurfaces() {
+  local dir state config log rc_fail rc_ok rc_again count
+  dir=$(make_case autodeploy-recur); state="$dir/state"; config="$dir/config"
+  mkdir -p "$config" "$state/deploy"
+  log="$state/deploy/status.log"
+  printf '%s\n' "$log" > "$config/autodeploy-logs"
+  printf '2026-07-15T13:00:00+00:00 ALERT nas=unsafe prod=unchanged deployed=no\n' > "$log"
+  rc_fail=$(run_autodeploy_scan "$state" "$config")
+  printf '2026-07-15T13:05:00+00:00 ok nas=unchanged prod=unchanged deployed=no\n' >> "$log"
+  rc_ok=$(run_autodeploy_scan "$state" "$config")
+  printf '2026-07-15T13:10:00+00:00 ALERT nas=unsafe prod=unchanged deployed=no\n' >> "$log"
+  rc_again=$(run_autodeploy_scan "$state" "$config")
+  [ "$rc_fail" = "rc=0" ] || fail "initial failure not actionable (got $rc_fail)"
+  [ "$rc_ok" = "rc=1" ] || fail "healthy recovery not silent (got $rc_ok)"
+  [ "$rc_again" = "rc=0" ] || fail "a failure recurring after a clean run did not re-surface (got $rc_again)"
+  count=$(grep -c "$(printf '\tcheck\t')" "$state/.wake-queue" 2>/dev/null || true)
+  [ "${count:-0}" = "2" ] || fail "expected 2 check wakes across fail/clear/fail, got ${count:-0}"
+  pass "a failure recurring after a healthy run re-surfaces once the alarm re-armed"
+}
+
+test_autodeploy_unreadable_log_is_silent() {
+  local dir state config rc
+  dir=$(make_case autodeploy-unreadable); state="$dir/state"; config="$dir/config"
+  mkdir -p "$config"
+  # Point at a log that does not exist; a NAS mount hiccup looks the same.
+  printf '%s\n' "$state/nope/status.log" > "$config/autodeploy-logs"
+  rc=$(run_autodeploy_scan "$state" "$config")
+  [ "$rc" = "rc=1" ] || fail "a missing/unreadable log was not skipped silently (got $rc)"
+  [ ! -s "$state/.wake-queue" ] || fail "a missing log enqueued a wake"
+  pass "a missing or unreadable configured log is skipped silently, not alarmed"
+}
+
+test_autodeploy_timed_out_log_is_silent() {
+  local dir state config fakebin log rc elapsed real_tail
+  dir=$(make_case autodeploy-timeout); state="$dir/state"; config="$dir/config"; fakebin="$dir/fakebin"
+  mkdir -p "$config" "$state/hung-deploy"
+  log="$state/hung-deploy/status.log"
+  printf '%s\n' "$log" > "$config/autodeploy-logs"
+  printf 'ALERT should time out\n' > "$log"
+  real_tail=$(command -v tail)
+  cat > "$fakebin/tail" <<SH
+#!/usr/bin/env bash
+if [ "\${FM_FAKE_TAIL_SLEEP:-}" = 1 ]; then
+  perl -e 'sleep 20'
+  exit 0
+fi
+exec '$real_tail' "\$@"
+SH
+  chmod +x "$fakebin/tail"
+
+  SECONDS=0
+  rc=$(PATH="$fakebin:$PATH" FM_FAKE_TAIL_SLEEP=1 FM_AUTODEPLOY_LOG_READ_TIMEOUT=1 run_autodeploy_scan "$state" "$config")
+  elapsed=$SECONDS
+  [ "$rc" = "rc=1" ] || fail "a timed-out log read was not skipped silently (got $rc)"
+  [ "$elapsed" -lt 5 ] || fail "timed-out log read blocked watcher scan for ${elapsed}s"
+  [ ! -s "$state/.wake-queue" ] || fail "a timed-out log read enqueued a wake"
+  pass "a timed-out configured log read is skipped silently, not alarmed"
+}
+
+test_autodeploy_comments_blanks_and_whitespace() {
+  local dir state config log rc
+  dir=$(make_case autodeploy-comments); state="$dir/state"; config="$dir/config"
+  mkdir -p "$config" "$state/deploy"
+  log="$state/deploy/status.log"
+  {
+    printf '# watched autodeploy logs\n'
+    printf '\n'
+    printf '   %s   \n' "$log"   # surrounding whitespace must be trimmed
+  } > "$config/autodeploy-logs"
+  printf '2026-07-15T14:00:00+00:00 deploy: build: FAILED: npm ERR code ELIFECYCLE\n' > "$log"
+  rc=$(run_autodeploy_scan "$state" "$config")
+  [ "$rc" = "rc=0" ] || fail "a FAILED: last line on a whitespace-padded path was not detected (got $rc)"
+  grep -F "build: FAILED: npm ERR" "$state/.wake-queue" >/dev/null || fail "FAILED: line not surfaced"
+  pass "blank lines and # comments are ignored and surrounding whitespace on a path is trimmed"
+}
+
+test_autodeploy_failure_surfaced_on_heartbeat() {
+  local dir state fakebin config out drain_out pid
+  dir=$(make_case autodeploy-heartbeat); state="$dir/state"; fakebin="$dir/fakebin"
+  config="$dir/config"; out="$dir/watch.out"; drain_out="$dir/drain.out"
+  mkdir -p "$config" "$state/beamanalyzer-autodeploy"
+  printf '%s\n' "$state/beamanalyzer-autodeploy/status.log" > "$config/autodeploy-logs"
+  printf '2026-07-15T10:30:00+00:00 ALERT nas=unsafe prod=unchanged deployed=no\n' \
+    > "$state/beamanalyzer-autodeploy/status.log"
+  PATH="$fakebin:$PATH" FM_STATE_OVERRIDE="$state" FM_CONFIG_OVERRIDE="$config" \
+    FM_POLL=1 FM_SIGNAL_GRACE=1 FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=1 "$WATCH" > "$out" &
+  pid=$!
+  wait_for_exit "$pid" 40 || fail "watcher did not surface a configured autodeploy failure on the periodic sweep"
+  grep -F "check: autodeploy" "$out" >/dev/null || fail "watcher did not exit with a check wake for the autodeploy failure: $(cat "$out")"
+  FM_STATE_OVERRIDE="$state" "$DRAIN" > "$drain_out" 2>/dev/null || fail "drain after autodeploy heartbeat failed"
+  grep "$(printf '\tcheck\t')" "$drain_out" >/dev/null || fail "autodeploy check wake was not queued"
+  grep -F "ALERT nas=unsafe" "$drain_out" >/dev/null || fail "drained check wake did not carry the failure line"
+  pass "a configured autodeploy status log's failure surfaces as a check wake on the watcher's periodic sweep"
+}
+
 test_signal_reason_is_actionable_classifier
 test_stale_is_terminal_classifier
 test_scan_captain_relevant_statuses_classifier
@@ -1125,11 +1463,15 @@ test_classifier_primitives
 test_crew_is_provably_working_classifier
 test_status_is_paused_classifier
 test_crew_absorb_class_classifier
+test_absorb_zero_env_values_sanitized_to_default
+test_absorb_zero_padded_env_values_sanitized_to_default
 test_signal_crew_provably_working_classifier
 test_provably_working_signal_absorbed
 test_turn_ended_provably_working_absorbed
 test_turn_ended_not_working_surfaced
 test_working_note_not_working_surfaced
+test_hung_crew_state_read_does_not_stall_watcher
+test_hung_no_mistakes_status_does_not_freeze_watcher_beacon
 test_actionable_signal_surfaced
 test_terminal_stale_surfaced
 test_stale_terminal_status_overridden_by_active_run
@@ -1151,3 +1493,12 @@ test_heartbeat_backstop_surfaces_unsurfaced_status
 test_beacon_stays_fresh_while_absorbing
 test_afk_present_reverts_watcher_to_one_shot
 test_afk_paused_changed_pane_hands_off_plain_stale
+test_autodeploy_absent_config_is_noop
+test_autodeploy_failure_enqueues_labelled_check
+test_autodeploy_healthy_is_silent_and_rearms
+test_autodeploy_persistent_failure_dedupes
+test_autodeploy_recurrence_after_clear_resurfaces
+test_autodeploy_unreadable_log_is_silent
+test_autodeploy_timed_out_log_is_silent
+test_autodeploy_comments_blanks_and_whitespace
+test_autodeploy_failure_surfaced_on_heartbeat
diff --git a/tests/lib.sh b/tests/lib.sh
index add7f2904..271602925 100644
--- a/tests/lib.sh
+++ b/tests/lib.sh
@@ -53,29 +53,85 @@ pass() {
 # --- self-cleaning temp root ------------------------------------------------
 #
 # fm_test_tmproot <prefix> echoes a fresh temp dir and registers it for removal
-# on EXIT. The first call installs the cleanup trap. A test file that needs
-# extra teardown (e.g. killing a daemon) should define its own EXIT trap and
-# call fm_test_cleanup from inside it so registered dirs are still removed.
+# on EXIT. A test file that needs extra teardown (e.g. killing a daemon) should
+# define its own EXIT trap and call fm_test_cleanup from inside it so registered
+# dirs are still removed.
+#
+# Registration goes through an on-disk manifest, not just the FM_TEST_CLEANUP_DIRS
+# array: every call site uses `TMP_ROOT=$(fm_test_tmproot prefix)`, and bash always
+# runs a command substitution in a subshell, so a trap installed - or an array
+# entry appended - inside fm_test_tmproot itself would apply only to that
+# short-lived subshell and vanish the instant it exits. Confirmed empirically: an
+# EXIT trap set there fires immediately on subshell exit, deleting the very
+# directory just created, before control ever returns to the caller; the caller's
+# own shell never gets a trap installed at all, so nothing then protects the
+# directory a later `mkdir -p` silently recreates. Writing the path to a manifest
+# file survives the subshell boundary because subshells share the real
+# filesystem even though they don't share shell state; the real top-level trap,
+# installed once below when this library is sourced (never inside a subshell,
+# since sourcing always runs in the current shell), reads the manifest at the
+# actual script's exit. FM_TEST_CLEANUP_DIRS keeps working unchanged for a
+# caller that appends to it directly at its own top level (not through a
+# command substitution), such as a helper that creates its temp dir with a bare
+# `mktemp -d` assignment.
+#
+# Directory names embed the owning PID (<prefix>.<pid>.XXXXXX) so a later
+# invocation's startup sweep (fm_test_sweep_stale_tmproots) can tell a leftover
+# from a still-running test apart without relying on age alone.
+#
+# None of this saves a directory from a SIGKILL (e.g. the OOM killer): no trap,
+# EXIT or otherwise, ever runs for that signal, so a killed run's temp root is
+# unavoidably left behind. fm_test_sweep_stale_tmproots is the actual safety net
+# for that case - it runs at the start of the next invocation.
 
 FM_TEST_CLEANUP_DIRS=()
+FM_TEST_CLEANUP_MANIFEST="${TMPDIR:-/tmp}/.fm-test-cleanup.$$"
 
 fm_test_cleanup() {
   local d
   for d in "${FM_TEST_CLEANUP_DIRS[@]:-}"; do
-    [ -n "$d" ] && rm -rf "$d"
+    [ -n "$d" ] && rm -rf -- "$d"
   done
+  if [ -f "$FM_TEST_CLEANUP_MANIFEST" ]; then
+    while IFS= read -r d; do
+      [ -n "$d" ] && rm -rf -- "$d"
+    done < "$FM_TEST_CLEANUP_MANIFEST"
+    rm -f -- "$FM_TEST_CLEANUP_MANIFEST"
+  fi
 }
+trap fm_test_cleanup EXIT
 
 fm_test_tmproot() {
   local prefix=${1:-fm-test} root
-  root=$(mktemp -d "${TMPDIR:-/tmp}/${prefix}.XXXXXX")
-  if [ "${#FM_TEST_CLEANUP_DIRS[@]}" -eq 0 ]; then
-    trap fm_test_cleanup EXIT
-  fi
-  FM_TEST_CLEANUP_DIRS+=("$root")
+  root=$(mktemp -d "${TMPDIR:-/tmp}/${prefix}.$$.XXXXXX")
+  printf '%s\n' "$root" >> "$FM_TEST_CLEANUP_MANIFEST"
   printf '%s\n' "$root"
 }
 
+# fm_test_sweep_stale_tmproots <prefix> removes any leftover
+# <prefix>.<pid>.XXXXXX directory under TMPDIR whose owning PID is no longer
+# alive - the actual safety net for a SIGKILL-terminated prior run, which no
+# EXIT trap (see above) can ever run for. A directory whose PID is still alive
+# is left untouched, so a genuinely concurrent run of the same test on this host
+# is never swept. Call it once at the top of a test file, before that file's own
+# fm_test_tmproot call, for any prefix known to create large fixtures (e.g. a
+# full repo clone) worth reclaiming promptly rather than waiting on the next
+# `rm -rf` of an already-registered root.
+fm_test_sweep_stale_tmproots() {
+  local prefix=$1 dir base pid
+  for dir in "${TMPDIR:-/tmp}/${prefix}".*; do
+    [ -d "$dir" ] || continue
+    base=$(basename "$dir")
+    pid=${base#"$prefix".}
+    pid=${pid%%.*}
+    case "$pid" in
+      ''|*[!0-9]*) continue ;; # not the <prefix>.<pid>.XXXXXX scheme; leave it alone
+    esac
+    kill -0 "$pid" 2>/dev/null && continue # owner still alive: a genuine concurrent run
+    rm -rf -- "$dir"
+  done
+}
+
 # --- fakebin / PATH shims ---------------------------------------------------
 #
 # fm_fakebin <dir> creates <dir>/fakebin and echoes it; prepend it to PATH to