From 985783855fa90f85c09abfae25a93195cd49c398 Mon Sep 17 00:00:00 2001
From: Curtis Kormos <curtis.kormos@gmail.com>
Date: Fri, 16 Oct 2026 14:49:39 -0600
Subject: [PATCH 1/4] fix(herdr): list only this home's recorded crew
 workspaces

---
 bin/backends/herdr.sh               |  6 +++---
 tests/fm-backend-herdr-crew.test.sh | 21 +++++++++++++++++++++
 2 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/bin/backends/herdr.sh b/bin/backends/herdr.sh
index f048066b1db..d7c3c6acfde 100644
--- a/bin/backends/herdr.sh
+++ b/bin/backends/herdr.sh
@@ -4112,7 +4112,8 @@ EOF
 # primary-spawns-a-secondmate path in fm-spawn.sh. Read-only: a session/
 # workspace that does not exist yet simply lists nothing. One
 # "<session>:<pane_id>\t<label>" line per live task tab, followed by one per
-# fm-<id>-labeled pane in each workspace carrying this home's crew label.
+# fm-<id>-labeled pane in each crew workspace this home recorded (never another
+# home's workspace that merely shares the crew label).
 fm_backend_herdr_list_live() {  # <session>
   local session=$1 wsid tabs tab_id label pane_id
   wsid=$(fm_backend_herdr_workspace_find "$session") || wsid=
@@ -4128,8 +4129,7 @@ fm_backend_herdr_list_live() {  # <session>
     [ -n "$wsid" ] || continue
     fm_backend_herdr_cli "$session" pane list --workspace "$wsid" 2>/dev/null | jq -r --arg session "$session" \
       '.result.panes[]? | select((.label // "") | startswith("fm-")) | "\($session):\(.pane_id)\t\(.label)"' 2>/dev/null
-  done < <(fm_backend_herdr_cli "$session" workspace list 2>/dev/null | jq -r --arg want "$(fm_backend_herdr_crew_workspace_label)" \
-    '.result.workspaces[]? | select(.label == $want) | .workspace_id' 2>/dev/null)
+  done < <(fm_backend_herdr_crew_workspace_recorded "${FM_STATE_OVERRIDE:-${FM_HOME:-}/state}" "$session" 2>/dev/null)
   return 0
 }
 
diff --git a/tests/fm-backend-herdr-crew.test.sh b/tests/fm-backend-herdr-crew.test.sh
index 5cc6fd0a14d..d020675b514 100755
--- a/tests/fm-backend-herdr-crew.test.sh
+++ b/tests/fm-backend-herdr-crew.test.sh
@@ -279,6 +279,26 @@ test_list_live_reports_crew_panes() {
   pass "herdr crew: list-live reports crew panes by their task labels"
 }
 
+test_list_live_ignores_another_homes_crew_workspace() {
+  local home_a live_a live_b
+  crew_fixture two-homes
+  home_a=$HOME_DIR
+  place fm-a >/dev/null || fail "home A crew placement failed"
+  HOME_DIR="$DIR/home-b"
+  mkdir -p "$HOME_DIR/state" "$HOME_DIR/config"
+  place fm-b >/dev/null || fail "home B crew placement failed"
+  assert_equals 2 "$(herdr_fake workspace list | jq '[.result.workspaces[] | select(.label == "firstmate-crew")] | length')" \
+    "both homes should own a same-labeled crew workspace in the shared session"
+  live_b=$(adapter fm_backend_herdr_list_live crewlab)
+  HOME_DIR=$home_a
+  live_a=$(adapter fm_backend_herdr_list_live crewlab)
+  assert_contains "$live_a" $'\tfm-a' "home A should list its own crew pane"
+  assert_not_contains "$live_a" $'\tfm-b' "home A must not list home B's crew pane"
+  assert_contains "$live_b" $'\tfm-b' "home B should list its own crew pane"
+  assert_not_contains "$live_b" $'\tfm-a' "home B must not list home A's crew pane"
+  pass "herdr crew: list-live lists only this home's recorded crew workspaces"
+}
+
 test_missing_layout_api_still_places_with_a_warning() {
   local ws tab pane
   crew_fixture no-layout-api
@@ -305,4 +325,5 @@ test_last_pane_removes_the_workspace_and_next_spawn_recreates_it
 test_a_relabeled_recorded_workspace_is_never_adopted
 test_a_live_same_labeled_pane_refuses
 test_list_live_reports_crew_panes
+test_list_live_ignores_another_homes_crew_workspace
 test_missing_layout_api_still_places_with_a_warning

From bed8dc2cbe0fbec6620cdd0053aa0d91eb45d961 Mon Sep 17 00:00:00 2001
From: Curtis Kormos <curtis.kormos@gmail.com>
Date: Fri, 16 Oct 2026 14:56:21 -0600
Subject: [PATCH 2/4] no-mistakes(document): Document home-scoped Herdr crew
 discovery

---
 docs/herdr-backend.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/docs/herdr-backend.md b/docs/herdr-backend.md
index ff3ae0a982b..455b04bd098 100644
--- a/docs/herdr-backend.md
+++ b/docs/herdr-backend.md
@@ -514,9 +514,10 @@ Placement runs under the same per-session presentation lock as the projection, a
 A live pane that already carries the task label refuses a duplicate launch, while an exited husk with that label is closed only after the replacement pane exists.
 A failure after the new pane exists closes that exact pane, and a crew placement writes no presentation journal.
 Cleanup closes only the task's exact pane through the ordinary exact-identity kill path and its focus-safe removal plan, so each crew workspace disappears with its last pane and a new one is created when a placement finds no room.
-List-live reports the home's crew panes alongside its home-workspace tabs, and a bare selector that matches no tab label falls back to an exact pane label, so recovery, send, capture, and turn-end detection use the recorded pane endpoint exactly as they do for a tab.
+List-live reports panes only from this home's recorded crew workspaces alongside its home-workspace tabs, so a same-labeled workspace belonging to another home in the shared session is never recovered as local work.
+A bare selector that matches no tab label falls back to an exact pane label, so recovery, send, capture, and turn-end detection use the recorded pane endpoint exactly as they do for a tab.
 
-`tests/fm-backend-herdr-crew.test.sh` pins parsing, first creation, grid fill, overflow, custom caps, cleanup rebalance, refill, recreation, record verification, duplicate refusal, list-live, and the no-layout-API fallback against a stateful fake.
+`tests/fm-backend-herdr-crew.test.sh` pins parsing, first creation, grid fill, overflow, custom caps, cleanup rebalance, refill, recreation, record verification, duplicate refusal, home-scoped list-live, and the no-layout-API fallback against a stateful fake.
 `tests/fm-backend-herdr-crew-workspace-e2e.test.sh` proves the same behavior and a real spawn and cleanup pass in a guarded named lab; [`verification/runtime-backends.md`](verification/runtime-backends.md#crew-workspace) owns the active versioned evidence.
 
 ## Default-tab prune safety

From 09cde807ae2b0bf21424cb84573c4a2f6bc6177b Mon Sep 17 00:00:00 2001
From: Curtis Kormos <curtis.kormos@gmail.com>
Date: Fri, 16 Oct 2026 17:28:34 -0600
Subject: [PATCH 3/4] no-mistakes(document): Document scoped Herdr crew
 workspace discovery

---
 docs/herdr-backend.md                         |  3 ++-
 ...m-backend-herdr-crew-workspace-e2e.test.sh | 22 +++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/docs/herdr-backend.md b/docs/herdr-backend.md
index 455b04bd098..bde6c48ca6a 100644
--- a/docs/herdr-backend.md
+++ b/docs/herdr-backend.md
@@ -156,7 +156,8 @@ Rename it manually before expecting new tasks or recovery to use it.
 
 ### Recovery and existing tasks
 
-Recovery and list-live still scan the first workspace matching the home label, because they address panes they already recorded rather than choosing where new work goes.
+Recovery and list-live scan the first workspace matching the home label for ordinary tabs, while crew-pane discovery scans only this home's recorded crew workspace ids.
+They address panes they already recorded rather than choosing where new work goes.
 The one recovery that does place new work is the control plane's reclaim of a destroyed endpoint.
 It mints a replacement tab through this section's ordinary placement rules while pinning the herdr session the task's record names ([`agent-control.md`](agent-control.md) "Reclaiming a task whose endpoint is gone").
 
diff --git a/tests/fm-backend-herdr-crew-workspace-e2e.test.sh b/tests/fm-backend-herdr-crew-workspace-e2e.test.sh
index be8f13de6d6..837c26c407e 100755
--- a/tests/fm-backend-herdr-crew-workspace-e2e.test.sh
+++ b/tests/fm-backend-herdr-crew-workspace-e2e.test.sh
@@ -222,6 +222,28 @@ read -r WS TAB _ < <(place fm-t9) || fail 'could not place a crew task after the
   || fail 'the recreated crew workspace should again sit right after the home'
 pass 'real herdr: each crew workspace disappears with its last pane and the next spawn recreates one'
 
+# Separate homes can create identically labeled crew workspaces in one Herdr
+# session. Recovery must use each home's recorded workspace ids, not that
+# mutable shared label, so it never offers another home's pane as local work.
+HOME_A=$HOME_DIR
+OTHER_HOME="$TMP_ROOT/other-home"
+mkdir -p "$OTHER_HOME/state"
+HOME_DIR=$OTHER_HOME
+read -r OTHER_WS _ OTHER_PANE < <(place fm-foreign) || fail 'could not place the foreign-home crew task'
+[ -n "$OTHER_WS" ] && [ "$OTHER_WS" != "$WS" ] || fail 'the foreign home should create a distinct crew workspace'
+HOME_DIR=$HOME_A
+LIVE_A=$(adapter fm_backend_herdr_list_live "$HERDR_LAB_SESSION")
+HOME_DIR=$OTHER_HOME
+LIVE_B=$(adapter fm_backend_herdr_list_live "$HERDR_LAB_SESSION")
+HOME_DIR=$HOME_A
+[ "$(lab workspace list | jq '[.result.workspaces[] | select(.label == "firstmate-crew")] | length')" = 2 ] \
+  || fail 'the shared session should contain two same-labeled crew workspaces'
+printf '%s\n' "$LIVE_A" | grep -Fq $'\tfm-t9' || fail "home A did not list its recorded crew pane: $LIVE_A"
+! printf '%s\n' "$LIVE_A" | grep -Fq $'\tfm-foreign' || fail "home A recovered foreign work from a same-labeled workspace: $LIVE_A"
+printf '%s\n' "$LIVE_B" | grep -Fq $'\tfm-foreign' || fail "home B did not list its recorded crew pane: $LIVE_B"
+! printf '%s\n' "$LIVE_B" | grep -Fq $'\tfm-t9' || fail "home B recovered foreign work from a same-labeled workspace: $LIVE_B"
+pass 'real herdr: list-live scopes same-labeled crew workspaces to the recording home'
+
 # The same layout through the real spawn and teardown scripts: a home whose
 # config selects "crew" gets its crewmates as panes of one crew workspace, and
 # teardown closes each exact pane.

From ffec8a239344f18666ca1e4ca781b5ebfc9cc635 Mon Sep 17 00:00:00 2001
From: Curtis Kormos <curtis.kormos@gmail.com>
Date: Fri, 16 Oct 2026 17:56:15 -0600
Subject: [PATCH 4/4] no-mistakes(ci): Fixed Lint 1 by removing the unused
 OTHER_PANE capture in tests/fm-backend-herdr-crew-workspace-e2e.test.sh.
 Verified: shellcheck target, bash
 tests/fm-backend-herdr-crew-workspace-e2e.test.sh, bash bin/fm-lint.sh, and
 bash tests/fm-remote-reply.test.sh all pass. Behavior portable serial 4
 failed only in tests/fm-remote-reply.test.sh ('NUL-bearing line was not
 captured'), a file unchanged by this PR; it passes locally, so no
 behavior-code change is warranted. Final diff scope check found no unrelated
 hunks

---
 tests/fm-backend-herdr-crew-workspace-e2e.test.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/fm-backend-herdr-crew-workspace-e2e.test.sh b/tests/fm-backend-herdr-crew-workspace-e2e.test.sh
index 837c26c407e..ed2a0633041 100755
--- a/tests/fm-backend-herdr-crew-workspace-e2e.test.sh
+++ b/tests/fm-backend-herdr-crew-workspace-e2e.test.sh
@@ -229,7 +229,7 @@ HOME_A=$HOME_DIR
 OTHER_HOME="$TMP_ROOT/other-home"
 mkdir -p "$OTHER_HOME/state"
 HOME_DIR=$OTHER_HOME
-read -r OTHER_WS _ OTHER_PANE < <(place fm-foreign) || fail 'could not place the foreign-home crew task'
+read -r OTHER_WS _ < <(place fm-foreign) || fail 'could not place the foreign-home crew task'
 [ -n "$OTHER_WS" ] && [ "$OTHER_WS" != "$WS" ] || fail 'the foreign home should create a distinct crew workspace'
 HOME_DIR=$HOME_A
 LIVE_A=$(adapter fm_backend_herdr_list_live "$HERDR_LAB_SESSION")