diff --git a/AGENTS.md b/AGENTS.md
index a8f8ff629a3..6997415bafc 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -104,7 +104,8 @@ backups/             root-local preservation files; not a canonical tracked surf
   <id>.status        appended by crewmates: "<state>: <note>" wake-event lines, not current-state truth
   <id>.turn-ended    touched by turn-end hooks
   <id>.grok-turnend-token   firstmate-owned grok hook registry token for the task; removed by teardown
-  <id>.meta          written by fm-spawn: window=, worktree=, project=, harness=, model=, effort=, kind=, mode=, yolo=, tasktmp=; non-default backends also record backend=, and Herdr records herdr_session=, herdr_workspace_id=, herdr_tab_id=, and herdr_pane_id=; kind=secondmate also records home= and projects= (fm-pr-check appends pr= and GitHub's pr_head= when available; fm-x-link appends x_request= and x_request_ts= for an X-mention-originated task, section 14)
+  <id>.meta          written by fm-spawn: window=, worktree=, project=, harness=, model=, effort=, kind=, mode=, yolo=, tasktmp=; non-default backends also record backend=, with Herdr-specific label and exact-id fields owned by docs/herdr-backend.md; kind=secondmate also records home= and projects= (fm-pr-check appends pr= and GitHub's pr_head= when available; fm-x-link appends x_request= and x_request_ts= for an X-mention-originated task, section 14)
+  <id>.herdr-label   private pre-create recovery journal for a Herdr tab; removed after complete task metadata is published (field and recovery contract: docs/herdr-backend.md)
   <id>.check.sh      optional slow poll you write per task (e.g. merged-PR check)
   x-watch.check.sh   generated X-mode relay poll shim; present only when opted in (section 14)
   x-inbox/           generated X-mode pending mention payloads; fmx-respond drains it (section 14)
@@ -122,9 +123,9 @@ backups/             root-local preservation files; not a canonical tracked surf
 ```
 
 Task ids are short kebab slugs with a random suffix, e.g. `fix-login-k3`.
-The tmux window for a tmux-backed task is named `fm-<id>`.
+The tmux window for a tmux-backed task is named `fm-<id>`; Herdr display labels do not change that naming.
 `fm-spawn.sh` creates that window by tmux window ID, disables automatic and application-driven renaming, restores the canonical name, and verifies it before sending any pane commands.
-Herdr-backed tasks instead use a `fm-<id>` tab and record an opaque `session:pane` target; the Herdr workspace is scoped to the firstmate home.
+Herdr-backed tasks instead use one `<kind> - <phrase> · <task-key>` display tab, with kind shown as `Crew`, `Scout`, or `2nd`, set once at spawn. The full task id plus exact Herdr session, workspace, tab, and pane ids remain machine identity; the Herdr workspace is scoped to the firstmate home, and legacy `fm-<id>` tabs remain discoverable for recovery.
 After creation, tmux targets the immutable window ID rather than the mutable `session:window-name` label; Herdr targets the recorded pane ID. If setup cannot prove the backend endpoint, it cleans up the uniquely identified new endpoint and aborts.
 
 ## 3. Bootstrap (run at every session start)
diff --git a/README.md b/README.md
index c7d8035eecf..4cf4f3d79b1 100644
--- a/README.md
+++ b/README.md
@@ -99,7 +99,7 @@ Outside tmux, tmux-backed crewmates land in a detached `firstmate` session you c
     │ backend sends / status files │
     ▼              ▼               ▼
  ┌────────┐   ┌────────┐      ┌────────┐
- │fm-task1│   │fm-task2│  ... │fm-taskN│   tmux windows by default; Herdr tabs when selected
+ │ task 1 │   │ task 2 │  ... │ task N │   fm-<id> tmux windows; readable Herdr tabs when selected
  │crewmate│   │crewmate│      │crewmate│   one autonomous agent each
  └───┬────┘   └───┬────┘      └───┬────┘
      ▼            ▼               ▼
diff --git a/bin/backends/herdr.sh b/bin/backends/herdr.sh
index 73c84605994..aaf10b6a502 100755
--- a/bin/backends/herdr.sh
+++ b/bin/backends/herdr.sh
@@ -9,8 +9,10 @@
 #
 # One Herdr workspace is kept per firstmate home: `firstmate` for the primary
 # and `2ndmate-<id>` for a seeded secondmate home. Each task is one tab with a
-# single root pane. Targets are `<session>:<pane-id>`; pane ids contain a colon,
-# so parsing always splits on the first colon only.
+# single root pane. Visible task labels are presentation only; full task ids and
+# exact response-derived ids remain machine identity. Targets are
+# `<session>:<pane-id>`; pane ids contain a colon, so parsing always splits on
+# the first colon only.
 
 FM_BACKEND_HERDR_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-${FM_ROOT:-$FM_BACKEND_HERDR_ROOT}}"
@@ -28,6 +30,8 @@ FM_BACKEND_HERDR_LOCK_WAIT_ATTEMPTS=${FM_BACKEND_HERDR_LOCK_WAIT_ATTEMPTS:-100}
 . "$FM_BACKEND_HERDR_ROOT/bin/fm-transition-lib.sh"
 # shellcheck source=bin/fm-composer-lib.sh
 . "$FM_BACKEND_HERDR_ROOT/bin/fm-composer-lib.sh"
+# shellcheck source=bin/fm-task-label-lib.sh
+. "$FM_BACKEND_HERDR_ROOT/bin/fm-task-label-lib.sh"
 
 fm_backend_herdr_workspace_label() {
   local marker="$FM_HOME/$FM_BACKEND_HERDR_SECONDMATE_MARKER" id
@@ -125,6 +129,10 @@ fm_backend_herdr_workspace_lock_path() {
   printf '%s/.fm-herdr-workspace.lock' "$FM_HOME"
 }
 
+fm_backend_herdr_label_lock_path() {
+  printf '%s/.fm-herdr-label.lock' "$1"
+}
+
 fm_backend_herdr_pid_start() {
   local pid=$1 proc_stat out
   local -a proc_fields
@@ -191,12 +199,15 @@ fm_backend_herdr_lock_owner_status() {
 }
 
 fm_backend_herdr_lock_discard() {
-  local lock=$1 owner
+  local lock=$1 owner owner_dir owner_name
+  owner_dir=$(dirname "$lock")
   if [ -L "$lock" ]; then
     owner=$(readlink "$lock" 2>/dev/null || true)
     rm -f "$lock"
-    case "$owner" in
-      "$FM_HOME"/.fm-herdr-workspace.owner.*) rm -f "$owner" ;;
+    owner_name=$(basename "$owner")
+    case "$owner" in "$owner_dir"/*)
+      case "$owner_name" in .fm-herdr-*.owner.*) rm -f "$owner" ;; esac
+      ;;
     esac
   elif [ -d "$lock" ]; then
     rm -f "$lock/pid" "$lock/pid-start"
@@ -207,9 +218,11 @@ fm_backend_herdr_lock_discard() {
 }
 
 fm_backend_herdr_workspace_lock_acquire() {
-  local lock=$1 attempt=0 stale_status quarantine pid start owner acquired=0
-  [ -d "$FM_HOME" ] || return 1
-  owner=$(mktemp "$FM_HOME/.fm-herdr-workspace.owner.XXXXXX" 2>/dev/null) || return 1
+  local lock=$1 attempt=0 stale_status quarantine pid start owner acquired=0 lock_dir lock_name
+  lock_dir=$(dirname "$lock")
+  lock_name=$(basename "$lock")
+  [ -d "$lock_dir" ] || return 1
+  owner=$(mktemp "$lock_dir/$lock_name.owner.XXXXXX" 2>/dev/null) || return 1
   pid=${BASHPID:-$$}
   start=$(fm_backend_herdr_pid_start "$pid") || { rm -f "$owner"; return 1; }
   printf '%s\n%s\n' "$pid" "$start" > "$owner" || { rm -f "$owner"; return 1; }
@@ -302,6 +315,18 @@ fm_backend_herdr_workspace_find() {  # <session>
   ' 2>/dev/null
 }
 
+fm_backend_herdr_workspace_tab_labels() {  # <session> [workspace]
+  local session=$1 wsid=${2:-} tabs
+  [ -n "$wsid" ] || wsid=$(fm_backend_herdr_workspace_find "$session") || return 1
+  [ -n "$wsid" ] || return 0
+  tabs=$(fm_backend_herdr_cli "$session" tab list --workspace "$wsid" 2>/dev/null) || return 1
+  printf '%s' "$tabs" | jq -r '
+    if (.result.tabs | type) == "array"
+    then .result.tabs[] | select((.label | type) == "string") | .label
+    else error("missing result.tabs")
+    end' 2>/dev/null
+}
+
 fm_backend_herdr_workspace_ids() {  # <session>
   local session=$1 out
   out=$(fm_backend_herdr_cli "$session" workspace list 2>/dev/null) || return 1
@@ -565,12 +590,10 @@ fm_backend_herdr_agent_alive() {  # <target> -> alive|dead|unknown
   esac
 }
 
-fm_backend_herdr_create_task() {  # <container> <label> <cwd> [seeded-default-tab]
-  local container=$1 label=$2 cwd=$3 seeded=${4:-} lock session wsid dup dup_pane out tab_id pane_id dup_tabs remaining_dup_tabs created_tab_committed create_attempted
-  lock=$(fm_backend_herdr_workspace_lock_path) || return 1
+fm_backend_herdr_create_task_locked() {  # <container> <label> <cwd> [seeded-default-tab]
+  local container=$1 label=$2 cwd=$3 seeded=${4:-} session wsid dup dup_pane out tab_id pane_id dup_tabs remaining_dup_tabs created_tab_committed create_attempted
   (
     local -a husks=()
-    fm_backend_herdr_workspace_lock_acquire "$lock" || exit 1
     created_tab_committed=0
     create_attempted=0
     cleanup_created_tab() {
@@ -582,7 +605,6 @@ fm_backend_herdr_create_task() {  # <container> <label> <cwd> [seeded-default-ta
         fi
       fi
       trap - EXIT
-      fm_backend_herdr_workspace_lock_release "$lock"
       exit "$status"
     }
     trap cleanup_created_tab EXIT
@@ -639,6 +661,47 @@ EOF
   )
 }
 
+fm_backend_herdr_create_task() {  # <container> <label> <cwd> [seeded-default-tab]
+  local lock
+  lock=$(fm_backend_herdr_workspace_lock_path) || return 1
+  (
+    fm_backend_herdr_workspace_lock_acquire "$lock" || exit 1
+    trap 'status=$?; trap - EXIT; fm_backend_herdr_workspace_lock_release "$lock" || status=1; exit "$status"' EXIT
+    fm_backend_herdr_create_task_locked "$@"
+  )
+}
+
+fm_backend_herdr_create_labeled_task() {  # <container> <state> <id> <kind> <title> <backlog> <cwd> [seeded]
+  local container=$1 state=$2 id=$3 kind=$4 title=$5 backlog=$6 cwd=$7 seeded=${8:-}
+  local label_lock workspace_lock
+  mkdir -p "$state" || return 1
+  label_lock=$(fm_backend_herdr_label_lock_path "$state") || return 1
+  workspace_lock=$(fm_backend_herdr_workspace_lock_path) || return 1
+  (
+    local session wsid live prepared label key ids tab_id pane_id
+    fm_backend_herdr_workspace_lock_acquire "$label_lock" || exit 1
+    fm_backend_herdr_workspace_lock_acquire "$workspace_lock" || {
+      fm_backend_herdr_workspace_lock_release "$label_lock"
+      exit 1
+    }
+    trap 'status=$?; trap - EXIT; fm_backend_herdr_workspace_lock_release "$workspace_lock" || status=1; fm_backend_herdr_workspace_lock_release "$label_lock" || status=1; exit "$status"' EXIT
+    session=${container%%:*}
+    wsid=${container#*:}
+    wsid=${wsid%%$'\t'*}
+    live=$(fm_backend_herdr_workspace_tab_labels "$session" "$wsid") || exit 1
+    prepared=$(fm_task_label_prepare "$state" "$id" "$kind" "$title" "$live" "$backlog" \
+      "$FM_HOME" "$session" "$wsid") || exit 1
+    label=${prepared%%$'\t'*}
+    key=${prepared#*$'\t'}
+    ids=$(fm_backend_herdr_create_task_locked "$container" "$label" "$cwd" "$seeded") || exit 1
+    read -r tab_id pane_id <<EOF
+$ids
+EOF
+    [ -n "$tab_id" ] && [ -n "$pane_id" ] || exit 1
+    printf '%s\t%s\t%s\t%s' "$label" "$key" "$tab_id" "$pane_id"
+  )
+}
+
 fm_backend_herdr_parse_target() {  # <session>:<pane-id>
   local target=$1
   FM_BACKEND_HERDR_SESSION=${target%%:*}
@@ -876,6 +939,106 @@ fm_backend_herdr_list_task_ids() {  # <session:workspace>
   printf '%s' "$tabs" | jq -r '.result.tabs[]?.tab_id // empty' 2>/dev/null
 }
 
+fm_backend_herdr_task_id_for_display_label() {  # <label>
+  local want=$1 state record data label owner found='' count=0
+  state=${FM_STATE_OVERRIDE:-${FM_HOME:-$FM_BACKEND_HERDR_ROOT}/state}
+  for record in "$state"/*.meta "$state"/*.herdr-label; do
+    [ -f "$record" ] || continue
+    owner=$(basename "$record")
+    owner=${owner%.meta}
+    owner=${owner%.herdr-label}
+    data=$(fm_task_label_read_record "$record" "$owner" 2>/dev/null) || continue
+    label=${data%%$'\t'*}
+    [ "$label" = "$want" ] || continue
+    if [ -z "$found" ]; then
+      found=$owner
+      count=1
+    elif [ "$found" != "$owner" ]; then
+      count=2
+    fi
+  done
+  [ "$count" -eq 1 ] || return 1
+  printf '%s' "$found"
+}
+
+fm_backend_herdr_task_id_for_exact_ids() {  # <session> <workspace> <tab> <pane>
+  local session=$1 wsid=$2 tab_id=$3 pane_id=$4 state record owner found='' count=0
+  local backend record_session record_workspace record_tab record_pane
+  state=${FM_STATE_OVERRIDE:-${FM_HOME:-$FM_BACKEND_HERDR_ROOT}/state}
+  for record in "$state"/*.meta; do
+    [ -f "$record" ] || continue
+    backend=$(grep '^backend=' "$record" 2>/dev/null | tail -1 | cut -d= -f2- || true)
+    [ "$backend" = herdr ] || continue
+    record_session=$(grep '^herdr_session=' "$record" 2>/dev/null | tail -1 | cut -d= -f2- || true)
+    record_workspace=$(grep '^herdr_workspace_id=' "$record" 2>/dev/null | tail -1 | cut -d= -f2- || true)
+    record_tab=$(grep '^herdr_tab_id=' "$record" 2>/dev/null | tail -1 | cut -d= -f2- || true)
+    record_pane=$(grep '^herdr_pane_id=' "$record" 2>/dev/null | tail -1 | cut -d= -f2- || true)
+    [ "$record_session" = "$session" ] || continue
+    [ "$record_workspace" = "$wsid" ] || continue
+    [ "$record_tab" = "$tab_id" ] || continue
+    [ "$record_pane" = "$pane_id" ] || continue
+    owner=$(basename "$record" .meta)
+    if [ -z "$found" ]; then
+      found=$owner
+      count=1
+    elif [ "$found" != "$owner" ]; then
+      count=2
+    fi
+  done
+  [ "$count" -eq 1 ] || return 1
+  printf '%s' "$found"
+}
+
+# Recovery fallback. Exact persisted session/pane ids remain the normal route.
+# New labels are claimed only by an exact metadata or pre-create-journal match;
+# legacy fm-<id> discovery remains supported.
+fm_backend_herdr_list_live() {  # <session> [workspace]
+  local session=$1 wsid=${2:-} tabs rows row tab_id label pane_id task_id reported
+  [ -n "$wsid" ] || wsid=$(fm_backend_herdr_workspace_find "$session") || return 1
+  [ -n "$wsid" ] || return 0
+  tabs=$(fm_backend_herdr_cli "$session" tab list --workspace "$wsid" 2>/dev/null) || return 1
+  printf '%s' "$tabs" | jq -e '
+    (.result | type) == "object"
+    and (.result.tabs | type) == "array"
+    and all(.result.tabs[]; type == "object" and (.tab_id | type) == "string" and (.label | type) == "string")
+  ' >/dev/null 2>&1 || return 1
+  rows=$(printf '%s' "$tabs" | jq -c '
+    def has_unsafe_controls:
+      any(explode[];
+        (. >= 0 and . <= 31)
+        or . == 127
+        or (. >= 8234 and . <= 8238)
+        or (. >= 8294 and . <= 8297));
+    .result.tabs[]
+    | select(.tab_id | has_unsafe_controls | not)
+    | select(.label | has_unsafe_controls | not)
+    | [.tab_id, .label]
+  ') || return 1
+  [ -n "$rows" ] || return 0
+  while IFS= read -r row; do
+    tab_id=$(printf '%s' "$row" | jq -r '.[0]') || return 1
+    label=$(printf '%s' "$row" | jq -r '.[1]') || return 1
+    [ -n "$tab_id" ] || continue
+    pane_id=$(fm_backend_herdr_pane_for_tab "$session" "$wsid" "$tab_id") || return 1
+    [ -n "$pane_id" ] || return 1
+    reported=$label
+    if task_id=$(fm_backend_herdr_task_id_for_exact_ids "$session" "$wsid" "$tab_id" "$pane_id"); then
+      reported="fm-$task_id"
+    else
+      case "$label" in
+        fm-*) fm_task_label_task_id_is_valid "${label#fm-}" || continue ;;
+        *)
+          fm_task_label_validate_display_label "$label" >/dev/null 2>&1 || continue
+          if task_id=$(fm_backend_herdr_task_id_for_display_label "$label"); then
+            reported="fm-$task_id"
+          fi
+          ;;
+      esac
+    fi
+    printf '%s:%s\t%s\t%s\n' "$session" "$pane_id" "$reported" "$label"
+  done <<<"$rows"
+}
+
 # These lifecycle operations are tmux-only in the generic spawn setup. They
 # remain explicit no-ops for callers that probe the shared interface.
 fm_backend_herdr_set_task_option() { return 0; }
diff --git a/bin/fm-backend.sh b/bin/fm-backend.sh
index cd79fdf1cdc..1a3f7cf01f5 100755
--- a/bin/fm-backend.sh
+++ b/bin/fm-backend.sh
@@ -103,11 +103,26 @@ fm_backend_of_meta() {  # <meta-file>
   printf '%s' "${value:-tmux}"
 }
 
+fm_backend_target_of_meta() {  # <meta-file>
+  local meta=$1 backend session pane window
+  backend=$(fm_backend_of_meta "$meta")
+  if [ "$backend" = herdr ]; then
+    session=$(fm_meta_get "$meta" herdr_session)
+    pane=$(fm_meta_get "$meta" herdr_pane_id)
+    if [ -n "$session" ] && [ -n "$pane" ]; then
+      printf '%s:%s' "$session" "$pane"
+      return 0
+    fi
+  fi
+  window=$(fm_meta_get "$meta" window)
+  [ -n "$window" ] && printf '%s' "$window"
+}
+
 fm_backend_meta_for_window() {  # <target> <state-dir>
   local target=$1 state=$2 meta
   for meta in "$state"/*.meta; do
     [ -e "$meta" ] || continue
-    [ "$(fm_meta_get "$meta" window)" = "$target" ] || continue
+    [ "$(fm_backend_target_of_meta "$meta")" = "$target" ] || continue
     printf '%s' "$meta"
     return 0
   done
@@ -150,29 +165,136 @@ fm_backend_source() {  # <name>
   esac
 }
 
-fm_backend_resolve_selector() {  # <raw-target> <state-dir>
-  local raw=$1 state=$2 meta window
+fm_backend_herdr_inventory_target() {  # <state> <alias> [home] [session] [workspace] [display-label] [allow-legacy]
+  local state=$1 alias=$2 home=${3:-$FM_HOME} session=${4:-} wsid=${5:-}
+  local display_label=${6:-} allow_legacy=${7:-0} live target
+  fm_backend_source herdr || return 2
+  if [ -z "$session" ]; then
+    session=$(fm_backend_herdr_session) || return 2
+    [ -n "$session" ] || return 2
+  fi
+  if ! live=$(FM_HOME="$home" FM_STATE_OVERRIDE="$state" \
+    fm_backend_list_live herdr "$session" "$wsid"); then
+    return 2
+  fi
+  if [ -n "$display_label" ]; then
+    target=$(printf '%s\n' "$live" | awk -F '\t' -v alias="$alias" -v label="$display_label" '
+      $2 == alias && $3 == label { if (++count == 1) found = $1 }
+      END { if (count == 1) print found }
+    ')
+    [ -z "$target" ] || { printf '%s' "$target"; return 0; }
+  fi
+  if [ "$allow_legacy" = 1 ]; then
+    target=$(printf '%s\n' "$live" | awk -F '\t' -v alias="$alias" '
+      $2 == alias && $3 == alias { if (++count == 1) found = $1 }
+      END { if (count == 1) print found }
+    ')
+    [ -z "$target" ] || { printf '%s' "$target"; return 0; }
+  fi
+  return 1
+}
+
+fm_backend_resolve_selector_with_backend() {  # <raw-target> <state-dir>; echoes backend<TAB>target
+  local raw=$1 state=$2 meta window id backend session wsid recovery_record recovery_label recovery_home
+  local recovery_display_label
+  local inventory_status
   case "$raw" in
     *:*)
-      printf '%s' "$raw"
+      printf '%s\t%s' "$(fm_backend_of_selector "$raw" "$raw" "$state")" "$raw"
       ;;
-    fm-*)
-      meta="$state/${raw#fm-}.meta"
-      if [ ! -f "$meta" ]; then
+    *)
+      case "$raw" in
+        fm-*) id=${raw#fm-} ;;
+        *) id=$raw ;;
+      esac
+      meta="$state/$id.meta"
+      [ -f "$meta" ] || meta=
+      if [ -n "$meta" ]; then
+        window=$(fm_backend_target_of_meta "$meta")
+        [ -n "$window" ] || { echo "error: no window recorded in $meta" >&2; return 1; }
+        backend=$(fm_backend_of_meta "$meta")
+        if [ "$backend" != herdr ]; then
+          printf '%s\t%s' "$backend" "$window"
+          return 0
+        fi
+        if fm_backend_pane_readable herdr "$window"; then
+          printf 'herdr\t%s' "$window"
+          return 0
+        fi
+        recovery_home=$(fm_meta_get "$meta" home)
+        session=$(fm_meta_get "$meta" herdr_session)
+        wsid=$(fm_meta_get "$meta" herdr_workspace_id)
+        recovery_display_label=$(fm_meta_get "$meta" display_label)
+        if window=$(fm_backend_herdr_inventory_target "$state" "fm-$id" \
+          "${recovery_home:-$FM_HOME}" "$session" "$wsid" "$recovery_display_label" 1); then
+          printf 'herdr\t%s' "$window"
+          return 0
+        else
+          inventory_status=$?
+        fi
+        if [ "$inventory_status" -eq 2 ]; then
+          echo "error: could not inspect Herdr recovery inventory for $raw" >&2
+        else
+          echo "error: no live Herdr target found for $raw" >&2
+        fi
+        return 1
+      fi
+      recovery_record="$state/$id.herdr-label"
+      if [ -f "$recovery_record" ]; then
+        recovery_label="fm-$id"
+        fm_backend_source herdr || return 1
+        fm_task_label_read_record "$recovery_record" "$id" >/dev/null 2>&1 || {
+          echo "error: malformed Herdr recovery journal for $raw" >&2
+          return 1
+        }
+        recovery_home=$(fm_meta_get "$recovery_record" herdr_home)
+        session=$(fm_meta_get "$recovery_record" herdr_session)
+        wsid=$(fm_meta_get "$recovery_record" herdr_workspace_id)
+        recovery_display_label=$(fm_meta_get "$recovery_record" display_label)
+        if window=$(fm_backend_herdr_inventory_target "$state" "$recovery_label" \
+          "${recovery_home:-$FM_HOME}" "$session" "$wsid" "$recovery_display_label" 1); then
+          printf 'herdr\t%s' "$window"
+          return 0
+        else
+          inventory_status=$?
+        fi
+        if [ "$inventory_status" -eq 2 ]; then
+          echo "error: could not inspect Herdr recovery inventory for $raw" >&2
+        else
+          echo "error: no live Herdr target found for $raw" >&2
+        fi
+        return 1
+      fi
+      if [[ "$raw" == fm-* ]] && [ "$(fm_backend_name)" = herdr ]; then
+        if window=$(fm_backend_herdr_inventory_target "$state" "fm-$id" \
+          "$FM_HOME" "" "" "" 1); then
+          printf 'herdr\t%s' "$window"
+          return 0
+        else
+          inventory_status=$?
+        fi
+        if [ "$inventory_status" -eq 2 ]; then
+          echo "error: could not inspect Herdr legacy inventory for $raw" >&2
+          return 1
+        fi
+      fi
+      if [[ "$raw" == fm-* ]]; then
         echo "error: no metadata for $raw in $state; pass session:window to target a window outside this firstmate home" >&2
         return 1
       fi
-      window=$(fm_meta_get "$meta" window)
-      [ -n "$window" ] || { echo "error: no window recorded in $meta" >&2; return 1; }
-      printf '%s' "$window"
-      ;;
-    *)
       fm_backend_source tmux || return 1
-      fm_backend_tmux_resolve_bare_selector "$raw"
+      window=$(fm_backend_tmux_resolve_bare_selector "$raw") || return 1
+      printf 'tmux\t%s' "$window"
       ;;
   esac
 }
 
+fm_backend_resolve_selector() {  # <raw-target> <state-dir>
+  local resolved
+  resolved=$(fm_backend_resolve_selector_with_backend "$@") || return 1
+  printf '%s' "${resolved#*$'\t'}"
+}
+
 # Generic dispatch wrappers. Backend-specific adapters own command spelling;
 # callers pass an opaque backend and target.
 fm_backend_capture() {  # <backend> <target> <lines>
@@ -338,6 +460,24 @@ fm_backend_list_task_ids() {  # <backend> <container>
   esac
 }
 
+fm_backend_list_live() {  # <backend> <container-or-session>
+  local backend=$1; shift
+  fm_backend_source "$backend" || return 1
+  case "$backend" in
+    herdr) fm_backend_herdr_list_live "$@" ;;
+    *) echo "error: no live-task inventory implementation for backend '$backend'" >&2; return 1 ;;
+  esac
+}
+
+fm_backend_create_labeled_task() {  # <backend> <container> <state> <id> <kind> <title> <backlog> <cwd> [seeded]
+  local backend=$1; shift
+  fm_backend_source "$backend" || return 1
+  case "$backend" in
+    herdr) fm_backend_herdr_create_labeled_task "$@" ;;
+    *) echo "error: no labeled-task create implementation for backend '$backend'" >&2; return 1 ;;
+  esac
+}
+
 fm_backend_set_task_option() {  # <backend> <target> <option> <value>
   local backend=$1; shift
   fm_backend_source "$backend" || return 1
diff --git a/bin/fm-brief.sh b/bin/fm-brief.sh
index a5443b0505a..37e03ecb0db 100755
--- a/bin/fm-brief.sh
+++ b/bin/fm-brief.sh
@@ -6,8 +6,10 @@
 # description, acceptance criteria, and context, and may adjust other sections
 # when the task genuinely deviates (e.g. working an existing external PR instead
 # of shipping a new one).
-# Usage: fm-brief.sh <task-id> <repo-name> [--scout]
-#        fm-brief.sh <task-id> --secondmate <project>...
+# Usage: fm-brief.sh <task-id> <repo-name> [--display-title <title>] [--scout]
+#        fm-brief.sh <task-id> [--display-title <title>] --secondmate <project>...
+#   --display-title sanitizes and persists a deterministic 1-28 character
+#   presentation phrase at data/<task-id>/display-title for fm-spawn.sh.
 #   --scout writes the scout contract instead: the deliverable is a report at
 #   data/<task-id>/report.md (no branch, no push, no PR) and the worktree is scratch.
 #   --secondmate writes a persistent secondmate charter. The project list
@@ -34,24 +36,53 @@ set -eu
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=bin/fm-marker-lib.sh
 . "$SCRIPT_DIR/fm-marker-lib.sh"
+# shellcheck source=bin/fm-task-label-lib.sh
+. "$SCRIPT_DIR/fm-task-label-lib.sh"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
 FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
 DATA="${FM_DATA_OVERRIDE:-$FM_HOME/data}"
 STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 KIND=ship
+DISPLAY_TITLE=
+DISPLAY_TITLE_SET=0
 POS=()
+want_value=
 for a in "$@"; do
+  if [ -n "$want_value" ]; then
+    case "$a" in
+      --*) echo "error: --$want_value requires a value" >&2; exit 1 ;;
+    esac
+    DISPLAY_TITLE=$a
+    DISPLAY_TITLE_SET=1
+    want_value=
+    continue
+  fi
   case "$a" in
     --scout) KIND=scout ;;
     --secondmate) KIND=secondmate ;;
+    --display-title) want_value=display-title ;;
+    --display-title=*) DISPLAY_TITLE=${a#--display-title=}; DISPLAY_TITLE_SET=1 ;;
     *) POS+=("$a") ;;
   esac
 done
+[ -z "$want_value" ] || { echo "error: --display-title requires a value" >&2; exit 1; }
 ID=${POS[0]}
 
 BRIEF="$DATA/$ID/brief.md"
 [ -e "$BRIEF" ] && { echo "error: $BRIEF already exists" >&2; exit 1; }
 mkdir -p "$DATA/$ID"
+if [ "$DISPLAY_TITLE_SET" -eq 1 ]; then
+  DISPLAY_TITLE=$(fm_task_label_sanitize_phrase "$DISPLAY_TITLE") || exit 1
+  [ -n "$DISPLAY_TITLE" ] || {
+    echo "error: --display-title has no usable characters" >&2
+    exit 1
+  }
+fi
+
+publish_display_title() {
+  [ "$DISPLAY_TITLE_SET" -eq 1 ] || return 0
+  printf '%s\n' "$DISPLAY_TITLE" > "$DATA/$ID/display-title"
+}
 
 shell_quote() {
   printf "'"
@@ -88,6 +119,7 @@ while [ "$idx" -lt "${#POS[@]}" ]; do
   idx=$((idx + 1))
 done
 [ -n "$SECONDMATE_PROJECTS" ] || { echo "error: --secondmate requires at least one project" >&2; exit 1; }
+publish_display_title
 SECONDMATE_CHARTER=${FM_SECONDMATE_CHARTER:-"{TASK}"}
 SECONDMATE_SCOPE=${FM_SECONDMATE_SCOPE:-${FM_SECONDMATE_CHARTER:-"{TASK}"}}
 PROJECT_LIST=$(printf '%s\n' "$SECONDMATE_PROJECTS" | tr ' ' '\n' | sed 's/^/- /')
@@ -150,6 +182,7 @@ fi
 REPO=${POS[1]}
 
 if [ "$KIND" = scout ]; then
+publish_display_title
 cat > "$BRIEF" <<EOF
 You are a crewmate: an autonomous worker agent managed by firstmate. Work on your own; do not wait for a human.
 
@@ -196,6 +229,7 @@ fi
 read -r MODE _ <<EOF
 $("$FM_ROOT/bin/fm-project-mode.sh" "$REPO")
 EOF
+publish_display_title
 
 case "$MODE" in
   direct-PR)
diff --git a/bin/fm-fleet-snapshot.sh b/bin/fm-fleet-snapshot.sh
index 4fb9ed14c04..106d0b8bafe 100755
--- a/bin/fm-fleet-snapshot.sh
+++ b/bin/fm-fleet-snapshot.sh
@@ -16,18 +16,52 @@ PROJECTS="${FM_PROJECTS_OVERRIDE:-$FM_HOME/projects}"
 usage() {
   cat <<'USAGE'
 Usage: fm-fleet-snapshot.sh [--json|--help]
+       fm-fleet-snapshot.sh --backlog-title <task-id>
 
 The default and --json modes print the read-only fm-fleet-snapshot.v1 JSON
 contract. All sources are local to this Firstmate home.
+--backlog-title prints the title from one canonical structured backlog row and
+exits before task endpoint inspection.
 USAGE
 }
 
+OUTPUT_MODE=json
 case "${1:---json}" in
   --json) ;;
+  --backlog-title)
+    OUTPUT_MODE=backlog-title
+    BACKLOG_TITLE_ID=${2:-}
+    [ -n "$BACKLOG_TITLE_ID" ] || { usage >&2; exit 2; }
+    ;;
   --help|-h) usage; exit 0 ;;
   *) usage >&2; exit 2 ;;
 esac
 
+if [ "$OUTPUT_MODE" = backlog-title ]; then
+  [ -f "$DATA/backlog.md" ] || exit 0
+  awk -v id="$BACKLOG_TITLE_ID" '
+    {
+      prefix = "- [ ] " id " - "
+      done_prefix = "- [x] " id " - "
+      done_prefix_upper = "- [X] " id " - "
+      bold_prefix = "- **" id "** - "
+      if (index($0, prefix) == 1) title = substr($0, length(prefix) + 1)
+      else if (index($0, done_prefix) == 1) title = substr($0, length(done_prefix) + 1)
+      else if (index($0, done_prefix_upper) == 1) title = substr($0, length(done_prefix_upper) + 1)
+      else if (index($0, bold_prefix) == 1) title = substr($0, length(bold_prefix) + 1)
+      else next
+      sub(/[[:space:]]+\(repo:[^)]*\).*/, "", title)
+      sub(/[[:space:]]+blocked-by:.*/, "", title)
+      sub(/[[:space:]]+-[[:space:]]+https:\/\/github\.com\/[^[:space:]]+\/pull\/[0-9]+[[:space:]]+\(merged[[:space:]][^)]*\)[[:space:]]*$/, "", title)
+      sub(/[[:space:]]+-[[:space:]]+local main[[:space:]]+\(merged[[:space:]][^)]*\)[[:space:]]*$/, "", title)
+      sub(/[[:space:]]+-[[:space:]]+data\/[^[:space:]]+\/report\.md[[:space:]]+\(reported[[:space:]][^)]*\)[[:space:]]*$/, "", title)
+      print title
+      exit
+    }
+  ' "$DATA/backlog.md"
+  exit 0
+fi
+
 command -v jq >/dev/null 2>&1 || {
   printf '%s\n' 'fm-fleet-snapshot.sh: jq is required for the JSON contract' >&2
   exit 127
diff --git a/bin/fm-peek.sh b/bin/fm-peek.sh
index 52e6278ad37..975596ec8c6 100755
--- a/bin/fm-peek.sh
+++ b/bin/fm-peek.sh
@@ -14,7 +14,8 @@ STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 # shellcheck source=bin/fm-backend.sh
 . "$SCRIPT_DIR/fm-backend.sh"
 
-T=$(fm_backend_resolve_selector "$1" "$STATE")
+RESOLUTION=$(fm_backend_resolve_selector_with_backend "$1" "$STATE")
+BACKEND=${RESOLUTION%%$'\t'*}
+T=${RESOLUTION#*$'\t'}
 N=${2:-40}
-BACKEND=$(fm_backend_of_selector "$1" "$T" "$STATE")
 fm_backend_capture "$BACKEND" "$T" "$N"
diff --git a/bin/fm-send.sh b/bin/fm-send.sh
index 721bd38fe81..681faf02300 100755
--- a/bin/fm-send.sh
+++ b/bin/fm-send.sh
@@ -61,8 +61,9 @@ case "$RAW_TARGET" in
     exit 1
     ;;
 esac
-T=$(fm_backend_resolve_selector "$1" "$STATE")
-TARGET_BACKEND=$(fm_backend_of_selector "$RAW_TARGET" "$T" "$STATE")
+TARGET_RESOLUTION=$(fm_backend_resolve_selector_with_backend "$1" "$STATE")
+TARGET_BACKEND=${TARGET_RESOLUTION%%$'\t'*}
+T=${TARGET_RESOLUTION#*$'\t'}
 shift
 
 # Mark a from-firstmate -> secondmate request. Only a bare `fm-<id>` target,
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index f4e2af07845..c122f64f78b 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -1,8 +1,11 @@
 #!/usr/bin/env bash
 # Spawn a direct report: a crewmate in a treehouse worktree, or a secondmate in
 # its isolated firstmate home.
-# Usage: fm-spawn.sh <task-id> <project-dir> [--harness <name>|harness|launch-command] [--model <name>] [--effort <level>] [--backend <name>] [--scout]
-#        fm-spawn.sh <task-id> [<firstmate-home>] [--harness <name>|harness|launch-command] [--model <name>] [--effort <level>] [--backend <name>] --secondmate
+# Usage: fm-spawn.sh <task-id> <project-dir> [--display-title <title>] [--harness <name>|harness|launch-command] [--model <name>] [--effort <level>] [--backend <name>] [--scout]
+#        fm-spawn.sh <task-id> [<firstmate-home>] [--display-title <title>] [--harness <name>|harness|launch-command] [--model <name>] [--effort <level>] [--backend <name>] --secondmate
+#   --display-title supplies the deterministic Herdr-only presentation phrase.
+#   Without it, spawn reads data/<task-id>/display-title, then the structured
+#   backlog title, then a semantic task-id fallback. Tmux naming is unchanged.
 #   --harness <name> is the explicit per-spawn harness/profile adapter. The old
 #   positional harness arg still works for back-compat.
 #   --model <name> and --effort <low|medium|high|xhigh|max> are concrete profile
@@ -88,6 +91,8 @@ fm_normalize_tool_path
 . "$SCRIPT_DIR/fm-cbm-lib.sh"
 # shellcheck source=bin/fm-backend.sh
 . "$SCRIPT_DIR/fm-backend.sh"
+# shellcheck source=bin/fm-task-label-lib.sh
+. "$SCRIPT_DIR/fm-task-label-lib.sh"
 # Skip the watcher guard when re-exec'd for one pair of a batch (FM_SPAWN_NO_GUARD is
 # set by the batch loop below), so the guard runs once for the batch, not once per pair.
 [ -n "${FM_SPAWN_NO_GUARD:-}" ] || "$FM_ROOT/bin/fm-guard.sh" || true
@@ -96,10 +101,12 @@ HARNESS_ARG=
 MODEL=
 EFFORT=
 BACKEND_ARG=
+DISPLAY_TITLE=
 HARNESS_SET=0
 MODEL_SET=0
 EFFORT_SET=0
 BACKEND_SET=0
+DISPLAY_TITLE_SET=0
 POS=()
 want_value=
 for a in "$@"; do
@@ -112,6 +119,7 @@ for a in "$@"; do
       model) MODEL=$a; MODEL_SET=1 ;;
       effort) EFFORT=$a; EFFORT_SET=1 ;;
       backend) BACKEND_ARG=$a; BACKEND_SET=1 ;;
+      display-title) DISPLAY_TITLE=$a; DISPLAY_TITLE_SET=1 ;;
       *) echo "error: internal parser state for --$want_value" >&2; exit 1 ;;
     esac
     want_value=
@@ -128,6 +136,8 @@ for a in "$@"; do
     --effort=*) EFFORT=${a#--effort=}; EFFORT_SET=1 ;;
     --backend) want_value=backend ;;
     --backend=*) BACKEND_ARG=${a#--backend=}; BACKEND_SET=1 ;;
+    --display-title) want_value=display-title ;;
+    --display-title=*) DISPLAY_TITLE=${a#--display-title=}; DISPLAY_TITLE_SET=1 ;;
     *) POS+=("$a") ;;
   esac
 done
@@ -136,6 +146,7 @@ done
 [ "$MODEL_SET" -eq 0 ] || [ -n "$MODEL" ] || { echo "error: --model requires a non-empty value" >&2; exit 1; }
 [ "$EFFORT_SET" -eq 0 ] || [ -n "$EFFORT" ] || { echo "error: --effort requires a non-empty value" >&2; exit 1; }
 [ "$BACKEND_SET" -eq 0 ] || [ -n "$BACKEND_ARG" ] || { echo "error: --backend requires a non-empty value" >&2; exit 1; }
+[ "$DISPLAY_TITLE_SET" -eq 0 ] || [ -n "$DISPLAY_TITLE" ] || { echo "error: --display-title requires a non-empty value" >&2; exit 1; }
 case "$EFFORT" in
   ''|low|medium|high|xhigh|max) ;;
   *) echo "error: --effort must be one of low, medium, high, xhigh, max" >&2; exit 1 ;;
@@ -171,6 +182,10 @@ if [ "${#POS[@]}" -gt 0 ] && [ "${POS[0]}" != "$idpart" ] && case "$idpart" in *
   [ -z "$MODEL" ] || shared_args+=(--model "$MODEL")
   [ -z "$EFFORT" ] || shared_args+=(--effort "$EFFORT")
   [ -z "$BACKEND_ARG" ] || shared_args+=(--backend "$BACKEND_ARG")
+  if [ "$DISPLAY_TITLE_SET" -eq 1 ]; then
+    echo "error: batch dispatch does not support one shared --display-title; spawn each task explicitly" >&2
+    exit 2
+  fi
   for pair in "${POS[@]}"; do
     case "$pair" in
       *=*) : ;;
@@ -192,6 +207,13 @@ ID=${POS[0]:-}
 case "$ID" in
   ''|.*|*[!A-Za-z0-9._-]*) echo "error: unsafe task id: $ID" >&2; exit 2 ;;
 esac
+if [ "$DISPLAY_TITLE_SET" -eq 0 ] && [ -e "$DATA/$ID/display-title" ]; then
+  [ -f "$DATA/$ID/display-title" ] || {
+    echo "error: display title record for $ID is not a regular file" >&2
+    exit 1
+  }
+  DISPLAY_TITLE=$(cat "$DATA/$ID/display-title")
+fi
 PROJ=
 ARG3=
 FIRSTMATE_HOME=
@@ -689,6 +711,9 @@ if [ "$KIND" = secondmate ]; then
 fi
 
 W="fm-$ID"
+DISPLAY_LABEL=
+TASK_KEY=
+HERDR_LABEL_JOURNAL=
 HERDR_SES=
 HERDR_WORKSPACE_ID=
 HERDR_TAB_ID=
@@ -844,18 +869,23 @@ case "$BACKEND" in
   herdr)
     HERDR_LABEL_HOME="$FM_HOME"
     [ "$KIND" = secondmate ] && HERDR_LABEL_HOME="$PROJ_ABS"
+    HERDR_SES=$(fm_backend_herdr_session)
+    fm_backend_herdr_server_ensure "$HERDR_SES" || exit 1
     CONTAINER=$(FM_HOME="$HERDR_LABEL_HOME" fm_backend_container_ensure "$BACKEND" "$PROJ_ABS") || exit 1
     CONTAINER_MAIN=${CONTAINER%%$'\t'*}
     HERDR_SEEDED=
     [ "$CONTAINER_MAIN" = "$CONTAINER" ] || HERDR_SEEDED=${CONTAINER#*$'\t'}
     HERDR_SES=${CONTAINER_MAIN%%:*}
     HERDR_WORKSPACE_ID=${CONTAINER_MAIN#*:}
-    HERDR_TASK_IDS=$(FM_HOME="$HERDR_LABEL_HOME" fm_backend_create_task "$BACKEND" "$CONTAINER" "$W" "$PROJ_ABS" "$HERDR_SEEDED") || exit 1
-    read -r HERDR_TAB_ID HERDR_PANE_ID <<EOF
+    HERDR_TASK_IDS=$(FM_HOME="$HERDR_LABEL_HOME" fm_backend_create_labeled_task \
+      "$BACKEND" "$CONTAINER" "$STATE" "$ID" "$KIND" "$DISPLAY_TITLE" \
+      "$DATA/backlog.md" "$PROJ_ABS" "$HERDR_SEEDED") || exit 1
+    IFS=$'\t' read -r DISPLAY_LABEL TASK_KEY HERDR_TAB_ID HERDR_PANE_ID <<EOF
 $HERDR_TASK_IDS
 EOF
+    HERDR_LABEL_JOURNAL="$STATE/$ID.herdr-label"
     if [ -z "$HERDR_TAB_ID" ] || [ -z "$HERDR_PANE_ID" ]; then
-      echo "error: Herdr did not return a tab/pane id for $W" >&2
+      echo "error: Herdr did not return a tab/pane id for $DISPLAY_LABEL" >&2
       exit 1
     fi
     T="$HERDR_SES:$HERDR_PANE_ID"
@@ -1030,6 +1060,8 @@ if [ "$KIND" != secondmate ]; then
 fi
 
 mkdir -p "$STATE"
+META_TMP=$(mktemp "$STATE/.$ID.meta.XXXXXX") || exit 1
+chmod 600 "$META_TMP" || { rm -f "$META_TMP"; exit 1; }
 {
   echo "window=$T"
   echo "worktree=$WT"
@@ -1052,6 +1084,8 @@ mkdir -p "$STATE"
   # non-default backends so existing and new tmux metadata stay unchanged.
   [ "$BACKEND" = tmux ] || echo "backend=$BACKEND"
   if [ "$BACKEND" = herdr ]; then
+    echo "display_label=$DISPLAY_LABEL"
+    echo "task_key=$TASK_KEY"
     echo "herdr_session=$HERDR_SES"
     echo "herdr_workspace_id=$HERDR_WORKSPACE_ID"
     echo "herdr_tab_id=$HERDR_TAB_ID"
@@ -1061,7 +1095,11 @@ mkdir -p "$STATE"
     echo "home=$PROJ_ABS"
     echo "projects=$SECONDMATE_PROJECTS"
   fi
-} > "$STATE/$ID.meta"
+} > "$META_TMP" || { rm -f "$META_TMP"; exit 1; }
+mv "$META_TMP" "$STATE/$ID.meta" || { rm -f "$META_TMP"; exit 1; }
+if [ "$BACKEND" = herdr ]; then
+  rm -f "$HERDR_LABEL_JOURNAL"
+fi
 
 sq_brief=$(shell_quote "$BRIEF")
 sq_turnend=$(shell_quote "$TURNEND")
diff --git a/bin/fm-task-label-lib.sh b/bin/fm-task-label-lib.sh
new file mode 100755
index 00000000000..570b4628b4e
--- /dev/null
+++ b/bin/fm-task-label-lib.sh
@@ -0,0 +1,312 @@
+#!/usr/bin/env bash
+# Deterministic Herdr display-label owner.
+#
+# Machine identity remains the full task id and response-derived Herdr ids.
+# This library owns presentation only:
+#   <kind> - <phrase> · <task-key>
+#
+# A caller must publish the returned journal before creating the Herdr tab and
+# remove it only after complete task metadata has been atomically published.
+FM_TASK_LABEL_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+fm_task_label_kind() {  # <ship|crew|scout|secondmate>
+  case "$1" in
+    ship|crew) printf 'Crew' ;;
+    scout) printf 'Scout' ;;
+    secondmate) printf '2nd' ;;
+    *) return 1 ;;
+  esac
+}
+
+fm_task_label_sha256() {  # <text>
+  if command -v sha256sum >/dev/null 2>&1; then
+    printf '%s' "$1" | sha256sum | awk '{print $1}'
+  else
+    printf '%s' "$1" | shasum -a 256 | awk '{print $1}'
+  fi
+}
+
+fm_task_label_base_key() {  # <task-id>
+  local id=$1 tail
+  tail=${id##*-}
+  case "$tail" in
+    *[!A-Za-z0-9]*|'') ;;
+    *)
+      if [ "${#tail}" -ge 4 ] && [ "${#tail}" -le 6 ] && \
+         [[ "$tail" == *[A-Za-z]* ]] && [[ "$tail" == *[0-9]* ]]; then
+        printf '%s' "$tail" | tr '[:upper:]' '[:lower:]'
+        return 0
+      fi
+      ;;
+  esac
+  fm_task_label_sha256 "$id" | cut -c1-6
+}
+
+fm_task_label_has_unsafe_controls() {  # <text>
+  local raw=$1 stripped
+  stripped=$(printf '%s' "$raw" | LC_ALL=C tr -d '\001-\037\177')
+  [ "$stripped" = "$raw" ] || return 0
+  case "$raw" in
+    *$'\342\200\252'*|*$'\342\200\253'*|*$'\342\200\254'*|\
+    *$'\342\200\255'*|*$'\342\200\256'*|*$'\342\201\246'*|\
+    *$'\342\201\247'*|*$'\342\201\250'*|*$'\342\201\251'*) return 0 ;;
+  esac
+  return 1
+}
+
+fm_task_label_trim_phrase() {  # <already ASCII-sanitized phrase>
+  printf '%s' "$1" | sed \
+    -e 's/[[:space:]][[:space:]]*/ /g' \
+    -e 's/^[ .+_-]*//' \
+    -e 's/[ .+_-]*$//'
+}
+
+fm_task_label_sanitize_phrase() {  # <raw phrase>
+  local raw=$1 phrase prefix next
+  fm_task_label_has_unsafe_controls "$raw" && {
+    echo "error: display title contains control or bidi characters" >&2
+    return 1
+  }
+  phrase=$(printf '%s' "$raw" | LC_ALL=C sed 's/[^A-Za-z0-9 .+_-]/ /g')
+  phrase=$(fm_task_label_trim_phrase "$phrase")
+  if [ "${#phrase}" -gt 28 ]; then
+    prefix=${phrase:0:28}
+    next=${phrase:28:1}
+    if [[ "$next" =~ [A-Za-z0-9_] ]] && [[ "$prefix" == *" "* ]]; then
+      prefix=${prefix% *}
+    fi
+    phrase=$(fm_task_label_trim_phrase "$prefix")
+  fi
+  printf '%s' "$phrase"
+}
+
+fm_task_label_character_count() {  # <safe display label>
+  local ascii=${1//$'·'/x}
+  printf '%s' "${#ascii}"
+}
+
+fm_task_label_phrase_is_valid() {  # <phrase>
+  local phrase=$1 sanitized
+  case "$phrase" in
+    ''|*[!A-Za-z0-9\ .+_-]*) return 1 ;;
+  esac
+  [ "${#phrase}" -le 28 ] || return 1
+  sanitized=$(fm_task_label_sanitize_phrase "$phrase") || return 1
+  [ "$sanitized" = "$phrase" ]
+}
+
+fm_task_label_task_id_is_valid() {  # <task-id>
+  case "$1" in
+    ''|.*|*[!A-Za-z0-9._-]*) return 1 ;;
+  esac
+}
+
+fm_task_label_validate_display_label() {  # <label>; echoes key
+  local label=$1 key phrase
+  fm_task_label_has_unsafe_controls "$label" && return 1
+  [ "$(fm_task_label_character_count "$label")" -le 50 ] || return 1
+  case "$label" in
+    *" · "*) key=${label##*" · "} ;;
+    *) return 1 ;;
+  esac
+  case "$key" in
+    [a-z0-9][a-z0-9][a-z0-9][a-z0-9]|\
+    [a-z0-9][a-z0-9][a-z0-9][a-z0-9][a-z0-9]|\
+    [a-z0-9][a-z0-9][a-z0-9][a-z0-9][a-z0-9][a-z0-9]|\
+    [a-z0-9][a-z0-9][a-z0-9][a-z0-9][a-z0-9][a-z0-9][a-z0-9][a-z0-9][a-z0-9][a-z0-9]) ;;
+    *) return 1 ;;
+  esac
+  case "$label" in
+    Crew\ -\ *\ ·\ "$key") phrase=${label#Crew - }; phrase=${phrase%" · $key"} ;;
+    Scout\ -\ *\ ·\ "$key") phrase=${label#Scout - }; phrase=${phrase%" · $key"} ;;
+    2nd\ -\ *\ ·\ "$key") phrase=${label#2nd - }; phrase=${phrase%" · $key"} ;;
+    *) return 1 ;;
+  esac
+  fm_task_label_phrase_is_valid "$phrase" || return 1
+  printf '%s' "$key"
+}
+
+fm_task_label_semantic_phrase() {  # <task-id>
+  local id=$1 tail lower_tail phrase word lower_word count=0 out='' first rest
+  id=${id#fm-}
+  id=${id##*/}
+  tail=${id##*-}
+  lower_tail=$(printf '%s' "$tail" | tr '[:upper:]' '[:lower:]')
+  if [ "$(fm_task_label_base_key "$id")" = "$lower_tail" ]; then
+    id=${id%-"$tail"}
+  fi
+  phrase=${id//-/ }
+  for word in $phrase; do
+    lower_word=$(printf '%s' "$word" | tr '[:upper:]' '[:lower:]')
+    case "$lower_word" in
+      fm|firstmate|crew|ship|scout|task|secondmate) continue ;;
+    esac
+    [[ "$word" == *[A-Za-z]* ]] || continue
+    out="${out}${out:+ }$word"
+    count=$((count + 1))
+    [ "$count" -lt 4 ] || break
+  done
+  out=$(fm_task_label_sanitize_phrase "$out") || return 1
+  if [ -n "$out" ]; then
+    first=$(printf '%s' "$out" | cut -c1 | tr '[:lower:]' '[:upper:]')
+    rest=${out:1}
+    printf '%s%s' "$first" "$rest"
+  fi
+}
+
+# Ask the fleet snapshot's canonical backlog parser for one title. Its
+# backlog-only mode exits before endpoint or task-state inspection, so spawn
+# reuses the established parser without duplicating its rules or paying for a
+# whole fleet snapshot.
+fm_task_label_backlog_title() {  # <backlog-path> <task-id>
+  local backlog=$1 id=$2 data home
+  [ -f "$backlog" ] || return 0
+  data=$(cd "$(dirname "$backlog")" && pwd -P) || return 1
+  home=$(dirname "$data")
+  FM_HOME="$home" FM_DATA_OVERRIDE="$data" \
+    "$FM_TASK_LABEL_LIB_DIR/fm-fleet-snapshot.sh" --backlog-title "$id"
+}
+
+fm_task_label_read_record() {  # <record> <expected-id>; echoes label<TAB>key
+  local record=$1 expected=$2 task_id label key label_key
+  [ -f "$record" ] || return 1
+  task_id=$(grep '^task_id=' "$record" 2>/dev/null | tail -1 | cut -d= -f2- || true)
+  label=$(grep '^display_label=' "$record" 2>/dev/null | tail -1 | cut -d= -f2- || true)
+  key=$(grep '^task_key=' "$record" 2>/dev/null | tail -1 | cut -d= -f2- || true)
+  [ -z "$task_id" ] || [ "$task_id" = "$expected" ] || return 1
+  label_key=$(fm_task_label_validate_display_label "$label") || return 1
+  [ "$label_key" = "$key" ] || return 1
+  printf '%s\t%s' "$label" "$key"
+}
+
+fm_task_label_collision() {  # <state> <current-id> <key> <candidate-label> <live-labels>
+  local state=$1 current=$2 key=$3 candidate=$4 live=${5:-} record owner other_key other_label
+  for record in "$state"/*.meta "$state"/*.herdr-label; do
+    [ -f "$record" ] || continue
+    owner=$(basename "$record")
+    owner=${owner%.meta}
+    owner=${owner%.herdr-label}
+    [ "$owner" = "$current" ] && continue
+    other_key=$(grep '^task_key=' "$record" 2>/dev/null | tail -1 | cut -d= -f2- || true)
+    other_label=$(grep '^display_label=' "$record" 2>/dev/null | tail -1 | cut -d= -f2- || true)
+    if [ -z "$other_key" ]; then
+      case "$other_label" in *" · "*) other_key=${other_label##*" · "} ;; esac
+    fi
+    [ "$other_key" != "$key" ] && [ "$other_label" != "$candidate" ] || return 0
+  done
+  while IFS= read -r other_label; do
+    [ -n "$other_label" ] || continue
+    [ "$other_label" != "$candidate" ] || return 0
+    case "$other_label" in *" · $key") return 0 ;; esac
+  done <<EOF
+$live
+EOF
+  return 1
+}
+
+fm_task_label_prepare() {  # <state> <id> <kind> <explicit-title> <live-labels> [backlog] [home] [session] [workspace]
+  local state=$1 id=$2 kind=$3 explicit=${4:-} live=${5:-} backlog=${6:-}
+  local herdr_home=${7:-} herdr_session=${8:-} herdr_workspace=${9:-}
+  local journal meta existing kind_label key phrase candidate hash tmp
+  local existing_home existing_session existing_workspace
+  journal="$state/$id.herdr-label"
+  meta="$state/$id.meta"
+  if ! fm_task_label_task_id_is_valid "$id"; then
+    echo "error: invalid task id for Herdr display label" >&2
+    return 1
+  fi
+  mkdir -p "$state" || return 1
+
+  if [ -e "$journal" ] || [ -L "$journal" ]; then
+    if [ ! -f "$journal" ] || ! existing=$(fm_task_label_read_record "$journal" "$id"); then
+      echo "error: malformed Herdr label journal for $id" >&2
+      return 1
+    fi
+    if [ -f "$meta" ]; then
+      candidate=$(fm_task_label_read_record "$meta" "$id" 2>/dev/null || true)
+      [ -z "$candidate" ] || [ "$candidate" = "$existing" ] || {
+        echo "error: Herdr label journal and metadata disagree for $id" >&2
+        return 1
+      }
+    fi
+    existing_home=$(grep '^herdr_home=' "$journal" 2>/dev/null | tail -1 | cut -d= -f2- || true)
+    existing_session=$(grep '^herdr_session=' "$journal" 2>/dev/null | tail -1 | cut -d= -f2- || true)
+    existing_workspace=$(grep '^herdr_workspace_id=' "$journal" 2>/dev/null | tail -1 | cut -d= -f2- || true)
+    [ -z "$existing_home" ] || [ -z "$herdr_home" ] || [ "$existing_home" = "$herdr_home" ] || return 1
+    [ -z "$existing_session" ] || [ -z "$herdr_session" ] || [ "$existing_session" = "$herdr_session" ] || return 1
+    [ -z "$existing_workspace" ] || [ -z "$herdr_workspace" ] || [ "$existing_workspace" = "$herdr_workspace" ] || return 1
+    if { [ -n "$herdr_home" ] && [ -z "$existing_home" ]; } ||
+       { [ -n "$herdr_session" ] && [ -z "$existing_session" ]; } ||
+       { [ -n "$herdr_workspace" ] && [ -z "$existing_workspace" ]; }; then
+      candidate=${existing%%$'\t'*}
+      key=${existing#*$'\t'}
+      tmp=$(mktemp "$state/.$id.herdr-label.XXXXXX") || return 1
+      chmod 600 "$tmp" || { rm -f "$tmp"; return 1; }
+      {
+        printf 'version=1\n'
+        printf 'task_id=%s\n' "$id"
+        printf 'display_label=%s\n' "$candidate"
+        printf 'task_key=%s\n' "$key"
+        printf 'herdr_home=%s\n' "${existing_home:-$herdr_home}"
+        printf 'herdr_session=%s\n' "${existing_session:-$herdr_session}"
+        printf 'herdr_workspace_id=%s\n' "${existing_workspace:-$herdr_workspace}"
+      } > "$tmp" || { rm -f "$tmp"; return 1; }
+      mv "$tmp" "$journal" || { rm -f "$tmp"; return 1; }
+    fi
+    printf '%s' "$existing"
+    return 0
+  fi
+  if existing=$(fm_task_label_read_record "$meta" "$id" 2>/dev/null); then
+    candidate=${existing%%$'\t'*}
+    key=${existing#*$'\t'}
+  else
+    kind_label=$(fm_task_label_kind "$kind") || {
+      echo "error: unsupported task kind for Herdr display label: $kind" >&2
+      return 1
+    }
+    key=$(fm_task_label_base_key "$id") || return 1
+    phrase=
+    if [ -n "$explicit" ]; then
+      phrase=$(fm_task_label_sanitize_phrase "$explicit") || return 1
+    fi
+    if [ -z "$phrase" ] && [ -n "$backlog" ]; then
+      phrase=$(fm_task_label_backlog_title "$backlog" "$id")
+      phrase=$(fm_task_label_sanitize_phrase "$phrase") || return 1
+    fi
+    if [ -z "$phrase" ]; then
+      phrase=$(fm_task_label_semantic_phrase "$id") || return 1
+    fi
+    [ -n "$phrase" ] || phrase="Task $key"
+    candidate="$kind_label - $phrase · $key"
+    if fm_task_label_collision "$state" "$id" "$key" "$candidate" "$live"; then
+      hash=$(fm_task_label_sha256 "$id") || return 1
+      key=${hash:0:10}
+      candidate="$kind_label - $phrase · $key"
+      fm_task_label_collision "$state" "$id" "$key" "$candidate" "$live" && {
+        echo "error: 10-character Herdr task-key collision for $id" >&2
+        return 1
+      }
+    fi
+  fi
+  [ "$(fm_task_label_character_count "$candidate")" -le 50 ] || {
+    echo "error: Herdr display label exceeds 50 characters" >&2
+    return 1
+  }
+
+  tmp=$(mktemp "$state/.$id.herdr-label.XXXXXX") || return 1
+  chmod 600 "$tmp" || { rm -f "$tmp"; return 1; }
+  {
+    printf 'version=1\n'
+    printf 'task_id=%s\n' "$id"
+    printf 'display_label=%s\n' "$candidate"
+    printf 'task_key=%s\n' "$key"
+    [ -z "$herdr_home" ] || printf 'herdr_home=%s\n' "$herdr_home"
+    [ -z "$herdr_session" ] || printf 'herdr_session=%s\n' "$herdr_session"
+    [ -z "$herdr_workspace" ] || printf 'herdr_workspace_id=%s\n' "$herdr_workspace"
+  } > "$tmp" || { rm -f "$tmp"; return 1; }
+  if ! mv "$tmp" "$journal"; then
+    rm -f "$tmp"
+    return 1
+  fi
+  printf '%s\t%s' "$candidate" "$key"
+}
diff --git a/docs/architecture.md b/docs/architecture.md
index ede1c69f642..5dcc92f7024 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -63,7 +63,7 @@ The runtime backend is the session-provider layer below firstmate's lifecycle sc
 `bin/fm-backend.sh` owns selection, metadata helpers, selector resolution, and operation dispatch; `bin/backends/tmux.sh` and `bin/backends/herdr.sh` own the backend-specific command primitives used by spawn, send, peek, watch, teardown, and crew-state.
 New spawns select a backend from `fm-spawn.sh --backend`, then `FM_BACKEND`, then local `config/backend`, then runtime auto-detection (`$TMUX` first, `HERDR_ENV=1` second), then default `tmux`.
 Tmux remains the default and production path. Herdr is an experimental opt-in backend for Herdr 0.7.x/protocol 14+; unknown names fail loudly, and default tmux tasks omit `backend=tmux` from metadata. A missing `backend=` still means tmux.
-When `HERDR_ENV=1` is present without explicit configuration, Herdr is auto-detected; `$TMUX` wins when nested. Herdr tasks use one workspace per firstmate home and one tab per task, while treehouse remains the worktree provider. The AFK daemon supports Herdr supervisor target resolution and injection when explicitly selected. On capable Herdr protocol-16 sessions, the watcher can also use the native `pane.agent_status_changed` stream as an optional fast path; capability, socket, subscription, and reader failures fall back to polling. The detailed Herdr lifecycle and safety contract lives in [herdr-backend.md](herdr-backend.md).
+When `HERDR_ENV=1` is present without explicit configuration, Herdr is auto-detected; `$TMUX` wins when nested. Herdr tasks use one workspace per firstmate home and one tab per task, while treehouse remains the worktree provider. New Herdr tabs separate their one-time readable display label from the full task id and exact response-derived tab/pane ids; tmux naming remains unchanged. The AFK daemon supports Herdr supervisor target resolution and injection when explicitly selected. On capable Herdr protocol-16 sessions, the watcher can also use the native `pane.agent_status_changed` stream as an optional fast path; capability, socket, subscription, and reader failures fall back to polling. The detailed Herdr lifecycle, label, recovery, and safety contract lives in [herdr-backend.md](herdr-backend.md).
 The existing poll loop remains the fail-closed event-source backstop for Herdr and the normal event source for tmux, so the default wake/stale behavior remains unchanged.
 
 Generated ship and scout briefs carry a shared no-mistakes daemon ownership boundary: workers must not stop, restart, or update the daemon; daemon errors are reported as `blocked:` and only firstmate manages the shared instance. The exact generated rule is owned by `bin/fm-brief.sh`.
@@ -77,7 +77,7 @@ remote PR discovery opt-in and soft-failing.
 
 Crewmates never intentionally touch your project clone; [treehouse](https://github.com/kunchenguid/treehouse) pools clean worktrees so parallel tasks on one repo cannot collide.
 For ship and scout work, `fm-spawn.sh` waits for `treehouse get` and then refuses to launch unless the pane resolves to a real git worktree root of the target project: its physical git common dir must match the target project and its HEAD must exist in that repo. A different git root is not an acceptable isolation result; the fresh window is killed and no task meta is recorded on refusal.
-For tmux it creates each window as `fm-<id>`, disables automatic and application-driven renaming, restores and verifies that title, then targets every post-create operation by the immutable window ID rather than the mutable title. For Herdr it creates a `fm-<id>` tab in the home workspace and targets the recorded `session:pane` endpoint.
+For tmux it creates each window as `fm-<id>`, disables automatic and application-driven renaming, restores and verifies that title, then targets every post-create operation by the immutable window ID rather than the mutable title. For Herdr it creates a readable `<kind> - <phrase> · <task-key>` tab in the home workspace, journals the full-id mapping before create, and targets the exact recorded `session:pane` endpoint.
 If tmux does not return a valid ID or cannot retain the canonical title, spawn cleans up a uniquely identified newly created window and aborts before it sends a pane command; Herdr likewise aborts if it cannot return a task tab/pane target.
 
 The firstmate repo has one extra exposure because it can dispatch crewmates to work on itself.
diff --git a/docs/configuration.md b/docs/configuration.md
index af3cb38f9ad..d2f1714ece9 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -30,6 +30,7 @@ Tmux remains the default. Herdr is an experimental opt-in backend for Herdr 0.7.
 Unknown values are rejected. Default tmux task metadata omits `backend=tmux`; readers treat a missing `backend=` as tmux for compatibility.
 The `config/backend` file is local to a firstmate home and is not inherited by secondmate homes.
 When Herdr resolves, bootstrap checks `herdr`, `jq`, and `treehouse`; otherwise Herdr is not a required tool. See [herdr-backend.md](herdr-backend.md) for the guarded `fm-herdr-lab.sh` workflow. Herdr remains a session provider only: treehouse still provides worktrees.
+Herdr adds presentation-label and exact-endpoint metadata while retaining `window=` compatibility. The field, routing, and recovery contract lives in [herdr-backend.md](herdr-backend.md#task-display-labels-presentation-split-from-identity); tmux workspace and window naming remain unchanged.
 
 ## Gate defaults (.no-mistakes.yaml)
 
diff --git a/docs/herdr-backend.md b/docs/herdr-backend.md
index 017253dbea2..2b82b0d9491 100644
--- a/docs/herdr-backend.md
+++ b/docs/herdr-backend.md
@@ -45,13 +45,55 @@ tab with one root pane:
 - secondmate home: workspace label `2ndmate-<secondmate-id>`
 - task target: `<session>:<pane-id>`, for example `default:w1:p2`
 
-Herdr task metadata records `backend=herdr`, `herdr_session=`,
-`herdr_workspace_id=`, `herdr_tab_id=`, and `herdr_pane_id=`. Tmux metadata
-continues to omit `backend=tmux`; a missing backend field still means tmux.
+Herdr task metadata records `backend=herdr`, `display_label=`, `task_key=`,
+`herdr_session=`, `herdr_workspace_id=`, `herdr_tab_id=`, and
+`herdr_pane_id=`. Tmux metadata continues to omit `backend=tmux`; a missing
+backend field still means tmux.
 
 The adapter avoids focusing new workspaces or tabs where Herdr supports that
 flag.
 
+### Task display labels: presentation split from identity
+
+`bin/fm-task-label-lib.sh` creates one Herdr-only label at spawn:
+
+```text
+<kind> - <phrase> · <task-key>
+```
+
+Ship maps to `Crew`, scout maps to `Scout`, and the persistent secondmate agent
+maps to `2nd`. The phrase is 1-28 characters from explicit `--display-title`,
+then `data/<id>/display-title`, then the structured backlog title, then a
+semantic task-id fallback. It permits only ASCII letters, digits, spaces, `.`,
+`+`, `_`, and `-`; control, ANSI, newline, tab, and bidi input is refused. The
+whole label is at most 50 characters and is set once, never renamed for a
+phase or status change.
+
+The key reuses a stable 4-6 character alphanumeric id tail when it contains
+both letters and digits. Otherwise it uses the first six lowercase SHA-256
+characters of the full task id. A collision found in metadata, pre-create
+journals, or live workspace labels extends it deterministically to ten
+characters. The key helps people scan tabs but never authorizes routing,
+recovery, or cleanup.
+
+Before tab create, spawn atomically publishes the private
+`state/<id>.herdr-label` journal with the full `task_id=`, exact
+`display_label=`, `task_key=`, `herdr_home=`, `herdr_session=`, and
+`herdr_workspace_id=`. After the create response's exact tab and pane ids plus
+the label are atomically published in `state/<id>.meta`, the journal is removed.
+A crash or lost response therefore leaves the backend and workspace identity
+needed to inventory the right home, and a retry reuses the same label.
+
+Normal routing prefers `herdr_session=` plus `herdr_pane_id=` and keeps
+`herdr_tab_id=` for exact correlation. Recovery still recognizes legacy
+`fm-<id>` labels. For readable labels it maps only an exact `display_label=`
+match from metadata or the pre-create journal back to the full task id.
+Unmatched readable labels remain unknown orphans; there is no
+pretty-label-only or short-key-only recovery. Workspace identity remains
+`firstmate` or `2ndmate-<id>`, and tmux naming is unchanged.
+Journal-only selector recovery remains routed through Herdr even before final
+metadata exists.
+
 ### ID stability across a server restart
 
 Herdr restores workspace, tab, and pane ids and labels after a session or server
diff --git a/docs/operating-map.md b/docs/operating-map.md
index 3b53777718d..429bbcfecb3 100644
--- a/docs/operating-map.md
+++ b/docs/operating-map.md
@@ -45,7 +45,7 @@ Owner: `AGENTS.md` sections 6 and 7; `bin/fm-brief.sh`; `bin/fm-spawn.sh`.
 
 ## 6. Spawn
 
-`fm-spawn.sh` selects the runtime session-provider backend, then allocates the canonical `fm-<id>` tmux window or Herdr tab in the selected adapter, gets or validates an isolated worktree of the target project, writes the task meta record, launches the selected harness with the resolved model and effort when supported, and installs any harness-specific turn-end hooks. The backend selection and compatibility contract lives in [architecture.md](architecture.md#runtime-session-provider-backend); the detailed target-repository containment contract lives in [architecture.md](architecture.md#worktrees-not-branches-in-your-checkout).
+`fm-spawn.sh` selects the runtime session-provider backend, then allocates either the unchanged canonical `fm-<id>` tmux window or a one-time Herdr `<kind> - <phrase> · <task-key>` display tab, gets or validates an isolated worktree of the target project, writes the task meta record, launches the selected harness with the resolved model and effort when supported, and installs any harness-specific turn-end hooks. For Herdr, the readable tab label is presentation only; the full task id plus exact session, workspace, tab, and pane ids remain machine identity. The backend selection and compatibility contract lives in [architecture.md](architecture.md#runtime-session-provider-backend); the detailed target-repository containment contract lives in [architecture.md](architecture.md#worktrees-not-branches-in-your-checkout).
 It uses the tmux immutable window ID or recorded Herdr `session:pane` target for post-create operations; an unverified endpoint cleans up the uniquely identified new endpoint and aborts the spawn.
 Secondmate spawn uses the same direct-report machinery but points at an isolated firstmate home.
 
diff --git a/docs/scripts.md b/docs/scripts.md
index 27028b07a51..2ca69f64521 100644
--- a/docs/scripts.md
+++ b/docs/scripts.md
@@ -7,7 +7,7 @@ Each file also starts with a short header comment.
 | ------------------------ | ------------------------------------------------------------------------------------------------------------------- |
 | `fm-bootstrap.sh`        | Detect required toolchain and version problems, dispatch profile JSON errors or active-rule blocks, secondmate profile JSON errors, default backlog-backend status, primary-checkout `TANGLE:` problems, and actionable clone refresh outcomes; refresh project clones best-effort; locally sync live secondmate homes and propagate declared inheritable config; set up opt-in X mode; install tools only after consent |
 | `fm-fleet-sync.sh`       | Fetch clones, fast-forward safe default-branch states, self-heal clean detached ancestor drift, recover orphaned `packed-refs.lock` only when provably stale, report unsafe drift as `STUCK:`, safely prune branches whose remote is gone, and accept a project name or `projects/<name>` for a deterministic single-clone sync |
-| `fm-fleet-snapshot.sh`   | Print the read-only local `fm-fleet-snapshot.v1` JSON contract for backlog, task metadata, status events, and worktree facts |
+| `fm-fleet-snapshot.sh`   | Print the read-only local `fm-fleet-snapshot.v1` JSON contract for backlog, task metadata, status events, and worktree facts, or return one canonical structured backlog title with `--backlog-title <task-id>` |
 | `fm-bearings-snapshot.sh` | Project the fleet snapshot into a compact TOON/JSON operator view; local-only by default, with soft-failing live PR discovery only under `--include-prs` |
 | `fm-lint.sh`              | Run the pinned ShellCheck definition shared by CI and the no-mistakes gate |
 | `fm-install-shellcheck.sh` | Install and checksum CI's pinned Linux ShellCheck build |
@@ -31,6 +31,7 @@ Each file also starts with a short header comment.
 | `fm-no-mistakes-pr-target-guard.sh` | Fail closed before no-mistakes test/push/PR work if direct push resolution, the no-mistakes gate, or no-mistakes status would target `kunchenguid/firstmate` instead of `JTInventory/firstmate`; allow upstream-owner `origin` fetch only with controlled-fork proof |
 | `fm-run-behavior-tests.sh` | Run the local behavior-test gate; see [configuration.md](configuration.md#gate-defaults-no-mistakesyaml) for its execution contract and CI boundary |
 | `fm-backend.sh`         | Select and validate the runtime session-provider backend, honor `$TMUX`/`HERDR_ENV=1` auto-detection, resolve recorded or explicit task selectors, and dispatch endpoint operations to tmux or the experimental Herdr adapter; missing `backend=` metadata means `tmux` |
+| `fm-task-label-lib.sh`  | Derive, reserve, journal, and recover deterministic Herdr-only task display labels without changing tmux naming or full task identity |
 | `backends/tmux.sh`      | The verified tmux session-provider adapter used by the backend dispatcher; owns tmux window, pane, capture, send, and kill primitives |
 | `backends/herdr.sh`     | Experimental Herdr 0.7.x/protocol-14 session adapter; owns per-home workspace, tab/pane, capture, send, busy-state, kill, shared composer, and optional protocol-16 event-wait primitives while treehouse remains the worktree provider; see [herdr-backend.md](herdr-backend.md) |
 | `fm-herdr-lab.sh`       | Provision, operate, stop, and tear down only `fm-lab-*` Herdr sessions with a default-session fleet tripwire; refuses direct lifecycle/server operations and caller session overrides |
diff --git a/tests/fm-backend-herdr-prune-safety-e2e.test.sh b/tests/fm-backend-herdr-prune-safety-e2e.test.sh
index 408755e0348..c4a3bbf1e43 100755
--- a/tests/fm-backend-herdr-prune-safety-e2e.test.sh
+++ b/tests/fm-backend-herdr-prune-safety-e2e.test.sh
@@ -13,7 +13,7 @@
 # create_task path and asserts the live pane (and its live process) survive
 # untouched. Also exercises the normal happy path (a genuinely fresh
 # workspace's seeded default tab gets pruned, leaving exactly one clean
-# fm-<id> task tab), mirroring tests/fm-backend-herdr-smoke.test.sh's broader
+# readable task tab), mirroring tests/fm-backend-herdr-smoke.test.sh's broader
 # coverage but scoped tightly to this one safety property.
 #
 # Safety (tests/herdr-test-safety.sh): cleanup uses ONLY
@@ -115,7 +115,7 @@ fi
 [ -z "$SEEDED_TAB_ID" ] || fail "an ADOPTED workspace must report an EMPTY seeded default tab id (the created-vs-adopted gate), got '$SEEDED_TAB_ID' - this is exactly what would reproduce the 2026-07-02 self-kill"
 pass "fixed: container_ensure adopts the label-colliding startup workspace and reports NO seeded default tab (never a prune candidate)"
 
-TASK_IDS=$(fm_backend_herdr_create_task "$CONTAINER" fm-prunesafety-e2e "$LIVE_CWD" "$SEEDED_TAB_ID") \
+TASK_IDS=$(fm_backend_herdr_create_task "$CONTAINER" "Crew - Prune safety · ps01" "$LIVE_CWD" "$SEEDED_TAB_ID") \
   || fail "create_task failed"
 read -r NEW_TAB_ID NEW_PANE_ID <<EOF
 $TASK_IDS
@@ -144,7 +144,7 @@ fm_backend_herdr_kill "$SESSION:$NEW_PANE_ID"
 fm_backend_herdr_kill "$SESSION:$LIVE_PANE_ID"
 
 # --- 4. happy path still works: a genuinely fresh workspace gets its seeded -
-# default tab pruned, leaving exactly one clean fm-<id> task tab -------------
+# default tab pruned, leaving exactly one clean readable task tab ------------
 
 HAPPY_CWD="$SCRATCH/happy-project"
 mkdir -p "$HAPPY_CWD"
@@ -153,7 +153,7 @@ HAPPY_CONTAINER=${HAPPY_RAW%%$'\t'*}
 HAPPY_SEEDED=${HAPPY_RAW#*$'\t'}
 [ -n "$HAPPY_SEEDED" ] || fail "happy path: expected a genuinely fresh workspace with a non-empty seeded default tab id"
 
-HAPPY_TASK_IDS=$(fm_backend_herdr_create_task "$HAPPY_CONTAINER" fm-prunesafety-happy "$HAPPY_CWD" "$HAPPY_SEEDED") \
+HAPPY_TASK_IDS=$(fm_backend_herdr_create_task "$HAPPY_CONTAINER" "Crew - Prune happy · ph01" "$HAPPY_CWD" "$HAPPY_SEEDED") \
   || fail "happy-path create_task failed"
 read -r _HAPPY_TAB HAPPY_PANE <<EOF
 $HAPPY_TASK_IDS
@@ -166,7 +166,7 @@ HAPPY_COUNT=$(printf '%s' "$HAPPY_TABS" | jq -r '.result.tabs? // [] | length')
 [ "$HAPPY_COUNT" = 1 ] || fail "happy path: expected exactly 1 tab (seeded default pruned) after the first real task tab, got $HAPPY_COUNT: $HAPPY_TABS"
 printf '%s' "$HAPPY_TABS" | jq -e --arg t "$HAPPY_SEEDED" '.result.tabs[] | select(.tab_id == $t)' >/dev/null 2>&1 \
   && fail "happy path: the seeded default tab should have been pruned but is still present: $HAPPY_TABS"
-pass "happy path: a genuinely fresh workspace's seeded default tab is still pruned, leaving exactly one clean fm-<id> task tab"
+pass "happy path: a genuinely fresh workspace's seeded default tab is still pruned, leaving exactly one clean readable task tab"
 
 fm_backend_herdr_kill "$SESSION:$HAPPY_PANE"
 
diff --git a/tests/fm-backend-herdr-respawn-idem-e2e.test.sh b/tests/fm-backend-herdr-respawn-idem-e2e.test.sh
index 4c0f7b4989d..fa9ad5af453 100755
--- a/tests/fm-backend-herdr-respawn-idem-e2e.test.sh
+++ b/tests/fm-backend-herdr-respawn-idem-e2e.test.sh
@@ -6,7 +6,7 @@
 #
 # herdr persists its whole session layout (workspaces/tabs/panes) and
 # restores it after a server restart, including a reboot. Before this fix, a
-# restored fm-<id> task tab came back a husk - a dead pane, or a plain
+# restored readable task tab came back a husk - a dead pane, or a plain
 # agent-less shell in the saved cwd - and bin/backends/herdr.sh's
 # fm_backend_herdr_create_task refused to spawn into it unconditionally,
 # because a same-labeled tab already existed. Every fleet respawn after a
@@ -85,7 +85,7 @@ CONTAINER=${RAW%%$'\t'*}
 SEEDED_TAB_ID=${RAW#*$'\t'}
 WSID=${CONTAINER#*:}
 
-CREW_LABEL="fm-respawn-crew1"
+CREW_LABEL="Crew - Respawn crew · rc01"
 CREW_IDS=$(fm_backend_herdr_create_task "$CONTAINER" "$CREW_LABEL" "$PROJ_CWD" "$SEEDED_TAB_ID") \
   || fail "initial crewmate-shaped task creation failed"
 read -r CREW_TAB_ID CREW_PANE_ID <<EOF
@@ -95,7 +95,7 @@ if [ -z "$CREW_TAB_ID" ] || [ -z "$CREW_PANE_ID" ]; then
   fail "initial crewmate-shaped task did not return tab/pane ids"
 fi
 
-SM_LABEL="fm-respawn-sm1"
+SM_LABEL="2nd - Respawn secondmate · rs01"
 SM_IDS=$(fm_backend_herdr_create_task "$CONTAINER" "$SM_LABEL" "$PROJ_CWD") \
   || fail "initial secondmate-shaped task creation failed"
 read -r SM_TAB_ID SM_PANE_ID <<EOF
@@ -105,7 +105,7 @@ if [ -z "$SM_TAB_ID" ] || [ -z "$SM_PANE_ID" ]; then
   fail "initial secondmate-shaped task did not return tab/pane ids"
 fi
 
-pass "repro setup: two real fm-<id> task tabs exist (crewmate-shaped and secondmate-shaped), neither with a registered agent"
+pass "repro setup: two real readable task tabs exist (crewmate-shaped and secondmate-shaped), neither with a registered agent"
 
 # --- 2. a REAL herdr session restart - the actual root cause -----------------
 # `session stop` + fresh `herdr server` for the SAME named session: verified
diff --git a/tests/fm-backend-herdr.test.sh b/tests/fm-backend-herdr.test.sh
index 1683a2af29b..14a1c824c96 100755
--- a/tests/fm-backend-herdr.test.sh
+++ b/tests/fm-backend-herdr.test.sh
@@ -601,14 +601,182 @@ SH
 test_dispatch_and_meta_routing() {
   local state="$TMP_ROOT/dispatch-state" meta
   mkdir -p "$state"
-  fm_write_meta "$state/task.meta" 'window=default:w1:p2' 'backend=herdr'
+  fm_write_meta "$state/task.meta" 'window=stale:w0:p0' 'backend=herdr' \
+    'herdr_session=default' 'herdr_tab_id=w1:t2' 'herdr_pane_id=w1:p2' \
+    'display_label=Crew - Route task · a1b2' 'task_key=a1b2'
   . "$ROOT/bin/fm-backend.sh"
   fm_backend_validate herdr || fail "Herdr should be a known backend"
   [ "$(fm_backend_of_meta "$state/task.meta")" = herdr ] || fail "meta backend was not read"
-  [ "$(fm_backend_resolve_selector fm-task "$state")" = default:w1:p2 ] || fail "selector target changed"
+  fm_backend_pane_readable() {
+    [ "$1" = herdr ] && [ "$2" = default:w1:p2 ]
+  }
+  [ "$(fm_backend_resolve_selector task "$state")" = default:w1:p2 ] || fail "exact task-id selector did not prefer persisted Herdr ids"
+  [ "$(fm_backend_resolve_selector fm-task "$state")" = default:w1:p2 ] || fail "legacy selector target changed"
   meta=$(fm_backend_meta_for_window default:w1:p2 "$state")
   [ "$meta" = "$state/task.meta" ] || fail "window metadata lookup failed"
-  pass "backend dispatch accepts Herdr and preserves opaque session:pane targets"
+  pass "backend dispatch prefers exact Herdr session/pane ids and retains fm-<id> routing"
+}
+
+test_list_live_correlates_exact_persisted_labels_and_keeps_unknown_orphans() {
+  local home state out
+  home="$TMP_ROOT/list-live-display-home"
+  state="$home/state"
+  mkdir -p "$state"
+  cat > "$state/task-c1db.meta" <<'EOF'
+backend=herdr
+herdr_session=fmtest
+herdr_workspace_id=w1
+herdr_tab_id=w1:t1
+herdr_pane_id=w1:p1
+display_label=Scout - Old label · c1db
+EOF
+  cat > "$state/task-be28.herdr-label" <<'EOF'
+version=1
+task_id=task-be28
+display_label=Crew - UI Design · be28
+task_key=be28
+EOF
+  cat > "$state/task-a1b2c.herdr-label" <<'EOF'
+version=1
+task_id=task-a1b2c
+display_label=Crew - Five key · a1b2c
+task_key=a1b2c
+EOF
+  cat > "$state/task-a1b2c3.herdr-label" <<'EOF'
+version=1
+task_id=task-a1b2c3
+display_label=Scout - Six key · a1b2c3
+task_key=a1b2c3
+EOF
+  cat > "$state/task-a1b2c3d4e5.herdr-label" <<'EOF'
+version=1
+task_id=task-a1b2c3d4e5
+display_label=2nd - Extended key · a1b2c3d4e5
+task_key=a1b2c3d4e5
+EOF
+  out=$(FM_HOME="$home" FM_STATE_OVERRIDE="$state" bash -c '
+    . "$0/bin/backends/herdr.sh"
+    fm_backend_herdr_workspace_find() { printf w1; }
+    fm_backend_herdr_cli() {
+      printf "%s\n" "{\"result\":{\"tabs\":[{\"tab_id\":\"w1:t1\",\"label\":\"Scout - Herdr labels · c1db\"},{\"tab_id\":\"w1:t2\",\"label\":\"Crew - UI Design · be28\"},{\"tab_id\":\"w1:t3\",\"label\":\"Crew - Unknown orphan · dead\"},{\"tab_id\":\"w1:t4\",\"label\":\"fm-legacy-z9\"},{\"tab_id\":\"w1:t5\",\"label\":\"Crew - Five key · a1b2c\"},{\"tab_id\":\"w1:t6\",\"label\":\"Scout - Six key · a1b2c3\"},{\"tab_id\":\"w1:t7\",\"label\":\"2nd - Extended key · a1b2c3d4e5\"},{\"tab_id\":\"w1:t8\",\"label\":\"fm-victim\\tfm-victim\"},{\"tab_id\":\"w1:t9\",\"label\":\"junk\\nw1:t10\\tfm-victim\"},{\"tab_id\":\"w1:t11\",\"label\":\"fm-vic\\u0000tim\"}]}}"
+    }
+    fm_backend_herdr_pane_for_tab() {
+      case "$3" in
+        w1:t1) printf w1:p1 ;;
+        w1:t2) printf w1:p2 ;;
+        w1:t3) printf w1:p3 ;;
+        w1:t4) printf w1:p4 ;;
+        w1:t5) printf w1:p5 ;;
+        w1:t6) printf w1:p6 ;;
+        w1:t7) printf w1:p7 ;;
+        w1:t8) printf w1:p8 ;;
+        w1:t9) printf w1:p9 ;;
+        w1:t10) printf w1:p10 ;;
+        w1:t11) printf w1:p11 ;;
+      esac
+    }
+    fm_backend_herdr_list_live fmtest
+  ' "$ROOT")
+  assert_contains "$out" $'fmtest:w1:p1\tfm-task-c1db\tScout - Herdr labels · c1db' "persisted meta label was not correlated to its full task id"
+  assert_contains "$out" $'fmtest:w1:p2\tfm-task-be28\tCrew - UI Design · be28' "pre-create journal label was not correlated to its full task id"
+  assert_contains "$out" $'fmtest:w1:p3\tCrew - Unknown orphan · dead\tCrew - Unknown orphan · dead' "unmatched readable label was not surfaced as unknown"
+  assert_contains "$out" $'fmtest:w1:p4\tfm-legacy-z9\tfm-legacy-z9' "legacy fm-<id> discovery was lost"
+  assert_contains "$out" $'fmtest:w1:p5\tfm-task-a1b2c' "five-character key was not recovered"
+  assert_contains "$out" $'fmtest:w1:p6\tfm-task-a1b2c3' "six-character key was not recovered"
+  assert_contains "$out" $'fmtest:w1:p7\tfm-task-a1b2c3d4e5' "extended collision key was not recovered"
+  assert_not_contains "$out" $'fmtest:w1:p8\t' "tab-bearing legacy label entered recovery inventory"
+  assert_not_contains "$out" $'fmtest:w1:p10\tfm-victim\tfm-victim' "newline-bearing label forged a recovery inventory row"
+  assert_not_contains "$out" $'fmtest:w1:p11\t' "NUL-bearing legacy label entered recovery inventory"
+  pass "Herdr list-live prefers exact machine ids, then labels, and keeps legacy discovery"
+}
+
+test_list_live_propagates_inventory_and_pane_failures() {
+  local home state status out
+  home="$TMP_ROOT/list-live-failures-home"
+  state="$home/state"
+  mkdir -p "$state"
+  out=$(FM_HOME="$home" FM_STATE_OVERRIDE="$state" bash -c '
+    . "$0/bin/backends/herdr.sh"
+    fm_backend_herdr_workspace_find() { printf w1; }
+    fm_backend_herdr_cli() { printf "%s\n" "{\"result\":{\"tabs\":[]}}"; }
+    fm_backend_herdr_list_live fmtest
+  ' "$ROOT") || fail "empty tab inventory returned nonzero"
+  [ -z "$out" ] || fail "empty tab inventory produced live rows"
+  status=0
+  FM_HOME="$home" FM_STATE_OVERRIDE="$state" bash -c '
+    . "$0/bin/backends/herdr.sh"
+    fm_backend_herdr_workspace_find() { return 1; }
+    fm_backend_herdr_list_live fmtest
+  ' "$ROOT" >/dev/null 2>&1 || status=$?
+  [ "$status" -ne 0 ] || fail "workspace inventory failure became an empty live inventory"
+  status=0
+  FM_HOME="$home" FM_STATE_OVERRIDE="$state" bash -c '
+    . "$0/bin/backends/herdr.sh"
+    fm_backend_herdr_workspace_find() { printf w1; }
+    fm_backend_herdr_cli() { printf "%s\n" "{\"result\":{\"tabs\":\"invalid\"}}"; }
+    fm_backend_herdr_list_live fmtest
+  ' "$ROOT" >/dev/null 2>&1 || status=$?
+  [ "$status" -ne 0 ] || fail "malformed tab JSON became an empty live inventory"
+  status=0
+  FM_HOME="$home" FM_STATE_OVERRIDE="$state" bash -c '
+    . "$0/bin/backends/herdr.sh"
+    fm_backend_herdr_workspace_find() { printf w1; }
+    fm_backend_herdr_cli() { printf "%s\n" "{\"result\":{\"tabs\":[{\"tab_id\":\"w1:t1\",\"label\":\"fm-task\"}]}}"; }
+    fm_backend_herdr_pane_for_tab() { return 1; }
+    fm_backend_herdr_list_live fmtest
+  ' "$ROOT" >/dev/null 2>&1 || status=$?
+  [ "$status" -ne 0 ] || fail "pane lookup failure skipped a live tab"
+  pass "Herdr list-live handles empty inventories and propagates lookup failures"
+}
+
+test_labeled_create_holds_one_lock_across_reservation_and_create() {
+  local home_one home_two state acquired release out_one out_two key_one key_two
+  home_one="$TMP_ROOT/labeled-create-lock-home-one"
+  home_two="$TMP_ROOT/labeled-create-lock-home-two"
+  state="$TMP_ROOT/labeled-create-shared-state"
+  acquired="$state/first-acquired"
+  release="$state/release-first"
+  mkdir -p "$home_one" "$home_two" "$state"
+  FM_HOME="$home_one" FM_STATE_OVERRIDE="$state" FM_TEST_STATE="$state" FM_TEST_ACQUIRED="$acquired" FM_TEST_RELEASE="$release" bash -c '
+    . "$0/bin/backends/herdr.sh"
+    fm_backend_herdr_workspace_tab_labels() { :; }
+    fm_backend_herdr_create_task_locked() {
+      [ -L "$FM_TEST_STATE/.fm-herdr-label.lock" ] || exit 1
+      [ -L "$FM_HOME/.fm-herdr-workspace.lock" ] || exit 1
+      : > "$FM_TEST_ACQUIRED"
+      while [ ! -e "$FM_TEST_RELEASE" ]; do sleep 0.01; done
+      printf "tab-one pane-one"
+    }
+    fm_backend_herdr_create_labeled_task fmtest:w1 "$1" alpha-c1db scout "Shared phrase" "" /tmp
+  ' "$ROOT" "$state" > "$home_one/one.out" &
+  local pid_one=$!
+  for _ in $(seq 1 100); do
+    [ ! -e "$acquired" ] || break
+    sleep 0.01
+  done
+  [ -e "$acquired" ] || fail "first labeled create never reached the acquisition barrier"
+  FM_HOME="$home_two" FM_STATE_OVERRIDE="$state" FM_TEST_STATE="$state" bash -c '
+    . "$0/bin/backends/herdr.sh"
+    fm_backend_herdr_workspace_tab_labels() { :; }
+    fm_backend_herdr_create_task_locked() {
+      [ -L "$FM_TEST_STATE/.fm-herdr-label.lock" ] || exit 1
+      [ -L "$FM_HOME/.fm-herdr-workspace.lock" ] || exit 1
+      printf "tab-two pane-two"
+    }
+    fm_backend_herdr_create_labeled_task fmtest:w1 "$1" beta-c1db scout "Shared phrase" "" /tmp
+  ' "$ROOT" "$state" > "$home_two/two.out" &
+  local pid_two=$!
+  : > "$release"
+  wait "$pid_one" || fail "first labeled create failed"
+  wait "$pid_two" || fail "second labeled create failed"
+  out_one=$(cat "$home_one/one.out")
+  out_two=$(cat "$home_two/two.out")
+  key_one=$(printf '%s' "$out_one" | cut -f2)
+  key_two=$(printf '%s' "$out_two" | cut -f2)
+  [ "$key_one" = c1db ] || fail "first reservation did not keep the short key: '$out_one'"
+  [ "${#key_two}" -eq 10 ] || fail "second reservation did not extend under collision: '$out_two'"
+  [ "$key_one" != "$key_two" ] || fail "concurrent creates reserved the same task key"
+  pass "Herdr labeled create serializes collision scan, journal reservation, and creation"
 }
 
 test_selection_and_autodetect
@@ -630,3 +798,6 @@ test_seed_prune_is_exact_and_fail_closed
 test_event_capability_uses_named_session
 test_eventwait_returns_fresh_blocked_transition
 test_dispatch_and_meta_routing
+test_list_live_correlates_exact_persisted_labels_and_keeps_unknown_orphans
+test_list_live_propagates_inventory_and_pane_failures
+test_labeled_create_holds_one_lock_across_reservation_and_create
diff --git a/tests/fm-backend.test.sh b/tests/fm-backend.test.sh
index c0fec6c715c..b3c7c59fc94 100755
--- a/tests/fm-backend.test.sh
+++ b/tests/fm-backend.test.sh
@@ -110,11 +110,17 @@ test_selector_and_dispatch() {
   log="$dir/tmux.log"; : > "$log"
   state="$dir/state"
   fm_write_meta "$state/demo.meta" "window=firstmate:fm-demo"
+  fm_write_meta "$state/foo.meta" "window=firstmate:fm-foo"
+  fm_write_meta "$state/fm-foo.meta" "window=firstmate:fm-fm-foo"
 
   [ "$(fm_backend_resolve_selector sess:win "$state")" = sess:win ] \
     || fail "explicit session:window selector changed"
   [ "$(fm_backend_resolve_selector fm-demo "$state")" = firstmate:fm-demo ] \
     || fail "fm-<id> selector did not use metadata"
+  [ "$(fm_backend_resolve_selector fm-foo "$state")" = firstmate:fm-foo ] \
+    || fail "fm-<id> selector did not retain its stripped-id meaning"
+  [ "$(fm_backend_resolve_selector fm-fm-foo "$state")" = firstmate:fm-fm-foo ] \
+    || fail "fm-prefixed task id was not addressable through its canonical selector"
   out=$(PATH="$fakebin:$PATH" FM_TMUX_LOG="$log" fm_backend_resolve_selector adhoc "$state")
   [ "$out" = firstmate:adhoc ] || fail "bare selector did not use fake tmux inventory"
 
@@ -132,6 +138,80 @@ test_selector_and_dispatch() {
   pass "selector resolution and capture/key/readability/kill dispatch use tmux adapter"
 }
 
+test_selector_recovers_precreate_herdr_journal() {
+  local state out resolution
+  state="$TMP_ROOT/herdr-recovery/state"
+  mkdir -p "$state"
+  fm_write_meta "$state/exact-c1db.meta" "window=stale:w0:p0" "backend=herdr" \
+    "herdr_session=fmtest" "herdr_workspace_id=w-second" \
+    "herdr_tab_id=w1:t1" "herdr_pane_id=w1:p1" \
+    "display_label=Crew - Exact recovery · c1db" "task_key=c1db" \
+    "home=$TMP_ROOT/secondmate-home"
+  fm_write_meta "$state/stale-d2e3.meta" "window=stale:w0:p0" "backend=herdr" \
+    "herdr_session=fmtest" "herdr_workspace_id=w-second" \
+    "herdr_tab_id=w-old:t1" "herdr_pane_id=w-old:p1" \
+    "display_label=Crew - Stale recovery · d2e3" "task_key=d2e3" \
+    "home=$TMP_ROOT/secondmate-home"
+  fm_write_meta "$state/legacy-e3f4.meta" "window=stale:w0:p0" "backend=herdr" \
+    "herdr_session=fmtest" "herdr_workspace_id=w-second" \
+    "herdr_tab_id=w-gone:t1" "herdr_pane_id=w-gone:p1" \
+    "display_label=Crew - Missing display · e3f4" "task_key=e3f4" \
+    "home=$TMP_ROOT/secondmate-home"
+  printf 'version=1\ntask_id=crash-c1db\ndisplay_label=Crew - Crash recovery · c1db\ntask_key=c1db\nherdr_home=%s\nherdr_session=fmtest\nherdr_workspace_id=w-second\n' \
+    "$TMP_ROOT/secondmate-home" \
+    > "$state/crash-c1db.herdr-label"
+  fm_backend_source herdr || fail "Herdr backend could not be loaded"
+  fm_backend_pane_readable() {
+    [ "$1" = herdr ] && [ "$2" = fmtest:w1:p1 ]
+  }
+  fm_backend_list_live() {
+    [ "$1" = herdr ] || return 1
+    [ "$FM_STATE_OVERRIDE" = "$state" ] || return 1
+    case "${3:-}" in
+      w-second)
+        [ "$2" = fmtest ] || return 1
+        [ "$FM_HOME" = "$TMP_ROOT/secondmate-home" ] || return 1
+        printf 'fmtest:w1:p2\tfm-stale-d2e3\tCrew - Stale recovery · d2e3\n'
+        printf 'fmtest:w1:p5\tfm-stale-d2e3\tfm-stale-d2e3\n'
+        printf 'fmtest:w1:p3\tfm-crash-c1db\tCrew - Crash recovery · c1db\n'
+        printf 'fmtest:w1:p7\tfm-crash-c1db\tfm-crash-c1db\n'
+        printf 'fmtest:w1:p6\tfm-legacy-e3f4\tfm-legacy-e3f4\n'
+        ;;
+      '')
+        printf 'fmtest:w1:p4\tfm-legacy-z9\tfm-legacy-z9\n'
+        ;;
+      *) return 1 ;;
+    esac
+  }
+  resolution=$(fm_backend_resolve_selector_with_backend exact-c1db "$state") \
+    || fail "readable exact Herdr ids did not resolve"
+  [ "$resolution" = $'herdr\tfmtest:w1:p1' ] \
+    || fail "readable exact Herdr ids were not preferred: '$resolution'"
+  resolution=$(fm_backend_resolve_selector_with_backend stale-d2e3 "$state") \
+    || fail "stale exact Herdr ids did not fall back through live inventory"
+  [ "$resolution" = $'herdr\tfmtest:w1:p2' ] \
+    || fail "stale exact Herdr ids did not recover by display label: '$resolution'"
+  resolution=$(fm_backend_resolve_selector_with_backend legacy-e3f4 "$state") \
+    || fail "stale Herdr ids did not use final legacy fallback"
+  [ "$resolution" = $'herdr\tfmtest:w1:p6' ] \
+    || fail "final legacy Herdr fallback resolved incorrectly: '$resolution'"
+  out=$(HERDR_SESSION=fmtest fm_backend_resolve_selector crash-c1db "$state") \
+    || fail "bare task id did not recover through the Herdr journal"
+  [ "$out" = fmtest:w1:p3 ] || fail "recovered Herdr target mismatch: '$out'"
+  out=$(HERDR_SESSION=fmtest fm_backend_resolve_selector fm-crash-c1db "$state") \
+    || fail "legacy fm-<id> selector did not recover through the Herdr journal"
+  [ "$out" = fmtest:w1:p3 ] || fail "legacy recovered Herdr target mismatch: '$out'"
+  resolution=$(HERDR_SESSION=fmtest fm_backend_resolve_selector_with_backend fm-crash-c1db "$state") \
+    || fail "journal-only selector did not return backend-aware recovery"
+  [ "$resolution" = $'herdr\tfmtest:w1:p3' ] || fail "journal-only selector lost Herdr backend routing: '$resolution'"
+  resolution=$(FM_BACKEND=herdr HERDR_SESSION=fmtest \
+    fm_backend_resolve_selector_with_backend fm-legacy-z9 "$state") \
+    || fail "legacy-only Herdr tab was not discovered through live inventory"
+  [ "$resolution" = $'herdr\tfmtest:w1:p4' ] \
+    || fail "legacy-only Herdr tab resolved incorrectly: '$resolution'"
+  pass "selector recovery retains Herdr routing and persisted workspace identity"
+}
+
 test_backend_failures_propagate() {
   local dir fakebin log out
   dir="$TMP_ROOT/failures"; mkdir -p "$dir"
@@ -239,5 +319,6 @@ SH
 test_selection_and_metadata
 test_spawn_rejects_unknown_selection
 test_selector_and_dispatch
+test_selector_recovers_precreate_herdr_journal
 test_backend_failures_propagate
 test_teardown_preserves_state_on_kill_failure
diff --git a/tests/fm-brief-display-title.test.sh b/tests/fm-brief-display-title.test.sh
new file mode 100755
index 00000000000..983809418bb
--- /dev/null
+++ b/tests/fm-brief-display-title.test.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -u
+
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+TMP_ROOT=$(fm_test_tmproot fm-brief-display-title)
+
+test_failed_brief_does_not_publish_display_title() {
+  local home status=0
+  home="$TMP_ROOT/failed"
+  mkdir -p "$home/data" "$home/state"
+  FM_HOME="$home" "$ROOT/bin/fm-brief.sh" invalid-shape --display-title "Stale title" \
+    >/dev/null 2>&1 || status=$?
+  [ "$status" -ne 0 ] || fail "invalid brief shape unexpectedly succeeded"
+  assert_absent "$home/data/invalid-shape/display-title" \
+    "failed brief left durable display-title intake"
+  pass "fm-brief publishes display title only after task-shape validation"
+}
+
+test_valid_brief_publishes_display_title() {
+  local home
+  home="$TMP_ROOT/valid"
+  mkdir -p "$home/data" "$home/state"
+  FM_HOME="$home" "$ROOT/bin/fm-brief.sh" valid alpha --display-title "Readable title" \
+    >/dev/null 2>&1 || fail "valid brief failed"
+  assert_grep "Readable title" "$home/data/valid/display-title" \
+    "valid brief did not publish display title"
+  pass "fm-brief publishes validated display title with the brief"
+}
+
+test_failed_brief_does_not_publish_display_title
+test_valid_brief_publishes_display_title
+
+echo "# all fm-brief display-title tests passed"
diff --git a/tests/fm-send-herdr-secondmate-marker.test.sh b/tests/fm-send-herdr-secondmate-marker.test.sh
index 67a3e85681e..2c4395538f0 100644
--- a/tests/fm-send-herdr-secondmate-marker.test.sh
+++ b/tests/fm-send-herdr-secondmate-marker.test.sh
@@ -24,11 +24,17 @@ case "${1:-}" in
   pane)
     case "${2:-}" in
       get) printf '%s\n' '{"result":{"pane":{"pane_id":"w1:p2"}}}' ;;
+      list) printf '%s\n' '{"result":{"panes":[{"pane_id":"w1:p2","tab_id":"w1:t2"}]}}' ;;
       send-text) printf '%s' "${4:-}" > "${FM_HERDR_SEND_LOG:?}" ;;
       send-keys) : ;;
       read) printf '>\n' ;;
     esac
     ;;
+  tab)
+    case "${2:-}" in
+      list) printf '{"result":{"tabs":[{"tab_id":"w1:t2","label":"%s"}]}}\n' "${FM_HERDR_RECOVERY_LABEL:-fm-domain}" ;;
+    esac
+    ;;
 esac
 exit 0
 SH
@@ -51,3 +57,23 @@ expected="${FM_FROMFIRST_MARK}route through Herdr"
 [ "$(cat "$log")" = "$expected" ] \
   || fail "Herdr secondmate send lost or changed the from-firstmate marker"
 pass "fm-send preserves the secondmate marker through the Herdr backend"
+
+recovery_home="$dir/recovery-home"
+mkdir -p "$recovery_home/state"
+cat > "$recovery_home/state/crash-a1b2c3d4e5.herdr-label" <<EOF
+version=1
+task_id=crash-a1b2c3d4e5
+display_label=Crew - Crash recovery · a1b2c3d4e5
+task_key=a1b2c3d4e5
+herdr_home=$recovery_home
+herdr_session=fmtest
+herdr_workspace_id=w1
+EOF
+PATH="$fakebin:$PATH" FM_HOME="$recovery_home" FM_ROOT_OVERRIDE="$recovery_home" \
+  FM_SEND_SETTLE=0 FM_SEND_SLEEP=0 FM_HERDR_SEND_LOG="$log" \
+  FM_HERDR_RECOVERY_LABEL="Crew - Crash recovery · a1b2c3d4e5" \
+  "$SEND" fm-crash-a1b2c3d4e5 "recover through Herdr" >/dev/null 2>&1 \
+  || fail "journal-only Herdr send failed"
+[ "$(cat "$log")" = "recover through Herdr" ] \
+  || fail "journal-only send did not stay on the Herdr backend"
+pass "fm-send keeps journal-only recovery on the Herdr backend"
diff --git a/tests/fm-spawn-herdr-label.test.sh b/tests/fm-spawn-herdr-label.test.sh
new file mode 100755
index 00000000000..d957a7ca6a1
--- /dev/null
+++ b/tests/fm-spawn-herdr-label.test.sh
@@ -0,0 +1,148 @@
+#!/usr/bin/env bash
+# Spawn behavior tests for Herdr display labels, metadata, and crash journal.
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+SPAWN="$ROOT/bin/fm-spawn.sh"
+TMP_ROOT=$(fm_test_tmproot fm-spawn-herdr-label)
+
+make_herdr_spawn_fake() {
+  local dir=$1 fakebin
+  fakebin=$(fm_fakebin "$dir")
+  cat > "$fakebin/herdr" <<'SH'
+#!/usr/bin/env bash
+set -u
+state=${FM_FAKE_HERDR_STATE:?}
+log=${FM_FAKE_HERDR_LOG:?}
+printf '%s\n' "$*" >> "$log"
+cmd=${1:-}; sub=${2:-}
+case "$cmd $sub" in
+  "status --json")
+    printf '{"client":{"version":"0.7.1","protocol":14},"server":{"running":true}}\n'
+    ;;
+  "workspace list")
+    if [ -f "$state/workspace" ]; then
+      printf '{"result":{"workspaces":[{"workspace_id":"w1","label":"firstmate"}]}}\n'
+    else
+      printf '{"result":{"workspaces":[]}}\n'
+    fi
+    ;;
+  "workspace create")
+    touch "$state/workspace"
+    printf '{"result":{"workspace":{"workspace_id":"w1","label":"firstmate"},"root_pane":{"pane_id":"w1:p0"}}}\n'
+    ;;
+  "tab list")
+    if [ -f "$state/task-label" ]; then
+      label=$(cat "$state/task-label")
+      printf '{"result":{"tabs":[{"tab_id":"w1:t1","label":"%s","workspace_id":"w1"}]}}\n' "$label"
+    else
+      printf '{"result":{"tabs":[]}}\n'
+    fi
+    ;;
+  "tab create")
+    label=
+    args=("$@")
+    for ((i=0; i<${#args[@]}; i++)); do
+      [ "${args[$i]}" != --label ] || label=${args[$((i+1))]:-}
+    done
+    if [ -f "${FM_FAKE_LABEL_JOURNAL:?}" ]; then
+      cp "$FM_FAKE_LABEL_JOURNAL" "$state/journal-at-create"
+    fi
+    printf '%s\n' "$label" > "$state/task-label"
+    if [ "${FM_FAKE_FAIL_AFTER_CREATE:-0}" = 1 ]; then
+      exit 1
+    fi
+    printf '{"result":{"tab":{"tab_id":"w1:t1"},"root_pane":{"pane_id":"w1:p1"}}}\n'
+    ;;
+  "pane get")
+    printf '{"result":{"pane":{"pane_id":"w1:p1","foreground_cwd":"%s"}}}\n' "${FM_FAKE_WORKTREE:?}"
+    ;;
+  "pane run"|"pane send-text"|"pane send-keys")
+    ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/herdr"
+  printf '%s\n' "$fakebin"
+}
+
+make_case() {
+  local name=$1 id=$2 case_dir home proj wt fakebin
+  case_dir="$TMP_ROOT/$name"
+  home="$case_dir/home"
+  proj="$case_dir/project"
+  wt="$case_dir/wt"
+  mkdir -p "$home/data/$id" "$home/state" "$home/config" "$home/projects" "$case_dir/herdr-state"
+  printf 'codex\n' > "$home/config/crew-harness"
+  printf 'brief\n' > "$home/data/$id/brief.md"
+  touch "$home/state/.last-watcher-beat"
+  fm_git_worktree "$proj" "$wt" "wt-$name"
+  fakebin=$(make_herdr_spawn_fake "$case_dir/fake")
+  printf '%s|%s|%s|%s|%s\n' "$case_dir" "$home" "$proj" "$wt" "$fakebin"
+}
+
+read_case() {
+  IFS='|' read -r CASE_DIR HOME_DIR PROJ_DIR WT_DIR FAKEBIN_DIR <<EOF
+$1
+EOF
+}
+
+run_spawn() {
+  local id=$1
+  shift
+  FM_ROOT_OVERRIDE='' FM_HOME="$HOME_DIR" \
+    FM_STATE_OVERRIDE="$HOME_DIR/state" FM_DATA_OVERRIDE="$HOME_DIR/data" \
+    FM_PROJECTS_OVERRIDE="$HOME_DIR/projects" FM_CONFIG_OVERRIDE="$HOME_DIR/config" \
+    FM_SPAWN_NO_GUARD=1 HERDR_SESSION=fmtest \
+    FM_FAKE_HERDR_STATE="$CASE_DIR/herdr-state" FM_FAKE_HERDR_LOG="$CASE_DIR/herdr.log" \
+    FM_FAKE_LABEL_JOURNAL="$HOME_DIR/state/$id.herdr-label" FM_FAKE_WORKTREE="$WT_DIR" \
+    PATH="$FAKEBIN_DIR:$PATH" \
+    "$SPAWN" "$id" "$PROJ_DIR" --backend herdr "$@" 2>&1
+}
+
+test_spawn_publishes_journal_before_create_then_atomic_meta() {
+  local rec id out status meta
+  id=herdr-label-c1db
+  rec=$(make_case success "$id")
+  read_case "$rec"
+  out=$(run_spawn "$id" --scout --display-title "Herdr labels")
+  status=$?
+  expect_code 0 "$status" "Herdr display-label spawn should succeed (output: $out)"
+  meta="$HOME_DIR/state/$id.meta"
+  assert_grep "display_label=Scout - Herdr labels · c1db" "$meta" "meta missing persisted display label"
+  assert_grep "task_key=c1db" "$meta" "meta missing task key"
+  assert_grep "herdr_tab_id=w1:t1" "$meta" "meta missing response-derived tab id"
+  assert_grep "herdr_pane_id=w1:p1" "$meta" "meta missing response-derived pane id"
+  assert_grep "herdr_home=$HOME_DIR" "$CASE_DIR/herdr-state/journal-at-create" "label journal missed the Herdr home before tab create"
+  assert_grep "herdr_session=fmtest" "$CASE_DIR/herdr-state/journal-at-create" "label journal missed the Herdr session before tab create"
+  assert_grep "herdr_workspace_id=w1" "$CASE_DIR/herdr-state/journal-at-create" "label journal missed the Herdr workspace before tab create"
+  assert_absent "$HOME_DIR/state/$id.herdr-label" "label journal should retire only after final metadata publication"
+  assert_grep "--label Scout - Herdr labels · c1db --no-focus" "$CASE_DIR/herdr.log" "Herdr tab did not use the display label"
+  pass "fm-spawn Herdr: journal precedes create; final metadata persists label, key, and exact ids"
+}
+
+test_lost_create_response_keeps_recovery_journal() {
+  local rec id out status journal
+  id=herdr-crash-be28
+  rec=$(make_case crash "$id")
+  read_case "$rec"
+  set +e
+  out=$(FM_FAKE_FAIL_AFTER_CREATE=1 run_spawn "$id" --display-title "UI Design")
+  status=$?
+  set -e
+  [ "$status" -ne 0 ] || fail "simulated create-response loss should fail spawn"
+  journal="$HOME_DIR/state/$id.herdr-label"
+  assert_present "$journal" "pre-create journal was lost after create-response failure"
+  assert_grep "display_label=Crew - UI Design · be28" "$journal" "recovery journal lost exact created label"
+  assert_grep "herdr_home=$HOME_DIR" "$journal" "recovery journal lost the Herdr home"
+  assert_grep "herdr_workspace_id=w1" "$journal" "recovery journal lost the Herdr workspace"
+  assert_absent "$HOME_DIR/state/$id.meta" "failed spawn must not publish final metadata"
+  pass "fm-spawn Herdr: a create/final-meta crash gap remains exactly correlated by the journal"
+}
+
+test_spawn_publishes_journal_before_create_then_atomic_meta
+test_lost_create_response_keeps_recovery_journal
+
+echo "# all fm-spawn-herdr-label tests passed"
diff --git a/tests/fm-task-label-lib.test.sh b/tests/fm-task-label-lib.test.sh
new file mode 100755
index 00000000000..ae7c62117ee
--- /dev/null
+++ b/tests/fm-task-label-lib.test.sh
@@ -0,0 +1,185 @@
+#!/usr/bin/env bash
+# Unit tests for deterministic Herdr task display labels.
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+LIB="$ROOT/bin/fm-task-label-lib.sh"
+TMP_ROOT=$(fm_test_tmproot fm-task-label-lib)
+
+test_kind_mapping() {
+  local out
+  out=$(bash -c '. "$1"; printf "%s|%s|%s|%s" "$(fm_task_label_kind ship)" "$(fm_task_label_kind crew)" "$(fm_task_label_kind scout)" "$(fm_task_label_kind secondmate)"' _ "$LIB")
+  [ "$out" = "Crew|Crew|Scout|2nd" ] || fail "kind mapping mismatch: $out"
+  pass "task labels: ship/crew, scout, and secondmate map to Crew, Scout, and 2nd"
+}
+
+test_phrase_sanitization_and_truncation() {
+  local out
+  out=$(bash -c '. "$1"; fm_task_label_sanitize_phrase "  UI@@  Design/// + polish -  "' _ "$LIB")
+  [ "$out" = "UI Design + polish" ] || fail "phrase sanitization mismatch: '$out'"
+  out=$(bash -c '. "$1"; fm_task_label_sanitize_phrase "Readable operator dashboard wording"' _ "$LIB")
+  [ "$out" = "Readable operator dashboard" ] || fail "word-boundary truncation mismatch: '$out'"
+  [ "${#out}" -le 28 ] || fail "sanitized phrase exceeds 28 characters: '$out'"
+  pass "task labels: printable punctuation is sanitized and long phrases truncate at a word boundary"
+}
+
+test_control_and_bidi_input_refused() {
+  local status
+  bash -c '. "$1"; fm_task_label_sanitize_phrase "$2"' _ "$LIB" $'unsafe\nmetadata' >/dev/null 2>&1
+  status=$?
+  [ "$status" -ne 0 ] || fail "newline-bearing title must be refused"
+  bash -c '. "$1"; fm_task_label_sanitize_phrase "$2"' _ "$LIB" $'unsafe\e[31mred' >/dev/null 2>&1
+  status=$?
+  [ "$status" -ne 0 ] || fail "ANSI/control-bearing title must be refused"
+  bash -c '. "$1"; fm_task_label_sanitize_phrase "$2"' _ "$LIB" $'safe\u202Etxt' >/dev/null 2>&1
+  status=$?
+  [ "$status" -ne 0 ] || fail "bidi-control-bearing title must be refused"
+  pass "task labels: control, ANSI, newline, and bidi input is refused"
+}
+
+test_task_keys_and_semantic_fallback() {
+  local out expected
+  out=$(bash -c '. "$1"; fm_task_label_base_key herdr-tab-labels-c1db' _ "$LIB")
+  [ "$out" = c1db ] || fail "random-looking suffix should be reused, got '$out'"
+  expected=3a14b9
+  out=$(bash -c '. "$1"; fm_task_label_base_key opaque-task-name' _ "$LIB")
+  [ "$out" = "$expected" ] || fail "hash-derived key mismatch: '$out' != '$expected'"
+  out=$(bash -c '. "$1"; fm_task_label_semantic_phrase herdr-tab-labels-ship-c1db' _ "$LIB")
+  [ "$out" = "Herdr tab labels" ] || fail "semantic fallback mismatch: '$out'"
+  pass "task labels: stable suffix/hash keys and semantic task-id fallback"
+}
+
+test_collision_extends_key_and_journal_reuses_label() {
+  local state out label key
+  state="$TMP_ROOT/collision/state"
+  mkdir -p "$state"
+  cat > "$state/other.meta" <<'EOF'
+display_label=Crew - UI Design · c1db
+task_key=c1db
+EOF
+  out=$(bash -c '. "$1"; fm_task_label_prepare "$2" "$3" scout "Herdr labels" ""' _ "$LIB" "$state" herdr-tab-labels-c1db)
+  label=${out%%$'\t'*}
+  key=${out#*$'\t'}
+  [ "${#key}" -eq 10 ] || fail "collision should extend task key to 10 chars, got '$key'"
+  [ "$label" = "Scout - Herdr labels · $key" ] || fail "extended label mismatch: '$label'"
+  assert_grep "task_id=herdr-tab-labels-c1db" "$state/herdr-tab-labels-c1db.herdr-label" "journal missing task id"
+  assert_grep "display_label=$label" "$state/herdr-tab-labels-c1db.herdr-label" "journal missing display label"
+  out=$(bash -c '. "$1"; fm_task_label_prepare "$2" "$3" scout "Changed title" ""' _ "$LIB" "$state" herdr-tab-labels-c1db)
+  [ "$out" = "$label"$'\t'"$key" ] || fail "same task did not reuse its journaled label exactly"
+  pass "task labels: collisions extend deterministically and the same task reuses its journal"
+}
+
+test_empty_title_falls_back_and_label_is_bounded() {
+  local state out label key
+  state="$TMP_ROOT/fallback/state"
+  mkdir -p "$state"
+  out=$(bash -c '. "$1"; fm_task_label_prepare "$2" "$3" ship "@:/=" ""' _ "$LIB" "$state" 1234)
+  label=${out%%$'\t'*}
+  key=${out#*$'\t'}
+  [ "$label" = "Crew - Task $key · $key" ] || fail "opaque fallback mismatch: '$label'"
+  [ "${#label}" -le 50 ] || fail "full label exceeds 50 characters: '$label'"
+  pass "task labels: fully rejected phrases use Task <key> and full labels stay within 50 chars"
+}
+
+test_backlog_title_precedes_semantic_id_fallback() {
+  local home state out
+  home="$TMP_ROOT/backlog/home"
+  state="$home/state"
+  mkdir -p "$home/data" "$state"
+  cat > "$home/data/backlog.md" <<'EOF'
+## In flight
+- [ ] opaque-work-c9d2 - Operator-friendly Herdr naming (repo: firstmate, kind: ship)
+- [ ] quick-fix-a1b2 - Fix UI (repo: demo, kind: ship)
+- **bold-work-b2c3** - Bold work (repo: demo, since 2026-07-24)
+- [ ] blocked-work-c3d4 - Blocked work (repo: demo) blocked-by: prior-task - waits
+## Done
+- [x] done-pr-d4e5 - Fix PR - https://github.com/example/repo/pull/12 (merged 2026-07-24)
+- [X] done-local-e5f6 - Fix local - local main (merged 2026-07-24)
+- [x] done-report-f6a7 - Fix report - data/done-report-f6a7/report.md (reported 2026-07-24)
+EOF
+  out=$(bash -c '. "$1"; fm_task_label_prepare "$2" "$3" ship "" "" "$4"' \
+    _ "$LIB" "$state" opaque-work-c9d2 "$home/data/backlog.md")
+  [ "$out" = "Crew - Operator-friendly Herdr · c9d2"$'\t'"c9d2" ] \
+    || fail "canonical backlog title was not preferred and bounded: '$out'"
+  out=$(bash -c '. "$1"; fm_task_label_prepare "$2" "$3" ship "" "" "$4"' \
+    _ "$LIB" "$state" quick-fix-a1b2 "$home/data/backlog.md")
+  [ "$out" = "Crew - Fix UI · a1b2"$'\t'"a1b2" ] \
+    || fail "backlog routing metadata leaked into a short display label: '$out'"
+  out=$(bash -c '. "$1"; fm_task_label_prepare "$2" "$3" scout "" "" "$4"' \
+    _ "$LIB" "$state" bold-work-b2c3 "$home/data/backlog.md")
+  [ "$out" = "Scout - Bold work · b2c3"$'\t'"b2c3" ] \
+    || fail "bold in-flight backlog title was not parsed: '$out'"
+  out=$(bash -c '. "$1"; fm_task_label_prepare "$2" "$3" scout "" "" "$4"' \
+    _ "$LIB" "$state" blocked-work-c3d4 "$home/data/backlog.md")
+  [ "$out" = "Scout - Blocked work · c3d4"$'\t'"c3d4" ] \
+    || fail "blocked-by routing metadata leaked into the display label: '$out'"
+  out=$(bash -c '. "$1"; fm_task_label_prepare "$2" "$3" ship "" "" "$4"' \
+    _ "$LIB" "$state" done-pr-d4e5 "$home/data/backlog.md")
+  [ "$out" = "Crew - Fix PR · d4e5"$'\t'"d4e5" ] \
+    || fail "PR completion metadata leaked into the display label: '$out'"
+  out=$(bash -c '. "$1"; fm_task_label_prepare "$2" "$3" ship "" "" "$4"' \
+    _ "$LIB" "$state" done-local-e5f6 "$home/data/backlog.md")
+  [ "$out" = "Crew - Fix local · e5f6"$'\t'"e5f6" ] \
+    || fail "local-main completion metadata leaked into the display label: '$out'"
+  out=$(bash -c '. "$1"; fm_task_label_prepare "$2" "$3" scout "" "" "$4"' \
+    _ "$LIB" "$state" done-report-f6a7 "$home/data/backlog.md")
+  [ "$out" = "Scout - Fix report · f6a7"$'\t'"f6a7" ] \
+    || fail "report completion metadata leaked into the display label: '$out'"
+  pass "task labels: canonical backlog title precedes semantic task-id fallback"
+}
+
+test_persisted_phrase_must_match_safe_ascii_grammar() {
+  local state phrase record
+  state="$TMP_ROOT/persisted-grammar/state"
+  mkdir -p "$state"
+  for phrase in "" "Bad/Path" "Bad:Value" 'Bad"Quote' "Café" " Leading"; do
+    record="$state/record-${RANDOM}.meta"
+    printf 'display_label=Crew - %s · c1db\ntask_key=c1db\n' "$phrase" > "$record"
+    if bash -c '. "$1"; fm_task_label_read_record "$2" task' _ "$LIB" "$record" >/dev/null 2>&1; then
+      fail "unsafe persisted phrase was accepted: '$phrase'"
+    fi
+  done
+  printf 'display_label=Crew - Safe phrase_1 + polish · c1db\ntask_key=c1db\n' > "$state/safe.meta"
+  bash -c '. "$1"; fm_task_label_read_record "$2" task' _ "$LIB" "$state/safe.meta" >/dev/null \
+    || fail "safe persisted phrase was rejected"
+  pass "task labels: persisted phrases enforce the generated ASCII grammar"
+}
+
+test_full_label_limit_counts_characters_in_c_and_utf8_locales() {
+  local state locale_name candidate out label key utf8_locale locales
+  locales=$(locale -a 2>/dev/null || true)
+  while IFS= read -r candidate; do
+    [ -n "$candidate" ] || continue
+    if [ "$(LC_ALL="$candidate" locale charmap 2>/dev/null || true)" = UTF-8 ]; then
+      utf8_locale=$candidate
+      break
+    fi
+  done <<<"$locales"
+  for locale_name in C ${utf8_locale:+"$utf8_locale"}; do
+    state="$TMP_ROOT/locale-${locale_name//./-}/state"
+    mkdir -p "$state"
+    printf 'display_label=Crew - Other · c1db\ntask_key=c1db\n' > "$state/other.meta"
+    out=$(LC_ALL="$locale_name" bash -c '. "$1"; fm_task_label_prepare "$2" "$3" scout "1234567890123456789012345678" ""' \
+      _ "$LIB" "$state" locale-task-c1db) || fail "$locale_name rejected a 49-character display label"
+    label=${out%%$'\t'*}
+    key=${out#*$'\t'}
+    [ "${#key}" -eq 10 ] || fail "$locale_name did not exercise the extended key"
+    [ "$(bash -c '. "$1"; fm_task_label_character_count "$2"' _ "$LIB" "$label")" -eq 49 ] \
+      || fail "$locale_name counted the display label incorrectly"
+  done
+  pass "task labels: the 50-character cap is locale-independent with optional UTF-8 comparison"
+}
+
+test_kind_mapping
+test_phrase_sanitization_and_truncation
+test_control_and_bidi_input_refused
+test_task_keys_and_semantic_fallback
+test_collision_extends_key_and_journal_reuses_label
+test_empty_title_falls_back_and_label_is_bounded
+test_backlog_title_precedes_semantic_id_fallback
+test_persisted_phrase_must_match_safe_ascii_grammar
+test_full_label_limit_counts_characters_in_c_and_utf8_locales
+
+echo "# all fm-task-label-lib tests passed"