feat(bin): add experimental Herdr runtime backend

[kunchenguid]

Intent

Implement P2 of firstmate's runtime-backend abstraction: an experimental herdr session-provider backend (bin/backends/herdr.sh), on top of the P1 tmux-extraction dispatcher already on main. Herdr is a session provider only - treehouse stays the worktree provider (locked decision D3). The container shape (tab-per-task in one 'firstmate' workspace vs workspace-per-task) was an open decision (D4) I resolved empirically against the real herdr v0.7.1 binary: tab-per-task wins because both shapes expose identical per-item agent_status rollups via their list calls, but tab-per-task gives a materially better single-attach human-watching story (one tab bar shows the whole fleet) matching tmux's model. Busy-state detection uses herdr's native agent.get semantic state (working/idle/done/blocked) as the primary signal in fm-watch.sh and fm-crew-state.sh, falling back to the existing tmux pane-regex detector only when herdr reports unknown - this is intentional layering, not a regression risk to tmux, since tmux's own busy-state dispatch call always returns unknown and its regex path is unchanged. fm-spawn.sh's tmux-specific calls were refactored into small backend-dispatching wrapper functions (spawn_send_text_line etc.) that just delegate to the existing tmux adapter functions for backend=tmux, specifically to keep the tmux command sequence byte-identical - I verified this against the existing old-vs-new conformance test suite (tests/fm-backend.test.sh), which I also had to fix: it had a PRE-EXISTING bug on main (missing bin/fm-backend.sh and bin/backends/ from its old-bin fixture, causing a source failure) unrelated to my change but blocking the 'entire existing suite must stay green' requirement, so I fixed the test fixture itself. During empirical verification against the real herdr binary I found and fixed two real herdr v0.7.1 CLI bugs that were not documented anywhere: (1) 'pane read --lines N' returns completely empty output when N is smaller than the pane's viewport height (~23 rows) instead of clamping to the last N lines - worked around by always requesting >=200 lines from herdr and trimming to the caller's actual bound locally with tail; this was critical because my own composer-verification code requested only 6 lines and was silently getting nothing back, which I caught via a flaky real smoke-test run. (2) 'pane get' JSON's .result.pane.cwd field is frozen at pane-creation time and never updates when the shell cd's or enters a subshell; I originally read that field for fm-spawn.sh's worktree-discovery poll (mirroring tmux's pane_current_path poll after 'treehouse get'), which would have made the isolation guard never see the pane leave the project directory - fixed by reading .result.pane.foreground_cwd instead, which tracks the live running process; caught this by actually running the mandatory end-to-end test against a real claude crewmate, not just unit tests. I ran a full, real, end-to-end lifecycle by hand as a captain-mandated bar for this task (not something no-mistakes itself needs to re-run): spawned a real claude crewmate through bin/fm-spawn.sh with FM_BACKEND=herdr against an isolated, throwaway HERDR_SESSION and a scratch FM_HOME/local-only project (never the captain's default herdr session or the live tmux fleet), steered it with bin/fm-send.sh, peeked it with bin/fm-peek.sh, confirmed its done status, confirmed bin/fm-teardown.sh correctly REFUSES before the branch is merged (the unlanded-work safety gate), merged it locally with bin/fm-merge-local.sh, then confirmed teardown succeeds and fully cleans up (worktree returned, herdr pane closed, state files removed) - then tore down all the isolated herdr test infrastructure and scratch state afterward. I also deliberately made a mistake mid-task that I want called out for my own accountability, not hidden: I briefly wrote a findings file to data/fm-backend-design-d7/ under the PRIMARY firstmate checkout (a different git worktree than the one I'm committing from) instead of my own worktree - data/ is gitignored so it created no git-visible change and I deleted the stray file immediately upon noticing, but it was still a real violation of 'never write outside your own worktree' that I want on the record. Added two new test files (tests/fm-backend-herdr.test.sh with 20 fake-CLI unit tests covering every adapter function including both discovered bugs, and tests/fm-backend-herdr-smoke.test.sh with 11 real-binary assertions gated on herdr actually being installed, run against an isolated session and cleaned up afterward) plus docs/herdr-backend.md recording the full verification findings, the D4 decision evidence, and the end-to-end run evidence, with small pointer updates in docs/architecture.md, docs/configuration.md, and AGENTS.md. bin/fm-bootstrap.sh's tool-detection list was deliberately left unchanged (still unconditionally requires tmux only) - herdr's version/tool gate happens at spawn time instead (fm_backend_herdr_version_check refuses loudly on missing/incompatible herdr or jq) - this was a scope call to keep the diff focused on the adapter and its wiring rather than bootstrap detection polish; I documented it explicitly as a known gap in docs/herdr-backend.md rather than silently leaving it undone.

What Changed

• Adds an experimental Herdr runtime backend with backend-dispatched spawn, send, peek, watcher, crew-state, daemon, and teardown support while keeping tmux as the default backend.
• Uses Herdr native agent state for busy detection, adds backend-aware stale recovery paths, and documents the Herdr backend behavior and known gaps.
• Adds Herdr unit and smoke coverage plus updates existing backend, crew-state, daemon, and watcher tests for the new runtime path.

Risk Assessment

⚠️ Medium: Captain, the remaining risk is mostly integration risk from an opt-in experimental backend and external Herdr CLI semantics, but I did not find a merge-blocking issue in this review pass.

Testing

The configured full baseline was already successful; I then exercised the herdr adapter through targeted automated tests, a real herdr CLI lifecycle, and a scratch fm-spawn.sh --backend herdr flow that showed spawn metadata, peek routing, pane output, tab listing, and cleanup all working.

Evidence: Targeted herdr and backend regression test transcript

## herdr fake-cli unit tests
ok - fm_backend_herdr_version_check: accepts the current protocol (14)
ok - fm_backend_herdr_version_check: refuses an old protocol loudly
ok - fm_backend_herdr_version_check: refuses loudly when herdr is not installed
ok - fm_backend_herdr_container_ensure: version-gates, starts the server, ensures the firstmate workspace, echoes session:workspace_id
ok - fm_backend_herdr_container_ensure: reuses an existing firstmate workspace without recreating it
ok - fm_backend_herdr_create_task: refuses a duplicate tab label (herdr's own tab create has no uniqueness check)
ok - fm_backend_herdr_create_task: creates a tab and parses tab_id/pane_id from the JSON response
ok - fm_backend_herdr_parse_target: splits '<session>:<pane_id>' on the FIRST colon (pane_id itself contains one)
ok - fm_backend_herdr_normalize_key: Enter/Escape/C-c map to herdr's verified enter/escape/ctrl+c
ok - fm_backend_herdr_capture: calls 'pane read <pane> --source recent --lines N' with the session set
ok - fm_backend_herdr_capture: works around the verified small-N '--lines' bug by over-fetching and trimming locally
ok - fm_backend_herdr_capture: ensures the session and preserves pane read failure
ok - fm_backend_herdr_send_key: normalizes the key and targets the right pane
ok - fm_backend_herdr_kill: calls pane close and stays best-effort on failure
ok - fm_backend_herdr_current_path: reads pane foreground_cwd (the live running process), not the frozen creation-time cwd
ok - fm_backend_herdr_busy_state: working -> busy
ok - fm_backend_herdr_busy_state: done -> idle, blocked -> idle (surfaced like a stale pane, not suppressed as busy)
ok - fm_backend_herdr_busy_state: unparseable/absent agent state reports unknown, the regex-fallback cue
ok - fm_backend_herdr_send_text_submit: reports 'empty' once the pane content changes after Enter (submitted)
ok - fm_backend_herdr_send_text_submit: reports 'pending' when the pane never changes after retried Enters (swallowed)
ok - fm_backend_herdr_send_text_submit: reports 'send-failed' when the literal send-text call itself errors
ok - fm_backend_herdr_send_text_submit: reports 'unknown' when typed-baseline capture fails
ok - fm_backend_herdr_send_text_submit: reports 'unknown' when post-Enter capture fails
ok - fm_backend_validate: herdr is a known backend (P2)
ok - fm_backend_busy_state: tmux (no native primitive) always reports unknown, preserving the P1 regex-only path
ok - fm-peek/fm-send: explicit stale targets matching metadata use the recorded backend

## real herdr smoke test
ok - real herdr: version_check accepts the installed binary's protocol
ok - real herdr: container_ensure starts the isolated session's server and ensures the firstmate workspace (fm-backend-smoke-90160:w1)
ok - real herdr: container_ensure is idempotent (reuses the existing firstmate workspace)
ok - real herdr: create_task creates a tab/pane and refuses a duplicate label
ok - real herdr: send_text_line runs a command atomically (pane run) and its output is capturable
ok - real herdr: send_literal + send_key Enter submit as two separate steps (verified: send-text does NOT auto-submit)
ok - real herdr: current_path reads the pane's live cwd
note: FM_HERDR_SMOKE_REAL_CLAUDE=1 not set; skipping the real-agent busy_state check
ok - real herdr: kill removes the pane and is idempotent/best-effort
ok - real herdr: list_live discovers a live task tab by fm-<id> label

## backend dispatcher regression tests
ok - fm_backend_name: FM_BACKEND env > config/backend > default tmux
ok - fm_backend_validate: tmux accepted, an unimplemented backend refused loudly
ok - fm_meta_get / fm_backend_of_meta: read key=value, default backend to tmux
ok - fm_backend_resolve_selector: session:window literal, fm-<id> via meta (always, even when the meta is missing), ad hoc bare name via tmux list-windows
ok - fm_backend_of_selector: fm-<id> and matching explicit targets inherit metadata backend
ok - fm-send.sh: --key, plain text, and /skill tmux command logs are byte-identical old vs new (send-keys -l, Enter submission preserved)
ok - fm-peek.sh: capture-pane invocation and output are byte-identical old vs new
ok - fm-spawn.sh: tmux command log and printed summary line are byte-identical old vs new for a ship-task claude spawn
ok - fm-teardown.sh: treehouse return + tmux kill-window command log is byte-identical old vs new for a scout task
ok - fm-spawn.sh --backend zellij is refused loudly (tmux-only in P1)
ok - fm-spawn.sh honors FM_BACKEND and refuses an unimplemented value loudly
ok - fm-spawn.sh: an explicit --backend tmux resolves silently and writes no backend= (missing means tmux)

## crew-state backend regression tests
ok - active run-step is authoritative
ok - stale needs-decision over active run is superseded
ok - stale blocked over active run is superseded
ok - genuine parked run is not flagged superseded
ok - scalar gate parked run is not flagged superseded
ok - gate block parked run is not flagged superseded
ok - ci-ready status log beats monitoring run
ok - terminal passed run is authoritative
ok - terminal failed run is authoritative
ok - cross-branch run is attributed via the run list
ok - unquoted run-list row is attributed
ok - another branch's run is ignored, falls back
ok - no run + busy pane reads working from the pane
ok - herdr unknown native state falls back to backend capture busy regex
ok - no run + idle pane uses the status-log verb
ok - dead window ignores stale status log
ok - closed pane still reports a terminal run-step
ok - closed pane still reports an active run-step
ok - no timeout command uses perl bound
ok - scout skips the run lookup
ok - torn-down worktree is handled gracefully
ok - missing meta is handled gracefully
ok - usage error exits 2
all fm-crew-state tests passed

## daemon backend regression tests
ok - supervise daemon state root is scoped by FM_HOME
ok - routine signal self-handles
ok - captain-relevant status verbs escalate
ok - check + unknown escalate; heartbeat self-handles
ok - transient stale self-handles and records a persistence marker
ok - stale + terminal status escalates immediately
ok - persistent stale escalates after threshold and clears its marker
ok - resumed (busy) stale clears its marker without escalating
ok - persistent herdr stale resolves the target from metadata and escalates
ok - resumed herdr stale clears through backend-aware busy state
ok - multiple escalations flush as a single batched digest
ok - batch flush measures max-delay from the first append, not the last
ok - catch-all scan escalates a missed terminal once, not twice
ok - handle_wake routes routine->self and captain->escalate
ok - INJECT_SKIP forces self-handle, bypassing captain-relevant classification
ok - is_wake_reason distinguishes watcher wake reasons from singleton-status stdout
ok - terminal-stale escalate removes its marker so housekeeping does not re-escalate
ok - captain signal escalate marks seen so the catch-all scan does not re-fire
ok - _collapse_newlines replaces newlines with literal separator
ok - afk flag absent: daemon does not inject, buffer preserved
ok - busy-guard defers injection when supervisor pane is busy
ok - marker detection: marker -> stay afk, no marker -> exit afk
ok - /afk invocation is exempt from afk exit (no self-cancel)
ok - should_exit_afk returns false when afk is not active
ok - strip_injection_marker removes the sentinel marker cleanly
ok - pane_input_pending detects partial input on the cursor line
ok - pane_input_pending: blank cursor line is not pending
ok - pane_input_pending: bare prompts are not pending (idle)
ok - pane_input_pending honors FM_COMPOSER_IDLE_RE after border stripping
ok - classify_signal dedupes against the catch-all scan seen marker
ok - classify_stale dedupes against the signal path seen marker
ok - pane_input_pending: an idle bordered composer is NOT pending (afk-invx-i5)
ok - pane_input_pending: text inside a bordered composer is still pending
ok - submit-ACK confirms a submit when the composer returns to a bordered-empty box
ok - submit-ACK reports pending on a persistently swallowed Enter (type-once)
ok - max-defer on an empty stuck pane types once, alarms, and preserves the buffer
ok - max-defer flushes and clears the buffer on an empty bordered pane
ok - max-defer on a pending composer alarms without typing
ok - normal flush clears a stale wedge marker
ok - below MAX_DEFER: no inject, no alarm, buffer preserved
ok - max-defer does not flush or alarm while afk is inactive
ok - fm-send exits non-zero on a confirmed swallow, zero on a clean submit
ok - fm-send exits non-zero when initial text send fails

## watch triage backend regression tests
ok - signal_reason_is_actionable: benign absorbed, captain verbs and coalesced batches surfaced
ok - stale_is_terminal: terminal status surfaces, non-terminal and no-status are benign
ok - scan_captain_relevant_statuses lists only captain-relevant statuses
ok - classifier primitives: last line, captain-relevance, window->task, FM_CAPTAIN_RE override
ok - crew_is_provably_working: only working+run-step/pane is provable; idle/finished/parked/failed/unknown surface
ok - signal_crew_provably_working: benign only when every referenced crew is provably working
ok - a no-verb signal whose crew is provably working is absorbed (no exit, no queue, suppressor advanced, beacon present)
ok - a bare turn-end whose crew is provably working (busy pane) is absorbed
ok - a bare turn-end whose crew is not provably working is surfaced (the swallowed-finish fix)
ok - a no-verb working: note whose crew is idle with no running pipeline is surfaced
ok - captain-relevant signal is surfaced (queue + exit) and marked surfaced
ok - a stale pane sitting on a terminal status is surfaced (queue + exit)
ok - provably-working non-terminal stale is absorbed on first sight, then wedge-escalated past the threshold
ok - a not-provably-working non-terminal stale is surfaced immediately (never left to wait out the timer)
ok - matching non-terminal stale suppressors repair missing or corrupt stale-since timers
ok - triage log capping handles wc byte counts with leading spaces
ok - a heartbeat with no captain-relevant change is absorbed and backs off the cadence
ok - heartbeat backstop fail-safe surfaces a captain-relevant status the per-wake path missed
ok - the liveness beacon stays fresh while the watcher absorbs benign wakes (fm-guard never false-alarms)
ok - with .afk present the watcher reverts to one-shot so the daemon owns triage (no double-triage)

Evidence: Manual real-herdr adapter lifecycle transcript

session=fm-backend-evidence-3717
$ herdr --version
herdr 0.7.1
$ fm_backend_herdr_container_ensure /tmp
container=fm-backend-evidence-3717:w1
tab=w1:t2 pane=w1:p2 target=fm-backend-evidence-3717:w1:p2
$ herdr tab list --workspace <firstmate>
{"tab_id":"w1:t1","label":"1","workspace_id":"w1","agent_status":"unknown"}
{"tab_id":"w1:t2","label":"fm-evidence","workspace_id":"w1","agent_status":"unknown"}
$ fm_backend_herdr_send_text_line <target> printf-pwd
$ fm_backend_herdr_capture <target> 20
printf 'HERDR_E2E_LINE\n'; pwd
/private/tmp
❯ printf 'HERDR_E2E_LINE\n'; pwd
HERDR_E2E_LINE
/private/tmp
/private/tmp
❯$ fm_backend_herdr_send_text_line <target> cd-pwd
current_path=/private/tmp
busy_state_without_agent=unknown
$ fm_backend_herdr_kill <target>
pane_closed=yes

Evidence: fm-spawn.sh --backend herdr smoke transcript

session=fm-spawn-evidence-7559
fm_home=/Users/kunchen/.no-mistakes/worktrees/016d88035d58/01KWGMAWB929VQHBXH2EZTNN7S/.tmp-herdr-spawn.XNwLMK/fmhome
$ FM_HOME=<scratch> HERDR_SESSION=<isolated> bin/fm-spawn.sh herdrspawn projects/proj --backend herdr claude
spawned herdrspawn harness=claude kind=ship mode=local-only yolo=off window=fm-spawn-evidence-7559:w1:p2 worktree=/Users/kunchen/.no-mistakes/worktrees/016d88035d58/01KWGMAWB929VQHBXH2EZTNN7S/.tmp-herdr-spawn.XNwLMK/worktree
$ cat state/herdrspawn.meta
window=fm-spawn-evidence-7559:w1:p2
worktree=<scratch>/worktree
project=<scratch>/fmhome/projects/proj
harness=claude
kind=ship
mode=local-only
yolo=off
tasktmp=/tmp/fm-herdrspawn
model=default
effort=default
backend=herdr
herdr_session=fm-spawn-evidence-7559
herdr_workspace_id=w1
herdr_tab_id=w1:t2
herdr_pane_id=w1:p2
$ bin/fm-peek.sh fm-herdrspawn 40
●━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
●  WATCHER DOWN - SUPERVISION IS OFF
●  1 task(s) in flight, but no watcher has a fresh beacon (last beat: never, grace 300s).
●  Trust bin/fm-watch-arm.sh for the true state: it confirms a live watcher and a fresh beacon, or fails loudly.
●  Re-arm it NOW: run bin/fm-watch-arm.sh as the harness-tracked background task (never a shell & that gets reaped).
●━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
treehouse get
proj main
❯ treehouse get

The default interactive shell is now zsh.
To update your account to use zsh, please run `chsh -s
 /bin/zsh`.
For more details, please visit https://support.apple.c
om/kb/HT208050.
bash-3.2$ export GOTMPDIR=/tmp/fm-herdrspawn/gotmp
bash-3.2$ CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false c
laude --dangerously-skip-permissions "$(cat '/Users/ku
nchen/.no-mistakes/worktrees/016d88035d58/01KWGMAWB929
VQHBXH2EZTNN7S/.tmp-herdr-spawn.XNwLMK/fmhome/data/her
drspawn/brief.md')"
FAKE_CLAUDE_LAUNCHED
argv:--dangerously-skip-permissions # herdr spawn smok
e

Write no files; just start.
prompt:# herdr spawn smoke

Write no files; just start.
bash-3.2$$ herdr tab list --workspace <recorded>
{"tab_id":"w1:t1","label":"1","workspace_id":"w1","agent_status":"unknown"}
{"tab_id":"w1:t2","label":"fm-herdrspawn","workspace_id":"w1","agent_status":"unknown"}
fake_claude_marker=present

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 5 issues found → auto-fixed (4) ✅

• 🚨 bin/fm-spawn.sh:575 - Captain, Herdr stores window= as <session>:<pane-id>, but stale classification still derives the task id by taking the suffix after the last colon. For a target like default:w1:p2, window_to_task becomes p2, so stale handling reads state/p2.status/state/p2.meta instead of the real task id. That breaks terminal-status detection, dedupe, and crew_is_provably_working for Herdr tasks. Resolve Herdr task ids from meta by matching window=, or keep the task id in the target used by watcher/classifier.
• 🚨 bin/backends/herdr.sh:236 - herdr pane read is piped into tail without preserving the read command's exit status. If the pane is gone or the Herdr server is unavailable, tail still exits 0 on empty stdin, so callers treat the pane as readable and fm-peek/watcher/crew-state see a false empty capture. Capture should explicitly check the herdr pane read result before trimming.
• ⚠️ bin/backends/herdr.sh:236 - The adapter documents that Herdr socket calls do not auto-start the server, but non-spawn operations call pane APIs directly. After a server stop or firstmate restart, persisted pane ids can still be valid, yet fm-peek, fm-send, watcher capture, and teardown kill will fail instead of ensuring the session server is running. Call fm_backend_herdr_server_ensure after parsing the target session for pane operations, or otherwise make the failure explicit and recoverable.
• ⚠️ bin/fm-crew-state.sh:145 - The Herdr unknown-state fallback in fm-crew-state calls fm_pane_is_busy, which is tmux-only and runs tmux capture-pane against a Herdr target. That means the intended regex fallback never works for Herdr when agent get returns unknown. Mirror fm-watch here by using fm_backend_capture and applying the busy regex to the captured tail.
• ⚠️ bin/backends/herdr.sh:266 - The Herdr submit verifier returns success on any visible delta after Enter. A completion popup being dismissed/selected, a redraw, or text changing while still in the composer can satisfy after != typed even though the steer was not submitted, which weakens the core fm-send guarantee. This needs a stronger acknowledgement or an explicit acceptance of the weaker Herdr semantics.

🔧 Fix: Fix Herdr supervision recovery gaps
3 warnings still open:

• ⚠️ bin/fm-supervise-daemon.sh:555 - Captain, away-mode stale persistence still reconstructs tasks by scanning tmux list-windows, then rechecks liveness with the tmux-only fm_pane_is_busy. A Herdr task's marker key can never resolve back to default:w1:p2, so housekeeping drops the marker as if the pane were gone and a wedged Herdr task will not escalate while afk. Resolve markers from state meta and use backend-aware busy/capture checks.
• ⚠️ bin/backends/herdr.sh:268 - Herdr submit verification does not handle capture failures even though the adapter advertises an unknown verdict. If pane read fails after text is typed, this can abort under set -e or misclassify the send as pending; return unknown when either baseline or post-Enter capture fails.
• ⚠️ bin/backends/herdr.sh:273 - The Herdr submit verifier treats any visible pane delta after Enter as a confirmed submit. A popup closing, autocomplete selection, or redraw can make after != typed while the text is still in the composer, weakening fm-send's submit guarantee. This needs a stronger acknowledgement or explicit acceptance of the weaker Herdr semantics.

🔧 Fix: Captain, fix Herdr stale recovery gaps
1 warning still open:

• ⚠️ bin/backends/herdr.sh:273 - Captain, the Herdr submit verifier treats any visible pane change after Enter as a confirmed submit. A popup closing, autocomplete selection, or redraw can change the capture while the original text remains unsubmitted, so fm-send may exit 0 even though the steer did not land. Either strengthen this to verify the composer is clear or explicitly accept the weaker Herdr send contract.

🔧 Fix: Document Herdr composer primitive candidate
3 issues (1 error, 2 warnings) still open:

• 🚨 tests/fm-backend-herdr.test.sh:1 - Captain, both new Herdr test scripts are checked in as mode 100644, but GitHub CI executes tests/*.test.sh directly as commands. The first new script will fail with permission denied before it can run or skip. Make both new test files executable, or change CI to invoke them with bash consistently.
• ⚠️ bin/fm-watch.sh:480 - Herdr stale wakes enqueue the raw backend target such as default:w1:p2, but fm-peek.sh and fm-send.sh infer backend only from raw fm-* selectors and otherwise default to tmux. Following the stale wake target therefore tries tmux against a Herdr pane, breaking the normal inspect or steer recovery path. Resolve backend by matching the resolved target back to meta, or emit a task selector that preserves backend lookup.
• ⚠️ tests/fm-backend-herdr-smoke.test.sh:105 - The smoke test invokes a real claude --dangerously-skip-permissions --print run whenever both herdr and claude are installed. That makes the default test suite consume external LLM credentials and adds a slow, flaky network dependency in developer or CI environments that happen to have Claude installed. Gate this section behind an explicit opt-in env var.

🔧 Fix: Captain, harden Herdr stale recovery and tests
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; exit "$rc"
• Pre-supplied baseline result accounted for: command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; exit "$rc" had already run successfully before this validation.
• bash tests/fm-backend-herdr.test.sh
• bash tests/fm-backend-herdr-smoke.test.sh
• bash tests/fm-backend.test.sh
• bash tests/fm-crew-state.test.sh
• bash tests/fm-daemon.test.sh
• bash tests/fm-watch-triage.test.sh
• Manual real-herdr adapter lifecycle: sourced bin/fm-backend.sh, ran fm_backend_herdr_container_ensure, fm_backend_herdr_create_task, fm_backend_herdr_send_text_line, fm_backend_herdr_capture, fm_backend_herdr_current_path, fm_backend_herdr_busy_state, and fm_backend_herdr_kill against an isolated HERDR_SESSION.
• Manual spawn smoke: ran FM_HOME=<scratch> HERDR_SESSION=<isolated> bin/fm-spawn.sh herdrspawn projects/proj --backend herdr claude with fake treehouse and fake claude, then verified state/herdrspawn.meta, backend=herdr metadata, herdr ids, bin/fm-peek.sh fm-herdrspawn 40, herdr tab list, and fake Claude launch marker.
• Cleanup verification: git status --short, find . -maxdepth 1 -name '.tmp-herdr-spawn.*' -print, /tmp/fm-herdrspawn absence check, and filtered herdr session list --json for private evidence sessions.

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.