diff --git a/bin/backends/cmux.sh b/bin/backends/cmux.sh
index 0d9791216a3..7ee90424184 100644
--- a/bin/backends/cmux.sh
+++ b/bin/backends/cmux.sh
@@ -335,6 +335,45 @@ fm_backend_cmux_workspace_id_for_label() {  # <label>
     | jq -r --arg want "$label" '.workspaces[]? | select(.title == $want) | .id' 2>/dev/null | head -1
 }
 
+# fm_backend_cmux_workspace_matches_label: is <workspace_id> the one and only
+# live workspace carrying task label <label>?
+#
+# Unlike fm_backend_cmux_workspace_id_for_label, which adopts the first match
+# because its callers only need A workspace, this is an identity proof, so an
+# ambiguous answer must refuse. It checks the home-scoped title every new
+# workspace is created with (fm_backend_cmux_scoped_title), then falls back to
+# the bare caller-facing label for a workspace created before home scoping
+# shipped - and only when exactly one live workspace carries that bare title,
+# mirroring fm_backend_zellij_tab_matches_label's migration posture.
+#
+# KNOWN LIMITATION, left for a follow-up. `workspace list --json` with no
+# `--window` is scoped to the CURRENT window only (verified live; the
+# fm_backend_cmux_window_of_workspace comment below owns that fact). A cmux task
+# whose workspace is not in the focused window is therefore simply absent from
+# this list, both jq checks fail, and the proof REFUSES - so that task is still
+# stranded with no supported lifecycle action, and the recovery built on this
+# function does NOT cover it. For the same reason the "exactly one live
+# workspace carries the title" ambiguity guard holds only WITHIN the current
+# window: a same-titled workspace in another window is invisible here and would
+# not be detected. The consequence is always refusal, never acting on an
+# unproven endpoint.
+fm_backend_cmux_workspace_matches_label() {  # <workspace_id> <label>
+  local wsid=$1 label=$2 scoped list
+  [ -n "$wsid" ] && [ -n "$label" ] || return 1
+  scoped=$(fm_backend_cmux_scoped_title "$label")
+  list=$(fm_backend_cmux_cli workspace list --json --id-format uuids 2>/dev/null) || return 1
+  printf '%s' "$list" | jq -e --arg id "$wsid" --arg want "$scoped" '
+    (.workspaces | type) == "array"
+    and ([.workspaces[] | select(.title == $want)] | length) == 1
+    and ([.workspaces[] | select(.id == $id and .title == $want)] | length) == 1
+  ' >/dev/null 2>&1 && return 0
+  printf '%s' "$list" | jq -e --arg id "$wsid" --arg want "$label" '
+    (.workspaces | type) == "array"
+    and ([.workspaces[] | select(.title == $want)] | length) == 1
+    and ([.workspaces[] | select(.id == $id and .title == $want)] | length) == 1
+  ' >/dev/null 2>&1
+}
+
 fm_backend_cmux_surface_id_for_workspace() {  # <workspace_id>
   local wsid=$1
   fm_backend_cmux_cli list-panes --workspace "$wsid" --json --id-format uuids 2>/dev/null \
diff --git a/bin/backends/herdr.sh b/bin/backends/herdr.sh
index c5f270bdaf9..2ce15395412 100644
--- a/bin/backends/herdr.sh
+++ b/bin/backends/herdr.sh
@@ -1909,6 +1909,38 @@ fm_backend_herdr_pane_agent_state() {  # <session> <pane_id>
   esac
 }
 
+# fm_backend_herdr_tab_matches_label: does the recorded endpoint chain
+# <workspace_id> -> <pane_id> -> <tab_id> in <session> really end at a tab whose
+# label is exactly <label> (the caller-facing "fm-<id>")?
+#
+# Herdr enforces no label uniqueness (see fm_backend_herdr_create_task), and a
+# pane can in principle be re-parented, so proving the label alone would prove
+# nothing about the recorded pane. Every link is therefore checked against the
+# SAME two read-only list calls: the recorded pane must be present in the
+# recorded workspace and report the recorded tab as its owner, and exactly one
+# tab in that workspace may carry <label> - the recorded one.
+#
+# Every failure mode collapses to 1: an unreachable server, a non-array or
+# unparseable response, a missing pane, a re-parented pane, a relabeled tab, or
+# a duplicated label. The caller (fm_backend_endpoint_label_provable) treats 1
+# as "not proven" and refuses, so an inconclusive read never licenses anything.
+fm_backend_herdr_tab_matches_label() {  # <session> <workspace_id> <tab_id> <pane_id> <label>
+  local session=$1 workspace=$2 tab=$3 pane=$4 label=$5 panes tabs
+  [ -n "$session" ] && [ -n "$workspace" ] && [ -n "$tab" ] && [ -n "$pane" ] && [ -n "$label" ] || return 1
+  panes=$(fm_backend_herdr_cli "$session" pane list --workspace "$workspace" 2>/dev/null) || return 1
+  printf '%s' "$panes" | jq -e --arg pane "$pane" --arg tab "$tab" '
+    (.result.panes | type) == "array"
+    and ([.result.panes[] | select(.pane_id == $pane)] | length) == 1
+    and ([.result.panes[] | select(.pane_id == $pane and .tab_id == $tab)] | length) == 1
+  ' >/dev/null 2>&1 || return 1
+  tabs=$(fm_backend_herdr_cli "$session" tab list --workspace "$workspace" 2>/dev/null) || return 1
+  printf '%s' "$tabs" | jq -e --arg tab "$tab" --arg want "$label" '
+    (.result.tabs | type) == "array"
+    and ([.result.tabs[] | select(.label == $want)] | length) == 1
+    and ([.result.tabs[] | select(.tab_id == $tab and .label == $want)] | length) == 1
+  ' >/dev/null 2>&1
+}
+
 # fm_backend_herdr_tab_is_husk: true (0) only for the two conservative husk
 # states (dead, no-agent) fm_backend_herdr_pane_agent_state can positively
 # confirm; live and unknown both refuse (1), so an inconclusive read never
diff --git a/bin/fm-backend.sh b/bin/fm-backend.sh
index 2882f4a6af2..c30a460a31d 100644
--- a/bin/fm-backend.sh
+++ b/bin/fm-backend.sh
@@ -364,10 +364,24 @@ fm_backend_target_of_meta() {  # <meta-file>
 # from its durable metadata before any runtime command or cleanup mutation.
 # The validation binds the exact task id, selected backend, target, project,
 # and worktree. New non-tmux records carry endpoint_task_id because their
-# opaque runtime ids do not encode the task label. Legacy tmux records remain
-# valid only when their window name itself is exactly fm-<task-id>.
+# opaque runtime ids do not encode the task label. Legacy tmux and Orca records
+# remain valid without it, because their recorded window name IS fm-<task-id>:
+# the record carries the task label itself, so a record authored for another
+# task cannot pass as this one.
 # On success, sets FM_BACKEND_VALIDATED_BACKEND and
-# FM_BACKEND_VALIDATED_TARGET. On failure, prints one refusal and returns 1.
+# FM_BACKEND_VALIDATED_TARGET.
+#
+# Return codes. 0 is valid. 1 is a refusal this function can settle offline and
+# nothing may act on. 2 is the ONE recoverable shape: a Herdr, Zellij, or cmux
+# record that is internally consistent in every other respect and whose only
+# missing fact is the endpoint_task_id binding - the pre-#1171 record shape.
+# Those backends record opaque runtime ids, so nothing offline binds such a
+# record to its task, and this function must still refuse it. But refusing with
+# no recoverable outcome leaves an operator with no supported lifecycle action
+# at all, which is exactly how a hand-improvised kill gets invented. Code 2 says
+# "not provable HERE", so a caller that can read live state may try
+# fm_backend_resolve_task_endpoint instead. Every existing caller treats any
+# nonzero return as a refusal and is unaffected.
 fm_backend_meta_exact_value() {  # <meta-file> <key>
   local meta=$1 key=$2 count value
   count=$(grep -c "^$key=" "$meta" 2>/dev/null || true)
@@ -452,10 +466,6 @@ fm_backend_validate_task_endpoint() {  # <meta-file> <task-id>
       fi
       ;;
     herdr)
-      [ "$binding" = "$id" ] || {
-        echo "REFUSED: legacy Herdr endpoint metadata for task $id lacks an exact task binding; preserving task state." >&2
-        return 1
-      }
       recorded_session=$(fm_backend_meta_exact_value "$meta" herdr_session) || recorded_session=
       workspace=$(fm_backend_meta_exact_value "$meta" herdr_workspace_id) || workspace=
       tab=$(fm_backend_meta_exact_value "$meta" herdr_tab_id) || tab=
@@ -469,12 +479,12 @@ fm_backend_validate_task_endpoint() {  # <meta-file> <task-id>
         echo "REFUSED: Herdr endpoint metadata for task $id is malformed or inconsistent; preserving task state." >&2
         return 1
       fi
+      [ -n "$binding" ] || {
+        echo "REFUSED: legacy Herdr endpoint metadata for task $id lacks an exact task binding; preserving task state." >&2
+        return 2
+      }
       ;;
     zellij)
-      [ "$binding" = "$id" ] || {
-        echo "REFUSED: legacy Zellij endpoint metadata for task $id lacks an exact task binding; preserving task state." >&2
-        return 1
-      }
       recorded_session=$(fm_backend_meta_exact_value "$meta" zellij_session) || recorded_session=
       tab=$(fm_backend_meta_exact_value "$meta" zellij_tab_id) || tab=
       pane=$(fm_backend_meta_exact_value "$meta" zellij_pane_id) || pane=
@@ -485,12 +495,16 @@ fm_backend_validate_task_endpoint() {  # <meta-file> <task-id>
         echo "REFUSED: Zellij endpoint metadata for task $id is malformed or inconsistent; preserving task state." >&2
         return 1
       fi
+      [ -n "$binding" ] || {
+        echo "REFUSED: legacy Zellij endpoint metadata for task $id lacks an exact task binding; preserving task state." >&2
+        return 2
+      }
       ;;
     orca)
-      [ "$binding" = "$id" ] || {
-        echo "REFUSED: legacy Orca endpoint metadata for task $id lacks an exact task binding; preserving task state." >&2
-        return 1
-      }
+      # No endpoint_task_id requirement here, unlike the other non-tmux
+      # backends: an Orca record's own window field must be exactly fm-<id>
+      # (asserted below), so the record carries the task label the same way a
+      # tmux record does and a legacy record is already self-evidencing.
       terminal=$(fm_backend_meta_exact_value "$meta" terminal) || terminal=
       worktree_id=$(fm_backend_meta_exact_value "$meta" orca_worktree_id) || worktree_id=
       [ -n "$terminal" ] || {
@@ -510,10 +524,6 @@ fm_backend_validate_task_endpoint() {  # <meta-file> <task-id>
       window=$terminal
       ;;
     cmux)
-      [ "$binding" = "$id" ] || {
-        echo "REFUSED: legacy cmux endpoint metadata for task $id lacks an exact task binding; preserving task state." >&2
-        return 1
-      }
       workspace=$(fm_backend_meta_exact_value "$meta" cmux_workspace_id) || workspace=
       surface=$(fm_backend_meta_exact_value "$meta" cmux_surface_id) || surface=
       if [ -z "$workspace" ] || [ -z "$surface" ] || [ "$window" != "$workspace:$surface" ] \
@@ -522,6 +532,10 @@ fm_backend_validate_task_endpoint() {  # <meta-file> <task-id>
         echo "REFUSED: cmux endpoint metadata for task $id is malformed or inconsistent; preserving task state." >&2
         return 1
       fi
+      [ -n "$binding" ] || {
+        echo "REFUSED: legacy cmux endpoint metadata for task $id lacks an exact task binding; preserving task state." >&2
+        return 2
+      }
       ;;
   esac
   # shellcheck disable=SC2034 # Output globals are consumed by sourcing callers.
@@ -531,6 +545,142 @@ fm_backend_validate_task_endpoint() {  # <meta-file> <task-id>
   return 0
 }
 
+# fm_backend_endpoint_label_provable: can the LIVE runtime prove that the
+# endpoint <meta-file> records is the one carrying task <task-id>'s own
+# fm-<task-id> label?
+#
+# This is the re-derivation path behind fm_backend_validate_task_endpoint's
+# code 2. Herdr, Zellij, and cmux record opaque runtime ids, so a pre-#1171
+# record has nothing OFFLINE that binds it to its task. What every one of those
+# adapters does have is a label: fm-spawn.sh creates each task's tab or
+# workspace with the caller-facing label fm-<id> and nothing else ever renames
+# it, so the binding is readable from live state even when the record predates
+# the metadata field. That is the same fact tmux and Orca get for free from
+# their recorded window name, read from the runtime instead of from the record,
+# so accepting it is not a weaker identity test than the legacy tmux records
+# this validator already accepts - it is the same test against a live source.
+# The residual gap is identical too: two homes sharing one session AND one task
+# id would collide, exactly as they already would on tmux.
+#
+# What it proves differs per backend, and only Herdr is covered end to end.
+# Herdr proves the WHOLE recorded chain - workspace -> pane -> owning tab ->
+# label - so a re-parented pane, a relabeled tab, a duplicated label, a missing
+# pane, and an unreachable server all refuse. Zellij reuses its own tab matcher,
+# which proves only that the recorded tab id carries the expected label, and
+# never that the recorded zellij_pane_id still belongs to that tab. cmux
+# requires exactly one live workspace to carry the title and that workspace to
+# be the recorded one, but likewise never proves that the recorded
+# cmux_surface_id is still in that workspace.
+#
+# That gap matters because the target bin/fm-control.sh and bin/fm-teardown.sh
+# subsequently act on is the PANE or SURFACE, not the tab or workspace, so on
+# Zellij and cmux the residual gap is larger than on Herdr. Both are KNOWN
+# LIMITATIONS left for a follow-up, not coverage that exists today; cmux carries
+# a second one, its current-window-scoped listing, documented on
+# fm_backend_cmux_workspace_matches_label in bin/backends/cmux.sh.
+#
+# A third, also left for a follow-up: only the Herdr branch has executable
+# coverage (tests/fm-teardown-endpoint-safety.test.sh). The Zellij branch and
+# fm_backend_cmux_workspace_matches_label have none at all, so their
+# refusal-on-unprovable behavior - including cmux's scoped-title-then-bare-title
+# fallback and the absent-workspace refusal the current-window limitation
+# depends on - is established by code reading only, not by a test.
+#
+# Returns 0 only on an exact, unambiguous live match. An unreachable runtime, an
+# unparseable response, a missing, moved, or duplicated label, and a backend
+# with no label to read all return 1, so an inconclusive read never licenses a
+# rebind.
+fm_backend_endpoint_label_provable() {  # <meta-file> <task-id>
+  local meta=$1 id=$2 backend label="fm-$2"
+  backend=$(fm_backend_of_meta "$meta")
+  fm_backend_source "$backend" || return 1
+  case "$backend" in
+    herdr)
+      fm_backend_herdr_tab_matches_label \
+        "$(fm_meta_get "$meta" herdr_session)" \
+        "$(fm_meta_get "$meta" herdr_workspace_id)" \
+        "$(fm_meta_get "$meta" herdr_tab_id)" \
+        "$(fm_meta_get "$meta" herdr_pane_id)" \
+        "$label"
+      ;;
+    zellij)
+      fm_backend_zellij_tab_matches_label \
+        "$(fm_meta_get "$meta" zellij_session)" \
+        "$(fm_meta_get "$meta" zellij_tab_id)" \
+        "$label"
+      ;;
+    cmux)
+      fm_backend_cmux_workspace_matches_label \
+        "$(fm_meta_get "$meta" cmux_workspace_id)" "$label"
+      ;;
+    *) return 1 ;;
+  esac
+}
+
+# fm_backend_bind_task_endpoint: durably record <task-id> as <meta-file>'s
+# endpoint binding, so a record that needed a live proof once takes the ordinary
+# offline path forever after.
+#
+# Only ever called after fm_backend_endpoint_label_provable succeeded, and only
+# for a record that carries NO binding line at all - an existing binding, right
+# or wrong, is never rewritten here, because rewriting one is how a wrong
+# endpoint would get laundered into a right-looking record. The caller holds the
+# task's meta lock. The write is a whole-file replace through a temp file in the
+# same directory, so a crash mid-write leaves the previous record intact, and the
+# replacement lands 0600 - the same private mode bin/fm-pr-check.sh already
+# requires of a task record, never looser than what it replaced.
+fm_backend_bind_task_endpoint() {  # <meta-file> <task-id>
+  local meta=$1 id=$2 dir tmp line
+  [ -f "$meta" ] && [ ! -L "$meta" ] || return 1
+  if grep -q '^endpoint_task_id=' "$meta"; then return 1; fi
+  dir=${meta%/*}
+  [ "$dir" != "$meta" ] || dir=.
+  tmp=$(mktemp "$dir/.fm-endpoint-bind.XXXXXX") || return 1
+  {
+    while IFS= read -r line || [ -n "$line" ]; do
+      printf '%s\n' "$line"
+    done < "$meta"
+    printf 'endpoint_task_id=%s\n' "$id"
+  } > "$tmp" || { rm -f "$tmp"; return 1; }
+  chmod 0600 "$tmp" || { rm -f "$tmp"; return 1; }
+  mv -f -- "$tmp" "$meta" || { rm -f "$tmp"; return 1; }
+  return 0
+}
+
+# fm_backend_resolve_task_endpoint: fm_backend_validate_task_endpoint for a
+# caller that can reach the live runtime, and therefore has one more honest
+# answer available than the offline validator does.
+#
+# Identical in every respect except one: on code 2 - the legacy record shape
+# whose ONLY missing fact is the endpoint binding - it asks the runtime to prove
+# the recorded endpoint carries the task's own fm-<id> label, records that
+# binding when the proof succeeds, and revalidates from the upgraded record. The
+# validation that ultimately decides is still the ordinary offline one; the live
+# read only supplies the fact the record was missing. When the proof fails, or
+# the binding cannot be written, the original refusal stands untouched.
+#
+# The runtime read here is read-only and happens before any mutation, so a
+# caller that refuses on a nonzero return has still mutated nothing.
+#
+# The CALLER must already hold the task's meta lock (fm_meta_lock_path), since
+# this may write the record. Locking here instead would deadlock bin/fm-teardown.sh,
+# which holds that lock across its whole validate-and-clean sequence.
+fm_backend_resolve_task_endpoint() {  # <meta-file> <task-id>
+  local meta=$1 id=$2 rc=0
+  fm_backend_validate_task_endpoint "$meta" "$id" || rc=$?
+  [ "$rc" -eq 2 ] || return "$rc"
+  fm_backend_endpoint_label_provable "$meta" "$id" || {
+    echo "REFUSED: could not prove from the live endpoint that task $id's recorded endpoint carries its own fm-$id label; preserving task state." >&2
+    return 1
+  }
+  fm_backend_bind_task_endpoint "$meta" "$id" || {
+    echo "REFUSED: could not record the re-derived endpoint binding for task $id; preserving task state." >&2
+    return 1
+  }
+  echo "note: task $id carried a legacy endpoint record; re-derived its binding from the live endpoint's own fm-$id label and recorded it." >&2
+  fm_backend_validate_task_endpoint "$meta" "$id"
+}
+
 fm_backend_meta_for_window() {  # <target> <state-dir>
   local target=$1 state=$2 meta window terminal
   for meta in "$state"/*.meta; do
diff --git a/bin/fm-control.sh b/bin/fm-control.sh
index 4196d3095c8..aa2dcd57bdc 100755
--- a/bin/fm-control.sh
+++ b/bin/fm-control.sh
@@ -63,10 +63,12 @@
 #
 # Targeting is EXACT: only a bare task id with a state/<id>.meta record in
 # THIS home is accepted, and the record must pass the shared endpoint-identity
-# validation (bin/fm-backend.sh's fm_backend_validate_task_endpoint). A legacy
+# validation (bin/fm-backend.sh's fm_backend_resolve_task_endpoint). A legacy
 # fm-<id> label, an explicit session:window endpoint, and a bare window name
 # are all refused - a lifecycle command delivered to the wrong endpoint is far
-# worse than a loud refusal.
+# worse than a loud refusal. A record predating the endpoint_task_id binding is
+# not refused outright: its identity is re-derived from the live endpoint's own
+# fm-<id> label and recorded, and only an unprovable one is refused.
 #
 # A remotely placed secondmate is refused by name: its agent runs on another
 # host, so no postcondition this plane verifies could be read for it here.
@@ -148,6 +150,8 @@ die() {  # <message>
 
 CONTROL_LOCK=
 CONTROL_LOCK_HELD=0
+CONTROL_META_LOCK=
+CONTROL_META_LOCK_HELD=0
 RELAUNCH_ACTIVE=0
 RELAUNCH_PHASE=start
 
@@ -157,6 +161,10 @@ control_cleanup() {
      && declare -F relaunch_rollback >/dev/null 2>&1; then
     relaunch_rollback || true
   fi
+  if [ "$CONTROL_META_LOCK_HELD" = 1 ]; then
+    CONTROL_META_LOCK_HELD=0
+    fm_lock_release "$CONTROL_META_LOCK" || true
+  fi
   if [ "$CONTROL_LOCK_HELD" = 1 ]; then
     CONTROL_LOCK_HELD=0
     fm_lock_release "$CONTROL_LOCK" || true
@@ -283,7 +291,22 @@ if [ -n "$(fm_meta_get "$META" remote_host)" ]; then
   die "task $ID is a remotely placed secondmate on $(fm_meta_get "$META" remote_host); its agent runs outside this home, so no lifecycle action here could verify that it interrupted, stopped, or came back. Drive its lifecycle on that host, and reconcile it through the secondmate recovery path rather than this plane"
 fi
 
-fm_backend_validate_task_endpoint "$META" "$ID" || exit 1
+# fm_backend_resolve_task_endpoint, not the bare offline validator: a record
+# written before endpoint_task_id existed carries no offline proof that its
+# opaque Herdr/Zellij/cmux endpoint is this task's, and refusing it outright
+# left an operator with no supported lifecycle action for a live agent at all -
+# only a hand-rolled kill. The resolver re-derives that binding from the live
+# endpoint's own fm-<id> label and records it, so this and every later call take
+# the ordinary offline path. It still refuses whenever the label cannot be
+# proven, and every other refusal is unchanged.
+CONTROL_META_LOCK=$(fm_meta_lock_path "$META") || exit 1
+fm_lock_acquire_wait "$CONTROL_META_LOCK"
+CONTROL_META_LOCK_HELD=1
+CONTROL_RESOLVE_RC=0
+fm_backend_resolve_task_endpoint "$META" "$ID" || CONTROL_RESOLVE_RC=$?
+fm_lock_release "$CONTROL_META_LOCK"
+CONTROL_META_LOCK_HELD=0
+[ "$CONTROL_RESOLVE_RC" -eq 0 ] || exit 1
 BACKEND=$FM_BACKEND_VALIDATED_BACKEND
 T=$FM_BACKEND_VALIDATED_TARGET
 LABEL="fm-$ID"
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index 4178217c91d..25b06b601e3 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -427,10 +427,26 @@ else
 fi
 [ "$remote_teardown_rc" -eq 3 ] || exit "$remote_teardown_rc"
 
-# This is the first cleanup authorization check. It is metadata-only and must
-# complete before fm-guard, a backend command, file removal, branch deletion,
-# worktree return, registry change, or process termination can run.
-fm_backend_validate_task_endpoint "$META" "$ID" || exit 1
+# This is the first cleanup authorization check. It must complete before
+# fm-guard, a backend command, file removal, branch deletion, worktree return,
+# registry change, or process termination can run.
+#
+# It decides from metadata alone, with one exception: a record written before
+# the endpoint_task_id binding existed carries no offline proof that its opaque
+# Herdr/Zellij/cmux endpoint is this task's, so fm_backend_resolve_task_endpoint
+# re-derives that one fact from the live endpoint's own fm-<id> label and
+# records it before the ordinary offline validation decides.
+#
+# The runtime QUERY is read-only, but on that recoverable legacy path the
+# resolver DOES write before the authorization check concludes: it appends the
+# single missing endpoint_task_id line to this task's own metadata record. That
+# write happens only after the live label proof succeeded, under the meta lock
+# this caller already holds, as a whole-file temp-file-plus-mv replace at mode
+# 0600, and it never overwrites an existing binding. It is metadata-only: no
+# project file, worktree, branch, endpoint, or process is touched here, so a
+# refusal on this line still leaves everything outside the task's own record
+# exactly as it was, ahead of every mutation above.
+fm_backend_resolve_task_endpoint "$META" "$ID" || exit 1
 BACKEND=$FM_BACKEND_VALIDATED_BACKEND
 T=$FM_BACKEND_VALIDATED_TARGET
 WT=$(fm_meta_get "$META" worktree)
@@ -2006,6 +2022,24 @@ preflight_descendant_task_locks() {
   done
 }
 
+# validate_firstmate_home_children_removal: authorize removal of every task
+# record inside a secondmate's own home, recursively.
+#
+# KNOWN LIMITATION, left for a follow-up. This loop deliberately uses the
+# OFFLINE fm_backend_validate_task_endpoint, so it does NOT get the legacy-record
+# recovery the top-level teardown path has. A secondmate home holding a child
+# record written before the endpoint_task_id binding existed (#1171) therefore
+# still refuses teardown on the first such child meta, with the same "lacks an
+# exact task binding" message. That is PRE-EXISTING behavior, not a regression
+# from the recovery work: those records refused identically before it, when the
+# same validator returned 1 instead of today's recoverable 2. It is not wired
+# here because fm_backend_resolve_task_endpoint requires the caller to hold THAT
+# child record's own meta lock before it writes, while teardown holds only the
+# parent task's, so correct wiring needs per-child locking inside a recursive
+# preflight that currently takes no locks at all - deliberately out of scope.
+# Operator workaround: run bin/fm-control.sh <child-id> exit or relaunch against
+# the secondmate's own home first, which upgrades that child record through the
+# resolver, then tear down.
 validate_firstmate_home_children_removal() {
   local home=$1 sub_state child_meta child_id child_wt child_proj child_kind child_home child_backend child_orca_worktree_id
   sub_state="$home/state"
@@ -2013,6 +2047,8 @@ validate_firstmate_home_children_removal() {
   for child_meta in "$sub_state"/*.meta; do
     [ -e "$child_meta" ] || continue
     child_id=$(basename "$child_meta" .meta)
+    # Offline validator by design; a legacy child record refuses here rather
+    # than being recovered - see this function's known limitation above.
     fm_backend_validate_task_endpoint "$child_meta" "$child_id" || return 1
     validate_pr_poll_cleanup "$sub_state" "$child_id" || return 1
     child_wt=$(meta_value "$child_meta" worktree)
@@ -2149,6 +2185,15 @@ $session	$lock_path"
   return 1
 }
 
+# preflight_firstmate_home_herdr_children: reserve every herdr endpoint inside a
+# secondmate's own home before anything is torn down, recursively.
+#
+# Carries the SAME known limitation as validate_firstmate_home_children_removal,
+# for the same reason and with the same operator workaround: this loop uses the
+# OFFLINE validator, so a pre-#1171 child record still refuses teardown here with
+# "lacks an exact task binding" instead of being recovered, which is pre-existing
+# rather than a regression, and wiring the resolver in would need per-child meta
+# locking this recursive preflight does not have. Left for a follow-up.
 preflight_firstmate_home_herdr_children() {  # <home>
   local home=$1 sub_state child_meta child_id child_backend child_target child_kind child_home child_wt
   sub_state="$home/state"
@@ -2156,6 +2201,8 @@ preflight_firstmate_home_herdr_children() {  # <home>
   for child_meta in "$sub_state"/*.meta; do
     [ -e "$child_meta" ] || continue
     child_id=$(basename "$child_meta" .meta)
+    # Offline validator by design; a legacy child record refuses here rather
+    # than being recovered - see this function's known limitation above.
     fm_backend_validate_task_endpoint "$child_meta" "$child_id" || return 1
     child_backend=$FM_BACKEND_VALIDATED_BACKEND
     child_target=$FM_BACKEND_VALIDATED_TARGET
diff --git a/docs/agent-control.md b/docs/agent-control.md
index af50ab75058..02a00e159ad 100644
--- a/docs/agent-control.md
+++ b/docs/agent-control.md
@@ -85,6 +85,8 @@ Switching harness is therefore one ordinary relaunch rather than a separate mech
 - Targeting is exact.
   Only a bare task id with a `state/<id>.meta` record in this home is accepted, and that record must pass the shared endpoint-identity validation.
   A legacy `fm-<id>` window label, an explicit `session:window` endpoint, and a record whose `endpoint_task_id` names another task are all refused.
+  A record predating that binding is not refused outright: its identity is re-derived from the live endpoint's own `fm-<id>` label and recorded, so the agent stays drivable through this plane, and only an endpoint whose label cannot be proven is refused.
+    That proof is full-chain on herdr, but on zellij and cmux it covers only the recorded tab or workspace label, and on cmux only within the currently focused window, so a cmux task whose workspace lives in another window is still refused.
 - A remotely placed secondmate is refused by name.
   Its agent runs on another host, so none of the postconditions this plane verifies could be read for it here; local endpoint validation would refuse the record regardless, because `window=remote:<id>` can never match a local backend's required shape.
   Drive that lifecycle on its own host and reconcile it through the secondmate recovery path.
diff --git a/docs/configuration.md b/docs/configuration.md
index 49ec6828714..cd4b0b3ab0a 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -79,9 +79,15 @@ Otherwise an exact task id matching `state/<id>.meta` wins before the legacy `fm
 A metadata-routed selector returns the recorded backend target (`terminal=` for Orca, otherwise `window=`), and matching explicit targets can still recover the recorded backend when metadata contains the same endpoint.
 Only metadata-routed task selectors carry secondmate-marker and Codex-harness context; explicit endpoint escape hatches do not.
 These five sentences are the single owner of the task-selector vocabulary; backend guides and other documents point here instead of restating the resolution order.
-`fm-teardown.sh <id>` takes a task id directly and validates the complete metadata-only endpoint identity before any runtime dispatch or cleanup mutation.
+`fm-teardown.sh <id>` takes a task id directly and validates the complete endpoint identity - from metadata alone, except for the legacy re-derivation described below - before any cleanup mutation or backend cleanup dispatch.
 Missing, empty, duplicate, malformed, backend-inconsistent, or task-mismatched endpoint records are preserved and refused.
-Legacy tmux metadata remains cleanup-compatible when its exact window name is `fm-<id>`; opaque non-tmux endpoints require their recorded `endpoint_task_id=` binding.
+Legacy tmux and Orca metadata remains cleanup-compatible without that binding, because its recorded window name is itself `fm-<id>` and so carries the task label.
+A legacy herdr, zellij, or cmux record records only opaque runtime ids, so nothing in the record binds it to its task; rather than stranding a live agent with no supported lifecycle action, `fm-teardown.sh` and `fm-control.sh` re-derive that binding from the live endpoint's own `fm-<id>` tab or workspace label, record it, and then validate normally.
+The runtime query itself is read-only, and the only write the re-derivation makes before the authorization decision is the one missing binding line appended to that task's own metadata record, never an existing binding and never a project file, worktree, branch, endpoint, or process.
+It refuses whenever the label cannot be proven to belong to exactly that recorded endpoint.
+The three backends are not equally covered: herdr proves the full recorded chain of workspace, pane, owning tab, and label, while zellij and cmux prove only that the recorded tab or workspace carries the label and never that the recorded pane or surface still belongs to it.
+A further known limitation is that the cmux proof reads only the currently focused window, so a cmux task whose workspace lives in another window is refused and stays stranded, and a same-titled workspace in another window is invisible to its uniqueness guard.
+A third known limitation: the recursive child loops that authorize teardown of a secondmate's own home use the offline validator only, so a child record predating the binding still refuses that teardown with the same message; this is pre-existing rather than new, and the workaround is to run `fm-control.sh <child-id> exit` or `relaunch` against the secondmate's home first, which upgrades that record, and then tear down.
 `FM_HOME` determines Herdr's home label: the primary home uses `firstmate`, and a secondmate home marked by `.fm-secondmate-home` uses `2ndmate-<secondmate-id>`.
 [`herdr-backend.md`](herdr-backend.md#watching-and-task-containers) owns launcher-bound workspace placement, the label-only fallback, collision handling, and recovery behavior.
 The local `config/herdr-presentation-spaces` file instead opts a home out of, or explicitly in to, Herdr's default-on disposable single-task visual projection; [Presentation spaces](herdr-backend.md#presentation-spaces) owns its accepted values, default, Herdr version floor, migration, behavior, safety limits, recovery contract, and narrow locked session-start cleanup of exact restored idle-shell children.
diff --git a/docs/verification/runtime-backends.md b/docs/verification/runtime-backends.md
index a413e9ffd73..c497adb321b 100644
--- a/docs/verification/runtime-backends.md
+++ b/docs/verification/runtime-backends.md
@@ -168,9 +168,24 @@ ok - process cleanup: creation-time PID identity removes only the exact child an
 ok - fm-teardown: dedicated-socket invalid cleanup preserves target/control and valid cleanup removes only the exact target
 ```
 
+The legacy-record half of that boundary was added on 2026-08-20 and pinned by the same portable suite, with `tests/fm-teardown-endpoint-safety.test.sh` run on Linux 6.18 with ShellCheck 0.11.0:
+
+```text
+ok - cleanup identity: a legacy non-tmux record is recoverable through a live label proof, and refuses without one
+```
+
+That case drives a canned herdr CLI, so it pins the decision logic, not herdr's own response shape.
+The live half is `tests/fm-backend-herdr-smoke.test.sh`, which exercises the same proof against a real herdr server in an isolated lab session and refreshes this row; it self-skips where herdr is not installed and has not been run for this row yet.
+
 The dedicated tmux cell removed ambient tmux variables, required a socket-bound wrapper, kept one target and one independent control window, and proved the wrapper was not called for invalid metadata or a direct empty target.
 Valid cleanup removed only the exact task-bound target and left the control window live.
 The metadata-only validation covers tmux, Herdr, Zellij, Orca, and cmux before backend dispatch.
+Its one exception is a record predating the `endpoint_task_id` binding on an opaque-id backend: that record carries no offline proof of its own task, so instead of being refused with no recoverable outcome, its binding is re-derived from one read-only query of the live endpoint's own `fm-<id>` label and recorded before the ordinary metadata-only validation decides.
+A tmux or Orca record needs no such query, because its recorded window name is already `fm-<id>`.
+That query proves the full recorded chain only on herdr; on zellij and cmux it proves just the recorded tab or workspace label, not that the recorded pane or surface still belongs to it, and the cmux proof additionally reads only the currently focused window, so a cmux task whose workspace lives elsewhere is refused and stays stranded.
+Both are known limitations left for a follow-up; in every unproven case the outcome is refusal, never action on an unproven endpoint.
+Only the herdr branch of that proof has executable coverage; the zellij branch and cmux's workspace matcher have none, so their refusal behavior is established by code reading alone and a test for them is left for a follow-up.
+The recursive child loops in `fm-teardown.sh` also keep using the offline validator, so a legacy child record inside a secondmate home still refuses that teardown, pre-existing and likewise left for a follow-up.
 Claude, Codex, OpenCode, Pi, pi-signed, Grok, Kimi, Cursor, and Muse share that backend cleanup boundary; their harness-specific hook files, tokens, transcript bindings, and session-log sidecars are cleaned only after it, so no harness needs a separate endpoint parser.
 
 ## Composer classification matrix
diff --git a/tests/fm-backend-herdr-smoke.test.sh b/tests/fm-backend-herdr-smoke.test.sh
index 98f1db2e974..7be4180a60d 100755
--- a/tests/fm-backend-herdr-smoke.test.sh
+++ b/tests/fm-backend-herdr-smoke.test.sh
@@ -101,6 +101,26 @@ printf '%s' "$POST_CREATE_TABS" | jq -e --arg t "$SEEDED_TAB_ID" '.result.tabs[]
   && fail "the seeded default tab ($SEEDED_TAB_ID) should have been pruned but is still present: $POST_CREATE_TABS"
 pass "real herdr: create_task prunes the freshly-created workspace's seeded default tab, leaving exactly one clean fm-<id> task tab"
 
+# --- endpoint label proof (legacy-record identity re-derivation) --------------
+#
+# fm_backend_endpoint_label_provable's whole value is that it reads a REAL
+# herdr server, so a canned fixture can only ever confirm the shape this test
+# assumes. Prove the chain against the live binary: the recorded pane must sit
+# in the recorded workspace, report the recorded tab as its owner, and that tab
+# must uniquely carry the fm-<id> label. Then break each link in turn.
+WSID=${CONTAINER#*:}
+fm_backend_herdr_tab_matches_label "$SESSION" "$WSID" "$TAB_ID" "$PANE_ID" "$LABEL" \
+  || fail "the live endpoint chain for $LABEL should prove its own label"
+fm_backend_herdr_tab_matches_label "$SESSION" "$WSID" "$TAB_ID" "$PANE_ID" "fm-not-this-task" \
+  && fail "a label the live tab does not carry must not be provable"
+fm_backend_herdr_tab_matches_label "$SESSION" "$WSID" "$TAB_ID" "no-such-pane" "$LABEL" \
+  && fail "a pane absent from the recorded workspace must not be provable"
+fm_backend_herdr_tab_matches_label "$SESSION" "$WSID" "no-such-tab" "$PANE_ID" "$LABEL" \
+  && fail "a pane whose owning tab is not the recorded one must not be provable"
+fm_backend_herdr_tab_matches_label "$SESSION" "no-such-workspace" "$TAB_ID" "$PANE_ID" "$LABEL" \
+  && fail "a workspace that does not exist must not be provable"
+pass "real herdr: the endpoint label proof accepts the exact recorded workspace/pane/tab/label chain and refuses every broken link"
+
 # NOTE: create_task no longer refuses EVERY same-labeled duplicate
 # unconditionally - a same-labeled tab whose pane hosts no registered agent is
 # now a close-and-replace candidate (the restored-layout husk fix below), so
diff --git a/tests/fm-teardown-endpoint-safety.test.sh b/tests/fm-teardown-endpoint-safety.test.sh
index b08420fc51d..bce401d64fb 100755
--- a/tests/fm-teardown-endpoint-safety.test.sh
+++ b/tests/fm-teardown-endpoint-safety.test.sh
@@ -372,3 +372,199 @@ test_supported_backend_endpoint_records_validate
 test_tmux_empty_target_refuses_without_invocation
 test_recorded_process_identity_cleanup_is_exact
 test_isolated_tmux_invalid_and_valid_cleanup
+
+# --- legacy endpoint records ------------------------------------------------
+#
+# Records written before endpoint_task_id existed (bin/fm-spawn.sh gained it in
+# #1171) still exist in live homes. On tmux and Orca they were always fine: the
+# recorded window name IS fm-<id>, so the record carries its own task label. On
+# Herdr, Zellij, and cmux the recorded ids are opaque, so those records were
+# refused outright - which stranded a LIVE agent with no supported lifecycle
+# action at all. These cases pin both directions of the replacement behavior:
+# the offline validator still refuses such a record on its own (now with the
+# recoverable code 2), and fm_backend_resolve_task_endpoint accepts it only when
+# the live endpoint proves it carries the task's own fm-<id> label.
+
+# make_herdr_label_fakebin: a `herdr` stub answering the two read-only list
+# calls the label proof makes, from files the case writes. A call with no
+# matching file fails, so a proof that asks for something unscripted refuses.
+make_herdr_label_fakebin() {  # <dir>
+  local fb="$1/fakebin"
+  mkdir -p "$fb"
+  cat > "$fb/herdr" <<'SH'
+#!/usr/bin/env bash
+set -u
+{
+  printf 'herdr'
+  for a in "$@"; do printf ' <%s>' "$a"; done
+  printf '\n'
+} >> "${FM_HERDR_CALLS:?}"
+case "${1:-}:${2:-}" in
+  pane:list) f="${FM_HERDR_FIXTURES:?}/panes.json" ;;
+  tab:list) f="${FM_HERDR_FIXTURES:?}/tabs.json" ;;
+  *) exit 1 ;;
+esac
+[ -f "$f" ] || exit 1
+cat "$f"
+SH
+  chmod +x "$fb/herdr"
+}
+
+write_legacy_herdr_meta() {  # <dir> <id>
+  local dir=$1 id=$2
+  fm_write_meta "$dir/home/state/$id.meta" \
+    "window=lab:w1:p2" "worktree=$dir/worktree" "project=$dir/project" \
+    "backend=herdr" "herdr_session=lab" "herdr_workspace_id=w1" \
+    "herdr_tab_id=w1:t2" "herdr_pane_id=w1:p2"
+}
+
+# The proven shape: the recorded pane lives in the recorded workspace, reports
+# the recorded tab as its owner, and that tab - uniquely - is labeled fm-<id>.
+write_matching_herdr_fixtures() {  # <dir> <id>
+  local dir=$1 id=$2
+  mkdir -p "$dir/fixtures"
+  printf '{"result":{"panes":[{"pane_id":"w1:p2","tab_id":"w1:t2"}]}}\n' > "$dir/fixtures/panes.json"
+  printf '{"result":{"tabs":[{"tab_id":"w1:t2","label":"fm-%s"}]}}\n' "$id" > "$dir/fixtures/tabs.json"
+}
+
+# run_endpoint_check <dir> <id> <function> -> prints "rc=<n>", diagnostics to
+# <dir>/<function>.err. Runs in its own shell so a case's PATH, fake CLI, and
+# home never leak into the next one.
+run_endpoint_check() {
+  local dir=$1 id=$2 fn=$3
+  # shellcheck disable=SC2016 # The inner script takes its inputs positionally.
+  env PATH="$dir/fakebin:$PATH" FM_HERDR_CALLS="$dir/herdr.calls" \
+    FM_HERDR_FIXTURES="$dir/fixtures" FM_ROOT_OVERRIDE="$ROOT" FM_HOME="$dir/home" \
+    bash -c '
+      set -u
+      # shellcheck source=/dev/null
+      . "$1/bin/fm-backend.sh"
+      # shellcheck source=/dev/null
+      . "$1/bin/fm-wake-lib.sh"
+      "$4" "$2" "$3"
+      printf "rc=%s\n" "$?"
+    ' _ "$ROOT" "$dir/home/state/$id.meta" "$id" "$fn" 2> "$dir/$fn.err"
+}
+
+run_resolve() {  # <dir> <id>
+  run_endpoint_check "$1" "$2" fm_backend_resolve_task_endpoint
+}
+
+run_validate() {  # <dir> <id>
+  run_endpoint_check "$1" "$2" fm_backend_validate_task_endpoint
+}
+
+test_legacy_endpoint_records_are_recoverable_not_stranded() {
+  local dir id out
+
+  # 1. The exact reported refusal: a legacy Herdr record, internally consistent
+  #    in every other respect, is still refused offline - and now says so with
+  #    the recoverable code 2 rather than the terminal 1.
+  dir=$(make_case legacy-herdr-offline)
+  id=legacy-herdr
+  write_legacy_herdr_meta "$dir" "$id"
+  out=$(run_validate "$dir" "$id")
+  [ "$out" = "rc=2" ] || fail "a legacy Herdr record should refuse offline as recoverable (code 2), got '$out'"
+  grep -q "legacy Herdr endpoint metadata for task $id lacks an exact task binding" \
+    "$dir/fm_backend_validate_task_endpoint.err" \
+    || fail "the offline refusal should name the missing binding: $(cat "$dir/fm_backend_validate_task_endpoint.err")"
+
+  # 2. A legacy Orca record was never ambiguous - its recorded window IS
+  #    fm-<id> - so it validates offline with no binding and no live read.
+  dir=$(make_case legacy-orca)
+  id=legacy-orca
+  fm_write_meta "$dir/home/state/$id.meta" \
+    "window=fm-$id" "terminal=term-7" "worktree=$dir/worktree" "project=$dir/project" \
+    "backend=orca" "orca_worktree_id=worktree-9"
+  out=$(run_validate "$dir" "$id")
+  [ "$out" = "rc=0" ] || fail "a legacy Orca record carries its own task label and must validate, got '$out'"
+
+  # 3. Recovery: the live endpoint proves the recorded chain ends at a tab
+  #    labeled fm-<id>, so the binding is re-derived, recorded, and the record
+  #    validates. The upgrade is durable - a second resolve needs no live read.
+  dir=$(make_case legacy-herdr-provable)
+  id=legacy-herdr
+  make_herdr_label_fakebin "$dir"
+  write_legacy_herdr_meta "$dir" "$id"
+  write_matching_herdr_fixtures "$dir" "$id"
+  out=$(run_resolve "$dir" "$id")
+  [ "$out" = "rc=0" ] || fail "a provable legacy Herdr record should resolve, got '$out': $(cat "$dir/fm_backend_resolve_task_endpoint.err")"
+  grep -Fqx "endpoint_task_id=$id" "$dir/home/state/$id.meta" \
+    || fail "resolving should have recorded the re-derived binding"
+  : > "$dir/herdr.calls"
+  out=$(run_resolve "$dir" "$id")
+  [ "$out" = "rc=0" ] || fail "the upgraded record should validate, got '$out': $(cat "$dir/fm_backend_resolve_task_endpoint.err")"
+  [ ! -s "$dir/herdr.calls" ] || fail "an upgraded record must take the offline path: $(cat "$dir/herdr.calls")"
+
+  # 4. The other direction. Each of these live shapes leaves the endpoint
+  #    genuinely unidentifiable, so every one refuses and writes no binding.
+  local case_name
+  for case_name in relabeled reparented duplicated missing unreachable; do
+    dir=$(make_case "legacy-herdr-$case_name")
+    id=legacy-herdr
+    write_legacy_herdr_meta "$dir" "$id"
+    write_matching_herdr_fixtures "$dir" "$id"
+    case "$case_name" in
+      relabeled)
+        printf '{"result":{"tabs":[{"tab_id":"w1:t2","label":"fm-other"}]}}\n' > "$dir/fixtures/tabs.json" ;;
+      reparented)
+        printf '{"result":{"panes":[{"pane_id":"w1:p2","tab_id":"w1:t9"}]}}\n' > "$dir/fixtures/panes.json" ;;
+      duplicated)
+        printf '{"result":{"tabs":[{"tab_id":"w1:t2","label":"fm-%s"},{"tab_id":"w1:t3","label":"fm-%s"}]}}\n' \
+          "$id" "$id" > "$dir/fixtures/tabs.json" ;;
+      missing)
+        printf '{"result":{"panes":[]}}\n' > "$dir/fixtures/panes.json" ;;
+      unreachable)
+        rm -f "$dir/fixtures/panes.json" "$dir/fixtures/tabs.json" ;;
+    esac
+    make_herdr_label_fakebin "$dir"
+    out=$(run_resolve "$dir" "$id")
+    [ "$out" = "rc=1" ] \
+      || fail "an unprovable legacy Herdr endpoint ($case_name) must refuse, got '$out': $(cat "$dir/fm_backend_resolve_task_endpoint.err")"
+    grep -q '^endpoint_task_id=' "$dir/home/state/$id.meta" \
+      && fail "an unprovable endpoint ($case_name) must not be bound"
+    grep -q "could not prove from the live endpoint" "$dir/fm_backend_resolve_task_endpoint.err" \
+      || fail "the refusal ($case_name) should name the failed proof: $(cat "$dir/fm_backend_resolve_task_endpoint.err")"
+  done
+
+  # 5. A record naming ANOTHER task is not a legacy record and is never
+  #    laundered by the recovery path: it stays a terminal refusal, with no
+  #    live read attempted at all.
+  dir=$(make_case foreign-binding)
+  id=legacy-herdr
+  make_herdr_label_fakebin "$dir"
+  write_legacy_herdr_meta "$dir" "$id"
+  write_matching_herdr_fixtures "$dir" "$id"
+  printf 'endpoint_task_id=other\n' >> "$dir/home/state/$id.meta"
+  out=$(run_resolve "$dir" "$id")
+  [ "$out" = "rc=1" ] || fail "a record bound to another task must refuse, got '$out': $(cat "$dir/fm_backend_resolve_task_endpoint.err")"
+  grep -q "belongs to task other" "$dir/fm_backend_resolve_task_endpoint.err" \
+    || fail "the refusal should name the conflicting binding: $(cat "$dir/fm_backend_resolve_task_endpoint.err")"
+  [ ! -s "$dir/herdr.calls" ] || fail "a foreign binding must trigger no live read: $(cat "$dir/herdr.calls")"
+  grep -Fqx "endpoint_task_id=other" "$dir/home/state/$id.meta" \
+    || fail "the conflicting binding must be left exactly as found"
+
+  # 6. A legacy record whose last line has no trailing newline - task records
+  #    are line-oriented, so binding one must not fuse the new line onto the
+  #    last pre-existing field and lose both.
+  dir=$(make_case legacy-herdr-no-trailing-newline)
+  id=legacy-herdr
+  make_herdr_label_fakebin "$dir"
+  write_legacy_herdr_meta "$dir" "$id"
+  write_matching_herdr_fixtures "$dir" "$id"
+  printf '%s' "$(cat "$dir/home/state/$id.meta")" > "$dir/home/state/$id.meta"
+  out=$(run_resolve "$dir" "$id")
+  [ "$out" = "rc=0" ] || fail "a legacy record without a trailing newline should resolve, got '$out': $(cat "$dir/fm_backend_resolve_task_endpoint.err")"
+  grep -Fqx "herdr_pane_id=w1:p2" "$dir/home/state/$id.meta" \
+    || fail "binding must leave the last pre-existing field intact: $(cat "$dir/home/state/$id.meta")"
+  grep -Fqx "endpoint_task_id=$id" "$dir/home/state/$id.meta" \
+    || fail "the re-derived binding must be its own line: $(cat "$dir/home/state/$id.meta")"
+  : > "$dir/herdr.calls"
+  out=$(run_validate "$dir" "$id")
+  [ "$out" = "rc=0" ] || fail "the bound record should validate offline, got '$out': $(cat "$dir/fm_backend_validate_task_endpoint.err")"
+  [ ! -s "$dir/herdr.calls" ] || fail "offline validation must make no live call: $(cat "$dir/herdr.calls")"
+
+  pass "cleanup identity: a legacy non-tmux record is recoverable through a live label proof, and refuses without one"
+}
+
+test_legacy_endpoint_records_are_recoverable_not_stranded