diff --git a/.no-mistakes.yaml b/.no-mistakes.yaml
index 10a1c9bef28..aed6d79ef8c 100644
--- a/.no-mistakes.yaml
+++ b/.no-mistakes.yaml
@@ -40,6 +40,8 @@ test:
     Run live Herdr scenarios only through bin/fm-herdr-lab.sh with a named non-default fm-lab-* session, following that helper's prepare, provision, run, and teardown contract exactly.
     Never touch the live default Herdr session or fleet panes.
     Prefer a throwaway lab for spawn, long-launch, and Claude-path proofs, and tear it down in the same evidence turn.
+    Use `LAB=$(bin/fm-lab-home.sh create <label>)` to create the disposable home and `bin/fm-lab-home.sh teardown "$LAB"` to remove it; the helper's header owns the marker and binding contract, and bin/fm-gate-refuse-lib.sh owns gate authorization.
+    To run a real primary inside the gate: create the lab, write the scenario's opt-in flag (e.g. `touch $LAB/config/supervision-host`), then, from the run worktree, start the harness CLI as the session command on the lab's private tmux socket: `mkdir -p $LAB/tmux && env -u NO_MISTAKES_GATE TMUX_TMPDIR=$LAB/tmux tmux -L fm-lab new-session -d -s primary -c "$PWD" -e FM_HOME=$LAB <cli>`, where <cli> is the harness's own launch command using the machine's existing login: claude -> `claude`, codex -> `codex`, cursor -> `cursor-agent`, opencode -> `opencode`, grok -> `grok`, omp -> `omp`. Drive, inspect, and stop that primary only through the same socket - `TMUX_TMPDIR=$LAB/tmux tmux -L fm-lab send-keys -t primary ...`, `TMUX_TMPDIR=$LAB/tmux tmux -L fm-lab capture-pane -p -t primary`, `TMUX_TMPDIR=$LAB/tmux tmux -L fm-lab kill-server` - never the default tmux server; the firstmate scripts the primary runs inherit $TMUX from its pane, which names that same fm-lab socket inside the lab. For a Herdr primary use a named non-default fm-lab-* session via bin/fm-herdr-lab.sh instead, and record it in the lab as soon as it is provisioned with `bin/fm-lab-home.sh record-herdr-session $LAB <session>` - the gate accepts only a Herdr session recorded for the FM_HOME's own lab. The gate marker is scrubbed (env -u NO_MISTAKES_GATE) because the lab primary is a fixture firstmate, not a gate agent. If the harness CLI is absent or its login is unavailable, report the scenario untested; never fake the CLI, the login, or the evidence.
     Do not mutate the operator primary checkout, real fleet FM_HOME state, or production credentials, and keep git changes otherwise inside the run worktree.
     Read docs/herdr-backend.md and the bin/fm-herdr-lab.sh header as the owners of Herdr lab mechanics rather than reproducing that manual here.
     Ship or scout briefs that will drive Herdr lifecycle still require --herdr-lab at scaffold time; these Test-agent instructions are not a substitute for that brief flag.
diff --git a/bin/fm-afk-launch.sh b/bin/fm-afk-launch.sh
index 829d362146c..e5562859499 100755
--- a/bin/fm-afk-launch.sh
+++ b/bin/fm-afk-launch.sh
@@ -190,6 +190,19 @@ fm_afk_launch_usage() {
 }
 
 fm_afk_launch_primary_harness() {
+  # Test seam: FM_TEST_HARNESS names the simulated harness for suites that
+  # invoke this launch path directly (tests/fm-afk-launch.test.sh). It is
+  # honored only alongside FM_TEST_SEAM=1, the marker test suites set, so a
+  # leaked variable in a real primary's environment stays inert. Only an
+  # exact known-harness token is honored, so a stray or mistyped value falls
+  # through to real detection; bin/fm-harness.sh's production detect_own
+  # precedence never reads either variable.
+  case "${FM_TEST_SEAM:-}${FM_TEST_SEAM:+ }${FM_TEST_HARNESS:-}" in
+    "1 claude" | "1 codex" | "1 opencode" | "1 pi" | "1 pi-signed" | "1 grok" | "1 kimi" | "1 cursor" | "1 gemini" | "1 muse" | "1 rovo" | "1 omp" | "1 agy" | "1 devin" | "1 unknown")
+      printf '%s' "$FM_TEST_HARNESS"
+      return
+      ;;
+  esac
   "$FM_AFK_LAUNCH_DIR/fm-harness.sh" 2>/dev/null || printf unknown
 }
 
diff --git a/bin/fm-control.sh b/bin/fm-control.sh
index aa4c9af2004..49f112164b8 100755
--- a/bin/fm-control.sh
+++ b/bin/fm-control.sh
@@ -145,9 +145,10 @@ esac
 
 # shellcheck source=bin/fm-gate-refuse-lib.sh
 . "$SCRIPT_DIR/fm-gate-refuse-lib.sh"
-# Fail closed before any fleet mutation: a no-mistakes gate agent must never
-# drive a crewmate's lifecycle (see bin/fm-gate-refuse-lib.sh).
-fm_refuse_if_gate_agent
+# Refuse gate-context lifecycle calls unless the target is a verified lab
+# (see bin/fm-gate-refuse-lib.sh). The backend comes from recorded task
+# metadata, not the environment, so the env-backend check is skipped.
+fm_refuse_if_gate_agent . '' 1
 
 if [ -z "${FM_HOME+x}" ] || [ -z "${FM_HOME:-}" ]; then
   echo "error: FM_HOME is not set; fm-control refuses to resolve a task without an explicit firstmate home" >&2
@@ -341,6 +342,8 @@ fi
 fm_backend_validate_task_endpoint "$META" "$ID" || exit 1
 BACKEND=$FM_BACKEND_VALIDATED_BACKEND
 T=$FM_BACKEND_VALIDATED_TARGET
+fm_gate_lab_assert_backend "$BACKEND"
+fm_gate_lab_assert_target "$BACKEND" "$T"
 LABEL="fm-$ID"
 RECORDED_HARNESS=$(fm_meta_get "$META" harness)
 KIND=$(fm_meta_get "$META" kind)
diff --git a/bin/fm-gate-refuse-lib.sh b/bin/fm-gate-refuse-lib.sh
index 8e624408a5e..795aba6cd88 100644
--- a/bin/fm-gate-refuse-lib.sh
+++ b/bin/fm-gate-refuse-lib.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 # fm-gate-refuse-lib.sh - fail-closed refusal that keeps a no-mistakes GATE agent
-# out of firstmate's fleet lifecycle.
+# out of firstmate's fleet lifecycle, with ONE structurally scoped exception:
+# a disposable lab home created by bin/fm-lab-home.sh.
 #
 # The hazard (data/nm-gate-ambient-authority-containment-c3/report.md): a
 # no-mistakes gate agent runs inside a firstmate checkout with a free shell, so
@@ -13,10 +14,11 @@
 # instructions and stamps NO_MISTAKES_GATE into the gate agent's environment).
 # THIS is the firstmate capability-removal half: an enforceable script refusal,
 # not a prose rule the neutralized agent would never read. It is sourced at the
-# top of the three fleet-lifecycle entrypoints and called before any fleet
-# mutation, so a gate agent that still reaches for the fleet is stopped cold.
+# top of the fleet-lifecycle entrypoints and called before any fleet mutation,
+# so a gate agent that still reaches for the fleet is stopped cold.
 #
-# Two independent signals, either of which refuses (fail closed):
+# Two independent gate signals, either of which engages the boundary
+# (fail closed):
 #
 #   1. NO_MISTAKES_GATE set - the durable env marker no-mistakes stamps into every
 #      gate agent. This is the primary signal and covers a relocated NM_HOME.
@@ -32,29 +34,79 @@
 # crew worktree - has NEITHER signal and is COMPLETELY unaffected: the function
 # returns 0 and the lifecycle proceeds exactly as before.
 #
-# This mirrors the unspoofable-marker precedent in bin/fm-marker-lib.sh: a signal
-# the agent cannot forge, keyed on at a chokepoint, keeping the pattern familiar
-# to firstmate maintainers. It layers ABOVE no-mistakes' separately-shipping
-# HEAD-continuity guard, which remains the adversarial/residual backstop.
+# ==== STRUCTURAL LAB AUTHORIZATION ====
 #
-# TEST-HARNESS ESCAPE HATCH (FM_GATE_REFUSE_BYPASS=1): firstmate's own test suite
-# must exercise the REAL fm-spawn/fm-send/fm-teardown, but the no-mistakes gate
-# runs that suite FROM a gate worktree (cwd git-common-dir under
-# .no-mistakes/repos/*.git, and possibly NO_MISTAKES_GATE set) - the exact
-# environment this guard refuses. So both signals would fire during firstmate's
-# own validation and break unrelated tests. FM_GATE_REFUSE_BYPASS=1 makes the
-# guard a no-op; firstmate's shared test helpers (tests/lib.sh and the backend
-# safety helpers) export it, so every test that drives these scripts against its
-# temp-sandbox fleet is exempt. This does NOT weaken the boundary against the
-# real hazard: the threat is a CONFUSED-not-adversarial gate agent that runs
-# bin/fm-spawn.sh directly after adopting firstmate's identity - it never sources
-# firstmate's test helpers, so it never carries the bypass; and the adversarial
-# case (an agent that would deliberately set it) is covered by no-mistakes'
-# neutral-execution-context and the HEAD-continuity guard. The dedicated
-# tests/fm-gate-refuse.test.sh strips the bypass so it still verifies real refusal.
+# When a gate signal IS present, one and only one path authorizes a lifecycle
+# call: every condition below must hold, proven from on-disk structure, and any
+# uncertainty refuses. This replaces the retired FM_GATE_REFUSE_BYPASS env
+# escape hatch, which authorized on the honor system and could not tell a
+# disposable lab from the real fleet.
+#
+#   fm_gate_lab_authorize requires ALL of:
+#
+#   1. FM_HOME (or the caller's resolved home) is a disposable lab home:
+#      bin/fm-lab-home.sh's fm_lab_home_verify must prove a marked lab dir that
+#      carries .fm-lab-home, whose marker token binds back to that exact
+#      canonical dir in the helper's state, and which canonically lives under
+#      the temp root ${TMPDIR:-/tmp}. A copied or forged marker fails: the
+#      binding names the dir the token was minted for.
+#   2. Neither the home nor its lab root is the primary git checkout.
+#      The effective state and data dirs (FM_STATE_OVERRIDE/FM_DATA_OVERRIDE,
+#      else $FM_HOME/state and $FM_HOME/data) must resolve inside the lab dir
+#      too, symlinks followed - they hold the task records and data the call
+#      writes, so a dir outside the lab would reach real fleet state.
+#   3. The home's own secondmate registry (data/secondmates.md) binds only
+#      lab-contained local homes; a remote record additionally requires the
+#      ssh transport to resolve inside the lab (FM_SSH_BIN or `ssh` under the
+#      lab dir). A malformed registry refuses.
+#   4. The checkout's real registry ($FM_ROOT/data/secondmates.md) binds
+#      nothing inside the lab dir - the lab home must not be a registered
+#      real secondmate.
+#   5. The backend the call could reach is the lab's own isolated target -
+#      a socket dir or tool must resolve inside THIS lab dir, never another
+#      marked lab:
+#      - herdr: HERDR_SESSION names an fm-lab-* session recorded in THIS
+#        lab's binding record (bin/fm-lab-home.sh record-herdr-session), or
+#        `herdr` resolves inside the lab (a fixture tool). A real default
+#        session or another lab's session is never authorized; without a
+#        lab-local tool, a missing or unreadable record refuses.
+#      - tmux: TMUX_TMPDIR resolves inside the lab (private socket dir), or
+#        `tmux` resolves inside the lab. An ambient $TMUX naming a live socket
+#        outside the lab refuses, since pane targeting would hit a real
+#        server. The default tmux server is never authorized.
+#      - zellij/orca/cmux: the tool resolves inside the lab only - there is
+#        no lab-safe isolation for the real tools.
+#      - remote secondmates: ssh resolves inside the lab.
+#      The resolved backend is read exactly as fm_backend_name does:
+#      FM_BACKEND, then config/backend, then runtime markers (HERDR_ENV,
+#      CMUX_WORKSPACE_ID), else tmux.
+#   6. Every task record in the lab's state dir ($FM_HOME/state or
+#      FM_STATE_OVERRIDE) stays bound to the lab: a recorded secondmate
+#      home= canonicalizes inside the lab dir, backend= plus
+#      herdr_session= satisfy the same isolation rules, remote_host=
+#      requires ssh in the lab, and a non-regular .meta file refuses.
+#      The scan descends into every secondmate record's home, the same
+#      descendant homes recursive teardown enters: each must lie inside the
+#      lab with its state and data dirs (symlinks followed), and its records
+#      pass the same rules; a descendant cycle refuses.
+#      worktree= and project= are deliberately NOT location-checked:
+#      a real treehouse or Orca spawn legitimately lands its worktree in
+#      the shared pool outside the lab dir, so pinning it inside would
+#      force every lab spawn onto a fake pool - the authorized proof is
+#      the lab home plus the isolated backend target, nothing more.
+#
+# Post-resolution assertions (fm_gate_lab_assert_*): authorization at refusal
+# time can only see the environment, so entrypoints re-assert once arguments
+# resolve the true target - the resolved backend and fm-send's resolved
+# endpoint - inside the lab boundary. These are no-ops outside an authorized
+# lab call.
+#
+# Everything else stays refused exactly as before: a real home keeps refusing
+# even with a copied marker, a malformed or incomplete lab refuses, and a
+# default-session or real-server target refuses.
 #
 # Sourced by bin/fm-spawn.sh, bin/fm-send.sh, bin/fm-teardown.sh,
-# bin/fm-sessionstart-nudge.sh, and the tests.
+# bin/fm-control.sh, bin/fm-sessionstart-nudge.sh, and the tests.
 # No side effects on source. set -u / set -e safe. The refusal is a hard exit,
 # not a return, because there is no safe way to continue a fleet mutation from a
 # gate context.
@@ -63,14 +115,16 @@
 # test as "the gate refusal fired" rather than an ordinary usage error.
 FM_GATE_REFUSE_EXIT=3
 
+# Set by fm_gate_lab_authorize on success: the verified lab dir, and the last
+# authorization-failure reason (for the refusal note and tests).
+FM_GATE_LAB_DIR=
+FM_GATE_LAB_REASON=
+
 # fm_is_gate_agent: return 0 without output when this process looks like a
 # no-mistakes gate agent. An optional root anchors the git-common-dir check;
 # callers that omit it retain the historical current-worktree behavior.
 fm_is_gate_agent() {
   local anchor=${1:-.} common
-  if [ "${FM_GATE_REFUSE_BYPASS:-}" = 1 ]; then
-    return 1
-  fi
   if [ "${NO_MISTAKES_GATE+x}" = x ]; then
     FM_GATE_REFUSE_REASON='env'
     return 0
@@ -87,16 +141,396 @@ fm_is_gate_agent() {
   return 1
 }
 
+# --- lab authorization internals ---------------------------------------------
+
+# Lazy-source the helper libs the authorization needs. Only runs inside a gate
+# context, so a normal firstmate session never pays for it.
+fm_gate_lab_deps() {
+  local dir
+  dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P) || return 1
+  # shellcheck source=bin/fm-lab-home.sh
+  . "$dir/fm-lab-home.sh" || return 1
+  # shellcheck source=bin/fm-secondmate-registry-lib.sh
+  . "$dir/fm-secondmate-registry-lib.sh" || return 1
+  # shellcheck source=bin/fm-secondmate-parent-lib.sh
+  . "$dir/fm-secondmate-parent-lib.sh" || return 1
+}
+
+fm_gate_lab_fail() { # <reason>
+  FM_GATE_LAB_REASON=$1
+  return 1
+}
+
+# Canon-resolve a path (symlinks followed; existing dir, or parent-canon +
+# basename) and require it to live inside the authorized lab dir. Used for
+# the home's own records and state/data dirs, and for backend containment: a
+# private socket dir or fixture tool must belong to this lab, not merely to
+# some marked lab, and a lab-local symlink to an outside tool is not lab-local.
+fm_gate_lab_path_inside() { # <path>
+  local c
+  c=$(fm_lab_home_canon_loose "$1" 2>/dev/null) || return 1
+  case "$c" in
+    "$FM_GATE_LAB_DIR" | "$FM_GATE_LAB_DIR"/*) return 0 ;;
+  esac
+  return 1
+}
+
+# A tool binary that canonically resolves inside the lab dir (a fixture
+# fake). With no argument override, PATH resolution decides - a missing tool
+# fails closed since it cannot be proven lab-contained.
+fm_gate_lab_bin_inside() { # <tool> [explicit-path]
+  local tool=$1 bin=${2:-}
+  if [ -z "$bin" ]; then
+    bin=$(command -v "$tool" 2>/dev/null) || return 1
+  fi
+  [ -n "$bin" ] || return 1
+  fm_gate_lab_path_inside "$bin"
+}
+
+# tmux containment: the server the call would reach must be private to the
+# lab - TMUX_TMPDIR inside the lab dir (private socket dir) or a lab-local
+# `tmux` binary. An ambient $TMUX naming a live socket outside the lab
+# refuses: pane targeting would hit a real server.
+fm_gate_lab_tmux_ok() {
+  local sock
+  if [ -n "${TMUX:-}" ]; then
+    sock=${TMUX%%,*}
+    case "$sock" in
+      /*)
+        if [ -e "$sock" ]; then
+          fm_gate_lab_path_inside "$sock" || return 1
+        fi
+        ;;
+    esac
+  fi
+  if [ -n "${TMUX_TMPDIR:-}" ] && fm_gate_lab_path_inside "$TMUX_TMPDIR"; then
+    return 0
+  fi
+  fm_gate_lab_bin_inside tmux
+}
+
+# A Herdr session this lab recorded when it provisioned it. Another lab's
+# session, the default session, or a missing record never matches.
+fm_gate_lab_herdr_session_ok() { # <session>
+  fm_lab_home_has_herdr_session "$FM_GATE_LAB_DIR" "$1"
+}
+
+# herdr containment: a Herdr session recorded for this lab, or a lab-local
+# `herdr` binary. The default session is never authorized.
+fm_gate_lab_herdr_ok() {
+  fm_gate_lab_herdr_session_ok "${HERDR_SESSION:-}" && return 0
+  fm_gate_lab_bin_inside herdr
+}
+
+# Remote-route containment: the ssh transport (FM_SSH_BIN or PATH ssh) must
+# resolve inside the lab.
+fm_gate_lab_remote_ok() {
+  fm_gate_lab_bin_inside ssh "${FM_SSH_BIN:-}"
+}
+
+fm_gate_lab_backend_ok() { # <backend>
+  case "$1" in
+    tmux) fm_gate_lab_tmux_ok ;;
+    herdr) fm_gate_lab_herdr_ok ;;
+    zellij) fm_gate_lab_bin_inside zellij ;;
+    orca) fm_gate_lab_bin_inside orca ;;
+    cmux) fm_gate_lab_bin_inside cmux ;;
+    remote) fm_gate_lab_remote_ok ;;
+    *) return 1 ;;
+  esac
+}
+
+# The backend a NEW spawn would resolve, mirroring fm_backend_name precedence:
+# an explicit --backend hint (pre-scanned by the caller, since argument parsing
+# runs after the refusal check), then FM_BACKEND, config/backend, runtime
+# markers, else tmux.
+fm_gate_lab_resolved_backend() { # <home> [hint]
+  local cfg line v
+  case "${2:-}" in
+    tmux | herdr | zellij | orca | cmux) printf '%s' "$2"; return 0 ;;
+  esac
+  if [ -n "${FM_BACKEND:-}" ]; then
+    printf '%s' "$FM_BACKEND"
+    return 0
+  fi
+  cfg="${FM_CONFIG_OVERRIDE:-$1/config}/backend"
+  if [ -f "$cfg" ]; then
+    while IFS= read -r line || [ -n "$line" ]; do
+      v=$(printf '%s' "$line" | tr -d '[:space:]')
+      if [ -n "$v" ]; then
+        printf '%s' "$v"
+        return 0
+      fi
+    done < "$cfg"
+  fi
+  if [ "${HERDR_ENV:-}" = 1 ]; then
+    printf 'herdr'
+    return 0
+  fi
+  if [ -n "${CMUX_WORKSPACE_ID:-}" ]; then
+    printf 'cmux'
+    return 0
+  fi
+  printf 'tmux'
+}
+
+# Scan one secondmates.md registry file. When the registry lives inside the
+# lab, every local binding must stay inside the lab and every remote record
+# needs the ssh transport inside the lab (a registry the call may consult can
+# never hand the agent a route to a real home or host). When the registry
+# lives OUTSIDE the lab - the checkout's real registry - it must bind nothing
+# inside the lab dir: the lab home must not be a registered real secondmate.
+fm_gate_lab_registry_scan() { # <reg-file> <inside-lab:0|1>
+  local reg=$1 inside=$2 line c
+  [ -f "$reg" ] && [ ! -L "$reg" ] || return 1
+  while IFS= read -r line || [ -n "$line" ]; do
+    case "$line" in
+      "- "*)
+        secondmate_registry_parse_line "$line" || return 1
+        if [ "$SECONDMATE_REGISTRY_REMOTE" -eq 1 ]; then
+          [ "$inside" -eq 1 ] || continue
+          fm_gate_lab_remote_ok || return 1
+        else
+          c=$(fm_lab_home_canon_loose "$SECONDMATE_REGISTRY_HOME" 2>/dev/null) || c=
+          if [ "$inside" -eq 1 ]; then
+            [ -n "$c" ] || return 1
+            case "$c" in "$FM_GATE_LAB_DIR" | "$FM_GATE_LAB_DIR"/*) ;; *) return 1 ;; esac
+          else
+            case "$c" in "$FM_GATE_LAB_DIR" | "$FM_GATE_LAB_DIR"/*) return 1 ;; esac
+          fi
+        fi
+        ;;
+    esac
+  done < "$reg"
+  return 0
+}
+
+fm_gate_lab_registry_ok() { # <home>
+  local home=$1 reg c
+  reg="${FM_DATA_OVERRIDE:-$home/data}/secondmates.md"
+  if [ -e "$reg" ] || [ -L "$reg" ]; then
+    fm_gate_lab_registry_scan "$reg" 1 || return 1
+  fi
+  reg="${FM_ROOT:-}/data/secondmates.md"
+  if [ -e "$reg" ] || [ -L "$reg" ]; then
+    c=$(fm_lab_home_canon_loose "$reg" 2>/dev/null) || c=
+    case "$c" in
+      "$FM_GATE_LAB_DIR"/*) fm_gate_lab_registry_scan "$reg" 1 ;;
+      *) fm_gate_lab_registry_scan "$reg" 0 ;;
+    esac || return 1
+  fi
+  return 0
+}
+
+# The secondmate parent chain (.fm-secondmate-parent markers) must stay inside
+# the lab: bookkeeping like the treehouse project lock anchors in the chain's
+# ROOT home, so a lab home chained to a real home would mutate real state. A
+# remote parent additionally needs the ssh transport inside the lab. A
+# malformed marker, unreachable parent, cycle, or runaway chain refuses -
+# mirroring fm_firstmate_root_home's fail-closed contract.
+fm_gate_lab_parent_chain_ok() { # <home>
+  local home cur marker parent seen depth=0
+  cur=$(fm_lab_home_canon "$1" 2>/dev/null) || return 1
+  seen="|$cur|"
+  while [ -e "$cur/.fm-secondmate-parent" ] || [ -L "$cur/.fm-secondmate-parent" ]; do
+    marker="$cur/.fm-secondmate-parent"
+    fm_secondmate_parent_record_parse "$marker" || return 1
+    case "$FM_SECONDMATE_PARENT_ROUTE" in
+      remote)
+        fm_gate_lab_remote_ok || return 1
+        return 0
+        ;;
+      local) ;;
+      *) return 1 ;;
+    esac
+    parent=$(fm_lab_home_canon "$FM_SECONDMATE_PARENT_HOME" 2>/dev/null) || return 1
+    case "$parent" in
+      "$FM_GATE_LAB_DIR" | "$FM_GATE_LAB_DIR"/*) ;;
+      *) return 1 ;;
+    esac
+    case "$seen" in *"|$parent|"*) return 1 ;; esac
+    seen="$seen$parent|"
+    cur=$parent
+    depth=$((depth + 1))
+    [ "$depth" -le 64 ] || return 1
+  done
+  return 0
+}
+
+# Every task record in a state dir must stay bound to the lab: a recorded
+# home= canonically contained (worktree= and project= are deliberately
+# unchecked - the shared real pool legitimately holds them), recorded
+# backend isolated by the same rules, remote routes through lab ssh. A
+# secondmate record's home (home=, else worktree=, as teardown resolves it)
+# is a descendant home recursive teardown will enter, so it must lie inside
+# the lab with its state and data dirs, and its own records pass this same
+# scan. Non-regular or unreadable records, and a descendant cycle, refuse.
+fm_gate_lab_metas_ok() { # <state-dir> [seen-homes]
+  local state_dir=$1 seen=${2:-|} meta backend session host c kind child
+  [ -d "$state_dir" ] || return 0
+  [ -r "$state_dir" ] && [ -x "$state_dir" ] || return 1
+  for meta in "$state_dir"/*.meta; do
+    [ -e "$meta" ] || [ -L "$meta" ] || continue
+    [ -f "$meta" ] && [ ! -L "$meta" ] && [ -r "$meta" ] || return 1
+    host=$(sed -n 's/^remote_host=//p' "$meta" | tail -1)
+    if [ -n "$host" ]; then
+      fm_gate_lab_remote_ok || return 1
+    fi
+    backend=$(sed -n 's/^backend=//p' "$meta" | tail -1)
+    backend=${backend:-tmux}
+    case "$backend" in
+      tmux | herdr | zellij | orca | cmux) ;;
+      *) return 1 ;;
+    esac
+    if [ "$backend" = herdr ]; then
+      session=$(sed -n 's/^herdr_session=//p' "$meta" | tail -1)
+      fm_gate_lab_herdr_session_ok "$session" \
+        || fm_gate_lab_bin_inside herdr || return 1
+    else
+      fm_gate_lab_backend_ok "$backend" || return 1
+    fi
+    c=$(sed -n 's/^home=//p' "$meta" | tail -1)
+    case "$c" in '' | '-') ;;
+      *) fm_gate_lab_path_inside "$c" || return 1 ;;
+    esac
+    kind=$(sed -n 's/^kind=//p' "$meta" | tail -1)
+    [ "$kind" = secondmate ] || continue
+    child=$c
+    [ -n "$child" ] || child=$(sed -n 's/^worktree=//p' "$meta" | tail -1)
+    fm_gate_lab_path_inside "$child" \
+      && fm_gate_lab_path_inside "$child/state" \
+      && fm_gate_lab_path_inside "$child/data" || return 1
+    child=$(fm_lab_home_canon_loose "$child") || return 1
+    case "$seen" in *"|$child|"*) return 1 ;; esac
+    fm_gate_lab_metas_ok "$child/state" "$seen$child|" || return 1
+  done
+  return 0
+}
+
+# fm_gate_lab_authorize: the single structural path a gate-context lifecycle
+# call may take. Returns 0 and sets FM_GATE_LAB_DIR when every condition in
+# the header holds; otherwise returns 1 with FM_GATE_LAB_REASON set.
+fm_gate_lab_authorize() { # <home> [--backend hint] [skip-env-backend]
+  local home=$1 lab canon_home canon_root resolved
+  FM_GATE_LAB_DIR=
+  FM_GATE_LAB_REASON=
+  fm_gate_lab_deps || {
+    fm_gate_lab_fail "lab helper unavailable"
+    return 1
+  }
+  lab=$(fm_lab_home_verify "$home" 2>/dev/null) || {
+    fm_gate_lab_fail "FM_HOME is not a marked disposable lab home under the temp root"
+    return 1
+  }
+  FM_GATE_LAB_DIR=$lab
+  canon_home=$(fm_lab_home_canon "$home" 2>/dev/null) || {
+    fm_gate_lab_fail "cannot resolve FM_HOME"
+    return 1
+  }
+  # The lab home must not be the checkout itself. FM_ROOT is the checkout the
+  # invoked scripts came from, so home == root means the agent pointed FM_HOME
+  # at a code checkout rather than a disposable home. The equality only counts
+  # when FM_ROOT is a real git worktree root: fixture harnesses routinely
+  # alias home and root inside a lab, and a fixture root is not a checkout.
+  canon_root=$(fm_lab_home_canon "${FM_ROOT:-.}" 2>/dev/null) || canon_root=
+  if [ -n "$canon_root" ] && { [ "$canon_home" = "$canon_root" ] || [ "$lab" = "$canon_root" ]; } \
+      && [ "$(fm_lab_home_canon "$(git -C "$canon_root" rev-parse --show-toplevel 2>/dev/null)" 2>/dev/null)" = "$canon_root" ]; then
+    fm_gate_lab_fail "lab home must not be the primary checkout"
+    return 1
+  fi
+  if ! fm_gate_lab_path_inside "${FM_STATE_OVERRIDE:-$home/state}" \
+      || ! fm_gate_lab_path_inside "${FM_DATA_OVERRIDE:-$home/data}"; then
+    fm_gate_lab_fail "the state or data directory resolves outside the lab"
+    return 1
+  fi
+  fm_gate_lab_registry_ok "$home" || {
+    fm_gate_lab_fail "secondmate registry does not stay inside the lab"
+    return 1
+  }
+  fm_gate_lab_parent_chain_ok "$home" || {
+    fm_gate_lab_fail "the home's secondmate parent chain leaves the lab"
+    return 1
+  }
+  # The env-resolved backend only predicts what a NEW spawn will use. Resolver
+  # entrypoints (send, teardown, control) take their backend from recorded
+  # metadata, which the meta scan below and the post-resolution asserts already
+  # constrain to the lab; checking env resolution there only false-refuses.
+  if [ "${3:-}" != 1 ]; then
+    resolved=$(fm_gate_lab_resolved_backend "$home" "${2:-}")
+    fm_gate_lab_backend_ok "$resolved" || {
+      fm_gate_lab_fail "backend '$resolved' is not isolated inside the lab"
+      return 1
+    }
+  fi
+  fm_gate_lab_metas_ok "${FM_STATE_OVERRIDE:-$home/state}" || {
+    fm_gate_lab_fail "a task record points outside the lab"
+    return 1
+  }
+  return 0
+}
+
 # fm_refuse_if_gate_agent: exit FM_GATE_REFUSE_EXIT with a clear stderr message if
-# this process looks like a no-mistakes gate agent. Call before any fleet
-# mutation. No-ops (returns 0) for a normal firstmate session, or when firstmate's
-# own test harness sets FM_GATE_REFUSE_BYPASS=1 (see the header).
-fm_refuse_if_gate_agent() {
+# this process looks like a no-mistakes gate agent, unless the call targets a
+# structurally verified disposable lab home (see the header).
+fm_refuse_if_gate_agent() { # [anchor] [--backend hint] [skip-env-backend]
   fm_is_gate_agent "${1:-.}" || return 0
+  if fm_gate_lab_authorize "${FM_HOME:-${FM_ROOT:-.}}" "${2:-}" "${3:-}"; then
+    return 0
+  fi
   if [ "$FM_GATE_REFUSE_REASON" = env ]; then
     echo "error: no-mistakes gate agent must not drive the fleet (NO_MISTAKES_GATE set)" >&2
   else
     echo "error: refusing fleet lifecycle from inside a no-mistakes gate worktree ($FM_GATE_REFUSE_COMMON)" >&2
   fi
+  if [ -n "$FM_GATE_LAB_REASON" ]; then
+    echo "note: lab authorization failed - $FM_GATE_LAB_REASON" >&2
+  fi
+  exit "$FM_GATE_REFUSE_EXIT"
+}
+
+# --- post-resolution assertions ----------------------------------------------
+#
+# Authorization at refusal time only sees the environment, so entrypoints
+# re-assert the true target once arguments resolve. Each is a no-op unless a
+# lab authorization is active in this process (FM_GATE_LAB_DIR set), so they
+# cost nothing in a normal firstmate session.
+
+fm_gate_lab_assert_active() {
+  [ -n "$FM_GATE_LAB_DIR" ]
+}
+
+fm_gate_lab_refuse() { # <detail>
+  echo "error: no-mistakes gate lab authorization refused - $1" >&2
   exit "$FM_GATE_REFUSE_EXIT"
 }
+
+# The backend resolved after argument parsing must satisfy the same isolation
+# the environment-level check required.
+fm_gate_lab_assert_backend() { # <backend>
+  fm_gate_lab_assert_active || return 0
+  fm_gate_lab_backend_ok "$1" \
+    || fm_gate_lab_refuse "backend '$1' is not isolated inside the lab"
+}
+
+# fm-send's resolved endpoint must be the lab's own backend target.
+fm_gate_lab_assert_target() { # <backend> <resolved-target>
+  fm_gate_lab_assert_active || return 0
+  case "$1" in
+    remote)
+      fm_gate_lab_remote_ok \
+        || fm_gate_lab_refuse "remote target '$2' needs a lab-local ssh transport"
+      ;;
+    herdr)
+      fm_gate_lab_herdr_session_ok "${2%%:*}" \
+        || fm_gate_lab_bin_inside herdr \
+        || fm_gate_lab_refuse "herdr target '$2' is not a Herdr session recorded for this lab"
+      ;;
+    tmux | zellij | orca | cmux)
+      fm_gate_lab_backend_ok "$1" \
+        || fm_gate_lab_refuse "backend '$1' target '$2' is not isolated inside the lab"
+      ;;
+    *)
+      fm_gate_lab_refuse "unknown backend '$1' for target '$2'"
+      ;;
+  esac
+}
diff --git a/bin/fm-lab-home.sh b/bin/fm-lab-home.sh
new file mode 100755
index 00000000000..8ef6e1a7488
--- /dev/null
+++ b/bin/fm-lab-home.sh
@@ -0,0 +1,313 @@
+#!/usr/bin/env bash
+# fm-lab-home.sh - create, mark, verify, and tear down disposable firstmate
+# "lab" homes that a no-mistakes GATE agent may drive through the fleet
+# lifecycle entrypoints (bin/fm-gate-refuse-lib.sh owns the authorization
+# decision; this helper owns the on-disk shape it verifies).
+#
+# Why a marker exists at all: the gate refusal must be able to tell a
+# throwaway home from a real fleet home WITHOUT trusting an environment
+# variable. The marker plus its binding record is that proof:
+#
+#   - A lab dir carries `.fm-lab-home` with a random `token=`.
+#   - The helper's state dir records `bindings/<token>` -> the lab dir's
+#     canonical path, so a marker copied onto another directory verifies
+#     nothing (the token resolves to the dir it was minted for or to nothing).
+#     The same record lists the Herdr lab sessions the lab provisioned
+#     (`herdr_session=` lines), so a session binds to exactly one lab.
+#   - The lab dir itself must canonically resolve under ${TMPDIR:-/tmp}, the
+#     disposable temp root. A real home (~/fm-homes/*) can never live there,
+#     so the marker can never "upgrade" a real home, and a hand-forged
+#     marker+binding under the temp root still only authorizes a temp dir.
+#
+# Usage:
+#   bin/fm-lab-home.sh create <label>     print a fresh marked lab dir
+#   bin/fm-lab-home.sh adopt <dir>        mark an existing dir under ${TMPDIR:-/tmp}
+#   bin/fm-lab-home.sh verify <fm_home>   print the marked lab dir <fm_home> lives in
+#   bin/fm-lab-home.sh teardown <dir>     remove a verified lab dir and its binding
+#   bin/fm-lab-home.sh record-herdr-session <dir> <fm-lab-session>
+#                                         bind a provisioned Herdr lab session to
+#                                         the lab <dir> lives in
+#
+# A lab dir is itself a usable disposable FM_HOME (state/, data/, config/,
+# projects/ are created). For multi-home scenarios create additional homes
+# inside the same lab dir - every FM_HOME and effective state and data dir a
+# lifecycle call uses must resolve inside the one marked lab dir, symlinks
+# followed, and the backend target must be the lab's own isolated session
+# (a Herdr fm-lab-* session recorded with record-herdr-session) or private
+# tmux socket (TMUX_TMPDIR inside this lab). A
+# lab-launched primary also needs the gate marker scrubbed from its
+# environment (env -u NO_MISTAKES_GATE) - it is a test fixture firstmate, not
+# a gate agent.
+#
+# The tracked .no-mistakes.yaml test instructions own the per-harness
+# primary-in-a-lab recipe; this header owns only the helper's lab mechanics.
+
+fm_lab_home_error() { echo "fm-lab-home: $*" >&2; }
+
+# The helper-owned state root: created lab dirs and the binding records that
+# pin each marker token to its exact canonical lab dir. Override with
+# FM_LAB_HOME_STATE_DIR only for tests of this helper itself; the override
+# must still resolve under ${TMPDIR:-/tmp} to produce verifiable labs.
+fm_lab_home_state_dir() {
+  printf '%s' "${FM_LAB_HOME_STATE_DIR:-${TMPDIR:-/tmp}/fm-lab-home-${UID}}"
+}
+
+fm_lab_home_tmp_root() {
+  CDPATH='' cd -- "${TMPDIR:-/tmp}" 2>/dev/null && pwd -P
+}
+
+fm_lab_home_canon() { # <dir> - canonical path, or nothing when unresolvable
+  CDPATH='' cd -P -- "$1" 2>/dev/null && pwd -P
+}
+
+fm_lab_home_canon_loose() { # <path> - canon of an existing dir, or
+  # parent-canon + basename for any other path (mirrors
+  # secondmate_registry_path_key). A symlink, dangling or not, is followed to
+  # its final target first, so a lab-local link never stands in for an
+  # outside file.
+  local path=$1 parent base target hops=0
+  case "$path" in /*) ;; *) return 1 ;; esac
+  while [ -L "$path" ]; do
+    hops=$((hops + 1))
+    [ "$hops" -le 40 ] || return 1
+    target=$(readlink -- "$path") || return 1
+    case "$target" in
+      /*) path=$target ;;
+      *)
+        parent=$(fm_lab_home_canon "$(dirname -- "$path")") || return 1
+        path="$parent/$target"
+        ;;
+    esac
+  done
+  if [ -d "$path" ]; then
+    fm_lab_home_canon "$path"
+  else
+    parent=$(dirname "$path")
+    base=$(basename "$path")
+    parent=$(fm_lab_home_canon "$parent") || return 1
+    printf '%s/%s\n' "$parent" "$base"
+  fi
+}
+
+fm_lab_home_new_token() {
+  od -An -N16 -tx1 /dev/urandom 2>/dev/null | tr -d ' \n'
+}
+
+# fm_lab_home_mark <dir>: write the marker into <dir> and the binding record
+# that pins its token to <dir>'s canonical path. Fails unless <dir> resolves
+# under the temp root - a lab is disposable temp state by definition.
+fm_lab_home_mark() { # <dir>
+  local dir=$1 canon_root canon_dir token bindings
+  canon_root=$(fm_lab_home_tmp_root) || {
+    fm_lab_home_error "temp root ${TMPDIR:-/tmp} is not resolvable"
+    return 1
+  }
+  canon_dir=$(fm_lab_home_canon "$dir") || {
+    fm_lab_home_error "cannot resolve lab dir: $dir"
+    return 1
+  }
+  case "$canon_dir" in
+    "$canon_root"/*) ;;
+    *)
+      fm_lab_home_error "refusing to mark $canon_dir: a lab dir must live under the temp root $canon_root"
+      return 1
+      ;;
+  esac
+  token=$(fm_lab_home_new_token)
+  case "$token" in '' | *[!0-9a-f]*)
+    fm_lab_home_error "could not mint a marker token"
+    return 1
+    ;;
+  esac
+  bindings="$(fm_lab_home_state_dir)/bindings"
+  mkdir -p "$bindings" || return 1
+  printf 'token=%s\ncreated=%s\n' "$token" "$(date -u '+%Y-%m-%dT%H:%M:%SZ')" \
+    > "$canon_dir/.fm-lab-home" || return 1
+  printf '%s\n' "$canon_dir" > "$bindings/$token" || return 1
+}
+
+# fm_lab_home_walk <canon-path>: the marked ancestor walk behind verify -
+# print the OUTERMOST dir under the temp root carrying a marker that
+# binds back to itself. A nested marked dir can never narrow authorization
+# away from the lab that contains it.
+fm_lab_home_walk() { # <canon-path>
+  local canon_path=$1 canon_root rel cursor marker token bindings bound comp
+  canon_root=$(fm_lab_home_tmp_root) || return 1
+  case "$canon_path" in
+    "$canon_root"/*) ;;
+    *) return 1 ;;
+  esac
+  rel=${canon_path#"$canon_root"/}
+  cursor=$canon_root
+  for comp in ${rel//\// }; do
+    [ -n "$comp" ] || continue
+    cursor="$cursor/$comp"
+    marker="$cursor/.fm-lab-home"
+    if [ -e "$marker" ] || [ -L "$marker" ]; then
+      [ -f "$marker" ] && [ ! -L "$marker" ] || return 1
+      token=$(sed -n 's/^token=\([0-9a-f][0-9a-f]*\)$/\1/p' "$marker" | head -1)
+      [ -n "$token" ] || return 1
+      bindings="$(fm_lab_home_state_dir)/bindings"
+      [ -f "$bindings/$token" ] && [ ! -L "$bindings/$token" ] || return 1
+      bound=$(head -1 "$bindings/$token")
+      [ "$bound" = "$cursor" ] || return 1
+      printf '%s\n' "$cursor"
+      return 0
+    fi
+  done
+  return 1
+}
+
+# fm_lab_home_verify <fm_home>: print the marked lab dir <fm_home> resolves
+# inside (or is), after checking the full proof chain: <fm_home> is an
+# existing dir under the temp root, and the outermost marked ancestor's token
+# binds back to that exact canonical dir in the helper's state. Anything less
+# fails closed.
+fm_lab_home_verify() { # <fm_home>
+  local home=$1 canon_home
+  [ -n "$home" ] && [ -d "$home" ] || return 1
+  canon_home=$(fm_lab_home_canon "$home") || return 1
+  fm_lab_home_walk "$canon_home"
+}
+
+# fm_lab_home_binding_file <lab-dir>: the binding record for a verified lab
+# dir. Its first line binds the marker token to the dir; each later
+# `herdr_session=` line names a Herdr lab session this lab provisioned.
+fm_lab_home_binding_file() { # <lab-dir>
+  local token
+  token=$(sed -n 's/^token=\([0-9a-f][0-9a-f]*\)$/\1/p' "$1/.fm-lab-home" 2>/dev/null | head -1)
+  [ -n "$token" ] || return 1
+  printf '%s/bindings/%s\n' "$(fm_lab_home_state_dir)" "$token"
+}
+
+# fm_lab_home_has_herdr_session <lab-dir> <session>: succeed only when the
+# lab's own binding record names <session>. A missing or unreadable record
+# fails closed.
+fm_lab_home_has_herdr_session() { # <lab-dir> <session>
+  local binding
+  [ -n "${2:-}" ] || return 1
+  binding=$(fm_lab_home_binding_file "$1") || return 1
+  [ -f "$binding" ] && [ ! -L "$binding" ] && [ -r "$binding" ] || return 1
+  grep -Fqx -- "herdr_session=$2" "$binding"
+}
+
+# fm_lab_home_record_herdr_session <path> <session>: record a provisioned
+# fm-lab-* Herdr session in the binding record of the lab <path> lives in. A
+# session another live lab already recorded is refused, so each name binds
+# to exactly one lab.
+fm_lab_home_record_herdr_session() { # <path> <session>
+  local session=$2 lab binding other bound
+  [[ "$session" =~ ^fm-lab-[a-zA-Z0-9][a-zA-Z0-9_-]*$ ]] || {
+    fm_lab_home_error "a lab Herdr session must be a named fm-lab-* session: $session"
+    return 1
+  }
+  lab=$(fm_lab_home_verify "$1") || {
+    fm_lab_home_error "not inside a marked lab dir: $1"
+    return 1
+  }
+  binding=$(fm_lab_home_binding_file "$lab") || return 1
+  [ -f "$binding" ] && [ ! -L "$binding" ] || return 1
+  for other in "$(dirname -- "$binding")"/*; do
+    [ "$other" != "$binding" ] || continue
+    if [ ! -f "$other" ] || ! grep -Fqx -- "herdr_session=$session" "$other"; then
+      continue
+    fi
+    bound=$(head -1 "$other")
+    if [ "$(fm_lab_home_verify "$bound" 2>/dev/null)" = "$bound" ]; then
+      fm_lab_home_error "Herdr session $session is already recorded by another lab"
+      return 1
+    fi
+  done
+  fm_lab_home_has_herdr_session "$lab" "$session" && return 0
+  printf 'herdr_session=%s\n' "$session" >> "$binding"
+}
+
+fm_lab_home_create() { # <label>
+  local label=$1 state_dir lab
+  label=$(printf '%s' "$label" | tr -cd 'a-zA-Z0-9_-' | sed 's/^[^a-zA-Z0-9]*//; s/-*$//')
+  [ -n "$label" ] || label=lab
+  label=${label:0:24}
+  state_dir=$(fm_lab_home_state_dir)
+  case "$(fm_lab_home_canon "$state_dir" 2>/dev/null || printf '%s' "$state_dir")" in
+    "$(fm_lab_home_tmp_root)"/*) ;;
+    *)
+      fm_lab_home_error "lab state dir $state_dir is not under the temp root"
+      return 1
+      ;;
+  esac
+  mkdir -p "$state_dir" || return 1
+  lab=$(mktemp -d "$state_dir/${label}-XXXXXX") || return 1
+  mkdir -p "$lab/state" "$lab/data" "$lab/config" "$lab/projects" || return 1
+  fm_lab_home_mark "$lab" || return 1
+  printf '%s\n' "$lab"
+}
+
+fm_lab_home_adopt() { # <dir>
+  local dir=$1
+  [ -d "$dir" ] || {
+    fm_lab_home_error "adopt needs an existing directory: $dir"
+    return 1
+  }
+  fm_lab_home_mark "$dir" || return 1
+  printf '%s\n' "$(fm_lab_home_canon "$dir")"
+}
+
+fm_lab_home_teardown() { # <dir>
+  local dir=$1 canon token
+  canon=$(fm_lab_home_canon "$dir" 2>/dev/null) || {
+    fm_lab_home_error "cannot resolve lab dir: $dir"
+    return 1
+  }
+  [ "$(fm_lab_home_verify "$canon" 2>/dev/null)" = "$canon" ] || {
+    fm_lab_home_error "refusing to teardown $canon: not a marked lab dir"
+    return 1
+  }
+  token=$(sed -n 's/^token=\([0-9a-f][0-9a-f]*\)$/\1/p' "$canon/.fm-lab-home" | head -1)
+  rm -rf -- "$canon" || {
+    fm_lab_home_error "could not remove lab dir $canon"
+    return 1
+  }
+  [ -z "$token" ] || rm -f -- "$(fm_lab_home_state_dir)/bindings/$token"
+}
+
+fm_lab_home_usage() {
+  sed -n '2,40p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
+}
+
+fm_lab_home_main() {
+  local command=${1:-}
+  case "$command" in
+    create)
+      [ "$#" -eq 2 ] || { fm_lab_home_usage >&2; return 2; }
+      fm_lab_home_create "$2"
+      ;;
+    adopt)
+      [ "$#" -eq 2 ] || { fm_lab_home_usage >&2; return 2; }
+      fm_lab_home_adopt "$2"
+      ;;
+    verify)
+      [ "$#" -eq 2 ] || { fm_lab_home_usage >&2; return 2; }
+      fm_lab_home_verify "$2"
+      ;;
+    teardown)
+      [ "$#" -eq 2 ] || { fm_lab_home_usage >&2; return 2; }
+      fm_lab_home_teardown "$2"
+      ;;
+    record-herdr-session)
+      [ "$#" -eq 3 ] || { fm_lab_home_usage >&2; return 2; }
+      fm_lab_home_record_herdr_session "$2" "$3"
+      ;;
+    -h | --help | help)
+      fm_lab_home_usage
+      ;;
+    *)
+      fm_lab_home_usage >&2
+      return 2
+      ;;
+  esac
+}
+
+if [ "${BASH_SOURCE[0]}" = "$0" ]; then
+  set -eu
+  fm_lab_home_main "$@"
+fi
diff --git a/bin/fm-send.sh b/bin/fm-send.sh
index af09392a4d0..7ca870b5d3b 100755
--- a/bin/fm-send.sh
+++ b/bin/fm-send.sh
@@ -222,9 +222,10 @@ FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
 
 # shellcheck source=bin/fm-gate-refuse-lib.sh
 . "$SCRIPT_DIR/fm-gate-refuse-lib.sh"
-# Fail closed before any fleet mutation: a no-mistakes gate agent must never steer
-# a crewmate (see bin/fm-gate-refuse-lib.sh).
-fm_refuse_if_gate_agent
+# Refuse gate-context steering unless the target is a verified lab
+# (see bin/fm-gate-refuse-lib.sh). The backend comes from resolved task
+# metadata, not the environment, so the env-backend check is skipped.
+fm_refuse_if_gate_agent . '' 1
 
 if [ -z "${FM_HOME+x}" ] || [ -z "${FM_HOME:-}" ]; then
   echo "error: FM_HOME is not set; fm-send refuses to resolve targets without an explicit firstmate home" >&2
@@ -444,6 +445,9 @@ fm_send_resolve_target() { # <raw-target>
 RAW_TARGET=$1
 fm_send_resolve_target "$RAW_TARGET" || exit 1
 T=$RESOLVED_TARGET
+# A gate lab steer may only reach the lab's own backend target (no-op outside
+# an authorized lab call).
+fm_gate_lab_assert_target "$TARGET_BACKEND" "$T"
 shift
 
 # Supervision lease guard: a steer is overlap territory between the two Pi
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index 2147e0224e5..f52b34e3697 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -596,9 +596,22 @@ fm_backlog_directory_present "$STATE" "state directory" || {
 . "$SCRIPT_DIR/fm-timeout-lib.sh"
 # shellcheck source=bin/fm-worker-account-lib.sh
 . "$SCRIPT_DIR/fm-worker-account-lib.sh"
-# Fail closed before any fleet mutation: a no-mistakes gate agent must never spawn
-# a direct report (see bin/fm-gate-refuse-lib.sh).
-fm_refuse_if_gate_agent
+# Refuse gate-context spawns outside a verified lab (see
+# bin/fm-gate-refuse-lib.sh). Lab authorization must judge the
+# backend this launch will actually use, so pre-scan the arguments for --backend -
+# the real parse happens below and an unknown token simply yields no hint.
+_spawn_backend_hint='' _spawn_from_meta='' _spawn_prev_arg=''
+for _a in "$@"; do
+  [ "$_spawn_prev_arg" = --backend ] && _spawn_backend_hint=$_a
+  case "$_a" in
+    --backend=*) _spawn_backend_hint=${_a#--backend=} ;;
+    --relaunch) _spawn_from_meta=1 ;;
+  esac
+  _spawn_prev_arg=$_a
+done
+unset _spawn_prev_arg
+fm_refuse_if_gate_agent . "$_spawn_backend_hint" "$_spawn_from_meta"
+unset _spawn_backend_hint _spawn_from_meta
 # Skip the watcher guard when re-exec'd for one pair of a batch (FM_SPAWN_NO_GUARD is
 # set by the batch loop below), so the guard runs once for the batch, not once per pair.
 [ -n "${FM_SPAWN_NO_GUARD:-}" ] || "$FM_ROOT/bin/fm-guard.sh" || true
@@ -882,6 +895,9 @@ spawn_remote_secondmate() {
     fm_lock_release "$SPAWN_TASK_LOCK" || true
     return 3
   fi
+  # The remote route is confirmed: a gate lab may only take it through a
+  # lab-local ssh transport (no-op outside an authorized lab call).
+  fm_gate_lab_assert_backend remote
   host=$(secondmate_registry_field "$DATA/secondmates.md" "$id" host)
   root=$(secondmate_registry_field "$DATA/secondmates.md" "$id" root)
   home=$(secondmate_registry_field "$DATA/secondmates.md" "$id" home)
@@ -1598,6 +1614,9 @@ if [ "$RELAUNCH" -eq 0 ]; then
     BACKEND=$(fm_backend_name)
   fi
   fm_backend_validate_spawn "$BACKEND" || exit 1
+  # Gate lab calls may only reach the lab's own isolated backend target (a
+  # no-op outside an authorized lab call).
+  fm_gate_lab_assert_backend "$BACKEND"
   fm_backend_source "$BACKEND" || exit 1
   if [ "$BACKEND" = orca ] && [ "$KIND" = secondmate ]; then
     echo "error: backend=orca does not support --secondmate spawns yet" >&2
@@ -3437,7 +3456,7 @@ else
     HERDR_LAUNCHER_RELATIONSHIP=launcher-home
     if [ "$KIND" = secondmate ]; then
       HERDR_LABEL_HOME=$PROJ_ABS
-      HERDR_LAUNCHER_RELATIONSHIP=other-home
+      HERDR_LAUNCHER_RELATIONSHIP='other-home'
     fi
     HERDR_PRESENTATION_JOURNAL=$(fm_backend_herdr_projection_journal_path "$STATE" "$ID")
     HERDR_PROJECTED=0
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index a1cf67c220a..634637d20d5 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -332,6 +332,11 @@ while [ "$#" -gt 0 ]; do
   esac
   shift
 done
+# Refuse gate-context teardown outside a verified lab (see
+# bin/fm-gate-refuse-lib.sh). The backend comes from
+# recorded task metadata, not the environment, so the env-backend check is
+# skipped.
+fm_refuse_if_gate_agent . '' 1
 fm_backlog_directory_present "$STATE" "state directory" || {
   echo "error: teardown refused: $FM_BACKLOG_TRANSITION_ERROR" >&2
   exit 1
@@ -436,9 +441,6 @@ fm_lock_try_acquire "$CONTROL_LOCK" || {
   exit 1
 }
 CONTROL_LOCK_HELD=1
-# Fail closed before any fleet mutation: a no-mistakes gate agent must never tear
-# down a worktree (see bin/fm-gate-refuse-lib.sh).
-fm_refuse_if_gate_agent
 FM_LOCK_LOG_PREFIX=teardown
 
 fm_backlog_record_present "$META" "task record" "$STATE" || {
@@ -1052,6 +1054,8 @@ else
   BACKEND=$FM_BACKEND_VALIDATED_BACKEND
   T=$FM_BACKEND_VALIDATED_TARGET
   [ "$BACKEND" != orca ] || T_ORCA=$T
+  fm_gate_lab_assert_backend "$BACKEND"
+  fm_gate_lab_assert_target "$BACKEND" "$T"
 fi
 if [ "${FM_TEARDOWN_GUARD_DONE:-0}" != 1 ]; then
   "$FM_ROOT/bin/fm-guard.sh" || true
diff --git a/docs/architecture.md b/docs/architecture.md
index cb783557050..6db6b6cf1d8 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -290,9 +290,9 @@ Placement is proven only at launch, so `bin/fm-spawn.sh` also exports the task i
 
 Firstmate's own no-mistakes gate runs agents inside a checkout that also contains the fleet-captain identity in `AGENTS.md`, so gate execution needs an authority boundary separate from ordinary crewmate worktree isolation.
 The tracked `.no-mistakes.yaml` sets `disable_project_settings: true`; no-mistakes honors that setting only from the trusted default-branch copy, so a pushed branch cannot enable its own project instructions during validation.
-Independently, `fm-spawn.sh`, `fm-send.sh`, `fm-control.sh`, and `fm-teardown.sh` source `bin/fm-gate-refuse-lib.sh` and exit with status 3 before fleet mutation when the gate environment marker is present or the current checkout matches the default no-mistakes gate-repository topology.
+Independently, `fm-spawn.sh`, `fm-send.sh`, `fm-control.sh`, and `fm-teardown.sh` source `bin/fm-gate-refuse-lib.sh` and refuse fleet lifecycle calls with status 3 when the gate environment marker is present or the current checkout matches the default no-mistakes gate-repository topology, unless a structurally verified disposable lab home and its isolated backend target authorize the call.
 A normal primary checkout or crewmate worktree has neither signal and remains unaffected.
-The helper's header owns the exact signal detection, relocated-home limitation, test-harness bypass, and relationship to no-mistakes' HEAD-continuity guard.
+The helper's header owns the authorization contract and its relationship to no-mistakes' HEAD-continuity guard; [`fm-lab-home.sh`](../bin/fm-lab-home.sh) owns lab provisioning and binding mechanics.
 
 ## Two task shapes
 
diff --git a/docs/scripts.md b/docs/scripts.md
index 68e1072082d..86e0a141d16 100644
--- a/docs/scripts.md
+++ b/docs/scripts.md
@@ -85,7 +85,8 @@ The shared no-mistakes gate refusal for fleet lifecycle entrypoints is summarize
 | `fm-procevent-remote-reply.sh` | Relay the remote-secondmate status stream through non-destructive process-event deltas |
 | `fm-procevent-quota.sh`  | Wake Firstmate when tracked quota drops below a threshold, is exhausted, or cannot be polled |
 | `fm-procevent-when.sh`   | Fire a trust-bound deterministic action at most once when its registered condition holds, then wake with the outcome |
-| `fm-gate-refuse-lib.sh`  | Shared no-mistakes gate-context refusal for fleet lifecycle entrypoints               |
+| `fm-gate-refuse-lib.sh`  | Gate-context fleet lifecycle refusal with structural lab authorization                |
+| `fm-lab-home.sh`        | Create, adopt, verify, and tear down disposable marked lab homes                       |
 | `fm-watch-arm.sh`        | Verified home-scoped watcher arm wrapper with loud cycle endings and bounded lifecycle ledger |
 | `fm-watch-checkpoint.sh` | Run one bounded foreground watcher checkpoint for Codex-style supervision            |
 | `fm-watch.sh`            | Singleton-safe watcher: absorb benign wakes, detect stalled local-secondmate wake queues, and exit on actionable ones |
diff --git a/tests/fm-afk-launch.test.sh b/tests/fm-afk-launch.test.sh
index 7a8e435e775..28665571f78 100755
--- a/tests/fm-afk-launch.test.sh
+++ b/tests/fm-afk-launch.test.sh
@@ -25,8 +25,12 @@ START="$ROOT/bin/fm-afk-start.sh"
 CONTRACT="$ROOT/bin/fm-afk-contract.sh"
 # The daemon paths refuse on a Pi primary, so pin a daemon-running harness for
 # every unit below; the Pi refusal has its own units (unit_pi_never_launches_the_daemon).
+# FM_TEST_HARNESS is the launch path's test-only seam (bin/fm-afk-launch.sh
+# fm_afk_launch_primary_harness): the suite calls the entrypoints directly, so a
+# real harness ancestor - a no-mistakes gate agent run under Pi - would outrank
+# the CLAUDECODE=1 marker below and refuse the daemon paths under test.
 unset PI_CODING_AGENT FM_PI_HARNESS CURSOR_AGENT CURSOR_INVOKED_AS GEMINI_CLI ATLASSIAN_AGENT_TYPE ROVODEV_CLI
-export CLAUDECODE=1
+export CLAUDECODE=1 FM_TEST_HARNESS=claude FM_TEST_SEAM=1
 
 FAILED=0
 fail() { printf 'not ok - %s\n' "$1" >&2; FAILED=1; }
@@ -141,6 +145,26 @@ unit_pi_never_launches_the_daemon() {
   done
 }
 
+# A leaked FM_TEST_HARNESS in a real primary's environment must stay inert: the
+# seam fires only alongside the FM_TEST_SEAM marker that test suites set.
+unit_test_harness_seam_requires_the_marker() {
+  local ref stray pinned
+  # shellcheck disable=SC2016 # positional params expand in the child shell.
+  ref=$(env -u FM_TEST_SEAM -u FM_TEST_HARNESS CLAUDECODE=1 \
+    bash -c '. "$1"; fm_afk_launch_primary_harness' _ "$LAUNCH")
+  # shellcheck disable=SC2016 # positional params expand in the child shell.
+  stray=$(env -u FM_TEST_SEAM CLAUDECODE=1 FM_TEST_HARNESS=omp \
+    bash -c '. "$1"; fm_afk_launch_primary_harness' _ "$LAUNCH")
+  [ "$stray" = "$ref" ] \
+    || fail "FM_TEST_HARNESS without FM_TEST_SEAM changed harness detection ($stray != $ref)"
+  # shellcheck disable=SC2016 # positional params expand in the child shell.
+  pinned=$(FM_TEST_SEAM=1 CLAUDECODE=1 FM_TEST_HARNESS=omp \
+    bash -c '. "$1"; fm_afk_launch_primary_harness' _ "$LAUNCH")
+  [ "$pinned" = omp ] \
+    || fail "FM_TEST_SEAM-armed FM_TEST_HARNESS did not pin the harness ($pinned)"
+  pass "FM_TEST_HARNESS seam is inert without the test marker"
+}
+
 unit_pi_enter_stop_does_not_claim_a_daemon_terminal() {
   local st out rc
   st=$(mktemp -d "${TMPDIR:-/tmp}/fm-afk-pi-stop.XXXXXX")
@@ -1311,6 +1335,7 @@ unit_clear_stale
 unit_enter_records_the_posture_in_one_step_without_a_daemon
 unit_retired_two_step_entry_is_refused
 unit_pi_never_launches_the_daemon
+unit_test_harness_seam_requires_the_marker
 unit_pi_enter_stop_does_not_claim_a_daemon_terminal
 unit_daemon_entry_requires_the_record
 unit_failed_daemon_launch_preserves_the_record
diff --git a/tests/fm-backend-autodetect-smoke.test.sh b/tests/fm-backend-autodetect-smoke.test.sh
index c242f4f6b84..c08ec25d376 100755
--- a/tests/fm-backend-autodetect-smoke.test.sh
+++ b/tests/fm-backend-autodetect-smoke.test.sh
@@ -47,8 +47,6 @@ command -v herdr >/dev/null 2>&1 || { echo "skip: herdr not found"; exit 0; }
 command -v jq >/dev/null 2>&1 || { echo "skip: jq not found (required by the herdr adapter)"; exit 0; }
 command -v treehouse >/dev/null 2>&1 || { echo "skip: treehouse not found (required by fm-spawn.sh)"; exit 0; }
 
-export FM_GATE_REFUSE_BYPASS=1
-
 # shellcheck source=tests/herdr-test-safety.sh
 . "$ROOT/tests/herdr-test-safety.sh"
 # This suite asserts that HERDR_ENV=1 alone selects the backend, and it runs
@@ -65,19 +63,24 @@ herdr_forget_inherited_pane
 # The dedicated regression is
 # tests/fm-backend.test.sh:test_spawn_symlinked_project_prefix_avoids_false_refusal.
 TMP_ROOT=$(mktemp -d "$(cd "${TMPDIR:-/tmp}" && pwd -P)/fm-backend-autodetect-smoke.XXXXXX")
+fm_test_lab_adopt "$TMP_ROOT"
 HERDR_LAB_HELPER="$ROOT/bin/fm-herdr-lab.sh"
 HERDR_LAB_SESSION=$("$HERDR_LAB_HELPER" name fm-autodetect-smoke-concurrency-h3) || {
-  rm -rf "$TMP_ROOT"
+  fm_test_lab_remove "$TMP_ROOT"
   fail "could not generate an isolated Herdr lab session name"
 }
 export HERDR_SESSION="$HERDR_LAB_SESSION"
+"$ROOT/bin/fm-lab-home.sh" record-herdr-session "$TMP_ROOT" "$HERDR_LAB_SESSION" || {
+  fm_test_lab_remove "$TMP_ROOT"
+  fail "could not record the Herdr lab session in the lab binding"
+}
 ID="autodetectsmoke1"
 WT=
 cleanup_all() {
   local cleanup_status=0
   [ -n "$WT" ] && command -v treehouse >/dev/null 2>&1 && treehouse return --force "$WT" >/dev/null 2>&1
   "$HERDR_LAB_HELPER" teardown "$HERDR_LAB_SESSION" || cleanup_status=$?
-  rm -rf "$TMP_ROOT"
+  fm_test_lab_remove "$TMP_ROOT"
   return "$cleanup_status"
 }
 on_exit() {
@@ -91,8 +94,12 @@ trap on_exit EXIT
 
 # --- scratch world: FM_HOME with NO backend config, one throwaway project ---
 
+# Under a no-mistakes gate the lifecycle calls must target a structurally
+# verified lab home, so FM_HOME points inside the adopted TMP_ROOT; the
+# STATE/DATA/CONFIG overrides below keep the same layout they always had.
+SCRATCH_HOME="$TMP_ROOT/home"
 STATE="$TMP_ROOT/state"; DATA="$TMP_ROOT/data"; CONFIG="$TMP_ROOT/config"
-mkdir -p "$STATE" "$DATA/$ID" "$CONFIG"
+mkdir -p "$SCRATCH_HOME/state" "$STATE" "$DATA/$ID" "$CONFIG"
 # Backend auto-detection is what is under test here, so opt out of the default-on
 # presentation projection and keep the assertions on the flat per-home workspace.
 printf 'off\n' > "$CONFIG/herdr-presentation-spaces"
@@ -118,6 +125,7 @@ git -C "$PROJ" remote add origin "file://$PROJ.origin.git"
 
 OUT_FILE="$TMP_ROOT/spawn.out"; ERR_FILE="$TMP_ROOT/spawn.err"
 env -u TMUX -u FM_BACKEND PATH="$PATH" HERDR_ENV=1 \
+  FM_HOME="$SCRATCH_HOME" \
   FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$STATE" FM_DATA_OVERRIDE="$DATA" \
   FM_CONFIG_OVERRIDE="$CONFIG" FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" \
   FM_SPAWN_NO_GUARD=1 \
@@ -169,7 +177,8 @@ pass "real herdr: the auto-detected spawn's launch command actually ran in the h
 # --- teardown completes the trivial spawn/teardown cycle --------------------
 
 TEARDOWN_OUT="$TMP_ROOT/teardown.out"
-FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$STATE" FM_DATA_OVERRIDE="$DATA" \
+FM_HOME="$SCRATCH_HOME" \
+  FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$STATE" FM_DATA_OVERRIDE="$DATA" \
   FM_CONFIG_OVERRIDE="$CONFIG" \
   "$ROOT/bin/fm-teardown.sh" "$ID" >"$TEARDOWN_OUT" 2>&1
 status=$?
diff --git a/tests/fm-backend-herdr-launcher-workspace-e2e.test.sh b/tests/fm-backend-herdr-launcher-workspace-e2e.test.sh
index e961550d839..aad1db98cf0 100755
--- a/tests/fm-backend-herdr-launcher-workspace-e2e.test.sh
+++ b/tests/fm-backend-herdr-launcher-workspace-e2e.test.sh
@@ -47,13 +47,19 @@ command -v treehouse >/dev/null 2>&1 || { echo "skip: treehouse not found (requi
 herdr_forget_inherited_pane
 
 TMP_ROOT=$(mktemp -d "$(cd "${TMPDIR:-/tmp}" && pwd -P)/fm-herdr-launcher-e2e.XXXXXX")
+fm_test_lab_adopt "$TMP_ROOT"
 HERDR_LAB_HELPER="$ROOT/bin/fm-herdr-lab.sh"
 HERDR_LAB_SESSION=$("$HERDR_LAB_HELPER" name fm-herdr-launcher-ws) || {
-  rm -rf "$TMP_ROOT"
+  fm_test_lab_remove "$TMP_ROOT"
   printf 'not ok - could not generate an isolated Herdr lab session name\n' >&2
   exit 1
 }
 export HERDR_SESSION="$HERDR_LAB_SESSION"
+"$ROOT/bin/fm-lab-home.sh" record-herdr-session "$TMP_ROOT" "$HERDR_LAB_SESSION" || {
+  fm_test_lab_remove "$TMP_ROOT"
+  printf 'not ok - could not record the Herdr lab session in the lab binding\n' >&2
+  exit 1
+}
 
 WORKTREES=()
 CLEANED=0
@@ -69,7 +75,7 @@ cleanup_all() {
   done
   WORKTREES=()
   "$HERDR_LAB_HELPER" teardown "$HERDR_LAB_SESSION" || status=$?
-  rm -rf "$TMP_ROOT"
+  fm_test_lab_remove "$TMP_ROOT"
   return "$status"
 }
 trap cleanup_all EXIT
@@ -425,7 +431,8 @@ pass "real herdr E2E: a --secondmate launch still stands up that secondmate's ow
 
 # --- 8. teardown closes only the worker's own pane --------------------------
 
-FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$PRIMARY_HOME/state" FM_DATA_OVERRIDE="$PRIMARY_HOME/data" \
+FM_HOME="$PRIMARY_HOME" \
+  FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$PRIMARY_HOME/state" FM_DATA_OVERRIDE="$PRIMARY_HOME/data" \
   FM_CONFIG_OVERRIDE="$PRIMARY_HOME/config" \
   "$ROOT/bin/fm-teardown.sh" dupC >"$TMP_ROOT/teardown.out" 2>&1
 status=$?
diff --git a/tests/fm-backend-herdr-presentation-e2e.test.sh b/tests/fm-backend-herdr-presentation-e2e.test.sh
index 4aef0afc349..d365692f8ca 100755
--- a/tests/fm-backend-herdr-presentation-e2e.test.sh
+++ b/tests/fm-backend-herdr-presentation-e2e.test.sh
@@ -266,6 +266,10 @@ export FM_BACKEND_HERDR_WORKSPACE_MOVER="$FAKEBIN/herdr-workspace-mover"
 
 # shellcheck source=tests/herdr-test-safety.sh
 . "$ROOT/tests/herdr-test-safety.sh"
+# Under the gate's structural lab authorization this suite's scratch world is a
+# marked lab: its FM_HOMEs and its named Herdr lab session stay lab-isolated
+# while treehouse still delegates to the real binary and pool.
+fm_test_lab_adopt "$TMP_ROOT"
 # This suite runs against its own isolated lab session, so a Herdr pane
 # inherited from the terminal it was launched in must not follow spawn into it
 # as a cross-session parent identity. Every projection below is anchored on the
@@ -275,6 +279,8 @@ herdr_forget_inherited_pane
 HERDR_LAB_SESSION=$(PATH="$HERDR_ORIGINAL_PATH" \
   "$HERDR_LAB_HELPER" name fm-herdr-presentation-projection)
 export HERDR_SESSION="$HERDR_LAB_SESSION" HERDR_LAB_SESSION
+"$ROOT/bin/fm-lab-home.sh" record-herdr-session "$TMP_ROOT" "$HERDR_LAB_SESSION" \
+  || fail "could not record the Herdr lab session in the lab binding"
 LAB_READY=0
 RECORDED_WORKTREES=""
 LOCK_CONTENTION_OWNER_PID=
@@ -297,7 +303,7 @@ EOF
       "$HERDR_LAB_HELPER" teardown "$HERDR_LAB_SESSION" >/dev/null 2>&1 || true
     LAB_READY=0
   fi
-  rm -rf "$TMP_ROOT"
+  fm_test_lab_remove "$TMP_ROOT"
 }
 trap cleanup_all EXIT
 
@@ -408,7 +414,7 @@ EOF
 
 spawn_task() {  # <id> <home> <project>
   local id=$1 home=$2 project=$3
-  FM_GATE_REFUSE_BYPASS=1 FM_SPAWN_NO_GUARD=1 FM_HOME="$home" FM_ROOT_OVERRIDE="$ROOT" \
+  FM_SPAWN_NO_GUARD=1 FM_HOME="$home" FM_ROOT_OVERRIDE="$ROOT" \
     "$ROOT/bin/fm-spawn.sh" "$id" "$project" "sh -c 'while :; do sleep 60; done'" --mode no-mistakes --yolo off --backend herdr
 }
 
@@ -433,13 +439,13 @@ finish_concurrent_expected_abort() {  # <id> <status> <stdout> <stderr>
 
 spawn_secondmate_task() {
   local id=$1 home=$2
-  FM_GATE_REFUSE_BYPASS=1 FM_SPAWN_NO_GUARD=1 FM_HOME="$HOME_DIR" FM_ROOT_OVERRIDE="$ROOT" \
+  FM_SPAWN_NO_GUARD=1 FM_HOME="$HOME_DIR" FM_ROOT_OVERRIDE="$ROOT" \
     "$ROOT/bin/fm-spawn.sh" "$id" "$home" "sh -c 'while :; do sleep 60; done'" --secondmate --backend herdr
 }
 
 teardown_task() {  # <id> <home>
   local id=$1 home=$2
-  FM_GATE_REFUSE_BYPASS=1 FM_HOME="$home" FM_ROOT_OVERRIDE="$ROOT" \
+  FM_HOME="$home" FM_ROOT_OVERRIDE="$ROOT" \
     FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
     FM_CONFIG_OVERRIDE="$home/config" \
     "$ROOT/bin/fm-teardown.sh" "$id" --force
diff --git a/tests/fm-backend-herdr-workspace-per-home-e2e.test.sh b/tests/fm-backend-herdr-workspace-per-home-e2e.test.sh
index 6f07798aa48..53433d5a310 100755
--- a/tests/fm-backend-herdr-workspace-per-home-e2e.test.sh
+++ b/tests/fm-backend-herdr-workspace-per-home-e2e.test.sh
@@ -66,14 +66,20 @@ herdr_forget_inherited_pane
 # canonicalized project and backend cwd comparisons in the worktree-discovery
 # poll.
 TMP_ROOT=$(mktemp -d "$(cd "${TMPDIR:-/tmp}" && pwd -P)/fm-herdr-e2e.XXXXXX")
+fm_test_lab_adopt "$TMP_ROOT"
 SESSION="fm-lab-herdr-e2e-$$"
 export HERDR_SESSION="$SESSION"
+"$ROOT/bin/fm-lab-home.sh" record-herdr-session "$TMP_ROOT" "$SESSION" || {
+  fm_test_lab_remove "$TMP_ROOT"
+  printf 'not ok - could not record the Herdr lab session in the lab binding\n' >&2
+  exit 1
+}
 WT1=; WT2=
 cleanup_all() {
   [ -n "$WT1" ] && command -v treehouse >/dev/null 2>&1 && treehouse return --force "$WT1" >/dev/null 2>&1
   [ -n "$WT2" ] && command -v treehouse >/dev/null 2>&1 && treehouse return --force "$WT2" >/dev/null 2>&1
   herdr_safe_stop_and_delete "$SESSION"
-  rm -rf "$TMP_ROOT"
+  fm_test_lab_remove "$TMP_ROOT"
 }
 trap cleanup_all EXIT
 fm_herdr_lab_prepare "$SESSION" || fail "could not prepare isolated Herdr lab session"
@@ -225,7 +231,8 @@ pass "real herdr E2E: list_live from the secondmate's own context sees only task
 # --- 5. teardown closes the RIGHT tab, and no other ------------------------
 
 TD1_OUT="$TMP_ROOT/td1.out"
-FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$PRIMARY_HOME/state" FM_DATA_OVERRIDE="$PRIMARY_HOME/data" \
+FM_HOME="$PRIMARY_HOME" \
+  FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$PRIMARY_HOME/state" FM_DATA_OVERRIDE="$PRIMARY_HOME/data" \
   FM_CONFIG_OVERRIDE="$PRIMARY_HOME/config" \
   "$ROOT/bin/fm-teardown.sh" cm1 >"$TD1_OUT" 2>&1
 rc=$?
@@ -244,7 +251,8 @@ WT1=
 pass "real herdr E2E: tearing down cm1 closes only its own tab - the secondmate's and cm2's tabs survive untouched"
 
 TD2_OUT="$TMP_ROOT/td2.out"
-FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$SM_HOME/state" FM_DATA_OVERRIDE="$SM_HOME/data" \
+FM_HOME="$SM_HOME" \
+  FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$SM_HOME/state" FM_DATA_OVERRIDE="$SM_HOME/data" \
   FM_CONFIG_OVERRIDE="$SM_HOME/config" \
   "$ROOT/bin/fm-teardown.sh" cm2 >"$TD2_OUT" 2>&1
 rc=$?
diff --git a/tests/fm-control-herdr-smoke.test.sh b/tests/fm-control-herdr-smoke.test.sh
index 14749064d1b..67fb256f66c 100755
--- a/tests/fm-control-herdr-smoke.test.sh
+++ b/tests/fm-control-herdr-smoke.test.sh
@@ -37,7 +37,7 @@ SESSION="fm-lab-control-smoke-$$"
 export HERDR_SESSION="$SESSION"
 SCRATCH=
 cleanup_all() {
-  [ -n "$SCRATCH" ] && rm -rf "$SCRATCH"
+  [ -n "$SCRATCH" ] && fm_test_lab_remove "$SCRATCH"
   herdr_safe_stop_and_delete "$SESSION"
 }
 trap cleanup_all EXIT
@@ -45,6 +45,9 @@ fm_herdr_lab_prepare "$SESSION" || fail "could not prepare isolated Herdr lab se
 
 SCRATCH=$(mktemp -d "${TMPDIR:-/tmp}/fm-control-herdr.XXXXXX")
 SCRATCH=$(cd "$SCRATCH" && pwd)
+fm_test_lab_adopt "$SCRATCH"
+"$ROOT/bin/fm-lab-home.sh" record-herdr-session "$SCRATCH" "$SESSION" \
+  || fail "could not record the Herdr lab session in the lab binding"
 HOME_DIR="$SCRATCH/home"
 mkdir -p "$HOME_DIR/state" "$HOME_DIR/data/hsmoke"
 cat > "$HOME_DIR/data/hsmoke/brief.md" <<'EOF'
diff --git a/tests/fm-control-relaunch.test.sh b/tests/fm-control-relaunch.test.sh
index f23775934b8..c023c725097 100755
--- a/tests/fm-control-relaunch.test.sh
+++ b/tests/fm-control-relaunch.test.sh
@@ -1534,8 +1534,16 @@ test_secondmate_checkpoint_refuses_unreadable_child_state() {
   printf '%s\n' "fm-sm5" > "$dir/fake/windows"
   printf '%s' "$dir/smhome" > "$dir/fake/cwd"
   out=$(run_control "$dir" sm5 relaunch); rc=$?
-  expect_code 1 "$rc" "a non-readable child record should refuse"
-  assert_contains "$out" "not a readable regular file" "the refusal should name the unreadable child record"
+  if [ "${NO_MISTAKES_GATE+x}" = x ]; then
+    # Under the gate the structural descendant-record check refuses the same
+    # unreadable child record earlier, at lab authorization.
+    expect_code 3 "$rc" "a non-readable child record should refuse under the gate"
+    assert_contains "$out" "a task record points outside the lab" \
+      "gate refusal did not name the unreadable child record"
+  else
+    expect_code 1 "$rc" "a non-readable child record should refuse"
+    assert_contains "$out" "not a readable regular file" "the refusal should name the unreadable child record"
+  fi
   [ "$(cat "$dir/fake/command")" = claude ] || fail "child record failure must not stop the secondmate"
   pass "fm-control relaunch: unreadable child records fail checkpoint"
   if [ "$(id -u)" = 0 ]; then
@@ -1547,9 +1555,15 @@ test_secondmate_checkpoint_refuses_unreadable_child_state() {
   chmod 000 "$dir/smhome/state"
   out=$(run_control "$dir" sm5 relaunch); rc=$?
   chmod 755 "$dir/smhome/state"
-  expect_code 1 "$rc" "an unlistable state directory should refuse"
-  assert_contains "$out" "no readable state directory" \
-    "the refusal should name the unlistable home state directory"
+  if [ "${NO_MISTAKES_GATE+x}" = x ]; then
+    expect_code 3 "$rc" "an unlistable state directory should refuse under the gate"
+    assert_contains "$out" "a task record points outside the lab" \
+      "gate refusal did not name the unlistable child state"
+  else
+    expect_code 1 "$rc" "an unlistable state directory should refuse"
+    assert_contains "$out" "no readable state directory" \
+      "the refusal should name the unlistable home state directory"
+  fi
   [ "$(cat "$dir/fake/command")" = claude ] || fail "unlistable child state must not stop the secondmate"
   pass "fm-control relaunch: unlistable state fails checkpoint"
 }
@@ -1723,9 +1737,17 @@ SH
   chmod +x "$dir/fakebin/tmux"
 
   out=$(run_spawn "$dir" rl37 --relaunch --harness claude); rc=$?
-  expect_code 1 "$rc" "relaunching from symlinked metadata should refuse"
-  assert_contains "$out" "task record resolves outside its authorized directory" \
-    "relaunch did not identify the unsafe task record"
+  if [ "${NO_MISTAKES_GATE+x}" = x ]; then
+    # Under the gate the structural record-safety check refuses the same
+    # unsafe record earlier, at lab authorization, with its own code and note.
+    expect_code 3 "$rc" "relaunching from symlinked metadata should refuse under the gate"
+    assert_contains "$out" "a task record points outside the lab" \
+      "gate refusal did not name the unsafe task record"
+  else
+    expect_code 1 "$rc" "relaunching from symlinked metadata should refuse"
+    assert_contains "$out" "task record resolves outside its authorized directory" \
+      "relaunch did not identify the unsafe task record"
+  fi
   [ -L "$meta" ] || fail "relaunch replaced or removed the symlinked record"
   assert_present "$target" "relaunch removed the foreign record target"
   assert_absent "$dir/relaunch-endpoint-inspected" \
diff --git a/tests/fm-gate-refuse.test.sh b/tests/fm-gate-refuse.test.sh
index 8ef32c14949..3b1c1965a59 100755
--- a/tests/fm-gate-refuse.test.sh
+++ b/tests/fm-gate-refuse.test.sh
@@ -1,11 +1,12 @@
 #!/usr/bin/env bash
-# Behavior tests for the no-mistakes GATE-agent fleet-lifecycle refusal.
+# Behavior tests for the no-mistakes GATE-agent fleet-lifecycle refusal and its
+# structural lab authorization.
 #
 # A confused no-mistakes gate agent runs inside a firstmate checkout, adopts the
 # captain identity from AGENTS.md, and reaches for fm-spawn/fm-send/fm-teardown.
 # bin/fm-gate-refuse-lib.sh is the firstmate capability-removal half: sourced at
-# the top of those three entrypoints and called before any fleet mutation, it
-# fails closed on either of two independent signals:
+# the top of those entrypoints and called before any fleet mutation, it fails
+# closed on either of two independent signals:
 #   1. NO_MISTAKES_GATE set in the environment (the marker no-mistakes stamps);
 #   2. the current worktree's git-common-dir resolves under a no-mistakes gate
 #      repo (.../.no-mistakes/repos/*.git) - the unspoofable backstop, which
@@ -13,35 +14,57 @@
 # A normal firstmate session (real primary, real crew worktree) has NEITHER
 # signal and is completely unaffected.
 #
-# Each entrypoint is exercised in three scenarios, isolating exactly ONE signal:
-#   - env-marker refuse : neutral cwd + NO_MISTAKES_GATE set      -> exit 3, no mutation
-#   - path-backstop refuse: gate-worktree cwd + marker UNSET      -> exit 3, no mutation
-#   - no-regression      : neutral cwd + marker UNSET             -> succeeds, no gate error
-# The marker is UNSET explicitly in the no-regression/backstop runs (env -u) and
-# those runs stand in a controlled NON-gate repo, so the suite is hermetic even
-# when it is itself executed inside the real no-mistakes gate (whose process has
-# NO_MISTAKES_GATE=1 and a gate-worktree cwd).
+# Exactly one path survives a gate signal: the structural lab authorization.
+# FM_HOME must live inside a marked disposable lab dir (bin/fm-lab-home.sh
+# create/adopt) and the backend target must be the lab's own isolation
+# (an fm-lab-* Herdr session recorded for this lab, private tmux socket dir,
+# or a lab-local tool).
+# A forged marker on a real or unadopted dir still refuses - the marker
+# token binds to the exact canonical dir it was minted for. Worktree and
+# spawning-project locations are deliberately NOT pinned inside the lab: a
+# real pool worktree is a legitimate spawn result, and requiring a lab-local
+# pool would force a fake treehouse. The backend target and any
+# FM_STATE_OVERRIDE/FM_DATA_OVERRIDE must belong to the authorized home's own
+# lab - another marked lab's socket dir, tool, or state never authorizes.
 #
-# Finally, assert firstmate's TRACKED .no-mistakes.yaml parses and sets
-# disable_project_settings: true (the trusted-only opt-out that neutralizes gate
-# agents' project instructions on the no-mistakes side).
+# This suite deliberately does NOT use fm_test_tmproot: that helper adopts its
+# root as a lab, and refusal fixtures need unadopted (non-lab) territory. The
+# world root below is raw mktemp; only $LAB and $OTHER_LAB are adopted.
 set -u
 
 # shellcheck source=tests/fixtures.sh
 . "$(dirname "${BASH_SOURCE[0]}")/fixtures.sh"
 
 GATE_LIB="$ROOT/bin/fm-gate-refuse-lib.sh"
+LAB_HELPER="$ROOT/bin/fm-lab-home.sh"
 SPAWN="$ROOT/bin/fm-spawn.sh"
 SEND="$ROOT/bin/fm-send.sh"
 TEARDOWN="$ROOT/bin/fm-teardown.sh"
 
-TMP=$(fm_test_tmproot fm-gate-refuse)
+WORLD=$(mktemp -d "${TMPDIR:-/tmp}/fm-gate-refuse.XXXXXX")
+printf '%s\n' "$WORLD" >> "$FM_TEST_CLEANUP_REGISTRY"
 fm_git_identity fmtest fmtest@example.invalid
 
+# The adopted lab dir every authorized-path fixture lives under. Refusal
+# fixtures stay in $WORLD outside it.
+LAB="$WORLD/lab"
+mkdir -p "$LAB"
+"$LAB_HELPER" adopt "$LAB" >/dev/null \
+  || fail "could not adopt the gate-refuse lab dir"
+# A second, separately adopted lab: its artifacts are verified disposable, yet
+# must never authorize a call whose FM_HOME lives in $LAB.
+OTHER_LAB="$WORLD/other-lab"
+mkdir -p "$OTHER_LAB"
+"$LAB_HELPER" adopt "$OTHER_LAB" >/dev/null \
+  || fail "could not adopt the second gate-refuse lab dir"
+trap 'fm_test_lab_remove "$LAB"; fm_test_lab_remove "$OTHER_LAB"; fm_test_cleanup' EXIT
+
 # The env marker's exact stderr fragment (the primary signal).
 ENV_MSG='NO_MISTAKES_GATE set'
 # The git-common-dir backstop's exact stderr fragment (the unspoofable signal).
 PATH_MSG='no-mistakes gate worktree'
+# The structural note printed beside every lab-authorization failure.
+LAB_MSG='lab authorization failed'
 
 # --- shared fixtures --------------------------------------------------------
 
@@ -52,7 +75,7 @@ make_gate_worktree() {
   local root=$1 id=016d88035d58 run=01KXC3SD5NZYMERGDS68Z1C8ER seed
   mkdir -p "$root/.no-mistakes/repos"
   git init -q --bare "$root/origin.git"
-  seed=$(mktemp -d "$TMP/gate-seed.XXXXXX")
+  seed=$(mktemp -d "$WORLD/gate-seed.XXXXXX")
   git init -q -b main "$seed"
   git -C "$seed" commit -q --allow-empty -m init
   git -C "$seed" push -q "$root/origin.git" HEAD:refs/heads/main
@@ -72,20 +95,20 @@ make_normal_repo() {
   printf '%s\n' "$dir"
 }
 
-GATE_WT=$(make_gate_worktree "$TMP/gate")
-NORMAL_CWD=$(make_normal_repo "$TMP/normal-cwd")
+GATE_WT=$(make_gate_worktree "$WORLD/gate")
+NORMAL_CWD=$(make_normal_repo "$WORLD/normal-cwd")
 
 # --- the shared helper, tested directly -------------------------------------
 
-# run_guard_lib <cwd> [set|empty] : from <cwd>, source the lib and call the guard under
-# set -eu in a subshell (proving set -eu safety). NO_MISTAKES_GATE is unset first;
-# a literal "set" second argument re-exports it, so callers pick the signal under
-# test. Echoes combined output; the guard's exit is the caller's $?.
+# run_guard_lib <cwd> [set|empty] : from <cwd>, source the lib and call the
+# guard under set -eu in a subshell. NO_MISTAKES_GATE is unset first; a literal
+# "set"/"empty" second argument re-exports it. With no FM_HOME the authorize
+# sees the cwd itself, which is unadopted territory in every caller.
 run_guard_lib() {
   local cwd=$1 marker=${2:-unset}
   (
     cd "$cwd" || exit 111
-    unset NO_MISTAKES_GATE FM_GATE_REFUSE_BYPASS
+    unset NO_MISTAKES_GATE
     case "$marker" in
       set) export NO_MISTAKES_GATE=1 ;;
       empty) export NO_MISTAKES_GATE= ;;
@@ -102,7 +125,8 @@ test_helper_env_marker_refuses() {
   out=$(run_guard_lib "$NORMAL_CWD" set); rc=$?
   expect_code 3 "$rc" "helper: env marker must exit 3"
   assert_contains "$out" "$ENV_MSG" "helper: env-marker refusal message"
-  pass "fm-gate-refuse-lib: refuses when NO_MISTAKES_GATE is set"
+  assert_contains "$out" "$LAB_MSG" "helper: env-marker refusal must name the failed lab check"
+  pass "fm-gate-refuse-lib: refuses when NO_MISTAKES_GATE is set outside a lab"
 }
 
 test_helper_empty_env_marker_refuses() {
@@ -131,15 +155,358 @@ test_helper_normal_is_noop() {
   pass "fm-gate-refuse-lib: no-op for a normal session (neither signal, set -eu clean)"
 }
 
+# --- structural lab authorization -------------------------------------------
+
+# run_lib_call <cwd> <home> [ASSIGN...] : source the lib in a gate env and call
+# fm_refuse_if_gate_agent with an explicit FM_HOME, the shape the lifecycle
+# entrypoints take after their own home resolution.
+run_lib_call() {
+  local cwd=$1 home=$2
+  shift 2
+  (
+    cd "$cwd" || exit 111
+    set -eu
+    # shellcheck source=/dev/null
+    . "$GATE_LIB"
+    # shellcheck disable=SC2016 # The inner bash, not this shell, expands $1.
+    env "$@" FM_HOME="$home" NO_MISTAKES_GATE=1 bash -c \
+      '. "$1"; fm_refuse_if_gate_agent' _ "$GATE_LIB"
+  ) 2>&1
+}
+
+# A fake tmux inside the lab makes the default backend lab-contained.
+make_lab_fakebin() { # <dir> -> echoes fakebin
+  local dir=$1 fakebin="$1/fakebin"
+  mkdir -p "$fakebin"
+  printf '#!/usr/bin/env bash\nexit 0\n' > "$fakebin/tmux"
+  chmod +x "$fakebin/tmux"
+  printf '%s\n' "$fakebin"
+}
+
+test_lab_home_authorizes() {
+  local home fakebin out rc
+  home="$LAB/auth-home"; mkdir -p "$home/state" "$home/data" "$home/config"
+  fakebin=$(make_lab_fakebin "$LAB/auth-fake")
+  out=$(run_lib_call "$NORMAL_CWD" "$home" "PATH=$fakebin:$PATH" "FM_ROOT=$WORLD/auth-root"); rc=$?
+  expect_code 0 "$rc" "helper: a marked lab home with a lab-contained backend must authorize"
+  [ -z "$out" ] || fail "helper: authorized lab call printed output: $out"
+  pass "fm-gate-refuse-lib: a marked lab home authorizes the gate lifecycle call"
+}
+
+test_lab_nested_home_authorizes() {
+  local home fakebin out rc
+  home="$LAB/nested/inner/home"; mkdir -p "$home/state" "$home/data" "$home/config"
+  fakebin=$(make_lab_fakebin "$LAB/nested-fake")
+  out=$(run_lib_call "$NORMAL_CWD" "$home" "PATH=$fakebin:$PATH" "FM_ROOT=$WORLD/auth-root"); rc=$?
+  expect_code 0 "$rc" "helper: a home nested inside the lab dir must authorize"
+  pass "fm-gate-refuse-lib: a nested lab path authorizes against the outermost marked dir"
+}
+
+test_forged_marker_on_temp_dir_refuses() {
+  local home fakebin out rc
+  # A .fm-lab-home file copied onto an unadopted temp dir: the token's binding
+  # names the real lab dir, not this one, so the proof chain breaks.
+  home="$WORLD/forged-home"; mkdir -p "$home/state"
+  cp "$LAB/.fm-lab-home" "$home/.fm-lab-home"
+  fakebin=$(make_lab_fakebin "$LAB/forged-fake")
+  out=$(run_lib_call "$NORMAL_CWD" "$home" "PATH=$fakebin:$PATH"); rc=$?
+  expect_code 3 "$rc" "helper: a copied marker on an unadopted temp dir must refuse"
+  assert_contains "$out" "$LAB_MSG" "helper: forged-marker refusal must name the failed lab check"
+  pass "fm-gate-refuse-lib: a forged marker on a non-lab temp dir refuses"
+}
+
+test_marker_outside_temp_root_refuses() {
+  local out rc
+  # A REAL lab dir (valid marker, valid binding) is still refused once the
+  # temp root moves: a real home can never live under the temp root, so a
+  # marker outside it is never an authorization.
+  out=$(run_lib_call "$NORMAL_CWD" "$LAB" "TMPDIR=$WORLD/fake-tmp" "PATH=$PATH"); rc=$?
+  expect_code 3 "$rc" "helper: a marked dir outside the temp root must refuse"
+  assert_contains "$out" "$LAB_MSG" "helper: outside-temp-root refusal must name the failed lab check"
+  pass "fm-gate-refuse-lib: a real-home-shaped dir outside the temp root refuses even with a valid marker"
+}
+
+test_forged_binding_refuses() {
+  local home token bindings original fakebin out rc
+  # Adopt a dir, then corrupt the binding record to name a different dir: the
+  # marker no longer binds back to itself.
+  home=$(mktemp -d "$WORLD/forged-binding.XXXXXX")
+  "$LAB_HELPER" adopt "$home" >/dev/null || fail "could not adopt forged-binding home"
+  token=$(sed -n 's/^token=//p' "$home/.fm-lab-home" | head -1)
+  bindings="${FM_LAB_HOME_STATE_DIR:-${TMPDIR:-/tmp}/fm-lab-home-${UID}}/bindings"
+  original=$(cat "$bindings/$token")
+  printf '%s\n' "$WORLD/somewhere-else" > "$bindings/$token"
+  fakebin=$(make_lab_fakebin "$LAB/forgedb-fake")
+  out=$(run_lib_call "$NORMAL_CWD" "$home" "PATH=$fakebin:$PATH"); rc=$?
+  expect_code 3 "$rc" "helper: a binding that names another dir must refuse"
+  assert_contains "$out" "$LAB_MSG" "helper: forged-binding refusal must name the failed lab check"
+  printf '%s\n' "$original" > "$bindings/$token"
+  fm_test_lab_remove "$home"
+  pass "fm-gate-refuse-lib: a forged marker binding refuses"
+}
+
+test_lab_ambient_tmux_refuses() {
+  local home out rc
+  # Lab home but the default tmux path: no private socket dir in a lab, no
+  # lab-local tmux - an ambient real tmux server is never authorized.
+  home="$LAB/tmux-home"; mkdir -p "$home/state" "$home/data" "$home/config"
+  out=$(run_lib_call "$NORMAL_CWD" "$home" -u TMUX_TMPDIR -u TMUX \
+      "PATH=/usr/bin:/bin" "FM_ROOT=$WORLD/auth-root"); rc=$?
+  expect_code 3 "$rc" "helper: lab home on the ambient tmux server must refuse"
+  assert_contains "$out" "is not isolated inside the lab" "helper: ambient-tmux refusal must name the backend check"
+  pass "fm-gate-refuse-lib: the default tmux target refuses inside a lab home"
+}
+
+test_lab_tmux_private_socket_authorizes() {
+  local home out rc
+  home="$LAB/sock-home"; mkdir -p "$home/state" "$home/data" "$home/config"
+  mkdir -p "$LAB/tmux-sock"
+  out=$(run_lib_call "$NORMAL_CWD" "$home" -u TMUX \
+      "TMUX_TMPDIR=$LAB/tmux-sock" "PATH=/usr/bin:/bin" "FM_ROOT=$WORLD/auth-root"); rc=$?
+  expect_code 0 "$rc" "helper: lab home with a private lab socket dir must authorize"
+  pass "fm-gate-refuse-lib: TMUX_TMPDIR inside the lab authorizes the tmux backend"
+}
+
+test_lab_cross_lab_backend_refuses() {
+  local home fakebin out rc
+  # The tmux socket dir and the tmux binary both live in another marked lab:
+  # neither is this home's own isolation, so both refuse.
+  home="$LAB/cross-home"; mkdir -p "$home/state" "$home/data" "$home/config"
+  mkdir -p "$OTHER_LAB/tmux-sock"
+  out=$(run_lib_call "$NORMAL_CWD" "$home" -u TMUX \
+      "TMUX_TMPDIR=$OTHER_LAB/tmux-sock" "PATH=/usr/bin:/bin" "FM_ROOT=$WORLD/auth-root"); rc=$?
+  expect_code 3 "$rc" "helper: a socket dir in another lab must refuse"
+  assert_contains "$out" "is not isolated inside the lab" "helper: cross-lab socket refusal must name the backend check"
+  fakebin=$(make_lab_fakebin "$OTHER_LAB/cross-fake")
+  out=$(run_lib_call "$NORMAL_CWD" "$home" -u TMUX_TMPDIR -u TMUX \
+      "PATH=$fakebin:/usr/bin:/bin" "FM_ROOT=$WORLD/auth-root"); rc=$?
+  expect_code 3 "$rc" "helper: a tmux binary in another lab must refuse"
+  assert_contains "$out" "is not isolated inside the lab" "helper: cross-lab tool refusal must name the backend check"
+  pass "fm-gate-refuse-lib: another lab's socket dir or tool never authorizes this lab's home"
+}
+
+test_lab_state_overrides_outside_refuse() {
+  local home fakebin out rc
+  home="$LAB/override-home"; mkdir -p "$home/state" "$home/data" "$home/config"
+  fakebin=$(make_lab_fakebin "$LAB/override-fake")
+  mkdir -p "$WORLD/real-state" "$WORLD/real-data" "$OTHER_LAB/state"
+  out=$(run_lib_call "$NORMAL_CWD" "$home" "PATH=$fakebin:$PATH" "FM_ROOT=$WORLD/auth-root" \
+      "FM_STATE_OVERRIDE=$WORLD/real-state"); rc=$?
+  expect_code 3 "$rc" "helper: FM_STATE_OVERRIDE outside the lab must refuse"
+  assert_contains "$out" "resolves outside the lab" "helper: state-override refusal must name the override check"
+  out=$(run_lib_call "$NORMAL_CWD" "$home" "PATH=$fakebin:$PATH" "FM_ROOT=$WORLD/auth-root" \
+      "FM_DATA_OVERRIDE=$WORLD/real-data"); rc=$?
+  expect_code 3 "$rc" "helper: FM_DATA_OVERRIDE outside the lab must refuse"
+  assert_contains "$out" "resolves outside the lab" "helper: data-override refusal must name the override check"
+  out=$(run_lib_call "$NORMAL_CWD" "$home" "PATH=$fakebin:$PATH" "FM_ROOT=$WORLD/auth-root" \
+      "FM_STATE_OVERRIDE=$OTHER_LAB/state"); rc=$?
+  expect_code 3 "$rc" "helper: FM_STATE_OVERRIDE in another lab must refuse"
+  out=$(run_lib_call "$NORMAL_CWD" "$home" "PATH=$fakebin:$PATH" "FM_ROOT=$WORLD/auth-root" \
+      "FM_STATE_OVERRIDE=$home/state" "FM_DATA_OVERRIDE=$home/data"); rc=$?
+  expect_code 0 "$rc" "helper: state and data overrides inside the lab must authorize"
+  pass "fm-gate-refuse-lib: FM_STATE_OVERRIDE/FM_DATA_OVERRIDE outside the lab refuse; inside authorize"
+}
+
+test_lab_symlinked_backend_escape_refuses() {
+  local home linkbin out rc
+  # A lab-local symlink is only as contained as its final target: a link in
+  # the lab's PATH to an outside tmux, or a lab socket-dir link to an outside
+  # (even not-yet-created) dir, must refuse; a link resolving inside the lab
+  # still authorizes.
+  home="$LAB/link-home"; mkdir -p "$home/state" "$home/data" "$home/config"
+  mkdir -p "$WORLD/real-bin" "$LAB/link-fake" "$LAB/link-in-fake"
+  printf '#!/usr/bin/env bash\nexit 0\n' > "$WORLD/real-bin/tmux"
+  chmod +x "$WORLD/real-bin/tmux"
+  linkbin="$LAB/link-fake"
+  ln -s "$WORLD/real-bin/tmux" "$linkbin/tmux"
+  out=$(run_lib_call "$NORMAL_CWD" "$home" -u TMUX_TMPDIR -u TMUX \
+      "PATH=$linkbin:/usr/bin:/bin" "FM_ROOT=$WORLD/auth-root"); rc=$?
+  expect_code 3 "$rc" "helper: a lab symlink to an outside tmux must refuse"
+  assert_contains "$out" "is not isolated inside the lab" "helper: symlinked-tool refusal must name the backend check"
+  ln -s "$WORLD/real-sock-missing" "$LAB/sock-link"
+  out=$(run_lib_call "$NORMAL_CWD" "$home" -u TMUX \
+      "TMUX_TMPDIR=$LAB/sock-link" "PATH=/usr/bin:/bin" "FM_ROOT=$WORLD/auth-root"); rc=$?
+  expect_code 3 "$rc" "helper: a lab socket-dir symlink to an outside dir must refuse"
+  make_lab_fakebin "$LAB/link-in-target" >/dev/null
+  ln -s "../link-in-target/fakebin/tmux" "$LAB/link-in-fake/tmux"
+  out=$(run_lib_call "$NORMAL_CWD" "$home" -u TMUX_TMPDIR -u TMUX \
+      "PATH=$LAB/link-in-fake:/usr/bin:/bin" "FM_ROOT=$WORLD/auth-root"); rc=$?
+  expect_code 0 "$rc" "helper: a lab symlink resolving inside the lab must authorize"
+  pass "fm-gate-refuse-lib: lab-local symlinks authorize only when their target stays inside the lab"
+}
+
+test_lab_default_state_data_symlink_refuses() {
+  local home fakebin out rc which
+  fakebin=$(make_lab_fakebin "$LAB/dirlink-fake")
+  for which in state data; do
+    home="$LAB/dirlink-$which-home"; mkdir -p "$home/state" "$home/data" "$home/config"
+    mkdir -p "$WORLD/real-home-$which"
+    rm -rf "${home:?}/$which"
+    ln -s "$WORLD/real-home-$which" "$home/$which"
+    out=$(run_lib_call "$NORMAL_CWD" "$home" -u FM_STATE_OVERRIDE -u FM_DATA_OVERRIDE \
+        "PATH=$fakebin:$PATH" "FM_ROOT=$WORLD/auth-root"); rc=$?
+    expect_code 3 "$rc" "helper: a lab home whose default $which dir links outside the lab must refuse"
+    assert_contains "$out" "the state or data directory resolves outside the lab" \
+      "helper: default $which-dir refusal must name the state/data check"
+  done
+  pass "fm-gate-refuse-lib: a lab home whose default state or data dir links outside the lab refuses"
+}
+
+test_lab_herdr_default_session_refuses() {
+  local home out rc
+  home="$LAB/herdr-home"; mkdir -p "$home/state" "$home/data" "$home/config"
+  out=$(run_lib_call "$NORMAL_CWD" "$home" -u TMUX_TMPDIR -u TMUX \
+      "FM_BACKEND=herdr" "HERDR_SESSION=default" "PATH=/usr/bin:/bin" \
+      "FM_ROOT=$WORLD/auth-root"); rc=$?
+  expect_code 3 "$rc" "helper: the default Herdr session must refuse inside a lab"
+  assert_contains "$out" "is not isolated inside the lab" "helper: default-session refusal must name the backend check"
+  pass "fm-gate-refuse-lib: the default Herdr session refuses inside a lab home"
+}
+
+test_lab_herdr_named_session_authorizes() {
+  local home session out rc
+  home="$LAB/herdr-ok"; mkdir -p "$home/state" "$home/data" "$home/config"
+  session="fm-lab-gate-ok-$$-$RANDOM"
+  out=$(run_lib_call "$NORMAL_CWD" "$home" -u TMUX_TMPDIR -u TMUX \
+      "FM_BACKEND=herdr" "HERDR_SESSION=$session" "PATH=/usr/bin:/bin" \
+      "FM_ROOT=$WORLD/auth-root"); rc=$?
+  expect_code 3 "$rc" "helper: an fm-lab-* session the lab never recorded must refuse"
+  "$LAB_HELPER" record-herdr-session "$LAB" "$session" \
+    || fail "could not record the Herdr lab session"
+  out=$(run_lib_call "$NORMAL_CWD" "$home" -u TMUX_TMPDIR -u TMUX \
+      "FM_BACKEND=herdr" "HERDR_SESSION=$session" "PATH=/usr/bin:/bin" \
+      "FM_ROOT=$WORLD/auth-root"); rc=$?
+  expect_code 0 "$rc" "helper: an fm-lab-* session recorded for the lab must authorize"
+  pass "fm-gate-refuse-lib: only a Herdr lab session recorded for the home's lab authorizes"
+}
+
+test_lab_herdr_other_lab_session_refuses() {
+  local home session fakebin out rc
+  # Lab B provisioned and recorded this session; lab A's home must not reach
+  # it through the environment, a task record, or a resolved send target, and
+  # lab A cannot claim it by recording it too.
+  home="$LAB/herdr-cross"; mkdir -p "$home/state" "$home/data" "$home/config"
+  session="fm-lab-gate-other-$$-$RANDOM"
+  "$LAB_HELPER" record-herdr-session "$OTHER_LAB" "$session" \
+    || fail "could not record lab B's Herdr session"
+  if "$LAB_HELPER" record-herdr-session "$LAB" "$session" 2>/dev/null; then
+    fail "lab A recorded a Herdr session lab B already owns"
+  fi
+  out=$(run_lib_call "$NORMAL_CWD" "$home" -u TMUX_TMPDIR -u TMUX \
+      "FM_BACKEND=herdr" "HERDR_SESSION=$session" "PATH=/usr/bin:/bin" \
+      "FM_ROOT=$WORLD/auth-root"); rc=$?
+  expect_code 3 "$rc" "helper: lab B's recorded session must refuse for lab A's home"
+  assert_contains "$out" "is not isolated inside the lab" "helper: cross-lab session refusal must name the backend check"
+
+  fakebin=$(make_lab_fakebin "$LAB/herdr-cross-fake")
+  fm_write_meta "$home/state/cross.meta" "window=$session:p1" "backend=herdr" \
+    "herdr_session=$session" "kind=ship"
+  out=$(run_lib_call "$NORMAL_CWD" "$home" "PATH=$fakebin:/usr/bin:/bin" "FM_ROOT=$WORLD/auth-root"); rc=$?
+  expect_code 3 "$rc" "helper: a task record on lab B's session must refuse for lab A's home"
+  assert_contains "$out" "a task record points outside the lab" "helper: cross-lab record refusal must name the meta check"
+  rm -f "$home/state/cross.meta"
+
+  # shellcheck disable=SC2016 # The inner bash, not this shell, expands $1-$3.
+  out=$(cd "$NORMAL_CWD" && env PATH="$fakebin:/usr/bin:/bin" FM_HOME="$home" FM_ROOT="$WORLD/auth-root" \
+      NO_MISTAKES_GATE=1 bash -c '. "$1"; fm_refuse_if_gate_agent; fm_gate_lab_assert_target herdr "$2:p1"; echo reached' \
+      _ "$GATE_LIB" "$session" 2>&1); rc=$?
+  expect_code 3 "$rc" "helper: a send target on lab B's session must refuse for lab A's home"
+  assert_contains "$out" "is not a Herdr session recorded for this lab" "helper: cross-lab target refusal must name the session check"
+  assert_not_contains "$out" "reached" "helper: a refused cross-lab target must stop the call"
+  pass "fm-gate-refuse-lib: lab A's home cannot target lab B's recorded Herdr session"
+}
+
+test_lab_meta_outside_path_refuses() {
+  local home fakebin out rc
+  home="$LAB/meta-home"; mkdir -p "$home/state" "$home/data" "$home/config"
+  fakebin=$(make_lab_fakebin "$LAB/meta-fake")
+  fm_write_meta "$home/state/escape.meta" \
+    "window=sess:win" "home=$WORLD/outside-lab" "kind=ship"
+  out=$(run_lib_call "$NORMAL_CWD" "$home" "PATH=$fakebin:$PATH" "FM_ROOT=$WORLD/auth-root"); rc=$?
+  expect_code 3 "$rc" "helper: a task record pointing outside the lab must refuse"
+  assert_contains "$out" "a task record points outside the lab" "helper: outside-path refusal must name the meta check"
+  pass "fm-gate-refuse-lib: a lab task record pointing outside the lab refuses"
+}
+
+test_lab_descendant_homes_stay_in_lab() {
+  local home child fakebin session out rc
+  # Recursive secondmate teardown enters every descendant home, so the scan
+  # must hold each one to the lab: a clean descendant authorizes; a child
+  # record on another lab's Herdr session, a child state dir linked outside
+  # the lab, a secondmate home outside the lab, or a cycle refuses.
+  fakebin=$(make_lab_fakebin "$LAB/desc-fake")
+  session="fm-lab-gate-desc-$$-$RANDOM"
+  "$LAB_HELPER" record-herdr-session "$OTHER_LAB" "$session" \
+    || fail "could not record lab B's Herdr session"
+  home="$LAB/desc-home"; child="$LAB/desc-child"
+  mkdir -p "$home/state" "$home/data" "$home/config" "$child/state" "$child/data"
+  fm_write_meta "$home/state/mate.meta" "window=sess:fm-mate" "kind=secondmate" "home=$child"
+  out=$(run_lib_call "$NORMAL_CWD" "$home" "PATH=$fakebin:/usr/bin:/bin" "FM_ROOT=$WORLD/auth-root"); rc=$?
+  expect_code 0 "$rc" "helper: a descendant home inside the lab must authorize"
+
+  fm_write_meta "$child/state/foreign.meta" "window=$session:p1" "backend=herdr" \
+    "herdr_session=$session" "kind=ship"
+  out=$(run_lib_call "$NORMAL_CWD" "$home" "PATH=$fakebin:/usr/bin:/bin" "FM_ROOT=$WORLD/auth-root"); rc=$?
+  expect_code 3 "$rc" "helper: a descendant record on lab B's session must refuse"
+  assert_contains "$out" "a task record points outside the lab" "helper: descendant endpoint refusal must name the meta check"
+  rm -f "$child/state/foreign.meta"
+
+  mkdir -p "$WORLD/desc-real-state"
+  rm -rf "${child:?}/state"
+  ln -s "$WORLD/desc-real-state" "$child/state"
+  out=$(run_lib_call "$NORMAL_CWD" "$home" "PATH=$fakebin:/usr/bin:/bin" "FM_ROOT=$WORLD/auth-root"); rc=$?
+  expect_code 3 "$rc" "helper: a descendant whose state links outside the lab must refuse"
+  rm -f "$child/state"; mkdir -p "$child/state"
+
+  mkdir -p "$WORLD/desc-real-home/state"
+  fm_write_meta "$home/state/mate.meta" "window=sess:fm-mate" "kind=secondmate" \
+    "worktree=$WORLD/desc-real-home"
+  out=$(run_lib_call "$NORMAL_CWD" "$home" "PATH=$fakebin:/usr/bin:/bin" "FM_ROOT=$WORLD/auth-root"); rc=$?
+  expect_code 3 "$rc" "helper: a secondmate home outside the lab must refuse"
+
+  fm_write_meta "$home/state/mate.meta" "window=sess:fm-mate" "kind=secondmate" "home=$child"
+  fm_write_meta "$child/state/back.meta" "window=sess:fm-back" "kind=secondmate" "home=$home"
+  out=$(run_lib_call "$NORMAL_CWD" "$home" "PATH=$fakebin:/usr/bin:/bin" "FM_ROOT=$WORLD/auth-root"); rc=$?
+  expect_code 3 "$rc" "helper: a descendant home cycle must refuse"
+  pass "fm-gate-refuse-lib: every descendant secondmate home is held to the lab boundary"
+}
+
+test_lab_registered_in_real_registry_refuses() {
+  local home fakeroot fakebin out rc
+  home="$LAB/reg-home"; mkdir -p "$home/state" "$home/data" "$home/config"
+  fakebin=$(make_lab_fakebin "$LAB/reg-fake")
+  fakeroot="$WORLD/reg-root"; mkdir -p "$fakeroot/data"
+  printf -- '- mate1 - test (home: %s; scope: test; projects: none; added 2026-01-01)\n' "$home" \
+    > "$fakeroot/data/secondmates.md"
+  out=$(run_lib_call "$NORMAL_CWD" "$home" "PATH=$fakebin:$PATH" "FM_ROOT=$fakeroot"); rc=$?
+  expect_code 3 "$rc" "helper: a lab home registered as a real secondmate must refuse"
+  assert_contains "$out" "secondmate registry does not stay inside the lab" \
+    "helper: registered-lab refusal must name the registry check"
+  pass "fm-gate-refuse-lib: a lab home in the real secondmate registry refuses"
+}
+
+test_lab_parent_chain_escape_refuses() {
+  local home fakebin out rc
+  home="$LAB/child-home"; mkdir -p "$home/state" "$home/data" "$home/config"
+  fakebin=$(make_lab_fakebin "$LAB/child-fake")
+  printf 'schema=fm-secondmate-parent.v1\nroute=local\nparent_home=%s\n' "$WORLD/real-parent" \
+    > "$home/.fm-secondmate-parent"
+  mkdir -p "$WORLD/real-parent"
+  out=$(run_lib_call "$NORMAL_CWD" "$home" "PATH=$fakebin:$PATH" "FM_ROOT=$WORLD/auth-root"); rc=$?
+  expect_code 3 "$rc" "helper: a lab home chained to a real parent must refuse"
+  assert_contains "$out" "parent chain leaves the lab" "helper: parent-chain refusal must name the parent check"
+  pass "fm-gate-refuse-lib: a lab home whose parent chain reaches a real home refuses"
+}
+
 # --- fm-spawn ---------------------------------------------------------------
 
 # run_spawn <cwd> <home> <id> <proj> <pane> <fakebin> [ASSIGN...] -> combined output
-# Gate-refuse cases must cd into a controlled cwd and drop both refusal signals
-# so the suite stays hermetic when it itself runs inside a real gate worktree.
+# Gate-refuse cases cd into a controlled cwd and drop both refusal signals so
+# the suite stays hermetic when it itself runs inside a real gate worktree.
 run_spawn() {
   local cwd=$1 home=$2 id=$3 proj=$4 pane=$5 fakebin=$6; shift 6
   fm_test_spawn_brief "$home" "$id" brief
-  ( cd "$cwd" && env -u NO_MISTAKES_GATE -u FM_GATE_REFUSE_BYPASS \
+  ( cd "$cwd" && env -u NO_MISTAKES_GATE \
       FM_ROOT_OVERRIDE='' FM_HOME="$home" \
       FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
       FM_PROJECTS_OVERRIDE="$home/projects" FM_CONFIG_OVERRIDE="$home/config" \
@@ -150,14 +517,14 @@ run_spawn() {
 
 test_spawn_refuses_and_admits() {
   local home proj fakebin wt out rc
-  home="$TMP/spawn-home"; mkdir -p "$home/data"
-  proj=$(make_normal_repo "$TMP/spawn-proj")
-  fm_git_add_origin "$proj" "$TMP/spawn-origin.git"
-  fakebin=$(make_spawn_fakebin "$TMP/spawn-fake")
-  wt="$TMP/spawn-wt"
+  home="$WORLD/spawn-home"; mkdir -p "$home/data"
+  proj=$(make_normal_repo "$WORLD/spawn-proj")
+  fm_git_add_origin "$proj" "$WORLD/spawn-origin.git"
+  fakebin=$(make_spawn_fakebin "$WORLD/spawn-fake")
+  wt="$WORLD/spawn-wt"
   git -C "$proj" worktree add -q --detach "$wt" >/dev/null 2>&1
 
-  # env-marker refuse: neutral cwd, marker set.
+  # env-marker refuse: neutral cwd, marker set, home outside any lab.
   out=$(run_spawn "$NORMAL_CWD" "$home" spawn-envmark "$proj" "$wt" "$fakebin" NO_MISTAKES_GATE=1); rc=$?
   expect_code 3 "$rc" "spawn: NO_MISTAKES_GATE must refuse"
   assert_contains "$out" "$ENV_MSG" "spawn: env-marker refusal message"
@@ -179,6 +546,60 @@ test_spawn_refuses_and_admits() {
   pass "fm-spawn: refuses on marker and gate-worktree backstop; a normal crew spawn is unaffected"
 }
 
+test_spawn_lab_authorizes() {
+  local home proj fakebin wt out rc
+  # The full lab world: home, project, worktree, fake tools - all inside $LAB.
+  home="$LAB/spawn-home"; mkdir -p "$home/data"
+  proj=$(make_normal_repo "$LAB/spawn-proj")
+  fm_git_add_origin "$proj" "$LAB/spawn-origin.git"
+  fakebin=$(make_spawn_fakebin "$LAB/spawn-fake")
+  wt="$LAB/spawn-wt"
+  git -C "$proj" worktree add -q --detach "$wt" >/dev/null 2>&1
+
+  out=$(run_spawn "$GATE_WT" "$home" spawn-lab "$proj" "$wt" "$fakebin" NO_MISTAKES_GATE=1); rc=$?
+  expect_code 0 "$rc" "spawn: a structurally verified lab spawn must proceed under the gate"
+  assert_contains "$out" "spawned spawn-lab" "spawn: authorized lab launch should report success"
+  assert_present "$home/state/spawn-lab.meta" "spawn: authorized lab launch should record meta"
+
+  # The same lab spawn redirected at state outside the lab refuses before
+  # recording anything there.
+  mkdir -p "$WORLD/escape-state"
+  out=$(run_spawn "$GATE_WT" "$home" spawn-escape "$proj" "$wt" "$fakebin" NO_MISTAKES_GATE=1 \
+      "FM_STATE_OVERRIDE=$WORLD/escape-state"); rc=$?
+  expect_code 3 "$rc" "spawn: a lab spawn with FM_STATE_OVERRIDE outside the lab must refuse"
+  assert_contains "$out" "resolves outside the lab" "spawn: state-override refusal must name the override check"
+  assert_absent "$WORLD/escape-state/spawn-escape.meta" "spawn: refused override launch must not record meta outside the lab"
+  pass "fm-spawn: a marked lab home with lab-contained tools authorizes a spawn inside the gate; outside state refuses"
+}
+
+test_spawn_lab_allows_real_treehouse() {
+  local home proj fakebin wt out rc
+  # Backend contained (private socket dir) and a marked lab home, but NO
+  # lab-local treehouse, and the project and its worktree outside the lab: the
+  # worktree-providing spawn may still reach the real shared pool. The
+  # authorized lab proof covers the FM_HOME and the backend target only -
+  # pinning the project or pool inside the lab would force a fake treehouse.
+  home="$LAB/thome"; mkdir -p "$home/data"
+  proj=$(make_normal_repo "$WORLD/tproj")
+  fm_git_add_origin "$proj" "$WORLD/tproj-origin.git"
+  wt="$WORLD/twt"
+  git -C "$proj" worktree add -q --detach "$wt" >/dev/null 2>&1
+  mkdir -p "$LAB/tsock"
+  fakebin=$(fm_fakebin "$LAB/tfake")
+  fm_test_fake_tmux_spawn "$fakebin"
+  fm_test_spawn_brief "$home" spawn-treehouse brief
+  out=$(cd "$GATE_WT" && env -u TMUX NO_MISTAKES_GATE=1 \
+      FM_ROOT_OVERRIDE='' FM_HOME="$home" \
+      FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
+      FM_PROJECTS_OVERRIDE="$home/projects" FM_CONFIG_OVERRIDE="$home/config" \
+      FM_SPAWN_NO_GUARD=1 FM_FAKE_PANE_PATH="$wt" \
+      TMUX_TMPDIR="$LAB/tsock" PATH="$fakebin:$PATH" \
+      "$SPAWN" spawn-treehouse "$proj" codex --mode no-mistakes --yolo off 2>&1); rc=$?
+  expect_code 0 "$rc" "spawn: a lab spawn resolving the real treehouse pool must proceed"
+  assert_contains "$out" "spawned spawn-treehouse" "spawn: real-pool lab spawn should report success"
+  pass "fm-spawn: a worktree-providing lab spawn may use the real treehouse pool"
+}
+
 # --- fm-send ----------------------------------------------------------------
 
 # A fake tmux that logs send-keys to FM_TMUX_LOG and reports live endpoints
@@ -217,19 +638,23 @@ SH
 }
 
 # run_send <cwd> <home> <fakebin> <log> <target> <text> [ASSIGN...] -> combined output
+# FM_ROOT_OVERRIDE points at a separate empty root: the structural check reads
+# the home-vs-checkout distinction, so the fixture's FM_HOME must not also be
+# its code root.
 run_send() {
   local cwd=$1 home=$2 fakebin=$3 log=$4 target=$5 text=$6; shift 6
-  ( cd "$cwd" && env -u NO_MISTAKES_GATE -u FM_GATE_REFUSE_BYPASS \
-      "PATH=$fakebin:$PATH" "FM_HOME=$home" "FM_ROOT_OVERRIDE=$home" \
+  mkdir -p "$WORLD/send-root"
+  ( cd "$cwd" && env -u NO_MISTAKES_GATE \
+      "PATH=$fakebin:$PATH" "FM_HOME=$home" "FM_ROOT_OVERRIDE=$WORLD/send-root" \
       "FM_TMUX_LOG=$log" "FM_SEND_SETTLE=0" "$@" \
       "$SEND" "$target" "$text" ) 2>&1
 }
 
 test_send_refuses_and_admits() {
   local home fakebin log out rc
-  home="$TMP/send-home"; mkdir -p "$home/state"
-  fakebin=$(make_send_fakebin "$TMP/send-fake")
-  log="$TMP/send-tmux.log"
+  home="$WORLD/send-home"; mkdir -p "$home/state"
+  fakebin=$(make_send_fakebin "$WORLD/send-fake")
+  log="$WORLD/send-tmux.log"
   fm_write_meta "$home/state/lane-ok.meta" "window=sess:fm-lane-ok" "kind=ship" "harness=codex"
 
   # env-marker refuse.
@@ -262,14 +687,42 @@ test_send_refuses_and_admits() {
   pass "fm-send: refuses on marker and gate-worktree backstop; a normal steer uses the inbox"
 }
 
+test_send_lab_authorizes() {
+  local home fakebin log out rc
+  home="$LAB/send-home"; mkdir -p "$home/state"
+  fakebin=$(make_send_fakebin "$LAB/send-fake")
+  log="$LAB/send-tmux.log"
+  fm_write_meta "$home/state/lane-ok.meta" "window=sess:fm-lane-ok" "kind=ship" "harness=codex"
+
+  : > "$log"
+  out=$(run_send "$GATE_WT" "$home" "$fakebin" "$log" fm-lane-ok "hello captain" NO_MISTAKES_GATE=1); rc=$?
+  expect_code 0 "$rc" "send: a structurally verified lab steer must proceed under the gate"
+  assert_contains "$(cat "$log")" "target=sess:fm-lane-ok" \
+    "send: authorized lab steer should reach the lab endpoint"
+
+  # The same lab home with its default state dir symlinked at an outside
+  # home's state: the steer refuses and enqueues nothing there.
+  home="$LAB/send-link-home"; mkdir -p "$home" "$WORLD/send-real-state"
+  ln -s "$WORLD/send-real-state" "$home/state"
+  fm_write_meta "$WORLD/send-real-state/lane-ok.meta" "window=sess:fm-lane-ok" "kind=ship" "harness=codex"
+  : > "$log"
+  out=$(run_send "$GATE_WT" "$home" "$fakebin" "$log" fm-lane-ok "hello captain" NO_MISTAKES_GATE=1); rc=$?
+  expect_code 3 "$rc" "send: a lab home whose state links outside the lab must refuse"
+  assert_contains "$out" "the state or data directory resolves outside the lab" \
+    "send: symlinked-state refusal must name the state/data check"
+  [ ! -s "$log" ] || fail "send: refused symlinked-state steer still typed to the endpoint"$'\n'"$(cat "$log")"
+  assert_absent "$WORLD/send-real-state/lane-ok.inbox" "send: refused symlinked-state steer must not enqueue outside the lab"
+  pass "fm-send: a marked lab home with a lab-contained tmux authorizes a steer inside the gate; outside state refuses"
+}
+
 # --- fm-teardown ------------------------------------------------------------
 
-# make_teardown_case <name> -> echoes a case dir holding a LANDED no-mistakes ship
-# task (HEAD reachable from origin), so a normal teardown genuinely succeeds and a
-# refused one leaves the task untouched (mirrors tests/fm-teardown make_case).
+# make_teardown_case <root> <name> -> echoes a case dir holding a LANDED
+# no-mistakes ship task (HEAD reachable from origin), so a normal teardown
+# genuinely succeeds and a refused one leaves the task untouched.
 make_teardown_case() {
-  local name=$1 case_dir fakebin t
-  case_dir="$TMP/$name"; fakebin="$case_dir/fakebin"
+  local root=$1 name=$2 case_dir fakebin t
+  case_dir="$root/$name"; fakebin="$case_dir/fakebin"
   mkdir -p "$case_dir/state" "$case_dir/config" "$case_dir/data" "$fakebin"
   for t in treehouse tmux; do
     printf '#!/usr/bin/env bash\nexit 0\n' > "$fakebin/$t"
@@ -314,7 +767,7 @@ SH
 # run_teardown <cwd> <case_dir> [ASSIGN...] -> combined output
 run_teardown() {
   local cwd=$1 case_dir=$2; shift 2
-  ( cd "$cwd" && env -u NO_MISTAKES_GATE -u FM_GATE_REFUSE_BYPASS \
+  ( cd "$cwd" && env -u NO_MISTAKES_GATE \
       "FM_ROOT_OVERRIDE=$ROOT" "FM_STATE_OVERRIDE=$case_dir/state" \
       "FM_DATA_OVERRIDE=$case_dir/data" "FM_CONFIG_OVERRIDE=$case_dir/config" \
       "PATH=$case_dir/fakebin:$PATH" "$@" \
@@ -325,21 +778,21 @@ test_teardown_refuses_and_admits() {
   local case_dir out rc
 
   # env-marker refuse: a genuinely-landed task is still refused; nothing is torn down.
-  case_dir=$(make_teardown_case teardown-envmark)
+  case_dir=$(make_teardown_case "$WORLD" teardown-envmark)
   out=$(run_teardown "$NORMAL_CWD" "$case_dir" NO_MISTAKES_GATE=1); rc=$?
   expect_code 3 "$rc" "teardown: NO_MISTAKES_GATE must refuse"
   assert_contains "$out" "$ENV_MSG" "teardown: env-marker refusal message"
   assert_present "$case_dir/state/task-x1.meta" "teardown: refused env-marker teardown must leave the task"
 
   # path-backstop refuse (marker UNSET).
-  case_dir=$(make_teardown_case teardown-backstop)
+  case_dir=$(make_teardown_case "$WORLD" teardown-backstop)
   out=$(run_teardown "$GATE_WT" "$case_dir"); rc=$?
   expect_code 3 "$rc" "teardown: gate-worktree cwd must refuse with the marker unset"
   assert_contains "$out" "$PATH_MSG" "teardown: path-backstop refusal message"
   assert_present "$case_dir/state/task-x1.meta" "teardown: refused backstop teardown must leave the task"
 
   # no-regression: a normal session tears down the landed task.
-  case_dir=$(make_teardown_case teardown-ok)
+  case_dir=$(make_teardown_case "$WORLD" teardown-ok)
   out=$(run_teardown "$NORMAL_CWD" "$case_dir"); rc=$?
   expect_code 0 "$rc" "teardown: a normal session must still tear down landed work"
   assert_not_contains "$out" "$ENV_MSG" "teardown: normal teardown must not print the gate refusal"
@@ -348,10 +801,43 @@ test_teardown_refuses_and_admits() {
   pass "fm-teardown: refuses on marker and gate-worktree backstop; a normal teardown is unaffected"
 }
 
+test_teardown_lab_authorizes() {
+  local case_dir out rc
+  case_dir=$(make_teardown_case "$LAB" teardown-lab)
+  # FM_HOME defaults inside run_teardown's env only through FM_*_OVERRIDE -
+  # pass the case dir explicitly so the authorize sees the lab home.
+  out=$(run_teardown "$GATE_WT" "$case_dir" NO_MISTAKES_GATE=1 "FM_HOME=$case_dir"); rc=$?
+  expect_code 0 "$rc" "teardown: a structurally verified lab teardown must proceed under the gate"
+  assert_absent "$case_dir/state/task-x1.meta" "teardown: authorized lab teardown should remove the task record"
+  pass "fm-teardown: a marked lab home with lab-contained tools authorizes teardown inside the gate"
+}
+
 test_helper_env_marker_refuses
 test_helper_empty_env_marker_refuses
 test_helper_path_backstop_refuses
 test_helper_normal_is_noop
+test_lab_home_authorizes
+test_lab_nested_home_authorizes
+test_forged_marker_on_temp_dir_refuses
+test_marker_outside_temp_root_refuses
+test_forged_binding_refuses
+test_lab_ambient_tmux_refuses
+test_lab_tmux_private_socket_authorizes
+test_lab_cross_lab_backend_refuses
+test_lab_state_overrides_outside_refuse
+test_lab_symlinked_backend_escape_refuses
+test_lab_default_state_data_symlink_refuses
+test_lab_herdr_default_session_refuses
+test_lab_herdr_named_session_authorizes
+test_lab_herdr_other_lab_session_refuses
+test_lab_meta_outside_path_refuses
+test_lab_descendant_homes_stay_in_lab
+test_lab_registered_in_real_registry_refuses
+test_lab_parent_chain_escape_refuses
 test_spawn_refuses_and_admits
+test_spawn_lab_authorizes
+test_spawn_lab_allows_real_treehouse
 test_send_refuses_and_admits
+test_send_lab_authorizes
 test_teardown_refuses_and_admits
+test_teardown_lab_authorizes
diff --git a/tests/fm-gotmp.test.sh b/tests/fm-gotmp.test.sh
index d3337fbc57c..6169f9b673f 100755
--- a/tests/fm-gotmp.test.sh
+++ b/tests/fm-gotmp.test.sh
@@ -11,11 +11,10 @@
 # metadata publication, and the pane environment export.
 set -u
 
-# This suite does not source tests/lib.sh, so exempt its teardown subprocess from
-# the gate-lifecycle refusal (bin/fm-gate-refuse-lib.sh) the way lib.sh does for
-# the rest of the suite: the no-mistakes gate runs this suite from a gate worktree,
-# which the guard would otherwise refuse.
-export FM_GATE_REFUSE_BYPASS=1
+# This suite does not source tests/lib.sh, so adopt its scratch root as a
+# structural lab home itself: the no-mistakes gate runs this suite from a gate
+# worktree, and bin/fm-gate-refuse-lib.sh would otherwise refuse the teardown
+# subprocess below.
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 TEARDOWN="$ROOT/bin/fm-teardown.sh"
@@ -33,12 +32,19 @@ TMP_ROOT=
 
 cleanup() {
   if [ -n "${TMP_ROOT:-}" ]; then
-    rm -rf "$TMP_ROOT"
+    "$ROOT/bin/fm-lab-home.sh" teardown "$TMP_ROOT" >/dev/null 2>&1 || rm -rf "$TMP_ROOT"
   fi
 }
 trap cleanup EXIT
 
 TMP_ROOT=$(mktemp -d "${TMPDIR:-/tmp}/fm-gotmp-tests.XXXXXX")
+"$ROOT/bin/fm-lab-home.sh" adopt "$TMP_ROOT" >/dev/null \
+  || { printf 'not ok - could not adopt the gotmp lab root\n' >&2; exit 1; }
+# Scrub any backend identity this suite inherited from the pane it was
+# launched in - the fixtures below stub tmux, and a leaked Herdr/cmux marker
+# would steer the teardown subprocess at the ambient real backend instead.
+unset TMUX HERDR_ENV HERDR_PANE_ID HERDR_TAB_ID HERDR_WORKSPACE_ID \
+  HERDR_SOCKET_PATH HERDR_SESSION CMUX_WORKSPACE_ID
 
 # Build a fake FM_HOME/FM_ROOT so the real fm-teardown.sh (symlinked in) resolves
 # state and helper scripts inside it. Stub the helper scripts fm-teardown calls so no
@@ -72,8 +78,10 @@ SH
   # wedge detector's bounded worktree write probe.
   ln -s "$ROOT/bin/fm-timeout-lib.sh" "$fake/bin/fm-timeout-lib.sh"
   ln -s "$ROOT/bin/fm-wake-lib.sh" "$fake/bin/fm-wake-lib.sh"
-  # fm-gate-refuse-lib.sh: teardown sources it before any fleet mutation.
+  # fm-gate-refuse-lib.sh: teardown sources it before any fleet mutation, and
+  # it lazy-sources the lab-home helper beside itself on the gate path.
   ln -s "$ROOT/bin/fm-gate-refuse-lib.sh" "$fake/bin/fm-gate-refuse-lib.sh"
+  ln -s "$ROOT/bin/fm-lab-home.sh" "$fake/bin/fm-lab-home.sh"
   # fm-pr-lib.sh: teardown uses its canonical task-ID validator for poll cleanup.
   ln -s "$ROOT/bin/fm-pr-lib.sh" "$fake/bin/fm-pr-lib.sh"
   # fm-public-followup-lib.sh (and the fm-x-lib.sh and fm-env-lib.sh it
@@ -93,6 +101,13 @@ SH
   # Ordinary teardown reports any final ledger outcome before removing records.
   ln -s "$ROOT/bin/fm-inactive-reconcile.sh" "$fake/bin/fm-inactive-reconcile.sh"
   ln -s "$ROOT/bin/fm-parent-channel-lib.sh" "$fake/bin/fm-parent-channel-lib.sh"
+  # tmux: stub binary so the gate lab authorization resolves a lab-contained
+  # tool (the fixture's stubbed tmux adapter never reaches a real server).
+  cat > "$fake/bin/tmux" <<'SH'
+#!/usr/bin/env bash
+exit 0
+SH
+  chmod +x "$fake/bin/tmux"
   # fm-guard.sh: stub (teardown calls it with `|| true`).
   cat > "$fake/bin/fm-guard.sh" <<'SH'
 #!/usr/bin/env bash
@@ -142,7 +157,7 @@ test_teardown_removes_tasktmp_dir() {
   # Sanity: dir + contents exist before teardown.
   [ -d "$task_tmp/gotmp" ] || fail "precondition: gotmp missing before teardown"
   # Run the REAL teardown against the fake root.
-  FM_HOME="$fake" bash "$fake/bin/fm-teardown.sh" "$id" >/dev/null 2>&1 \
+  PATH="$fake/bin:$PATH" FM_HOME="$fake" bash "$fake/bin/fm-teardown.sh" "$id" >/dev/null 2>&1 \
     || fail "teardown exited non-zero with a valid tasktmp"
   [ ! -e "$task_tmp" ] \
     || fail "teardown did not remove the tasktmp dir ($task_tmp still exists)"
@@ -160,6 +175,11 @@ test_teardown_skips_gracefully_without_tasktmp() {
   cat > "$fake/bin/backends/tmux.sh" <<'SH'
 fm_backend_tmux_kill() { return 0; }
 SH
+  cat > "$fake/bin/tmux" <<'SH'
+#!/usr/bin/env bash
+exit 0
+SH
+  chmod +x "$fake/bin/tmux"
   ln -s "$ROOT/bin/fm-tmux-lib.sh" "$fake/bin/fm-tmux-lib.sh"
   ln -s "$ROOT/bin/fm-cursor-lib.sh" "$fake/bin/fm-cursor-lib.sh"
   ln -s "$ROOT/bin/fm-composer-lib.sh" "$fake/bin/fm-composer-lib.sh"
@@ -175,6 +195,7 @@ SH
   ln -s "$ROOT/bin/fm-wake-lib.sh" "$fake/bin/fm-wake-lib.sh"
   # fm-gate-refuse-lib.sh: teardown sources it before any fleet mutation.
   ln -s "$ROOT/bin/fm-gate-refuse-lib.sh" "$fake/bin/fm-gate-refuse-lib.sh"
+  ln -s "$ROOT/bin/fm-lab-home.sh" "$fake/bin/fm-lab-home.sh"
   # fm-pr-lib.sh: teardown uses its canonical task-ID validator for poll cleanup.
   ln -s "$ROOT/bin/fm-pr-lib.sh" "$fake/bin/fm-pr-lib.sh"
   # fm-public-followup-lib.sh (and the fm-x-lib.sh and fm-env-lib.sh it
@@ -219,7 +240,7 @@ kind=ship
 mode=no-mistakes
 yolo=off
 META
-  FM_HOME="$fake" bash "$fake/bin/fm-teardown.sh" "$id" >/dev/null 2>&1 \
+  PATH="$fake/bin:$PATH" FM_HOME="$fake" bash "$fake/bin/fm-teardown.sh" "$id" >/dev/null 2>&1 \
     || fail "teardown exited non-zero when tasktmp= was absent"
   pass "fm-teardown skips gracefully when tasktmp= is absent (backward compat)"
 }
@@ -232,7 +253,7 @@ test_teardown_skips_gracefully_when_dir_missing() {
   [ ! -e "$task_tmp" ] || fail "precondition: task_tmp should not exist yet"
   local fake
   fake=$(make_fake_root "$id" "$task_tmp")
-  FM_HOME="$fake" bash "$fake/bin/fm-teardown.sh" "$id" >/dev/null 2>&1 \
+  PATH="$fake/bin:$PATH" FM_HOME="$fake" bash "$fake/bin/fm-teardown.sh" "$id" >/dev/null 2>&1 \
     || fail "teardown exited non-zero when tasktmp dir was missing"
   [ ! -e "$task_tmp" ] || fail "teardown created/left the tasktmp dir unexpectedly"
   pass "fm-teardown skips gracefully when tasktmp= points to a nonexistent dir"
diff --git a/tests/fm-live-gate.test.sh b/tests/fm-live-gate.test.sh
index c2e3b4e1ca1..ac27862e3f8 100755
--- a/tests/fm-live-gate.test.sh
+++ b/tests/fm-live-gate.test.sh
@@ -155,28 +155,28 @@ test_any_of_several_entry_points_turns_a_guard_on() {
   assert_contains "$result" ran "a secondary entry point must also turn the guard on"
 }
 
-test_gate_lets_a_guard_drive_the_real_fleet_scripts_under_a_gate_marker() {
-  # The nine live guards that never sourced the shared helpers used to be
-  # refused by bin/fm-gate-refuse-lib.sh whenever the pipeline ran them, because
-  # the gate marker is set for every no-mistakes gate agent. Opening with the
-  # shared gate is what carries the test-suite bypass into them.
+test_live_gate_does_not_authorize_an_unmarked_home() {
+  # A live guard's opt-in controls whether it runs, not which fleet home it
+  # can reach. Structural lab authorization remains required under the gate.
   local path out rc
-  path="$TMP_ROOT/bypass.test.sh"
+  path="$TMP_ROOT/unmarked.test.sh"
   {
     printf '#!/usr/bin/env bash\nset -u\n'
     printf '. "%s/tests/lib.sh"\n' "$ROOT"
     printf 'fm_live_gate default-on FM_FAKE_LIVE fmfakeharness\n'
     printf '. "%s/bin/fm-gate-refuse-lib.sh"\n' "$ROOT"
-    printf 'if fm_is_gate_agent; then printf "refused\\n"; else printf "allowed\\n"; fi\n'
+    printf 'fm_refuse_if_gate_agent "%s"\n' "$ROOT"
+    printf 'printf "allowed\\n"\n'
   } > "$path"
   chmod +x "$path"
   set +e
-  out=$(clean_env NO_MISTAKES_GATE=1 PATH="$BIN:/usr/bin:/bin" "$path" 2>&1)
+  out=$(clean_env NO_MISTAKES_GATE=1 FM_HOME="$ROOT" PATH="$BIN:/usr/bin:/bin" "$path" 2>&1)
   rc=$?
   set -e
-  expect_code 0 "$rc" "a guard opened with the shared gate must not be refused"
-  assert_contains "$out" allowed \
-    "the shared gate must carry the test-suite bypass so a live guard can drive the real fleet scripts"
+  expect_code 3 "$rc" "a live guard must refuse a non-lab home under a gate marker"
+  assert_contains "$out" "lab authorization failed" \
+    "opening a live guard must not bypass lifecycle refusal for an unmarked home"
+  assert_not_contains "$out" allowed "refusal must stop the guard before fleet work"
 }
 
 test_every_live_guard_is_wired_to_the_shared_gate() {
@@ -215,6 +215,6 @@ test_a_guards_own_variable_wins_over_fm_live
 pass "a guard's own setting wins over FM_LIVE"
 test_any_of_several_entry_points_turns_a_guard_on
 pass "any entry point of a multi-mode guard turns it on"
-test_gate_lets_a_guard_drive_the_real_fleet_scripts_under_a_gate_marker
-pass "the shared gate carries the gate-refusal bypass into every live guard"
+test_live_gate_does_not_authorize_an_unmarked_home
+pass "the shared live gate does not authorize an unmarked home"
 test_every_live_guard_is_wired_to_the_shared_gate
diff --git a/tests/fm-omp-harness.test.sh b/tests/fm-omp-harness.test.sh
index 757c01b5b59..088731e0dfd 100755
--- a/tests/fm-omp-harness.test.sh
+++ b/tests/fm-omp-harness.test.sh
@@ -81,10 +81,16 @@ test_detection_anchored_name_and_marker_precedence() {
   out=$(env -u PI_CODING_AGENT -u CURSOR_AGENT -u CURSOR_INVOKED_AS CLAUDECODE=1 FM_OMP_HARNESS=omp \
     "$bin/omp" -c '"$1"; :' _ "$HARNESS")
   [ "$out" = omp ] || fail "FM_OMP_HARNESS under an omp ancestor must outrank an inherited CLAUDECODE, got '$out'"
-  # ...and is inert when it leaks into a worker with no omp ancestor.
+  # ...and is inert when it leaks into a worker with no omp ancestor. Blind the
+  # ancestry walk so the suite's own real ancestors - a no-mistakes gate agent
+  # run under Pi - cannot outrank the marker the case pins: the marker is the
+  # only evidence left, which is exactly the contract under test.
+  local blind=$TMP_ROOT/blind-ancestry
+  mkdir -p "$blind"
+  fm_fake_blind_ancestry "$blind"
   # shellcheck disable=SC2016 # the quoted body expands inside the named shell
   out=$(env -u PI_CODING_AGENT -u CURSOR_AGENT -u CURSOR_INVOKED_AS CLAUDECODE=1 FM_OMP_HARNESS=omp \
-    bash -c '"$1"; :' _ "$HARNESS")
+    PATH="$blind:$PATH" bash -c '"$1"; :' _ "$HARNESS")
   [ "$out" = claude ] || fail "a leaked FM_OMP_HARNESS without an omp ancestor must not relabel a claude worker, got '$out'"
   pass "fm-harness: omp detects by its anchored name; the marker is a precedence override that needs real omp ancestry"
 }
diff --git a/tests/fm-remote-secondmate-lifecycle-e2e.test.sh b/tests/fm-remote-secondmate-lifecycle-e2e.test.sh
index 681e9401c29..d8f7f974958 100755
--- a/tests/fm-remote-secondmate-lifecycle-e2e.test.sh
+++ b/tests/fm-remote-secondmate-lifecycle-e2e.test.sh
@@ -1358,17 +1358,21 @@ printf 'confirmed:%s\n' "$retired_wake_corr" > "$PARENT/state/.backlog-handoff-i
 printf '%s\tattempt\n' "$(date +%s)" > "$PARENT/state/.secondmate-relaunch-ios"
 printf '%s\tdead\n' "$(date +%s)" > "$PARENT/state/.secondmate-relaunch-bound-ios"
 liveness_lock="$PARENT/state/.secondmate-liveness-ios.lock"
-( STATE="$PARENT/state" exec bash -c '. "$1" && fm_lock_acquire_wait "$2" && exec sleep 120' \
-    _ "$ROOT/bin/fm-wake-lib.sh" "$liveness_lock" ) &
+# The link is published before the claim finishes; signal only after acquire.
+# shellcheck disable=SC2016 # Positional parameters expand in the child shell.
+( STATE="$PARENT/state" exec bash -c '. "$1" && fm_lock_acquire_wait "$2" && touch "$3" && exec sleep 120' \
+    _ "$ROOT/bin/fm-wake-lib.sh" "$liveness_lock" "$TMP_ROOT/liveness.entered" ) &
 liveness_holder_pid=$!
 liveness_wait=0
-while [ ! -d "$liveness_lock" ]; do
+while [ ! -f "$TMP_ROOT/liveness.entered" ]; do
   kill -0 "$liveness_holder_pid" 2>/dev/null || fail "liveness lock holder exited before acquiring the lock"
   liveness_wait=$((liveness_wait + 1))
   [ "$liveness_wait" -le 250 ] || fail "liveness lock holder never acquired the lock"
   sleep 0.02
 done
-liveness_owner=$(cat "$liveness_lock/pid")
+liveness_owner=$liveness_holder_pid
+[ "$(cat "$liveness_lock/pid" 2>/dev/null)" = "$liveness_owner" ] \
+  || fail "liveness lock holder did not own its acquired lock"
 if remote_env "$ROOT/bin/fm-teardown.sh" ios > "$TMP_ROOT/teardown-liveness-busy.out" 2>&1; then
   fail "remote retirement proceeded under an active liveness episode"
 fi
diff --git a/tests/fm-send-agy-confirm.test.sh b/tests/fm-send-agy-confirm.test.sh
index 1a5a5240509..7e4f2eca1eb 100755
--- a/tests/fm-send-agy-confirm.test.sh
+++ b/tests/fm-send-agy-confirm.test.sh
@@ -105,7 +105,7 @@ run_send() {  # <harness> <busy-at> [env=val ...]
   log="$dir/sleep.log"; : > "$log"
   fm_write_meta "$dir/state/agyw.meta" "window=sess:win" "harness=$harness"
   (
-    export FM_GATE_REFUSE_BYPASS=1 FM_SEND_SETTLE=0
+    export FM_SEND_SETTLE=0
     export PATH="$fb:$PATH" FM_ROOT_OVERRIDE="$dir" FM_HOME="$dir" FM_SLEEP_LOG="$log"
     for a in "$@"; do eval "export $a"; done
     "$SEND" sess:win 'Append steer1 line to notes.md' 2>"$dir/err"
diff --git a/tests/fm-send-secondmate-marker-herdr-e2e.test.sh b/tests/fm-send-secondmate-marker-herdr-e2e.test.sh
index bdddfa2334e..4fd231ae48c 100755
--- a/tests/fm-send-secondmate-marker-herdr-e2e.test.sh
+++ b/tests/fm-send-secondmate-marker-herdr-e2e.test.sh
@@ -20,6 +20,8 @@ set -u
 # shellcheck source=/dev/null
 . "$ROOT/bin/fm-marker-lib.sh"
 # shellcheck source=/dev/null
+. "$ROOT/bin/fm-task-inbox-lib.sh"
+# shellcheck source=/dev/null
 . "$ROOT/bin/fm-backend.sh"
 
 fm_live_gate opt-in FM_SEND_MARKER_HERDR_E2E git herdr jq pi
@@ -27,6 +29,9 @@ fm_live_gate opt-in FM_SEND_MARKER_HERDR_E2E git herdr jq pi
 LAB_HELPER=${HERDR_LAB_HELPER:-$ROOT/bin/fm-herdr-lab.sh}
 SESSION=$("$LAB_HELPER" name fm-send-secondmate-marker-v7)
 TMP_ROOT=$(mktemp -d "${TMPDIR:-/tmp}/fm-send-marker-herdr-e2e.XXXXXX")
+fm_test_lab_adopt "$TMP_ROOT"
+"$ROOT/bin/fm-lab-home.sh" record-herdr-session "$TMP_ROOT" "$SESSION" \
+  || fail "could not record the Herdr lab session in the lab binding"
 SENDER_HOME="$TMP_ROOT/sender-home"
 SECOND_HOME="$TMP_ROOT/secondmate-home"
 CAPTURE="$TMP_ROOT/pi-before-agent.jsonl"
@@ -43,7 +48,11 @@ cleanup() {
   if ! "$LAB_HELPER" teardown "$SESSION"; then
     rc=1
   fi
-  rm -rf "$TMP_ROOT"
+  if [ "$rc" -eq 0 ] || [ "${KEEP_LAB_ARTIFACTS:-}" != 1 ]; then
+    fm_test_lab_remove "$TMP_ROOT"
+  else
+    printf 'kept lab artifacts at %s\n' "$TMP_ROOT" >&2
+  fi
   exit "$rc"
 }
 trap cleanup EXIT
@@ -108,7 +117,7 @@ printf '#!/usr/bin/env bash\nexec %q -e %q "$@"\n' "$REAL_PI" "$CAPTURE_EXTENSIO
 chmod +x "$FAKEBIN/pi"
 
 "$LAB_HELPER" provision "$SESSION"
-PATH="$FAKEBIN:$ORIGINAL_PATH" FM_GATE_REFUSE_BYPASS=1 FM_HOME="$SENDER_HOME" HERDR_SESSION="$SESSION" \
+PATH="$FAKEBIN:$ORIGINAL_PATH" FM_HOME="$SENDER_HOME" HERDR_SESSION="$SESSION" \
   "$ROOT/bin/fm-spawn.sh" "$ID" "$SECOND_HOME" --secondmate --harness pi --backend herdr >/dev/null
 
 META="$SENDER_HOME/state/$ID.meta"
@@ -156,13 +165,37 @@ wait_for_prompt 'Isolated marker capture secondmate' \
   || fail "real Pi before_agent_start capture did not load for the startup charter"
 wait_for_idle || fail "real Pi did not become idle after the startup capture"
 
-PATH="$FAKEBIN:$ORIGINAL_PATH" FM_GATE_REFUSE_BYPASS=1 FM_HOME="$SENDER_HOME" \
-  "$ROOT/bin/fm-send.sh" "$ID" "$REQUEST" >/dev/null
-wait_for_prompt "$REQUEST" || fail "real Pi did not receive the exact-id fm-send request"
-GOT=$(jq -r --arg needle "$REQUEST" 'select(.prompt | contains($needle)) | .prompt' "$CAPTURE" | tail -1)
-[ "$GOT" = "${FM_FROMFIRST_MARK}${REQUEST}" ] \
-  || fail "real Pi exact-id prompt did not contain exactly one terminal-safe marker"$'\n'"--- bytes ---"$'\n'"$(printf '%s' "$GOT" | od -An -tx1)"
-printf 'evidence: exact-id received-hex=%s\n' "$(printf '%s' "$GOT" | od -An -tx1 | tr -d ' \n')"
+PATH="$FAKEBIN:$ORIGINAL_PATH" FM_HOME="$SENDER_HOME" \
+  "$ROOT/bin/fm-send.sh" "$ID" "$REQUEST" >"$TMP_ROOT/send.out" 2>"$TMP_ROOT/send.err"
+rc=$?
+[ "$rc" -eq 0 ] || { cat "$TMP_ROOT/send.err" >&2; fail "exact-id fm-send exited $rc"; }
+
+# Inbox-plane delivery (fm-send.sh #2856): the durable .msg record IS the
+# delivery - it carries marker, correlation, and request bytes - while the
+# terminal receives only the constant doorbell line. Assert the record's bytes
+# directly, then let the drain prompt prove the ring reached the pane.
+INBOX_DIR="$SENDER_HOME/state/$ID.inbox"
+REC=''
+for _ in $(seq 1 240); do
+  for candidate in "$INBOX_DIR"/*.msg "$INBOX_DIR"/handled/*.msg; do
+    [ -f "$candidate" ] || continue
+    REC=$candidate
+    break
+  done
+  [ -n "$REC" ] && break
+  sleep 0.25
+done
+[ -n "$REC" ] || fail "exact-id fm-send wrote no steering inbox record"
+GOT=$(fm_task_inbox_body "$REC")
+case "$GOT" in
+  "${FM_FROMFIRST_MARK}corr="*" ${REQUEST}") : ;;
+  *) fail "inbox record does not carry marker + correlation + request"$'\n'"--- body ---"$'\n'"$(printf '%s' "$GOT" | od -An -tx1)" ;;
+esac
+[ "$(printf '%s' "$GOT" | grep -o 'fm-from-firstmate' | wc -l | tr -d ' ')" = 1 ] \
+  || fail "inbox record does not contain exactly one from-firstmate marker"$'\n'"--- body ---"$'\n'"$(printf '%s' "$GOT" | od -An -tx1)"
+wait_for_prompt 'instruction waiting' \
+  || fail "real Pi did not ring the exact-id steering doorbell"
+printf 'evidence: exact-id record-hex=%s\n' "$(printf '%s' "$GOT" | od -An -tx1 | tr -d ' \n')"
 pass "real Pi/Herdr: exact-id FM_HOME send delivers exactly one from-firstmate marker"
 wait_for_idle || fail "real Pi did not become idle after the exact-id capture"
 
diff --git a/tests/fm-sessionstart-instruction-refresh-live-e2e.test.sh b/tests/fm-sessionstart-instruction-refresh-live-e2e.test.sh
index 42819acc1bb..f972bf1d757 100755
--- a/tests/fm-sessionstart-instruction-refresh-live-e2e.test.sh
+++ b/tests/fm-sessionstart-instruction-refresh-live-e2e.test.sh
@@ -30,10 +30,13 @@ set -u
 fm_live_gate opt-in FM_SESSIONSTART_INSTRUCTION_REFRESH_LIVE_E2E pi tmux git
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-TMUX_SOCKET="fm-sessionstart-instruction-refresh-$$"
+# The tmux socket file lives at TMUX_TMPDIR/tmux-<uid>/TMUX_SOCKET; with the
+# TMPDIR-rooted lab that whole path must stay under the Unix socket name
+# limit, so the lab dir and socket names are kept short.
+TMUX_SOCKET="insref-$$"
 TMUX_SESSION="instruction-refresh"
 LAB=${TMPDIR:-/tmp}
-LAB="${LAB%/}/fm-sessionstart-instruction-refresh-live-e2e.$$"
+LAB="${LAB%/}/fm-insref.$$"
 PROJECT="$LAB/project"
 HOME_DIR="$LAB/home"
 NONCE=$(od -An -N12 -tx1 /dev/urandom | tr -d ' \n')
@@ -103,11 +106,17 @@ send_line() {  # <text>
 
 cleanup() {
   tmux -L "$TMUX_SOCKET" kill-server >/dev/null 2>&1 || true
-  rm -rf "$LAB"
+  fm_test_lab_remove "$LAB"
 }
 trap cleanup EXIT INT TERM
 
 mkdir -p "$LAB"
+fm_test_lab_adopt "$LAB"
+# The suite's own private tmux socket already isolates the server; under the
+# gate's structural lab authorization the socket directory must also sit
+# inside a marked lab dir.
+mkdir -p "$LAB/tt"
+export TMUX_TMPDIR="$LAB/tt"
 git clone --quiet --no-hardlinks "$ROOT" "$PROJECT" || fail "could not create isolated Firstmate checkout"
 git -C "$PROJECT" checkout -q -B main "$TEST_COMMIT" \
   || fail "could not check out isolated test ref $TEST_REF ($TEST_COMMIT)"
@@ -137,8 +146,12 @@ git -C "$PROJECT" add AGENTS.md
 git -C "$PROJECT" commit -q -m "test: initial instruction contract" || fail "could not commit initial instruction contract"
 printf '%s\n' '{"compaction":{"keepRecentTokens":200}}' > "$PROJECT/.pi/settings.json"
 
-tmux -L "$TMUX_SOCKET" new-session -d -s "$TMUX_SESSION" -c "$PROJECT" -x 220 -y 55 \
-  -e "FM_HOME=$HOME_DIR" -e "FM_ROOT_OVERRIDE=$PROJECT" -e "FM_GATE_REFUSE_BYPASS=1" \
+# The pane is a real session, not a gate agent: the server is started with the
+# gate marker scrubbed so it cannot leak through the server environment into
+# the Pi extension's sessionstart wrapper, which would correctly stand down.
+env -u NO_MISTAKES_GATE \
+  tmux -L "$TMUX_SOCKET" new-session -d -s "$TMUX_SESSION" -c "$PROJECT" -x 220 -y 55 \
+  -e "FM_HOME=$HOME_DIR" -e "FM_ROOT_OVERRIDE=$PROJECT" -e "TMUX_TMPDIR=$LAB/tt" \
   pi --no-tools -e "$PROJECT/.pi/extensions/fm-primary-turnend-guard.ts" \
   || fail "could not start isolated Pi session"
 
@@ -161,7 +174,7 @@ wait_for_file "$HOME_DIR/state/.sessionstart-e2e-sources" 120 || {
   capture >&2
   fail "Pi extension did not invoke the real session-start wrapper"
 }
-grep -Fqx -- 'argv=--source startup pi=true root='"$PROJECT"' home='"$HOME_DIR" "$HOME_DIR/state/.sessionstart-e2e-sources" >/dev/null || {
+grep -Fqx -- 'argv=--source startup --pi-prerequisite pi=true root='"$PROJECT"' home='"$HOME_DIR" "$HOME_DIR/state/.sessionstart-e2e-sources" >/dev/null || {
   capture >&2
   printf '# Pi session-start sources:\n' >&2
   cat "$HOME_DIR/state/.sessionstart-e2e-sources" >&2
diff --git a/tests/fm-sessionstart-nudge.test.sh b/tests/fm-sessionstart-nudge.test.sh
index 03bedf85502..7c9b301f961 100755
--- a/tests/fm-sessionstart-nudge.test.sh
+++ b/tests/fm-sessionstart-nudge.test.sh
@@ -48,7 +48,7 @@ make_primary() {
 
 run_nudge() {
   local root=$1
-  FM_GATE_REFUSE_BYPASS=0 FM_ROOT_OVERRIDE="$root" FM_HOME="$root" "$NUDGE"
+  FM_ROOT_OVERRIDE="$root" FM_HOME="$root" "$NUDGE"
 }
 
 expect_silent_zero() {
@@ -74,7 +74,7 @@ test_genuine_primary_nudges() {
 test_gate_env_is_silent() {
   local root="$TMP_ROOT/gate-env"
   make_primary "$root"
-  expect_silent_zero "gate env nudge" env NO_MISTAKES_GATE=1 FM_GATE_REFUSE_BYPASS=0 \
+  expect_silent_zero "gate env nudge" env NO_MISTAKES_GATE=1 \
     FM_ROOT_OVERRIDE="$root" FM_HOME="$root" "$NUDGE"
   pass "fm-sessionstart-nudge: NO_MISTAKES_GATE is silent"
 }
@@ -89,7 +89,7 @@ test_gate_common_dir_is_silent() {
   mkdir -p "$root/bin" "$root/state"
   : > "$root/AGENTS.md"
   printf 'gate-test\n' > "$root/.fm-secondmate-home"
-  expect_silent_zero "gate common-dir nudge" env FM_GATE_REFUSE_BYPASS=0 \
+  expect_silent_zero "gate common-dir nudge" env \
     FM_ROOT_OVERRIDE="$root" FM_HOME="$root" "$NUDGE"
   pass "fm-sessionstart-nudge: .no-mistakes gate common-dir is silent"
 }
@@ -150,7 +150,7 @@ test_namespace_pid1_lock_holder_is_silent() {
   # Non-vacuity: inside the same namespace, with no lock at all, the hook must
   # still produce its nudge, so silence below means the owner was recognized.
   out=$(unshare -rpf --mount-proc bash -c \
-    "FM_GATE_REFUSE_BYPASS=0 FM_ROOT_OVERRIDE='$root' FM_HOME='$root' '$NUDGE'; exit \$?") || status=$?
+    "FM_ROOT_OVERRIDE='$root' FM_HOME='$root' '$NUDGE'; exit \$?") || status=$?
   expect_code 0 "$status" "namespace nudge without a lock"
   [ "$out" = "$NUDGE_LINE" ] \
     || fail "the namespace fixture did not nudge without a lock, so its silence proves nothing: $out"
@@ -158,7 +158,7 @@ test_namespace_pid1_lock_holder_is_silent() {
   printf '1\n' > "$root/state/.lock"
   status=0
   out=$(unshare -rpf --mount-proc bash -c \
-    "FM_GATE_REFUSE_BYPASS=0 FM_ROOT_OVERRIDE='$root' FM_HOME='$root' '$NUDGE'; exit \$?") || status=$?
+    "FM_ROOT_OVERRIDE='$root' FM_HOME='$root' '$NUDGE'; exit \$?") || status=$?
   expect_code 0 "$status" "namespace pid 1 lock nudge"
   [ -z "$out" ] \
     || fail "a lock held by the harness at namespace pid 1 was not recognized, got: $out"
@@ -225,14 +225,14 @@ run_hook() {  # <root> [args...]
   local root=$1
   shift
   env -u CLAUDECODE -u PI_CODING_AGENT -u FM_PI_HARNESS -u GROK_AGENT \
-    FM_GATE_REFUSE_BYPASS=0 FM_ROOT_OVERRIDE="$root" FM_HOME="$root" PATH="$RUN_PATH" "$RUN" "$@"
+    FM_ROOT_OVERRIDE="$root" FM_HOME="$root" PATH="$RUN_PATH" "$RUN" "$@"
 }
 
 run_hook_pi() {  # <root> [args...]
   local root=$1
   shift
   env -u CLAUDECODE -u GROK_AGENT PI_CODING_AGENT=true FM_PI_HARNESS=pi \
-    FM_GATE_REFUSE_BYPASS=0 FM_ROOT_OVERRIDE="$root" FM_HOME="$root" PATH="$RUN_PATH" "$RUN" "$@"
+    FM_ROOT_OVERRIDE="$root" FM_HOME="$root" PATH="$RUN_PATH" "$RUN" "$@"
 }
 
 # Every run-tier assertion keys off the digest banner, which fm-session-start.sh
@@ -941,7 +941,7 @@ SH
   chmod +x "$fixture/bin/"*.sh
 
   out=$(EXT="$fixture/.pi/extensions/fm-primary-turnend-guard.ts" \
-    FM_HOME="$fixture" FM_ROOT_OVERRIDE="$fixture" FM_GATE_REFUSE_BYPASS=1 \
+    FM_HOME="$fixture" FM_ROOT_OVERRIDE="$fixture" \
     node --input-type=module 2>&1 <<'JS'
 import { pathToFileURL } from "node:url";
 const handlers = new Map();
@@ -1016,10 +1016,10 @@ test_run_gate_and_scope_are_silent() {
   local root="$TMP_ROOT/run-gate" base="$TMP_ROOT/run-linked-base" linked="$TMP_ROOT/run-linked"
   local out status=0
   make_run_primary "$root"
-  expect_silent_zero "gate env run" env NO_MISTAKES_GATE=1 FM_GATE_REFUSE_BYPASS=0 \
+  expect_silent_zero "gate env run" env NO_MISTAKES_GATE=1 \
     FM_ROOT_OVERRIDE="$root" FM_HOME="$root" PATH="$RUN_PATH" "$RUN" --source startup
   assert_absent "$root/state/.lock" "a gate agent's session open still took the fleet lock"
-  out=$(env NO_MISTAKES_GATE=1 FM_GATE_REFUSE_BYPASS=0 \
+  out=$(env NO_MISTAKES_GATE=1 \
     FM_ROOT_OVERRIDE="$root" FM_HOME="$root" PATH="$RUN_PATH" \
     "$RUN" --source startup --pi-prerequisite 2>&1) || status=$?
   expect_code 3 "$status" "gate env Pi prerequisite stand-down"
diff --git a/tests/fm-spawn-batch.test.sh b/tests/fm-spawn-batch.test.sh
index ab447397c0e..22b0b382ae5 100755
--- a/tests/fm-spawn-batch.test.sh
+++ b/tests/fm-spawn-batch.test.sh
@@ -16,10 +16,21 @@ SPAWN="$ROOT/bin/fm-spawn.sh"
 TMP_ROOT=$(fm_test_tmproot fm-spawn-batch)
 export FM_BACKEND=tmux
 
+# Under a no-mistakes gate, lifecycle calls need a structurally authorized lab
+# home (FM_HOME='' would resolve to the real checkout and be refused, correctly).
+# Outside a gate the suite keeps the ambient-default resolution it always used.
+GATE_LAB_HOME="$TMP_ROOT/home"
+mkdir -p "$GATE_LAB_HOME/state" "$GATE_LAB_HOME/data"
+if [ "${NO_MISTAKES_GATE:-}" = 1 ]; then
+  SPAWN_HOME="$GATE_LAB_HOME"
+else
+  SPAWN_HOME=''
+fi
+
 # Clear ambient firstmate overrides so the behavior test owns its environment.
 run_spawn() {
   FM_ROOT_OVERRIDE='' \
-    FM_HOME='' \
+    FM_HOME="$SPAWN_HOME" \
     FM_STATE_OVERRIDE='' \
     FM_DATA_OVERRIDE='' \
     FM_PROJECTS_OVERRIDE='' \
diff --git a/tests/fm-test-fixture-cleanup.test.sh b/tests/fm-test-fixture-cleanup.test.sh
index 3f22602cb3d..58cfd476602 100755
--- a/tests/fm-test-fixture-cleanup.test.sh
+++ b/tests/fm-test-fixture-cleanup.test.sh
@@ -80,18 +80,17 @@ test_cleanup_registry_resists_precreation() {
 }
 
 test_fixture_registration_failure_rolls_back_root() {
-  local harness failure_tmp registry_dir output leaked_root
+  local harness registry_dir output leaked_root
   harness=$(fm_test_tmproot fm-test-cleanup-registration-harness)
-  failure_tmp="$harness/tmp"
   registry_dir="$harness/registry-dir"
-  mkdir -p "$failure_tmp" "$registry_dir"
+  mkdir -p "$registry_dir"
 
-  if output=$(TMPDIR="$failure_tmp" FM_TEST_CLEANUP_REGISTRY="$registry_dir" \
+  if output=$(FM_TEST_CLEANUP_REGISTRY="$registry_dir" \
     fm_test_tmproot fm-test-cleanup-registration-failure 2>/dev/null); then
     fail "fm_test_tmproot succeeded after its cleanup registry rejected registration"
   fi
   [ -z "$output" ] || fail "fm_test_tmproot published an unregistered fixture root"
-  for leaked_root in "$failure_tmp"/fm-test-cleanup-registration-failure.*; do
+  for leaked_root in "$FM_TEST_LAB_DIR"/fm-test-cleanup-registration-failure.*; do
     [ ! -e "$leaked_root" ] || fail "fm_test_tmproot leaked a root after registration failed"
   done
   pass "failed fixture registration rolls back the new root"
@@ -117,7 +116,7 @@ test_orphan_sweep_respects_fixture_ownership() {
   done
   [ -s "$dirfile" ] || fail "the active child never published its fixture root before the wait timed out"
   active_dir=$(cat "$dirfile")
-  touch -t 202001010000 "$active_dir/.fm-test-fixture"
+  touch -t 202001010000 "$(dirname "$active_dir")/.fm-test-fixture"
 
   stale_dir=$(mktemp -d "${TMPDIR:-/tmp}/fm-test-cleanup-stale.XXXXXX")
   printf '%s\n%s\n' "$$" reused-process-identity > "$stale_dir/.fm-test-fixture"
diff --git a/tests/fm-wake-queue.test.sh b/tests/fm-wake-queue.test.sh
index f64df38f6fc..4a7f7494731 100755
--- a/tests/fm-wake-queue.test.sh
+++ b/tests/fm-wake-queue.test.sh
@@ -253,9 +253,16 @@ foreign_stall_watch_leg() {  # <dir> <leg> <now> [observation]
       sleep 0.1
       i=$((i + 1))
     done
-    ! is_live_non_zombie "$pid" || kill -TERM "$pid" 2>/dev/null || true
+    # This leg tests the queue observation, not watcher shutdown/recovery.
+    # TERM can leave bash waiting in a child on some runners; stop the owned
+    # fixture process and clear only its watcher lifecycle state before the
+    # next leg starts against the same queue and progress marker.
+    ! is_live_non_zombie "$pid" || kill -KILL "$pid" 2>/dev/null || true
   fi
   wait_for_exit "$pid" 600 || true
+  if [ -n "$observation" ]; then
+    rm -rf -- "$dir/state/.watch.lock" "$dir/state/.watcher-down"
+  fi
   if [ -n "$observation" ]; then
     [ "$(cat "$marker" 2>/dev/null || true)" = "$observation" ] \
       || fail "watcher leg $leg did not record observation '$observation': $(cat "$marker" 2>/dev/null)"
diff --git a/tests/herdr-test-safety.sh b/tests/herdr-test-safety.sh
index 810b4a518fe..553e31e6e99 100644
--- a/tests/herdr-test-safety.sh
+++ b/tests/herdr-test-safety.sh
@@ -8,15 +8,26 @@ set -u
 . "$(dirname "${BASH_SOURCE[0]}")/git-config-helpers.sh"
 
 # Herdr backend tests drive the real fm-spawn/fm-teardown but do not source
-# tests/lib.sh, so exempt them from the gate-lifecycle refusal here too (see
-# tests/lib.sh and bin/fm-gate-refuse-lib.sh for why firstmate's own suite,
-# which the no-mistakes gate runs from a gate worktree, must be exempt).
-export FM_GATE_REFUSE_BYPASS=1
+# tests/lib.sh. Under the gate-lifecycle refusal (bin/fm-gate-refuse-lib.sh)
+# their fixture homes need the same disposable-lab marking fm_test_tmproot
+# applies, so each suite marks its scratch root with fm_test_lab_adopt (or
+# bin/fm-lab-home.sh adopt) right after creating it; the fm-lab-* session
+# names already satisfy the backend-isolation side of the lab contract.
 
 HERDR_TEST_SAFETY_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 # shellcheck source=/dev/null
 . "$HERDR_TEST_SAFETY_DIR/bin/fm-herdr-lab.sh"
 
+fm_test_lab_adopt() { # <dir>
+  "$HERDR_TEST_SAFETY_DIR/bin/fm-lab-home.sh" adopt "$1" >/dev/null
+}
+
+# Remove an adopted lab through the helper so its binding record goes with it;
+# a dir that never became a lab is simply removed.
+fm_test_lab_remove() { # <dir>
+  "$HERDR_TEST_SAFETY_DIR/bin/fm-lab-home.sh" teardown "$1" >/dev/null 2>&1 || rm -rf "$1"
+}
+
 # herdr_forget_inherited_pane: drop the Herdr PANE identity this test process
 # inherited from whatever terminal it was started in.
 #
diff --git a/tests/lib.sh b/tests/lib.sh
index 4429362ae55..fc7960c9b3d 100644
--- a/tests/lib.sh
+++ b/tests/lib.sh
@@ -38,14 +38,31 @@ umask 022
 # shellcheck source=tests/git-config-helpers.sh
 . "$(dirname "${BASH_SOURCE[0]}")/git-config-helpers.sh"
 
-# Exempt firstmate's own test suite from the gate-lifecycle refusal
-# (bin/fm-gate-refuse-lib.sh). The no-mistakes gate runs this suite FROM a gate
-# worktree - the exact environment that guard refuses - so without this every
-# test that drives the real fm-spawn/fm-send/fm-teardown would be refused during
-# firstmate's own validation. A confused gate agent never sources this helper, so
-# the boundary against the real hazard is unaffected. tests/fm-gate-refuse.test.sh
-# strips this to verify real refusal.
-export FM_GATE_REFUSE_BYPASS=1
+# Let firstmate's own test suite drive the REAL fm-spawn/fm-send/fm-teardown
+# under the gate-lifecycle refusal (bin/fm-gate-refuse-lib.sh). The no-mistakes
+# gate runs this suite FROM a gate worktree - the exact environment that guard
+# refuses - so fixture roots created through fm_test_tmproot below live inside
+# the suite's disposable lab dir, marked with bin/fm-lab-home.sh: the structural lab
+# authorization then proves on disk what the retired FM_GATE_REFUSE_BYPASS env
+# flag asserted on the honor system (temp-rooted, helper-marked,
+# backend-isolated). Suites that build fixture homes outside fm_test_tmproot
+# mark their scratch root with bin/fm-lab-home.sh adopt instead.
+FM_TEST_LAB_HOME_HELPER="$(cd "$(dirname "${BASH_SOURCE[0]}")/../bin" && pwd -P)/fm-lab-home.sh"
+
+fm_test_lab_adopt() { # <dir>
+  "$FM_TEST_LAB_HOME_HELPER" adopt "$1" >/dev/null
+}
+
+# Remove an adopted lab through the helper so its binding record goes with it;
+# a dir that never became a lab is simply removed.
+fm_test_lab_remove() { # <dir>
+  "$FM_TEST_LAB_HOME_HELPER" teardown "$1" >/dev/null 2>&1 || rm -rf "$1"
+}
+
+# Arms the test-only seams bin/ scripts expose (e.g. fm-afk-launch.sh's
+# FM_TEST_HARNESS harness pin). Production processes never export it, so a
+# leaked seam variable stays inert outside a suite.
+export FM_TEST_SEAM=1
 
 # Clear the task-worker marker bin/fm-spawn.sh exports into ship and scout
 # panes. This suite builds git-init fixture repositories whose primary checkout
@@ -111,6 +128,36 @@ FM_TEST_OWNER_IDENTITY=$(fm_test_pid_identity "$$") || {
   return 1
 }
 
+# The suite's own disposable lab dir: every fm_test_tmproot fixture root is
+# created inside it, and it is also the suite's private tmux socket dir, so a
+# case driving real tmux under the gate lands on this lab's own server rather
+# than the default one (bin/fm-gate-refuse-lib.sh binds backend containment
+# to the authorized home's lab). Created at source time because
+# fm_test_tmproot runs inside command substitution, where an export could
+# never reach the suite shell. It carries the same owner marker as a fixture
+# root, so fm_test_reap_orphans reclaims it after a hard kill.
+FM_TEST_LAB_DIR=$(mktemp -d "${TMPDIR:-/tmp}/fm-test-lab.XXXXXX") || {
+  rm -f "$FM_TEST_CLEANUP_REGISTRY"
+  return 1
+}
+if ! FM_TEST_LAB_DIR=$(cd -P -- "$FM_TEST_LAB_DIR" && pwd -P) ||
+  ! printf '%s\n%s\n' "$$" "$FM_TEST_OWNER_IDENTITY" > "$FM_TEST_LAB_DIR/.fm-test-fixture" ||
+  ! printf '%s\n' "$FM_TEST_LAB_DIR" >> "$FM_TEST_CLEANUP_REGISTRY" ||
+  ! fm_test_lab_adopt "$FM_TEST_LAB_DIR"; then
+  rm -rf "$FM_TEST_LAB_DIR" "$FM_TEST_CLEANUP_REGISTRY"
+  return 1
+fi
+export TMUX_TMPDIR="$FM_TEST_LAB_DIR"
+
+# A suite launched from inside a Herdr/cmux/tmux pane inherits that pane's
+# backend identity (HERDR_ENV, HERDR_SESSION, CMUX_WORKSPACE_ID, TMUX), which
+# would steer backend-resolving fixture calls at the ambient real backend
+# instead of the suite's own fixtures - the same leak herdr-test-safety's
+# herdr_forget_inherited_pane scrubs for the per-home container suites. Suites
+# that mean to exercise a backend set its markers explicitly per invocation.
+unset TMUX HERDR_ENV HERDR_PANE_ID HERDR_TAB_ID HERDR_WORKSPACE_ID \
+  HERDR_SOCKET_PATH HERDR_SESSION CMUX_WORKSPACE_ID
+
 # --- process-event runner reaping -------------------------------------------
 #
 # A process-event runner is detached into its own process group and reparents to
@@ -164,6 +211,7 @@ export FM_TEST_STUB_MAX_BLOCK_SECONDS
 fm_test_cleanup() {
   local d
   fm_test_reap_procevent_homes
+  fm_test_lab_remove "$FM_TEST_LAB_DIR"
   for d in "${FM_TEST_CLEANUP_DIRS[@]:-}"; do
     [ -n "$d" ] && rm -rf "$d"
   done
@@ -176,10 +224,8 @@ fm_test_cleanup() {
 }
 
 fm_test_tmproot() {
-  local prefix=${1:-fm-test} root tmp_base
-  tmp_base=${TMPDIR:-/tmp}
-  tmp_base=${tmp_base%/}
-  root=$(mktemp -d "$tmp_base/${prefix}.XXXXXX") || return 1
+  local prefix=${1:-fm-test} root
+  root=$(mktemp -d "$FM_TEST_LAB_DIR/${prefix}.XXXXXX") || return 1
   root=$(cd -P -- "$root" && pwd -P) || return 1
   if ! printf '%s\n%s\n' "$$" "$FM_TEST_OWNER_IDENTITY" > "$root/.fm-test-fixture" ||
     ! printf '%s\n' "$root" >> "$FM_TEST_CLEANUP_REGISTRY"; then
@@ -226,7 +272,7 @@ fm_test_reap_orphans() {
     if [ -d "$dir" ] && [ ! -L "$dir" ]; then
       find "$dir" -type d -exec chmod u+rwx {} + 2>/dev/null || true
     fi
-    rm -rf "$dir"
+    fm_test_lab_remove "$dir"
   done
 }
 
@@ -262,9 +308,10 @@ fi
 # actually ran. Setting one to 0 (or FM_LIVE=0) turns it off; a guard's own
 # variable wins over FM_LIVE.
 #
-# Sourcing this library also exports FM_GATE_REFUSE_BYPASS=1, which is what
-# lets a live guard drive the real fm-spawn/fm-send/fm-teardown from inside a
-# no-mistakes gate worktree instead of being refused by
+# Sourcing this library creates every fm_test_tmproot fixture root inside the
+# suite's adopted lab dir and points TMUX_TMPDIR at that same lab, which is
+# what lets a live guard drive the real fm-spawn/fm-send/fm-teardown from
+# inside a no-mistakes gate worktree instead of being refused by
 # bin/fm-gate-refuse-lib.sh.
 
 fm_live_gate() {