diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
index dc54678..2139c41 100644
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -18,7 +18,7 @@
       "name": "work-system",
       "source": "./plugins/work-system",
       "description": "Generic task and worktree workflow system for Claude Code. Manage tasks as markdown files, run them in isolated git worktrees with a choice of worker agent (Claude, codex, grok, or kimi), and track progress across the define/kickoff/continue/status/close lifecycle.",
-      "version": "1.11.0"
+      "version": "1.11.1"
     },
     {
       "name": "pr-flow",
diff --git a/.claude/knowledge/_index.md b/.claude/knowledge/_index.md
index 30ad4f7..77cea69 100644
--- a/.claude/knowledge/_index.md
+++ b/.claude/knowledge/_index.md
@@ -12,7 +12,7 @@
 ## Features
 - `features/backfill-and-origin-metadata.md` — `/backfill-knowledge` significance bar + origin-reconstruction cascade
 - `features/statusline-integration.md` — Status-line segments: plugins can't own `statusLine.command`; marker-block injection; the `[ks …]` + `[ws …]` two-segment coexistence and ws's never-block-on-network PR cache
-- `features/herdr-kickoff-automation.md` — herdr `herdr-launch.sh`: `launch` (`/kickoff` + `/adopt`) + `resume` (`/continue <task>` reopens an `/exit`-closed tab)
+- `features/herdr-kickoff-automation.md` — herdr `herdr-launch.sh`: `launch` (`/kickoff` + `/adopt`) + `resume`; feature-detected dual contract (legacy placement vs 0.7.5+ `agent start --kind --pane`), registry-declared transport, rollback vs `blocked=unverified`, worker death from process state not terminal text
 - `features/lane-registry.md` — `lanes.sh` + `herdr-agent.sh` (Wave 1): the one herdr-agent wrapper (degrade-not-block, bounded wait) + centralized `$HERDR_MATCH_PRELUDE` cwd↔worktree match (consumed by herdr-tab-glyph, regression-guarded via live snapshot); lanes.sh joins states+liveness keyed by worktree_path with a worktree-tab-state degrade tri-state; env test-seams for hermetic join tests
 - `features/herdr-close-automation.md` — `/close` in herdr: cwd-tab teardown, plugin SessionEnd hook, the one TUI-exit primitive, detached self-exit onto idle
 - `features/herdr-tab-glyphs.md` — Task-state glyphs (`○ ● ◇ ◆ ✓`) + main-root `◉` on herdr tab labels: `states` mode in the self-contained renderer, sync-vs-`--cached` PR refresh per caller, exact-cwd rename rules, soft pr-flow shim
diff --git a/.claude/knowledge/features/herdr-close-automation.md b/.claude/knowledge/features/herdr-close-automation.md
index 46f38b1..391710d 100644
--- a/.claude/knowledge/features/herdr-close-automation.md
+++ b/.claude/knowledge/features/herdr-close-automation.md
@@ -1,10 +1,10 @@
 ---
 title: "herdr /close Automation"
 createdAt: 2026-06-24
-updatedAt: 2026-07-12
+updatedAt: 2026-08-11
 createdFrom: "PR #18"
-updatedFrom: "session: 2026-07-12"
-pluginVersion: 1.8.2
+updatedFrom: "session: 2026-08-11 (herdr 0.7.5+ shell-pane lifecycle)"
+pluginVersion: 1.11.1
 prime: false
 reindexedAt: 2026-07-12
 ---
@@ -77,13 +77,19 @@ cleanly from another process:
   **is** the clean exit. (`send-text "/exit"` alone opens the slash-command menu;
   the separate `Return` runs it.)
 
-## Gotcha: clean exit auto-closes the tab; inject onto idle, not mid-turn
+## Gotcha: whether a clean exit closes the tab depends on the herdr version
 
-- When Claude is the tab's **root pane** (kickoff launches it via `agent start --
-  claude`), a clean `/exit` ends the pane's only process, so herdr **auto-closes the
-  tab**. The `SessionEnd` hook's `herdr tab close` is therefore a *backup* — it does
-  the real work only for sessions where Claude is *not* the root pane (e.g. launched
-  inside a shell pane), where exiting drops back to the shell and the tab survives.
+- **Only when Claude is the tab's root pane** does a clean `/exit` end the pane's
+  only process and make herdr auto-close the tab. That held while `/kickoff` used the
+  legacy `agent start --workspace --cwd -- <argv>` placement (herdr ≤0.7.4).
+- **herdr 0.7.5+ inverted it.** `agent start` now requires an already-open pane, so a
+  kickoff worker runs *inside* a shell pane: `/exit` drops back to that shell and the
+  tab survives. The `SessionEnd` hook's `herdr tab close` — armed by `/close`'s
+  per-pane marker — became the **primary** teardown there, not a backup. Never write
+  (or reason) as if the exit alone closed the tab; both paths rely on the marker.
+- What did **not** change: a modern kickoff worker is still a *registered* agent
+  (started via `agent start`), so `agent_status` keeps populating and the idle-poller
+  below is unaffected. Only the "who closes the tab" half moved.
 - **Self-close injects onto an idle prompt, never mid-turn.** `/close` is itself a
   turn; injecting `/exit` while Claude is busy is unreliable. The helper's `self-exit`
   arms a **detached** injector (`nohup … & disown`) that **polls the pane's
diff --git a/.claude/knowledge/features/herdr-kickoff-automation.md b/.claude/knowledge/features/herdr-kickoff-automation.md
index 0a22612..708fd0f 100644
--- a/.claude/knowledge/features/herdr-kickoff-automation.md
+++ b/.claude/knowledge/features/herdr-kickoff-automation.md
@@ -1,10 +1,10 @@
 ---
 title: "herdr /kickoff + /continue-reopen Automation"
 createdAt: 2026-06-24
-updatedAt: 2026-07-23
+updatedAt: 2026-08-11
 createdFrom: "PR #17"
-updatedFrom: "session: 2026-07-23 (adopt auto-launch reuses launch)"
-pluginVersion: 1.9.3
+updatedFrom: "session: 2026-08-11 (herdr 0.7.5+ dual launch contract)"
+pluginVersion: 1.11.1
 prime: false
 reindexedAt: 2026-07-12
 ---
@@ -28,7 +28,9 @@ truth; this entry captures the durable design and one non-obvious gotcha.
   work-system 1.9.3 by `/adopt` (see the adopt note below) — per the project's
   helper-script convention and the "prose skill logic drifts" memory. The skill only
   derives the label and branches on the helper's `moved=yes|no` / exit code.
-- **Spawn the worker as argv, never type it into a shell.** The launch is
+- **Spawn the worker as argv, never type it into a shell** (the LEGACY contract —
+  herdr ≤0.7.4; see "herdr 0.7.5 changed the launch contract" below for what the
+  modern path does instead). The launch is
   `herdr agent start "<label>" … -- <worker argv>`, which execs the worker binary
   directly. As of work-system 1.9.0 the worker argv is **resolved from the chosen
   agent** by `agent-registry.sh` (`emit_argv`), not hardcoded: a claude worker is
@@ -43,12 +45,12 @@ truth; this entry captures the durable design and one non-obvious gotcha.
   `-- argv` form sidesteps the interactive shell entirely, so there is no keystroke
   race against shell startup (see the gotcha below) and no readiness handshake to
   maintain.
-- **`agent start` splits the caller's tab → move it out.** `herdr agent start`
-  (without `--tab`) lands the agent as a split pane in the *invoking* tab, so a
+- **`agent start` splits the caller's tab → move it out** (LEGACY only). `herdr agent
+  start` (without `--tab`) lands the agent as a split pane in the *invoking* tab, so a
   second step `herdr pane move "<pane>" --new-tab --label "<label>"` relocates it
   into its own background tab — one tab per task. The pane id comes from the start
   call's `result.agent.pane_id` (parsed with `python3`; `herdr pane move` does **not**
-  accept an agent name as target — verified).
+  accept an agent name as target — verified). On 0.7.5+ there is no move at all.
 - **One short `LABEL` for agent name + session.** `agent start "<label>"` (immediate,
   deterministic sidebar label) and `claude -n "<label>"` use one short,
   sidebar-friendly name (filler words like `automate`/`in` dropped). The `task/<name>`
@@ -117,6 +119,115 @@ truth; this entry captures the durable design and one non-obvious gotcha.
   in all of this — every case above, plus the stdout contract, as regression
   coverage the first round shipped without.
 
+## herdr 0.7.5 changed the launch contract (work-system 1.11.1)
+
+herdr 0.7.5 (still current in 0.8.0) redefined `agent start`: it no longer places
+the agent, it **starts one in an already-open pane at an interactive shell prompt**
+— `agent start <NAME> --kind <KIND> --pane <ID> [--timeout <MS>] [-- <args>]`.
+Placement moved to a preceding `tab create --workspace … --cwd … --label …
+--no-focus`. work-system 1.11.0 still sent the old flags, so a real launch died with
+`herdr error: unknown option: --workspace` → "did not return a pane id". Durable
+decisions from the fix:
+
+- **Feature-detect the contract, never version-compare.** `detect_launch_api()` reads
+  `herdr agent start --help` (bounded, read-only — no process is started to find out):
+  `--kind` AND `--pane` → modern; else `--workspace` AND `--cwd` → legacy; else
+  **stop before creating or starting anything**. A version compare would be wrong by
+  construction: 0.7.x spans BOTH contracts, so half that range routes to the wrong
+  path. `$WORK_SYSTEM_HERDR_API` overrides it (hermetic tests, and an escape hatch if
+  a future help text stops naming its flags).
+- **The registry declares the transport; the launcher never infers it.**
+  `agent-registry.sh resolve` emits `herdr_mode=agent-start|pane-run` +
+  `herdr_kind=<canonical cli>`. `agent-start` means
+  argv[0] IS herdr's canonical executable for that kind, so the launcher drops
+  exactly that word and passes the rest to `--kind` unchanged — a *check*, not a
+  transformation, which is what keeps argument order and boundaries (codex/grok's
+  one-word bootstrap prompt, claude's one-word `/work-system:continue`) intact.
+  `pane-run` is for wrappers that cannot be projected onto a native kind — kimi's
+  two-phase `sh -c` seed+continue — sent as the registry's `argv_shell=` in ONE
+  `pane run` command (no `eval`, no re-quoting). Unknown mode → fail closed BEFORE
+  `tab create`. The pair is deliberately generic so a dynamically-registered wrapper
+  (cc-harness, PR #52) is `pane-run` + `herdr_kind=claude` with no launcher change.
+- **`agent_pane_busy` is the real-world failure, and the ONLY retried one.** Right
+  after `tab create` the pane's login shell is still running its rc files (direnv,
+  sops, ssh-add — measured at ~4s here), and herdr rejects the start with that code.
+  It is retried within a bounded window; every other error is retried zero times,
+  because a retry loop over an unclassified error is how a launcher starts two
+  workers. Exit code 2 (clap usage text: "unsupported interactive agent kind",
+  "missing required --pane", "unknown option: …") and no-such-pane codes are
+  *definitive* — herdr never touched the pane.
+- **Roll back only what provably started nothing; never kill a maybe-worker.**
+  Definitive failures close the created tab exactly once through
+  `herdr-teardown.sh close-tab` (the existing close-then-verify SoT — it deliberately
+  does not re-issue the close, since a recycled tab id would kill an unrelated live
+  tab). Ambiguous outcomes — readiness timeout, an unclassifiable herdr error, a
+  returned pane id that isn't the requested one, a wrapper detected as the wrong kind
+  — leave the tab alone and return the new fail-closed `blocked=unverified` result
+  (exit 0, `blocked` FIRST). An *unconfirmed* rollback downgrades to the same result:
+  a tab that may still exist must not be reported as a clean failure. Callers branch
+  on `blocked` before `moved`, and on it must not relaunch, print the manual worker
+  command, or persist a project default — mirroring the `resume` guard's shape.
+- **Wrapper readiness is herdr's own detection, not a timer.** After `pane run` the
+  launcher polls `pane get` until `result.pane.agent` equals the declared kind in
+  that exact pane. Verified live: herdr reports `agent=kimi` within ~5s of a
+  `kimi -p` seed (so the two-phase wrapper is detectable during phase 1, long before
+  `exec kimi -c --auto`), and `interactive_ready` is only set for agents started via
+  `agent start` — so it can't be the wrapper's signal. Before typing, a bounded wait
+  compares `pane process-info`'s `foreground_process_group_id` to `shell_pid`: equal
+  = the shell itself is in the foreground, i.e. safe to type into (the `pane run`
+  path has no herdr-side readiness check the way `agent start` does). An unreadable
+  answer degrades to "proceed" rather than blocking a launch forever.
+- **`moved=yes` is kept on the modern path** even though nothing moves — it means
+  "the verified worker is in its dedicated tab", and changing the key would break
+  every caller for a cosmetic gain.
+
+### Gotcha: a supervisor cannot take its signal from terminal text
+
+Deciding "did this worker die?" from what the pane SHOWS was attempted three times
+and failed three times. Each fix looked complete and closed exactly one channel:
+
+1. The literal must not appear in the command the launcher TYPES — a pane echoes
+   its command line, so the token inside the wrapper script matched itself and
+   rolled a **healthy** launch back after 2s (found live). Fixed by assembling it
+   at runtime (`m=WORKER_SEED` … `${m}_FAILED`).
+2. It must not appear in anything the worker READS — the kimi seed's whole job is
+   reading repository files, and in a work-system repo TASK.md, the CHANGELOG and
+   the tests all legitimately name the marker. Fixed with a per-launch nonce.
+3. But the nonce has to REACH the wrapper, and the only channel is the environment
+   of the process being supervised — so the worker can print its own death
+   certificate. And a rendered `pane read` snapshot is width-wrapped, so in a
+   narrow pane the match silently misses anyway. Forgeable *and* unreliable.
+
+The signal that works is process STATE, which output cannot fake — but not the
+obvious form of it. "The pane left its prompt (wrapper running) and came back
+(wrapper died)" is unusable: measured live, a seed that fails on startup — the case
+this exists to catch — is gone before the first 0.5s poll, and every sample reads
+`ready`. What is observable is the steady state: a `sh -c` wrapper puts a child in
+the foreground, so while it runs the pane is busy or its worker is detected. A pane
+sitting at its OWN shell prompt, no agent, for N consecutive polls (and past a
+wall-clock floor, so a `sleep` that ignores fractional seconds cannot collapse the
+budget) means nothing is running there — whether the seed died or the keystrokes
+never landed. Measured: a dead wrapper fails in ~5s with its tab rolled back, a
+healthy one is confirmed in ~2s; the floor sits between those two numbers on
+purpose. The wrapper still PRINTS its marker — for whoever reads the tab, not for
+the launcher.
+
+Generalizes twice over: a supervisor that greps a terminal must own that signal end
+to end (it may not appear in what it types in, nor in anything the supervised
+process can read and echo — closing only the first channel looks complete and
+isn't); and when you switch to process state, verify WHICH state transition is
+actually observable at your polling rate before trusting it.
+
+**Legacy has the same question with a cleaner answer.** There the wrapper is the
+tab's ROOT process, so an instantly-failing seed takes the pane and the tab with
+it — and the legacy path would still print `moved=yes` for a tab herdr had already
+closed. It now checks pane liveness through the pane LIST, tri-state: `gone` is
+definitive, an unreadable herdr is `blocked=unverified` (never death — declaring a
+live worker dead sends the caller to its manual block and invites a SECOND
+unattended worker onto the worktree). Native legacy launches skip the check
+entirely: their argv cannot self-terminate on a bad seed, and that contract is
+meant to stay byte-identical.
+
 ## `/adopt` auto-launch: reference kickoff's prose, don't duplicate it
 
 work-system 1.9.3 gave `/adopt` the same in-herdr tab launch as `/kickoff`: after it
@@ -142,9 +253,13 @@ optional `[agent-selector]` arg for it). Two durable decisions:
 
 ## `resume` mode: reopen a task tab a `/exit` closed
 
-A kickoff tab runs Claude as its **root pane** (argv-exec above), so a clean `/exit`
-— even one only meant to restart Claude Code — ends the pane and herdr closes the
-whole tab; the worktree and resumable session persist, but the tab is gone.
+A LEGACY kickoff tab runs Claude as its **root pane** (argv-exec above), so a clean
+`/exit` — even one only meant to restart Claude Code — ends the pane and herdr closes
+the whole tab; the worktree and resumable session persist, but the tab is gone. (On
+0.7.5+ the worker is started INTO a shell pane, so `/exit` leaves a bare shell in
+the tab instead — `resume` then finds that tab still open and only *focuses* it
+(`reused=yes`, `resumed=` empty); the `claude -c` is the caller's to run, since a
+cwd match cannot tell a live Claude from a surviving shell.)
 `/continue <task>` **from the main session** recovers it via `herdr-launch.sh
 resume`, which — unlike `launch` — uses `herdr tab create` + `pane run "claude -c"`
 so Claude runs **inside a shell pane**. Two durable decisions:
@@ -156,10 +271,13 @@ so Claude runs **inside a shell pane**. Two durable decisions:
   prevention: argv-exec's race-freedom is verified (the gotcha below), and `/close`'s
   teardown (self-exit poller on `agent_status`, SessionEnd hook keyed to
   Claude-as-root-pane) is built around the root-pane model — changing it risks that
-  machinery with no way to live-verify here. So kickoff tabs still die on `/exit`;
-  reopen is the one-command recovery, and reopened tabs are hardened. A race-free
-  *prevention* (`agent start … -- bash -lc 'claude …; exec "$SHELL" -i'`) is possible
-  but deferred pending live herdr agent-detection verification.
+  machinery with no way to live-verify here. So legacy kickoff tabs still die on
+  `/exit`; reopen is the one-command recovery, and reopened tabs are hardened.
+  **herdr 0.7.5+ settled this by force:** `agent start` requires an existing pane, so
+  a modern kickoff worker is *already* a shell-pane process and its tab survives
+  `/exit`. Live-verified consequence: it is still a **registered agent** (started via
+  `agent start`), so `agent_status` keeps working and `/close`'s poller is unaffected
+  — the marker + SessionEnd hook, not the exit itself, closes the tab.
 - **`claude -c`, no session-id stash.** Resume runs `claude -c` (most-recent session
   for the cwd). Each worktree hosts exactly one task, so its cwd is a 1:1 proxy for
   the session — `-c` is already unambiguous, and stashing a session id at kickoff
@@ -285,6 +403,14 @@ this exact sequence was verified live by hand. The race is a low-probability cos
 a manual recovery action, accepted for the tab-survival payoff — not the automated,
 frequently-run kickoff, where argv-exec's certainty wins.
 
+**On herdr 0.7.5+ the argv escape hatch is gone** — `agent start` needs a pane, so
+every launch goes through one. The race is handled rather than avoided: for native
+workers herdr owns it (it refuses with `agent_pane_busy` until the pane is at a
+prompt, which the launcher retries), and for `pane run` wrappers the launcher gates
+on `process-info` showing the shell itself in the foreground before typing. Same
+guarantee, different owner — which is *why* the busy retry is not optional
+book-keeping but the modern equivalent of argv-exec's race-freedom.
+
 Related: [skill-composition](../architecture/skill-composition.md) (kickoff softly
 drives `/continue` across a process boundary) ·
 [worktree-task-file-copy](../architecture/worktree-task-file-copy.md) (why the
diff --git a/.claude/knowledge/features/kickoff-agent-selection.md b/.claude/knowledge/features/kickoff-agent-selection.md
index 9a9551f..68c751d 100644
--- a/.claude/knowledge/features/kickoff-agent-selection.md
+++ b/.claude/knowledge/features/kickoff-agent-selection.md
@@ -1,10 +1,10 @@
 ---
 title: "Kickoff Agent Selection: registry, per-repo default, honest degradation"
 createdAt: 2026-07-17
-updatedAt: 2026-08-05
+updatedAt: 2026-08-11
 createdFrom: "session: 2026-07-17 (task/kickoff-agent-selection)"
-updatedFrom: "session: 2026-08-05 (task/add-kimi-worker-support, post-swarm)"
-pluginVersion: 1.11.0
+updatedFrom: "session: 2026-08-11 (herdr transport metadata + kimi seed stop)"
+pluginVersion: 1.11.1
 prime: false
 ---
 
@@ -32,6 +32,16 @@ launch). Skills never hardcode the CLI list. `default get` **validates** its
 committed value against the registry — a stale/removed/attacker-supplied name
 reads as "no default" (→ picker), never routes or bricks kickoff.
 
+Ownership extends to **how the worker reaches herdr** (1.11.1): each entry declares
+`herdr_mode=agent-start|pane-run` + `herdr_kind`, so the launcher never infers
+transport from a selector name or by parsing `argv[0]`. `agent-start` asserts
+argv[0] *equals* the kind (herdr's canonical executable) and hands the untouched
+tail to `--kind`; `pane-run` is for wrappers that no native kind can express — kimi
+today, and a dynamically-registered cc-harness entry (`pane-run` +
+`herdr_kind=claude`) tomorrow, with no launcher change. An entry whose mode the
+launcher does not know fails closed before anything is created. See
+[[herdr-kickoff-automation]] for the launch-side contract.
+
 ## grok availability is model-aware and bounded
 grok drops/renames models between releases (composer `grok-composer-2.5-fast`
 died in 0.2.10x; `grok-build`→`grok-4.5` before that). So grok availability
@@ -53,16 +63,22 @@ entry point but is mutually exclusive with **both** `--auto` and `-y` and exits
 after one answer, so it cannot *be* the worker. What makes it work: `-p` runs
 tools unattended, and `kimi -c` inherits its session history. Hence two phases:
 
-    sh -c 'kimi -m "$1" -p "$2" || <report+wait>; exec kimi -c --auto' \
+    sh -c 'if kimi -m "$1" -p "$2"; then exec kimi -c --auto;
+           else <marker + exit $rc>; fi' \
        kimi-worker <model> <prompt>        # exact text: KIMI_LAUNCH_SCRIPT
 
-`exec` re-roots the pane at kimi (herdr then watches the real process). A failed
-seed must neither kill the pane (`&&`) nor pass unnoticed (a bare `;` — the TUI's
-first repaint scrolls the error away, leaving a tab that looks like a working
-worker but never read TASK.md), so the script **reports and waits for a keypress**
-before handing over. Verified: a failed seed in a fresh worktree yields a NEW empty
-session, never a foreign one — `kimi -c` is scoped to the working directory, so two
-worktrees cannot cross-resume. Values ride as
+`exec` re-roots the pane at kimi (herdr then watches the real process). **A failed
+seed is a hard stop (1.11.1).** The first shape ran phase 2 regardless after a
+keypress, which produced the very trap it meant to avoid: an empty `kimi -c --auto`
+session that never read TASK.md but looks alive to herdr's detection *and* to the
+user — and in an unattended background tab nobody is there to press the key anyway.
+Now the failure branch prints a machine-readable ASCII marker
+(`[work-system] WORKER_SEED_FAILED: …`, assembled at runtime so the literal is not
+in the typed command — see [[herdr-kickoff-automation]]), says TASK.md was not
+started, and exits with the **seed's own** code without touching phase 2, so the
+launcher can classify it as a definitive failure and roll the tab back. On legacy
+herdr, where the wrapper is the tab's root process, this also closes the tab — a
+closed tab is honest where the empty session was actively misleading. Values ride as
 `"$1"`/`"$2"` positionals, never spliced into the script text — `-p` swallows the
 next token, so a concatenated argv is one reordering away from silently eating a
 flag (`kimi -p --auto "…"` makes `--auto` the prompt). The test asserts the exact
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2f5f217..97ba1c0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -52,6 +52,17 @@ entries are grouped per plugin, newest first.
 
 ## work-system
 
+### 1.11.1 — 2026-08-12
+- Fix automated `/kickoff` and `/adopt` worker launches under **herdr 0.7.5+ (incl. 0.8)**, which failed with `herdr error: unknown option: --workspace` → "did not return a pane id". `agent start` no longer places the agent; it starts one in an **already-open pane** (`agent start <name> --kind <kind> --pane <id> [-- <args>]`), with placement moved to a preceding `tab create`. The launcher now creates the task's final tab first and starts the worker in its root pane.
+- The contract is **feature-detected** from `herdr agent start --help` (read-only, bounded) rather than compared against a version — 0.7.x spans both contracts, so a version check would route half of it wrong. herdr 0.7.0–0.7.4 keeps its exact previous sequence, diagnostics and stdout contract; an unrecognizable `agent start` fails before creating a tab or starting anything.
+- `agent-registry.sh resolve` now declares the transport per entry: `herdr_mode=agent-start` + `herdr_kind` for claude/codex/grok (argv[0] must equal the kind, is dropped, and every remaining argument keeps its order and boundaries), `herdr_mode=pane-run` for kimi's two-phase wrapper, which no native kind can express. Unknown transport metadata fails closed before anything is created. The metadata is generic so a dynamically-registered wrapper entry needs no launcher change.
+- `agent_pane_busy` — herdr's rejection while the new pane's login shell is still running its rc files — is retried within a bounded window, and no other error is ever retried. Wrapper workers get a `pane process-info`-based shell-prompt wait before their command is typed, then are confirmed by polling until herdr detects the expected kind in that exact pane.
+- New fail-closed launch result `blocked=unverified` (exit 0, `blocked` first): a tab exists and a worker may be running, but the launch could not be confirmed (readiness timeout, unclassifiable herdr error, pane-id mismatch, wrong detected kind, or an unconfirmed rollback). `/kickoff` and `/adopt` branch on it **before** `moved=`, send you to inspect that tab, and must not relaunch, print the manual worker command, or persist a project default. Failures that provably started nothing roll their tab back exactly once instead.
+- A failed kimi seed is now a hard stop: it prints a marker, states TASK.md was not started, and exits with the seed's own code — no keypress wait and no empty `kimi -c --auto` session that looks like a healthy worker. That marker is for the **human** who opens the tab; the launcher does not grep it. Terminal text cannot carry a supervisor's signal: the pane echoes the command it was given (which rolled a *healthy* launch back in live 0.8 testing), the seed reads repository files that legitimately name the marker, salting it with a per-launch nonce means handing that nonce to the very process being supervised, and a rendered snapshot is width-wrapped. 
+- A dead wrapper is detected from **process state** instead: a pane sitting at its own shell prompt, with no worker detected, for several consecutive polls means nothing is running there — whether the seed died or its keystrokes never landed. Measured live: the busy→ready *transition* is not usable (a seed that fails on startup is gone before the first poll), the steady state is. A failed launch is reported in ~5s and its tab rolled back; a healthy one is confirmed in ~2s. What this cannot catch is a seed that fails minutes later — the seed phase *is* the task work — and that is an ordinary worker crash, not a bad launch.
+- On the legacy path a wrapper worker is the tab's root process, so a seed that exits at once takes the tab with it. The launcher now confirms the pane is still alive before reporting `moved=yes`, instead of pointing the user at a tab herdr already closed. Native legacy launches keep their byte-identical fast path.
+- Lifecycle docs corrected: on 0.7.5+ the worker runs **inside** a shell pane, so a clean `/exit` no longer closes its tab — `/close`'s armed marker plus the `SessionEnd` hook is the primary teardown there. No teardown behavior changed; the worker is still a registered agent, so `agent_status` polling is unaffected.
+
 ### 1.11.0 — 2026-08-03
 - `/kickoff` can launch the **kimi CLI** (kimi-code) as a worker: `--kimi` → `kimi:kimi-code/k3-256k`, joining claude/codex/grok in `agent-registry.sh`. It appears in the picker and can be saved as the repo default, where it announces like the other third-party workers.
 - kimi is the first worker without a `<cli> -m <model> <prompt>` launch form — it has no positional launch prompt, no initial-prompt env var, and piped stdin only prefills the input box (and would steal the TUI's tty). Its `-p` flag is the only entry point, but it cannot be combined with `--auto`/`-y` and exits after one answer. Since `-p` does run tools unattended and `kimi -c` inherits its history, the launch is two-phase: `sh -c 'kimi -m "$1" -p "$2" || <report+wait>; exec kimi -c --auto' …` — the seed works the task through once, then `exec` hands over to the interactive autonomous session. So a kimi tab has already made progress by the time you switch to it.
diff --git a/plugins/work-system/.claude-plugin/plugin.json b/plugins/work-system/.claude-plugin/plugin.json
index 428cd2e..25393c6 100644
--- a/plugins/work-system/.claude-plugin/plugin.json
+++ b/plugins/work-system/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "work-system",
   "description": "Generic task and worktree workflow system for Claude Code. Manage tasks as markdown files, run them in isolated git worktrees with a choice of worker agent (Claude, codex, grok, or kimi), and track progress across the define/kickoff/continue/status/close lifecycle.",
-  "version": "1.11.0",
+  "version": "1.11.1",
   "author": {
     "name": "gering"
   },
diff --git a/plugins/work-system/README.md b/plugins/work-system/README.md
index 5534680..3b00125 100644
--- a/plugins/work-system/README.md
+++ b/plugins/work-system/README.md
@@ -214,12 +214,22 @@ task guidance.
 
 **kimi launches in two phases.** It has no positional launch prompt, and its
 one-shot `-p` flag can't be combined with the autonomous `--auto`/`-y` modes — so
-the worker is `sh -c 'kimi -m "$1" -p "$2" || <report+wait>; exec kimi -c --auto' …`:
-the `-p` seed
-works the task through once (it runs tools unattended), then `exec` hands over to
-the interactive autonomous session, which inherits the seed's full history. So
-unlike the other workers, a kimi tab has already made progress by the time you
-switch to it.
+the worker is `sh -c 'if kimi -m "$1" -p "$2"; then exec kimi -c --auto; else
+<marker + exit>; fi' …`: the `-p` seed works the task through once (it runs tools
+unattended), then `exec` hands over to the interactive autonomous session, which
+inherits the seed's full history. So unlike the other workers, a kimi tab has
+already made progress by the time you switch to it.
+
+If that seed **fails** (expired auth, an unconfigured model), phase 2 is not
+reached at all: the wrapper prints a machine-readable marker, says TASK.md was not
+started, and exits with the seed's own code. An empty `kimi -c --auto` session
+would look like a healthy worker to both you and herdr's detection, which is worse
+than no tab. What `/kickoff` can do about it depends on the herdr version. On **0.7.5+** the
+wrapper runs inside a shell pane, so the launcher sees that pane fall back to its
+prompt without a worker ever appearing, reports the launch as failed and removes
+the tab it had created. On **0.7.0–0.7.4** the wrapper *is* the tab's root process,
+so herdr closes the tab itself the moment the seed exits; the launcher only
+confirms the pane is gone and tells you to run the worker by hand to see its error.
 
 **What that costs you, stated plainly.** Both kimi phases run *without
 tool-approval prompts* — the seed by construction (`-p` cannot be combined with
@@ -256,16 +266,30 @@ keeps the original branch name rather than renaming it to `task/<name>`:
   names the herdr agent (and, for a claude worker, the `-n` session); the task's
   branch — `task/<name>` from `/kickoff`, or the original branch `/adopt` kept — is
   unchanged, so the resume flow still resolves the task.
-- The chosen worker is launched directly as argv (`herdr agent start … --
-  <resolved worker command>`), so the real CLI process is what herdr's agent-state
-  detection sees. A claude worker gets `claude --model <m> -n "<label>" "/work-system:continue"`
-  and loads the task context automatically; a codex/grok/kimi worker gets a bootstrap
-  prompt (read `TASK.md`, drive the task to a PR) since they have no work-system skills.
-  A kimi worker's pane roots at a short `sh -c` wrapper that `exec`s into kimi, so
-  what herdr ends up watching is the real kimi process.
+- The real CLI process is what herdr's agent-state detection ends up watching. A
+  claude worker gets `claude --model <m> -n "<label>" "/work-system:continue"` and
+  loads the task context automatically; a codex/grok/kimi worker gets a bootstrap
+  prompt (read `TASK.md`, drive the task to a PR) since they have no work-system
+  skills. A kimi worker runs behind a short `sh -c` wrapper that `exec`s into kimi.
+- **How** the worker reaches herdr depends on the herdr version, which the launcher
+  feature-detects from `herdr agent start --help` (never from a version number —
+  the change landed mid-0.7.x). On **0.7.5+ / 0.8** `agent start` needs an
+  already-open pane, so the task's tab is created first and the worker started in
+  its root pane (`agent start <label> --kind <cli> --pane <id> -- <args>`), with
+  herdr's `agent_pane_busy` — the shell still running its rc files — retried within
+  a bounded window. On **0.7.0–0.7.4** the old `agent start --workspace --cwd -- …`
+  plus `pane move --new-tab` sequence is kept unchanged. If neither contract is
+  recognizable, nothing is created and you get the manual command instead.
+- If a launch can't be **confirmed** (the worker never became detectable, an
+  unclassifiable herdr error, a pane-id mismatch), the tab is left in place and the
+  skill tells you to look at it rather than launching a second worker onto the same
+  worktree. Failures that provably started nothing roll their tab back instead, so a
+  retry loop can't leave a trail of blank tabs.
 - The new tab opens in the background (`--no-focus`), so the session you launched
   from (`/kickoff` or `/adopt`, in the main repo) stays in front; switch to the tab
-  when you're ready to work there.
+  when you're ready to work there. On 0.7.5+ the worker lives inside that tab's
+  shell, so `/exit` returns you to a shell rather than closing the tab — `/close`'s
+  marker + `SessionEnd` hook handle teardown.
 
 ### `/close` tears down the task's tab
 
@@ -281,25 +305,30 @@ and decides self-close vs. a different-tab close by pane id. Two entry points:
   than leaving a silent orphan.
 - **From inside the worktree tab**: Claude cannot close its own tab, only exit
   cleanly. So `/close` focuses the main tab and arms a **detached `/exit`** that
-  fires once the turn ends — Claude exits cleanly, its tab auto-closes, and
-  you land back in the main session, hands-free. (The injector polls until the
+  fires once the turn ends — Claude exits cleanly, the armed marker + `SessionEnd`
+  hook close its tab, and you land back in the main session, hands-free. (The injector polls until the
   prompt is idle before delivering the exit; injecting into a busy TUI is
   unreliable.) If herdr injection isn't available it instead asks you to press
   **Ctrl+D**. Because a self-close fires *after* the turn and can't be confirmed
   in-turn, `/close` always prints the tab id as a fallback — if the tab lingers,
   close it by hand.
 
-For the self-close path a `SessionEnd` hook ships with the plugin as a backup: it
-closes the tab on a clean exit, but only when `/close` wrote a short-lived per-pane
-marker file (under `$HOME/.cache`), so it never fires on an ordinary session exit.
+A `SessionEnd` hook ships with the plugin for that path: it closes the tab on a
+clean exit, but only when `/close` wrote a short-lived per-pane marker file (under
+`$HOME/.cache`), so it never fires on an ordinary session exit. On herdr 0.7.5+ the
+hook is the *primary* mechanism, not a backup — `agent start` needs an existing
+pane, so a kickoff worker runs **inside** a shell pane and its exit drops back to
+that shell instead of ending the tab.
 All of this lives in the tested `scripts/herdr-teardown.sh`; see
 `skills/close/SKILL.md` step 12 for the flow.
 
 ### `/work-system:continue <task>` reopens a closed task tab
 
-A kickoff tab runs Claude as its **root pane**, so a bare `/exit` (even just to
-restart Claude Code) ends that pane and herdr closes the whole tab — the worktree
-and the resumable session survive, but you lose your place. Run
+A bare `/exit` (even just to restart Claude Code) costs you your place: on herdr
+0.7.0–0.7.4 the kickoff worker is the tab's **root pane**, so the exit closes the
+whole tab; on 0.7.5+ it runs inside a shell pane, so the exit leaves a bare shell
+sitting in the worktree. Either way the worktree and the resumable session survive.
+Run
 `/work-system:continue <task>` **from the main session** to get it back (use the
 plugin-qualified form — a Claude Code built-in `/continue` shadows the bare skill
 name): it reopens a herdr tab
diff --git a/plugins/work-system/scripts/agent-registry.sh b/plugins/work-system/scripts/agent-registry.sh
index b9b94eb..fbf67d2 100755
--- a/plugins/work-system/scripts/agent-registry.sh
+++ b/plugins/work-system/scripts/agent-registry.sh
@@ -31,13 +31,31 @@
 #              the work-system continue skill resumes TASK.md deterministically)
 #   codex   -> codex -m <model> <bootstrap-prompt>
 #   grok    -> grok  -m <model> <bootstrap-prompt>
-#   kimi    -> sh -c 'kimi -m "$1" -p "$2"; exec kimi -c --auto' \
+#   kimi    -> sh -c 'if <seed>; then exec kimi -c --auto; else <marker+exit>; fi' \
 #                    kimi-worker <model> <bootstrap-prompt>          (seed+continue)
 #   The bootstrap prompt (codex/grok/kimi have no work-system skills) tells the
 #   agent to read TASK.md and drive the task to a PR. `supports=` metadata records
 #   which lifecycle hooks each agent honors, so /close and /continue can degrade
 #   for non-claude workers instead of faking claude-only behavior.
 #
+# HERDR TRANSPORT metadata (`herdr_mode=` / `herdr_kind=`).
+# herdr 0.7.5+ starts agents in an ALREADY-OPEN pane (`agent start <name> --kind
+# <kind> --pane <id> -- <native args>`) instead of placing them itself. That needs
+# two facts the launcher must NOT guess from a selector name or by parsing argv[0]:
+#   herdr_mode=agent-start  the argv IS a canonical CLI invocation, so the launcher
+#                           drops argv[0] (which MUST equal herdr_kind, herdr's
+#                           canonical executable for that kind) and hands the rest
+#                           to `--kind`. Native claude/codex/grok entries.
+#   herdr_mode=pane-run     the argv is a WRAPPER that cannot be projected onto
+#                           `--kind` (kimi's two-phase seed+continue `sh -c`). The
+#                           launcher sends `argv_shell=` as one `pane run` command
+#                           and then waits until herdr detects `herdr_kind` in that
+#                           exact pane.
+# The pair is generic on purpose: a future dynamically-registered wrapper (e.g. a
+# cc-harness agent that ends up as an interactive `claude`) declares
+# `pane-run` + `herdr_kind=claude` without any launcher change. An entry whose
+# mode the launcher does not know must fail CLOSED before anything is created.
+#
 #   Why kimi needs the two-phase seed+continue shape (all probed live, 0.31.1):
 #   kimi has NO positional launch prompt (`kimi "text"` -> "unknown command"), no
 #   initial-prompt env var, and piped stdin only prefills the input box without
@@ -46,9 +64,11 @@
 #   answer — so `-p` alone cannot be a worker. It does run tools unattended, and
 #   `kimi -c` inherits its full session history, so: phase 1 seeds+works the task
 #   one-shot, phase 2 `exec`s into the interactive autonomous session with that
-#   history. The `exec` matters — it re-roots the herdr pane at kimi, and `;` (not
-#   `&&`) keeps phase 2 alive if the seed fails, leaving a usable tab instead of a
-#   dead one. Values travel as "$1"/"$2" positionals, never interpolated into the
+#   history. The `exec` matters — it re-roots the herdr pane at kimi. Phase 2 is
+#   reached ONLY on a successful seed: a failed one prints the machine-readable
+#   marker and exits with the seed's own code, because an empty `kimi -c --auto`
+#   session that never read TASK.md is indistinguishable from a healthy worker (see
+#   KIMI_LAUNCH_SCRIPT). Values travel as "$1"/"$2" positionals, never interpolated into the
 #   script text: `-p` swallows the next token as its value, so an argv built by
 #   concatenation is one reordering away from silently eating a flag.
 #
@@ -62,6 +82,12 @@
 #             3 resolved but the entry's CLI is unavailable
 set -euo pipefail
 
+# Where this script (and its sibling helpers) actually live. `${0%/*}` is NOT a
+# safe substitute: invoked as a bare name (`bash agent-registry.sh`, or via PATH)
+# it has no slash, so `${0%/*}` yields the FILENAME and every sibling path built
+# from it silently misses.
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "${BASH_SOURCE[0]:-$0}")" && pwd)"
+
 HOME="${HOME:-$(cd ~ 2>/dev/null && pwd || echo /nonexistent)}"
 # The ONLY persisted state: the per-repo committed `default` agent. No global
 # state, no shipped fallback — if a repo has no default, /kickoff shows the
@@ -92,23 +118,50 @@ KIMI_CREDENTIALS_FILE="${KIMI_CREDENTIALS_FILE:-$HOME/.kimi-code/credentials/kim
 # argv word; the launch helper passes it verbatim.
 BOOTSTRAP_PROMPT='Read TASK.md in this worktree and continue the task. Commit on the current branch as you go, and open a PR when the work is complete.'
 
+# The ASCII marker a wrapper worker prints when its seed phase fails. It names the
+# failure unambiguously and states that TASK.md was never started, where the
+# pre-1.11.1 shape left an empty session that looked healthy. WHO reads it depends
+# on the path: on legacy herdr and on a manual `argv_shell=` paste it is the human
+# looking at the tab; on the modern path the launcher detects the dead wrapper and
+# rolls that tab back, so there the marker is what the seed's own error sits next
+# to while it is still on screen — the launch failure itself is reported by the
+# launcher, which tells the user to run the worker by hand to see it.
+#
+# It is deliberately NOT a machine signal. herdr-launch.sh used to grep the pane
+# for it; three review rounds showed terminal text cannot carry a supervisor's
+# signal at all — the pane echoes the command (so the literal matched itself), the
+# seed reads repo files that legitimately name it, a per-launch nonce had to be
+# handed to the very process being supervised, and a rendered snapshot wraps. The
+# launcher now uses process STATE instead (the pane returning to its shell prompt
+# without the worker being detected), so nothing here needs to be greppable.
+SEED_FAIL_MARKER='WORKER_SEED_FAILED'
+
 # kimi's two-phase launch script (see the header). Defined once here so the shape
 # has exactly one home; emit_argv passes it as the `sh -c` word.
 #
-# The seed's failure is made LOUD on purpose. `;` would run phase 2 regardless and
-# the TUI's first repaint scrolls the error off-screen — leaving a tab that looks
-# like a healthy worker but never read TASK.md. `&&` is not the fix either: it
-# kills the pane, and the task's whole point is that the tab survives. So: report,
-# wait for an explicit keypress, then hand over to an (empty) session the user now
-# knows is empty. Verified: a failed seed in a fresh worktree yields a NEW empty
-# session, never a foreign one — `kimi -c` is scoped to the working directory.
-# Kept ASCII-only and free of backslash escapes so `printf %q` renders it as a
+# A failed seed must be UNAMBIGUOUS, and it must not leave anything behind that
+# could be mistaken for a working worker. The earlier shape ran phase 2 regardless
+# (`;`) after a keypress, which produced exactly that trap: an empty `kimi -c
+# --auto` session that never read TASK.md but looks alive to herdr's detection —
+# and to the user. So on a seed failure this now prints the machine-readable
+# marker, states that TASK.md was not started, and exits with the SEED'S exit code
+# WITHOUT running phase 2 and without waiting for input (an unattended background
+# tab has nobody to press Enter). Only a successful seed reaches `exec kimi -c
+# --auto`; the `exec` re-roots the pane at kimi so herdr detects it.
+# Consequence on the LEGACY herdr path (0.7.0-0.7.4), where the worker argv is the
+# tab's ROOT process: a failed seed now ends that process, so herdr closes the tab.
+# Accepted deliberately — a closed tab is honest, whereas the empty session it
+# replaces was actively misleading. On modern herdr the wrapper runs inside a shell
+# pane, so the marker and kimi's own error land on screen; the launcher sees the
+# pane fall back to its prompt without a worker and rolls the tab back.
+# Kept ASCII-only and free of backslash escapes so `shell_quote` renders it as a
 # plain single-quoted word in `argv_shell=` — a `$'…'` form would be bash/zsh-only
 # and near-unreadable in the copy-paste block.
-KIMI_LAUNCH_SCRIPT='kimi -m "$1" -p "$2" || { echo; echo "[work-system] kimi seed FAILED (see the error above): TASK.md was not read, nothing was started."; echo "Press Enter to open an empty kimi session in this worktree."; read -r _; }; exec kimi -c --auto'
+KIMI_LAUNCH_SCRIPT='if kimi -m "$1" -p "$2"; then exec kimi -c --auto; else rc=$?; echo; echo "[work-system] '"$SEED_FAIL_MARKER"': kimi seed exited $rc - TASK.md was NOT started and no session was opened."; exit $rc; fi'
 
 # ---------- registry ----------
-# `flag|cli|model|supports`. flag `-` = no shorthand (name/--agent only). The
+# `flag|cli|model|supports|herdr_mode|herdr_kind`. flag `-` = no shorthand
+# (name/--agent only). The
 # FIRST entry of each CLI is that CLI's default model (for a bare `--agent codex`).
 # `supports` is per-agent capability metadata: which lifecycle hooks each agent
 # honors —
@@ -120,13 +173,18 @@ KIMI_LAUNCH_SCRIPT='kimi -m "$1" -p "$2" || { echo; echo "[work-system] kimi see
 # currently hardcode the claude-vs-non-claude distinction in prose; this field is
 # the seed for the manager/worker-orchestration design to read per-agent
 # capabilities from one place. Keep it in sync when that lands.
-REGISTRY='--fable|claude|fable|continue,close-exit,statusline,commit,pr
---opus|claude|opus|continue,close-exit,statusline,commit,pr
--|claude|sonnet|continue,close-exit,statusline,commit,pr
---codex|codex|gpt-5.6-terra|commit,pr
---sol|codex|gpt-5.6-sol|commit,pr
---grok|grok|grok-4.5|commit,pr
---kimi|kimi|kimi-code/k3-256k|commit,pr'
+#
+# `herdr_mode|herdr_kind` is the modern-herdr transport contract (see the header):
+# agent-start entries hand their argv TAIL to `--kind <herdr_kind>` (so argv[0]
+# MUST equal herdr_kind), pane-run entries are wrappers sent as one shell command
+# and then waited for until herdr detects herdr_kind in that pane.
+REGISTRY='--fable|claude|fable|continue,close-exit,statusline,commit,pr|agent-start|claude
+--opus|claude|opus|continue,close-exit,statusline,commit,pr|agent-start|claude
+-|claude|sonnet|continue,close-exit,statusline,commit,pr|agent-start|claude
+--codex|codex|gpt-5.6-terra|commit,pr|agent-start|codex
+--sol|codex|gpt-5.6-sol|commit,pr|agent-start|codex
+--grok|grok|grok-4.5|commit,pr|agent-start|grok
+--kimi|kimi|kimi-code/k3-256k|commit,pr|pane-run|kimi'
 
 usage() {
   # Usage = header comment from line 2 up to (not including) the registry
@@ -136,37 +194,39 @@ usage() {
 }
 
 # ---------- registry access ----------
-# Emit one `flag|cli|model|supports` record per line (skips blank lines).
+# Emit one `flag|cli|model|supports|herdr_mode|herdr_kind` record per line.
 registry_rows() { printf '%s\n' "$REGISTRY"; }
 
-# Print the whole record for a canonical name (cli:model), or nothing.
-row_for_name() {
-  local want="$1" flag cli model supports
-  while IFS='|' read -r flag cli model supports; do
+# find_row <how> <want> — the ONE reader over the registry table. `how` picks what
+# `want` is matched against: `name` (canonical cli:model), `flag` (shorthand, `-`
+# rows skipped), or `cli` (first row of that CLI = its default model). Prints the
+# matched record with a FIXED field count — so a row that were ever short a
+# trailing field cannot shift the transport metadata into `supports` — or fails (1).
+#
+# Deliberately one function, not three near-identical loops: the `read -r` field
+# list appears EXACTLY once, so adding a registry column can't be applied to two
+# readers and forgotten in the third (which would make a bare `--agent codex`
+# resolve a mangled row while `--codex` still worked — a bug that reads as
+# agent-specific when it is really reader-specific).
+find_row() {
+  local how="$1" want="$2" flag cli model supports mode kind
+  while IFS='|' read -r flag cli model supports mode kind; do
     [ -n "$cli" ] || continue
-    [ "$cli:$model" = "$want" ] && { printf '%s|%s|%s|%s\n' "$flag" "$cli" "$model" "$supports"; return 0; }
-  done < <(registry_rows)
-  return 1
-}
-
-# Print the record whose shorthand flag matches, or nothing.
-row_for_flag() {
-  local want="$1" flag cli model supports
-  while IFS='|' read -r flag cli model supports; do
-    [ "$flag" = "-" ] && continue
-    [ "$flag" = "$want" ] && { printf '%s|%s|%s|%s\n' "$flag" "$cli" "$model" "$supports"; return 0; }
+    case "$how" in
+      name) [ "$cli:$model" = "$want" ] || continue ;;
+      flag) [ "$flag" = "-" ] && continue; [ "$flag" = "$want" ] || continue ;;
+      cli)  [ "$cli" = "$want" ] || continue ;;
+      *)    return 1 ;;
+    esac
+    printf '%s|%s|%s|%s|%s|%s\n' "$flag" "$cli" "$model" "$supports" "$mode" "$kind"
+    return 0
   done < <(registry_rows)
   return 1
 }
 
-# Print the default (first) record for a bare CLI name, or nothing.
-row_for_cli_default() {
-  local want="$1" flag cli model supports
-  while IFS='|' read -r flag cli model supports; do
-    [ "$cli" = "$want" ] && { printf '%s|%s|%s|%s\n' "$flag" "$cli" "$model" "$supports"; return 0; }
-  done < <(registry_rows)
-  return 1
-}
+row_for_name()        { find_row name "$1"; }
+row_for_flag()        { find_row flag "$1"; }
+row_for_cli_default() { find_row cli  "$1"; }
 
 # Resolve any selector to a registry record. Order: shorthand flag, canonical
 # cli:model name, bare CLI (its default model). Prints the record or fails (1).
@@ -208,46 +268,15 @@ row_for_selector() {
 #           live), so a bare substring would also fire on the alias appearing as
 #           a VALUE (a `default_model`/metadata field) while `models` is empty.
 
-# run_bounded <seconds> <cmd...> — run cmd with a hard time bound so an external
-# probe can never hang `list`/the picker. Prints cmd's stdout; returns cmd's exit
-# code, or non-zero if it hit the bound. Uses timeout/gtimeout when present; else
-# self-bounds with a detached killer that escalates SIGTERM -> SIGKILL, so a
-# process that ignores SIGTERM still can't block the caller. The killer's fds go
-# to /dev/null: this runs inside a command substitution, and a background job
-# holding the captured pipe would make $(...) block until it exits.
-run_bounded() {
-  local secs="$1"; shift
-  local rc=0
-  # `-k 1`: GNU timeout only SIGTERMs at the deadline then waits — a child that
-  # ignores SIGTERM would run forever on the COMMON path (any host with timeout/
-  # gtimeout). --kill-after escalates to SIGKILL, matching the self-watchdog below.
-  if command -v timeout >/dev/null 2>&1; then
-    timeout  -k 1 "$secs" "$@" || rc=$?
-  elif command -v gtimeout >/dev/null 2>&1; then
-    gtimeout -k 1 "$secs" "$@" || rc=$?
-  else
-    # No timeout binary — self-bound. cmd stdout -> a temp file, NOT this
-    # function's stdout: if the killer has to SIGKILL the cmd, an orphaned
-    # grandchild (e.g. a `sleep` the cmd spawned) inherits the cmd's fds — and if
-    # that were the command-substitution pipe, the capturing $(...) would block
-    # until the orphan dies. Writing to $tmp means the only thing on our stdout is
-    # the final `cat`, so $() returns as soon as we do. The killer escalates
-    # SIGTERM -> SIGKILL so a process ignoring SIGTERM still can't hang the caller.
-    local tmp; tmp="$(mktemp)"
-    "$@" >"$tmp" &
-    local pid=$!
-    ( sleep "$secs"; kill "$pid" 2>/dev/null; sleep 2; kill -9 "$pid" 2>/dev/null ) >/dev/null 2>&1 &
-    local killer=$!
-    if wait "$pid" 2>/dev/null; then rc=0; else rc=$?; fi
-    kill "$killer" 2>/dev/null || true
-    cat "$tmp"; rm -f "$tmp"
-  fi
-  # Normalize a bounded kill to ONE "timed out" code (124): GNU timeout reports
-  # 124 (SIGTERM) or 137 (needed SIGKILL); the watchdog's `wait` yields 137/143.
-  # Callers use 124 to treat a slow probe as inconclusive, distinct from a real
-  # non-zero exit (e.g. genuine auth failure).
-  case "$rc" in 137|143) rc=124 ;; esac
-  return "$rc"
+# `run_bounded <seconds> <cmd...>` — the shared time bound for every probe below,
+# so an external CLI can never hang `list`/the picker. Defined once in
+# lib-bounded.sh (herdr-launch.sh sources the same file): two private copies had
+# already drifted apart, and a sibling-script dependency is the norm here anyway.
+_LIB_BOUNDED="$SCRIPT_DIR/lib-bounded.sh"
+# shellcheck source=lib-bounded.sh
+. "$_LIB_BOUNDED" 2>/dev/null || {
+  echo "agent-registry.sh: cannot source $_LIB_BOUNDED (it ships alongside this script)" >&2
+  exit 1
 }
 
 # Print `grok models` RAW output on stdout; RETURN 0 iff the fetch succeeded,
@@ -418,8 +447,8 @@ subcmd_resolve() {
     echo "Try: $(registry_rows | cut -d'|' -f1 | grep -v '^-$' | tr '\n' ' ')— a name (claude:opus), or a cli (codex)" >&2
     exit 2
   }
-  local flag cli model supports
-  IFS='|' read -r flag cli model supports <<<"$record"
+  local flag cli model supports mode kind
+  IFS='|' read -r flag cli model supports mode kind <<<"$record"
 
   local avail note
   IFS=$'\t' read -r avail note < <(entry_status "$cli" "$model")
@@ -429,6 +458,10 @@ subcmd_resolve() {
   printf 'model=%s\n' "$model"
   printf 'available=%s\n' "$avail"
   printf 'supports=%s\n' "$supports"
+  # Modern-herdr transport (see the header). Always emitted — a consumer that
+  # cannot interpret the mode must fail closed rather than guess from the name.
+  printf 'herdr_mode=%s\n' "$mode"
+  printf 'herdr_kind=%s\n' "$kind"
   [ -n "$note" ] && printf 'note=%s\n' "$note"
   emit_argv "$cli" "$model" "$session"
 
@@ -444,8 +477,8 @@ subcmd_list() {
   esac
 
   # Build rows: name cli model available note (TAB-separated internally).
-  local rows="" flag cli model supports avail note
-  while IFS='|' read -r flag cli model supports; do
+  local rows="" flag cli model supports mode kind avail note
+  while IFS='|' read -r flag cli model supports mode kind; do
     [ -n "$cli" ] || continue
     IFS=$'\t' read -r avail note < <(entry_status "$cli" "$model")
     rows+="$cli:$model	$cli	$model	$avail	$note"$'\n'
diff --git a/plugins/work-system/scripts/herdr-launch.sh b/plugins/work-system/scripts/herdr-launch.sh
index c76fa04..b5460de 100755
--- a/plugins/work-system/scripts/herdr-launch.sh
+++ b/plugins/work-system/scripts/herdr-launch.sh
@@ -3,26 +3,58 @@
 #
 # Two modes share one precondition/JSON-parse/output contract:
 #
-#   launch  (/kickoff, /adopt) — spawn the chosen worker as ARGV via `agent start … --
-#                         <worker-argv>`, then move it into its own background tab.
+#   launch  (/kickoff, /adopt) — open a background tab running the chosen worker.
+#                         herdr changed HOW that is done in 0.7.5, so the launcher
+#                         feature-detects the contract (see "launch API" below) and
+#                         speaks whichever this herdr offers:
+#
+#                         LEGACY (0.7.0-0.7.4) — herdr places the agent itself:
+#                           agent start <name> --workspace <ws> --cwd <dir> --no-focus
+#                                              -- <worker-argv>
+#                           pane move <pane> --new-tab --label <label> --no-focus
 #                         The worker is the tab's ROOT pane, so a later clean /exit
-#                         ends the pane and herdr closes the tab. Argv-exec
-#                         structurally avoids the shell-startup keystroke race (see
-#                         the kickoff knowledge entry) — a fresh interactive shell
-#                         can eat the leading keystrokes of a typed command.
+#                         ends the pane and herdr closes the tab.
+#
+#                         MODERN (0.7.5+, incl. 0.8) — `agent start` requires an
+#                         ALREADY-OPEN pane at an interactive shell prompt, so the
+#                         final tab is created FIRST and the worker started in its
+#                         root pane; nothing is moved afterwards:
+#                           tab create --workspace <ws> --cwd <dir> --label <label>
+#                                      --no-focus
+#                           agent start <name> --kind <kind> --pane <pane> -- <args>
+#                         The worker therefore runs INSIDE a shell pane: a later
+#                         /exit drops back to that shell and the tab survives, so
+#                         /close's marker + SessionEnd hook (not agent exit) are the
+#                         normal teardown path.
+#
+#                         Both paths keep the same stdout contract, and both avoid
+#                         the shell-startup keystroke race (see the kickoff knowledge
+#                         entry): legacy by exec'ing argv, modern by letting herdr's
+#                         own `agent start` readiness handling drive the pane — its
+#                         `agent_pane_busy` rejection is retried, bounded.
 #                         The worker argv is resolved from an agent SELECTOR via
 #                         agent-registry.sh (claude/codex/grok/kimi × model); with no
 #                         selector it stays the legacy `claude … /work-system:continue`. The
-#                         registry owns every per-CLI launch detail, so this script
-#                         is CLI-agnostic — it just execs the resolved argv.
+#                         registry owns every per-CLI launch detail INCLUDING how the
+#                         worker reaches modern herdr (`herdr_mode=agent-start` hands
+#                         the argv tail to `--kind`; `herdr_mode=pane-run` sends the
+#                         registry's `argv_shell=` as one `pane run` command for
+#                         wrappers that cannot be projected onto a native kind), so
+#                         this script stays CLI-agnostic.
 #
 #   resume  (/continue) — reopen a tab at the worktree and run `claude -c` INSIDE a
 #                         shell pane, then focus it. Because Claude runs inside a
 #                         shell (not as the root pane), a later /exit drops back to
 #                         the shell and the TAB SURVIVES — this is the /exit
 #                         hardening. Used to recover a task tab that a bare /exit
-#                         closed (kickoff tabs are root-pane Claude, so /exit closes
-#                         them). `claude -c` continues the most-recent session for
+#                         closed — which is what happens to a LEGACY kickoff tab,
+#                         where the worker is the tab's root pane. A modern kickoff
+#                         tab already runs its worker inside a shell pane, so there
+#                         /exit leaves a bare shell and this mode FINDS that tab
+#                         still open: it focuses it and starts nothing (reused=yes,
+#                         resumed= empty) — running `claude -c` in it is then the
+#                         caller's call, not this helper's.
+#                         `claude -c` continues the most-recent session for
 #                         the worktree cwd; since each worktree hosts exactly one
 #                         task, the cwd already identifies the session unambiguously
 #                         — no session id needs stashing at kickoff.
@@ -53,6 +85,16 @@
 # launch selector errors (nothing spawned): exit 2 = unknown selector; exit 3 =
 # the CLI is not available, with stdout `unavailable=<name>` + `note=<hint>` so
 # the caller can print a clear "run: … login".
+# launch adds ONE fail-closed outcome, exit 0 with `blocked=unverified` first:
+#   blocked=unverified
+#   pane=<pane or empty>
+#   tab=<tab or empty>
+#   agent=<resolved agent>
+# It means a tab exists and a worker MAY be running in it, but the launch could
+# not be confirmed (readiness timeout, an unrecognized herdr error, a pane-id
+# mismatch, or a rollback that could not be verified). Callers must branch on
+# `blocked` BEFORE `moved`, tell the user to inspect that tab, and must NOT launch
+# again, print the manual worker command, or save a project default.
 # resume adds three keys so the caller never reports a resume that didn't happen:
 #   reused=<yes|no>  (yes → a tab already existed at this worktree and was focused,
 #                     NOT a new one — no second `claude -c` was started. Its LIVE
@@ -75,6 +117,14 @@
 # the manual instructions instead. Diagnostics always go to stderr.
 set -eu
 
+# Where this script (and its sibling helpers: lib-bounded.sh, herdr-tab-glyph.sh,
+# agent-registry.sh, herdr-teardown.sh) actually live. `${0%/*}` is NOT a safe
+# substitute: invoked as a bare name (`bash herdr-launch.sh`, or via PATH) `$0`
+# has no slash, so `${0%/*}` yields the FILENAME — every sibling path built from
+# it then misses, and the guards that check `[ -f … ]` degrade SILENTLY (rollback
+# would report `unverified` for a tab it never even tried to close).
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "${BASH_SOURCE[0]:-$0}")" && pwd)"
+
 mode="${1:-}"
 case "$mode" in
   launch|resume) shift ;;
@@ -121,12 +171,103 @@ trap 'rm -f "${start_err:-}" "${move_err:-}" "${create_err:-}" "${run_err:-}" "$
 # <name>`) and the Claude session name are stable identities: a glyph there would
 # freeze at its launch-time value (nothing refreshes them) and clutter /resume.
 tab_label="$label"
-glyph_helper="${0%/*}/herdr-tab-glyph.sh"
+glyph_helper="$SCRIPT_DIR/herdr-tab-glyph.sh"
 if [ -f "$glyph_helper" ]; then
   stamped="$(bash "$glyph_helper" prefix "$label" "$worktree" 2>/dev/null || true)"
   [ -n "$stamped" ] && tab_label="$stamped"
 fi
 
+# `run_bounded <seconds> <cmd...>` — the shared time bound (lib-bounded.sh, also
+# sourced by agent-registry.sh). It wraps the capability probe and every POLLING
+# read below, so a herdr that stops answering turns into a bounded diagnostic
+# instead of an indefinite hang inside a loop. It does NOT wrap the mutating calls
+# (`tab create`, `agent start`, `pane run`, `pane move`): `agent start` carries
+# herdr's own `--timeout`, and client-side killing a half-applied mutation would
+# trade a hang for unknown server state — those keep their pre-existing behavior.
+# shellcheck source=lib-bounded.sh
+. "$SCRIPT_DIR/lib-bounded.sh" 2>/dev/null || {
+  echo "herdr-launch.sh: cannot source $SCRIPT_DIR/lib-bounded.sh (it ships alongside this script)" >&2
+  exit 1
+}
+
+# ---- launch API detection --------------------------------------------------
+# Which `agent start` contract this herdr speaks, read ONLY from its --help (no
+# process is started to find out) and NEVER from a version string: 0.7.x spans
+# BOTH contracts (the change landed in 0.7.5), so a version compare would route
+# half of that range to the wrong path.
+#   modern       --kind AND --pane offered  → tab create first, start into that pane
+#   legacy       --workspace AND --cwd      → herdr places the agent, then pane move
+#   unknown      help read fine, names neither → this herdr speaks something else
+#   probe-failed the probe itself failed/timed out/returned nothing → we learned
+#                NOTHING about the contract. Kept distinct from `unknown` so the
+#                diagnostic names the real cause (a wedged socket, a missing
+#                binary) instead of accusing herdr of an unrecognizable API. Both
+#                still fail closed — guessing a contract could create a stray tab.
+# $WORK_SYSTEM_HERDR_API forces the answer (tests, and an escape hatch if a future
+# herdr's help text stops naming its flags).
+detect_launch_api() {
+  [ -n "${WORK_SYSTEM_HERDR_API:-}" ] && { printf '%s\n' "$WORK_SYSTEM_HERDR_API"; return 0; }
+  local help rc=0
+  # NOT `2>&1`: that would make the child's stderr the command-substitution pipe,
+  # so a SIGKILLed grandchild still holding it would keep this $( ) open forever —
+  # defeating the exact hang guard run_bounded's temp-file stdout routing provides.
+  # `--help` goes to stdout; herdr's stderr is of no use here.
+  help="$(run_bounded 10 herdr agent start --help 2>/dev/null)" || rc=$?
+  # Plain substring tests on a string already in memory — `case` does this with no
+  # subprocess, where the printf|grep pipelines it replaces cost eight per launch
+  # and implied a regex match that was never wanted.
+  if [ "$rc" != 0 ] || [ -z "$help" ]; then
+    printf 'probe-failed\n'
+    return 0
+  fi
+  case "$help" in
+    *--kind*)
+      case "$help" in *--pane*) printf 'modern\n'; return 0 ;; esac ;;
+  esac
+  case "$help" in
+    *--workspace*)
+      case "$help" in *--cwd*) printf 'legacy\n'; return 0 ;; esac ;;
+  esac
+  printf 'unknown\n'
+}
+
+# Bounds for the modern path. All overridable so tests stay hermetic and fast.
+START_TIMEOUT_MS="${WORK_SYSTEM_HERDR_START_TIMEOUT_MS:-30000}"  # herdr's own readiness wait
+BUSY_TRIES="${WORK_SYSTEM_HERDR_BUSY_TRIES:-20}"                 # agent_pane_busy retries
+# The shell-prompt wait (pane-run) has to cover a real login shell's rc files —
+# nvm/sdkman/conda/direnv+sops routinely run 10-20s — because a still-busy shell at
+# the end of the window is a hard failure here. Budgeted to ~30s so it is comparable
+# to what the native path effectively gets (herdr's own --timeout 30000 per try).
+READY_TRIES="${WORK_SYSTEM_HERDR_READY_TRIES:-60}"               # shell-prompt wait (pane-run)
+DETECT_TRIES="${WORK_SYSTEM_HERDR_DETECT_TRIES:-60}"             # wrapper detection polls
+RETRY_DELAY="${WORK_SYSTEM_HERDR_RETRY_DELAY:-0.5}"              # seconds between polls
+# Try counts alone do NOT bound these loops in wall clock: each iteration makes
+# herdr calls that are themselves only bounded at 10s each, so against a wedged
+# socket "60 tries" can mean twenty minutes rather than the ~30s the numbers imply.
+# Every poll loop therefore also carries an absolute deadline, and whichever bound
+# trips first ends it.
+READY_SECONDS="${WORK_SYSTEM_HERDR_READY_SECONDS:-45}"
+DETECT_SECONDS="${WORK_SYSTEM_HERDR_DETECT_SECONDS:-45}"
+ALIVE_SECONDS="${WORK_SYSTEM_HERDR_ALIVE_SECONDS:-20}"
+# The busy-retry budget is wall clock for a reason: `agent start` may REJECT
+# instantly (a precondition check) or only after consuming its own --timeout, so a
+# try count alone means either ~10s — under the 10-20s rc startup this file
+# documents — or ~600s of silence. The deadline makes both behave the same.
+BUSY_SECONDS="${WORK_SYSTEM_HERDR_BUSY_SECONDS:-45}"
+# Consecutive "pane is at its own shell prompt, no worker detected" samples that
+# mean nothing is running there. The bound is a real trade-off, measured live: too
+# SHORT and a healthy wrapper is torn down in the gap between `pane run` returning
+# and its child taking the foreground; too LONG and a failed launch is only reported
+# after the full detection window. 8 × RETRY_DELAY ≈ 4s sits well past that gap
+# (a healthy kimi was detected in ~2s, busy throughout) and still reports a dead
+# wrapper in seconds. Raise it on a slow host.
+IDLE_STREAK="${WORK_SYSTEM_HERDR_IDLE_STREAK:-8}"
+IDLE_MIN_SECONDS="${WORK_SYSTEM_HERDR_IDLE_MIN_SECONDS:-3}"
+UNKNOWN_TRIES="${WORK_SYSTEM_HERDR_UNKNOWN_TRIES:-8}"   # unreadable answers before degrading
+# Legacy path only: how long to let a wrapper worker prove it did not die on the
+# spot before its tab is reported as running (see the pane_alive check there).
+WRAPPER_ALIVE_TRIES="${WORK_SYSTEM_HERDR_ALIVE_TRIES:-6}"
+
 # JSON extractors. null / missing / malformed all yield empty, and a stray
 # traceback can never reach the user's terminal.
 #   launch: agent start → result.agent.pane_id, then move → the created tab id.
@@ -135,22 +276,77 @@ try:
     print(json.load(sys.stdin)["result"]["agent"]["pane_id"] or "")
 except Exception:
     pass'
+#   modern launch: the detected agent kind of one pane (`pane get`), i.e. what
+#   herdr believes is running there. Empty for a plain shell pane.
+extract_pane_agent='import sys, json
+try:
+    print(json.load(sys.stdin)["result"]["pane"].get("agent") or "")
+except Exception:
+    pass'
+#   modern launch (pane-run) + resume: is the pane back at its own shell prompt,
+#   i.e. safe to type a command into? Answered from WHICH PROCESSES hold the
+#   foreground: only the shell itself → ready; anything else (rc-file startup
+#   running direnv/sops/ssh-add, or a wrapper we launched) → busy. Deliberately not
+#   `foreground_process_group_id == shell_pid`: that equality is only meaningful
+#   with job control, and a shell started with `set +m` would report every running
+#   child as "idle" — which on the detection path means tearing down a healthy
+#   worker. Comparing pids answers the same question without that assumption.
+#   `unknown` covers everything unreadable (older herdr without process-info, a
+#   renamed or re-typed field): the caller degrades on it rather than blocking a
+#   launch forever, and `busy` — a HARD state that fails a launch — is only ever
+#   printed from a fully parsed answer.
+#   `busy` is only ever printed on a POSITIVELY parsed answer — both ids present
+#   and different. A missing/renamed field is schema drift, not a busy shell, and
+#   must read as `unknown` (→ the caller waits out its window and proceeds); mapping
+#   drift to `busy` would hard-fail and roll back every wrapper launch the day herdr
+#   renames a key.
+extract_shell_ready='import sys, json
+try:
+    pi = json.load(sys.stdin)["result"]["process_info"]
+    shell = pi.get("shell_pid")
+    fg = pi.get("foreground_processes")
+    if not isinstance(shell, int) or isinstance(shell, bool) or not isinstance(fg, list) or not fg:
+        print("unknown")
+    else:
+        pids = [q.get("pid") for q in fg if isinstance(q, dict)]
+        if any(not isinstance(x, int) or isinstance(x, bool) for x in pids) or len(pids) != len(fg):
+            print("unknown")
+        else:
+            print("ready" if all(x == shell for x in pids) else "busy")
+except Exception:
+    print("unknown")'
 extract_moved_tab='import sys, json
 try:
     print(json.load(sys.stdin)["result"]["move_result"]["created_tab"]["tab_id"] or "")
 except Exception:
     pass'
-#   resume: tab create → the new tab's root pane id and its tab id in ONE pass,
-#   pipe-delimited as `<pane>|<tab>` (the tab id may live at result.tab_id or,
-#   defensively, under the root pane). A single `|` is ALWAYS printed, so the caller
-#   splits on the first `|` — an empty pane with a present tab yields pane="" (which
-#   then fails the non-empty-pane guard) instead of the tab being mis-read as the
-#   pane. herdr ids are `wN:pM`/`wN:tM` and never contain `|`.
+#   tab create (BOTH the modern launch and resume) → the new tab's root pane id and
+#   its tab id in ONE pass, pipe-delimited as `<pane>|<tab>`. Verified against herdr
+#   0.8: `result.root_pane.pane_id` + `result.tab.tab_id`. The fallbacks are
+#   deliberate and each covers a real shape — a flat `result.tab_id` (what earlier
+#   herdr returned, still exercised by the tests) and the tab id echoed under the
+#   root pane. A single `|` is ALWAYS printed, so the caller splits on the first `|`
+#   — an empty pane with a present tab yields pane="" (which then fails the
+#   non-empty-pane guard) instead of the tab being mis-read as the pane. herdr ids
+#   are `wN:pM`/`wN:tM` and never contain `|`. A partial response therefore still
+#   surrenders whatever id IS there, which is what lets the caller clean up a tab
+#   that came back without a usable pane instead of orphaning it.
+#   Each id is resolved through its own isinstance-checked chain: a field that is
+#   present but the WRONG SHAPE (e.g. `"tab": "w1:t9"` instead of an object) must
+#   cost only that one lookup, never the whole parse — an unguarded `.get` on a
+#   string raises, the bare `except` prints `"|"`, and a perfectly usable pane id
+#   would be thrown away with it, turning schema drift into a failed launch.
 extract_root_pane_tab='import sys, json
+def pick(v, key):
+    if isinstance(v, dict):
+        return v.get(key) or ""
+    return v or "" if isinstance(v, str) else ""
 try:
     r = json.load(sys.stdin)["result"]
-    pane = (r.get("root_pane") or {}).get("pane_id") or ""
-    tab = r.get("tab_id") or (r.get("root_pane") or {}).get("tab_id") or ""
+    pane = (pick(r.get("root_pane"), "pane_id") or pick(r.get("pane"), "pane_id")
+            or pick(r, "pane_id"))
+    tab = (pick(r.get("tab"), "tab_id") or pick(r, "tab_id")
+           or pick(r.get("root_pane"), "tab_id"))
     print(pane + "|" + tab)
 except Exception:
     print("|")'
@@ -239,6 +435,187 @@ HERDR_WORKSPACE_ID=$ws_clean is not a valid workspace on this herdr server (like
   printf '%s\n' "$line"
 }
 
+# ---- modern-launch outcome helpers ----------------------------------------
+# These read $workspace / $pane / $tab / $agent_name from the launch scope; they
+# exist to keep the three outcome shapes (success, rolled-back failure, fail-closed
+# unverified) in ONE place instead of repeated inline at every error site.
+
+# classify_start_failure <rc> <stderr-blob> → busy | definitive | ambiguous
+#   busy       herdr refused because the pane's shell was not at a prompt yet. This
+#              is THE failure right after `tab create` (a login shell running
+#              direnv/sops/ssh-add takes seconds), so it is retried — bounded, and
+#              ONLY for this exact code. Every other error retries nothing.
+#   definitive herdr rejected the call before touching the pane, so nothing was
+#              started and the created tab can be rolled back: a usage error (exit
+#              2, plain text — "unsupported interactive agent kind", "missing
+#              required --pane", "unknown option: …") or a no-such-pane/placement
+#              error code.
+#   ambiguous  anything else, INCLUDING a readiness timeout: the worker may be
+#              coming up in that pane. Never rolled back, never retried — reported
+#              as blocked=unverified so the user inspects the tab.
+classify_start_failure() {
+  local rc="$1" blob="$2" code
+  [ "$rc" = 2 ] && { printf 'definitive\n'; return 0; }
+  code="$(printf '%s' "$blob" | tr -dc '[:print:]\t\n' | python3 -c "$extract_herdr_error" 2>/dev/null || true)"
+  code="${code%%|*}"
+  case "$code" in
+    agent_pane_busy) printf 'busy\n' ;;
+    agent_pane_not_found|agent_target_not_found|agent_placement_not_found|pane_not_found)
+      printf 'definitive\n' ;;
+    *) printf 'ambiguous\n' ;;
+  esac
+}
+
+# rollback_tab <tab-id> → closed | unverified. Undo a tab THIS run created, exactly
+# once. Delegates to herdr-teardown.sh's `close-tab`, the single source of truth for
+# close-then-confirm (it closes once, never re-issues — a recycled tab id would
+# otherwise kill an unrelated live tab — and polls until the tab is gone). Nothing
+# to close counts as `closed`; anything we cannot confirm is `unverified`, so an
+# unconfirmed rollback is never reported to the user as a clean failure.
+rollback_tab() {
+  local t="${1:-}" td state
+  if [ -z "$t" ]; then
+    # No id. That is "nothing to close" ONLY if no tab was ever created; if one was
+    # created and its id simply did not parse, claiming a clean rollback would leave
+    # a blank background tab open while the caller tells the user everything was
+    # undone — and the user then launches a second worker onto the same worktree.
+    if [ "${tab_created:-no}" = yes ]; then printf 'unverified\n'; else printf 'closed\n'; fi
+    return 0
+  fi
+  td="$SCRIPT_DIR/herdr-teardown.sh"
+  [ -f "$td" ] || { printf 'unverified\n'; return 0; }
+  state="$(bash "$td" close-tab "$t" "$workspace" 2>/dev/null || echo unverified)"
+  case "$state" in closed) printf 'closed\n' ;; *) printf 'unverified\n' ;; esac
+}
+
+# emit_unverified — the fail-closed launch outcome (exit 0, `blocked` FIRST).
+emit_unverified() {
+  printf 'blocked=unverified\npane=%s\ntab=%s\nagent=%s\n' "${pane:-}" "${tab:-}" "${agent_name:-}"
+}
+
+# fail_definitive <message…> — a failure we KNOW left no worker running: report it,
+# roll the created tab back, exit 1 so the caller shows the manual block. If the
+# rollback cannot be CONFIRMED, the outcome is downgraded to blocked=unverified —
+# a tab that may still exist (possibly with something in it) must not be reported
+# as a clean failure.
+fail_definitive() {
+  printf '%s\n' "$*" >&2
+  local rb; rb="$(rollback_tab "${tab:-}")"
+  if [ "$rb" = closed ]; then
+    [ -n "${tab:-}" ] && printf 'rolled back the tab created for this launch (%s)\n' "$tab" >&2
+    exit 1
+  fi
+  if [ -n "${tab:-}" ]; then
+    printf 'could not confirm that the tab created for this launch (%s) was closed — check it by hand\n' "$tab" >&2
+  else
+    printf 'a tab was created for this launch but herdr did not return its id, so it could not be closed — find and close it by hand\n' >&2
+  fi
+  emit_unverified
+  exit 0
+}
+
+# pane_agent_kind <pane> — what herdr currently detects in that pane ("" = nothing).
+pane_agent_kind() {
+  run_bounded 10 herdr pane get "$1" 2>/dev/null | python3 -c "$extract_pane_agent" 2>/dev/null || true
+}
+
+# pane_state <pane> → present | gone | unverified. Used on the LEGACY path, where a
+# wrapper worker IS the tab's root process: if its seed dies, the pane (and with it
+# the tab) is gone, and reporting `moved=yes` would point the user at a tab that no
+# longer exists.
+#
+# TRI-state on purpose. "`herdr pane get` failed" conflates two opposite facts — the
+# pane is gone, or herdr just couldn't answer — and acting on the first when it was
+# the second declares a healthy worker dead, which sends the caller down its manual
+# path and invites a SECOND unattended worker onto the same worktree. So the check
+# reads the pane LIST instead: a populated list is evidence (present or genuinely
+# absent); an empty/failed/unparsable one is `unverified` and must never be reported
+# as death. Same shape, and same reasoning, as herdr-teardown.sh's tab lookups.
+extract_pane_present='import sys, json
+pid = sys.argv[1] if len(sys.argv) > 1 else ""
+try:
+    panes = json.load(sys.stdin)["result"]["panes"]
+except Exception:
+    print("unverified"); sys.exit(0)
+if not pid or not panes:
+    print("unverified"); sys.exit(0)
+print("present" if any(p.get("pane_id") == pid for p in panes) else "gone")'
+pane_state() {
+  local json
+  json="$(run_bounded 10 herdr pane list 2>/dev/null || true)"
+  [ -n "$json" ] || { printf 'unverified\n'; return 0; }
+  printf '%s' "$json" | python3 -c "$extract_pane_present" "$1" 2>/dev/null || printf 'unverified\n'
+}
+
+# NOTE — why there is no `pane_has_marker` here any more.
+# A wrapper announces a failed seed by PRINTING a marker (see agent-registry.sh's
+# KIMI_LAUNCH_SCRIPT); the launcher used to grep the pane for it. Three review
+# rounds took that apart, and the conclusion is that terminal TEXT cannot be the
+# supervisor's signal at all:
+#   * the pane echoes the command it was given, so the literal in the wrapper
+#     script matched itself and rolled a HEALTHY launch back (found live);
+#   * splitting the literal fixed only that channel — the seed's whole job is
+#     reading repository files, and in a work-system repo TASK.md, the CHANGELOG
+#     and these tests all legitimately name the marker;
+#   * salting it with a per-launch nonce fixed that, but the nonce had to reach
+#     the wrapper through the environment — i.e. into the very process being
+#     supervised, which can then print its own death certificate;
+#   * and a rendered snapshot is width-WRAPPED, so in a narrow pane the match
+#     silently misses anyway.
+# Forgeable and unreliable at the same time. The signal used instead is process
+# STATE, which the worker's output cannot fake: the pane leaves its shell prompt
+# when the wrapper starts, and returns to it when the wrapper exits. A pane that
+# came back to its prompt without herdr ever detecting the expected worker is a
+# definitive failure. The printed marker remains — for the HUMAN reading the tab.
+
+# pane_shell_state <pane> → ready | busy | unknown. ONE sample of "is the pane at
+# its own shell prompt". `ready` = the shell itself holds the foreground, `busy` =
+# a child does (the wrapper is running), `unknown` = herdr cannot answer.
+pane_shell_state() {
+  run_bounded 10 herdr pane process-info --pane "$1" 2>/dev/null \
+    | python3 -c "$extract_shell_ready" 2>/dev/null || echo unknown
+}
+
+# wait_shell_ready <pane> → ready | busy | unknown. Bounded wait for the pane to be
+# back at ITS OWN shell prompt before typing into it (the `pane run` path has no
+# herdr-side readiness check the way `agent start` does).
+#
+# `unknown` (herdr cannot answer — no `pane process-info`, an error, a renamed
+# field) means CANNOT VERIFY, not READY: returning on it immediately would type
+# into a pane created milliseconds ago and hand the rc-file keystroke race back
+# exactly the window this function exists to close. So an unknown answer keeps
+# polling — it may become readable — and only after the whole bounded window is
+# spent does the caller proceed on it, having at least waited out the documented
+# rc-file window. `busy` (a readable answer that says a child holds the foreground)
+# stays a hard failure: we know it is not safe to type.
+wait_shell_ready() {
+  local p="$1" i=0 st=unknown last=unknown unknowns=0 deadline=$(( SECONDS + READY_SECONDS ))
+  while [ "$i" -lt "$READY_TRIES" ] && [ "$SECONDS" -lt "$deadline" ]; do
+    st="$(pane_shell_state "$p")"
+    [ "$st" = ready ] && { printf 'ready\n'; return 0; }
+    if [ "$st" = unknown ]; then
+      unknowns=$((unknowns + 1))
+      # A herdr that cannot answer at all will not start answering: waiting out the
+      # full window would add its whole length to EVERY launch and resume on such a
+      # host. Give it a few polls in case the answer is merely transient, then
+      # degrade — the wait only exists to cover a seconds-long rc window, so
+      # spending far longer than that to learn nothing is the wrong trade.
+      [ "$unknowns" -ge "$UNKNOWN_TRIES" ] && { printf 'unknown\n'; return 0; }
+    else
+      unknowns=0
+    fi
+    last="$st"
+    i=$((i + 1))
+    sleep "$RETRY_DELAY" 2>/dev/null || true
+  done
+  # Window spent: an unreadable pane degrades to "proceed" (detection still gates
+  # success), a readably-busy one does not.
+  case "$last" in
+    unknown) printf 'unknown\n' ;;
+    *)       printf 'busy\n' ;;
+  esac
+}
+
 case "$mode" in
   launch)
     # Build the worker argv. The registry is the single source of truth for the
@@ -251,11 +628,20 @@ case "$mode" in
     worker_argv=()
     agent_name="claude"
     note=""
+    pane=""
+    tab=""
+    tab_created=no
+    argv_shell=""
+    # Modern-herdr transport, declared by the registry (never inferred here). The
+    # no-selector legacy default IS a canonical `claude` invocation, so it carries
+    # the same agent-start/claude contract.
+    herdr_mode="agent-start"
+    herdr_kind="claude"
     if [ -z "$selector" ]; then
       # Plugin-qualified: a CC built-in/alias `/continue` shadows the skill.
       worker_argv=(claude -n "$session" "/work-system:continue")
     else
-      registry="${0%/*}/agent-registry.sh"
+      registry="$SCRIPT_DIR/agent-registry.sh"
       [ -f "$registry" ] || { echo "agent-registry.sh not found next to herdr-launch.sh" >&2; exit 1; }
       rc=0
       # Keep resolve's stderr (it distinguishes its exit-2 causes: unknown
@@ -270,9 +656,12 @@ case "$mode" in
       rm -f "$resolve_err"
       while IFS= read -r line; do
         case "$line" in
-          argv=*) worker_argv+=("${line#argv=}") ;;
-          name=*) agent_name="${line#name=}" ;;
-          note=*) note="${line#note=}" ;;
+          argv=*)         worker_argv+=("${line#argv=}") ;;
+          argv_shell=*)   argv_shell="${line#argv_shell=}" ;;
+          name=*)         agent_name="${line#name=}" ;;
+          note=*)         note="${line#note=}" ;;
+          herdr_mode=*)   herdr_mode="${line#herdr_mode=}" ;;
+          herdr_kind=*)   herdr_kind="${line#herdr_kind=}" ;;
         esac
       done <<EOF_RESOLVE
 $resolve_out
@@ -285,41 +674,300 @@ EOF_RESOLVE
       [ ${#worker_argv[@]} -gt 0 ] || { echo "agent-registry resolved no argv for $selector" >&2; exit 1; }
     fi
 
-    # Spawn the worker as argv and read back the pane id. stderr is captured (not
-    # discarded) so a failure can surface herdr's actual error.code/message instead
-    # of only the generic "no pane id" guard below.
-    start_err="$(mktemp)"
-    start_json="$(herdr agent start "$label" --workspace "$workspace" \
-      --cwd "$worktree" --no-focus -- "${worker_argv[@]}" 2>"$start_err" || true)"
-    pane="$(printf '%s' "$start_json" | python3 -c "$extract_agent_pane" 2>/dev/null || true)"
-
-    # Empty pane id → the agent did not start (broken socket / bad response).
-    # Print herdr's own error first when captured — the generic message stays as
-    # the last-resort fallback for a truly pane-less/malformed response.
-    if [ -z "$pane" ]; then
-      diag="$(herdr_diag "$(cat "$start_err")" "$workspace" 1)"
+    # Which contract does this herdr speak? Decided BEFORE anything is created or
+    # started, so an unrecognizable herdr stops here instead of guessing and
+    # leaving a blank tab behind.
+    api="$(detect_launch_api)"
+    case "$api" in
+      modern|legacy) : ;;
+      probe-failed)
+        # We never got an answer, so we know nothing about the contract. Say THAT,
+        # instead of accusing herdr of an unrecognizable API — the cause here is a
+        # wedged/unreachable socket or a probe that outran its bound.
+        echo "could not probe 'herdr agent start --help' (no output, an error, or it outran its 10s bound) — herdr may be unreachable or wedged" >&2
+        echo "nothing was created and no worker was started — start it by hand, or retry once herdr responds" >&2
+        exit 1
+        ;;
+      *)
+        echo "cannot identify this herdr's 'agent start' contract: its --help offers neither --kind/--pane (0.7.5+) nor --workspace/--cwd (0.7.0-0.7.4)" >&2
+        echo "nothing was created and no worker was started — start it by hand" >&2
+        exit 1
+        ;;
+    esac
+
+    if [ "$api" = legacy ]; then
+      # ---- LEGACY (herdr 0.7.0-0.7.4): herdr places the agent, we move it ----
+      # Spawn the worker as argv and read back the pane id. stderr is captured (not
+      # discarded) so a failure can surface herdr's actual error.code/message instead
+      # of only the generic "no pane id" guard below.
+      start_err="$(mktemp)"
+      start_json="$(herdr agent start "$label" --workspace "$workspace" \
+        --cwd "$worktree" --no-focus -- "${worker_argv[@]}" 2>"$start_err" || true)"
+      pane="$(printf '%s' "$start_json" | python3 -c "$extract_agent_pane" 2>/dev/null || true)"
+
+      # Empty pane id → the agent did not start (broken socket / bad response).
+      # Print herdr's own error first when captured — the generic message stays as
+      # the last-resort fallback for a truly pane-less/malformed response.
+      if [ -z "$pane" ]; then
+        diag="$(herdr_diag "$(cat "$start_err")" "$workspace" 1)"
+        rm -f "$start_err"
+        [ -n "$diag" ] && printf '%s\n' "$diag" >&2
+        echo "herdr agent start did not return a pane id" >&2
+        exit 1
+      fi
       rm -f "$start_err"
+
+      # caller's tab). If the move fails, the worker is still running — report it in
+      # place rather than claiming a tab that does not exist. `agent=` tells the
+      # caller which CLI×model was launched; the tab uses the glyph-stamped label.
+      move_err="$(mktemp)"
+      if move_json="$(herdr pane move "$pane" --new-tab --label "$tab_label" --no-focus 2>"$move_err")"; then
+        tab="$(printf '%s' "$move_json" | python3 -c "$extract_moved_tab" 2>/dev/null || true)"
+        rm -f "$move_err"
+        # A WRAPPER worker (herdr_mode=pane-run) is this tab's ROOT process here, so
+        # a seed that exits immediately — bad auth, an unconfigured model — ends the
+        # pane and herdr closes the tab we are about to report as running. Give it a
+        # bounded moment and check the pane is still there, so we never print
+        # `moved=yes` for a tab that is already gone. Native workers keep the
+        # unchanged fast path: their argv doesn't self-terminate on a bad seed, and
+        # this legacy contract is meant to stay byte-identical for them.
+        if [ "$herdr_mode" = pane-run ]; then
+          i=0
+          alive_state=unverified
+          alive_deadline=$(( SECONDS + ALIVE_SECONDS ))
+          while [ "$i" -lt "$WRAPPER_ALIVE_TRIES" ] && [ "$SECONDS" -lt "$alive_deadline" ]; do
+            sleep "$RETRY_DELAY" 2>/dev/null || true
+            alive_state="$(pane_state "$pane")"
+            # `gone` is the answer we are watching for and it cannot un-happen, so
+            # stop at once. `present` keeps watching: the seed can still die inside
+            # the window, and only the LAST reading of a surviving pane is the one
+            # worth reporting.
+            [ "$alive_state" = gone ] && break
+            i=$((i + 1))
+          done
+          case "$alive_state" in
+            gone)
+              echo "the $agent_name worker exited immediately in pane $pane, so herdr closed its tab — the seed phase failed and TASK.md was not started (run the worker by hand to see its error)" >&2
+              exit 1
+              ;;
+            unverified)
+              # herdr could not be read, so we do NOT know whether the worker is
+              # alive. Reporting a launch would be a guess; reporting a failure
+              # would send the caller down its manual path and risk a SECOND worker
+              # on this worktree. Fail closed instead: the tab exists, go look.
+              echo "could not verify whether the $agent_name worker is still running in pane $pane (herdr did not answer) — check the tab before launching anything else" >&2
+              emit_unverified
+              exit 0
+              ;;
+          esac
+        fi
+        printf 'pane=%s\ntab=%s\nmoved=yes\nagent=%s\n' "$pane" "$tab" "$agent_name"
+      else
+        diag="$(herdr_diag "$(cat "$move_err")" "$workspace" 0)"
+        rm -f "$move_err"
+        [ -n "$diag" ] && printf '%s\n' "$diag" >&2
+        echo "herdr pane move --new-tab failed for pane $pane (worker still running; no dedicated tab)" >&2
+        printf 'pane=%s\ntab=\nmoved=no\nagent=%s\n' "$pane" "$agent_name"
+      fi
+      exit 0
+    fi
+
+    # ---- MODERN (herdr 0.7.5+): create the tab, then start into its pane ----
+    # Validate the transport FIRST — an entry this launcher cannot start must fail
+    # before `tab create`, or every attempt leaves a blank tab behind.
+    native_argv=()
+    case "$herdr_mode" in
+      agent-start)
+        if [ -z "$herdr_kind" ]; then
+          echo "agent $agent_name declares herdr_mode=agent-start without a herdr_kind — refusing to launch (nothing was created)" >&2
+          exit 1
+        fi
+        # `--kind` names herdr's canonical executable, so the resolved argv must
+        # START with exactly that word and we drop exactly that word. No rebuilding:
+        # every remaining argument keeps its order and boundaries (the one-word
+        # bootstrap prompt for codex/grok, the one-word /work-system:continue for
+        # claude), which is why this is a check and not a transformation.
+        if [ "${worker_argv[0]}" != "$herdr_kind" ]; then
+          echo "agent $agent_name resolves to '${worker_argv[0]}' but declares herdr kind '$herdr_kind' — refusing to launch (nothing was created)" >&2
+          exit 1
+        fi
+        [ "${#worker_argv[@]}" -gt 1 ] && native_argv=("${worker_argv[@]:1}")
+        ;;
+      pane-run)
+        if [ -z "$herdr_kind" ] || [ -z "$argv_shell" ]; then
+          echo "agent $agent_name declares herdr_mode=pane-run but is missing herdr_kind/argv_shell — refusing to launch (nothing was created)" >&2
+          exit 1
+        fi
+        ;;
+      *)
+        echo "agent $agent_name declares an unknown herdr transport '${herdr_mode:-<empty>}' — refusing to launch (nothing was created)" >&2
+        exit 1
+        ;;
+    esac
+
+    # Create the FINAL tab up front (background, glyph-stamped label) and read back
+    # its root pane. From here on any failure has a tab to account for.
+    create_err="$(mktemp)"
+    create_json="$(herdr tab create --workspace "$workspace" --cwd "$worktree" \
+      --label "$tab_label" --no-focus 2>"$create_err" || true)"
+    # Record that a tab may now exist BEFORE parsing: whether we can read its id is
+    # exactly the thing rollback must not confuse with "nothing was created".
+    [ -n "$create_json" ] && tab_created=yes
+    pane_tab="$(printf '%s' "$create_json" | python3 -c "$extract_root_pane_tab" 2>/dev/null || true)"
+    pane="${pane_tab%%|*}"
+    tab="${pane_tab#*|}"
+    if [ -z "$pane" ]; then
+      # No pane → nothing can be started here. A tab id that DID parse belongs to a
+      # real tab that would be orphaned, so fail_definitive closes it (once, verified).
+      diag="$(herdr_diag "$(cat "$create_err")" "$workspace" 1)"
+      rm -f "$create_err"
       [ -n "$diag" ] && printf '%s\n' "$diag" >&2
-      echo "herdr agent start did not return a pane id" >&2
-      exit 1
+      fail_definitive "herdr tab create did not return a root pane id"
     fi
-    rm -f "$start_err"
-
-    # caller's tab). If the move fails, the worker is still running — report it in
-    # place rather than claiming a tab that does not exist. `agent=` tells the
-    # caller which CLI×model was launched; the tab uses the glyph-stamped label.
-    move_err="$(mktemp)"
-    if move_json="$(herdr pane move "$pane" --new-tab --label "$tab_label" --no-focus 2>"$move_err")"; then
-      tab="$(printf '%s' "$move_json" | python3 -c "$extract_moved_tab" 2>/dev/null || true)"
-      rm -f "$move_err"
+    rm -f "$create_err"
+
+    if [ "$herdr_mode" = agent-start ]; then
+      # ---- native worker: hand the argv TAIL to --kind, unchanged ----
+      attempt=0
+      busy_deadline=$(( SECONDS + BUSY_SECONDS ))
+      while : ; do
+        start_rc=0
+        start_err="$(mktemp)"
+        # Built once. The `--` and its arguments are appended only when there ARE
+        # any, because a bash 3.2 `"${empty[@]}"` is an unbound-variable error under
+        # `set -u` — which is the whole reason this used to be written out twice.
+        start_cmd=(herdr agent start "$label" --kind "$herdr_kind" --pane "$pane"
+                   --timeout "$START_TIMEOUT_MS")
+        [ "${#native_argv[@]}" -gt 0 ] && start_cmd+=(-- "${native_argv[@]}")
+        start_json="$("${start_cmd[@]}" 2>"$start_err")" || start_rc=$?
+        start_blob="$(cat "$start_err")"
+        rm -f "$start_err"
+        [ "$start_rc" = 0 ] && break
+
+        class="$(classify_start_failure "$start_rc" "$start_blob")"
+        # Retry ONLY the "shell not ready yet" rejection, bounded. Everything else
+        # falls straight through — a retry loop over an unrelated error is how a
+        # launcher ends up starting two workers.
+        if [ "$class" = busy ] && [ "$attempt" -lt "$BUSY_TRIES" ] && [ "$SECONDS" -lt "$busy_deadline" ]; then
+          attempt=$((attempt + 1))
+          sleep "$RETRY_DELAY" 2>/dev/null || true
+          continue
+        fi
+
+        # This call never sends --workspace, so a placement error here cannot be a
+        # stale-workspace problem: ws_relevant=0 keeps that hint off.
+        diag="$(herdr_diag "$start_blob" "$workspace" 0)"
+        [ -n "$diag" ] && printf '%s\n' "$diag" >&2
+        if [ "$class" = busy ]; then
+          fail_definitive "pane $pane never reached an interactive shell prompt (herdr kept reporting agent_pane_busy for ${BUSY_SECONDS}s / $BUSY_TRIES retries) — nothing was started"
+        fi
+        if [ "$class" = definitive ]; then
+          fail_definitive "herdr agent start --kind $herdr_kind was rejected before starting anything in pane $pane"
+        fi
+        echo "herdr agent start --kind $herdr_kind did not confirm the worker in pane $pane — it may still be coming up, so the tab was left alone" >&2
+        emit_unverified
+        exit 0
+      done
+
+      # A successful modern start must report back the SAME pane we asked for.
+      # Anything else (missing, malformed, a different id) means we cannot say what
+      # ran where — and since herdr claimed success, something may well be running
+      # in that tab, so this is NOT a rollback case.
+      started_pane="$(printf '%s' "$start_json" | python3 -c "$extract_agent_pane" 2>/dev/null || true)"
+      if [ "$started_pane" != "$pane" ]; then
+        echo "herdr agent start reported success for pane '${started_pane:-<none>}' but the worker was requested in $pane — cannot confirm the launch" >&2
+        emit_unverified
+        exit 0
+      fi
+      # `moved=yes` = the verified worker is in its own dedicated tab. On this path
+      # no physical move happened (the tab was created first); the key is kept for
+      # caller compatibility.
       printf 'pane=%s\ntab=%s\nmoved=yes\nagent=%s\n' "$pane" "$tab" "$agent_name"
-    else
-      diag="$(herdr_diag "$(cat "$move_err")" "$workspace" 0)"
-      rm -f "$move_err"
+      exit 0
+    fi
+
+    # ---- wrapper worker (herdr_mode=pane-run) ----
+    # The registry's argv_shell is sent as EXACTLY ONE `pane run` command word: no
+    # eval, no re-quoting, no ${array[*]} — the registry already quoted it for a
+    # POSIX shell, and re-quoting a script carrying `;`/`exec` is how a paste ends
+    # up replacing the wrong shell.
+    ready="$(wait_shell_ready "$pane")"
+    if [ "$ready" = busy ]; then
+      fail_definitive "pane $pane never reached its shell prompt within the readiness window — nothing was typed into it"
+    fi
+    run_rc=0
+    run_err="$(mktemp)"
+    herdr pane run "$pane" "$argv_shell" >/dev/null 2>"$run_err" || run_rc=$?
+    run_blob="$(cat "$run_err")"
+    rm -f "$run_err"
+    if [ "$run_rc" != 0 ]; then
+      diag="$(herdr_diag "$run_blob" "$workspace" 0)"
       [ -n "$diag" ] && printf '%s\n' "$diag" >&2
-      echo "herdr pane move --new-tab failed for pane $pane (worker still running; no dedicated tab)" >&2
-      printf 'pane=%s\ntab=\nmoved=no\nagent=%s\n' "$pane" "$agent_name"
+      if [ "$(classify_start_failure "$run_rc" "$run_blob")" = definitive ]; then
+        fail_definitive "herdr pane run could not deliver the $agent_name wrapper to pane $pane"
+      fi
+      echo "herdr pane run returned an error for pane $pane but may still have delivered the command — the tab was left alone" >&2
+      emit_unverified
+      exit 0
     fi
+
+    # Bounded detection. Success is ONLY herdr recognizing the expected worker in
+    # this exact pane; a timeout, a different kind, or an unreadable state is
+    # reported as unverified — never as success, and never as a reason to start a
+    # second one.
+    #
+    # A dead wrapper is detected from process state, not from anything it printed
+    # (see the note above pane_agent_kind). The signal is NOT the busy→ready
+    # transition — measured live, a wrapper that fails on startup (the common case:
+    # expired auth) is gone before the first poll, so its "running" phase is never
+    # observable. What IS observable is the steady state: a `sh -c` wrapper puts a
+    # child in the foreground, so while it runs the pane is busy or its worker is
+    # detected. A pane sitting at its OWN shell prompt, with no agent, for several
+    # consecutive polls therefore means nothing is running in it — whether the
+    # wrapper died or its keystrokes never landed. The streak is what makes it
+    # sound: a single early sample is just the state we typed into.
+    #
+    # What this window can and cannot catch, stated honestly: it catches a seed that
+    # dies BEFORE the launch is confirmed — the common failure (expired auth, an
+    # unconfigured model), which is exactly when the user needs a clean "it didn't
+    # start" instead of a tab to inspect. It cannot catch a seed that fails minutes
+    # later: the seed phase IS the task work, so waiting for it to finish is not a
+    # launch-time option. A launch reported here was real when reported; a worker
+    # that dies afterwards is an ordinary worker crash, not a bad launch.
+    i=0
+    idle_streak=0
+    detect_deadline=$(( SECONDS + DETECT_SECONDS ))
+    # The streak reasons in seconds ("a wrapper takes this long to reach the
+    # foreground"), so it is gated on elapsed time too — a `sleep` that silently
+    # rejects the fractional delay would otherwise collapse the whole budget into
+    # milliseconds and tear down a healthy worker that had not started yet.
+    idle_earliest=$(( SECONDS + IDLE_MIN_SECONDS ))
+    while [ "$i" -lt "$DETECT_TRIES" ] && [ "$SECONDS" -lt "$detect_deadline" ]; do
+      detected="$(pane_agent_kind "$pane")"
+      if [ "$detected" = "$herdr_kind" ]; then
+        printf 'pane=%s\ntab=%s\nmoved=yes\nagent=%s\n' "$pane" "$tab" "$agent_name"
+        exit 0
+      fi
+      if [ -n "$detected" ]; then
+        echo "herdr detects '$detected' in pane $pane, not the expected '$herdr_kind' — cannot confirm the launch" >&2
+        emit_unverified
+        exit 0
+      fi
+      case "$(pane_shell_state "$pane")" in
+        ready)
+          idle_streak=$((idle_streak + 1))
+          if [ "$idle_streak" -ge "$IDLE_STREAK" ] && [ "$SECONDS" -ge "$idle_earliest" ]; then
+            fail_definitive "nothing is running in pane $pane — it has been back at its shell prompt for $IDLE_STREAK polls with no worker detected, so the $agent_name seed phase failed and TASK.md was not started (run the worker by hand to see its error)"
+          fi
+          ;;
+        *) idle_streak=0 ;;   # busy, or unreadable — either way not evidence of idleness
+      esac
+      i=$((i + 1))
+      sleep "$RETRY_DELAY" 2>/dev/null || true
+    done
+    echo "the $agent_name worker did not become detectable as '$herdr_kind' in pane $pane within the detection window — it may still be starting, so the tab was left alone" >&2
+    emit_unverified
+    exit 0
     ;;
 
   resume)
@@ -337,7 +985,7 @@ EOF_RESOLVE
     #                 list, or an unreadable-cwd pane): FAIL CLOSED — do not risk a
     #                 duplicate. Emit blocked=unverified so the caller cues the user to
     #                 check herdr for an existing tab. (Also covers a missing helper.)
-    teardown="${0%/*}/herdr-teardown.sh"
+    teardown="$SCRIPT_DIR/herdr-teardown.sh"
     state=unverified
     [ -f "$teardown" ] && state="$(bash "$teardown" worktree-tab-state "" "$worktree" 2>/dev/null || echo unverified)"
     case "$state" in
@@ -388,6 +1036,11 @@ EOF_RESOLVE
     # last-resort fallback.
     if [ -z "$pane" ]; then
       if [ -n "$tab" ]; then
+        # Deliberately NOT rollback_tab here. That helper confirms the close by
+        # polling herdr-teardown, but it swallows herdr's own error — and surfacing
+        # exactly that error on this path was itself the outcome of an earlier
+        # review. This branch already ends in the caller's manual block, so the
+        # diagnostic is worth more than the confirmation.
         close_err="$(mktemp)"
         if ! herdr tab close "$tab" >/dev/null 2>"$close_err"; then
           close_diag="$(herdr_diag "$(cat "$close_err")" "$workspace" 0)"
@@ -413,9 +1066,20 @@ EOF_RESOLVE
     # the caller never claims a resume that didn't happen: the tab + shell exist, but
     # the user must run it by hand. (Catches a failed send, not `claude -c` erroring
     # later on a cwd with no prior session — the caller's wording stays tentative.)
+    # The same just-created-pane race the launch path guards: this pane was made
+    # milliseconds ago and its login shell may still be sourcing rc files, which can
+    # eat the leading keystrokes of a typed command. Wait for it to reach its own
+    # prompt (bounded; an unreadable answer degrades to proceeding, as there).
+    # `busy` means we must not type — but the tab still exists and the user is
+    # switching to it, so this falls through to the shared focus block below
+    # exactly like the send-failed path does. Only `resumed` differs.
     resumed=yes
+    if [ "$(wait_shell_ready "$pane")" = busy ]; then
+      resumed=no
+      echo "pane $pane never reached its shell prompt — not typing 'claude -c' into it; the tab is open, run it there by hand" >&2
+    fi
     run_err="$(mktemp)"
-    if ! herdr pane run "$pane" "cd $(printf '%q' "$worktree") && claude -c" >/dev/null 2>"$run_err"; then
+    if [ "$resumed" = yes ] && ! herdr pane run "$pane" "cd $(printf '%q' "$worktree") && claude -c" >/dev/null 2>"$run_err"; then
       resumed=no
       diag="$(herdr_diag "$(cat "$run_err")" "$workspace" 0)"
       [ -n "$diag" ] && printf '%s\n' "$diag" >&2
diff --git a/plugins/work-system/scripts/herdr-teardown.sh b/plugins/work-system/scripts/herdr-teardown.sh
index ad39725..f7217d9 100644
--- a/plugins/work-system/scripts/herdr-teardown.sh
+++ b/plugins/work-system/scripts/herdr-teardown.sh
@@ -50,11 +50,15 @@
 #                               (verified live): `herdr pane run <pane> "/exit"`
 #                               does nothing to Claude's TUI (it targets a shell),
 #                               and `send-keys ctrl+d` does not exit either — only
-#                               this text+Return pair triggers a clean exit. When
-#                               Claude is the tab's root pane (kickoff launches it
-#                               via `agent start -- claude`), that clean exit also
-#                               auto-closes the tab, so the SessionEnd hook is a
-#                               safety net, not the primary close.
+#                               this text+Return pair triggers a clean exit. Whether
+#                               that also closes the TAB depends on the herdr the
+#                               worker was launched under: on legacy herdr the worker
+#                               is the tab's root pane, so the exit closes the tab
+#                               too; on 0.7.5+ `agent start` needs an existing pane,
+#                               so the worker runs INSIDE a shell and the exit only
+#                               drops back to that shell. The armed marker +
+#                               SessionEnd hook is therefore the primary close, not a
+#                               safety net — never assume the exit alone did it.
 #   self-exit <pane-id> [workspace]
 #                               Scenario B self-close: detach an injector that
 #                               waits for this session to go idle (turn ended),
diff --git a/plugins/work-system/scripts/lib-bounded.sh b/plugins/work-system/scripts/lib-bounded.sh
new file mode 100644
index 0000000..739ee73
--- /dev/null
+++ b/plugins/work-system/scripts/lib-bounded.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# lib-bounded.sh — `run_bounded`, the one time-bounded command runner.
+#
+# SOURCE this file (`. "<dir>/lib-bounded.sh"`); it defines a function and runs
+# nothing. Both agent-registry.sh (CLI availability probes) and herdr-launch.sh
+# (the herdr capability probe + its polling reads) need the same primitive.
+# agent-registry.sh had it first; herdr-launch.sh grew a copy when it gained a
+# bounded probe, and within a single change the two had already drifted — one
+# merged the child's stderr into the captured output, the other didn't. That is
+# how fast this particular duplication rots. A sibling-file dependency is
+# already the norm between these scripts (herdr-launch.sh shells out to
+# herdr-teardown.sh, agent-registry.sh), so one definition beats two.
+#
+# NOT yet migrated: herdr-agent.sh's `_ha_bounded` and ws-statusline.sh's own
+# `run_bounded`. Both lack the SIGTERM->SIGKILL escalation and the 124
+# normalization below, so they are worth moving here — but they sit on unrelated
+# code paths (the lane registry and the status line), and this file was extracted
+# during a launch-path fix. Named explicitly so the consolidation is a known
+# follow-up rather than an oversight.
+
+# run_bounded <seconds> <cmd...> — run cmd with a hard time bound, so an external
+# probe or a wedged server can never hang the caller. Prints cmd's stdout; returns
+# cmd's exit code, or 124 if the bound killed it.
+#
+# Uses timeout/gtimeout when present; otherwise self-bounds with a detached killer
+# that escalates SIGTERM -> SIGKILL, so a process ignoring SIGTERM still can't
+# block us. Two details that look incidental but are not:
+#   * cmd's stdout goes to a TEMP FILE, not this function's stdout. Callers run
+#     this inside a command substitution, and if the killer has to SIGKILL cmd, an
+#     orphaned grandchild inherits cmd's fds — were that the $( ) pipe, the caller
+#     would block until the orphan died. Only the final `cat` writes to stdout.
+#   * cmd's STDERR is deliberately NOT merged into that file: it stays on the
+#     function's stderr, which the CALL SITE controls (`run_bounded … 2>/dev/null`
+#     to drop it, `2>&1` to capture it). Merging it here would silently fold error
+#     text into probe output that callers then pattern-match.
+# The killer's own fds go to /dev/null for the same command-substitution reason.
+run_bounded() {
+  local secs="$1"; shift
+  local rc=0
+  # `-k 1`: GNU timeout only SIGTERMs at the deadline then waits — a child that
+  # ignores SIGTERM would run forever on the COMMON path (any host with timeout/
+  # gtimeout). --kill-after escalates to SIGKILL, matching the self-watchdog below.
+  if command -v timeout >/dev/null 2>&1; then
+    timeout  -k 1 "$secs" "$@" || rc=$?
+  elif command -v gtimeout >/dev/null 2>&1; then
+    gtimeout -k 1 "$secs" "$@" || rc=$?
+  else
+    local tmp; tmp="$(mktemp)"
+    "$@" >"$tmp" &
+    local pid=$!
+    ( sleep "$secs"; kill "$pid" 2>/dev/null; sleep 2; kill -9 "$pid" 2>/dev/null ) >/dev/null 2>&1 &
+    local killer=$!
+    if wait "$pid" 2>/dev/null; then rc=0; else rc=$?; fi
+    kill "$killer" 2>/dev/null || true
+    cat "$tmp"; rm -f "$tmp"
+  fi
+  # Normalize a bounded kill to ONE "timed out" code (124): GNU timeout reports
+  # 124 (SIGTERM) or 137 (needed SIGKILL); the watchdog's `wait` yields 137/143.
+  # Callers use 124 to treat a slow probe as inconclusive, distinct from a real
+  # non-zero exit (e.g. genuine auth failure).
+  case "$rc" in 137|143) rc=124 ;; esac
+  return "$rc"
+}
diff --git a/plugins/work-system/scripts/test_agent_registry.py b/plugins/work-system/scripts/test_agent_registry.py
index a5529c3..1235471 100644
--- a/plugins/work-system/scripts/test_agent_registry.py
+++ b/plugins/work-system/scripts/test_agent_registry.py
@@ -122,12 +122,15 @@ def run(self, *args, project_state=True):
 
     def run_argv(self, argv):
         """Execute a resolved launch argv against the stubs; return the per-call
-        argv lines the kimi stub recorded."""
+        argv lines the kimi stub recorded. The CompletedProcess is kept on
+        `self.last_proc` so a test can also assert the wrapper's exit code and
+        output (the seed-failure contract is exactly that)."""
         env = dict(self.env)
         env["KIMI_ARGLOG"] = str(self.kimi_arglog)
         self.kimi_arglog.write_text("")
-        subprocess.run(argv, env=env, cwd=str(self.home), stdin=subprocess.DEVNULL,
-                       capture_output=True, text=True, timeout=30)
+        self.last_proc = subprocess.run(
+            argv, env=env, cwd=str(self.home), stdin=subprocess.DEVNULL,
+            capture_output=True, text=True, timeout=30)
         return [line.split("\t")[:-1]
                 for line in self.kimi_arglog.read_text().splitlines()]
 
@@ -180,12 +183,11 @@ def kv(out):
 # kimi has no positional launch prompt and `-p` cannot be combined with --auto/-y,
 # so a worker is `-p` (seed, runs tools unattended) then `exec kimi -c --auto`
 # (interactive + autonomous, inheriting the seed's session history).
+SEED_MARKER = "WORKER_SEED_FAILED"
 KIMI_SCRIPT = (
-    'kimi -m "$1" -p "$2" || { echo; '
-    'echo "[work-system] kimi seed FAILED (see the error above): '
-    'TASK.md was not read, nothing was started."; '
-    'echo "Press Enter to open an empty kimi session in this worktree."; '
-    'read -r _; }; exec kimi -c --auto'
+    'if kimi -m "$1" -p "$2"; then exec kimi -c --auto; else rc=$?; echo; '
+    f'echo "[work-system] {SEED_MARKER}: kimi seed exited $rc - '
+    'TASK.md was NOT started and no session was opened."; exit $rc; fi'
 )
 
 r = kv(e.run("resolve", "--kimi").stdout)
@@ -214,17 +216,28 @@ def kv(out):
 # legitimately mentions TASK.md in its seed-failure message.
 check("prompt is not spliced into the script text", r["argv"][5] not in script)
 check("-p takes the positional as its value", '-p "$2"' in script)
-check("--auto is not in the same command as -p",
-      "--auto" not in script.split("||", 1)[0])
+check("--auto is only reachable from the SUCCESS branch (never in -p's value slot)",
+      "--auto" not in script.split("then", 1)[0])
 check("no bare -p/--prompt argv word (it stays bound inside the script)",
       "-p" not in r["argv"] and "--prompt" not in r["argv"])
-# A failed seed must neither kill the pane (`&&`) nor slip past unseen (`;`):
-# it reports, waits for a keypress, then still hands over to phase 2.
-check("seed failure is announced, not silent", "seed FAILED" in script)
-check("seed failure waits for acknowledgement", "read -r _" in script)
-check("phase 2 still runs after a failed seed (tab survives)",
-      script.rstrip().endswith("exec kimi -c --auto")
-      and "&&" not in script.split("exec", 1)[0].replace("||", ""))
+# A failed seed must be unambiguous: a stable marker, an explicit "not started", no
+# phase 2, and no wait for a keypress nobody is there to press. The marker is
+# human-facing only — see the note further down and herdr-launch.sh.
+# The literal token must NOT be in the script text: a pane echoes the command it
+# was given, so a launcher grepping that pane for the marker would "detect" a seed
+# failure the moment it typed the command — killing a healthy launch (found live).
+# The script assembles the token at runtime instead; the executed-output assertions
+# further down prove it still reaches the screen intact.
+# The marker is for the human reading the tab, not a machine signal — the launcher
+# detects a dead wrapper from process state (see herdr-launch.sh), so nothing here
+# needs to be greppable, salted, or assembled at runtime to dodge a grep.
+check("the marker is a plain literal, with no launcher-side plumbing",
+      SEED_MARKER in script and "SEED_TOKEN" not in script and "${m}_" not in script)
+check("seed failure states TASK.md was not started", "TASK.md was NOT started" in script)
+check("seed failure does not wait for input", "read " not in script)
+check("phase 2 is gated behind the seed's success",
+      script.startswith("if kimi ") and "then exec kimi -c --auto" in script)
+check("seed failure exits with the seed's own code", "exit $rc" in script)
 
 # Execute the resolved argv for real against the stub and assert what each phase
 # actually received — string checks alone can't prove the shell binds the values
@@ -241,24 +254,60 @@ def kv(out):
           "--auto" not in seed and "-y" not in seed)
     check("phase 2 is the interactive autonomous continue", cont == ["-c", "--auto"])
 
-# A FAILING seed must still reach phase 2 — the tab has to survive. Runs the real
-# argv against a stub whose non-`provider` calls exit 1 (the first stub always
-# exits 0, so this path was previously untested).
+# A FAILING seed must be a hard, self-announcing stop: marker on stdout, the
+# seed's own exit code, and NO phase 2 — an empty `kimi -c --auto` session that
+# never read TASK.md is indistinguishable from a healthy worker to herdr's
+# detection (and to the user), which is exactly the trap this replaces. Runs the
+# real resolved argv against a stub whose non-`provider` calls exit 7, so code
+# propagation is asserted on a value nothing else could produce.
 e_fail = Env()
 (Path(e_fail.env["PATH"].split(":")[0]) / "kimi").write_text(
     "#!/bin/sh\n"
     '[ -n "$KIMI_ARGLOG" ] && { printf \'%s\\t\' "$@" >> "$KIMI_ARGLOG"; '
     'printf \'\\n\' >> "$KIMI_ARGLOG"; }\n'
     'if [ "$1" = "provider" ]; then echo \'{"models": {"kimi-code/k3-256k": {}}}\'; exit 0; fi\n'
-    "exit 1\n"
+    "exit 7\n"
 )
 (Path(e_fail.env["PATH"].split(":")[0]) / "kimi").chmod(0o755)
 fail_calls = e_fail.run_argv(kv(e_fail.run("resolve", "--kimi").stdout)["argv"])
-check("a failed seed still reaches phase 2", len(fail_calls) == 2)
-if len(fail_calls) == 2:
-    check("phase 2 after a failed seed is still -c --auto", fail_calls[1] == ["-c", "--auto"])
+check("a failed seed runs the seed and NOTHING else", len(fail_calls) == 1)
+if fail_calls:
+    check("the one call was the -p seed", "-p" in fail_calls[0])
+check("no phase-2 `-c --auto` after a failed seed",
+      ["-c", "--auto"] not in fail_calls)
+check("the seed's exit code propagates out of the wrapper",
+      e_fail.last_proc.returncode == 7)
+check("the wrapper prints the machine-readable marker",
+      SEED_MARKER in e_fail.last_proc.stdout)
+check("the marker line names the failing seed's code",
+      "exited 7" in e_fail.last_proc.stdout)
 e_fail.close()
 
+# --- herdr transport metadata (modern `agent start --kind --pane`) --------- #
+# The launcher must not infer transport from a selector name or by parsing argv[0]
+# — every entry declares it. Native CLIs are `agent-start` with a kind that EQUALS
+# their argv[0] (the launcher drops that word and hands the rest to --kind); kimi's
+# wrapper is `pane-run` and carries the seed-failure marker.
+for sel, mode, kind in (("--fable", "agent-start", "claude"),
+                        ("--opus", "agent-start", "claude"),
+                        ("claude:sonnet", "agent-start", "claude"),
+                        ("--codex", "agent-start", "codex"),
+                        ("--sol", "agent-start", "codex"),
+                        ("--grok", "agent-start", "grok"),
+                        ("--kimi", "pane-run", "kimi")):
+    t = kv(e.run("resolve", sel).stdout)
+    check(f"{sel}: herdr_mode={mode}", t.get("herdr_mode") == mode)
+    check(f"{sel}: herdr_kind={kind}", t.get("herdr_kind") == kind)
+    if mode == "agent-start":
+        check(f"{sel}: argv[0] equals the declared kind (no rebuild needed)",
+              t["argv"][0] == kind)
+    else:
+        check(f"{sel}: wrapper argv[0] is NOT the kind (needs pane-run)",
+              t["argv"][0] != kind)
+# `supports` must not absorb the new trailing fields (field-order regression).
+check("supports is unchanged by the added transport columns",
+      kv(e.run("resolve", "--grok").stdout).get("supports") == "commit,pr")
+
 # canonical name and bare-cli-default selectors
 check("name selector claude:sonnet",
       kv(e.run("resolve", "claude:sonnet").stdout).get("model") == "sonnet")
diff --git a/plugins/work-system/scripts/test_herdr_launch.py b/plugins/work-system/scripts/test_herdr_launch.py
index 351d762..51d35b2 100644
--- a/plugins/work-system/scripts/test_herdr_launch.py
+++ b/plugins/work-system/scripts/test_herdr_launch.py
@@ -1,17 +1,28 @@
 #!/usr/bin/env python3
-"""Tests for herdr-launch.sh's error-diagnostics path (herdr_diag) — run
-standalone (`python3 test_herdr_launch.py`) or via check-structure.py's
-"plugin tests" check.
-
-A fake `herdr` binary on PATH returns canned JSON/text on stderr for each
-subcommand, so these tests exercise the REAL herdr-launch.sh end to end (not
-herdr_diag in isolation) against the exact integration surface skills call.
-Covers: the JSON error-schema extraction, the ws_relevant-gated + clause-
-bounded stale-workspace hint (the real w9 incident, the "unrelated clause"
-false-positive a loose AND-of-substrings would trip, case-insensitivity, and
-an ERE-metachar workspace id), the double control-byte strip (pre- AND
-post-JSON-decode, plus $ws itself), the tab-close cleanup diagnostic, and that
-the stdout key=value contract is untouched by any of this on the success path.
+"""Tests for herdr-launch.sh — run standalone (`python3 test_herdr_launch.py`) or
+via check-structure.py's "plugin tests" check.
+
+A fake `herdr` binary on PATH returns canned JSON/text per subcommand (and can
+return a DIFFERENT canned response per call, so a detection poll can change its
+answer), so these tests exercise the REAL herdr-launch.sh end to end against the
+exact integration surface skills call.
+
+Covers:
+  * error diagnostics — the JSON error-schema extraction, the ws_relevant-gated +
+    clause-bounded stale-workspace hint (the real w9 incident, the "unrelated
+    clause" false positive a loose AND-of-substrings would trip,
+    case-insensitivity, an ERE-metachar workspace id), the double control-byte
+    strip, and the tab-close cleanup diagnostic;
+  * launch API capability detection — modern (--kind/--pane), legacy
+    (--workspace/--cwd), and an unrecognizable help that must mutate NOTHING;
+  * the legacy path's unchanged sequence and stdout contract;
+  * the modern tab-create → agent-start path for claude/codex/grok, incl. exact
+    kind/pane, argv boundaries, no duplicated executable and no `pane move`;
+  * the modern pane-run path for wrapper workers (kimi): one-command delivery,
+    bounded expected-kind detection, the idle-pane death signal (process state, not
+    terminal text), wrong-kind and timeout → blocked=unverified with no retry;
+  * rollback — exactly-once tab close on definitive failures, no rollback on
+    ambiguous ones, and an unconfirmed rollback downgrading to unverified.
 """
 import json as jsonlib
 import os
@@ -25,6 +36,58 @@
 
 FAILS = []
 
+# --- canned herdr responses ------------------------------------------------ #
+MODERN_HELP = (
+    "Start a supported interactive agent in an existing pane\n\n"
+    "Usage: herdr agent start <NAME> --kind <KIND> --pane <ID> [-- [AGENT_ARG]...]\n"
+    "      --kind <KIND>\n      --pane <ID>\n      --timeout <MS>\n"
+)
+LEGACY_HELP = (
+    "Start an agent\n\n"
+    "Usage: herdr agent start <NAME> [OPTIONS] [-- [AGENT_ARG]...]\n"
+    "      --workspace <WORKSPACE_ID>\n      --cwd <PATH>\n      --no-focus\n"
+)
+UNKNOWN_HELP = "Usage: herdr agent start <NAME>\n      --wat <WAT>\n"
+
+TAB_CREATED = jsonlib.dumps({"result": {
+    "root_pane": {"pane_id": "w1:p7", "tab_id": "w1:t7"},
+    "tab": {"tab_id": "w1:t7", "label": "t"},
+}})
+AGENT_STARTED = jsonlib.dumps({"result": {"agent": {
+    "agent": "claude", "pane_id": "w1:p7", "interactive_ready": True}}})
+LEGACY_STARTED = jsonlib.dumps({"result": {"agent": {"pane_id": "w1:p5"}}})
+LEGACY_MOVED = jsonlib.dumps({"result": {"move_result": {"created_tab": {"tab_id": "w1:t9"}}}})
+# Readiness is read from WHICH processes hold the foreground, not from a process
+# group id: only the shell itself → ready, anything else → busy (see the extractor).
+SHELL_READY = jsonlib.dumps({"result": {"process_info": {
+    "shell_pid": 4242, "foreground_process_group_id": 4242,
+    "foreground_processes": [{"pid": 4242, "argv0": "zsh"}]}}})
+SHELL_BUSY = jsonlib.dumps({"result": {"process_info": {
+    "shell_pid": 4242, "foreground_process_group_id": 4242,
+    "foreground_processes": [{"pid": 4243, "argv0": "sh"},
+                             {"pid": 4242, "argv0": "zsh"}]}}})
+BUSY_ERR = jsonlib.dumps({"error": {
+    "code": "agent_pane_busy", "message": "pane w1:p7 is not at a shell prompt"}})
+NO_PANE_ERR = jsonlib.dumps({"error": {
+    "code": "agent_pane_not_found", "message": "agent target pane w1:p7 not found"}})
+
+
+def pane_get(agent=None):
+    p = {"pane_id": "w1:p7", "tab_id": "w1:t7", "agent_status": "unknown"}
+    if agent:
+        p["agent"] = agent
+        p["agent_status"] = "idle"
+    return jsonlib.dumps({"result": {"pane": p}})
+
+
+# `pane list` for herdr-teardown.sh's close-tab verification: a populated list
+# that does NOT contain w1:t7 reads as "gone" → the close is CONFIRMED.
+PANE_LIST_GONE = jsonlib.dumps({"result": {"panes": [
+    {"pane_id": "w1:p1", "tab_id": "w1:t1", "cwd": "/nowhere"}]}})
+# ...and one that still holds it reads as "still-open" → rollback unconfirmed.
+PANE_LIST_STILL = jsonlib.dumps({"result": {"panes": [
+    {"pane_id": "w1:p7", "tab_id": "w1:t7", "cwd": "/nowhere"}]}})
+
 
 def check(name, cond):
     if not cond:
@@ -35,26 +98,62 @@ def shquote(s):
     return "'" + s.replace("'", "'\\''") + "'"
 
 
-def herdr_stub(cases):
-    """Build a fake `herdr` script from {"<argv1> <argv2>": (stdout, stderr, exit)}.
+def herdr_stub(cases, help_text=None):
+    """Build a fake `herdr` from {"<argv1> <argv2>": (stdout, stderr, exit)}.
+
+    A case value may instead be a LIST of such triples: the Nth call to that
+    subcommand gets the Nth entry and the last one repeats — which is how a
+    detection poll (`pane get` returning a shell, then the worker) or a bounded
+    busy-retry is modelled.
+
+    `help_text` answers `agent start --help` before anything else, so capability
+    detection can be exercised for real instead of only via the env override.
 
     When $HERDR_ARGV_LOG is set, every call appends a `=== <subcmd>` header line
     followed by each received arg on its own line — so a test can assert the exact
     argv herdr-launch.sh execs (e.g. the worker argv after `agent start … --`)."""
-    lines = [
-        "#!/usr/bin/env bash",
+    lines = ["#!/usr/bin/env bash"]
+    if help_text is not None:
+        lines += [
+            'if [ "$1 $2" = "agent start" ] && [ "$3" = "--help" ]; then',
+            f"  printf '%s' {shquote(help_text)}",
+            "  exit 0",
+            "fi",
+        ]
+    lines += [
         'if [ -n "${HERDR_ARGV_LOG:-}" ]; then',
         '  { printf \'=== %s\\n\' "$1 $2"; printf \'%s\\n\' "$@"; } >> "$HERDR_ARGV_LOG"',
         "fi",
         'case "$1 $2" in',
     ]
-    for key, (out, err, rc) in cases.items():
+    for key, value in cases.items():
+        seq = value if isinstance(value, list) else [value]
         lines.append(f'  "{key}")')
-        if out:
-            lines.append(f"    printf '%s' {shquote(out)}")
-        if err:
-            lines.append(f"    printf '%s' {shquote(err)} >&2")
-        lines.append(f"    exit {rc}")
+        if len(seq) == 1:
+            out, err, rc = seq[0]
+            if out:
+                lines.append(f"    printf '%s' {shquote(out)}")
+            if err:
+                lines.append(f"    printf '%s' {shquote(err)} >&2")
+            lines.append(f"    exit {rc}")
+        else:
+            slug = key.replace(" ", "_")
+            lines += [
+                f'    n=$(cat "$HERDR_STUB_STATE/{slug}" 2>/dev/null || echo 0)',
+                "    n=$((n + 1))",
+                f'    printf %s "$n" > "$HERDR_STUB_STATE/{slug}"',
+                "    case $n in",
+            ]
+            for i, (out, err, rc) in enumerate(seq, start=1):
+                pat = f"{i})" if i < len(seq) else "*)"
+                lines.append(f"      {pat}")
+                if out:
+                    lines.append(f"        printf '%s' {shquote(out)}")
+                if err:
+                    lines.append(f"        printf '%s' {shquote(err)} >&2")
+                lines.append(f"        exit {rc}")
+                lines.append("        ;;")
+            lines.append("    esac")
         lines.append("    ;;")
     lines.append('  *) echo "unhandled herdr stub call: $*" >&2; exit 9 ;;')
     lines.append("esac")
@@ -63,20 +162,58 @@ def herdr_stub(cases):
 
 class Env:
     """A throwaway PATH with a fake `herdr` stub, plus a worktree dir for
-    herdr-launch.sh to target."""
+    herdr-launch.sh to target.
+
+    `api` pins $WORK_SYSTEM_HERDR_API so a test states which contract it is
+    exercising; pass api=None to let the script probe `agent start --help` for
+    real (then give the stub a `help_text`)."""
 
-    def __init__(self, cases, log_argv=False):
+    def __init__(self, cases, log_argv=False, api="legacy", help_text=None):
         self.tmp = tempfile.TemporaryDirectory()
         root = Path(self.tmp.name)
         self.worktree = root / "wt"
         self.worktree.mkdir()
+        state = root / "state"
+        state.mkdir()
         bindir = root / "bin"
         bindir.mkdir()
         herdr = bindir / "herdr"
-        herdr.write_text(herdr_stub(cases))
+        herdr.write_text(herdr_stub(cases, help_text))
         herdr.chmod(0o755)
+        # Stub the worker CLIs too, so a launch test never depends on which agents
+        # happen to be installed and authenticated on the machine running it — the
+        # registry's live probes would otherwise make these tests skip on CI and go
+        # flaky locally (a slow `grok models` alone changes the outcome).
+        for name, body in (
+            ("codex", 'if [ "$1" = "login" ]; then exit 0; fi\nexit 0\n'),
+            ("grok", 'if [ "$1" = "models" ]; then echo "grok-4.5"; fi\nexit 0\n'),
+            ("kimi", 'if [ "$1" = "provider" ]; then '
+                     "echo '{\"models\": {\"kimi-code/k3-256k\": {}}}'; fi\nexit 0\n"),
+        ):
+            stub = bindir / name
+            stub.write_text("#!/bin/sh\n" + body)
+            stub.chmod(0o755)
+        auth = root / "auth.json"
+        auth.write_text("{}\n")
         self.env = dict(os.environ)
         self.env["PATH"] = f"{bindir}:{self.env['PATH']}"
+        self.env["GROK_AUTH_FILE"] = str(auth)
+        self.env["KIMI_CREDENTIALS_FILE"] = str(auth)
+        self.env["HERDR_STUB_STATE"] = str(state)
+        # Keep every bounded wait fast and deterministic.
+        self.env["WORK_SYSTEM_HERDR_RETRY_DELAY"] = "0"
+        self.env["WORK_SYSTEM_HERDR_BUSY_TRIES"] = "3"
+        self.env["WORK_SYSTEM_HERDR_READY_TRIES"] = "3"
+        self.env["WORK_SYSTEM_HERDR_DETECT_TRIES"] = "3"
+        self.env["WORK_SYSTEM_HERDR_IDLE_STREAK"] = "2"
+        # the wall-clock half of the idle gate; the streak is what these assert
+        self.env["WORK_SYSTEM_HERDR_IDLE_MIN_SECONDS"] = "0"
+        self.env["WORK_SYSTEM_HERDR_UNKNOWN_TRIES"] = "2"
+        self.env["WORK_SYSTEM_HERDR_ALIVE_TRIES"] = "2"
+        if api is not None:
+            self.env["WORK_SYSTEM_HERDR_API"] = api
+        else:
+            self.env.pop("WORK_SYSTEM_HERDR_API", None)
         self.argv_log = root / "argv.log" if log_argv else None
         if self.argv_log is not None:
             self.env["HERDR_ARGV_LOG"] = str(self.argv_log)
@@ -87,16 +224,68 @@ def logged_argv(self):
             return []
         return self.argv_log.read_text().splitlines()
 
+    def calls(self):
+        """The recorded log as [(subcmd, [arg, ...]), ...], in call order."""
+        out, cur = [], None
+        for ln in self.logged_argv():
+            if ln.startswith("=== "):
+                cur = (ln[4:], [])
+                out.append(cur)
+            elif cur is not None:
+                cur[1].append(ln)
+        return out
+
+    def call_args(self, subcmd):
+        """Every recorded arg list for one subcommand, in order."""
+        return [args for name, args in self.calls() if name == subcmd]
+
     def run(self, *args):
         return subprocess.run(
             ["bash", str(SCRIPT), *args],
-            env=self.env, capture_output=True, text=True, timeout=20,
+            env=self.env, capture_output=True, text=True, timeout=30,
         )
 
     def close(self):
         self.tmp.cleanup()
 
 
+def kv(out):
+    """Parse the launcher's key=value stdout into a dict."""
+    d = {}
+    for line in out.splitlines():
+        if "=" in line:
+            k, v = line.split("=", 1)
+            d[k] = v
+    return d
+
+
+# A complete modern-path stub; individual tests override single keys.
+def modern_cases(**over):
+    cases = {
+        "tab create": (TAB_CREATED, "", 0),
+        "agent start": (AGENT_STARTED, "", 0),
+        "pane list": (PANE_LIST_GONE, "", 0),
+        "tab close": ('{"result":{"type":"ok"}}', "", 0),
+    }
+    cases.update(over)
+    return cases
+
+
+def wrapper_cases(**over):
+    cases = modern_cases(**{
+        "pane process-info": (SHELL_READY, "", 0),
+        "pane run": ('{"result":{"type":"ok"}}', "", 0),
+        "pane get": [(pane_get(), "", 0), (pane_get("kimi"), "", 0)],
+    })
+    cases.pop("agent start")
+    cases.update(over)
+    return cases
+
+
+# ========================================================================== #
+# error diagnostics (legacy path — unchanged behaviour)
+# ========================================================================== #
+
 # --- the real incident: agent_placement_not_found names the workspace ------ #
 e = Env({"agent start": ("", jsonlib.dumps(
     {"error": {"code": "agent_placement_not_found",
@@ -137,7 +326,7 @@ def close(self):
 
 # --- ws_relevant=0 (pane move) never gets the hint, even with the trigger code #
 e = Env({
-    "agent start": (jsonlib.dumps({"result": {"agent": {"pane_id": "w1:p5"}}}), "", 0),
+    "agent start": (LEGACY_STARTED, "", 0),
     "pane move": ("", jsonlib.dumps(
         {"error": {"code": "agent_placement_not_found", "message": "pane target gone"}}), 1),
 })
@@ -182,15 +371,91 @@ def close(self):
       "herdr tab create did not return a pane id" in r.stderr)
 e.close()
 
+# --- resume still parses a flat result.tab_id (pre-0.8 shape) -------------- #
+# The create extractor is shared with the modern launch now; its fallbacks must
+# keep working for the older response shape.
+e = Env({
+    "pane list": (jsonlib.dumps(
+        {"result": {"panes": [{"tab_id": "w1:t1", "cwd": "/nowhere"}]}}), "", 0),
+    "tab create": (jsonlib.dumps(
+        {"result": {"tab_id": "w1:t9", "root_pane": {"pane_id": "w1:p9"}}}), "", 0),
+    "pane run": ("", "", 0),
+    "tab focus": ("", "", 0),
+})
+r = e.run("resume", "t", str(e.worktree), "w1")
+check("resume: flat tab_id fallback still parses",
+      kv(r.stdout).get("tab") == "w1:t9" and kv(r.stdout).get("pane") == "w1:p9")
+check("resume: reports a fresh resume", kv(r.stdout).get("resumed") == "yes")
+e.close()
+
+
+# ========================================================================== #
+# launch API capability detection
+# ========================================================================== #
+
+# --- modern help -> tab create first, agent start --kind, no pane move ----- #
+e = Env(modern_cases(), log_argv=True, api=None, help_text=MODERN_HELP)
+r = e.run("launch", "t", str(e.worktree), "w1")
+names = [n for n, _ in e.calls()]
+check("detect modern: exit 0", r.returncode == 0)
+check("detect modern: tab create precedes agent start",
+      "tab create" in names and "agent start" in names
+      and names.index("tab create") < names.index("agent start"))
+check("detect modern: no pane move", "pane move" not in names)
+check("detect modern: agent start carries --kind",
+      any("--kind" in a for a in e.call_args("agent start")))
+e.close()
+
+# --- legacy help -> the untouched agent start --workspace + pane move ------ #
+e = Env({"agent start": (LEGACY_STARTED, "", 0), "pane move": (LEGACY_MOVED, "", 0)},
+        log_argv=True, api=None, help_text=LEGACY_HELP)
+r = e.run("launch", "t", str(e.worktree), "w1")
+names = [n for n, _ in e.calls()]
+check("detect legacy: exit 0", r.returncode == 0)
+check("detect legacy: no tab create", "tab create" not in names)
+check("detect legacy: pane move used", "pane move" in names)
+check("detect legacy: agent start carries --workspace",
+      any("--workspace" in a for a in e.call_args("agent start")))
+check("detect legacy: stdout contract unchanged",
+      r.stdout == "pane=w1:p5\ntab=w1:t9\nmoved=yes\nagent=claude\n")
+e.close()
+
+# --- a FAILED probe is not an "unrecognizable contract" -------------------- #
+# We learned nothing about the API, so the diagnostic must name the probe, not
+# accuse herdr of an unknown contract. Both still fail closed.
+e = Env(modern_cases(**{"agent start": ("", "socket closed", 1)}),
+        log_argv=True, api=None)
+r = e.run("launch", "t", str(e.worktree), "w1")
+check("probe failed: exit 1", r.returncode == 1)
+check("probe failed: diagnostic names the probe, not a missing contract",
+      "could not probe" in r.stderr and "--kind/--pane" not in r.stderr)
+check("probe failed: nothing was created", "tab create" not in [n for n, _ in e.calls()])
+e.close()
+
+# --- unrecognizable help -> fail BEFORE any mutation ----------------------- #
+e = Env(modern_cases(), log_argv=True, api=None, help_text=UNKNOWN_HELP)
+r = e.run("launch", "t", str(e.worktree), "w1")
+names = [n for n, _ in e.calls()]
+check("detect unknown: exit 1", r.returncode == 1)
+check("detect unknown: nothing on stdout", r.stdout == "")
+check("detect unknown: diagnostic names both contracts",
+      "--kind/--pane" in r.stderr and "--workspace/--cwd" in r.stderr)
+check("detect unknown: NOTHING was created or started",
+      "tab create" not in names and "agent start" not in names
+      and "pane run" not in names)
+e.close()
+
+
+# ========================================================================== #
+# legacy path (herdr 0.7.0-0.7.4) — output contract must not drift
+# ========================================================================== #
+
 # --- legacy no-selector launch: worker argv is the plugin-qualified skill --- #
 # Guards the shadowing fix: an empty selector takes the legacy path, whose worker
 # argv MUST be `claude -n <session> /work-system:continue` — the qualified form as
 # ONE argv token (a bare `/continue` would be shadowed by a CC built-in/alias).
-e = Env({
-    "agent start": (jsonlib.dumps({"result": {"agent": {"pane_id": "w1:p5"}}}), "", 0),
-    "pane move": (jsonlib.dumps(
-        {"result": {"move_result": {"created_tab": {"tab_id": "w1:t9"}}}}), "", 0),
-}, log_argv=True)
+e = Env({"agent start": (LEGACY_STARTED, "", 0), "pane move": (LEGACY_MOVED, "", 0)},
+        log_argv=True)
 r = e.run("launch", "t", str(e.worktree), "w1", "", "sess1")  # "" selector = legacy path
 argv = e.logged_argv()
 check("legacy: exit 0", r.returncode == 0)
@@ -205,11 +470,7 @@ def close(self):
 e.close()
 
 # --- success path: stdout contract untouched by any of the above ----------- #
-e = Env({
-    "agent start": (jsonlib.dumps({"result": {"agent": {"pane_id": "w1:p5"}}}), "", 0),
-    "pane move": (jsonlib.dumps(
-        {"result": {"move_result": {"created_tab": {"tab_id": "w1:t9"}}}}), "", 0),
-})
+e = Env({"agent start": (LEGACY_STARTED, "", 0), "pane move": (LEGACY_MOVED, "", 0)})
 r = e.run("launch", "t", str(e.worktree), "w1")
 check("success: exit 0", r.returncode == 0)
 check("success: stdout contract unchanged",
@@ -218,9 +479,428 @@ def close(self):
 e.close()
 
 
+# ========================================================================== #
+# modern path — native workers (herdr_mode=agent-start)
+# ========================================================================== #
+
+# --- claude (no selector), codex and grok all start through --kind --------- #
+for selector, kind, expect_head, expect_len in (
+    ("", "claude", ["-n", "sess1", "/work-system:continue"], 3),
+    # codex/grok take `-m <model> <bootstrap-prompt>`; the prompt must survive as
+    # exactly ONE word, which is what the length assertion pins down.
+    ("--codex", "codex", ["-m", "gpt-5.6-terra"], 3),
+    ("--grok", "grok", ["-m", "grok-4.5"], 3),
+):
+    started = jsonlib.dumps({"result": {"agent": {"agent": kind, "pane_id": "w1:p7"}}})
+    e = Env(modern_cases(**{"agent start": (started, "", 0)}),
+            log_argv=True, api="modern")
+    r = e.run("launch", "t", str(e.worktree), "w1", selector, "sess1")
+    label = selector or "claude(default)"
+    starts = e.call_args("agent start")
+    check(f"modern {label}: exit 0", r.returncode == 0)
+    check(f"modern {label}: stdout is the stable contract",
+          r.stdout == f"pane=w1:p7\ntab=w1:t7\nmoved=yes\nagent={kv(r.stdout).get('agent')}\n")
+    check(f"modern {label}: moved=yes (dedicated tab, no physical move)",
+          kv(r.stdout).get("moved") == "yes")
+    check(f"modern {label}: exactly one agent start", len(starts) == 1)
+    if starts:
+        a = starts[0]
+        check(f"modern {label}: --kind is exactly the declared kind",
+              a[a.index("--kind") + 1] == kind)
+        check(f"modern {label}: --pane is the tab's root pane",
+              a[a.index("--pane") + 1] == "w1:p7")
+        tail = a[a.index("--") + 1:] if "--" in a else []
+        check(f"modern {label}: the executable word is NOT repeated after --",
+              kind not in tail)
+        check(f"modern {label}: native args keep order and boundaries",
+              tail[:len(expect_head)] == expect_head and len(tail) == expect_len)
+    check(f"modern {label}: no pane move", "pane move" not in [n for n, _ in e.calls()])
+    check(f"modern {label}: tab created with --no-focus",
+          any("--no-focus" in c for c in e.call_args("tab create")))
+    e.close()
+
+# --- tab create receives the glyph-stamped label and the worktree cwd ------ #
+e = Env(modern_cases(), log_argv=True, api="modern")
+r = e.run("launch", "mylabel", str(e.worktree), "w1")
+create = e.call_args("tab create")[0]
+check("modern: tab create targets the worktree",
+      create[create.index("--cwd") + 1] == str(e.worktree))
+check("modern: tab create passes the workspace",
+      create[create.index("--workspace") + 1] == "w1")
+check("modern: agent name stays plain (no glyph)",
+      e.call_args("agent start")[0][2] == "mylabel")
+e.close()
+
+# --- agent_pane_busy is retried, bounded, and ONLY that error -------------- #
+e = Env(modern_cases(**{"agent start": [
+    ("", BUSY_ERR, 1), ("", BUSY_ERR, 1), (AGENT_STARTED, "", 0)]}),
+    log_argv=True, api="modern")
+r = e.run("launch", "t", str(e.worktree), "w1")
+check("busy retry: eventually succeeds", r.returncode == 0 and "moved=yes" in r.stdout)
+check("busy retry: retried exactly until it took", len(e.call_args("agent start")) == 3)
+check("busy retry: the tab was not rolled back", "tab close" not in [n for n, _ in e.calls()])
+e.close()
+
+# --- busy forever -> definitive: nothing started, tab rolled back ---------- #
+e = Env(modern_cases(**{"agent start": ("", BUSY_ERR, 1)}), log_argv=True, api="modern")
+r = e.run("launch", "t", str(e.worktree), "w1")
+closes = e.call_args("tab close")
+check("busy forever: exit 1", r.returncode == 1)
+check("busy forever: bounded (tries+1 attempts, no infinite loop)",
+      len(e.call_args("agent start")) == 4)
+check("busy forever: tab closed exactly once", len(closes) == 1)
+check("busy forever: the closed tab is the one we created",
+      closes and closes[0][2] == "w1:t7")
+check("busy forever: no stdout (caller shows the manual block)", r.stdout == "")
+e.close()
+
+# --- a pre-start rejection is definitive -> rollback, exit 1 --------------- #
+e = Env(modern_cases(**{"agent start": ("", NO_PANE_ERR, 1)}), log_argv=True, api="modern")
+r = e.run("launch", "t", str(e.worktree), "w1")
+check("definitive start failure: exit 1", r.returncode == 1)
+check("definitive start failure: herdr's own error is relayed",
+      "agent_pane_not_found" in r.stderr)
+check("definitive start failure: tab closed exactly once",
+      len(e.call_args("tab close")) == 1)
+check("definitive start failure: no stale-workspace hint (no --workspace sent)",
+      "is not a valid workspace" not in r.stderr)
+e.close()
+
+# --- a usage error (exit 2, plain text) is definitive too ------------------ #
+e = Env(modern_cases(**{"agent start": ("", "unsupported interactive agent kind: nope", 2)}),
+        log_argv=True, api="modern")
+r = e.run("launch", "t", str(e.worktree), "w1")
+check("usage error: exit 1", r.returncode == 1)
+check("usage error: tab closed exactly once", len(e.call_args("tab close")) == 1)
+check("usage error: the raw text is relayed", "unsupported interactive agent kind" in r.stderr)
+e.close()
+
+# --- an UNRECOGNIZED error is ambiguous: never rolled back, never retried -- #
+weird = jsonlib.dumps({"error": {"code": "agent_start_timeout", "message": "gave up waiting"}})
+e = Env(modern_cases(**{"agent start": ("", weird, 1)}), log_argv=True, api="modern")
+r = e.run("launch", "t", str(e.worktree), "w1")
+d = kv(r.stdout)
+check("ambiguous start: exit 0", r.returncode == 0)
+check("ambiguous start: blocked=unverified is the FIRST key",
+      r.stdout.startswith("blocked=unverified\n"))
+check("ambiguous start: pane/tab/agent reported for inspection",
+      d.get("pane") == "w1:p7" and d.get("tab") == "w1:t7" and d.get("agent") == "claude")
+check("ambiguous start: no moved= key (callers must branch on blocked first)",
+      "moved" not in d)
+check("ambiguous start: the tab is LEFT ALONE", "tab close" not in [n for n, _ in e.calls()])
+check("ambiguous start: tried exactly once (no retry)",
+      len(e.call_args("agent start")) == 1)
+e.close()
+
+# --- pane-id mismatch on a "successful" start is unverified, not rollback -- #
+mismatch = jsonlib.dumps({"result": {"agent": {"pane_id": "w1:pOTHER"}}})
+e = Env(modern_cases(**{"agent start": (mismatch, "", 0)}), log_argv=True, api="modern")
+r = e.run("launch", "t", str(e.worktree), "w1")
+check("pane mismatch: blocked=unverified", r.stdout.startswith("blocked=unverified\n"))
+check("pane mismatch: exit 0", r.returncode == 0)
+check("pane mismatch: names both panes", "w1:pOTHER" in r.stderr and "w1:p7" in r.stderr)
+check("pane mismatch: tab left alone (something may be running)",
+      "tab close" not in [n for n, _ in e.calls()])
+e.close()
+
+# --- a start response with NO pane id is the same mismatch case ------------ #
+e = Env(modern_cases(**{"agent start": ('{"result":{"agent":{}}}', "", 0)}), api="modern")
+r = e.run("launch", "t", str(e.worktree), "w1")
+check("missing pane id: blocked=unverified", r.stdout.startswith("blocked=unverified\n"))
+e.close()
+
+# --- partial tab create: a pane-less response must not orphan its tab ------ #
+e = Env(modern_cases(**{"tab create": (jsonlib.dumps({"result": {"tab": {"tab_id": "w1:t7"}}}), "", 0)}),
+        log_argv=True, api="modern")
+r = e.run("launch", "t", str(e.worktree), "w1")
+check("partial create: exit 1", r.returncode == 1)
+check("partial create: nothing was started", "agent start" not in [n for n, _ in e.calls()])
+check("partial create: the orphan tab is closed exactly once",
+      len(e.call_args("tab close")) == 1)
+e.close()
+
+# --- an unusable tab create (no ids at all) closes nothing ----------------- #
+e = Env(modern_cases(**{"tab create": ("", jsonlib.dumps(
+    {"error": {"code": "workspace_not_found", "message": "workspace w9 not found"}}), 1)}),
+    log_argv=True, api="modern")
+r = e.run("launch", "t", str(e.worktree), "w9")
+check("failed create: exit 1", r.returncode == 1)
+check("failed create: herdr's error is relayed", "workspace_not_found" in r.stderr)
+check("failed create: stale-workspace hint IS offered here (--workspace was sent)",
+      "HERDR_WORKSPACE_ID=w9 is not a valid workspace" in r.stderr)
+check("failed create: no tab close attempted", "tab close" not in [n for n, _ in e.calls()])
+e.close()
+
+# --- a tab created but never identified must not read as "rolled back" ----- #
+# `tab create` succeeded, its id did not parse. Claiming a clean rollback would
+# leave a blank background tab open while the caller tells the user everything was
+# undone — and the user then launches a second worker on the same worktree.
+e = Env(modern_cases(**{
+    "tab create": (jsonlib.dumps({"result": {"root_pane": {"pane_id": "w1:p7"}}}), "", 0),
+    "agent start": ("", NO_PANE_ERR, 1),
+}), log_argv=True, api="modern")
+r = e.run("launch", "t", str(e.worktree), "w1")
+check("unidentified tab: not reported as a clean failure",
+      r.returncode == 0 and r.stdout.startswith("blocked=unverified\n"))
+check("unidentified tab: says the tab could not be closed",
+      "did not return its id" in r.stderr)
+e.close()
+
+# --- a rollback that cannot be confirmed downgrades to unverified ---------- #
+e = Env(modern_cases(**{
+    "agent start": ("", NO_PANE_ERR, 1),
+    "pane list": (PANE_LIST_STILL, "", 0),   # tab still there after the close
+}), log_argv=True, api="modern")
+r = e.run("launch", "t", str(e.worktree), "w1")
+check("unconfirmed rollback: exit 0 with blocked=unverified",
+      r.returncode == 0 and r.stdout.startswith("blocked=unverified\n"))
+check("unconfirmed rollback: says the tab could not be confirmed closed",
+      "could not confirm" in r.stderr)
+check("unconfirmed rollback: still closed only once", len(e.call_args("tab close")) == 1)
+e.close()
+
+
+# ========================================================================== #
+# modern path — wrapper workers (herdr_mode=pane-run)
+# ========================================================================== #
+
+def kimi_run(cases, log_argv=True):
+    """Run a --kimi launch against a wrapper stub; returns (env, result)."""
+    env = Env(cases, log_argv=log_argv, api="modern")
+    res = env.run("launch", "t", str(env.worktree), "w1", "--kimi", "sess1")
+    check("wrapper: the stubbed kimi resolves (not an availability skip)",
+          res.returncode != 3)
+    return env, res
+
+
+# --- happy path: one pane run, then detection of the expected kind --------- #
+e, r = kimi_run(wrapper_cases())
+runs = e.call_args("pane run")
+check("wrapper: exit 0", r.returncode == 0)
+check("wrapper: stdout is the stable contract",
+      kv(r.stdout).get("moved") == "yes" and kv(r.stdout).get("pane") == "w1:p7")
+check("wrapper: exactly one pane run", len(runs) == 1)
+if runs:
+    # `pane run <PANE> <COMMAND>` — the whole wrapper must arrive as ONE word,
+    # not re-split, re-quoted or prefixed by the launcher.
+    check("wrapper: the command is a single argv word", len(runs[0]) == 4)
+    cmd = runs[0][3]
+    check("wrapper: the registry's argv_shell is sent verbatim",
+          cmd.startswith("sh -c ") and "exec kimi -c --auto" in cmd)
+    check("wrapper: no agent start on this path",
+          "agent start" not in [n for n, _ in e.calls()])
+check("wrapper: waited for the shell prompt before typing",
+      len(e.call_args("pane process-info")) >= 1)
+check("wrapper: the tab was not rolled back",
+      "tab close" not in [n for n, _ in e.calls()])
+# The supervisor must never take its signal from terminal TEXT: a pane echoes the
+# command it was given and the worker prints repository content into it.
+check("wrapper: the pane's text is never read", "pane read" not in [n for n, _ in e.calls()])
+e.close()
+
+# --- detection never sees the worker -> unverified, no retry, tab kept ----- #
+# ready first (the pre-run prompt wait), then busy — the worker is running, herdr
+# just never recognizes it.
+e, r = kimi_run(wrapper_cases(**{"pane get": (pane_get(), "", 0),
+                                "pane process-info": [(SHELL_READY, "", 0),
+                                                      (SHELL_BUSY, "", 0)]}))
+check("wrapper timeout: exit 0 with blocked=unverified",
+      r.returncode == 0 and r.stdout.startswith("blocked=unverified\n"))
+check("wrapper timeout: bounded polling", len(e.call_args("pane get")) == 3)
+check("wrapper timeout: the command was sent exactly once (no second start)",
+      len(e.call_args("pane run")) == 1)
+check("wrapper timeout: the tab is left for inspection",
+      "tab close" not in [n for n, _ in e.calls()])
+e.close()
+
+# --- a DIFFERENT kind is detected -> unverified, not success --------------- #
+e, r = kimi_run(wrapper_cases(**{"pane get": (pane_get("claude"), "", 0)}))
+check("wrapper wrong kind: blocked=unverified", r.stdout.startswith("blocked=unverified\n"))
+check("wrapper wrong kind: names what was detected",
+      "'claude'" in r.stderr and "'kimi'" in r.stderr)
+check("wrapper wrong kind: stops immediately", len(e.call_args("pane get")) == 1)
+check("wrapper wrong kind: no rollback", "tab close" not in [n for n, _ in e.calls()])
+e.close()
+
+# --- an IDLE pane with no worker is a definitive seed failure -------------- #
+# Process state, not text. And not the busy→ready transition either: measured live,
+# a wrapper that fails on startup is gone before the first poll, so its running
+# phase is never observable. The steady state is: a pane back at its own shell
+# prompt, with no agent, for IDLE_STREAK consecutive polls ⇒ nothing is running.
+e, r = kimi_run(wrapper_cases(**{
+    "pane get": (pane_get(), "", 0),
+    "pane process-info": (SHELL_READY, "", 0),
+}))
+check("idle pane: exit 1", r.returncode == 1)
+check("idle pane: says the seed failed and TASK.md was not started",
+      "seed phase failed" in r.stderr and "TASK.md was not started" in r.stderr)
+check("idle pane: tab rolled back exactly once", len(e.call_args("tab close")) == 1)
+check("idle pane: no stdout", r.stdout == "")
+e.close()
+
+# --- a running child WITHOUT its own process group still reads busy --------- #
+# Readiness must not rest on `foreground_process_group_id == shell_pid`: that
+# equality only means "idle" when job control is on. A shell started with `set +m`
+# leaves its children in the shell's own group, so the pgid test would call a
+# running wrapper idle — and the detection loop would tear its tab down.
+NO_JOB_CONTROL = jsonlib.dumps({"result": {"process_info": {
+    "shell_pid": 4242, "foreground_process_group_id": 4242,
+    "foreground_processes": [{"pid": 4242, "argv0": "sh"},
+                             {"pid": 4299, "argv0": "kimi"}]}}})
+e, r = kimi_run(wrapper_cases(**{
+    "pane get": (pane_get(), "", 0),
+    "pane process-info": [(SHELL_READY, "", 0), (NO_JOB_CONTROL, "", 0)],
+}))
+check("no job control: a running child is not idleness",
+      "tab close" not in [n for n, _ in e.calls()])
+check("no job control: reported unverified, not failed",
+      r.returncode == 0 and r.stdout.startswith("blocked=unverified\n"))
+e.close()
+
+# --- a BUSY pane is the wrapper running: never a failure ------------------- #
+# The streak must reset on anything that is not evidence of idleness, or a slow
+# worker gets torn down while it is starting.
+e, r = kimi_run(wrapper_cases(**{
+    "pane get": (pane_get(), "", 0),
+    "pane process-info": [(SHELL_READY, "", 0), (SHELL_BUSY, "", 0)],
+}))
+check("busy pane: never rolled back", "tab close" not in [n for n, _ in e.calls()])
+check("busy pane: reported unverified, not failed",
+      r.returncode == 0 and r.stdout.startswith("blocked=unverified\n"))
+e.close()
+
+# --- an UNREADABLE pane state is not evidence of idleness either ----------- #
+e, r = kimi_run(wrapper_cases(**{
+    "pane get": (pane_get(), "", 0),
+    "pane process-info": [(SHELL_READY, "", 0), ("not json", "", 0)],
+}))
+check("unreadable pane state: never rolled back",
+      "tab close" not in [n for n, _ in e.calls()])
+e.close()
+
+# --- a detected worker wins over a pane that looks idle -------------------- #
+e, r = kimi_run(wrapper_cases(**{
+    "pane get": (pane_get("kimi"), "", 0),
+    "pane process-info": (SHELL_READY, "", 0),
+}))
+check("detected worker wins: exit 0", r.returncode == 0)
+check("detected worker wins: reported as a launch", "moved=yes" in r.stdout)
+e.close()
+
+# --- the shell never reaches a prompt -> nothing typed, tab rolled back ---- #
+e, r = kimi_run(wrapper_cases(**{"pane process-info": (SHELL_BUSY, "", 0)}))
+check("wrapper shell busy: exit 1", r.returncode == 1)
+check("wrapper shell busy: nothing was typed into the pane",
+      "pane run" not in [n for n, _ in e.calls()])
+check("wrapper shell busy: tab closed exactly once",
+      len(e.call_args("tab close")) == 1)
+check("wrapper shell busy: bounded wait", len(e.call_args("pane process-info")) == 3)
+e.close()
+
+# --- an unreadable readiness answer waits out the window, then proceeds ---- #
+# "Cannot verify" is not "ready": returning on the first unreadable answer would
+# type into a pane created milliseconds ago and hand back the rc-file keystroke
+# race this wait exists to close. It spends the whole bounded window instead, and
+# only then degrades to proceeding (detection still gates success).
+e, r = kimi_run(wrapper_cases(**{"pane process-info": ("not json at all", "", 0)}))
+check("wrapper readiness unknown: still launches", r.returncode == 0)
+check("wrapper readiness unknown: the whole bounded window was spent",
+      len(e.call_args("pane process-info")) >= 3)
+check("wrapper readiness unknown: the command was still sent",
+      len(e.call_args("pane run")) == 1)
+e.close()
+
+# --- pane run itself is rejected -> definitive, tab rolled back ------------ #
+e, r = kimi_run(wrapper_cases(**{
+    "pane run": ("", jsonlib.dumps(
+        {"error": {"code": "pane_not_found", "message": "pane w1:p7 not found"}}), 1)}))
+check("wrapper run rejected: exit 1", r.returncode == 1)
+check("wrapper run rejected: tab closed exactly once",
+      len(e.call_args("tab close")) == 1)
+check("wrapper run rejected: never polled for detection",
+      "pane get" not in [n for n, _ in e.calls()])
+e.close()
+
+
+# ========================================================================== #
+# legacy path + a wrapper worker: never report a tab that already died
+# ========================================================================== #
+
+# On legacy herdr the wrapper IS the tab's root process, so a seed that exits at
+# once takes the pane — and the tab — with it. Reporting moved=yes then points the
+# user at a tab that no longer exists.
+e = Env({"agent start": (LEGACY_STARTED, "", 0), "pane move": (LEGACY_MOVED, "", 0),
+         "pane list": (PANE_LIST_GONE, "", 0)},   # populated, but w1:p5 is not in it
+        log_argv=True, api="legacy")
+r = e.run("launch", "t", str(e.worktree), "w1", "--kimi", "sess1")
+check("legacy wrapper died: exit 1", r.returncode == 1)
+check("legacy wrapper died: no moved=yes for a dead tab", "moved=yes" not in r.stdout)
+check("legacy wrapper died: says the seed failed", "seed phase failed" in r.stderr)
+e.close()
+
+# ...and a wrapper that IS alive keeps the unchanged legacy success contract.
+e = Env({"agent start": (LEGACY_STARTED, "", 0), "pane move": (LEGACY_MOVED, "", 0),
+         "pane list": (jsonlib.dumps({"result": {"panes": [
+             {"pane_id": "w1:p5", "tab_id": "w1:t9", "cwd": "/nowhere"}]}}), "", 0)},
+        log_argv=True, api="legacy")
+r = e.run("launch", "t", str(e.worktree), "w1", "--kimi", "sess1")
+check("legacy wrapper alive: stdout contract unchanged",
+      r.stdout == "pane=w1:p5\ntab=w1:t9\nmoved=yes\nagent=kimi:kimi-code/k3-256k\n")
+e.close()
+
+# An UNREADABLE herdr is not evidence of death. Calling it one would send the
+# caller down its manual path and invite a SECOND unattended worker onto the same
+# worktree — the exact hazard blocked=unverified exists to prevent.
+e = Env({"agent start": (LEGACY_STARTED, "", 0), "pane move": (LEGACY_MOVED, "", 0),
+         "pane list": ("", "socket closed", 1)}, log_argv=True, api="legacy")
+r = e.run("launch", "t", str(e.worktree), "w1", "--kimi", "sess1")
+check("legacy wrapper unverifiable: exit 0 with blocked=unverified",
+      r.returncode == 0 and r.stdout.startswith("blocked=unverified\n"))
+check("legacy wrapper unverifiable: never claims the seed failed",
+      "seed phase failed" not in r.stderr)
+e.close()
+
+# A NATIVE legacy launch must not pay for that check at all — its contract is
+# meant to stay byte-identical, and its argv cannot self-terminate on a bad seed.
+e = Env({"agent start": (LEGACY_STARTED, "", 0), "pane move": (LEGACY_MOVED, "", 0)},
+        log_argv=True, api="legacy")
+r = e.run("launch", "t", str(e.worktree), "w1", "--codex", "sess1")
+check("legacy native: no liveness probe added",
+      "pane get" not in [n for n, _ in e.calls()])
+check("legacy native: stdout contract unchanged",
+      r.stdout == "pane=w1:p5\ntab=w1:t9\nmoved=yes\nagent=codex:gpt-5.6-terra\n")
+e.close()
+
+
+# ========================================================================== #
+# defensive parsing + sibling-script resolution
+# ========================================================================== #
+
+# A `tab` field of the WRONG SHAPE must cost only that lookup, never the whole
+# parse — an unguarded `.get` on a string would throw the pane id away with it.
+e = Env(modern_cases(**{"tab create": (jsonlib.dumps(
+    {"result": {"root_pane": {"pane_id": "w1:p7"}, "tab": "w1:t7"}}), "", 0)}),
+    api="modern")
+r = e.run("launch", "t", str(e.worktree), "w1")
+check("scalar tab field: still launches", r.returncode == 0)
+check("scalar tab field: both ids survive",
+      kv(r.stdout).get("pane") == "w1:p7" and kv(r.stdout).get("tab") == "w1:t7")
+e.close()
+
+# Invoked by BARE NAME (no slash in $0), sibling helpers must still resolve — a
+# `${0%/*}`-derived path would silently disable rollback and report `unverified`
+# for a tab it never tried to close.
+e = Env(modern_cases(**{"agent start": ("", NO_PANE_ERR, 1)}), log_argv=True, api="modern")
+r = subprocess.run(["bash", SCRIPT.name, "launch", "t", str(e.worktree), "w1"],
+                   env=e.env, cwd=str(HERE), capture_output=True, text=True, timeout=30)
+check("bare-name invocation: rollback still ran", len(e.call_args("tab close")) == 1)
+check("bare-name invocation: reported as a clean failure", r.returncode == 1)
+e.close()
+
+
 if FAILS:
     print("FAIL:")
     for f in FAILS:
         print("  -", f)
     sys.exit(1)
-print("herdr-launch.sh (herdr_diag): all tests passed")
+print("herdr-launch.sh: all tests passed")
diff --git a/plugins/work-system/skills/adopt/SKILL.md b/plugins/work-system/skills/adopt/SKILL.md
index e28be2d..9109654 100644
--- a/plugins/work-system/skills/adopt/SKILL.md
+++ b/plugins/work-system/skills/adopt/SKILL.md
@@ -174,14 +174,12 @@ The Bash tool persists CWD between calls — a bare `cd .claude/worktrees/<task>
     ```
 
     This is the **same helper and call `/kickoff` uses** — the single source of truth
-    for selector resolution, argv-launch, tab-move, and exit codes. **Branch on its
-    result exactly as `skills/kickoff/SKILL.md` step 13a describes** (exit 0 `moved=yes`
-    → new background tab; `moved=no` → running as a split in *this* tab, relay the
-    helper's stderr; the `OFFER_DEFAULT=yes` → `bash "$REG" default set "<agent>"`
-    persistence after a successful launch; exit 2 unknown selector → re-offer the
-    picker; exit 3 unavailable agent → report `unavailable=`/`note=` verbatim, re-offer;
-    other non-zero → relay stderr, then the manual block). Do not re-implement that
-    branching here — following one copy keeps adopt and kickoff from drifting.
+    for selector resolution, the herdr launch transport, rollback, and exit codes.
+    **Read `skills/kickoff/SKILL.md` step 13a and follow its result branching in the
+    order given there** — every outcome, including the `OFFER_DEFAULT=yes` persistence
+    rule. Do **not** restate that list here: a second prose copy of the launcher's
+    outcome contract is exactly what drifts when the helper grows an outcome, and a
+    stale copy would act on a launch the helper never confirmed.
 
     Success report (adopt keeps the *adopted* branch name — use `<current-branch-name>`,
     which is `task/<task-name>` only if step 8 renamed it):
diff --git a/plugins/work-system/skills/close/SKILL.md b/plugins/work-system/skills/close/SKILL.md
index 9bf15c2..7bfe5a9 100644
--- a/plugins/work-system/skills/close/SKILL.md
+++ b/plugins/work-system/skills/close/SKILL.md
@@ -338,15 +338,18 @@ Rules:
        an **idle** prompt, the state in which it exits cleanly (verified live), never
        mid-turn. (`herdr pane run "/exit"` does nothing to Claude's TUI and `ctrl+d`
        doesn't exit either — only `send-text "/exit"` + `Return` onto an idle prompt
-       works, which is what the injector does.) Claude's clean exit **auto-closes**
-       its (root-pane) tab; the marker + `SessionEnd` hook from step 2 are the backup
-       for sessions whose tab does not auto-close (e.g. Claude launched inside a
-       shell pane).
+       works, which is what the injector does.) What closes the **tab** is the marker
+       + `SessionEnd` hook from step 2 — do not assume the exit alone does it. On
+       herdr 0.7.5+ `/kickoff` starts the worker **inside a shell pane** (herdr's
+       `agent start` requires an existing pane), so a clean exit drops back to that
+       shell and the tab stays open; only on legacy herdr, where the worker was the
+       tab's root process, does the exit also auto-close the tab. The hook covers
+       both, which is why step 2 is not optional.
        - **B-hook (fallback):** if `self-exit` can't run (`herdr` injection
          unavailable / non-zero exit), do **not** inject — tell the user: "Cleanup
          done, main tab focused — press **Ctrl+D** (or type `/exit`) to close this
-         finished tab (`$WT_TAB`)." The same auto-close + hook tear it down on that
-         manual clean exit. Never defer a tab-close to a SIGHUP/idle kill — that
+         finished tab (`$WT_TAB`)." The armed marker + hook tear it down on that
+         manual clean exit (and on legacy herdr the root-pane exit does too). Never defer a tab-close to a SIGHUP/idle kill — that
          risks a corrupt transcript / broken `--resume`. (This line already names the
          tab, so item 5 does **not** apply to the B-hook path.)
     5. **After B-inject, name the tab (verification fallback).** A self-close fires
diff --git a/plugins/work-system/skills/continue/SKILL.md b/plugins/work-system/skills/continue/SKILL.md
index 8e4dbc9..696a9fb 100644
--- a/plugins/work-system/skills/continue/SKILL.md
+++ b/plugins/work-system/skills/continue/SKILL.md
@@ -19,8 +19,10 @@ user_invocable: true
   progress; keep working here. (Steps 1–7 under "In-session resume".)
 - **From the main session with a `<task>` argument** → *reopen*: open the task's
   herdr tab at its worktree and resume its Claude session there (`claude -c`), then
-  focus it — recovering a task tab that a bare `/exit` closed (kickoff tabs run
-  Claude as the root pane, so `/exit` closes them). ("Reopen mode" below.)
+  focus it — recovering a task tab that a bare `/exit` closed (on legacy herdr the
+  worker IS the tab's root pane, so `/exit` closes the tab; on herdr 0.7.5+ it runs
+  inside a shell pane, so `/exit` leaves a bare shell there instead). ("Reopen mode"
+  below.)
 
 **Pick the mode first.** Resolve names through `task-status.sh` so a `task/`-prefixed
 or aliased argument is normalized the SAME way worktree directories are named (they use
diff --git a/plugins/work-system/skills/kickoff/SKILL.md b/plugins/work-system/skills/kickoff/SKILL.md
index 9c22680..78941a5 100644
--- a/plugins/work-system/skills/kickoff/SKILL.md
+++ b/plugins/work-system/skills/kickoff/SKILL.md
@@ -193,35 +193,47 @@ is a per-repo committed file (`.claude/work-system-agent`), set via
     bash "${CLAUDE_PLUGIN_ROOT}/scripts/herdr-launch.sh" launch "$LABEL" "$WORKTREE" "$HERDR_WORKSPACE_ID" "$SELECTOR"
     ```
 
-    The helper resolves `SELECTOR` through the registry and spawns the worker as
-    **argv** (`herdr agent start … -- <resolved worker argv>`) — execing the binary
-    directly instead of typing into a fresh shell, which structurally avoids the
-    shell-startup keystroke race — then moves the agent into its own background tab.
-    It is the **single source of truth** for the launch (resolution, robust JSON
-    parsing, graceful fallback, exit codes); do not re-implement the herdr commands
-    or the resolution inline. Branch on its result:
+    The helper resolves `SELECTOR` through the registry, feature-detects which
+    `agent start` contract this herdr speaks, and opens the worker's own background
+    tab — on herdr 0.7.5+ by creating the tab first and starting the worker in its
+    root pane, on older herdr by spawning the agent and moving it. Either way the
+    worker never has to survive a shell-startup keystroke race. It is the **single
+    source of truth** for the launch (resolution, transport, robust JSON parsing,
+    rollback, exit codes); do not re-implement the herdr commands or the resolution
+    inline. Branch on its result **in this order**:
+    - **exit 0 with `blocked=unverified` (check this FIRST)** → a tab exists and
+      something may be running in it, but the launch could not be confirmed (the
+      worker never became detectable, herdr returned an error the helper cannot
+      classify, the pane id did not match, or a rollback could not be verified).
+      Report `pane=`/`tab=`/`agent=` and tell the user to **switch to that tab and
+      look** before doing anything else. Do **not** re-run the launch, do **not**
+      print the manual worker command, and do **not** save a project default — all
+      three would risk a second worker on the same worktree. Relay the helper's
+      stderr, which says what could not be confirmed.
     - **exit 0 with `moved=yes`** → the task is running in its own background tab
       (`tab=<id>`) with worker `agent=<cli:model>`. Report success (template below).
-    - **exit 0 with `moved=no`** → the worker started but the tab move failed, so it
-      is running as a split in *this* session's tab — tell the user it's here, not in
-      a new tab. The helper's stderr for this call carries herdr's own error
-      (code/message) ahead of its own generic line — **relay that stderr text to the
-      user**, not just "the move failed." (This call never sends `--workspace`, so
+    - **exit 0 with `moved=no`** (legacy herdr only) → the worker started but the tab
+      move failed, so it is running as a split in *this* session's tab — tell the user
+      it's here, not in a new tab. The helper's stderr for this call carries herdr's own
+      error (code/message) ahead of its own generic line — **relay that stderr text to
+      the user**, not just "the move failed." (This call never sends `--workspace`, so
       unlike the failure below there is no stale-workspace hint to expect here.)
-    - **After a successful launch (either `moved=` value), if `OFFER_DEFAULT=yes`**
-      (the picker path, user chose to save): `bash "$REG" default set "<agent>"`
-      (the `agent=` value) to write the repo's committed default. Mention it, and
-      that it's an uncommitted change to `.claude/work-system-agent` to commit when
-      ready. Skip on any non-zero launch (don't persist a default that didn't run).
+    - **After a confirmed launch (a `moved=` line, never on `blocked=unverified`), if
+      `OFFER_DEFAULT=yes`** (the picker path, user chose to save):
+      `bash "$REG" default set "<agent>"` (the `agent=` value) to write the repo's
+      committed default. Mention it, and that it's an uncommitted change to
+      `.claude/work-system-agent` to commit when ready. Skip on any non-zero launch
+      (don't persist a default that didn't run).
     - **exit 2** → unknown/invalid selector. Tell the user and re-offer the picker.
     - **exit 3** → the chosen agent is unavailable (stdout `unavailable=<name>` +
       `note=<hint>`). Report it verbatim (e.g. "codex not ready — run: codex login")
       and re-offer the picker or another selector. Nothing was spawned.
     - **other non-zero exit** → the helper could not automate (herdr/python3 missing,
-      broken socket, or no pane id). **Relay the helper's stderr to the user first**
-      — on a broken-socket/no-pane-id failure it carries herdr's own error
-      (code/message, and a stale-workspace hint when applicable), the actual reason
-      this happened, not just the generic guard text. Then show the manual block (b).
+      an unrecognizable `agent start` contract, a broken socket, or no pane id) — and
+      whatever it did create it has already rolled back. **Relay the helper's stderr to
+      the user first** — it carries herdr's own error (code/message, and a
+      stale-workspace hint when applicable), the actual reason this happened, not just
+      the generic guard text. Then show the manual block (b).
 
     Success report (fill `Tab` from the helper's `tab=` line, `Agent` from `agent=`):
     ```