CB-588 follow-up: reclaim a pruned ticket's pendingTickets entry too

tasks is the sole authority on whether a ticket exists, but
pruneTerminalTickets dropped entries from it without telling
ReplyPushLoop. ticketCollected(ticket) was only ever called from
MessageService.poll's terminal branch, which pruneTerminalTickets
short-circuits past once a ticket is gone (poll returns null at the
top). A ticket the lead never polled — or one the reminder cap already
gave up on — was pruned from tasks but never collected in
ReplyPushLoop.pendingTickets, so it rode along on every later nudge to
the same lead forever, naming a ticket bridge_poll could no longer
find, and the map itself never shrank.

pruneTerminalTickets now calls pushLoop.ticketCollected for every
ticket it actually removes (guarded on pushLoop != null), so a pending
nudge entry lives exactly as long as its ticket is pollable. Reused
tasks as the only removal trigger rather than adding a second live
query back into MessageService — no new source of truth.

Added an injectable clock (LongSupplier nowNanos, defaulting to
System::nanoTime) to MessageService, mirroring the SessionManager/
SessionReaper nowNanos seam, so a test can cross the 10-minute
TICKET_TTL_NANOS deterministically instead of sleeping for real.
Confirmed the new regression test fails against the prior
pruneTerminalTickets (a stale ticket rides along on a later coalesced
nudge) before restoring the fix.

bridged/src/test/java/dev/ltms/bridged/msg/MessageServiceTest.java

@@ -733,13 +733,18 @@ class MessageServiceTest {
     }
 
     private PushWiring wireWithPushLoop(int maxReminders, long backoffMs) {
+        return wireWithPushLoop(maxReminders, backoffMs, System::nanoTime);
+    }
+
+    /** As above, with an injectable clock (CB-588 follow-up: exercise pruneTerminalTickets' TTL). */
+    private PushWiring wireWithPushLoop(int maxReminders, long backoffMs, java.util.function.LongSupplier nowNanos) {
         PrimaryRegistry registry = new PrimaryRegistry(null);
         registry.recordDelegation(T, LEAD);
         FakeHerdr leadHerdr = new FakeHerdr();
         AgentControl leadAgents = new AgentControl(leadHerdr);
         var scheduler = java.util.concurrent.Executors.newSingleThreadScheduledExecutor();
         ReplyPushLoop pushLoop = new ReplyPushLoop(registry, leadAgents, inbox, scheduler, maxReminders, backoffMs);
-        MessageService service = new MessageService(agents, injector, rendezvous, inbox, pushLoop);
+        MessageService service = new MessageService(agents, injector, rendezvous, inbox, pushLoop, null, nowNanos);
         return new PushWiring(service, leadHerdr, scheduler);
     }
 
@@ -840,6 +845,62 @@ class MessageServiceTest {
         assertEquals("async result", view.reply());
     }
 
+    /**
+     * CB-588 follow-up: {@code tasks} is the sole authority on whether a ticket exists, and
+     * {@code pruneTerminalTickets} drops entries from it once {@link MessageService#TICKET_TTL_NANOS}
+     * elapses. Before this test, that prune never told {@code ReplyPushLoop} — its own
+     * {@code pendingTickets} entry for a pruned, never-collected ticket had no remover at all, so it
+     * rode along on every later nudge to the same lead, naming a ticket {@code bridge_poll} could no
+     * longer find. Uses the injectable clock (mirroring {@code SessionManager}'s {@code nowNanos} seam
+     * for its idle reaper) to cross the 10-minute TTL without a real wait.
+     */
+    @Test
+    void aPrunedTicketIsReclaimedFromThePushLoopNotLeakedForever() throws Exception {
+        java.util.concurrent.atomic.AtomicLong clock = new java.util.concurrent.atomic.AtomicLong(1_000_000_000L);
+        // maxReminders=1 + a short backoff: the stale ticket gets its one legitimate reminder, then
+        // decideTickets hits the cap and STOPs — activeLeads drops the lead, but (before the fix)
+        // pendingTickets never drops the ticket. That is the exact "cap already STOPped" branch of
+        // the bug report, reached deterministically rather than by timing it against a live tick.
+        try (var wiring = wireWithPushLoop(1, 50, clock::get)) {
+            String stale = wiring.service().sendAsync(T, "first task");
+            awaitWaiting();
+            injectDelivery();
+            assertTrue(rendezvous.resolve(T, "stale result"));
+
+            // Let the reminder loop fire its one nudge and hit the cap (STOP removes it from
+            // activeLeads; pendingTickets is untouched either way — that asymmetry is the bug).
+            awaitNudge(wiring.leadHerdr());
+            Thread.sleep(300);
+            assertTrue(wiring.leadHerdr().lastCall("agent.prompt").params().toString().contains(stale),
+                    "sanity: the stale ticket's own reminder must have fired first");
+
+            // Cross the TTL — a real clock would need 10 minutes; the injected one does it instantly.
+            clock.addAndGet(MessageService.TICKET_TTL_NANOS + TimeUnit.SECONDS.toNanos(1));
+
+            // A second, unrelated ticket to the same target/lead reaches sendAsync, which prunes.
+            String fresh = wiring.service().sendAsync(T, "second task");
+            awaitWaiting();
+            injectDelivery();
+            assertTrue(rendezvous.resolve(T, "fresh result"));
+
+            // The fresh ticket restarts the (now-dormant) reminder loop with its own nudge.
+            long before = wiring.leadHerdr().calls.stream().filter(c -> c.method().equals("agent.prompt")).count();
+            long deadline = System.currentTimeMillis() + 3000;
+            while (wiring.leadHerdr().calls.stream().filter(c -> c.method().equals("agent.prompt")).count() <= before
+                    && System.currentTimeMillis() < deadline) {
+                Thread.sleep(10);
+            }
+            String latestNudge = wiring.leadHerdr().lastCall("agent.prompt").params().toString();
+            assertTrue(latestNudge.contains(fresh), "the fresh ticket's nudge must still arrive: " + latestNudge);
+            assertFalse(latestNudge.contains(stale),
+                    "a pruned ticket must never be named in a later nudge — it is gone and bridge_poll "
+                            + "on it would return nothing: " + latestNudge);
+
+            // And bridge_poll(ticket=stale) really does return nothing now — the nudge would have lied.
+            assertNull(wiring.service().poll(stale), "the pruned ticket must actually be gone, not just unmentioned");
+        }
+    }
+
     private MessageService.TaskView awaitTicketPhaseOn(MessageService svc, String ticket,
             MessageService.Phase phase) throws Exception {
         long deadline = System.currentTimeMillis() + 3000;