fleetd #726 unit 2: cover the bootstrapText relaunch send with a dedicated test

LeadRollover already sends every call through the lead-bound AgentControl and
WorkspaceControl it receives at construction, so no production code needed a
routing fix. Add a regression test that drives a full relaunch to the point
where recognition times out and asserts bootstrapText still lands on the lead
daemon and never on the member daemon, the one path the existing assembly test
never reaches.

fleetd/src/test/java/dev/ltms/fleet/FleetdLeadRolloverAssemblyTest.java

@@ -179,6 +179,42 @@ class FleetdLeadRolloverAssemblyTest {
         return FleetConfig.load(f);
     }
 
+    /**
+     * Unlike {@link #writeConfig}, this names a {@code profile:} for the lead and declares it
+     * under {@code profiles:}, so {@code LeadLauncher#relaunch} can actually start a fresh agent
+     * instead of refusing with "names no profile". {@code relaunchReadySeconds} is cut to 2s so
+     * the recognition wait (expected to time out — see the test) does not cost real test seconds.
+     */
+    private static FleetConfig writeConfigWithRelaunchableLead(Path dir, Path leadCwd) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                herdrSocket: "%s"
+                memberHerdrSocket: "%s"
+                idleSleepGuard:
+                  enabled: false
+                broker:
+                  uri: "amqp://fake-test-broker/vh"
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead: opus"
+                      cwd: "%s"
+                      profile: opus
+                profiles:
+                  opus:
+                    subscription: true
+                    argv: ["ccs", "opus"]
+                leadRollover:
+                  handoverPath: handover.md
+                  requireOperatorConfirm: false
+                  relaunchReadySeconds: 2
+                """.formatted(LEAD_SOCKET, MEMBER_SOCKET, leadCwd.toString()));
+        return FleetConfig.load(f);
+    }
+
     @Test
     @DisplayName("[BEHAVIOURAL] the real assembled LeadRollover runs the open/confirm/continuation "
             + "sequence through the real herdr router — ending the old pane, then giving up once it "
@@ -258,6 +294,72 @@ class FleetdLeadRolloverAssemblyTest {
                 + member.calls.size() + " call(s) on the MEMBER daemon instead: " + member.calls);
     }
 
+    /**
+     * Exercises the relaunch site {@link #assembledLeadRolloverEndsTheOldPaneThroughTheRealHerdrRouter}
+     * never reaches: with the old pane confirmed gone, the roll relaunches a fresh lead, and
+     * {@code bootstrapText} must reach it even though recognition times out (FakeHerdr's
+     * {@code tab.list} is a fixed canned response that never reflects the relaunch's own
+     * {@code tab.rename}, so the fresh terminal is never recognised as a live lead). Same
+     * dual-socket shape as the sibling test: two distinct {@link FakeHerdr} instances, so a
+     * {@code bootstrapText} send wired to the wrong daemon is visible.
+     */
+    @Test
+    @DisplayName("[BEHAVIOURAL] bootstrapText reaches the fresh LEAD terminal even when recognition "
+            + "times out, and the MEMBER daemon never sees it")
+    void bootstrapTextReachesTheFreshLeadTerminalEvenWhenRecognitionTimesOut(@TempDir Path dir) throws Exception {
+        Path leadCwd = dir.resolve("lead-workspace");
+        Files.createDirectories(leadCwd);
+        FleetConfig cfg = writeConfigWithRelaunchableLead(dir, leadCwd);
+        ConfigRef config = new ConfigRef(dir.resolve("fleetd.yaml"), cfg);
+        SubscriptionGuard guard = new SubscriptionGuard(cfg.guard().hostSet());
+        RecordingResourcePorts ports = new RecordingResourcePorts();
+        FakeHerdr lead = new FakeHerdr();
+        lead.withTab("w2", "w2:t7", "lead: opus");
+        // Lets the old pane (w2:p7) report gone once pane.close actually reaches it, so the roll
+        // proceeds to relaunch instead of stopping at OLD_PANE_NEVER_DIED.
+        lead.paneGoneAfterClose("w2:p7");
+        FakeHerdr member = new FakeHerdr();
+        ports.herdrsBySocket.put(LEAD_SOCKET, lead);
+        ports.herdrsBySocket.put(MEMBER_SOCKET, member);
+
+        FleetdRuntime runtime = FleetdAssembly.assembleAndStart(new AssemblyInputs(cfg, config, guard), ports);
+
+        LeadRollover rollover = runtime.mcp().leadRollover();
+        assertNotNull(rollover, "leadRollover: is present in this test's config, so a real "
+                + "LeadRollover must have been built");
+
+        LeadRollover.PendingRollover pending = rollover.open("term_a", "bootstrapText relaunch test");
+        Thread.sleep(50);
+        Files.writeString(Path.of(pending.handoverPath()), "handover content for bootstrapText test");
+
+        LeadRollover.RollDecision decision = rollover.confirm("term_a", pending.token(), true);
+        assertTrue(decision.accepted(), "confirm() must approve — got: " + decision);
+
+        LeadRollover.RollStatus status = pollUntilTerminal(rollover, pending.token());
+        assertEquals(LeadRollover.RollState.RELAUNCH_NOT_RECOGNISED, status.state(),
+                "the fresh terminal is never recognised against this fake's static tab.list, so the "
+                        + "roll must reach RELAUNCH_NOT_RECOGNISED — not an earlier failure state and "
+                        + "not ROLLED — detail: " + status.detail());
+
+        @SuppressWarnings("unchecked")
+        List<FakeHerdr.Call> leadPrompts = lead.calls.stream()
+                .filter(c -> c.method().equals("agent.prompt"))
+                .toList();
+        assertEquals(1, leadPrompts.size(), "exactly one bootstrapText send is expected, on the LEAD "
+                + "daemon, once recognition gives up — got: " + leadPrompts);
+        Object text = ((Map<String, Object>) leadPrompts.get(0).params()).get("text");
+        assertTrue(text instanceof String && ((String) text).contains("handover.md"),
+                "the send must be bootstrapText naming the resolved handover path, got: " + text);
+
+        // Scoped to agent.prompt specifically, not every MEMBER call: the orphan-worker reap also
+        // talks to the MEMBER daemon once, unconditionally, at daemon boot — unrelated to this roll.
+        List<FakeHerdr.Call> memberPrompts = member.calls.stream()
+                .filter(c -> c.method().equals("agent.prompt"))
+                .toList();
+        assertTrue(memberPrompts.isEmpty(), "bootstrapText must never be sent to the MEMBER daemon, "
+                + "got: " + memberPrompts);
+    }
+
     private static LeadRollover.RollStatus pollUntilTerminal(LeadRollover rollover, String token)
             throws InterruptedException {
         long deadline = System.nanoTime() + java.util.concurrent.TimeUnit.SECONDS.toNanos(15);