fleetd #114: delete the drifted tool catalogue, keep the flows, guard the names

docs/MCP-Contract.md was written 2026-07-14, before any MCP code existed,
and never caught up. CLAUDE.md points every session in the fleet at it.

Audited against the code today. The drift was not confined to the tool
table the ticket reported:

  section 3  still described the OLD identity rule - "any connection that
             does not map to a known worker is treated as a primary".
             That was a real privilege bug, fixed since by the ancestry
             walk in #161. The page still taught it.
  section 4  names port 8080 (the mount is 8765) and says the pom does
             not yet carry an MCP dependency.
  section 5  named fleet_read and fleet_cancel, which do not exist, and
             omitted fleet_poll, fleet_ack, fleet_profiles, fleet_whoami
             and fleet_list, which do.
  section 8  says turn_id where the code says turnId, and has no row for
             the exhausted outcome CB-578 added.
  sections
  9, 10, 11  pre-build planning: "new work" columns, open decisions long
             since decided, CB-1xx placeholders.

Every one of those is the same defect: a hand-maintained second copy of
something the code already states. So the copy is deleted rather than
corrected - correcting it just restarts the clock.

What survives is the flows and the status gating, because a flow is a
shape rather than a name, and shapes are what this page was ever good
for. They are rewritten with the names checked against the code, and
extended with what has been learned since: the ~60s cap on a blocking
send, the ~55s ask window, and the three ways the turn-done fallback
loses a report (clipped, echoed brief, slow member).

389 lines -> 188.

The names that remain are guarded. McpContractDocTest fails if the page
names a fleet_* tool FleetMcp does not register, and - because an empty
set is a subset of everything - a second test pins that both sides
actually found names, so the check cannot pass by checking nothing. A
third pins the "this is not the tool reference" sentence, which is the
fix itself: without it someone helpfully re-adds a tool table.

Mutation-tested both ways, 0 compile errors each: adding `fleet_read` to
the doc fails theDocNamesNoToolThatDoesNotExist ("names [fleet_read] ...
Checked 6 name(s)"); removing the disclaimer fails
theDocStillDisclaimsBeingTheToolReference.

All 5 mermaid diagrams render under mermaid-cli.

CLAUDE.md's pointer said "section 6 only" and now names the guard
instead. It is in the project addendum, so the canonical block is
untouched - verified still byte-identical with the wiki template.

REST is split out to #252: 14 routes, documented nowhere, and it IS a
supported operator surface - one of them drains on read.

1232 tests, 0 failures.

fleetd/src/test/java/dev/ltms/fleet/mcp/McpContractDocTest.java

@@ -0,0 +1,121 @@
+package dev.ltms.fleet.mcp;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.LinkedHashSet;
+import java.util.Set;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #114 (CB-609): the guard that lets {@code docs/MCP-Contract.md} name a tool at all.
+ *
+ * <p>That page was written in July 2026, before any MCP code existed, and then did not follow the
+ * code. By August it named two tools that had never been built, omitted five that shipped, had the
+ * wrong name for nearly every parameter, and still described a caller-identity rule that was a
+ * privilege bug by then. Nothing failed, because nothing checked it — and {@code CLAUDE.md} sends
+ * every session in the fleet to that page.
+ *
+ * <p>The fix was to delete the tool catalogue rather than correct it: a hand-maintained second copy
+ * of the tool surface is the defect, not the particular errors it had accumulated. What survives is
+ * the flows, which are shapes rather than names. But the flows still have to say {@code fleet_send}
+ * somewhere to be readable, and that is exactly the sentence that rots. This test is what makes it
+ * safe to write.
+ *
+ * <p><b>It checks source text, not behaviour.</b> It reads the Markdown and reads {@link FleetMcp}'s
+ * source, and it only catches a name in the doc that the server does not register. It cannot catch a
+ * flow that describes the wrong order, or a parameter name in prose — those are not name-shaped. The
+ * doc's own header carries that caveat for its readers.
+ */
+class McpContractDocTest {
+
+    /** Tests run with the module directory as cwd, so the repo-root doc is one level up. */
+    private static final Path DOC = Path.of("../docs/MCP-Contract.md");
+    private static final Path MCP_SOURCE = Path.of("src/main/java/dev/ltms/fleet/mcp/FleetMcp.java");
+
+    private static Set<String> matches(Path file, String regex) throws Exception {
+        Matcher m = Pattern.compile(regex).matcher(Files.readString(file));
+        Set<String> found = new LinkedHashSet<>();
+        while (m.find()) {
+            found.add(m.group(1));
+        }
+        return found;
+    }
+
+    /** Every {@code fleet_*} the doc mentions, in prose or in a diagram. */
+    private static Set<String> toolsNamedInTheDoc() throws Exception {
+        return matches(DOC, "(fleet_[a-z_]+)");
+    }
+
+    /** Every tool {@link FleetMcp} actually registers, read from its {@code tool("…")} calls. */
+    private static Set<String> toolsTheServerRegisters() throws Exception {
+        return matches(MCP_SOURCE, "tool\\(\"(fleet_[a-z_]+)\"");
+    }
+
+    @Test
+    @DisplayName("[SOURCE TEXT] every fleet_* tool named in MCP-Contract.md is one the server registers")
+    void theDocNamesNoToolThatDoesNotExist() throws Exception {
+        Set<String> registered = toolsTheServerRegisters();
+        Set<String> named = toolsNamedInTheDoc();
+
+        Set<String> unknown = new LinkedHashSet<>(named);
+        unknown.removeAll(registered);
+
+        assertTrue(unknown.isEmpty(),
+                "docs/MCP-Contract.md names " + unknown + ", which FleetMcp does not register. "
+                        + "Checked " + named.size() + " name(s) in the doc against " + registered.size()
+                        + " registered tool(s): " + registered + ". This is the fleetd #114 defect "
+                        + "recurring — the doc named fleet_read and fleet_cancel for weeks after the "
+                        + "code shipped without them. Either fix the name or drop it from the page; do "
+                        + "NOT weaken this test.");
+    }
+
+    /**
+     * The denominator guard. The check above passes trivially if the doc stops naming any tool at
+     * all — an empty set is a subset of everything. A checker that can silently check nothing is the
+     * fleetd #113 shape, so this pins that the doc really is still describing the flows, and that
+     * the registration scrape really did find the server's tools.
+     */
+    @Test
+    @DisplayName("[SOURCE TEXT] the doc/server name check is not vacuous — both sides found names")
+    void theCheckActuallyHasSomethingToCheck() throws Exception {
+        Set<String> registered = toolsTheServerRegisters();
+        Set<String> named = toolsNamedInTheDoc();
+
+        assertTrue(registered.size() >= 10,
+                "scraped only " + registered.size() + " tool registrations from FleetMcp (" + registered
+                        + "); the server registers eleven, so the tool(\"…\") scrape has stopped matching "
+                        + "and the check above is now vacuous");
+        assertTrue(named.size() >= 4,
+                "docs/MCP-Contract.md names only " + named.size() + " fleet_* tool(s) (" + named + "). "
+                        + "The flows describe delegation, clarification, detached delivery and the "
+                        + "turn-done fallback, so it should name several. Too few means the page has been "
+                        + "gutted and this test is guarding nothing.");
+    }
+
+    /**
+     * fleetd #114's actual lesson. The catalogue was deleted on purpose; a well-meaning "let me just
+     * document the tools here" restores the exact second copy that drifted for a month.
+     */
+    @Test
+    @DisplayName("[SOURCE TEXT] MCP-Contract.md still says it is not the tool reference")
+    void theDocStillDisclaimsBeingTheToolReference() throws Exception {
+        String doc = Files.readString(DOC);
+        assertTrue(doc.contains("**What this page is NOT: a tool reference.**"),
+                "docs/MCP-Contract.md must keep saying it is not the tool reference. That sentence is "
+                        + "the fix for fleetd #114: the page carried a hand-maintained tool catalogue that "
+                        + "drifted from the code for a month while CLAUDE.md pointed every session at it.");
+        assertEquals(0, countTables(doc.substring(0, doc.indexOf("## 1. Rendezvous flows"))),
+                "the header of docs/MCP-Contract.md must not grow a tool/parameter table — that is the "
+                        + "second copy fleetd #114 deleted");
+    }
+
+    private static int countTables(String markdown) {
+        return (int) markdown.lines().filter(l -> l.strip().startsWith("|")).count();
+    }
+}